joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42ed50
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x8c
push ebx
push esi
mov ebx, dword [esp + 0x98]
push edi
push ebp
mov eax, dword [ebx + 8]
test eax, eax
jne 0x42ed73
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x42ef46
mov ecx, dword [ebx + 0x1c]
test ecx, ecx
jne 0x42ef46
mov ecx, dword [ebx + 0x18]
test ecx, ecx
jne 0x42edb0
test eax, eax
je 0x42ed90
mov ecx, ebx
call fcn.0042ec10
mov eax, dword [ebx + 0x18]
test eax, eax
jne 0x42edb0
mov eax, dword [ebx + 8]
test eax, eax
je 0x42edb0
mov dword [ebx + 0x1c], 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x8c
ret
mov eax, dword [ebx + 0x24]
lea ebp, [ebx + 0x28]
inc eax
lea ecx, [esp + 0xa8]
push ecx
mov dword [ebx + 0x24], eax
mov eax, dword [esp + 0xa8]
push eax
push ebp
call fcn.0051a910
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor ecx, ecx
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 0x20]
mov dword [esp + 0x14], ecx
fild qword [esp + 0x10]
mov dword [esp + 0x10], eax
mov byte [esp + 0x3c], cl
mov dword [esp + 0x14], ecx
mov byte [esp + 0x5c], cl
fild qword [esp + 0x10]
mov edx, dword [ebx]
mov byte [esp + 0x1c], cl
mov byte [esp + 0x7c], cl
cmp edx, ecx
fsubp st(1)
fmul dword [0x533050]
fstp dword [esp + 0x10]
je 0x42ee34
fld dword [esp + 0x10]
lea eax, [esp + 0x7c]
sub esp, 8
fstp qword [esp]
push str._.2f_
push eax
call fcn.00519a30
add esp, 0x10
mov eax, dword [ebx + 4]
test eax, eax
je 0x42ee97
lea eax, [esp + 0x18]
push eax
call fcn.0051a6a0
lea eax, [esp + 0x1c]
add esp, 4
push 0x14
push eax
call fcn.0051ac30
add esp, 4
mov edi, 0x544b68
push eax
lea eax, [esp + 0x24]
push eax
call fcn.0051ab00
add esp, 0xc
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x1c]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x42eeb4
mov eax, dword [ebx + 0x24]
lea ecx, [esp + 0x5c]
push eax
push str._ld_
push ecx
call fcn.00519a30
add esp, 0xc
mov edi, 0x544b5c
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [esp + 0x3c]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea esi, [ebx + 0x348]
lea eax, [esp + 0x40]
lea ecx, [esp + 0x60]
push eax
lea edx, [esp + 0x24]
push ecx
lea eax, [esp + 0x88]
push edx
push eax
push str._s_s_s_s_s_n
push esi
call fcn.00519a30
add esp, 0x1c
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x42ef14
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [ebx + 8]
test eax, eax
je 0x42ef46
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x42ef46
mov eax, dword [0x561428]
push eax
push esi
call fcn.0051aaa0
add esp, 8
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x42ef46
mov eax, dword [0x561428]
push eax
call fcn.0051a7b0
add esp, 4
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x8c
ret
Function at 0x456340
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x88
lea eax, [esp]
push ebx
push esi
push edi
mov edi, dword [esp + 0x98]
push ebp
push 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_OpenFile]
cmp eax, 0xffffffff
mov esi, eax
jne 0x4563ae
push 2
push edi
push 0
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x45639c
push eax
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x88
ret
cmp esi, 0xffffffff
jne 0x4563ae
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x88
ret
push esi
call fcn.00456480
add esp, 4
mov ebp, eax
test ebp, ebp
jne 0x4563ca
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x88
ret
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x20]
test eax, eax
jne 0x4563e5
mov cx, word [ebp + 0xe]
cmp cx, 8
ja 0x4563e5
mov eax, 1
shl eax, cl
mov ecx, dword [ebp]
push ebp
lea eax, [ecx + eax*4]
lea edi, [eax + ebx]
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalReAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
test edi, edi
jne 0x45643c
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
test edi, edi
je 0x456464
mov eax, dword [edi + 0x20]
test eax, eax
jne 0x456454
mov cx, word [edi + 0xe]
cmp cx, 8
ja 0x456454
mov eax, 1
shl eax, cl
push ebx
mov ecx, dword [edi]
lea eax, [ecx + eax*4]
add eax, edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll__hread]
push esi
call dword [sym.imp.KERNEL32.dll__lclose]
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x88
ret

Function at 0x464088
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x4640c3
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x4640aa
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x4640bb
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x4640c5
inc edi
add eax, 0x28
cmp edi, esi
jb 0x4640a0
xor eax, eax
pop edi
pop esi
ret
Function at 0x465bc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add eax, dword [eax]
add byte [ebx - 0x6fb43], al
inc dword [ecx]
jne 0x465c74
and byte [ebp - 0x78c], 0
and byte [ebp - 0x78b], 0
mov byte [ebp - 0x78a], 0xa0
and byte [ebp - 0x789], 0
mov byte [ebp - 0x788], 3
mov byte [ebp - 0x787], 0x3b
mov byte [ebp - 0x786], 0x33
mov byte [ebp - 0x785], 0x3c
mov byte [ebp - 0x784], 0x30
mov byte [ebp - 0x783], 0x3a
mov byte [ebp - 0x782], 0x2d
mov byte [ebp - 0x781], 0x71
mov byte [ebp - 0x780], 0x3b
mov byte [ebp - 0x77f], 0x33
mov byte [ebp - 0x77e], 0x33
mov byte [ebp - 0x77d], 0x5f
push 0xc
lea eax, [ebp - 0x78c]
push eax
call fcn.00464058
pop ecx
push eax
mov eax, dword [ebp - 0x28]
lea eax, [ebp + eax - 0x12c]
push eax
call fcn.00463fb9
add esp, 0xc
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x3a0], eax
jmp 0x465fc0
cmp dword [ebp - 0x6fc], 2
jne 0x465d31
and byte [ebp - 0x79c], 0
and byte [ebp - 0x79b], 0
mov byte [ebp - 0x79a], 0x10
and byte [ebp - 0x799], 0
mov byte [ebp - 0x798], 0xb3
mov byte [ebp - 0x797], 0x8c
mov byte [ebp - 0x796], pe_nt_image_headers32
mov byte [ebp - 0x795], 0x81
mov byte [ebp - 0x794], 0x9d
mov byte [ebp - 0x793], 0x8a
mov byte [ebp - 0x792], 0x9c
mov byte [ebp - 0x791], 0xc1
mov byte [ebp - 0x790], 0x8b
mov byte [ebp - 0x78f], 0x83
mov byte [ebp - 0x78e], 0x83
mov byte [ebp - 0x78d], 0xef
call fcn.00464048
push esp
mov dword [eax - 0x72f39594], eax
test dword [eax + edi*8 - 1], esp
call dword [eax - 0x18]
push eax
jecxz 0x465d06
invalid
call [ecx + 0x50]
mov eax, dword [ebp - 0x550]
lea eax, [ebp + eax - 0x654]
push eax
call fcn.00463fb9
add esp, 0xc
lea eax, [ebp - 0x654]
mov dword [ebp - 0x3a0], eax
jmp 0x465fc0
cmp dword [ebp - 0x6fc], 3
jne 0x465dd2
and byte [ebp - 0x7ac], 0
and byte [ebp - 0x7ab], 0
mov byte [ebp - 0x7aa], 0xed
invalid
invalid
in eax, dx
cmp dword [ebp - 0x6fc], 4
jne 0x465e7c
and byte [ebp - 0x7bc], 0
and byte [ebp - 0x7bb], 0
mov byte [ebp - 0x7ba], 2
clc
invalid
inc dword [edx]
and byte [ebp - 0x7b9], 0
mov byte [ebp - 0x7b8], 0xa1
mov byte [ebp - 0x7b7], 0xb2
mov byte [ebp - 0x7b6], 0xb1
mov byte [ebp - 0x7b5], 0xb8
mov byte [ebp - 0x7b4], 0xcf
invalid
invalid

Function at 0x468a40
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 4]
push 4
mov edx, dword [esp + 0xc]
test eax, eax
lea eax, [esp + 0x10]
push eax
push 4
push 0
push edx
je 0x468a6c
mov ecx, dword [ecx + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp eax, 1
sbb eax, eax
neg eax
ret 0xc
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp eax, 1
