joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46cf00
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x290
mov eax, dword [0x55758c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x84]
push edi
push 0x80
push 0
push eax
call fcn.00492e60
push 0x80
lea eax, [ebp - 0x84]
push eax
push esi
call fcn.0046bf10
lea ecx, [ebp - 0x188]
mov edi, esi
mov eax, ecx
add esp, 0x18
mov edx, 0x104
sub edi, eax
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x46cf6a
mov al, byte [edi + ecx]
test al, al
je 0x46cf6a
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x46cf51
lea eax, [ecx - 1]
test edx, edx
cmovne eax, ecx
mov ecx, 0x104
mov byte [eax], 0
lea eax, [ebp - 0x188]
cmp byte [eax], 0
je 0x46cf8b
inc eax
sub ecx, 1
jne 0x46cf80
mov edx, 0x104
mov edi, ecx
mov eax, edx
sub eax, ecx
neg edi
sbb edi, edi
and edi, eax
test ecx, ecx
je 0x46cfe0
lea ecx, [ebp - 0x188]
lea ecx, [ecx + edi]
sub edx, edi
je 0x46cfd5
lea edi, [ebp - 0x84]
mov eax, SysReAllocString
sub edi, ecx
push ebx
nop dword [eax + eax]
test eax, eax
je 0x46cfd4
mov bl, byte [edi + ecx]
test bl, bl
je 0x46cfd4
mov byte [ecx], bl
dec eax
inc ecx
sub edx, 1
jne 0x46cfc0
pop ebx
test edx, edx
lea eax, [ecx - 1]
cmovne eax, ecx
mov byte [eax], 0
push 0x100
lea eax, [ebp - 0x288]
mov dword [ebp - 0x290], 1
push 0
push eax
call fcn.00492e60
add esp, 0xc
mov dword [ebp - 0x28c], 0x100
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x288]
push eax
lea eax, [ebp - 0x290]
push eax
push 0x52b540
push str.SoftwareComMaster
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueA]
test eax, eax
jne 0x46d09a
lea eax, [ebp - 0x288]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x46d064
test cl, cl
je 0x46d060
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x46d064
add eax, 2
add esi, 2
test cl, cl
jne 0x46d044
xor eax, eax
jmp 0x46d069
sbb eax, eax
or eax, 1
test eax, eax
je 0x46d09a
lea ecx, [ebp - 0x288]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46d076
sub ecx, edx
lea eax, [ebp - 0x288]
push ecx
push eax
push 1
push str.mid_old
push str.SoftwareComMaster
push reloc.OLEAUT32.dll_SysReAllocString
call edi
lea ecx, [ebp - 0x188]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46d0a3
sub ecx, edx
lea eax, [ebp - 0x188]
push ecx
push eax
push 1
push 0x52b540
push str.SoftwareComMaster
push reloc.OLEAUT32.dll_SysReAllocString
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00464278
mov esp, ebp
pop ebp
ret
Function at 0x46f760
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x511152
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x55758c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], 0
cmp dword [ebp + 0xc], 0
je 0x46f7bc
mov dword [esi], 0x52b868
mov dword [esi + 0x10], 0x52b870
mov dword [esi + 0x68], vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
push 0
push 0
lea edi, [esi + 0x18]
mov ecx, esi
push edi
call fcn.0046f4e0
lea edx, [esi + 0x10]
mov dword [ebp + 0xc], edx
mov eax, dword [edx]
mov eax, dword [eax + 4]
mov dword [edx + eax], vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [edx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + edx - 4], eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov dword [esi + eax], vtable.std::basic_iostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x20]
mov dword [ecx + esi - 4], eax
mov eax, dword [esi]
push 8
mov dword [ebp - 4], 4
mov eax, dword [eax + 4]
mov dword [esi + eax], vtable.std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
mov dword [ebp + 0xc], edi
lea eax, [ecx - 0x68]
mov dword [ecx + esi - 4], eax
mov dword [edi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.0042e4e0
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x46f84c
push 1
mov byte [ebp - 4], 5
call fcn.004e818a
add esp, 4
mov dword [ebx + 4], eax
jmp 0x46f84e
xor ebx, ebx
lea eax, [edi + 4]
mov dword [edi + 0x34], ebx
mov dword [edi + 0xc], eax
lea ecx, [edi + 8]
mov ebx, dword [ebp + 8]
lea eax, [edi + 0x14]
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [edi + 0x10], ecx
mov dword [ecx], 0
mov ecx, ebx
mov eax, dword [edi + 0x20]
not ecx
and ecx, 1
shl ecx, 2
mov edx, ecx
mov dword [eax], 0
or edx, 2
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, ebx
and al, 2
mov dword [edi], vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov eax, ebx
mov dword [edi + 0x38], 0
cmovne edx, ecx
mov ecx, edx
or ecx, 8
and al, 8
cmove ecx, edx
mov eax, ecx
or eax, 0x10
and bl, 4
cmove eax, ecx
mov dword [edi + 0x3c], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4738c6
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x4cd236
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004cce36

Function at 0x4cd241
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004ccfb9

Function at 0x4d377c
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004d2f00

Function at 0x4d3787
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004d313f

Function at 0x4d42e8
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004d41b5

Function at 0x4dc7e7
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
and eax, 0x3f
mov edx, dword [ebp + 0xc]
push ebx
sar ecx, 6
push esi
push edi
imul edi, eax, 0x30
mov eax, dword [ecx*4 + 0x560c40]
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4dc828
cmp byte [edx], 0xa
jne 0x4dc828
or byte [eax + edi + 0x28], 4
jmp 0x4dc82d
and byte [eax + edi + 0x28], 0xfb
lea eax, [edx + ecx]
mov ebx, edx
mov dword [ebp - 8], eax
mov esi, edx
cmp edx, eax
jae 0x4dc91e
mov al, byte [ebx]
cmp al, 0x1a
je 0x4dc8ff
cmp al, 0xd
je 0x4dc856
mov byte [esi], al
inc esi
inc ebx
jmp 0x4dc8f4
lea eax, [ebx + 1]
cmp eax, dword [ebp - 8]
jae 0x4dc876
cmp byte [eax], 0xa
jne 0x4dc86b
push 2
mov byte [esi], 0xa
pop eax
jmp 0x4dc871
xor eax, eax
mov byte [esi], 0xd
inc eax
add ebx, eax
inc esi
jmp 0x4dc8f4
push 0
mov ebx, eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4dc8ed
cmp dword [ebp - 0x14], 0
je 0x4dc8ed
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x560c40]
test byte [eax + edi + 0x28], 0x48
je 0x4dc8c4
mov dl, byte [ebp - 1]
cmp dl, 0xa
jne 0x4dc8b4
mov byte [esi], dl
jmp 0x4dc8f0
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x560c40]
mov byte [eax + edi + 0x2a], dl
jmp 0x4dc8f0
cmp byte [ebp - 1], 0xa
jne 0x4dc8d6
mov edx, dword [ebp + 0xc]
cmp esi, edx
jne 0x4dc8d6
mov byte [esi], 0xa
jmp 0x4dc873
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.004de485
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x4dc8f1
mov byte [esi], 0xd
inc esi
mov edx, dword [ebp + 0xc]
cmp ebx, dword [ebp - 8]
jb 0x4dc83f
jmp 0x4dc91e
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x560c40]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4dc919
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4dc91e
mov cl, byte [ebx]
mov byte [esi], cl
inc esi
sub esi, edx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4dc929
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
and eax, 0x3f
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
sar ecx, 6
imul edi, eax, 0x30
mov dword [ebp - 8], ecx
push 0xa
mov eax, dword [ecx*4 + 0x560c40]
pop ebx
mov edx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], edx
mov edx, dword [ebp + 0xc]
test esi, esi
je 0x4dc96d
cmp word [edx], bx
jne 0x4dc96d
or byte [edi + eax + 0x28], 4
jmp 0x4dc972
and byte [edi + eax + 0x28], 0xfb
lea eax, [edx + esi*2]
mov ebx, edx
mov dword [ebp - 0xc], eax
mov esi, edx
cmp edx, eax
jae 0x4dcac6
mov dword [ebp - 0x10], 0xd
movzx eax, word [ebx]
cmp eax, 0x1a
je 0x4dcaa6
cmp ax, word [ebp - 0x10]
je 0x4dc9ab
mov word [esi], ax
add esi, 2
add ebx, 2
jmp 0x4dca9b
lea eax, [ebx + 2]
cmp eax, dword [ebp - 0xc]
jae 0x4dc9d1
push 0xa
pop ecx
cmp word [eax], cx
jne 0x4dc9c1
push ecx
pop eax
push 4
jmp 0x4dc9c6
push 0xd
pop eax
push 2
mov word [esi], ax
pop eax
add ebx, eax
jmp 0x4dca95
push 0
mov ebx, eax
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4dca8c
cmp dword [ebp - 0x18], 0
je 0x4dca8c
mov ecx, dword [ebp - 8]
push 0xa
mov eax, dword [ecx*4 + 0x560c40]
test byte [edi + eax + 0x28], 0x48
pop eax
je 0x4dca58
mov dx, word [ebp - 4]
cmp dx, ax
jne 0x4dca1c
mov word [esi], ax
jmp 0x4dca50
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ecx*4 + 0x560c40]
mov word [ebp - 0x20], dx
push 0xa
mov byte [edi + eax + 0x2a], dl
mov ecx, dword [ecx*4 + 0x560c40]
mov al, byte [ebp - 0x1f]
pop edx
mov byte [edi + ecx + 0x2b], al
mov ecx, dword [ebp - 8]
mov eax, dword [ecx*4 + 0x560c40]
mov byte [edi + eax + 0x2c], dl
mov edx, dword [ebp + 0xc]
add esi, 2
jmp 0x4dca9b
cmp word [ebp - 4], ax
jne 0x4dca6d
mov edx, dword [ebp + 0xc]
cmp esi, edx
jne 0x4dca6d
mov word [esi], ax
add esi, 2
jmp 0x4dca9b
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.004de485
mov edx, dword [ebp + 0xc]
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x4dca98
jmp 0x4dca8f
mov edx, dword [ebp + 0xc]
push 0xd
pop eax
mov word [esi], ax
add esi, 2
mov ecx, dword [ebp - 8]
cmp ebx, dword [ebp - 0xc]
jb 0x4dc98b
jmp 0x4dcac6
mov ecx, dword [ecx*4 + 0x560c40]
mov al, byte [edi + ecx + 0x28]
test al, 0x40
jne 0x4dcabd
or al, 2
mov byte [edi + ecx + 0x28], al
jmp 0x4dcac6
mov cx, word [ebx]
mov word [esi], cx
add esi, 2
sub esi, edx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e4570
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0
push dword [ebp + 8]
call fcn.004e4b80
add esp, 8
test al, al
je 0x4e4595
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4e4595
mov al, 1
pop ebp
ret
xor al, al
pop ebp
ret

Function at 0x4e4b80
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
pop ebp
ret

Function at 0x4e6030
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4e605b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4e605b
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
add ecx, esi
pop esi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x4013c0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x414fb0
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x41515a
push ebx
mov ebx, dword [esp + 0x10]
nop word [eax + eax]
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x7b
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xd6
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0x8b
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xd6
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x32
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
add esp, 0x44
push eax
call fcn.004013a7
add byte [esi + ebx], 0xad
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x2b
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xad
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x13
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xea
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x28
add esp, 0x40
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xd4
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0xc0
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x11
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xaa
add esp, 0x30
inc esi
cmp esi, edi
jb 0x414fd0
pop ebx
pop edi
pop esi
ret

Function at 0x4035da
Capabilities:
Terminate process

Disassembly:
jmp 0x453329
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x45333a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405920
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x40370b
Capabilities:
Query environment variable

Disassembly:
jmp 0x49c7e2
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49c7f3
pop esi
ret
push ebx
push edi
push esi
call fcn.0049c6c9
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fe9
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49c81b
push ebx
push esi
push edi
call fcn.00405713
add esp, 0xc
push 0
call fcn.00406262
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x43e154
Capabilities:
Parse pe header
Read file on windows
Write file on windows

Disassembly:
push ebp
push esp
pop ebp
add esp, 0xfffffeb8
push ebx
push esi
push edi
push eax
pop esi
mov byte [ebp - 1], 0
sub ebx, ebx
push 0
push 0x80
push 3
push 0
push 1
push 0xc0000000
mov eax, esi
call fcn.004044e4
push eax
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cdq
cmp edx, 0
jne 0x43e1a1
cmp eax, 0xffffffff
jne 0x43e1a1
mov byte [ebp - 1], 1
jmp 0x43e31e
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x43e1d0
push 0
lea eax, [ebp - 8]
push eax
push 0x40
lea eax, [ebp - 0x4e]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x43e1d0
mov bl, 1
test bl, bl
jne 0x43e1dd
mov byte [ebp - 1], 1
jmp 0x43e31e
xor ebx, ebx
cmp word [ebp - 0x4e], 0x5a4d
je 0x43e1ed
cmp dword [ebp - 8], 0x40
jne 0x43e23f
push 0
push 0
mov eax, dword [ebp - 0x12]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x43e23f
push 0
lea eax, [ebp - 8]
push eax
push 0xf8
lea eax, [ebp - 0x146]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x43e23f
mov eax, dword [ebp - 0x146]
cmp eax, 0x4550
je 0x43e23d
cmp eax, 0x454e
je 0x43e23d
cmp eax, 0x454c
jne 0x43e23f
mov bl, 1
test bl, bl
je 0x43e315
xor eax, eax
push ebp
push 0x43e30b
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0043e0ac
mov dword [ebp - 0x13e], eax
call fcn.00402ab0
nop
push 9
nop
pop eax
call fcn.00402ca8
mov word [ebp - 0x102], ax
nop
push 9
nop
pop eax
call fcn.00402ca8
mov word [ebp - 0x100], ax
push 0
push 0
mov eax, dword [ebp - 0x12]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x43e2c1
push 0
lea eax, [ebp - 8]
push eax
push 0xf8
lea eax, [ebp - 0x146]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
cmp word [ebp - 0x4e], 0x5a4d
je 0x43e301
mov word [ebp - 0xe], 0x5a4d
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x43e301
push 0
lea eax, [ebp - 8]
push eax
push 2
lea eax, [ebp - 0xe]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43e315
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43f894
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push ebp
push esp
pop ebp
add esp, 0xfffffeb0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14c], ebx
mov dword [ebp - 0x150], ebx
push ecx
pop esi
mov dword [ebp - 4], edx
push eax
pop ebx
mov edi, dword [ebp + 8]
sub eax, eax
push ebp
push 0x43fa20
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov dword [esi], 2
mov eax, edi
call fcn.00404024
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push ebx
pop eax
call fcn.004044e4
push eax
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x43fa02
push 0
push 0
push 0
push ebx
call sub.kernel32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x43f9fc
push 0
lea eax, [ebp - 0xc]
push eax
push 0x40
lea eax, [ebp - 0x50]
push eax
push ebx
call sub.kernel32.dll_ReadFile
or eax, eax
je 0x43f9fc
cmp word [ebp - 0x50], 0x5a4d
jne 0x43f9fc
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
push ebx
call sub.kernel32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x43f9fc
push 0
lea eax, [ebp - 0xc]
push eax
push 0xf8
lea eax, [ebp - 0x148]
push eax
push ebx
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x43f9fc
cmp dword [ebp - 0x148], 0x4550
jne 0x43f9fc
mov eax, dword [ebp - 0x140]
xor eax, 0x50485e00
xor eax, dword [ebp - 0x120]
movzx edx, word [ebp - 0x142]
xor eax, edx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 4], 2
jne 0x43f9af
call fcn.0043c774
add eax, 0x7c6
xor dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jle 0x43f9c9
cmp dword [ebp - 0x10], 0x7a120
jge 0x43f9c9
mov eax, dword [ebp - 0x10]
mov dword [esi], eax
mov byte [ebp - 5], 1
jmp 0x43f9fc
lea edx, [ebp - 0x14c]
mov eax, dword [ebp - 0x10]
call fcn.00407a8c
mov eax, dword [ebp - 0x14c]
push eax
lea edx, [ebp - 0x150]
mov eax, 0x43fa3c
call fcn.0043e5bc
mov edx, dword [ebp - 0x150]
mov eax, edi
pop ecx
call fcn.00404330
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43fa27
lea eax, [ebp - 0x150]
mov edx, 2
call fcn.00404048
ret
Function at 0x43fa6c
Capabilities:
Parse pe header
Read file on windows
Write file on windows

Disassembly:
push ebp
push esp
pop ebp
add esp, 0xfffffebc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 1], dl
mov esi, eax
xor eax, eax
push ebp
push 0x43fc2a
push dword fs:[eax]
mov dword fs:[eax], esp
sub ebx, ebx
push 0
push 0x80
push 3
push 0
push 1
push 0xc0000000
mov eax, esi
call fcn.004044e4
push eax
call sub.kernel32.dll_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x43fc0e
push 0
push 0
push 0
push esi
call sub.kernel32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x43fc08
push 0
lea eax, [ebp - 8]
push eax
push 0x40
lea eax, [ebp - 0x4c]
push eax
push esi
call sub.kernel32.dll_ReadFile
or eax, eax
je 0x43fc08
cmp word [ebp - 0x4c], 0x5a4d
jne 0x43fc08
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
push esi
call sub.kernel32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x43fc08
push 0
lea eax, [ebp - 8]
push eax
push 0xf8
lea eax, [ebp - 0x144]
push eax
push esi
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x43fc08
cmp dword [ebp - 0x144], 0x4550
jne 0x43fc08
call sub.kernel32.dll_GetCurrentProcessId
add eax, 0x7c6
xor eax, dword [ebp - 0x13c]
mov dword [ebp - 0x13c], eax
call fcn.00402ab0
nop
push 9
nop
pop eax
call fcn.00402ca8
mov word [ebp - 0x100], ax
nop
push 9
nop
pop eax
call fcn.00402ca8
mov word [ebp - 0xfe], ax
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
push esi
call sub.kernel32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x43fbac
push 0
lea eax, [ebp - 8]
push eax
push 0xf8
lea eax, [ebp - 0x144]
push eax
push esi
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb ebx, ebx
inc ebx
cmp byte [ebp - 1], 0
je 0x43fc08
mov eax, 0x200
call fcn.00402ca8
mov edi, eax
shl edi, 4
or edi, edi
jle 0x43fc08
push 2
push 0
push 0
push esi
call sub.kernel32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x43fc08
push edi
lea eax, [ebp - 0xc]
nop
nop
push 1
pop ecx
mov edx, dword [0x43fa48]
call fcn.004053ac
add esp, 4
mov edx, edi
mov eax, dword [ebp - 0xc]
call fcn.00406574
push 0
lea eax, [ebp - 8]
push eax
push edi
mov eax, dword [ebp - 0xc]
push eax
push esi
call sub.kernel32.dll_WriteFile_1
push esi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43fc31
lea eax, [ebp - 0xc]
mov edx, dword [0x43fa48]
call fcn.004053b8
ret