joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439fa0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1ec
push esi
push edi
mov dword [ebp - 8], 0x12345678
mov edi, dword [ebp - 8]
mov esi, dword [ebp - 8]
add esi, 0x28358
mov ecx, 0xa0d6
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x188]
push eax
call fcn.0043a230
add esp, 4
lea ecx, [ebp - 0x158]
push ecx
call fcn.0043a2b0
add esp, 4
lea edx, [ebp - 0x128]
push edx
call fcn.0043a330
add esp, 4
lea eax, [ebp - 0xf8]
push eax
call fcn.0043a3b0
add esp, 4
lea ecx, [ebp - 0xc8]
push ecx
call fcn.0043a430
add esp, 4
lea edx, [ebp - 0x98]
push edx
call fcn.0043a4b0
add esp, 4
lea eax, [ebp - 0x68]
push eax
call fcn.0043a530
add esp, 4
lea ecx, [ebp - 0x38]
push ecx
call fcn.0043a5b0
add esp, 4
mov dword [ebp - 0x1ec], 0x34
mov dword [ebp - 0x1e8], 0x588
mov edx, dword [ebp + 8]
mov dword [ebp - 0x1e4], edx
mov dword [ebp - 0x1e0], 0
mov dword [ebp - 0x1dc], 0
mov byte [ebp - 0x1b8], 0x43
mov byte [ebp - 0x1b7], 0x6f
mov byte [ebp - 0x1b6], 0x6e
mov byte [ebp - 0x1b5], 0x66
mov byte [ebp - 0x1b4], 0x69
mov byte [ebp - 0x1b3], 0x67
mov byte [ebp - 0x1b2], 0x75
mov byte [ebp - 0x1b1], 0x72
mov byte [ebp - 0x1b0], 0x61
mov byte [ebp - 0x1af], 0x74
mov byte [ebp - 0x1ae], 0x69
mov byte [ebp - 0x1ad], 0x6f
mov byte [ebp - 0x1ac], 0x6e
mov byte [ebp - 0x1ab], 0
lea eax, [ebp - 0x1b8]
mov dword [ebp - 0x1d8], eax
mov dword [ebp - 0x1d4], 8
mov dword [ebp - 0x1d0], 0
lea ecx, [ebp - 0x188]
mov dword [ebp - 0x1cc], ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x15fd74]
mov dword [ebp - 0x1c8], eax
mov byte [ebp - 0x1a8], 0x43
mov byte [ebp - 0x1a7], 0x4f
mov byte [ebp - 0x1a6], 0x4d
mov byte [ebp - 0x1a5], 0x43
mov byte [ebp - 0x1a4], 0x54
mov byte [ebp - 0x1a3], 0x4c
mov byte [ebp - 0x1a2], 0x33
mov byte [ebp - 0x1a1], 0x32
mov byte [ebp - 0x1a0], 0x2e
mov byte [ebp - 0x19f], 0x44
mov byte [ebp - 0x19e], 0x4c
mov byte [ebp - 0x19d], 0x4c
mov byte [ebp - 0x19c], 0
mov byte [ebp - 0x198], 0x50
mov byte [ebp - 0x197], 0x72
mov byte [ebp - 0x196], 0x6f
mov byte [ebp - 0x195], 0x70
mov byte [ebp - 0x194], 0x65
mov byte [ebp - 0x193], 0x72
mov byte [ebp - 0x192], 0x74
mov byte [ebp - 0x191], 0x79
mov byte [ebp - 0x190], 0x53
mov byte [ebp - 0x18f], 0x68
mov byte [ebp - 0x18e], 0x65
mov byte [ebp - 0x18d], 0x65
mov byte [ebp - 0x18c], 0x74
mov byte [ebp - 0x18b], 0x41
mov byte [ebp - 0x18a], 0
lea ecx, [ebp - 0x198]
push ecx
lea edx, [ebp - 0x1a8]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1ec]
push eax
call dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x596b8], eax
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x15fd78]
push eax
push 0xfffffffffffffffc
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x596b8]
push edx
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x1599d0], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x43ab00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov byte [ebp - 0xc], 0x43
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xa], 0x61
mov byte [ebp - 9], 0x6e
mov byte [ebp - 8], 0x6e
mov byte [ebp - 7], 0x65
mov byte [ebp - 6], 0x6c
mov byte [ebp - 5], 0x4c
mov byte [ebp - 4], 0x69
mov byte [ebp - 3], 0x73
mov byte [ebp - 2], 0x74
mov byte [ebp - 1], 0
lea eax, [ebp - 0xc]
push eax
push 0
call fcn.00437b10
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x43ae50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x14], eax
push 0xa
push 0x13ba
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
add eax, 0x2dc
push eax
call fcn.004293d0
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x43c480
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [ebp - 1], 0
