joyce8/EMBER2024-capa huggingface dataset:
Function at 0x448320
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x460198
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
mov ebp, dword [esp + 0x30]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 0x10]
mov dword [esp + 0xc], ecx
xor ecx, ecx
push esi
mov esi, dword [ebp + 0x18]
xor ebx, ebx
cmp word [edx + 2], cx
push edi
mov dword [esp + 0x38], ecx
jbe 0x4483ac
movzx edx, word [edx + 2]
mov dword [esp + 0x10], edx
lea edx, [esi + 8]
lea esp, [esp]
mov edi, dword [edx + 4]
cmp eax, edi
jb 0x448386
mov esi, dword [edx]
test esi, esi
jne 0x448380
mov esi, dword [edx + 8]
add edi, esi
cmp eax, edi
jb 0x448394
mov esi, dword [esp + 0x10]
inc ecx
add edx, 0x28
cmp ecx, esi
jl 0x448370
jmp 0x4483ac
mov eax, dword [ebp + 0x18]
lea edx, [ecx + ecx*4]
mov eax, dword [eax + edx*8 + 0x14]
push ecx
mov ecx, ebp
mov dword [esp + 0x3c], eax
call fcn.00448e10
mov ebx, eax
mov eax, dword [esp + 0x38]
cmp eax, dword [ebp + 4]
jb 0x4483cc
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret 8
mov ecx, dword [ebp]
lea edx, [esp + 0x10]
push edx
add ecx, eax
push ebx
push ecx
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x24]
push eax
add ecx, 0x418
call fcn.0044db00
mov eax, dword [esp + 0x1c]
test eax, eax
mov dword [esp + 0x30], 0
je 0x44847f
mov edx, dword [esp + 0x20]
mov ecx, edx
sub ecx, eax
sar ecx, 2
test ecx, ecx
je 0x44847f
cmp eax, edx
mov ecx, eax
je 0x44842f
add eax, 4
cmp eax, edx
je 0x44842f
lea esp, [esp]
mov esi, dword [eax]
cmp esi, dword [ecx]
jge 0x448428
mov ecx, eax
add eax, 4
cmp eax, edx
jne 0x448420
mov edi, dword [ecx]
lea esi, [edi + edi*2]
shl esi, 2
mov ecx, dword [esi + 0x401e20]
mov eax, ecx
lea ebx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x448442
sub eax, ebx
mov ebx, dword [esp + 0x3c]
push eax
push ecx
lea ecx, [ebx + 4]
call fcn.00430e60
push edi
push ebp
push ebx
call dword [esi + fcn.00401e24]
add esp, 0xc
test al, al
mov eax, dword [esp + 0x1c]
je 0x448483
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x38]
add ecx, edx
mov byte [ebx], 1
mov dword [ebx + 0x20], ecx
jmp 0x448483
mov ebx, dword [esp + 0x3c]
test eax, eax
mov bl, byte [ebx]
je 0x448492
push eax
call fcn.0045519d
add esp, 4
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 8
Function at 0x4487b0
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x40c
push ebx
mov ebx, dword [esp + 0x414]
cmp dword [ebx + 4], 0x100
push ebp
mov ebp, ecx
ja 0x4487d7
pop ebp
xor al, al
pop ebx
add esp, 0x40c
ret 8
mov eax, dword [ebp + 0x838]
push esi
push edi
mov edi, dword [ebp + 0x834]
cmp edi, eax
je 0x44885d
lea esi, [edi + 0x20]
lea esp, [esp]
mov al, byte [esi + 0xc]
test al, al
jne 0x44884d
mov ecx, dword [esi]
test ecx, ecx
je 0x44884d
mov eax, dword [esi + 4]
sub eax, ecx
sar eax, 1
test eax, eax
je 0x44884d
push eax
push ecx
lea ecx, [esp + 0x1c]
call fcn.00431d60
cmp dword [esi - 8], 0x10
jb 0x44881e
mov eax, dword [esi - 0x1c]
jmp 0x448821
lea eax, [esi - 0x1c]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov ecx, dword [ebx + 4]
mov edx, dword [ebx]
lea eax, [esp + 0x10]
push eax
sub ecx, 0x100
push ecx
add edx, 0x100
push edx
lea ecx, [esp + 0x20]
call fcn.00439170
test al, al
jne 0x44886c
mov eax, dword [ebp + 0x838]
add edi, 0x30
add esi, 0x30
cmp edi, eax
jne 0x4487f0
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x40c
ret 8
mov esi, dword [esp + 0x424]
push 0xffffffffffffffff
push 0
push edi