sbb eax, eax
neg eax
ret 0xc
Function at 0x468ac0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
test eax, eax
nop
lea eax, [esp]
push ebx
mov dword [esp + 8], 1
lea edx, [esp + 8]
push esi
mov esi, ecx
push eax
mov dword [esp + 0xc], 0xff
lea ecx, [esi + 0xc]
mov eax, dword [esp + 0x1c]
push ecx
push edx
push 0
push eax
je 0x468afa
mov ecx, dword [esi + 4]
jmp 0x468afc
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x468b12
lea eax, [esi + 0xc]
pop esi
pop ebx
add esp, 8
ret 8
xor eax, eax
pop esi
pop ebx
add esp, 8
ret 8

Function at 0x468b20
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0xc
mov eax, 4
test edx, edx
lea edx, [esp + 8]
push ebx
lea ebx, [esp + 8]
mov dword [esp + 4], eax
mov dword [esp + 8], eax
lea eax, [esp + 4]
push eax
push edx
mov eax, dword [esp + 0x20]
push ebx
push 0
push eax
je 0x468b54
mov ecx, dword [ecx + 4]
jmp 0x468b56
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x468b6c
mov eax, dword [esp + 0xc]
pop ebx
add esp, 0xc
ret 8
mov eax, 0xffffffff
pop ebx
add esp, 0xc
ret 8
Function at 0x4770b0
Capabilities:
Get disk information

Disassembly:
sub esp, 0x20c
push ebx
push esi
mov eax, dword [ecx + 0xc]
push edi
push ebp
mov esi, ecx
mov ecx, dword [eax + 0x408]
test ecx, ecx
jne 0x4770d3
mov eax, 1
jmp 0x4771b5
xor edi, edi
mov eax, dword [esp + 0x220]
cmp eax, edi
jle 0x477126
xor ebx, ebx
lea ebp, [ebx + 1]
mov ecx, dword [esi + 0x70]
push ebp
call fcn.004a48c0
cmp eax, 2
jne 0x477100
push ebx
mov ecx, esi
call fcn.00479390
test eax, eax
je 0x477100
inc edi
mov ebx, ebp
cmp ebp, 9
jl 0x4770e2
mov eax, dword [esi + 0xc]
mov edx, dword [esp + 0x220]
mov ecx, dword [eax + 0x40c]
xor eax, eax
imul ecx, edi
cmp ecx, edx
setge al
jmp 0x4771b5
mov eax, dword [0x547358]
test eax, eax
je 0x477136
mov eax, 1
jmp 0x4771b5
push str.CDPath
mov ecx, dword [esi + 0x90]
push 0
call fcn.00468ac0
mov edi, eax
test edi, edi
jne 0x477152
xor eax, eax
jmp 0x4771b5
push edi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 5
je 0x477162
xor eax, eax
jmp 0x4771b5
lea eax, [esp + 0x11c]
push 0x100
lea ecx, [esp + 0x1c]
push eax
lea edx, [esp + 0x1c]
push ecx
lea eax, [esp + 0x1c]
push edx
lea ecx, [esp + 0x2c]
push eax
push 0x100
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
mov eax, 0
je 0x4771b5
mov eax, dword [esi + 0xc]
lea ecx, [esp + 0x1c]
add eax, 0x2fd
push eax
push ecx
call fcn.0051cd70
add esp, 8
cmp eax, 1
sbb eax, eax
neg eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x20c
ret 4

Function at 0x477240
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push esi
mov eax, dword [ecx + 0xc]
push edi
push ebp
mov esi, ecx
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x20], eax
call ebp
cmp eax, 0xb7
jne 0x4772c9
mov eax, dword [esi + 0xc]
lea ecx, [eax + 0x7a]
push ecx
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
mov edi, eax
test edi, edi
je 0x4772a3
push edi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x47728e
push 1
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push edi
call dword [sym.imp.USER32.dll_GetLastActivePopup]
push eax
call dword [sym.imp.USER32.dll_BringWindowToTop]
mov eax, dword [esi + 0x20]
test eax, eax
je 0x4772c2
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x20], 0
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret
mov eax, dword [esi + 0x20]
test eax, eax
je 0x4772d7
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x47d590
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47d645
mov dword [ecx], 0x535110
push eax
mov dword fs:[0], esp
