joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e460
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
mov eax, dword [0x4630b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x113]
xor ebx, ebx
push 0x103
push ebx
push eax
mov dword [0x467b30], ebx
mov byte [ebp - 0x114], bl
call fcn.00434f70
push 0x15c
lea eax, [ebp - 0x270]
mov dword [ebp - 8], ebx
xorps xmm0, xmm0
mov dword [ebp - 0x274], ebx
push ebx
push eax
movq qword [ebp - 0x10], xmm0
call fcn.00434f70
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
add esp, 0x18
mov dword [ebp - 0x278], ebx
mov dword [ebp - 0x27c], ebx
push 0xffffffffffffffff
push ebx
push 1
push 0x1002
push dword [0x467b40]
call esi
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_Remove]
push ebx
push ebx
push 0x1009
push dword [0x467b40]
call esi
push ebx
push ebx
push 0x1009
push dword [0x467b44]
call esi
lea eax, [ebp - 0x114]
push eax
call fcn.00428e00
add esp, 4
test eax, eax
je 0x41e679
nop
push 0x160
lea eax, [ebp - 0x274]
push 0
push eax
call fcn.00434f70
inc ebx
call fcn.00428c50
push eax
push ebx
push str.Building_process_list..._d_of__d
push 0x467800
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x1c
push 0x467800
push 0
push 0x401
push dword [0x467ba0]
call esi
test edi, edi
je 0x41e577
push 0x467800
push 0x472
push edi
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
cmp dword [ebp - 0xc], 0
lea eax, [ebp - 0x114]
push eax
push 0x467908
je 0x41e596
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [0x467b38]
jmp 0x41e5e5
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push 0x467908
call dword [sym.imp.USER32.dll_CharLowerBuffA]
push 0x4101
push 0x160
lea eax, [ebp - 0x274]
push eax
push 0x80
push 0x467908
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov eax, dword [ebp - 0x274]
test eax, eax
cmove eax, dword [0x467b38]
push eax
push 0xffffffffffffffff
push dword [0x467ba8]
mov dword [0x467b3c], eax
call dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
push dword [0x467b3c]
mov esi, eax
call dword [sym.imp.USER32.dll_DestroyIcon]
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x278]
push eax
push dword [ebp - 0x10]
call fcn.00428cb0
push 1
push dword [ebp - 8]
push esi
push dword [ebp - 0x27c]
push dword [ebp - 0x278]
push dword [ebp - 0x10]
push 0x467908
push dword [0x467b40]
call fcn.0041de80
inc dword [0x467b30]
add esp, 0x2c
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 1
push 0x115
push dword [0x467b40]
call esi
lea eax, [ebp - 0x114]
push eax
call fcn.00428fd0
add esp, 4
test eax, eax
jne 0x41e520
call fcn.00428c50
push eax
push str.Processes_loaded:__d
push 0x467800
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x467800
push 0
push 0x401
push dword [0x467ba0]
call esi
test edi, edi
je 0x41e6bb
push 0x467800
push 0x472
push edi
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004344b4
mov esp, ebp
pop ebp
ret
Function at 0x4214c0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4630b0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x421547
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 1
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [ebp + 8]
neg eax
push 0
sbb eax, eax
push 0
and eax, 2
push 0x10
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x18]
neg eax
sbb esi, esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esi + 1]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004344b4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.004344b4
mov esp, ebp
pop ebp
ret

Function at 0x4215e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4630b0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x210]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionAeDebug
push CreateStatusWindowA
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x421713
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push str.Debugger
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x421707
mov cl, byte [ebp - 0x20c]
lea eax, [ebp - 0x20c]
cmp cl, 0x22
jne 0x421678
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
je 0x421670
cmp cl, 0x22
jne 0x421660
inc eax
jmp 0x421686
cmp byte [eax], 0x22
jne 0x421686
inc eax
jmp 0x421686
cmp cl, 0x20
jle 0x421686
lea ecx, [ecx]
inc eax
cmp byte [eax], 0x20
jg 0x421680
mov byte [eax], 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x421707
push str.drwtsn32
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x421707
push str.drwtsn32.exe
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x421707
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [0x467bb0], eax
test eax, eax
jne 0x4216f9
mov eax, 0x8007000e
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004344b4
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.004344b4
mov esp, ebp
pop ebp
ret
Function at 0x4219f0
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x4630b0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x103
lea eax, [ebp - 0x107]
mov byte [ebp - 0x108], 0
push 0
push eax
call fcn.00434f70
add esp, 0xc
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
cmp dword [0x466a20], 0
je 0x421a7b
mov ecx, dword [ebp - 0x118]
mov eax, ecx
sub ecx, dword [ebp - 0x114]
shr eax, 0xa
push eax
shr ecx, 0xa
lea eax, [ebp - 0x108]
push ecx
push str.Memory:__u_Kb__u_Kb
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x108]
push eax
push 1
push 0x401
push dword [0x467ba0]
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004344b4
mov esp, ebp
pop ebp
ret

Function at 0x421a90
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push str._PTDS
push 0x4673e8
call esi
test eax, eax
jne 0x421abe
push eax
push dword [0x4659c0]
call fcn.0040dfc0
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x4674ec
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x421b04
push 0x4673e8
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x421b04
push 0x4673e8
push 0x465188
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
push dword [0x4659c0]
call fcn.00422480
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str._PEEDITOR
push 0x4673e8
call esi
test eax, eax
jne 0x421b4b
push 0x4674ec
push 0x465188
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x465188
call fcn.0041ae60
push 0
push dword [0x4659c0]
call fcn.00422480
add esp, 0xc
call fcn.00421e70
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str._BREAKENTER
push 0x4673e8
call esi
test eax, eax
jne 0x421b82
push 0x4674ec
push 0x465188
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call fcn.00402790
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str._PESNIFFER
push 0x4673e8
call esi
test eax, eax
jne 0x421bbf
push 0x4674ec
push 0x465188
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x465188
push 0
push dword [0x4659c0]
call fcn.00427870
add esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str._REBUILDPE
push 0x4673e8
call esi
test eax, eax
jne 0x421bf7
push 0x4674ec
push 0x465188
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
push dword [0x4659c0]
call fcn.00429ae0
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str._WNDNAME
push 0x4673e8
call esi
pop esi
test eax, eax
jne 0x421c1e
push 0x4674ec
push 0x467a10
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, 1
ret
xor eax, eax
ret
Function at 0x421c30
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
call edi
test eax, eax
jne 0x421c4c
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov cl, byte [esi]
mov edx, 0x4673e8
mov eax, dword [ebp - 4]
push ebx
mov bl, byte [0x4675f0]
lea ecx, [ecx]
test cl, cl
je 0x421cb3
cmp cl, 0x20
jne 0x421c76
lea esp, [esp]
inc esi
cmp byte [esi], 0x20
je 0x421c70
mov cl, byte [esi]
cmp cl, 0x22
je 0x421cf1
test cl, cl
je 0x421cb3
inc bl
xor eax, eax
mov byte [0x4675f0], bl
mov cl, byte [esi]
cmp cl, 0x20
jbe 0x421ca5
cmp eax, 0x104
jg 0x421ce8
inc esi
mov byte [edx + eax], cl
inc eax
mov cl, byte [esi]
cmp cl, 0x20
ja 0x421c92
add edx, 0x104
cmp edx, 0x4675f0
jl 0x421c60
test eax, eax
je 0x421e64
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push str._PTDS
push 0x4673e8
call esi
test eax, eax
jne 0x421d13
push eax
push dword [0x4659c0]
call fcn.0040dfc0
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
inc esi
push esi
call edi
push eax
push esi
push 0x4674ec
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
call fcn.00421a90
pop ebx
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
push 0x4674ec
call edi
test eax, eax
jne 0x421d51
push 0x4673e8
call edi
test eax, eax
je 0x421d51
push 0x4673e8
push 0x465188
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
push dword [0x4659c0]
call fcn.00422480
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str._PEEDITOR
push 0x4673e8
call esi
test eax, eax
jne 0x421d98
push 0x4674ec
push 0x465188
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x465188
call fcn.0041ae60
push 0
push dword [0x4659c0]
call fcn.00422480
add esp, 0xc
call fcn.00421e70
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str._BREAKENTER
push 0x4673e8
call esi
test eax, eax
jne 0x421dcf
push 0x4674ec
push 0x465188
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call fcn.00402790
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str._PESNIFFER
push 0x4673e8
call esi
test eax, eax
jne 0x421e0c
push 0x4674ec
push 0x465188
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x465188
push 0
push dword [0x4659c0]
call fcn.00427870
add esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str._REBUILDPE
push 0x4673e8
call esi
test eax, eax
jne 0x421e44
push 0x4674ec
push 0x465188
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
push dword [0x4659c0]
call fcn.00429ae0
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str._WNDNAME
push 0x4673e8
call esi
test eax, eax
jne 0x421e64
push 0x4674ec
push 0x467a10
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop ebx
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x421e70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x4630b0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x103
lea eax, [ebp - 0x107]
mov byte [ebp - 0x108], 0
push 0
push eax
call fcn.00434f70
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x108]
push eax
push 0x4668e4
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x118]
mov dword [0x4668a0], 1
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x112]
push dword [0x4659bc]
mov dword [0x4668a4], eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x421f12
push 0x4668b8
push dword [0x4659bc]
mov dword [0x4668b8], 0x2c
call dword [sym.imp.USER32.dll_GetWindowPlacement]
push 0xb36
push 0x4668a0
push str.OptStruct
push 0x44fb9c
mov ecx, 0x4673e0
call fcn.0042b1b0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004344b4
mov esp, ebp
pop ebp
ret
Function at 0x4231d0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4630b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [0x465a20]
xorps xmm0, xmm0
mov byte [ebp - 0x10], 0
movq qword [ebp - 0xf], xmm0
push ebx
movzx eax, word [edx + 0x14]
lea ecx, [edx + 0x18]
mov ebx, dword [0x465a24]
add ecx, eax
push esi
mov dword [0x465a28], ecx
xor esi, esi
movzx eax, word [edx + 6]
mov dword [ebp - 0x14], eax
test eax, eax
mov eax, dword [sym.imp.USER32.dll_SetDlgItemTextA]
push edi
je 0x423254
lea esp, [esp]
mov eax, dword [ecx + 8]
test eax, eax
jne 0x42322a
mov eax, dword [ecx + 0x10]
mov ebx, dword [ecx + 0xc]
mov edi, dword [edx + 0x28]
cmp edi, ebx
jb 0x42323a
add eax, ebx
cmp edi, eax
jb 0x42328e
mov ebx, dword [0x465a24]
add ecx, 0x28
inc esi
mov dword [0x465a28], ecx
cmp esi, dword [ebp - 0x14]
jb 0x423220
mov eax, dword [sym.imp.USER32.dll_SetDlgItemTextA]
test ebx, ebx
je 0x423300
cmp dword [edx + 0x28], 0
jne 0x42334b
push str._NULL_EntryPoint
push 0x404
push dword [0x467bc0]
call eax
mov edx, dword [0x465a20]
mov eax, 1
mov ebx, dword [0x465a24]
jmp 0x42334d
push 9
push ecx
lea eax, [ebp - 0x10]
sub edi, ebx
add edi, dword [ecx + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push dword [0x465a28]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
test eax, eax
jne 0x4232bc
lea eax, [esi + 1]
push eax
push str._Section:__d__EP:_0x_0.8lX
jmp 0x4232c5
lea eax, [ebp - 0x10]
push eax
push str._Section:___s___EP:_0x_0.8lX
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push 0x465590
call esi
mov edi, dword [sym.imp.USER32.dll_SetDlgItemTextA]
add esp, 0x10
push 0x465590
push 0x404
push dword [0x467bc0]
call edi
mov edx, dword [0x465a20]
mov eax, 1
mov ebx, dword [0x465a24]
jmp 0x423359
cmp dword [edx + 0x28], 0
je 0x423266
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
mov edi, dword [sym.imp.USER32.dll_SetDlgItemTextA]
push dword [edx + 0x28]
push str._EP:_0x_0.8X
push 0x465590
call esi
add esp, 0xc
push 0x465590
push 0x404
push dword [0x467bc0]
call edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004344b4
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
mov edi, dword [sym.imp.USER32.dll_SetDlgItemTextA]
test eax, eax
jne 0x42333a
jmp 0x423316

Function at 0x4238a0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
xor esi, esi
movzx eax, word [edx + 0x14]
lea ecx, [edx + 0x18]
add ecx, eax
movzx eax, word [edx + 6]
test eax, eax
je 0x4238e8
push edi
mov edi, dword [ebp + 0x10]
mov edi, edi
mov edx, dword [ecx + 0x14]
add edx, dword [ecx + 0x10]
cmp edi, edx
jb 0x4238da
inc esi
add ecx, 0x28
cmp esi, eax
jb 0x4238c0
pop edi
xor eax, eax
pop esi
pop ebp
ret 0xc
mov eax, dword [ecx + 0xc]
sub eax, dword [ecx + 0x14]
add eax, edi
pop edi
pop esi
pop ebp
ret 0xc
xor eax, eax
pop esi
pop ebp
ret 0xc
Function at 0x423d40
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x423d78
mov edi, dword [ebp + 0xc]
nop
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x423d70
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x423d7a
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x423d60
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x425950
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.00403510
mov edx, dword [ebp + 8]
add esp, 4
test eax, eax
je 0x425987
mov ecx, dword [edx + 0x3c]
add ecx, edx
mov dword [ebp - 4], ecx
movzx eax, word [ecx + 0x14]
lea esi, [ecx + 0x18]
add esi, eax
movzx eax, word [ecx + 6]
jmp 0x425999
mov ebx, dword [edx + 0x3c]
add ebx, edx
movzx eax, word [ebx + 0x14]
lea esi, [ebx + 0x18]
add esi, eax
movzx eax, word [ebx + 6]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
test eax, eax
je 0x425a6b
mov edi, edi
push edx
call fcn.00403510
add esp, 4
test eax, eax
je 0x425a0b
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x28]
test ecx, ecx
je 0x425a4f
mov eax, dword [esi + 8]
test eax, eax
jne 0x4259d5
mov eax, dword [esi + 0x10]
mov edx, dword [esi + 0xc]
cmp ecx, edx
jb 0x425a33
add eax, edx
cmp ecx, eax
jae 0x425a33
cmp edi, 1
jne 0x425a2e
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x28]
sub ecx, edx
add ecx, dword [esi + 0x14]
mov eax, dword [ebp + 0x10]
pop edi
mov dword [eax], ecx
mov eax, dword [ebp + 0x14]
mov ecx, dword [esi + 0x10]
pop esi
pop ebx
mov dword [eax], ecx
mov eax, 1
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebx + 0x28]
test ecx, ecx
je 0x425a4f
mov eax, dword [esi + 8]
test eax, eax
jne 0x425a1c
mov eax, dword [esi + 0x10]
mov edx, dword [esi + 0xc]
cmp ecx, edx
jb 0x425a33
add eax, edx
cmp ecx, eax
jae 0x425a33
cmp edi, 1
je 0x425a61
cmp edi, 2
je 0x425a4a
mov eax, dword [ebp - 8]
add esi, 0x28
inc eax
mov dword [ebp - 8], eax
cmp eax, dword [ebp - 0xc]
jae 0x425a6b
mov edx, dword [ebp + 8]
jmp 0x4259b0
mov ecx, dword [esi + 0x14]
jmp 0x4259f2
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
mov dword [eax], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0x14]
sub ecx, edx
add ecx, dword [ebx + 0x28]
jmp 0x4259f2
push dword [ebp + 8]
call fcn.00403510
add esp, 4
test eax, eax
je 0x425aa3
cmp edi, 1
je 0x425a84
cmp edi, 2
jne 0x425ac9
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0x10]
pop edi
pop esi
mov ecx, dword [edx + 0x28]
mov dword [eax], ecx
mov eax, dword [ebp + 0x14]
mov ecx, dword [edx + 0x1c]
pop ebx
mov dword [eax], ecx
mov eax, 1
mov esp, ebp
pop ebp
ret
cmp edi, 1
jne 0x425ac4
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebx + 0x28]
pop edi
pop esi
mov dword [eax], ecx
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebx + 0x1c]
pop ebx
mov dword [eax], ecx
mov eax, 1
mov esp, ebp
pop ebp
ret
cmp edi, 2
je 0x425aa8
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4266b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push 2
push 0
push ebx
mov dword [ebp - 4], ecx
call fcn.00436c8f
add esp, 0xc
test eax, eax
je 0x4266d8
mov eax, 0xfffffffd
pop ebx
mov esp, ebp
pop ebp
ret 4
push esi
push ebx
call fcn.004370a2
mov esi, eax
add esp, 4
test esi, esi
jns 0x4266f5
pop esi
mov eax, 0xfffffffd
pop ebx
mov esp, ebp
pop ebp
ret 4
jne 0x426701
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
push edi
lea eax, [esi + 1]
push 0x468adf
push eax
call fcn.004372d0
mov edi, eax
add esp, 8
test edi, edi
jne 0x426725
lea eax, [edi - 2]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
push 0
push ebx
mov byte [edi + esi], 0
call fcn.00436c8f
push ebx
push esi
push 1
push edi
call fcn.00436b54
add esp, 0x1c
cmp eax, esi
je 0x42675b
push edi
call fcn.00435a6a
add esp, 4
mov eax, 0xfffffffd
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
push eax
push edi
call fcn.004261a0
push edi
mov esi, eax
call fcn.00435a6a
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4269e0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
je 0x426a67
push 0
push 0x80000a7
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x462e6c], eax
cmp eax, 0xffffffff
je 0x426a63
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [0x467cec], eax
test eax, eax
je 0x426a63
push 0
push eax
push 0
push 2
push 0
push dword [0x462e6c]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [0x462e70], eax
cmp eax, 0xffffffff
je 0x426a63
push 0
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x467ce8], eax
test eax, eax
jne 0x426a67
push dword [0x462e70]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop ebp
ret
mov eax, 1
pop ebp
ret

Function at 0x428420
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [0x468030]
xor eax, eax
push esi
test edx, edx
je 0x42844f
mov ecx, dword [ebp + 8]
movzx esi, cx
jmp 0x428440
lea ecx, [eax + 0x2134]
cmp ecx, esi
je 0x428456
inc eax
cmp eax, edx
jb 0x428440
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 4]
push ecx
push 0
push eax
push 0x428380
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x429200
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
mov eax, dword [0x4630b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, dword [ebp + 0xc]
push 0x3e
push eax
mov word [ebp - 0x44], ax
lea eax, [ebp - 0x42]
push eax
mov dword [ebp - 0x140], 0
call fcn.00434f70
push 0xf4
lea eax, [ebp - 0x138]
mov dword [ebp - 0x13c], 0
push 0
push eax
call fcn.00434f70
add esp, 0x18
cmp dword [0x4681e4], 0
je 0x4292da
push esi
push 0
push 0x10
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4292da
lea eax, [ebp - 0x140]
push eax
push 0x40
lea eax, [ebp - 0x44]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, 0x5a4d
cmp ax, word [ebp - 0x44]
jne 0x4292b1
lea eax, [ebp - 0x140]
push eax
push 0xf8
lea eax, [ebp - 0x13c]
push eax
mov eax, dword [ebp - 8]
add eax, edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x13c], 0x4550
jne 0x4292da
mov eax, dword [ebp - 0xec]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004344b4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.004344b4
mov esp, ebp
pop ebp
ret

Function at 0x4292f0
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
mov eax, dword [0x4630b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push 0x3e
push eax
mov word [ebp - 0x44], ax
lea eax, [ebp - 0x42]
push eax
mov dword [ebp - 0x140], 0
call fcn.00434f70
push 0xf4
lea eax, [ebp - 0x138]
mov dword [ebp - 0x13c], 0
push 0
push eax
call fcn.00434f70
add esp, 0x18
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4293fe
push 0
lea eax, [ebp - 0x140]
push eax
push 0x40
lea eax, [ebp - 0x44]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x42938a
cmp dword [ebp - 0x140], 0x40
jne 0x4293f7
mov eax, 0x5a4d
cmp word [ebp - 0x44], ax
jne 0x4293f7
push 0
push 0
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x140]
push eax
push 0xf8
lea eax, [ebp - 0x13c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4293cf
cmp dword [ebp - 0x140], 0xf8
jne 0x4293f7
cmp dword [ebp - 0x13c], 0x4550
jne 0x4293f7
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xec]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004344b4
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.004344b4
mov esp, ebp
pop ebp
ret