lea ecx, [esi + 4]
mov byte [esi], 1
call fcn.00430d70
mov eax, dword [esp + 0x10]
add eax, 0x100
pop edi
mov dword [esi + 0x20], eax
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x40c
ret 8

Function at 0x448e50
Capabilities:
Parse pe header

Disassembly:
mov edx, dword [esp + 8]
cmp edx, 0x160
push esi
mov esi, ecx
jae 0x448e65
xor al, al
pop esi
ret 8
push ebp
mov ebp, dword [esp + 0xc]
mov dword [esi + 8], ebp
cmp word [ebp], 0x5a4d
je 0x448e7c
pop ebp
xor al, al
pop esi
ret 8
mov ecx, dword [ebp + 0x3c]
lea eax, [ecx + ebp]
cmp eax, ebp
jb 0x448e75
add ecx, 0x120
cmp edx, ecx
jb 0x448e75
mov dword [esi + 0xc], eax
cmp dword [eax], 0x4550
jne 0x448e75
add eax, 4
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0xc]
mov edx, dword [esi + 0x10]
add eax, 0x18
mov dword [esi + 0x14], eax
movzx ecx, word [edx + 0x10]
add ecx, eax
push ebx
mov ebx, eax
mov dword [esi + 0x18], ecx
cmp word [ebx], 0x10b
je 0x448ec8
pop ebx
pop ebp
xor al, al
pop esi
ret 8
mov eax, dword [esp + 0x14]
push edi
movzx edi, word [edx + 2]
mov edx, ebp
sub edx, ecx
add edx, eax
mov eax, 0xcccccccd
mul edx
shr edx, 5
cmp edi, edx
jbe 0x448eee
pop edi
pop ebx
pop ebp
xor al, al
pop esi
ret 8
xor edx, edx
test edi, edi
jle 0x448f15
lea eax, [ecx + 0x14]
mov ecx, dword [eax - 4]
test ecx, ecx
je 0x448f06
mov ecx, dword [esp + 0x18]
cmp dword [eax], ecx
jae 0x448ee5
mov ecx, dword [esi + 0x10]
movzx ecx, word [ecx + 2]
inc edx
add eax, 0x28
cmp edx, ecx
jl 0x448ef7
mov eax, dword [ebx + 0x10]
cmp eax, dword [ebx + 0x3c]
jb 0x448f2e
push eax
mov ecx, esi
call fcn.00448d20
mov ecx, dword [esp + 0x18]
dec eax
cmp eax, ecx
jae 0x448ee5
mov edx, dword [esp + 0x18]
pop edi
pop ebx
mov dword [esi], ebp
pop ebp
mov dword [esi + 4], edx
mov al, 1
pop esi
ret 8
Function at 0x44abe0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4602d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
push edi
mov dword [esp + 0x20], 0xf
mov dword [esp + 0x1c], 0
mov byte [esp + 0xc], 0
mov eax, dword [esp + 0x38]
mov ecx, dword [eax + 0x18]
mov edi, 0x10
cmp ecx, edi
mov dword [esp + 0x30], 0
jb 0x44ac2c
mov eax, dword [eax + 4]
jmp 0x44ac2f
add eax, 4
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x44ac62
cmp dword [esp + 0x20], edi
jb 0x44ac4f
mov eax, dword [esp + 0xc]
push eax
call fcn.0045519d
add esp, 4
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
push ebp
push 0x40a6b8
push esi
call edi
push 0x40a6b0
push esi
mov ebp, eax
call edi
test eax, eax
mov dword [esp + 0x28], eax
je 0x44ace9
call ebp
mov ecx, eax
lea esi, [ecx + 1]
lea ebx, [ebx]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x44ac90
sub ecx, esi
push ecx
push eax
lea ecx, [esp + 0x14]
call fcn.00430e60
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [0x463cfc]
add ecx, 0xfffffff0
call fcn.0044a8a0
mov edx, dword [0x463cfc]
mov byte [edx - 0x18], 1
cmp dword [esp + 0x24], 0x10
jb 0x44acd5
mov eax, dword [esp + 0x10]
push eax
call fcn.0045519d
add esp, 4
pop ebp
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret
cmp dword [esp + 0x24], 0x10
jb 0x44acfd
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0045519d
add esp, 4
mov ecx, dword [esp + 0x2c]
pop ebp
pop edi
xor al, al
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x4507f0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ecx
push ebp
mov ebp, ecx
mov eax, dword [ebp + 0x2b8]
test eax, eax
jne 0x450803
xor eax, eax
pop ebp
pop ecx
ret
push ebx
mov ebx, dword [ebp + 0x2c0]
push edi
sub ebx, dword [ebp + 0x2bc]
push 0
inc ebx
call dword [sym.imp.user32.dll_OpenClipboard]
test eax, eax
jne 0x45083e
mov eax, dword [ebp + 0x140]
push 0x10
push 0x42eed0
push 0x42ef1c
push eax
call dword [sym.imp.user32.dll_MessageBoxA]
pop edi
pop ebx
xor eax, eax
pop ebp
pop ecx
ret
lea ecx, [ebx + 4]
push ecx
push 0x2042
call dword [sym.imp.kernel32.dll_GlobalAlloc]
test eax, eax
mov dword [esp + 0xc], eax
jne 0x45087b
call dword [sym.imp.user32.dll_CloseClipboard]
mov edx, dword [ebp + 0x140]
push 0x10
push 0x42eed0
push 0x42eefc
push edx
call dword [sym.imp.user32.dll_MessageBoxA]
pop edi
pop ebx
xor eax, eax
pop ebp
pop ecx
ret
push esi
push eax
call dword [sym.imp.kernel32.dll_GlobalLock]
mov edi, dword [ebp + 0x2bc]
mov esi, dword [ebp + 0x150]
mov ecx, ebx
mov edx, ecx
add esi, edi
shr ecx, 2
lea edi, [eax + 4]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x10]
push esi
mov dword [eax], ebx
call dword [sym.imp.kernel32.dll_GlobalUnlock]
call dword [sym.imp.user32.dll_EmptyClipboard]
mov eax, dword [ebp + 0x308]
push esi
push eax
call dword [sym.imp.user32.dll_SetClipboardData]
test eax, eax
jne 0x4508f7
push esi
call dword [sym.imp.kernel32.dll_GlobalFree]
call dword [sym.imp.user32.dll_CloseClipboard]
mov ecx, dword [ebp + 0x140]
push 0x10
push 0x42eed0
push 0x42eed8
push ecx
call dword [sym.imp.user32.dll_MessageBoxA]
pop esi
pop edi
pop ebx
xor eax, eax
pop ebp
pop ecx
ret
call dword [sym.imp.user32.dll_CloseClipboard]
pop esi
pop edi
pop ebx
mov eax, 1
pop ebp
pop ecx
ret
Function at 0x450ba9
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4606fc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x148]
mov dword [esp + 0xc], esi
call fcn.004544f0
xor ebx, ebx
lea ecx, [esi + 0x168]
mov dword [esp + 0x54], ebx
call fcn.004545c0
push ebx
mov byte [esp + 0x58], 1
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov ecx, esi
mov dword [esi + 0x13c], eax
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x34], ebx
call fcn.00450080
xor eax, eax
mov ecx, 0xb
lea edi, [esi + 0x2cc]
rep stosd dword es:[edi], eax
mov eax, dword [0x463d08]
push 0x104
lea edi, [esi + 0x43c]
push edi
push eax
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
push edi
call fcn.00454b80
push edi
call fcn.00454bb0
push edi
lea ecx, [esi + 0x38]
push 0x42efe4
push ecx
call dword [sym.imp.user32.dll_wsprintfA]
add esp, 0x14
xor eax, eax
push 0x406b54
lea edx, [esp + 0x30]
mov ecx, 0xf
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
push edx
mov dword [esp + 0x18], 0xfffffff5
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], 0x190
mov byte [esp + 0x2c], bl
mov byte [esp + 0x2d], bl
mov byte [esp + 0x2e], bl
mov byte [esp + 0x2f], bl
mov byte [esp + 0x30], 3
mov byte [esp + 0x31], 2
mov byte [esp + 0x32], 1
mov byte [esp + 0x33], 0x31
call dword [sym.imp.kernel32.dll_lstrcpy]
mov edi, dword [sym.imp.gdi32.dll_CreateFontIndirectA]
lea eax, [esp + 0x10]
push eax
call edi
lea ecx, [esp + 0x10]
push ecx
mov dword [esi], eax
call edi
push 0x42efd8
mov dword [esi + 4], eax
call dword [sym.imp.user32.dll_RegisterClipboardFormatA]
mov dword [esi + 0x308], eax
call dword [sym.imp.user32.dll_CreatePopupMenu]
push 0x42efd0
push 0x1001
push ebx
mov dword [esi + 0x438], eax
push eax
mov edi, dword [sym.imp.user32.dll_AppendMenuA]
call edi
mov edx, dword [esi + 0x438]
push 0x42efc8
push 0x1002
push ebx
push edx
call edi
mov ecx, dword [esp + 0x4c]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x4c
ret
Function at 0x450e70
Capabilities:
Hide graphical window

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x3e0]
xor eax, eax
mov ecx, 0x16
mov edi, ebx
rep stosd dword es:[edi], eax
push 0x42f008
lea edi, [esi + 0x3f8]
push edi
mov dword [ebx], 0x58
call dword [sym.imp.kernel32.dll_lstrcpy]
lea ebp, [esi + 0x168]
mov ecx, ebp
call fcn.00454580
test eax, eax
je 0x450eef
mov ecx, ebp
call fcn.004545a0
push eax
call fcn.00454b50
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x450f05
push ebp
call dword [sym.imp.kernel32.dll_lstrlen]
cmp eax, 0x34
ja 0x450f05
push 0x42f004
push edi
call dword [sym.imp.kernel32.dll_lstrcat]
push ebp
push edi
call dword [sym.imp.kernel32.dll_lstrcat]
push edi
call dword [sym.imp.kernel32.dll_lstrlen]
jmp 0x450f05
mov ebp, dword [sym.imp.kernel32.dll_lstrcat]
push 0x42f004
push edi
call ebp
push 0x42eff4
push edi
call ebp
mov eax, dword [esi + 0x140]
push 0xfffffffffffffff2
push eax
mov dword [esi + 0x3e4], eax
mov dword [esi + 0x3e8], 0x2001
mov dword [esi + 0x3ec], 7
call dword [sym.imp.user32.dll_GetClassLongA]
push ebx
push 0
mov dword [esi + 0x3f4], eax
mov dword [esi + 0x3f0], 0x1400
call dword [sym.imp.shell32.dll_Shell_NotifyIcon]
test eax, eax
jne 0x450f50
pop edi
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esi + 0x140]
push 0
push eax
call dword [sym.imp.user32.dll_ShowWindow]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x454590
Capabilities:
Get file size

Disassembly:
mov eax, dword [ecx + 0xc]
push 0
push eax
call dword [sym.imp.kernel32.dll_GetFileSize]
ret

Function at 0x454800
Capabilities:
Get file size
Read file on windows

Disassembly:
push ecx
push edi
mov edi, ecx
mov eax, dword [edi + 0xc]
cmp eax, 0xffffffff
jne 0x454811
xor eax, eax
pop edi
pop ecx
ret
push esi
push 0
push eax
call dword [sym.imp.kernel32.dll_GetFileSize]
mov esi, eax
push esi
call fcn.004563b8
add esp, 4
test eax, eax
mov dword [edi + 4], eax
jne 0x454833
pop esi
xor eax, eax
pop edi
pop ecx
ret
mov edx, dword [edi + 0xc]
push 0
lea ecx, [esp + 0xc]
push ecx
push esi
push eax
push edx
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x45482d
mov dword [edi], esi
pop esi
mov eax, 1
pop edi
pop ecx
ret

Function at 0x454860
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
push 0
push 0
mov esi, ecx
mov eax, dword [esi + 0xc]
push 0
push eax
call dword [sym.imp.kernel32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x454887
mov ecx, dword [esi + 0xc]
push ecx
call dword [sym.imp.kernel32.dll_SetEndOfFile]
test eax, eax
jne 0x45488c
xor eax, eax
pop esi
pop ecx
ret
mov eax, dword [esi + 4]
push edi
mov edi, dword [esi]
push 0
lea edx, [esp + 0xc]
push edx
push edi
push eax
mov eax, dword [esi + 0xc]
push eax
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
je 0x4548b8
cmp edi, dword [esp + 8]
jne 0x4548b8
pop edi
mov eax, 1
pop esi
pop ecx
ret
pop edi
xor eax, eax
pop esi
pop ecx
ret
Function at 0x455f1e
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x42f508
call fcn.004577dc
mov edi, 0x94
mov eax, edi
call fcn.00455950
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.kernel32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x464468], ecx
mov eax, dword [esi + 4]
mov dword [0x464474], eax
mov edx, dword [esi + 8]
mov dword [0x464478], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x46446c], esi
cmp ecx, 2
je 0x455f7e
or esi, 0x8000
mov dword [0x46446c], esi