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
or al, al
je 0x43c49a
mov byte [ebp - 1], 1
mov byte [ebp - 1], 0
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret

Function at 0x43f160
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov dword [ebp - 0x104], ecx
push 0x4dc0a0
push str._sChargeTool.exe
push pe_nt_image_headers32
lea eax, [ebp - 0x100]
push eax
call fcn.0043fb40
add esp, 0x10
push 5
push 0
push 0
lea ecx, [ebp - 0x100]
push ecx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10

Function at 0x43fe10
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov dword [ebp - 0x40], ecx
cmp dword [ebp - 0x40], 0
je 0x43fe2a
mov eax, dword [ebp - 0x40]
sub eax, 0x20
mov dword [ebp - 0x44], eax
jmp 0x43fe31
mov dword [ebp - 0x44], 0
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 1
cmp dword [ebp + 0x14], 0
je 0x43febd
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 8]
add ecx, 4
call fcn.0040b080
mov ecx, eax
call fcn.0040c0b0
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], 0xffffffff
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.0043ff90
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x43feac
mov eax, dword [ebp - 0xc]
add eax, 1
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov dword [ebp - 0x14], eax
push 0xffffffffffffffff
mov ecx, dword [ebp + 0xc]
call fcn.0043f9d0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0xc]
jge 0x43febb
mov dword [ebp - 4], 0
jmp 0x43fed8
mov ecx, dword [ebp + 0xc]
call fcn.0040c0b0
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 8]
add ecx, 4
call fcn.0043ff60
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x43fef3
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
add ecx, 0x20
call fcn.0043ffd0
jmp 0x43ff56
cmp dword [ebp + 0x14], 0
je 0x43ff56
cmp dword [ebp + 0x18], 0
je 0x43ff56
mov ecx, dword [ebp + 0xc]
call fcn.0043fa90
cmp eax, dword [ebp + 0x1c]
jle 0x43ff56
mov dword [ebp - 0x38], 1
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0xc]
call fcn.0043fa90
mov dword [ebp - 0x30], eax
mov edx, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], edx
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 8]
add ecx, 0x20
call fcn.00440030
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0x18
Function at 0x44c660
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [0x4dcab4]
push ecx
push str._s:__s_n
push 0x4726c8
call fcn.0045177e
add esp, 0x10
push 1
call fcn.00452bea
pop ebp
ret

Function at 0x44c690
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x400c
call fcn.00450340
mov eax, dword [ebp + 8]
push eax
push 0x4000
push 1
lea ecx, [ebp - 0x4008]
push ecx
call fcn.004521f9
add esp, 0x10
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
and eax, 0x20
je 0x44c6d9
push str.fread
call fcn.00452d8b
add esp, 4
push 1
call fcn.00452bea
cmp dword [ebp - 4], 0
jne 0x44c6e1
jmp 0x44c71b
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x4008]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.00446ee0
add esp, 0xc
cmp eax, dword [ebp - 4]
je 0x44c719
lea ecx, [ebp - 0x400c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.004477d0
add esp, 8
push eax
call fcn.0044c660
add esp, 4
jmp 0x44c69d
mov eax, dword [ebp + 8]
push eax
call fcn.004515cd
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00447700
add esp, 4
test eax, eax
je 0x44c744
push 0x472334
call fcn.0044c660
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x44c810
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x400]
push ecx
call fcn.00450830
add esp, 8
push 0x472374
lea edx, [ebp - 0x400]
push edx
call fcn.00450840
add esp, 8
push 0x472378
mov eax, dword [ebp + 8]
push eax
call fcn.004516ca
add esp, 8
mov dword [ebp - 0x404], eax
cmp dword [ebp - 0x404], 0
jne 0x44c873
mov ecx, dword [ebp + 8]
push ecx
call fcn.00452d8b
add esp, 4
push 1
call fcn.00452bea
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x400]
push eax
call fcn.004460a0
add esp, 8
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 0
jne 0x44c8bc
lea ecx, [ebp - 0x400]
push ecx
mov edx, dword [0x4dcab4]
push edx
push 0x47237c
push 0x4726c8
call fcn.0045177e
add esp, 0x10
push 1
call fcn.00452bea
mov eax, dword [ebp - 0x408]
push eax
mov ecx, dword [ebp - 0x404]
push ecx
call fcn.0044c690
add esp, 8
mov edx, dword [ebp + 8]
push edx
call fcn.004607fc
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x44c8f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [ebp + 8]
push eax
call fcn.004506c0
add esp, 4
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x410]
push edx
call fcn.00450830
add esp, 8
cmp dword [ebp - 0xc], 3
jbe 0x44c95b
push 0x472394
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax - 3]
push edx
call fcn.00450750
add esp, 8
test eax, eax
jne 0x44c95b
mov eax, dword [ebp + 8]
mov dword [ebp - 0x414], eax
lea ecx, [ebp - 0x410]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0xc]
mov byte [edx - 3], 0
jmp 0x44c981
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x410]
mov dword [ebp - 0x414], ecx
push 0x472398
mov edx, dword [ebp - 0x414]
push edx
call fcn.00450840
add esp, 8
push 0x47239c
mov eax, dword [ebp - 0x414]
push eax
call fcn.004460a0
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x44c9c5
mov ecx, dword [ebp - 0x414]
push ecx
mov edx, dword [0x4dcab4]
push edx
push str._s:_cant_gzopen__s_n
push 0x4726c8
call fcn.0045177e
add esp, 0x10
push 1
call fcn.00452bea
push 0x4723b8
mov eax, dword [ebp - 4]
push eax
call fcn.004516ca
add esp, 8
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x418], 0
jne 0x44c9f8
mov ecx, dword [ebp + 8]
push ecx
call fcn.00452d8b
add esp, 4
push 1
call fcn.00452bea
mov edx, dword [ebp - 0x418]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0044c750
add esp, 8
mov ecx, dword [ebp - 0x414]
push ecx
call fcn.004607fc
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x450eed
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.00450340
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x450f88
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x4dc5bc]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x450f88
cmp eax, 1
je 0x450fa9
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x450f88
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x450f55
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x450f84
xor eax, eax
inc eax
jmp 0x450fc8
cmp edi, eax
jae 0x450f8c
xor eax, eax
jmp 0x450fc8
cmp eax, esi
jae 0x450f93
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x4dc5bc]
jmp 0x450fac
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x452b27
Capabilities:
Terminate process

Disassembly:
push 8
push 0x467008
call fcn.00453098
push 8
call fcn.00453bd8
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x4dc5fc], esi
jne 0x452b5b
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x4dc5f8], esi
mov al, byte [ebp + 0x10]
mov byte [0x4dc5f4], al
cmp dword [ebp + 0xc], edi
jne 0x452ba5
cmp dword [0x4dde6c], edi
je 0x452b95
mov eax, dword [0x4dde68]
sub eax, 4
mov dword [0x4dde68], eax
cmp eax, dword [0x4dde6c]
jb 0x452b95
mov eax, dword [eax]
cmp eax, edi
je 0x452b76
call eax
jmp 0x452b76
push 0x46b044
mov eax, 0x46b03c
call fcn.00452aa5
pop ecx
push 0x46b050
mov eax, 0x46b048
call fcn.00452aa5
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x452bd6
cmp dword [ebp + 0x10], edi
jne 0x452be4
mov dword [0x4dc5fc], esi
push dword [ebp + 8]
call fcn.00452a63
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x452be3
push 8
call fcn.00453b23
pop ecx
ret
call fcn.004530d3
ret
Function at 0x452e81
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x60
push 0x467030
call fcn.00453098
mov edi, 0x94
mov eax, edi
call fcn.00450340
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x4dc5bc], ecx
mov eax, dword [esi + 4]
mov dword [0x4dc5c8], eax
mov edx, dword [esi + 8]
mov dword [0x4dc5cc], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x4dc5c0], esi
cmp ecx, 2
je 0x452ee1
or esi, 0x8000
mov dword [0x4dc5c0], esi
shl eax, 8
add eax, edx
mov dword [0x4dc5c4], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x452f1c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x452f1c
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x452f34
cmp eax, 0x20b
je 0x452f21
mov dword [ebp - 0x1c], esi
jmp 0x452f48
cmp dword [ecx + 0x84], 0xe
jbe 0x452f1c
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x452f42
cmp dword [ecx + 0x74], 0xe
jbe 0x452f1c
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.00453c3e
pop ecx
test eax, eax
jne 0x452f5c
push 0x1c
call fcn.00452e5d
pop ecx
call fcn.00454e3e
test eax, eax
jne 0x452f6d
push 0x10
call fcn.00452e5d
pop ecx
call fcn.0045cb7d
mov dword [ebp - 4], esi
call fcn.0045c52b
test eax, eax
jge 0x452f86
push 0x1b
call fcn.00452e38
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x4dce44], eax
call fcn.0045d4fc
mov dword [0x4dc604], eax
call fcn.0045d45a
test eax, eax
jge 0x452fac
push 8
call fcn.00452e38
pop ecx
call fcn.0045d227
test eax, eax
jge 0x452fbd
push 9
call fcn.00452e38
pop ecx
push 1
call fcn.00452abd
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x452fd3
push eax
call fcn.00452e38
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.0045d1ca
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x452ff4
movzx eax, word [ebp - 0x40]
jmp 0x452ff7
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.00429040
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x453015
push edi
call fcn.00452bea
call fcn.00452c0c
jmp 0x453047
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.004530d3
ret
Function at 0x4547b2
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x4547e0
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x4547e7
cmp ebx, dword [eax + 4]
jae 0x4547e7
xor eax, eax
jmp 0x4549d7
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x4547f8
xor eax, eax
inc eax
jmp 0x4549d6
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x45480e
cmp ecx, edx
jae 0x454953
cmp dword [eax + 4], 0
je 0x454817
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x4547ff
cmp dword [ebp + 8], 0
je 0x454839
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x454953
cmp eax, esi
jae 0x454953
mov eax, dword [0x4dc768]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x45485e
cmp dword [esi*4 + 0x4dc770], edi
je 0x454957
inc esi
cmp esi, eax
jl 0x45484c
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4549d3
cmp dword [ebp - 8], 0x1000000
jne 0x4549d3
test byte [ebp - 0xc], 0xcc
je 0x4548dc
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x4549d3
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x4549d3
cmp word [eax + 0x18], 0x10b
jne 0x4549d3
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x4549d3
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x4548dc
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x4548dc
test byte [ecx + 0x27], 0x80
jne 0x454953
push 1
push 0x4dc7b0
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x4547f0
mov ecx, dword [0x4dc768]
test ecx, ecx
mov edx, ecx
jle 0x454910
lea eax, [ecx*4 + 0x4dc76c]
cmp dword [eax], edi
je 0x454910
dec edx
sub eax, 4
test edx, edx
jg 0x454904
test edx, edx
jne 0x454941
push 0xf
pop ebx
cmp ecx, ebx
jg 0x45491d
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x454935
lea eax, [edx*4 + 0x4dc770]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x454923
cmp ecx, 0x10
jge 0x454941
inc ecx
mov dword [0x4dc768], ecx
push 0
push 0x4dc7b0
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x4547f0
xor eax, eax
jmp 0x4549d6
test esi, esi
jle 0x4547f0
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
push 0x4dc7b0
call ebx
test eax, eax
jne 0x4547f0
cmp dword [esi*4 + 0x4dc770], edi
je 0x4549ad
mov eax, dword [0x4dc768]
lea esi, [eax - 1]
test esi, esi
jl 0x45499b
cmp dword [esi*4 + 0x4dc770], edi
je 0x454997
dec esi
jns 0x45498b
test esi, esi
jge 0x4549ab
cmp eax, 0x10
jge 0x4549a6
inc eax
mov dword [0x4dc768], eax
lea esi, [eax - 1]
jmp 0x4549ad
je 0x4549c5
xor ecx, ecx
test esi, esi
jl 0x4549c5
lea eax, [ecx*4 + 0x4dc770]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x4549b3
push 0
push 0x4dc7b0
call ebx
jmp 0x4547f0
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x45c2a5
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edx, ebx
je 0x45c479
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0x1f
sar ecx, 5
lea esi, [eax + eax*8]
lea edi, [ecx*4 + 0x4dcd20]
mov eax, dword [edi]
shl esi, 2
add eax, esi
mov cl, byte [eax + 4]
test cl, 2
jne 0x45c479
test cl, 0x48
je 0x45c310
cmp byte [eax + 5], 0xa
je 0x45c310
mov eax, dword [edi]
mov al, byte [eax + esi + 5]
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea edx, [ebx + 1]
mov dword [ebp - 8], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push edx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x45c362
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop esi
cmp eax, esi
jne 0x45c34a
call fcn.004525c5
mov dword [eax], 9
call fcn.004525ce
mov dword [eax], esi
jmp 0x45c35a
cmp eax, 0x6d
je 0x45c479
push eax
call fcn.004525d7
pop ecx
or eax, 0xffffffff
jmp 0x45c47b
mov eax, dword [ebp - 0xc]
mov ecx, dword [edi]
add dword [ebp - 8], eax
test byte [ecx + esi + 4], 0x80
je 0x45c474
test eax, eax
je 0x45c389
cmp byte [ebx], 0xa
jne 0x45c389
mov eax, ecx
lea eax, [eax + esi + 4]
or byte [eax], 4
jmp 0x45c392
mov eax, dword [edi]
lea eax, [eax + esi + 4]
and byte [eax], 0xfb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
add ecx, eax
cmp eax, ecx
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], ecx
jae 0x45c46e
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0x1a
je 0x45c45e
cmp al, 0xd
je 0x45c3c4
mov byte [ebx], al
inc ebx
inc dword [ebp + 0x10]
jmp 0x45c450
dec ecx
cmp dword [ebp + 0x10], ecx
jae 0x45c3de
mov eax, dword [ebp + 0x10]
inc eax
cmp byte [eax], 0xa
jne 0x45c3d9
add dword [ebp + 0x10], 2
jmp 0x45c432
mov dword [ebp + 0x10], eax
jmp 0x45c44c
inc dword [ebp + 0x10]
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x45c406
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x45c44c
cmp dword [ebp - 0xc], 0
je 0x45c44c
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x45c427
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x45c432
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x45c44f
cmp ebx, dword [ebp + 0xc]
jne 0x45c437
cmp byte [ebp - 1], 0xa
jne 0x45c437
mov byte [ebx], 0xa
jmp 0x45c44f
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0045c729
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x45c450
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0x10], ecx
jb 0x45c3a8
jmp 0x45c46e
mov eax, dword [edi]
test byte [eax + esi + 4], 0x40
jne 0x45c46e
lea esi, [eax + esi + 4]
or byte [esi], 2
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jmp 0x45c47b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret