joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4498fd
Capabilities:
Hide graphical window

Disassembly:
mov edx, dword [esp + 4]
push ebp
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
push edx
push 0x4a83d8
xor ebp, ebp
call fcn.0044213b
test al, al
jne 0x449929
pop esi
xor eax, eax
pop ebp
ret 0xc
mov eax, dword [esp + 0xc]
mov ecx, dword [0x4a8438]
mov edx, dword [ecx + eax*4]
mov eax, dword [edx]
mov ecx, dword [0x4a844c]
mov edx, dword [esp + 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ecx + edx*4]
push ebx
mov ebx, dword [eax]
push edi
mov edi, dword [ebx]
cmp esi, 0xffffffff
je 0x4499cf
movzx eax, byte [ebx + 0x88]
add eax, 0xfffffffe
cmp eax, 0x14
ja case.0x44996a.4
movzx ecx, byte [eax + 0x449a91]
jmp dword [ecx*4 + 0x449a75]
pop edi
pop ebx
pop esi
xor eax, eax
pop ebp
ret 0xc
or esi, 0xe
jmp case.0x44996a.4
or esi, 3
jmp case.0x44996a.4
or esi, 4
push 0
test esi, 0x800
je 0x4499a1
push 1
push 0xcf
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x44996a.4
push 0
push 0xcf
push edi
or esi, 0x10000
call dword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x44996a.4
or esi, 0x4000000
or esi, 0x50000000
push esi
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov ebp, eax
mov esi, dword [esp + 0x1c]
cmp esi, 0xffffffff
je 0x449a0d
push esi
push 0xffffffffffffffec
push edi
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov edx, dword [0x4a844c]
mov ebp, eax
mov eax, dword [esp + 0x18]
mov ecx, dword [edx + eax*4]
mov edx, dword [ecx]
cmp byte [edx + 0x88], 0x13
jne 0x449a0d
push esi
push 0
push 0x1036
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebp, eax
mov al, byte [ebx + 0x8b]
cmp al, 0xff
je 0x449a31
mov ecx, dword [esp + 0x14]
movzx eax, al
cmp eax, dword [ecx + 0x184]
je 0x449a31
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x449a3e
mov edx, dword [esp + 0x14]
push 1
push ebx
push edx
call fcn.0043401c
mov al, byte [ebx + 0x88]
cmp al, 2
je 0x449a51
cmp al, 3
je 0x449a51
cmp esi, 0xffffffff
je 0x449a66
mov eax, dword [ebx]
push 0x27
push 0
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
pop edi
pop ebx
xor eax, eax
test ebp, ebp
pop esi
setne al
pop ebp
ret 0xc

Function at 0x44afdc
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xdc
push ebx
mov ebx, dword [esp + 0xe4]
push esi
push edi
mov edi, dword [esp + 0xf0]
lea eax, [esp + 0x10]
push eax
call fcn.004431e0
mov ecx, dword [esp + 0xf4]
push ecx
lea edx, [esp + 0x14]
push edx
call fcn.0044313a
xor esi, esi
test edi, edi
jbe 0x44b02e
lea esp, [esp]
lea eax, [esp + 0x10]
push eax
call fcn.004431b2
xor byte [esi + ebx], al
inc esi
cmp esi, edi
jb 0x44b01c
pop edi
pop esi
pop ebx
add esp, 0xdc
ret 0xc
Function at 0x44b2e9
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ecx
sub dword [0x49223c], 1
jne 0x44b2f8
call fcn.00443390
mov ecx, dword [0x4a72e4]
mov eax, dword [ecx]
add ecx, 4
mov dword [0x4a72e4], ecx
mov ecx, eax
shr ecx, 0xb
xor eax, ecx
mov edx, eax
and edx, 0xff3a58ad
shl edx, 7
xor eax, edx
mov ecx, eax
and ecx, 0xffffdf8c
shl ecx, 0xf
xor eax, ecx
mov edx, eax
shr edx, 0x12
xor edx, eax
mov dword [esp], edx
fild dword [esp]
test edx, edx
jge 0x44b341
fadd qword [0x48c528]
fmul qword [0x48c530]
pop ecx
ret

Function at 0x44b64f
Capabilities:
Terminate thread

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
cmp dword [edi + 0x30], 0
lea esi, [edi + 0x30]
je 0x44b6b7
mov eax, dword [edi + 0x34]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
lea ebx, [edi + 0x34]
push eax
push ebx
call ebp
cmp eax, 0x1f6
je 0x44b6b5
add edi, 0x14
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [esi]
push 0x1f6
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [esi]
push 0x3e8
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call fcn.004356cd
add esp, 4
push 0x1f6
push ebx
call ebp
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebp
pop ebx
pop edi
pop esi
ret 4

Function at 0x44bb20
Capabilities:
Delete directory
Delete file

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x22c
lea eax, [esp + 0x20]
call fcn.0040ffb0
lea eax, [esp + 0x20]
push eax
call fcn.00436ac4
add esp, 4
test al, al
jne 0x44bb4b
add esp, 0x22c
ret
push ebx
xor ebx, ebx
cmp byte [esp + 0x238], bl
jne 0x44bb6f
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
pop ebx
add esp, 0x22c
ret
lea edx, [esp + 0x24]
push edx
call fcn.004112d5
xor ecx, ecx
mov word [esp + eax*2 + 0x2a], cx
add esp, 4
lea ecx, [esp + 4]
lea edx, [esp + 0x24]
mov eax, 0x614
push ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1e], ebx
mov dword [esp + 0x22], ebx
mov dword [esp + 0x1a], ebx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], 3
mov word [esp + 0x18], ax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
sete al
pop ebx
add esp, 0x22c
ret
Function at 0x4523ce
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x430
push ebx
push ebp
push esi
mov esi, dword [esp + 0x440]
push edi
xor ebp, ebp
mov eax, dword [esi]
push eax
push 4
lea ecx, [esp + 0x1c]
push 1
push ecx
call fcn.004151b0
add esp, 0x10
push 0xe3afd4c1
push 4
lea edx, [esp + 0x1c]
push edx
call fcn.0044afdc
lea eax, [esp + 0x14]
push 0x487704
push eax
mov byte [esp + 0x20], 0
call fcn.004151d0
add esp, 8
test eax, eax
jne 0x452562
mov ecx, dword [esi]
push ecx
push 1
lea edx, [esp + 0x18]
push 4
push edx
inc ebp
call fcn.004151b0
mov edi, dword [esp + 0x20]
mov eax, dword [esi]
push eax
xor edi, 0x2ce20ac
lea ebx, [edi + edi]
push ebx
lea ecx, [esp + 0x38]
push 1
push ecx
call fcn.004151b0
add esp, 0x20
add edi, 0x5f6e8593
push edi
push ebx
lea edx, [esp + 0x28]
push edx
call fcn.0044afdc
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x234]
xor eax, eax
push edx
mov word [esp + ebx + 0x28], ax
call fcn.00411691
mov eax, dword [esi]
push eax
push 1
lea ecx, [esp + 0x20]
push 4
push ecx
call fcn.004151b0
mov edi, dword [esp + 0x28]
mov edx, dword [esi]
push edx
xor edi, 0x793d26ea
lea ebx, [edi + edi]
push ebx
lea eax, [esp + 0x40]
push 1
push eax
call fcn.004151b0
add esp, 0x28
add edi, 0xe95d0b92
push edi
push ebx
lea ecx, [esp + 0x28]
push ecx
call fcn.0044afdc
mov ecx, dword [esp + 0x44c]
lea eax, [esp + 0x20]
push eax
xor edx, edx
push ecx
mov word [esp + ebx + 0x28], dx
call fcn.00411691
mov edi, dword [esp + 0x450]
lea edx, [esp + 0x238]
push edi
push edx
call fcn.004133e4
add esp, 0x10
test eax, eax
je 0x452553
push 0x4876f8
push edi
call fcn.004133e4
add esp, 8
test eax, eax
jne 0x452510
test ebp, ebp
je 0x452553
mov eax, dword [esi]
push 1
push 1
push eax
call fcn.0041557c
mov ecx, dword [esi]
add esp, 0xc
push ecx
push 1
lea edx, [esp + 0x24]
push 4
push edx
call fcn.004151b0
mov eax, dword [esp + 0x2c]
xor eax, 0x87bc
mov dword [esp + 0x2c], eax
add eax, 0x18
push 1
push eax
mov eax, dword [esi]
push eax
call fcn.0041557c
add esp, 0x1c
jmp 0x4523e1
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x430
ret 0xc
pop edi
pop esi
pop ebp
mov eax, 6
pop ebx
add esp, 0x430
ret 0xc
Function at 0x4647a2
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x24]
push esi
push edi
lea ecx, [esp + 0x10]
push ecx
mov eax, 2
push ebp
mov word [ebx], ax
call fcn.0045a407
mov eax, dword [eax]
push eax
call sub.WSOCK32.dll_inet_addr
lea esi, [esp + 0x10]
mov edi, eax
call fcn.00401330
cmp edi, 0xffffffff
jne 0x464814
push 0x48a844
push ebp
call fcn.0044cd47
add esp, 8
test al, al
je 0x464814
push 0
push 1
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
add eax, ecx
call fcn.004040e0
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x10
ret 0x10
push 0
push 2
jmp 0x4647f2
mov eax, dword [esp + 0x30]
lea ecx, [eax - 1]
mov dword [ebx + 4], edi
cmp ecx, 0xfffe
ja 0x46480e
push eax
call sub.WSOCK32.dll_htons
pop edi
pop esi
mov word [ebx + 2], ax
pop ebp
mov al, 1
pop ebx
add esp, 0x10
ret 0x10

Function at 0x465fe6
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
cmp byte [esi + 0xd0], 0
je 0x466001
test al, al
je 0x466001
lea eax, [esi + 0xd4]
push eax
call fcn.00434b61
push esi
push 0
push 0x465fb6
call fcn.00415702
xor eax, eax
add esp, 0xc
cmp dword [esi + 0x18], eax
sete al
pop esi
ret 8
push eax
push esi
call fcn.00465e8e
pop esi
ret 8
Function at 0x468387
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x30]
push ebp
mov ebp, dword [esp + 0x20]
push esi
push edi
xor esi, esi
xor edi, edi
mov byte [esp + 0x3c], 1
cmp dword [ebp + 4], esi
jne 0x4683b0
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x18
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
mov byte [ebx], 0
mov byte [eax], 0
mov byte [ecx], 0
mov byte [edx], 0
push esi
push ebp
call int.00438a19
movzx eax, word [eax]
cmp ax, 0x2b
je 0x4683f0
cmp ax, 0x5e
je 0x4683ea
cmp ax, 0x21
je 0x4683ea
cmp ax, 0x23
jne 0x468426
cmp ax, 0x2b
jne 0x4683fa
mov eax, dword [esp + 0x30]
mov byte [eax], 1
inc esi
jmp 0x4683c8
cmp ax, 0x5e
jne 0x46840a
mov ecx, dword [esp + 0x34]
mov byte [ecx], 1
inc esi
jmp 0x4683c8
cmp ax, 0x21
jne 0x46841a
mov edx, dword [esp + 0x38]
mov byte [edx], 1
inc esi
jmp 0x4683c8
cmp ax, 0x23
jne 0x468423
mov byte [ebx], 1
inc esi
jmp 0x4683c8
mov eax, esi
push eax
inc esi
push ebp
mov dword [esp + 0x30], esi
call int.00438a19
movzx eax, word [eax]
cmp ax, 0x7b
jne 0x46850f
mov eax, 0x40
lea ecx, [esp + 0x10]
call fcn.00401400
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x14]
push ecx
push ebp
push 0x7d
call fcn.0045f717
test al, al
je 0x4684e7
mov edx, dword [esp + 0x10]
mov eax, dword [edi*4 + 0x492b10]
push edx
push eax
call fcn.004115d0
add esp, 8
test eax, eax
je 0x468488
inc edi
cmp edi, 0x62
jl 0x468469
cmp edi, 0x62
jne 0x4684de
xor edi, edi
lea esi, [esp + 0x10]
call fcn.00401be0
movzx ecx, word [eax]
push ecx
call dword [sym.imp.USER32.dll_VkKeyScanW]
mov edx, dword [esp + 0x2c]
cwde
mov dword [edx], eax
test eax, 0x200
je 0x4684b7
mov ecx, dword [esp + 0x34]
mov byte [ecx], 1
test eax, 0x400
je 0x4684c5
mov edx, dword [esp + 0x38]
mov byte [edx], 1
test eax, 0x100
je 0x468504
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x10]
mov byte [eax], 1
call fcn.00402620
jmp 0x468547
cmp byte [edi + 0x492c98], 0
je 0x4684f7
lea ecx, [esp + 0x10]
mov byte [esp + 0x3c], 0
call fcn.00402620
jmp 0x468547
movzx ecx, byte [edi + str._f_b_b..__reepqrstuvwxyz________t___]
mov edx, dword [esp + 0x2c]
mov dword [edx], ecx
lea ecx, [esp + 0x10]
call fcn.00402620
jmp 0x468547
push eax
call dword [sym.imp.USER32.dll_VkKeyScanW]
mov ecx, dword [esp + 0x2c]
cwde
mov dword [ecx], eax
test eax, 0x200
je 0x46852b
mov edx, dword [esp + 0x34]
mov byte [edx], 1
test eax, 0x400
je 0x468539
mov ecx, dword [esp + 0x38]
mov byte [ecx], 1
test eax, 0x100
je 0x468547
mov edx, dword [esp + 0x30]
mov byte [edx], 1
mov eax, dword [esp + 0x2c]
and dword [eax], 0xff
mov al, byte [esp + 0x3c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x18
Function at 0x428660
Capabilities:
Reference public rsa key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x485fb7
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4a7360]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
push ebx
push ebx
push ebx
mov dword [ebp - 0x18], 0x4aed40
mov dword [0x4aed40], 0x493ebc
mov dword [0x4aed48], 0x493938
call dword [fcn.0048f238]
mov dword [0x4aed4c], eax
mov dword [ebp - 4], ebx
mov dword [0x4aed64], 0xf
mov dword [0x4aed60], ebx
mov byte [0x4aed50], bl
mov byte [ebp - 4], 1
xor eax, eax
mov dword [0x4aed84], 7
mov dword [0x4aed80], ebx
mov word [0x4aed70], ax
mov byte [ebp - 4], 2
mov dword [0x4aed8c], 0x494198
mov dword [0x4aed90], ebx
mov byte [ebp - 4], 3
mov dword [0x4aed9c], 0x4942f0
mov dword [0x4aeda0], ebx
mov dword [0x4aeda4], ebx
mov byte [ebp - 4], 4
push 0xf0000000
push 1
push 0x493e30
push ebx
push 0x4aed94
mov dword [0x4aed44], ebx
mov dword [0x4aed94], ebx
mov dword [0x4aed98], ebx
call dword [fcn.0048f02c]
test eax, eax
je 0x42879d
mov ecx, dword [0x4aed94]
push 0x4aed98
push ebx
push ebx
push 0x94
push 0x4a8518
push ecx
call dword [fcn.0048f028]
test eax, eax
je 0x42879d
mov ecx, dword [0x4aed98]
push ebx
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x14]
push eax
push 9
push ecx
mov dword [ebp - 0x10], 4
call dword [fcn.0048f024]
test eax, eax
je 0x42879d
mov edi, dword [ebp - 0x14]
shr edi, 3
mov esi, 0x4aed9c
call fcn.0042e920
mov dword [ebp - 4], 0xffffffff
mov eax, 0x4aed40
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42bbb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push edi
xor edi, edi
mov dword [ebp - 4], ecx
test ebx, ebx
jle 0x42bc02
push esi
mov esi, 0xa000
cmp ebx, 0xa000
jg 0x42bbd2
mov esi, ebx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
mov edx, dword [ebp + 8]
push ecx
push esi
lea eax, [edi + edx]
push 1
push eax
call fcn.0046a6ed
add esp, 0x10
add edi, eax
cmp eax, esi
jne 0x42bbf7
sub ebx, esi
test ebx, ebx
jg 0x42bbc3
pop esi
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x42bd00
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea ecx, [ebp - 4]
push ecx
push 0
push esi
push 0x42bca0
push 0
push 0
mov dword [esi + 4], eax
mov dword [ebp - 4], 0
call fcn.0046a82c
xor edx, edx
add esp, 0x18
test eax, eax
sete dl
mov dword [esi + 8], eax
mov eax, edx
mov esp, ebp
pop ebp
ret
Function at 0x42ed40
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
mov eax, dword [ebx]
mov edx, dword [eax + 8]
push esi
push edi
mov dword [ebp - 4], ebx
mov dword [ebx + 0xc], 0
call edx
mov edi, dword [ebp + 0xc]
mov edx, 8
cmp dword [edi + 0x14], edx
jb 0x42ed6b
mov ecx, dword [edi]
jmp 0x42ed6d
mov ecx, edi
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], edx
jb 0x42ed77
mov eax, dword [eax]
push ecx
push eax
call fcn.0046a457
mov esi, eax
add esp, 8
mov dword [ebx + 4], esi
test esi, esi
je 0x42ef0e
push 1
lea eax, [ebp + 0xc]
push eax
push edi
mov dword [ebp + 0xc], 0x72
call fcn.00417a10
cmp eax, 0xffffffff
je 0x42ee58
push esi
push 2
lea ecx, [ebp + 0xc]
push 1
push ecx
mov word [ebp + 0xc], 0
mov byte [ebp + 0xe], 0
call fcn.004671e1
add esp, 0x10
cmp eax, 2
jne 0x42ee40
mov ecx, 0x494314
lea eax, [ebp + 0xc]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x42edf2
test dl, dl
je 0x42edee
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x42edf2
add eax, 2
add ecx, 2
test dl, dl
jne 0x42edd2
xor eax, eax
jmp 0x42edf7
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x42ee40
mov edx, dword [ebx + 4]
push edx
push 2
lea eax, [ebp + 0xc]
push 1
push eax
call fcn.004671e1
add esp, 0x10
cmp eax, 2
jne 0x42ef0e
lea ecx, [ebp + 0xc]
push ecx
call fcn.0046a8e2
dec eax
add esp, 4
cmp eax, 9
ja 0x42ef0e
pop edi
pop esi
mov dword [ebx + 0xc], 4
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebx]
mov eax, dword [edx + 0x1c]
push 0
push 0
mov ecx, ebx
call eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
push 1
lea ecx, [ebp + 0xc]
push ecx
push edi
mov dword [ebp + 0xc], 0x77
call fcn.00417a10
cmp eax, 0xffffffff
je 0x42ef0e
mov edi, 2
xor ebx, ebx
jmp 0x42ee80
mov esi, 0xa000
cmp edi, 0xa000
jg 0x42ee8f
mov esi, edi
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
push eax
push esi
lea ecx, [ebx + 0x494314]
push 1
push ecx
call fcn.0046a6ed
add esp, 0x10
add ebx, eax
cmp eax, esi
jne 0x42eeb4
sub edi, esi
test edi, edi
jg 0x42ee80
cmp ebx, 2
jne 0x42ef0e
mov edi, ebx
xor ebx, ebx
lea ecx, [ecx]
mov esi, 0xa000
cmp edi, 0xa000
jg 0x42eecf
mov esi, edi
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
push eax
push esi
lea ecx, [ebx + 0x494318]
push 1
push ecx
call fcn.0046a6ed
add esp, 0x10
add ebx, eax
cmp eax, esi
jne 0x42eef4
sub edi, esi
test edi, edi
jg 0x42eec0
cmp ebx, 2
jne 0x42ef0e
mov edx, dword [ebp - 4]
pop edi
pop esi
mov dword [edx + 0xc], 4
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x42f5d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48234b
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x4a7360]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], 0x49452c
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], 4
mov dword [ebp - 4], edx
mov dword [eax], 0x494550
mov dword [ebp - 4], 1
mov dword [eax], 0x494630
mov dword [ebp - 4], 2
lea ecx, [eax + 0x14]
mov dword [ebp - 0x10], ecx
mov dword [ecx], 0x49452c
mov dword [ecx + 4], edx
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], edx
mov dword [ecx + 0x10], 4
mov byte [ebp - 4], 3
mov dword [ecx], 0x494550
mov byte [ebp - 4], 4
mov dword [ecx], 0x49455c
mov byte [ebp - 4], 5
mov dword [eax + 0x28], edx
mov dword [eax + 0x2c], edx
mov byte [eax + 0x30], dl
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x430700
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [eax + 0x14], 8
mov dword [ebp - 8], 0
jb 0x430715
mov eax, dword [eax]
push 0x492274
push eax
lea eax, [ebp - 8]
push eax
call fcn.0046a46e
add esp, 0xc
test eax, eax
jne 0x43076d
mov eax, dword [ebp - 8]
test eax, eax
je 0x43076d
push eax
push 2
lea ecx, [ebp - 4]
push 1
push ecx
mov word [ebp - 4], 0
call fcn.004671e1
mov edx, dword [ebp - 8]
push edx
call fcn.0046a522
add esp, 0x14
cmp byte [ebp - 4], 0x37
jne 0x430767
cmp byte [ebp - 3], 0x7a
jne 0x430767
mov eax, 1
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x435ad0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x483c76
mov eax, dword fs:[0]
push eax
mov eax, dword [0x4a7360]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax], 0x494788
mov dword [eax + 8], ecx
mov dword [ebp - 4], ecx
mov dword [eax + 0xc], ecx
mov dl, 1
mov byte [ebp - 4], dl
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov word [eax + 0x30], 0x101
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4363b0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x483c45
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a7360]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov al, byte [ebx]
mov edi, dword [ebp + 8]
mov byte [edi], al
mov ecx, dword [ebx + 4]
mov dword [edi + 4], ecx
mov edx, dword [ebx + 8]
lea eax, [ebx + 0xc]
push eax
lea esi, [edi + 0xc]
mov dword [edi + 8], edx
call fcn.004308b0
xor ecx, ecx
mov dword [ebp - 4], ecx
lea eax, [edi + 0x18]
mov dword [ebp - 0x10], eax
mov dword [eax], 0x49452c
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], 4
mov byte [ebp - 4], 1
mov dword [eax], 0x494550
mov byte [ebp - 4], 2
lea ecx, [ebx + 0x18]
push ecx
mov dword [eax], 0x494608
call fcn.004364b0
mov byte [ebp - 4], 3
xor eax, eax
lea esi, [edi + 0x2c]
push eax
mov dword [esi], 0x494600
mov dword [esi + 4], eax
mov dword [esi + 8], eax
call fcn.004662f1
xor ecx, ecx
mov dword [esi + 8], ecx
mov dword [esi + 4], ecx
mov eax, dword [ebx + 0x30]
add esp, 4
cmp eax, ecx
jbe 0x43647d
mov edi, eax
call fcn.00435900
mov edx, dword [ebx + 0x30]
mov eax, dword [ebx + 0x34]
mov ecx, dword [esi + 8]
push edx
push eax
push ecx
call fcn.00465f90
mov edi, dword [ebp + 8]
add esp, 0xc
mov byte [ebp - 4], 4
mov dl, byte [ebx + 0x38]
mov byte [edi + 0x38], dl
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x43fbb0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x484874
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x4a7360]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0x494adc
xor ecx, ecx
mov dword [eax + 8], ecx
lea edx, [eax + 0x10]
mov dword [eax], 0x494af4
mov dword [eax + 4], 0x494b08
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [ebp - 0x10], edx
mov dword [edx + 0xc], ecx
mov dword [ebp - 4], ecx
mov dword [edx + 0x18], ecx
mov dword [ebp - 4], 1
lea edx, [eax + 0x30]
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [ebp - 0x10], edx
mov dword [edx + 0xc], ecx
mov byte [ebp - 4], 2
mov dword [edx + 0x18], ecx
mov byte [ebp - 4], 3
lea edx, [eax + 0x50]
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [ebp - 0x10], edx
mov dword [edx + 0xc], ecx
mov byte [ebp - 4], 4
mov dword [edx + 0x18], ecx
mov byte [ebp - 4], 5
lea edx, [eax + 0x70]
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [ebp - 0x10], edx
mov dword [edx + 0xc], ecx
mov byte [ebp - 4], 6
mov dword [edx + 0x18], ecx
mov byte [ebp - 4], 8
lea edx, [eax + 0x4a0]
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [ebp - 0x10], edx
mov dword [edx + 0x14], ecx
mov byte [ebp - 4], 9
mov dword [edx + 0x20], ecx
mov byte [ebp - 4], 0xa
mov ecx, 0x100000
mov dword [eax + 0x4d8], 0x10000
mov dword [eax + 0x4c8], ecx
mov dword [eax + 0x4cc], ecx
mov dword [eax + 0x4d0], ecx
mov dword [eax + 0x4d4], ecx
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4