shl eax, 8
add eax, edx
mov dword [0x464470], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.kernel32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x455fb9
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x455fb9
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x455fd1
cmp eax, 0x20b
je 0x455fbe
mov dword [ebp - 0x1c], esi
jmp 0x455fe5
cmp dword [ecx + 0x84], 0xe
jbe 0x455fb9
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x455fdf
cmp dword [ecx + 0x74], 0xe
jbe 0x455fb9
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.0045a676
pop ecx
test eax, eax
jne 0x455ff9
push 0x1c
call fcn.00455efa
pop ecx
call fcn.00457347
test eax, eax
jne 0x45600a
push 0x10
call fcn.00455efa
pop ecx
call fcn.0045a5d4
mov dword [ebp - 4], esi
call fcn.0045a3d6
test eax, eax
jge 0x456023
push 0x1b
call fcn.00455ed5
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x465b10], eax
call fcn.0045a2b4
mov dword [0x4642a4], eax
call fcn.0045a212
test eax, eax
jge 0x456049
push 8
call fcn.00455ed5
pop ecx
call fcn.00459fdf
test eax, eax
jge 0x45605a
push 9
call fcn.00455ed5
pop ecx
push 1
call fcn.004597c3
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x456070
push eax
call fcn.00455ed5
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
call fcn.00459f82
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x456091
movzx eax, word [ebp - 0x40]
jmp 0x456094
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.00446f20
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x4560b2
push edi
call fcn.004598f0
call fcn.00459912
jmp 0x4560e4
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.00457817
ret
Function at 0x459540
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x45956e
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x459575
cmp ebx, dword [eax + 4]
jae 0x459575
xor eax, eax
jmp 0x459765
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x459586
xor eax, eax
inc eax
jmp 0x459764
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x45959c
cmp ecx, edx
jae 0x4596e1
cmp dword [eax + 4], 0
je 0x4595a5
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x45958d
cmp dword [ebp + 8], 0
je 0x4595c7
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x4596e1
cmp eax, esi
jae 0x4596e1
mov eax, dword [0x464418]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x4595ec
cmp dword [esi*4 + 0x464420], edi
je 0x4596e5
inc esi
cmp esi, eax
jl 0x4595da
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.kernel32.dll_VirtualQuery]
test eax, eax
je 0x459761
cmp dword [ebp - 8], 0x1000000
jne 0x459761
test byte [ebp - 0xc], 0xcc
je 0x45966a
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x459761
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x459761
cmp word [eax + 0x18], 0x10b
jne 0x459761
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x459761
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x45966a
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x45966a
test byte [ecx + 0x27], 0x80
jne 0x4596e1
push 1
push 0x464460
call dword [sym.imp.kernel32.dll_InterlockedExchange]
test eax, eax
jne 0x45957e
mov ecx, dword [0x464418]
test ecx, ecx
mov edx, ecx
jle 0x45969e
lea eax, [ecx*4 + 0x46441c]
cmp dword [eax], edi
je 0x45969e
dec edx
sub eax, 4
test edx, edx
jg 0x459692
test edx, edx
jne 0x4596cf
push 0xf
pop ebx
cmp ecx, ebx
jg 0x4596ab
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x4596c3
