joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43a1b5
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
mov dword [ebp - 8], edx
push esi
xor esi, esi
mov dword [ebp - 4], ecx
cmp dword [ebp + 0x14], ebx
push edi
setne bl
mov edi, 0x80
inc ebx
add edi, edi
test esi, esi
je 0x43a1eb
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
lea eax, [edi + edi]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x43a22f
cmp dword [ebp + 0x10], 0
push dword [ebp - 4]
push edi
push esi
je 0x43a21a
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
jmp 0x43a22b
push 0x40e8b0
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, eax
jmp 0x43a231
xor ecx, ecx
mov eax, edi
sub eax, ebx
cmp ecx, eax
jae 0x43a1d5
test esi, esi
je 0x43a258
test ecx, ecx
jne 0x43a258
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
neg eax
sbb eax, eax
not eax
and esi, eax
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x14

Function at 0x43a96d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
xor ebx, ebx
mov dword [ebp - 4], ebx
test edi, edi
je 0x43a9a6
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43a9a2
mov eax, dword [ebp - 4]
test eax, eax
jne 0x43a9ae
mov esi, ebx
jmp 0x43a9d9
mov eax, reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], eax
cmp dword [ebp + 8], ebx
je 0x43a9cb
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
neg eax
sbb esi, esi
mov eax, dword [ebp - 4]
inc esi
jmp 0x43a9ce
xor esi, esi
inc esi
test edi, edi
je 0x43a9d9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4

Function at 0x43a9ef
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push eax
push 0x20006
push 0
push 0x412dac
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x43aa34
push 0x412d90
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
test esi, esi
pop esi
sete al
leave
ret 4
Function at 0x43aa4d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push edi
xor edi, edi
mov dword [ebp - 0xc], 4
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x10], edi
test ecx, ecx
jne 0x43aa70
push 0x57
jmp 0x43aad4
lea eax, [ebp - 4]
push eax
push 0x20019
push edi
push 0x40e8d4
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43aad3
cmp dword [ebp - 4], edi
je 0x43aad3
push esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push edi
push 0x40e8c4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x43aaba
cmp dword [ebp - 0xc], 4
je 0x43aabd
push 0xd
pop esi
mov dword [ebp - 8], edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 8]
pop esi
jmp 0x43aadc
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
leave
ret 4

Function at 0x43aae7
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 1
push esi
push edi
test edx, edx
je 0x43ab4f
lea eax, [ebp - 0xc]
xor edi, edi
push eax
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
push edi
push 0x20006
push edi
push 0x40e8b0
push edi
push edx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
jne 0x43ab6b
push 4
lea eax, [ebp - 8]
push eax
push 4
push edi
push 0x41367c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x43ab6b
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push 0x41367c
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
test esi, esi
pop edi
sete al
pop esi
leave
ret 8
Function at 0x43de9d
Capabilities:
Delete file

Disassembly:
push 0
mov eax, 0x4896e1
call fcn.0047ceb6
mov esi, ecx
lea ecx, [esi + 0x48]
mov dword [esi], 0x4026d8
mov dword [esi + 4], 0x402730
call fcn.0045e65e
xor edi, edi
cmp dword [esi + 0x50], edi
je 0x43def5
push ecx
lea ecx, [esi + 0x38]
call fcn.0041a494
push ecx
lea ecx, [esi + 0x3c]
call fcn.0041a494
cmp dword [esi + 0x2c], edi
je 0x43dee7
push dword [esi + 0x2c]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esi + 0x30], edi
je 0x43def5
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 4], edi
lea ecx, [esi + 0x3c]
call fcn.004316b4
mov dword [ebp - 4], 1
lea ecx, [esi + 0x38]
call fcn.004316b4
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 2
cmp dword [esi + 0x34], 0
je 0x43df2b
push dword [esi + 0x34]
call fcn.00431523
mov dword [esi + 0x34], edi
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 3
cmp dword [esi + 0x30], 0
je 0x43df47
push dword [esi + 0x30]
call fcn.00431523
mov dword [esi + 0x30], edi
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 4
cmp dword [esi + 0x2c], 0
je 0x43df63
push dword [esi + 0x2c]
call fcn.00431523
mov dword [esi + 0x2c], edi
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.0045535b
call fcn.0047ce87
ret
Function at 0x44d454
Capabilities:
Contain obfuscated stackstrings

