joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45fed0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
mov eax, dword [0x4b7480]
xor eax, esp
mov dword [esp + 8], eax
push esi
push edi
mov esi, dword [esp + 0x1c]
mov eax, dword [esi + 0x14]
mov ecx, eax
mov edx, eax
shr eax, 8
shr ecx, 0x18
mov byte [esp + 0xd], al
mov al, byte [esi + 0x14]
mov byte [esp + 0xf], cl
shr edx, 0x10
mov byte [esp + 0xc], al
mov eax, dword [esi + 0x10]
mov ecx, eax
shr ecx, 0x18
mov byte [esp + 0xe], dl
mov edx, eax
mov byte [esp + 0xb], cl
shr edx, 0x10
mov ecx, eax
shr ecx, 8
mov byte [esp + 0xa], dl
mov dl, al
shr eax, 3
mov byte [esp + 9], cl
and eax, 0x3f
mov ecx, 0x40
sub ecx, eax
cmp ecx, 9
mov edi, dword [esp + 0x18]
mov byte [esp + 8], dl
jae 0x45ff44
add ecx, 0x40
add ecx, 0xfffffff8
push ecx
push 0x4b72a8
push esi
call fcn.0045fe20
push 8
lea eax, [esp + 0x18]
push eax
push esi
call fcn.0045fe20
add esp, 0x18
test edi, edi
je 0x45ffdc
movzx ecx, byte [esi + 3]
mov byte [edi + 3], cl
movzx edx, byte [esi + 2]
mov byte [edi + 2], dl
mov eax, dword [esi]
shr eax, 8
mov byte [edi + 1], al
movzx ecx, byte [esi]
mov byte [edi], cl
movzx edx, byte [esi + 7]
mov byte [edi + 7], dl
movzx eax, byte [esi + 6]
mov byte [edi + 6], al
mov ecx, dword [esi + 4]
shr ecx, 8
mov byte [edi + 5], cl
movzx edx, byte [esi + 4]
mov byte [edi + 4], dl
movzx eax, byte [esi + 0xb]
mov byte [edi + 0xb], al
movzx ecx, byte [esi + 0xa]
mov byte [edi + 0xa], cl
mov edx, dword [esi + 8]
shr edx, 8
mov byte [edi + 9], dl
movzx eax, byte [esi + 8]
mov byte [edi + 8], al
movzx ecx, byte [esi + 0xf]
mov byte [edi + 0xf], cl
movzx edx, byte [esi + 0xe]
mov byte [edi + 0xe], dl
mov eax, dword [esi + 0xc]
shr eax, 8
mov byte [edi + 0xd], al
movzx ecx, byte [esi + 0xc]
mov byte [edi + 0xc], cl
push 0x58
push 0
push esi
call fcn.0046e830
mov ecx, dword [esp + 0x1c]
add esp, 0xc
pop edi
pop esi
xor ecx, esp
call fcn.0046f564
add esp, 0xc
ret

Function at 0x460000
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x5c
mov eax, dword [0x4b7480]
xor eax, esp
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x64]
xor ecx, ecx
push esi
mov esi, dword [esp + 0x64]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x6c]
push ecx
push eax
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x10], 0x67452301
mov dword [esp + 0x14], 0xefcdab89
mov dword [esp + 0x18], 0x98badcfe
mov dword [esp + 0x1c], 0x10325476
call fcn.0045fe20
lea eax, [esp + 0x10]
push eax
push esi
call fcn.0045fed0
mov ecx, dword [esp + 0x70]
add esp, 0x14
pop esi
xor ecx, esp
call fcn.0046f564
add esp, 0x5c
ret

Function at 0x460080
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx + 4]
push 0
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8

Function at 0x460100
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov ecx, dword [ecx + 4]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
neg eax
sbb eax, eax
add eax, 1
ret 0xc
Function at 0x4601f0
Capabilities:
Get file size

Disassembly:
sub esp, 0x10
push ebx
mov ebx, ecx
mov eax, dword [ebx + 4]
test eax, eax
jne 0x46020f
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 1
pop ebx
add esp, 0x10
ret
push esi
push edi
push 1
lea esi, [esp + 0x10]
push esi
xor edx, edx
push edx
xor ecx, ecx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x46022f
xor esi, esi
xor edi, edi
jmp 0x460237
mov esi, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
mov ecx, dword [ebx + 4]
lea eax, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp esi, dword [esp + 0x14]
jne 0x46025e
cmp edi, dword [esp + 0x18]
jne 0x46025e
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x10
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret

Function at 0x460270
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov ecx, dword [ecx + 4]
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
lea eax, [esp]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, dword [esp]
mov edx, dword [esp + 4]
add esp, 8
ret

Function at 0x4605e0
Capabilities:
Create directory

Disassembly:
sub esp, 0x204
mov eax, dword [0x4b7480]
xor eax, esp
mov dword [esp + 0x200], eax
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
push edi
mov edi, dword [esp + 0x214]
je 0x46060e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [esp + 0x218]
cmp ebx, 4
je 0x460624
cmp ebx, 1
je 0x460624
cmp ebx, 2
jne 0x46064e
push 0x200
lea eax, [esp + 0x10]
push eax
push edi
call fcn.00460360
add esp, 0xc
push 0
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x46064e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [esp + 0x21c]
push 0
xor edx, edx
push 0x80
cmp eax, 0x80000000
sete dl
push ebx
push 0
push edx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
sub ecx, 0xffffffff
neg ecx
sbb ecx, ecx
and ecx, eax
mov dword [esi + 4], ecx
pop edi
mov eax, ecx
mov ecx, dword [esp + 0x208]
pop esi
pop ebx
xor ecx, esp
call fcn.0046f564
add esp, 0x204
ret 0xc
Function at 0x4607e0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x49d252
mov eax, dword fs:[0]
push eax
mov eax, 0x201c
call fcn.00470980
mov eax, dword [0x4b7480]
xor eax, esp
mov dword [esp + 0x2018], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4b7480]
xor eax, esp
push eax
lea eax, [esp + 0x2030]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x2040]
xor edi, edi
mov dword [esp + 0x1c], edi
mov dword [ebx + 0x18], 0xf
mov dword [ebx + 0x14], edi
mov esi, ecx
mov dword [esp + 0x28], ebx
mov byte [ebx + 4], 0
mov eax, dword [esi + 4]
cmp eax, edi
mov dword [esp + 0x2038], edi
mov dword [esp + 0x1c], 1
mov byte [esp + 0x16], 0
jne 0x460865
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x460879
push 1
lea ebp, [esp + 0x24]
push ebp
xor edx, edx
push edx
xor ecx, ecx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov ecx, esi
call fcn.004601f0
test eax, eax
jne 0x46097a
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, edi
mov edx, dword [esi + 4]
push edi
lea eax, [esp + 0x1c]
push eax
push 1
lea ecx, [esp + 0x23]
push ecx
push edx
call ebp
mov al, byte [esp + 0x17]
cmp al, 0xd
je 0x4608af
cmp al, 0xa
jne 0x4608bf
mov ecx, esi
call fcn.004601f0
test eax, eax
je 0x460890
jmp 0x46097a
mov edx, dword [esi + 4]
cmp edx, edi
jne 0x4608d0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4608e7
push 1
or eax, 0xffffffff
lea edi, [esp + 0x24]
push edi
or ecx, eax
push ecx
push eax
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
xor edi, edi
mov edx, dword [esi + 4]
push 0
lea eax, [esp + 0x1c]
push eax
push 1
lea ecx, [esp + 0x22]
push ecx
push edx
call ebp
mov eax, dword [esi + 4]
test eax, eax
jne 0x46090c
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x460921
push 1
or ecx, 0xffffffff
lea ebp, [esp + 0x24]
push ebp
or edx, ecx
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov al, byte [esp + 0x16]
cmp al, 0xd
je 0x460969
lea esp, [esp]
cmp al, 0xa
je 0x460969
mov ecx, esi
call fcn.004601f0
test eax, eax
jne 0x460969
cmp edi, 0x1fff
jae 0x460969
lea eax, [esp + 0x18]
push eax
push 1
lea ecx, [esp + 0x1e]
push ecx
mov ecx, esi
call fcn.00460100
mov al, byte [esp + 0x16]
mov byte [esp + edi + 0x2c], al
add edi, 1
cmp al, 0xd
jne 0x460930
lea edx, [esp + 0x2c]
push edx
mov ecx, ebx
mov byte [esp + edi + 0x30], 0
call fcn.0040b970
mov eax, ebx
mov ecx, dword [esp + 0x2030]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2018]
xor ecx, esp
call fcn.0046f564
add esp, 0x2028
ret 4
Function at 0x460d70
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x49d2c8
mov eax, dword fs:[0]
push eax
sub esp, 0x208
mov eax, dword [0x4b7480]
xor eax, esp
mov dword [esp + 0x204], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4b7480]
xor eax, esp
push eax
lea eax, [esp + 0x21c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x22c]
xor ebx, ebx
mov edi, ecx
mov dword [esp + 0x14], ebx
push 0x200
lea eax, [esp + 0x1c]
push ebx
push eax
mov dword [esp + 0x230], 2
call fcn.0046e830
mov ebp, 0x10
add esp, 0xc
cmp dword [edi + 0x18], ebp
jb 0x460de7
mov edi, dword [edi + 4]
jmp 0x460dea
add edi, 4
cmp dword [esp + 0x280], ebp
mov edx, dword [esp + 0x26c]
jae 0x460e01
lea edx, [esp + 0x26c]
cmp dword [esp + 0x264], ebp
mov ecx, dword [esp + 0x250]
jae 0x460e18
lea ecx, [esp + 0x250]
cmp dword [esp + 0x248], ebp
mov eax, dword [esp + 0x234]
jae 0x460e2f
lea eax, [esp + 0x234]
push edi
push 0x200
lea edi, [esp + 0x20]
push edi
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
mov edi, 0xf
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], edi
mov byte [esi + 4], bl
jne 0x460ee1
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x270]
push ecx
mov ecx, esi
call fcn.0040a6b0
cmp dword [esp + 0x248], ebp
jb 0x460e84
mov edx, dword [esp + 0x234]
push edx
call fcn.0046e29f
add esp, 4
cmp dword [esp + 0x264], ebp
mov dword [esp + 0x248], edi
mov dword [esp + 0x244], ebx
mov byte [esp + 0x234], bl
jb 0x460eb2
mov eax, dword [esp + 0x250]
push eax
call fcn.0046e29f
add esp, 4
cmp dword [esp + 0x280], ebp
mov dword [esp + 0x264], edi
mov dword [esp + 0x260], ebx
mov byte [esp + 0x250], bl
jb 0x460f75
mov ecx, dword [esp + 0x26c]
push ecx
jmp 0x460f6d
lea eax, [esp + 0x18]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x460ee8
sub eax, edx
push eax
lea edx, [esp + 0x1c]
push edx
mov ecx, esi
call fcn.0040ae30
cmp dword [esp + 0x248], ebp
jb 0x460f19
mov eax, dword [esp + 0x234]
push eax
call fcn.0046e29f
add esp, 4
cmp dword [esp + 0x264], ebp
mov dword [esp + 0x248], edi
mov dword [esp + 0x244], ebx
mov byte [esp + 0x234], bl
jb 0x460f47
mov ecx, dword [esp + 0x250]
push ecx
call fcn.0046e29f
add esp, 4
cmp dword [esp + 0x280], ebp
mov dword [esp + 0x264], edi
mov dword [esp + 0x260], ebx
mov byte [esp + 0x250], bl
jb 0x460f75
mov edx, dword [esp + 0x26c]
push edx
call fcn.0046e29f
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x21c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x204]
xor ecx, esp
call fcn.0046f564
add esp, 0x214
ret 0x58
Function at 0x464bd0
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push edi
mov edi, ecx
cmp dword [edi], 0
je 0x464bdf
mov eax, 1
pop edi
ret
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
push esi
push 8
push 1
push str.Microsoft_Base_Cryptographic_Provider_v1.0
push 0x4a2790
push edi
call ebx
mov esi, eax
test esi, esi
jne 0x464c62
push eax
push 1
push str.Microsoft_Base_Cryptographic_Provider_v1.0
push eax
push edi
call ebx
mov esi, eax
test esi, esi
jne 0x464c62
push 0x20
push 1
push str.Microsoft_Base_Cryptographic_Provider_v1.0
push eax
push edi
call ebx
mov esi, eax
test esi, esi
jne 0x464c62
push 0x28
push 1
push str.Microsoft_Base_Cryptographic_Provider_v1.0
push eax
push edi
call ebx
mov esi, eax
test esi, esi
jne 0x464c62
push eax
push 1
push str.Microsoft_Base_Cryptographic_Provider_v1.0
push 0x4a2790
push edi
call ebx
mov esi, eax
test esi, esi
jne 0x464c62
mov eax, dword [edi]
test eax, eax
je 0x464c6c
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [edi], esi
mov eax, esi
pop esi
pop ebx
pop edi
ret
add edi, 4
push edi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
pop ebx
pop edi
ret
Function at 0x464c80
Capabilities:
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
sub esp, 0x1c
push ebp
xor ebp, ebp
cmp dword [esp + 0x28], ebp
push esi
mov esi, ecx
jle 0x464e0b
call fcn.00464bd0
test eax, eax
je 0x464e0b
lea eax, [esi + 4]
push edi
push eax
mov dword [esp + 0x18], ebp
mov dword [esp + 0x10], ebp
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esp + 0x34]
cmp edi, ebp
je 0x464db6
mov ecx, dword [esi]
lea eax, [esp + 0xc]
push eax
push ebp
push ebp
push 0x8003
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x464d01
lea edx, [esp + 0x30]
push edx
lea ecx, [esp + 0x20]
mov dword [esp + 0x34], str.CryptCreateHash_error
call fcn.0046ea49
push 0x4b08ac
lea eax, [esp + 0x20]
push eax
call fcn.0046e573
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0xc]
push ebp
push ecx
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x464d3c
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x34], str.CryptHashData_error
call fcn.0046ea49
push 0x4b08ac
lea ecx, [esp + 0x20]
push ecx
call fcn.0046e573
mov eax, dword [esp + 0xc]
mov ecx, dword [esi]
lea edx, [esp + 0x14]
push edx
push ebp
push eax
push 0x6801
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x464d7e
lea edx, [esp + 0x30]
push edx
lea ecx, [esp + 0x20]
mov dword [esp + 0x34], str.CryptDeriveKey_error
call fcn.0046ea49
push 0x4b08ac
lea eax, [esp + 0x20]
push eax
call fcn.0046e573
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
test eax, eax
jne 0x464db2
lea edx, [esp + 0x30]
push edx
lea ecx, [esp + 0x20]
mov dword [esp + 0x34], str.CryptDestroyHash_error
call fcn.0046ea49
push 0x4b08ac
lea eax, [esp + 0x20]
push eax
call fcn.0046e573
mov dword [esp + 0xc], ebp
push ebx
mov ebx, dword [esp + 0x30]
xor edi, edi
mov ebp, 0x3e8
mov eax, dword [esp + 0x34]
sub eax, edi
cmp eax, ebp
jbe 0x464dd6
add edi, ebp
mov dword [esp + 0x14], ebp
xor esi, esi
jmp 0x464ddf
mov dword [esp + 0x14], eax
mov esi, 1
mov edx, dword [esp + 0x18]
push ebp
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0
push esi
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test esi, esi
jne 0x464dfe
add ebx, ebp
jmp 0x464dc2
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x1c
ret 0x10
Function at 0x467440
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x49d958
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x4b7480]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x30]
lea edx, [eax + ecx]
push edx
push eax
lea ecx, [esp + 0x14]
call fcn.00466ad0
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esi + 4]
mov dword [esp + 0x28], 0
call fcn.00467330
mov ecx, eax
call fcn.004668c0
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4674b3
push eax
call fcn.0046e29f
add esp, 4
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x1c
ret 0xc
Function at 0x46d11a
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x4b7480]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0046cf79
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.0046e830
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x46d169
cmp dword [ebp - 0x1c], 5
jb 0x46d181
jmp 0x46d17d
cmp dword [ebp - 0x10], 1
jne 0x46d181
cmp dword [ebp - 0x1c], 4
ja 0x46d17d
jne 0x46d181
cmp dword [ebp - 0x18], 0
jbe 0x46d181
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x4a4664
call fcn.0044afd0
test eax, eax
jge 0x46d1a2
mov byte [0x4b88e4], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0046f564
add ebp, 0x78
leave
ret

Function at 0x46d3bb
Capabilities:
Allocate or change rwx memory

Disassembly:
cmp dword [0x4b909c], 0
push esi
jne 0x46d329
call fcn.0046d247
test eax, eax
je 0x46d36c
mov eax, dword [0x4b909c]
cmp eax, 1
jne 0x46d34a
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x46d36c
pop esi
ret
push eax
call dword [0x4b90a4]
test eax, eax
jne 0x46d3b4
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x46d370
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x4b909c]
call dword [0x4b90a4]
mov edi, eax
test edi, edi
je 0x46d397
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x46d3b3
lea edi, [esi + 0xff0]
push esi
push dword [0x4b909c]
call dword [0x4b90a0]
add esi, 0x10
cmp esi, edi
jb 0x46d39d
mov eax, esi
pop edi
pop esi
ret
jmp 0x46d316

Function at 0x46f564
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4b7480]
jne 0x46f56e
repz ret
jmp fcn.0047978c
Function at 0x470a99
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x470ad6
cmp dword [ebp + 0x14], edi
je 0x470ad6
cmp ecx, edi
jne 0x470add
call fcn.00473420
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.0046f0cc
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x470af1
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x470b12
cmp ebx, 0xffffffff
je 0x470b01
push ebx
push edi
push ecx
call fcn.0046e830
add esp, 0xc
cmp esi, edi
je 0x470abe
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x470abe
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x470b2e
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x470b35
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x470c26
test word [esi + 0xc], 0x10c
je 0x470b89
mov eax, dword [esi + 4]
test eax, eax
je 0x470b89
jl 0x470c87
cmp ebx, eax
mov edi, ebx
jb 0x470b5a
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x470c2e
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0046e8aa
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x470c1e
cmp ebx, dword [ebp - 0xc]
jb 0x470bf6
cmp dword [ebp - 0xc], 0
je 0x470bb3
mov ecx, closesocket
xor edx, edx
cmp ebx, ecx
jbe 0x470ba8
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x470baf
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x470bbe
mov eax, closesocket
cmp ebx, eax
ja 0x470bbe
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x470c5a
push eax
push dword [ebp - 8]
push esi
call fcn.0047b714
pop ecx
push eax
call fcn.0047c1c9
add esp, 0xc
test eax, eax
je 0x470c99
cmp eax, 0xffffffff
je 0x470c87
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x470c1e
push esi
call fcn.0047bae8
cmp eax, 0xffffffff
pop ecx
je 0x470c8b
cmp dword [ebp - 4], 0
je 0x470c5a
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x470b3d
mov eax, dword [ebp + 0x14]
jmp 0x470ad8
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x470c45
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.0046e830
add esp, 0xc
call fcn.00473420
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x470ace
cmp dword [ebp + 0xc], 0xffffffff
je 0x470c70
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.0046e830
add esp, 0xc
call fcn.00473420
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x470ace
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x470ad8
or dword [esi + 0xc], 0x10
jmp 0x470c8b
Function at 0x47782d
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x4b77c8]
je 0x477848
inc edi
cmp edi, 0x17
jb 0x477839
cmp edi, 0x17
jae 0x4779c8
push ebp
push 3
call fcn.0048c659
cmp eax, 1
pop ecx
je 0x477994
push 3
call fcn.0048c659
test eax, eax
pop ecx
jne 0x47787c
cmp dword [0x4b74f0], 1
je 0x477994
cmp ebx, 0xfc
je 0x4779c7
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x4b94c8
push ebp
call fcn.0046e5bd
add esp, 0xc
test eax, eax
je 0x4778b2
push esi
push esi
push esi
push esi
push esi
call fcn.0046ef98
add esp, 0x14
push 0x104
mov esi, 0x4b94e1
push esi
push 0
mov byte [0x4b95e5], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4778f6
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.0046e5bd
add esp, 0xc
test eax, eax
je 0x4778f6
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0046ef98
add esp, 0x14
push esi
call fcn.004734f0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x47793b
push esi
call fcn.004734f0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x4b97dc
push 0x4a568c
sub ecx, eax
push ecx
push eax
call fcn.00470005
add esp, 0x14
test eax, eax
je 0x47793b
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.0046ef98
add esp, 0x14
jmp 0x47793d
xor esi, esi
push 0x4a5688
push ebx
push ebp
call fcn.0048344c
add esp, 0xc
test eax, eax
je 0x47795d
push esi
push esi
push esi
push esi
push esi
call fcn.0046ef98
add esp, 0x14
push dword [edi*8 + 0x4b77cc]
push ebx
push ebp
call fcn.0048344c
add esp, 0xc
test eax, eax
je 0x47797f
push esi
push esi
push esi
push esi
push esi
call fcn.0046ef98
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0048c49c
add esp, 0xc
jmp 0x4779c7
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x4779c7
cmp ebp, 0xffffffff
je 0x4779c7
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x4b77cc]
push dword [esi]
call fcn.004734f0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret