joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e950
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc30
mov eax, dword [0x5ca3a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov word [ebp - 0xa10], 0
push 0x206
push 0
lea eax, [ebp - 0xa0e]
push eax
call fcn.0047d440
add esp, 0xc
push 0x5724ec
lea ecx, [ebp - 0xa10]
push ecx
call fcn.0047ddf0
add esp, 8
mov dword [ebp - 0xc24], 0x1f4
mov word [ebp - 0x5f8], 0
push 0x3e6
push 0
lea edx, [ebp - 0x5f6]
push edx
call fcn.0047d440
add esp, 0xc
lea eax, [ebp - 0xa10]
push eax
push 0x5724fc
lea ecx, [ebp - 0xc18]
push ecx
call fcn.0047d5b8
add esp, 0xc
mov word [ebp - 0x210], 0
push 0x206
push 0
lea edx, [ebp - 0x20e]
push edx
call fcn.0047d440
add esp, 0xc
mov word [ebp - 0x808], 0
push 0x206
push 0
lea eax, [ebp - 0x806]
push eax
call fcn.0047d440
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x808]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
lea edx, [ebp - 0x808]
push edx
call fcn.00405ae0
add esp, 8
mov word [eax], 0
lea eax, [ebp - 0xc18]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42ea58
jmp 0x42ebe0
lea ecx, [ebp - 0x808]
push ecx
call fcn.0047dc42
add esp, 4
lea edx, [ebp + eax*2 - 0x806]
push edx
lea eax, [ebp - 0x210]
push eax
call fcn.0047ddf0
add esp, 8
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0xa10]
push edx
push 0x572514
lea eax, [ebp - 0xc18]
push eax
call fcn.0047d5b8
add esp, 0x10
lea ecx, [ebp + 0xc]
mov dword [ebp - 0xc1c], ecx
mov edx, dword [ebp - 0xc1c]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0xc24]
sub ecx, 1
push ecx
lea edx, [ebp - 0x5f8]
push edx
call fcn.004837e9
add esp, 0x10
mov eax, dword [ebp - 0xc24]
mov word [ebp + eax*2 - 0x5fa], 0
mov dword [ebp - 0xc20], 0
lea ecx, [ebp - 0xc18]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42eb02
mov dword [ebp - 0xc20], 1
push 0x572528
lea edx, [ebp - 0xc18]
push edx
call fcn.00483704
add esp, 8
mov dword [ebp - 0x5fc], eax
cmp dword [ebp - 0x5fc], 0
je 0x42ebe0
cmp dword [ebp - 0xc20], 0
jne 0x42eb55
mov word [ebp - 0xc30], 0xfeff
mov eax, dword [ebp - 0x5fc]
push eax
push 2
push 1
lea ecx, [ebp - 0xc30]
push ecx
call fcn.004835bc
add esp, 0x10
lea edx, [ebp - 0x5f8]
push edx
call fcn.0047dc42
add esp, 4
mov dword [ebp - 0xc28], eax
mov eax, dword [ebp - 0x5fc]
push eax
mov ecx, dword [ebp - 0xc28]
shl ecx, 1
push ecx
push 1
lea edx, [ebp - 0x5f8]
push edx
call fcn.004835bc
add esp, 0x10
mov word [ebp - 0xc2c], 0xd
mov eax, dword [ebp - 0x5fc]
push eax
push 2
push 1
lea ecx, [ebp - 0xc2c]
push ecx
call fcn.004835bc
add esp, 0x10
mov word [ebp - 0xc2c], 0xa
mov edx, dword [ebp - 0x5fc]
push edx
push 2
push 1
lea eax, [ebp - 0xc2c]
push eax
call fcn.004835bc
add esp, 0x10
mov ecx, dword [ebp - 0x5fc]
push ecx
call fcn.004833e1
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047da50
mov esp, ebp
pop ebp
ret
Function at 0x42fde0
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64c
mov eax, dword [0x5ca3a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x64c], ecx
mov word [ebp - 0x224], 0
xor eax, eax
mov dword [ebp - 0x222], eax
mov dword [ebp - 0x21e], eax
mov dword [ebp - 0x21a], eax
mov dword [ebp - 0x216], eax
mov word [ebp - 0x212], ax
mov word [ebp - 0x210], 0
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.0047d440
add esp, 0xc
push 0x104
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x5726d8
call fcn.0047dc42
add esp, 4
push eax
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x224]
push ecx
call fcn.00484d6f
add esp, 0xc
mov word [ebp - 0x648], 0
push 0x206
push 0
lea edx, [ebp - 0x646]
push edx
call fcn.0047d440
add esp, 0xc
mov word [ebp - 0x440], 0
push 0x206
push 0
lea eax, [ebp - 0x43e]
push eax
call fcn.0047d440
add esp, 0xc
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x22c], 0
push 0x104
lea ecx, [ebp - 0x440]
push ecx
lea edx, [ebp - 0x22c]
push edx
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x234]
push ecx
push 0x104
lea edx, [ebp - 0x648]
push edx
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 0
je 0x42ff37
mov ecx, dword [ebp - 0x234]
push ecx
push str._08X
mov edx, dword [ebp + 8]
push edx
call fcn.0047d5b8
add esp, 0xc
jmp 0x42ff48
push 0x5726ec
mov eax, dword [ebp + 8]
push eax
call fcn.0047ddf0
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047da50
mov esp, ebp
pop ebp
ret 4
Function at 0x431440
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x5ca3a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x41c], ecx
mov word [ebp - 0x210], 0
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.0047d440
add esp, 0xc
mov word [ebp - 0x418], 0
push 0x206
push 0
lea ecx, [ebp - 0x416]
push ecx
call fcn.0047d440
add esp, 0xc
push 0
push 0x2b
lea edx, [ebp - 0x210]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str._shiqiang_
lea eax, [ebp - 0x210]
push eax
call fcn.0047ddc6
add esp, 8
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4314de
push 0
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x418]
push ecx
call fcn.0047ddf0
add esp, 8
push str.wnsoft.ini
lea edx, [ebp - 0x418]
push edx
call fcn.0047ddc6
add esp, 8
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4315ac
lea ecx, [ebp - 0x418]
push ecx
mov edx, dword [ebp - 0x41c]
mov eax, dword [edx]
push eax
push 0x572980
push 0x5729a0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 0x418]
push ecx
mov edx, dword [ebp - 0x41c]
mov eax, dword [edx]
add eax, 0x208
push eax
push 0x5729b0
push 0x5729d0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 0x418]
push ecx
mov edx, dword [ebp - 0x41c]
mov eax, dword [edx]
add eax, 0x410
push eax
push 0x5729e0
push 0x572a00
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 0x418]
push ecx
mov edx, dword [ebp - 0x41c]
mov eax, dword [edx]
add eax, 0x618
push eax
push 0x572a10
push str.Globals
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047da50
mov esp, ebp
pop ebp
ret
Function at 0x4315c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x572a40
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4315f2
jmp 0x4316c7
push 0
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.ShiQiang
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x431622
jmp 0x4316c7
mov dword [ebp - 4], 0
push 0x104
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push ecx
push 1
push 0
push str.OnlyIdentifier1
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x104
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
add ecx, 0x208
push ecx
push 1
push 0
push str.OnlyIdentifier2
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x104
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
add ecx, 0x410
push ecx
push 1
push 0
push str.OnlyIdentifier3
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x104
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
add ecx, 0x618
push ecx
push 1
push 0
push str.OnlyIdentifier4
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret

Function at 0x446e10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
jne 0x446e26
xor eax, eax
jmp 0x446e5f
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 1
mov edx, dword [ebp + 0xc]
push edx
call fcn.00485565
add esp, 0x10
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
cmp eax, dword [ebp - 4]
jne 0x446e51
xor eax, eax
jmp 0x446e5f
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call fcn.0048529a
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x446e70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
jne 0x446e86
xor eax, eax
jmp 0x446ebf
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 1
mov edx, dword [ebp + 0xc]
push edx
call fcn.004835bc
add esp, 0x10
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
cmp eax, dword [ebp - 4]
jne 0x446eb1
xor eax, eax
jmp 0x446ebf
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call fcn.0048529a
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x4484e0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x5ca3a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x120], 0x114
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x448512
xor eax, eax
jmp 0x44851e
cmp dword [ebp - 0x11c], 5
sbb eax, eax
add eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047da50
mov esp, ebp
pop ebp
ret

Function at 0x44a980
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
jmp 0x44a998
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x100
jae 0x44a9eb
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 0
jmp 0x44a9b9
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 8
jae 0x44a9dc
mov eax, dword [ebp - 8]
shr eax, 1
mov ecx, dword [ebp - 8]
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
xor eax, ecx
mov dword [ebp - 8], eax
jmp 0x44a9b0
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov dword [edx*4 + 0x5d49a0], eax
jmp 0x44a98f
jmp 0x44a9f6
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x800
jae 0x44aa2e
mov edx, dword [ebp - 4]
mov eax, dword [edx*4 + 0x5d45a0]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
and ecx, 0xff
mov edx, dword [ebp - 0x10]
shr edx, 8
xor edx, dword [ecx*4 + 0x5d49a0]
mov eax, dword [ebp - 4]
mov dword [eax*4 + 0x5d49a0], edx
jmp 0x44a9ed
mov dword [0x5d69a0], fcn.0044aa50
call fcn.004483b0
test eax, eax
jne 0x44aa4b
mov dword [0x5d69a0], 0x44ab60
mov esp, ebp
pop ebp
ret

Function at 0x453260
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
add eax, 0x14
push eax
push 0
mov ecx, dword [ebp - 8]
push ecx
push 0x4535a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 8]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0x18], 0
jne 0x453296
jmp 0x4532b3
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x18], 0xffffffff
jne 0x4532a1
jmp 0x4532b3
push 0xffffffffffffffff
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
mov esp, ebp
pop ebp
ret

Function at 0x4532c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
add eax, 0x14
push eax
push 0
mov ecx, dword [ebp - 8]
push ecx
push 0x4535c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 8]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0x18], 0
jne 0x4532f6
jmp 0x453313
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x18], 0xffffffff
jne 0x453301
jmp 0x453313
push 0xffffffffffffffff
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
mov esp, ebp
pop ebp
ret
Function at 0x458530
Capabilities:
Check if file exists
Delete file
Download url
Get common file path
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x569f98
mov eax, dword fs:[0]
push eax
sub esp, 0x854
mov eax, dword [0x5ca3a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x860], ecx
mov dword [ebp - 0x85c], 0
mov dword [ebp - 4], 2
mov word [ebp - 0x42c], 0
push 0x206
push 0
lea eax, [ebp - 0x42a]
push eax
call fcn.0047d440
add esp, 0xc
mov word [ebp - 0x634], 0
push 0x206
push 0
lea ecx, [ebp - 0x632]
push ecx
call fcn.0047d440
add esp, 0xc
mov word [ebp - 0x21c], 0
push 0x206
push 0
lea edx, [ebp - 0x21a]
push edx
call fcn.0047d440
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x104
lea ecx, [ebp - 0x634]
push ecx
lea edx, [ebp - 0x21c]
push edx
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
lea eax, [ebp - 0x634]
push eax
lea ecx, [ebp - 0x42c]
push ecx
call fcn.0047ddf0
add esp, 8
lea ecx, [ebp + 0x28]
call fcn.00401800
push eax
lea edx, [ebp - 0x42c]
push edx
call fcn.0047ddc6
add esp, 8
lea eax, [ebp - 0x42c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x458646
lea ecx, [ebp - 0x42c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea edx, [ebp - 0x634]
push edx
lea ecx, [ebp - 0x858]
call fcn.00401610
mov byte [ebp - 4], 3
lea eax, [ebp + 0x28]
push eax
lea ecx, [ebp - 0x858]
call fcn.00403f60
mov word [ebp - 0x83c], 0
push 0x206
push 0
lea ecx, [ebp - 0x83a]
push ecx
call fcn.0047d440
add esp, 0xc
push 0
push 0
lea ecx, [ebp - 0x858]
call fcn.00401800
push eax
lea ecx, [ebp + 0xc]
call fcn.00401800
push eax
push 0
call sub.urlmon.dll_URLDownloadToFileW
mov dword [ebp - 0x220], eax
lea ecx, [ebp - 0x858]
call fcn.00401800
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x45870e
push 0x574074
mov ecx, dword [ebp + 8]
call fcn.00401610
mov edx, dword [ebp - 0x85c]
or edx, 1
mov dword [ebp - 0x85c], edx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x858]
call fcn.00401650
mov byte [ebp - 4], 1
lea ecx, [ebp + 0xc]
call fcn.00401650
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x28]
call fcn.00401650
mov eax, dword [ebp + 8]
jmp 0x458756
lea eax, [ebp - 0x858]
push eax
mov ecx, dword [ebp + 8]
call fcn.00403610
mov ecx, dword [ebp - 0x85c]
or ecx, 1
mov dword [ebp - 0x85c], ecx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x858]
call fcn.00401650
mov byte [ebp - 4], 1
lea ecx, [ebp + 0xc]
call fcn.00401650
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x28]
call fcn.00401650
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047da50
mov esp, ebp
pop ebp
ret 0x3c
Function at 0x458de0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
movzx ecx, word [edx + 0x14]
lea edx, [eax + ecx + 0x18]
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], 0
jmp 0x458e1f
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x28
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
movzx ecx, word [eax + 6]
cmp dword [ebp - 4], ecx
jge 0x458ed0
mov edx, dword [ebp - 0x14]
cmp dword [edx + 0x10], 0
jne 0x458e84
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x38]
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0
jle 0x458e82
push 4
push 0x1000
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
add ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0xc]
push ecx
push 0
mov edx, dword [ebp - 8]
push edx
call fcn.0047d440
add esp, 0xc
jmp 0x458e0d
push 4
push 0x1000
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
add eax, dword [edx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x10]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x14]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.00482b90
add esp, 0xc
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov dword [eax + 8], ecx
jmp 0x458e0d
mov esp, ebp
pop ebp
ret
Function at 0x458ee0
Capabilities:
Enumerate pe sections
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
mov eax, dword [edx]
movzx edx, word [eax + 0x14]
lea eax, [ecx + edx + 0x18]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
jmp 0x458f16
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
add edx, 0x28
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
movzx edx, word [ecx + 6]
cmp dword [ebp - 4], edx
jge 0x45902b
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x24]
and ecx, 0x20000000
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x24]
and eax, 0x40000000
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x24]
and edx, 0x80000000
neg edx
sbb edx, edx
neg edx
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x24]
and ecx, 0x2000000
je 0x458f92
push 0x4000
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x10]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x458f04
mov eax, dword [ebp - 0x14]
shl eax, 4
mov ecx, dword [ebp - 0x1c]
lea edx, [eax + ecx*8 + 0x5c8b68]
mov eax, dword [ebp - 0x10]
mov ecx, dword [edx + eax*4]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x24]
and eax, 0x4000000
je 0x458fc4
mov ecx, dword [ebp - 0x18]
or ecx, 0x200
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x459004
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x24]
and edx, 0x40
je 0x458feb
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x20]
mov dword [ebp - 0x20], edx
jmp 0x459004
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x24]
and ecx, 0x80
je 0x459004
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [eax + 0x24]
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], 0
jbe 0x459026
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x10]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x458f04
mov esp, ebp
pop ebp
ret
Function at 0x45a060
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x56a133
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x5ca3a0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor ebx, ebx
or eax, 0xffffffff
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov dword [esi + 0xc], ebx
mov dword [esi + 0x20], 0x5d6aa8
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [esp + 0x18], ebx
mov dword [ecx], 0x5d6aa8
mov dword [esi + 0x40], eax
mov dword [esi + 0x3c], eax
push ebx
push 0x5b7c7c
mov byte [esp + 0x20], 1
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], bl
mov byte [esi + 0x2c], bl
mov dword [esi + 0x30], ebx
call fcn.0045d2e0
mov dword [esi + 0x40], ebx
mov dword [esi + 0x3c], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x45a110
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x56a328
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5ca3a0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebx, ecx
mov ebp, dword [esp + 0x28]
xor edi, edi
cmp ebp, edi
jne 0x45a152
push edi
push edi
push edi
push 2
call fcn.0045b930
xor al, al
jmp 0x45a2ef
mov esi, dword [ebx + 0x18]
cmp esi, edi
je 0x45a171
lea esp, [esp]
mov ecx, esi
mov eax, dword [ecx]
mov edx, dword [eax]
mov esi, dword [esi + 0x28]
push 1
call edx
cmp esi, edi
jne 0x45a160
push 2
or eax, 0xffffffff
mov dword [ebx + 0x18], edi
mov dword [ebx + 0x1c], edi
push edi
push ebp
mov dword [ebx + 8], eax
mov dword [ebx + 4], eax
call fcn.004845aa
push ebp
call fcn.00485718
push 0
push 0
push ebp
mov edi, eax
call fcn.004845aa
add esp, 0x1c
test edi, edi
jne 0x45a1b5
push edi
push edi
push edi
push 0xd
mov ecx, ebx
call fcn.0045b930
xor al, al
jmp 0x45a2ef
mov dword [esp + 0x14], 0x5d6aa8
push edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], 0
call fcn.0045d240
lea eax, [edi + 1]
push eax
call fcn.0045d430
push ebp
mov esi, eax
push 1
push edi
push esi
mov dword [esp + 0x3c], esi
mov byte [esi], 0
call fcn.00485565
add esp, 0x14
cmp eax, 1
je 0x45a225
push 0
push 0
push 0
push 2
mov ecx, ebx
call fcn.0045b930
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], 0xffffffff
cmp eax, 0x5d6aa8
je 0x45a21e
push eax
call fcn.0045d460
add esp, 4
xor al, al
jmp 0x45a2ef
mov ebp, dword [esp + 0x28]
mov byte [edi + ebp], 0
cmp byte [ebp], 0
mov eax, esi
je 0x45a297
mov cl, byte [esi]
cmp cl, 0xa
jne 0x45a255
mov ecx, esi
sub ecx, eax
add ecx, 1
push ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.0045d3d0
add esi, 1
mov eax, esi
jmp 0x45a292
cmp cl, 0xd
jne 0x45a28f
mov ecx, esi
sub ecx, eax
test ecx, ecx
jle 0x45a26d
push ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.0045d3d0
push 1
lea edx, [esp + 0x2c]
push edx
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 0xa
call fcn.0045d3d0
cmp byte [esi + 1], 0xa
jne 0x45a24e
add esi, 2
mov eax, esi
jmp 0x45a292
add esi, 1
cmp byte [esi], 0
jne 0x45a235
sub esi, eax
je 0x45a2a6
push esi
push eax
lea ecx, [esp + 0x1c]
call fcn.0045d3d0
push ebp
call fcn.0045d460
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x18]
mov eax, dword [ebx]
mov eax, dword [eax + 8]
add esp, 4
push ecx
push 0
add edx, 8
push edx
mov ecx, ebx
call eax
cmp byte [ebx + 0x2c], 0
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], 0xffffffff
jne 0x45a20e
cmp eax, 0x5d6aa8
je 0x45a2ed
push eax
call fcn.0045d460
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8