sub esp, 4
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], ecx
mov ecx, dword [ecx + 0xf8]
test ecx, ecx
je 0x47d5e8
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 0x108]
test edx, edx
jne 0x47d5e8
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x108], 1
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x100]
test eax, eax
je 0x47d60b
push eax
call fcn.00513ed0
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x100], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xf8]
test eax, eax
je 0x47d62c
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [ebp - 0x10]
mov dword [eax + 0xf8], 0
mov dword [ebp - 4], 0xffffffff
call fcn.0047d64f
mov eax, dword [ebp - 0xc]
mov esp, ebp
mov dword fs:[0], eax
pop ebp
ret

Function at 0x47d920
Capabilities:
Get graphical window text

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, ecx
mov ecx, dword [ecx + 0xf8]
test ecx, ecx
je 0x47d99b
movsx eax, word [esi + 0xfc]
push eax
mov edx, dword [esi + 0x100]
push edx
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea edx, [esp + 8]
mov dword [esi + 0x104], eax
mov eax, dword [esi + 0x100]
push edx
movsx ecx, word [esi + 0xfc]
mov byte [ecx + eax - 1], 0
lea ecx, [esp + 0x10]
mov eax, dword [esi + 0xf8]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
push ecx
push 0xb0
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
sub eax, ecx
mov dword [esi + 0x150], eax
pop esi
pop ebx
add esp, 8
ret
Function at 0x48c820
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor eax, eax
push esi
mov edx, dword [ecx + 0x18]
push edi
xor esi, esi
push ebp
cmp edx, eax
jle 0x48c852
mov ebx, dword [ecx + 0x14]
xor edi, edi
test ebx, ebx
jle 0x48c84a
mov edx, dword [ecx]
mov ebp, dword [edx + esi*4]
xor edx, edx
mov dl, byte [ebp + edi]
inc edi
xor eax, edx
cmp edi, ebx
jl 0x48c83d
inc esi
mov edx, dword [ecx + 0x18]
cmp esi, edx
jl 0x48c832
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x48c860
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor eax, eax
push esi
mov ebx, dword [ecx + 0x18]
push edi
test ebx, ebx
push ebp
jle 0x48c88d
mov edi, 0x6e3560
mov ecx, dword [ecx + 0x14]
test ecx, ecx
jle 0x48c887
mov esi, dword [edi]
mov edx, ecx
mov ebp, dword [esi]
add esi, 4
xor eax, ebp
dec edx
jne 0x48c87d
add edi, 4
dec ebx
jne 0x48c875
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x48c8a0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48ca10
push eax
mov dword fs:[0], esp
sub esp, 4
push ebx
push esi
mov dword [ebp - 0x10], ecx
push edi
mov esi, ecx
mov edi, dword [ebp + 8]
mov ecx, 0xffffffff
xor ebx, ebx
mov eax, dword [ebp + 0xc]
mov dword [esi + 4], edi
mov dword [esi + 8], ecx
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], eax
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], eax
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], ecx
mov eax, 0xbf800000
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], ecx
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x4c], ecx
mov dword [esi + 0x50], ecx
mov dword [esi + 0x54], ecx
mov dword [esi + 0x58], ecx
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
push 0x28
mov dword [esi + 0x68], ebx
mov dword [esi + 0x48], 0x40000000
mov dword [esi + 0x6c], 0xa
call fcn.00513eb0
add esp, 4
mov dword [esi + 0x60], eax
mov dword [ebp - 4], ebx
mov dword [esi + 0xf0], ebx
mov dword [esi + 0xf4], ebx
mov dword [esi + 0xf8], ebx
mov dword [esi + 0x104], ebx
mov dword [esi + 0x108], ebx
mov dword [esi + 0x124], ebx
mov dword [esi + 0x128], ebx
mov dword [esi + 0x12c], ebx
mov dword [esi + 0x100], 0xbb8
mov dword [esi + 0x10c], 0x3e8
mov dword [esi + 0x120], 0x3f800000
mov byte [esi + 0x130], bl
mov dword [esi], 0x535ea0
test edi, edi
je 0x48c9ac
mov eax, dword [edi + 0x30]
movsx ecx, word [eax + 0x12]
mov dword [esi + 0xc], ecx
mov eax, dword [edi + 0x30]
mov edx, dword [eax + 0x24]
mov dword [esi + 0x120], edx
mov eax, dword [esi + 0x14]
shl eax, 2
lea ecx, [eax + eax*8]
push ecx
call fcn.00513eb0
add esp, 4
mov ecx, dword [esi + 0x20]
mov dword [esi + 0x18], eax
lea eax, [ecx + ecx*2]
shl eax, 3
push eax
call fcn.00513eb0
add esp, 4
mov ecx, esi
mov dword [esi + 0x24], eax
mov eax, 0xbf800000
mov dword [esi + 0x110], eax
mov dword [esi + 0x114], eax
mov dword [esi + 0x118], eax
call fcn.00490880
mov eax, esi
pop edi
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x48c8a6
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48ca10
push eax
mov dword fs:[0], esp
sub esp, 4
push ebx
push esi
mov dword [ebp - 0x10], ecx
push edi
mov esi, ecx
mov edi, dword [ebp + 8]
mov ecx, 0xffffffff
xor ebx, ebx
mov eax, dword [ebp + 0xc]
mov dword [esi + 4], edi
mov dword [esi + 8], ecx
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], eax
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], eax
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], ecx
mov eax, 0xbf800000
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], ecx
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x4c], ecx
mov dword [esi + 0x50], ecx
mov dword [esi + 0x54], ecx
mov dword [esi + 0x58], ecx
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
push 0x28
mov dword [esi + 0x68], ebx
mov dword [esi + 0x48], 0x40000000
mov dword [esi + 0x6c], 0xa
call fcn.00513eb0
add esp, 4
mov dword [esi + 0x60], eax
mov dword [ebp - 4], ebx
mov dword [esi + 0xf0], ebx
mov dword [esi + 0xf4], ebx
mov dword [esi + 0xf8], ebx
mov dword [esi + 0x104], ebx
mov dword [esi + 0x108], ebx
mov dword [esi + 0x124], ebx
mov dword [esi + 0x128], ebx
mov dword [esi + 0x12c], ebx
mov dword [esi + 0x100], 0xbb8
mov dword [esi + 0x10c], 0x3e8
mov dword [esi + 0x120], 0x3f800000
mov byte [esi + 0x130], bl
mov dword [esi], 0x535ea0
test edi, edi
je 0x48c9ac
mov eax, dword [edi + 0x30]
movsx ecx, word [eax + 0x12]
mov dword [esi + 0xc], ecx
mov eax, dword [edi + 0x30]
mov edx, dword [eax + 0x24]
mov dword [esi + 0x120], edx
mov eax, dword [esi + 0x14]
shl eax, 2
lea ecx, [eax + eax*8]
push ecx
call fcn.00513eb0
add esp, 4
mov ecx, dword [esi + 0x20]
mov dword [esi + 0x18], eax
lea eax, [ecx + ecx*2]
shl eax, 3
push eax
call fcn.00513eb0
add esp, 4
mov ecx, esi
mov dword [esi + 0x24], eax
mov eax, 0xbf800000
mov dword [esi + 0x110], eax
mov dword [esi + 0x114], eax
mov dword [esi + 0x118], eax
call fcn.00490880
mov eax, esi
pop edi
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x497c40
Capabilities:
Get common file path

Disassembly:
sub esp, 0x10c
lea eax, [esp]
push ebx
mov ebx, dword [esp + 0x120]
push esi
lea ecx, [esp + 0xc]
push edi
mov edx, dword [esp + 0x120]
push ebp
push eax
mov dword [ebx], 0
mov eax, dword [esp + 0x124]
push ecx
push edx
push eax
call fcn.00497b00
add esp, 0x10
mov ebp, eax
test ebp, ebp
jne 0x497c8c
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x10c
ret
lea eax, [esp + 0x18]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x497cc6
mov edi, 0x54a220
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x128]
lea eax, [esp + 0x18]
push esi
push 0
push str.temp
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x497d20
push 0x54a214
push esi
call fcn.00519a10
add esp, 8
mov dword [ebx], eax
test eax, eax
je 0x497d20
mov ecx, dword [esp + 0x10]
test ecx, ecx
jle 0x497d20
push eax
push 1
mov eax, dword [esp + 0x18]
push eax
push ebp
call fcn.0051c8e0
add esp, 0x10
mov eax, dword [ebx]
push 0
push 0
push eax
call fcn.0051c840
add esp, 0xc
mov eax, dword [esp + 0x14]
cmp eax, 1
jne 0x497d32
push ebp
call fcn.00514010
add esp, 4
mov eax, dword [ebx]
pop ebp
pop edi
cmp eax, 1
sbb eax, eax
pop esi
inc eax
pop ebx
add esp, 0x10c
ret
Function at 0x4b24e0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov dword [ebp - 4], ecx
push esi
mov ecx, dword [ecx + 0x64]
push edi
add ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x28]
mov esi, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov ebx, dword [esi + 0x54]
cmp ebx, edx
jl 0x4b2680
mov eax, dword [esi + 0x50]
cmp eax, edx
jg 0x4b2680
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
mov eax, dword [esi + 0x10]
lea edx, [eax + ecx - 1]
mov eax, dword [esi + 0x14]
mov ecx, dword [ebp + 0x18]
lea eax, [eax + ecx - 1]
mov ecx, dword [ebp + 0x14]
add ecx, dword [esi + 0x18]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp + 0x18]
add ecx, dword [esi + 0x1c]
mov esi, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov edi, dword [esi + 0x40]
cmp edi, ebx
jl 0x4b2680
mov ecx, dword [esi + 0x3c]
cmp ecx, edx
jg 0x4b2680
mov ecx, dword [ebp + 0x18]
mov edx, dword [esi + 0x48]
cmp edx, ecx
jl 0x4b2680
mov ecx, dword [esi + 0x44]
cmp ecx, eax
jg 0x4b2680
mov eax, dword [ebp - 8]
test eax, eax
jl 0x4b257f
mov ecx, eax
mov eax, dword [esi + 0x68]
cmp eax, ecx
jg 0x4b2580
int3
mov ecx, dword [ebp - 4]
call fcn.004b2420
mov esi, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov edx, dword [esi + 0x58]
lea edx, [edx + ecx*4]
mov ecx, dword [edx]
test ecx, ecx
jne 0x4b259e
mov dword [edx], eax
jmp 0x4b25ad
mov edx, dword [ecx]
test edx, edx
je 0x4b25ab
mov ecx, dword [ecx]
cmp dword [ecx], 0
jne 0x4b25a4
mov dword [ecx], eax
xor edx, edx
mov ecx, dword [ebp + 0x2c]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x14]
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
mov ecx, dword [ebp + 0x18]
mov dword [eax + 0xc], esi
mov esi, dword [ebp + 0x1c]
mov dword [eax + 0x14], ebx
mov ebx, dword [ebp + 8]
mov dword [eax + 0x18], ecx
mov ecx, dword [ebp + 0x20]
mov dword [eax + 0x1c], esi
mov esi, dword [ebp + 0x24]
mov edi, dword [ebp - 4]
mov dword [eax + 0x20], ebx
mov ebx, dword [ebp + 0x28]
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], esi
mov dword [eax + 0x10], ebx
mov dword [eax + 0x2c], edx
mov ecx, dword [edi + 0x6c]
test ecx, ecx
je 0x4b263b
mov bx, word [ebp - 0x10]
mov esi, dword [ebp - 4]
mov cx, word [ecx]
add cx, bx
mov di, word [ebp - 0xc]
mov word [eax + 0x30], cx
mov ecx, dword [esi + 0x6c]
mov cx, word [ecx + 2]
add cx, di
mov word [eax + 0x32], cx
mov ecx, dword [esi + 0x6c]
mov cx, word [ecx + 4]
add cx, bx
mov word [eax + 0x34], cx
mov ebx, dword [esi + 0x6c]
mov cx, word [ebx + 6]
add cx, di
mov word [eax + 0x36], cx
mov dword [esi + 0x6c], edx
jmp 0x4b2666
mov cx, word [ebp + 0x14]
mov esi, dword [ebp + 0xc]
mov di, word [ebp + 0x18]
mov word [eax + 0x30], cx
mov word [eax + 0x32], di
mov edx, dword [esi + 0x10]
add dx, cx
dec dx
mov word [eax + 0x34], dx
mov ecx, dword [esi + 0x14]
add cx, di
dec cx
mov word [eax + 0x36], cx
mov cx, word [ebp - 0x10]
mov dx, word [ebp - 0xc]
mov word [eax + 0x38], cx
xor ecx, ecx
mov word [eax + 0x3a], dx
mov word [eax + 0x3c], cx
mov word [eax + 0x3e], cx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x28