Disassembly:
movsd dword es:[edi], dword [esi]
xor eax, 0x41a645c6
call fcn.0044d063
push eax
push esi
push dword [ebp + 8]
call fcn.0044d018
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0044d063
push eax
push esi
push dword [ebp + 8]
call fcn.0044d018
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0044d053
inc esp
push ebx
push ebx
mov byte es:[ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.0044d053
dec esp
cmc
push ss
invalid

Function at 0x44df88
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
invalid
Function at 0x4551ae
Capabilities:
Shutdown system

Disassembly:
push 8
mov eax, 0x489c53
call fcn.0047ceb6
mov ebx, edx
mov edi, ecx
and dword [ebp - 4], 0
and dword [ebp - 0x14], 0
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x10], 0x13
test edi, edi
je 0x4551ee
cmp edi, 1
je 0x4551ee
cmp edi, 2
je 0x4551ee
cmp edi, 3
je 0x4551ee
mov esi, 0x80070057
jmp 0x45527a
push 1
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
call fcn.0042e074
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
js 0x45527a
test edi, edi
je 0x45523b
cmp edi, 1
je 0x45523b
cmp edi, 2
je 0x455218
cmp edi, 3
jne 0x455280
lea eax, [ebp - 0x10]
push eax
xor eax, eax
cmp edi, 2
setne al
inc eax
push eax
call dword [sym.imp.ntdll.dll_NtShutdownSystem]
push eax
call fcn.00431702
mov esi, dword [ebp - 0x10]
test eax, eax
je 0x45527a
jmp 0x455280
test ebx, ebx
jne 0x455244
mov ebx, 0x80030002
xor eax, eax
mov ecx, 0x411d44
test edi, edi
sete al
test edi, edi
je 0x455259
mov ecx, 0x411d70
push ebx
push eax
push 1
push 0
push ecx
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownExW]
test eax, eax
jne 0x455280
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004317f4
mov esi, eax
push esi
call fcn.004314fa
push esi
call fcn.00431467
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.004322f4
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x14]
call fcn.004322f4
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0047ce87
ret

Function at 0x4565de
Capabilities:
Print debug messages

Disassembly:
push 0xc
mov eax, 0x489cbc
call fcn.0047ceb6
mov dword [ebp - 0x18], edx
mov edi, ecx
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 1
mov ebx, esi
mov dword [ebp - 0x10], ebx
or dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x45661e
push esi
mov edi, esi
call fcn.004314fa
jmp 0x4566c7
sub edi, 1
je 0x45664e
sub edi, 1
je 0x456647
sub edi, 1
je 0x456640
sub edi, 1
je 0x456639
mov edi, 0x411e00
jmp 0x456653
mov edi, 0x411df4
jmp 0x456653
mov edi, 0x411de4
jmp 0x456653
mov edi, 0x411dd8
jmp 0x456653
mov edi, 0x411dcc
lea ecx, [ebp - 0x14]
call fcn.00430000
mov esi, dword [ebp - 0x14]
test eax, eax
js 0x456690
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push dword [ebp - 0x18]
push edi
push eax
push esi
lea eax, [ebp - 0x10]
push 0x411e10
push eax
call fcn.0041a612
mov edi, eax
add esp, 0x18
test edi, edi
jns 0x4566bd
push edi
call fcn.004314fa
mov ebx, dword [ebp - 0x10]
jmp 0x4566c7
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push dword [ebp - 0x18]
push edi
push eax
lea eax, [ebp - 0x10]
push 0x411e50
push eax
call fcn.0041a612
mov edi, eax
add esp, 0x14
test edi, edi
jns 0x4566bd
push edi
call fcn.004314fa
mov esi, dword [ebp - 0x14]
jmp 0x45668b
mov ebx, dword [ebp - 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push edi
call fcn.00431467
mov dword [ebp - 4], 2
test ebx, ebx
je 0x4566de
push ebx
call fcn.00431523
mov dword [ebp - 4], 3
test esi, esi
je 0x4566ef
push esi
call fcn.00431523
or dword [ebp - 4], 0xffffffff
mov eax, edi
call fcn.0047ce87
ret
Function at 0x457070
Capabilities:
Hash data using sha1

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x49025c], 0
push ebx
jne 0x4570ef
push eax
push ebx
push ecx
push edx
xor eax, eax
cpuid
xor eax, eax
xor ebx, 0x756e6547
sete al
xor ebx, ebx
xor ecx, 0x6c65746e
sete bl
and eax, ebx
xor ecx, ecx
xor edx, 0x49656e69
sete cl
and eax, ecx
mov dword [ebp - 4], eax
mov eax, 1
cpuid
xor ecx, ecx
xor edx, edx
mov ebx, 0xff0
and ebx, eax
mov dword [ebp - 8], ebx
pop edx
pop ecx
pop ebx
pop eax
cmp dword [ebp - 4], 0
mov ecx, 1
je 0x4570e3
cmp dword [ebp - 8], 0x660
sbb eax, eax
not eax
and ecx, eax
mov eax, dword [ecx*4 + 0x4029f8]
mov dword [0x49025c], eax
mov eax, dword [ebp + 8]
pop ebx
mov dword [eax + 0x54], 0
mov dword [eax + 0x58], 0
mov dword [eax + 0x40], 0x67452301
mov dword [eax + 0x44], 0xefcdab89
mov dword [eax + 0x48], 0x98badcfe
mov dword [eax + 0x4c], 0x10325476
mov dword [eax + 0x50], 0xc3d2e1f0
mov esp, ebp
pop ebp
ret 4
Function at 0x457fb3
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
xor esi, esi
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x457fd6
test al, 0x10
jne 0x45807d
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x45807d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x457ffb
xor esi, esi
jmp 0x45807d
movzx eax, word [edi]
mov ecx, edi
push ebx
xor ebx, ebx
test ax, ax
je 0x458077
push 0x5c
mov edx, eax
pop edi
cmp dx, di
jne 0x458014
mov ebx, ecx
add ecx, 2
movzx eax, word [ecx]
mov edx, eax
test ax, ax
jne 0x45800d
mov edi, dword [ebp - 4]
test ebx, ebx
je 0x458077
xor eax, eax
xor edx, edx
mov ecx, edi
mov word [ebx], ax
call fcn.00457fb3
mov esi, eax
push 0x5c
pop eax
mov word [ebx], ax
test esi, esi
js 0x45807c
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x458073
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0xb7
jne 0x458064
xor esi, esi
inc esi
jmp 0x45807c
test esi, esi
jle 0x45807c
movzx esi, si
or esi, 0x80070000
jmp 0x45807c
xor esi, esi
jmp 0x45807c
mov esi, 0x80070003
pop ebx
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x4589d6
Capabilities:
Hash data via bcrypt
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x48dc38]
xor eax, esp
mov dword [esp + 0x38], eax
and dword [esp + 4], 0
xor eax, eax
push ebx
push esi
push edi
push 8
mov ebx, ecx
lea edi, [esp + 0x28]
pop ecx
push 0xa00000
rep stosd dword es:[edi], eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x458a24
mov esi, 0x8007000e
jmp 0x458b57
lea ecx, [esp + 0x10]
call fcn.00458602
mov eax, dword [ebx + 0x10]
push ecx
mov ecx, dword [ebx]
push dword [eax + 0xc]
push dword [eax + 8]
call fcn.0047b0cc
mov esi, eax
test esi, esi
js 0x458b57
xor ecx, ecx
xor edx, edx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
mov eax, dword [ebx + 0x10]
mov eax, dword [eax + 0x10]
sub eax, ecx
mov dword [esp + 0x20], eax
mov eax, dword [ebx + 0x10]
mov eax, dword [eax + 0x14]
sbb eax, edx
test eax, eax
jb 0x458a7f
ja 0x458a78
cmp dword [esp + 0x20], 0xa00000
jbe 0x458a7f
mov eax, 0xa00000
jmp 0x458a87
mov eax, dword [ebx + 0x10]
mov eax, dword [eax + 0x10]
sub eax, ecx
and dword [esp + 0x14], 0
lea ecx, [esp + 0x14]
push 0
push ecx
push eax
push edi
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x458b39
push 0
push dword [esp + 0x18]
push edi
push dword [esp + 0x1c]
call dword [sym.imp.bcrypt.dll_BCryptHashData]
test eax, eax
jns 0x458abf
push 7
pop ecx
int 0x29
mov ecx, dword [esp + 0x18]
add ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
mov eax, dword [ebx + 0x10]
adc edx, 0
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
cmp edx, dword [eax + 0x14]
jb 0x458a54
ja 0x458aed
cmp ecx, dword [eax + 0x10]
jb 0x458a54
push 0
push 0x20
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x1c]
call dword [sym.imp.bcrypt.dll_BCryptFinishHash]
test eax, eax
jns 0x458b09
push 7
pop ecx
int 0x29
push dword [esp + 0x10]
call dword [sym.imp.bcrypt.dll_BCryptDestroyHash]
and dword [esp + 0x10], 0
xor ecx, ecx
mov edx, dword [ebx + 0x10]
lea ebx, [esp + 0x24]
mov eax, dword [edx + ecx*4 + 0x18]
cmp eax, dword [ebx + ecx*4]
jne 0x458b32
inc ecx
cmp ecx, 8
jne 0x458b21
jmp 0x458b71
mov esi, 0x80004005
jmp 0x458b71
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x458b50
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x458b57
mov esi, 0x80004005
cmp dword [esp + 0x10], 0
je 0x458b6d
push dword [esp + 0x10]
call dword [sym.imp.bcrypt.dll_BCryptDestroyHash]
and dword [esp + 0x10], 0
test edi, edi
je 0x458b81
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [esp + 0x44]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0047c8b0
mov esp, ebp
pop ebp
ret 4
Function at 0x458ee4
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
xor eax, eax
mov ebx, ecx
push edi
push ecx
push eax
mov ecx, dword [ebx]
mov edi, eax
push eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], eax
call fcn.0047b0cc
mov esi, eax
test esi, esi
js 0x45904a
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
test edi, edi
jne 0x458f4a
mov esi, 0x20000
push esi
push 8
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x458f6d
mov esi, 0x8007000e
jmp 0x45904a
mov eax, dword [ebp - 0x10]
mov esi, eax
push eax
push edi
push 0
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
test eax, eax
je 0x45903e
mov edi, eax
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
and dword [ebp - 0x18], 0
push 0
push eax
mov eax, esi
sub eax, ecx
push eax
lea eax, [ecx + edi]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x45901e
lea eax, [ebp - 0x14]
mov edx, esi
push eax
lea eax, [ebp - 0xc]
mov ecx, edi
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00459057
mov esi, eax
cmp esi, 0x8007007a
je 0x458f18
test esi, esi
js 0x459043
push dword [ebp - 0xc]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebx + 8], eax
test eax, eax
je 0x45903e
mov eax, dword [ebp - 4]
push dword [eax + 0x1c]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebx + 0xc], eax
test eax, eax
je 0x45903e
push dword [ebp - 0xc]
push dword [ebp - 4]
push dword [ebx + 8]
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 4]
add esp, 0xc
push dword [eax + 0x1c]
push dword [ebp - 0x14]
push dword [ebx + 0xc]
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x459043
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x459035
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x459043
mov esi, 0x80004005
jmp 0x459043
mov esi, 0x8007000e
mov ecx, edi
call fcn.004585b2
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x459057
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, edx
xor esi, esi
mov edx, ecx
mov dword [edi], esi
cmp ebx, 0x40
jae 0x459082
mov dword [edi], 0x138
mov esi, 0x8007007a
jmp 0x459165
mov eax, 0x5a4d
cmp ax, word [edx]
jne 0x459160
mov ecx, dword [edx + 0x3c]
cmp ebx, ecx
jae 0x4590a1
lea eax, [ecx + 0xf8]
mov dword [edi], eax
jmp 0x459078
lea eax, [ecx + edx]
cmp dword [eax], 0x4550
jne 0x459160
movzx edi, word [eax + 6]
mov dword [ebp - 4], edi
movzx edi, word [eax + 0x14]
imul eax, dword [ebp - 4], 0x28
add eax, 0x18
add eax, ecx
add eax, edi
mov edi, dword [ebp + 8]
cmp ebx, eax
jb 0x45909d
lea eax, [ecx + edx]
movzx edi, word [eax + 0x14]
lea ecx, [eax + 0x18]
add ecx, edi
mov eax, esi
mov dword [ebp - 8], ecx
cmp dword [ebp - 4], eax
jbe 0x459160
cmp dword [ecx], 0x786f622e
jne 0x4590f4
cmp dword [ecx + 4], 0x64616f6c
je 0x4590fd
inc eax
add ecx, 0x28
cmp eax, dword [ebp - 4]
jb 0x4590e3
cmp dword [ebp - 4], eax
jbe 0x459160
imul ecx, eax, 0x28
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov edi, ecx
mov ecx, dword [ecx + eax + 0x14]
mov eax, dword [edi + eax + 0x10]
mov edi, dword [ebp + 8]
add eax, ecx
cmp ebx, eax
jb 0x45909d
add ecx, edx
cmp dword [ecx], 0xb0c50002
jne 0x459160
mov eax, dword [ecx + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ecx + 0x1c]
add eax, dword [ecx + 0x20]
cmp ebx, eax
jb 0x45909d
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov ecx, dword [eax + ecx + 8]
mov eax, dword [ebp + 0x10]
mov dword [eax], ecx
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0xc]
add ecx, edx
mov dword [eax], ecx
jmp 0x459165
mov esi, 0x8007000d
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x10
Function at 0x459174
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x274
mov eax, dword [0x48dc38]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
or dword [ebp - 0x264], 0xffffffff
push ebx
mov dword [ebp - 0x268], eax
xor ebx, ebx
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x270], edx
inc eax
push edi
lea edx, [ebp - 0x260]
mov dword [ebp - 0x26c], eax
mov dword [ebp - 0x260], ebx
mov dword [ebp - 0x25c], ebx
call fcn.0047afa1
mov esi, eax
test esi, esi
js 0x459358
mov edx, dword [ebp - 0x260]
lea ecx, [ebp - 0x25c]
push ebx
call fcn.004580d9
mov esi, eax
test esi, esi
js 0x459347
push ebx
mov edx, 0x411f98
lea ecx, [ebp - 0x25c]
call fcn.00458235
mov esi, eax
test esi, esi
js 0x459347
mov edi, dword [ebp - 0x25c]
lea eax, [ebp - 0x258]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x45923e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x459238
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x45934d
test byte [ebp - 0x258], 0x10
jne 0x4592d2
mov edx, dword [ebp - 0x268]
xor eax, eax
add eax, dword [ebp - 0x238]
mov ecx, dword [ebp - 0x23c]
adc ecx, 0
mov edx, dword [edx + 0x10]
cmp eax, dword [edx + 0x10]
jne 0x4592d2
cmp ecx, dword [edx + 0x14]
jne 0x4592d2
mov edx, dword [ebp - 0x260]
lea ecx, [ebp - 0x25c]
push 0
call fcn.004580d9
mov esi, eax
test esi, esi
js 0x45931a
push 0
lea edx, [ebp - 0x22c]
lea ecx, [ebp - 0x25c]
call fcn.00458235
mov esi, eax
test esi, esi
js 0x45931a
mov ecx, dword [ebp - 0x270]
lea eax, [ebp - 0x264]
mov edi, dword [ebp - 0x25c]
push eax
lea eax, [ebp - 0x26c]
mov edx, dword [ecx]
push eax
lea eax, [ecx + 4]
mov ecx, edi
push eax
call fcn.00459385
mov esi, eax
test esi, esi
jns 0x4592fa
lea eax, [ebp - 0x258]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x45923e
mov eax, dword [ebp - 0x264]
cmp eax, 0xffffffff
jne 0x459322
mov esi, 0x80070002
jmp 0x459339
mov ecx, dword [ebp - 0x268]
mov edx, edi
push 0
lea ecx, [ecx + 4]
call fcn.004580d9
mov esi, eax
test esi, esi
jns 0x4592e8
mov eax, dword [ebp - 0x264]
jmp 0x45932d
mov edi, dword [ebp - 0x25c]
jmp 0x459312
mov ecx, dword [ebp - 0x268]
mov dword [ecx], eax
or eax, 0xffffffff
cmp eax, 0xffffffff
je 0x459339
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 0xffffffff
je 0x45934d
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x45934d
mov edi, dword [ebp - 0x25c]
test edi, edi
je 0x459358
mov ecx, edi
call fcn.004585b2
cmp dword [ebp - 0x260], 0
je 0x45936c
mov ecx, dword [ebp - 0x260]
call fcn.004585b2
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047c8b0
leave
ret 8