lea eax, [edx*4 + 0x464420]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x4596b1
cmp ecx, 0x10
jge 0x4596cf
inc ecx
mov dword [0x464418], ecx
push 0
push 0x464460
call dword [sym.imp.kernel32.dll_InterlockedExchange]
jmp 0x45957e
xor eax, eax
jmp 0x459764
test esi, esi
jle 0x45957e
mov ebx, dword [sym.imp.kernel32.dll_InterlockedExchange]
push 1
push 0x464460
call ebx
test eax, eax
jne 0x45957e
cmp dword [esi*4 + 0x464420], edi
je 0x45973b
mov eax, dword [0x464418]
lea esi, [eax - 1]
test esi, esi
jl 0x459729
cmp dword [esi*4 + 0x464420], edi
je 0x459725
dec esi
jns 0x459719
test esi, esi
jge 0x459739
cmp eax, 0x10
jge 0x459734
inc eax
mov dword [0x464418], eax
lea esi, [eax - 1]
jmp 0x45973b
je 0x459753
xor ecx, ecx
test esi, esi
jl 0x459753
lea eax, [ecx*4 + 0x464420]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x459741
push 0
push 0x464460
call ebx
jmp 0x45957e
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x45982d
Capabilities:
Terminate process

Disassembly:
push 8
push 0x42f6f8
call fcn.004577dc
push 8
call fcn.004577ab
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x4644a8], esi
jne 0x459861
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
mov dword [0x4644a4], esi
mov al, byte [ebp + 0x10]
mov byte [0x4644a0], al
cmp dword [ebp + 0xc], edi
jne 0x4598ab
cmp dword [0x465b08], edi
je 0x45989b
mov eax, dword [0x465b04]
sub eax, 4
mov dword [0x465b04], eax
cmp eax, dword [0x465b08]
jb 0x45989b
mov eax, dword [eax]
cmp eax, edi
je 0x45987c
call eax
jmp 0x45987c
push 0x4013f0
mov eax, 0x4013e8
call fcn.004597ab
pop ecx
push 0x4013fc
mov eax, 0x4013f4
call fcn.004597ab
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x4598dc
cmp dword [ebp + 0x10], edi
jne 0x4598ea
mov dword [0x4644a8], esi
push dword [ebp + 8]
call fcn.00459769
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x4598e9
push 8
call fcn.004576f6
pop ecx
ret
call fcn.00457817
ret

Function at 0x459c6e
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x403e94]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x4042e8]
je 0x459ca3
inc eax
cmp eax, 0x13
jb 0x459c94
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x4042e8]
jne 0x459dc9
mov eax, dword [0x4642ac]
cmp eax, 1
je 0x459da1
cmp eax, edx
jne 0x459cd3
cmp dword [0x403e84], 1
je 0x459da1
cmp ecx, 0xfc
je 0x459dc9
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
test eax, eax
jne 0x459d09
lea eax, [ebp - 0x80]
push 0x43019c
push eax
call fcn.00457560
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.004564d0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x459d3d
mov eax, edi
push eax
call fcn.004564d0
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x430198
push edi
call fcn.004559e0
add esp, 0x10
push edi
call fcn.004564d0
push dword [esi + 0x4042ec]
mov ebx, eax
call fcn.004564d0
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.00455950
mov ebx, esp
push 0x43017c
push ebx
call fcn.00457560
push edi
push ebx
call fcn.00457570
push 0x430178
push ebx
call fcn.00457570
push dword [esi + 0x4042ec]
push ebx
call fcn.00457570
push 0x12010
push 0x430150
push ebx
call fcn.0045d530
add esp, 0x2c
jmp 0x459dc9
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x4042ec]
push dword [esi]
call fcn.004564d0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.kernel32.dll_GetStdHandle]
push eax
call dword [sym.imp.kernel32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.0045c265
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret