joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425e70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x425eea
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 8], ecx
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 0x18]
push eax
lea ecx, [ebp + 0x14]
push ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x425ee0
mov ecx, dword [ebp + 0x14]
cmp ecx, dword [ebp - 0xc]
jne 0x425ee0
mov edx, dword [ebp + 0x1c]
cmp edx, dword [ebp - 8]
jb 0x425ee0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x425eec
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x425ef0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x425f58
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x425f4e
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x425f5a
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x426670
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
and eax, 0xffff
movzx ecx, ax
and ecx, 0xff
movzx edx, cl
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 5
jb 0x4266a3
mov eax, 1
jmp 0x4266a5
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4266f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.00426670
test eax, eax
je 0x426706
mov dword [ebp - 4], 0x17
jmp 0x42670d
mov dword [ebp - 4], 2
push 1
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov esp, ebp
pop ebp
ret
Function at 0x43e7d0
Capabilities:
Connect to http server

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4855e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
push edi
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x10
call fcn.004205a0
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x14
call fcn.004205a0
mov edx, dword [ebp - 0x1c]
cmp dword [edx + 4], 0
jne 0x43e838
mov edi, dword [ebp - 0x1c]
add edi, 0x20
mov ecx, 6
mov esi, str.Session_not_initialized_
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
xor eax, eax
jmp 0x43e9ad
push 0
push 0x4900b8
mov ecx, dword [ebp - 0x1c]
add ecx, 0x10
call fcn.0043eb90
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x43e8e9
mov eax, dword [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x10
call fcn.004137f0
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x24], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x10
call fcn.0041f710
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00403ca0
mov ecx, dword [ebp - 0x1c]
add ecx, 0x14
call fcn.00403ce0
sub eax, dword [ebp - 0x10]
sub eax, 1
push eax
lea ecx, [ebp - 0x18]
push ecx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x14
call fcn.0043ec10
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x14
call fcn.0041f710
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00403ca0
jmp 0x43e8f4
mov ecx, dword [ebp - 0x1c]
add ecx, 0x14
call fcn.00404180
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx + 0xc24], 1
jne 0x43e90f
cmp dword [ebp + 0x18], 1
jne 0x43e90f
mov dword [ebp - 0x30], 0x8000000
jmp 0x43e916
mov dword [ebp - 0x30], 0
cmp dword [ebp + 0xc], 0
jne 0x43e931
mov edx, dword [ebp - 0x1c]
cmp dword [edx + 0xc24], 3
jne 0x43e931
mov dword [ebp - 0x34], 0x48c93c
jmp 0x43e937
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
movzx ecx, word [ebp + 0x14]
test ecx, ecx
jne 0x43e94f
mov edx, dword [ebp - 0x1c]
mov ax, word [edx + 0xc20]
mov word [ebp - 0x36], ax
jmp 0x43e957
mov cx, word [ebp + 0x14]
mov word [ebp - 0x36], cx
push 0
mov edx, dword [ebp - 0x30]
push edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0xc24]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x34]
push eax
mov cx, word [ebp - 0x36]
push ecx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x10
call fcn.00420d30
push eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.WININET.dll_InternetConnectA]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 0x1c]
cmp dword [edx + 8], 0
jne 0x43e9a8
mov ecx, dword [ebp - 0x1c]
call fcn.0043eb20
xor eax, eax
jmp 0x43e9ad
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x43ff50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 0xc]
call fcn.0043f9e0
test eax, eax
jne 0x43ff69
xor eax, eax
jmp 0x440032
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x43ff95
xor eax, eax
jmp 0x440032
push 0
lea ecx, [ebp - 4]
push ecx
push 4
push str.ssi3
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x43ffb2
jmp 0x440026
mov ecx, dword [ebp + 0xc]
call fcn.0043f9a0
push eax
mov ecx, dword [ebp + 0xc]
call fcn.0043f9c0
push eax
push 0
call fcn.00438280
add esp, 0xc
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 4]
push eax
push 4
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x43ffed
jmp 0x440026
push 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.0043f9a0
push eax
mov ecx, dword [ebp + 0xc]
call fcn.0043f9c0
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x440015
jmp 0x440026
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x440032
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x440040
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
jne 0x44005a
xor eax, eax
jmp 0x4401ad
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x440086
xor eax, eax
jmp 0x4401ad
push 0
lea ecx, [ebp - 8]
push ecx
push 4
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4400a6
cmp dword [ebp - 8], 4
je 0x4400ab
jmp 0x44018f
push 4
push str.ssi3
lea ecx, [ebp - 0x18]
push ecx
call fcn.00467520
add esp, 0xc
test eax, eax
je 0x4400c7
jmp 0x44018f
push 0
lea edx, [ebp - 8]
push edx
push 4
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4400e7
cmp dword [ebp - 8], 4
je 0x4400ec
jmp 0x44018f
push 2
push 0
push 0
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
sub eax, 8
mov dword [ebp - 0x14], eax
push 0
push 0
push 8
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.00463b01
add esp, 4
mov dword [ebp - 4], eax
push 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x440145
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x14]
je 0x440147
jmp 0x44018f
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
push 0
call fcn.00438280
add esp, 0xc
cmp eax, dword [ebp - 0x10]
je 0x440160
jmp 0x44018f
push 0
push 0
push 0
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.0043f430
mov ecx, dword [ebp - 4]
push ecx
call fcn.004639e9
add esp, 4
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x4401ad
cmp dword [ebp - 4], 0
je 0x4401a1
mov eax, dword [ebp - 4]
push eax
call fcn.004639e9
add esp, 4
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4401c0
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [eax], 0
lea ecx, [ebp - 8]
push ecx
push 0x49017c
push 1
push 0
push 0x49016c
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jge 0x440207
jmp 0x440235
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ebp - 8]
push edx
call dword [ecx + 0x1c]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jge 0x440222
jmp 0x440235
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov eax, dword [ebp - 4]
push eax
call dword [edx + 0x1c]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
je 0x440247
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov eax, dword [ebp - 4]
push eax
call dword [edx + 8]
cmp dword [ebp - 8], 0
je 0x440259
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov eax, dword [ebp - 8]
push eax
call dword [edx + 8]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x441864
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
mov eax, esi
shr eax, 2
test eax, eax
push edi
mov edi, dword [esp + 0x14]
jle 0x44189f
push ebx
movzx edx, byte [ecx]
xor ebx, ebx
inc ecx
mov bh, byte [ecx]
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or edx, ebx
inc ecx
xor edi, edx
dec eax
jne 0x44187c
pop ebx
and esi, 3
xor eax, eax
dec esi
je 0x4418bb
dec esi
je 0x4418b4
dec esi
jne 0x4418c0
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
xor edx, edx
mov dh, byte [ecx]
or eax, edx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
xor eax, edi
pop edi
pop esi
ret 0xc

Function at 0x44a980
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x485818
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push edi
lea ecx, [esp + 0xc]
call fcn.00421db0
mov edx, dword [esp + 0x30]
lea eax, [esp + 0xb]
push eax
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x30]
push 0x20
push 0
push 0
push edx
push 0xa
push eax
push ecx
mov dword [esp + 0x44], 0
mov byte [esp + 0x2f], 0
call fcn.0044aa50
mov ecx, dword [esp + 0x30]
mov bl, al
mov eax, dword [esp + 0x38]
add esp, 0x24
sub eax, ecx
test ecx, ecx
mov edi, ecx
je 0x44aa3a
cmp eax, 0x80
jbe 0x44aa0e
push ecx
call fcn.0047916c
add esp, 4
pop edi
mov al, bl
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret
push esi
lea esi, [eax - 1]
shr esi, 3
push 0x4a7b3c
lea esi, [esi*4 + 0x4a7b40]
call fcn.00445530
mov edx, dword [esi]
mov dword [edi], edx
add esp, 4
mov dword [esi], edi
mov dword [0x4a7b3c], 0
pop esi
mov ecx, dword [esp + 0x18]
pop edi
mov al, bl
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x44c6c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x485818
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push edi
lea ecx, [esp + 0xc]
call fcn.00421db0
mov edx, dword [esp + 0x30]
lea eax, [esp + 0xb]
push eax
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x30]
push 0x20
push 0
push 0
push edx
push 0xa
push eax
push ecx
mov dword [esp + 0x44], 0
mov byte [esp + 0x2f], 0
call fcn.0044c790
mov ecx, dword [esp + 0x30]
mov bl, al
mov eax, dword [esp + 0x38]
add esp, 0x24
sub eax, ecx
test ecx, ecx
mov edi, ecx
je 0x44c77a
cmp eax, 0x80
jbe 0x44c74e
push ecx
call fcn.0047916c
add esp, 4
pop edi
mov al, bl
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret
push esi
lea esi, [eax - 1]
shr esi, 3
push 0x4a7b3c
lea esi, [esi*4 + 0x4a7b40]
call fcn.00445530
mov edx, dword [esi]
mov dword [edi], edx
add esp, 4
mov dword [esi], edi
mov dword [0x4a7b3c], 0
pop esi
mov ecx, dword [esp + 0x18]
pop edi
mov al, bl
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x4540f5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, dword [esp + 8]
mov al, byte [esi + 0x37]
test al, al
jne 0x45405d
mov ecx, esi
call fcn.00454090
test al, al
jne 0x454083
or ax, 0xffff
pop esi
ret
mov al, byte [esi + 0x3a]
test al, al
je 0x454083
mov eax, dword [esi + 0x64]
mov ecx, dword [esi + 0x6c]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x68]
cmp eax, ecx
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
mov byte [esi + 0x3a], 0
je 0x454083
mov ax, word [eax]
pop esi
ret
mov ecx, esi
pop esi
jmp 0x4540f0
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 0x58]
mov ecx, dword [esi + 0x4c]
mov dword [esi + 0x54], eax
mov eax, dword [esi + 0x50]
cmp eax, ecx
push edi
jbe 0x454121
mov edx, dword [esi + 0x44]
lea edi, [esp + 0x13]
push edi
push edx
push eax
push ecx
call fcn.0040c1a0
add esp, 0x10
mov dword [esi + 0x50], eax
jmp 0x454127
mov ecx, dword [esi + 0x44]
mov dword [esi + 0x50], ecx
mov eax, dword [esi + 0x50]
mov edx, dword [esi + 0x48]
sub edx, eax
push edx
lea ecx, [esi + 0x24]
push eax
call fcn.00458b40
test eax, eax
jle 0x4541e4
mov edx, dword [esi + 0x40]
mov ecx, dword [esi + 0x50]
mov edi, dword [esi + 0x3c]
add ecx, eax
lea ebp, [esp + 0x18]
push ebp
push edx
push edi
mov eax, ecx
lea edx, [esp + 0x28]
push edx
push eax
mov eax, dword [esi + 0x44]
mov dword [esi + 0x50], ecx
mov ecx, dword [esi + 0x58]
push eax
mov dword [esp + 0x2c], ecx
mov ecx, dword [esi + 0x70]
mov ebx, dword [ecx]
lea eax, [esp + 0x2c]
push eax
call dword [ebx + 8]
cmp eax, 3
je 0x4541f0
cmp eax, 2
je 0x454215
mov eax, dword [esi + 0x3c]
mov ecx, dword [esp + 0x18]
cmp ecx, eax
mov edx, dword [esp + 0x1c]
je 0x454198
cmp edx, dword [esi + 0x44]
je 0x454215
mov bl, byte [esi + 0x34]
test bl, bl
je 0x4541b4
mov ebp, dword [esi + 0x44]
mov edi, ecx
sub edi, eax
sar edi, 1
imul edi, dword [esi + 0x74]
mov ebx, edx
sub ebx, ebp
cmp edi, ebx
jne 0x454215
cmp ecx, eax
jne 0x4541fb
mov ebp, dword [esi + 0x44]
mov ebx, dword [esi + 0x78]
mov edi, edx
sub edi, ebp
cmp edi, ebx
jge 0x454215
cmp ecx, eax
jne 0x4541fb
mov eax, dword [esi + 0x50]
mov ecx, dword [esi + 0x48]
sub ecx, eax
push ecx
push eax
lea ecx, [esi + 0x24]
call fcn.00458b40
test eax, eax
jg 0x454141
pop edi
pop esi
pop ebp
or ax, 0xffff
pop ebx
add esp, 0x10
ret
pop edi
pop esi
pop ebp
xor ax, ax
pop ebx
add esp, 0x10
ret
mov eax, dword [esi + 0x3c]
pop edi
mov dword [esi + 0x4c], edx
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
mov ax, word [eax]
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov ecx, esi
call fcn.00454230
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x454270
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x486139
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
push edi
mov dword [esp + 0xc], 0
mov edi, dword [esp + 0x30]
push edi
lea eax, [esp + 0x34]
push eax
mov esi, ecx
call fcn.00457ff0
mov ecx, dword [esi + 0x58]
test ecx, ecx
mov dword [esp + 0x24], 1
je 0x4542c6
push edi
lea edx, [esp + 0xc]
push edx
call fcn.00458340
lea ecx, [esp + 8]
call fcn.004460e0
push 0x4a3840
mov ecx, edi
call fcn.00446130
push 0x4a3854
mov ecx, edi
mov dword [esi + 0x40], eax
call fcn.00446130
lea ecx, [esp + 0x10]
push ecx
mov ecx, eax
mov dword [esi + 0x44], eax
call fcn.0044b670
lea ecx, [esi + 0x48]
cmp eax, ecx
mov byte [esp + 0x24], 2
je 0x45430d
mov edx, dword [eax + 4]
mov eax, dword [eax]
lea esi, [esp + 0x30]
push esi
push edx
push eax
call fcn.00450a90
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
sub eax, ecx
test ecx, ecx
mov byte [esp + 0x24], 1
mov esi, ecx
je 0x45435b
cmp eax, 0x80
jbe 0x454331
push ecx
call fcn.0047916c
jmp 0x454358
lea edi, [eax - 1]
shr edi, 3
push 0x4a7b3c
lea edi, [edi*4 + 0x4a7b40]
call fcn.00445530
mov edx, dword [edi]
mov dword [esi], edx
mov dword [edi], esi
mov dword [0x4a7b3c], 0
add esp, 4
mov esi, dword [esp + 0x2c]
lea eax, [esp + 0x30]
push eax
mov ecx, esi
call fcn.004460c0
lea ecx, [esp + 0x30]
mov dword [esp + 0xc], 1
mov byte [esp + 0x24], 0
call fcn.004460e0
mov ecx, dword [esp + 0x1c]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 8

Function at 0x4543a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x486139
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
push edi
mov dword [esp + 0xc], 0
mov edi, dword [esp + 0x30]
push edi
lea eax, [esp + 0x34]
push eax
mov esi, ecx
call fcn.00457ff0
mov ecx, dword [esi + 0x58]
test ecx, ecx
mov dword [esp + 0x24], 1
je 0x4543f6
push edi
lea edx, [esp + 0xc]
push edx
call fcn.00451c10
lea ecx, [esp + 8]
call fcn.004460e0
push 0x4a3860
mov ecx, edi
call fcn.00446130
push 0x4a386c
mov ecx, edi
mov dword [esi + 0x40], eax
call fcn.00446130
lea ecx, [esp + 0x10]
push ecx
mov ecx, eax
mov dword [esi + 0x44], eax
call fcn.0044b670
lea ecx, [esi + 0x48]
cmp eax, ecx
mov byte [esp + 0x24], 2
je 0x45443d
mov edx, dword [eax + 4]
mov eax, dword [eax]
lea esi, [esp + 0x30]
push esi
push edx
push eax
call fcn.00450a90
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
sub eax, ecx
test ecx, ecx
mov byte [esp + 0x24], 1
mov esi, ecx
je 0x45448b
cmp eax, 0x80
jbe 0x454461
push ecx
call fcn.0047916c
jmp 0x454488
lea edi, [eax - 1]
shr edi, 3
push 0x4a7b3c
lea edi, [edi*4 + 0x4a7b40]
call fcn.00445530
mov edx, dword [edi]
mov dword [esi], edx
mov dword [edi], esi
mov dword [0x4a7b3c], 0
add esp, 4
mov esi, dword [esp + 0x2c]
lea eax, [esp + 0x30]
push eax
mov ecx, esi
call fcn.004460c0
lea ecx, [esp + 0x30]
mov dword [esp + 0xc], 1
mov byte [esp + 0x24], 0
call fcn.004460e0
mov ecx, dword [esp + 0x1c]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 8
Function at 0x458130
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4863fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
lea ecx, [esi + 0x20]
mov dword [esp + 8], esi
mov dword [esi], vtable._STL::ios_base.0
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
call fcn.004460a0
lea ecx, [esi + 0x48]
mov dword [esp + 0x14], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
call fcn.00421db0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x4589e0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esi], 0xffffffff
mov dword [esi + 8], ebx
mov byte [esi + 0xc], bl
mov byte [esi + 0xd], bl
cmp dword [0x4a4370], ebx
jne 0x458a15
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 0xc]
mov dword [0x4a4370], ecx
mov dword [esi + 4], ebx
cmp dword [0x4a4370], ebx
mov eax, esi
ja 0x458a2c
mov dword [0x4a4370], 0x1000
pop esi
pop ebx
add esp, 0x24
ret

Function at 0x458a40
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov ecx, dword [ecx]
lea eax, [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esp], eax
jne 0x458a6c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x458a69
xor eax, eax
add esp, 8
ret
mov eax, dword [esp]
add esp, 8
ret
Function at 0x458b40
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x14]
push edi
push 0
mov edi, ecx
mov ecx, dword [esp + 0x20]
mov edx, dword [edi]
lea eax, [esp + 0x10]
push eax
push ecx
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test byte [edi + 8], 4
mov eax, dword [esp + 0xc]
jne 0x458c2d
test eax, eax
je 0x458c2d
push ebp
lea ebp, [eax + ebx - 1]
cmp ebx, ebp
mov ecx, ebx
push esi
mov esi, ebx
mov dword [esp + 0x10], ecx
ja 0x458c27
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov al, byte [ecx]
cmp al, 0x1a
je 0x458c12
cmp al, 0xd
je 0x458ba2
mov byte [esi], al
inc esi
jmp 0x458bf7
cmp ecx, ebp
jae 0x458bb2
cmp byte [ecx + 1], 0xa
je 0x458bf7
mov byte [esi], 0xd
inc esi
jmp 0x458bf7
mov edx, dword [edi]
push 0
lea eax, [esp + 0x1c]
push eax
push 1
lea ecx, [esp + 0x30]
push ecx
push edx
mov byte [esp + 0x38], 0x20
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x458bf3
cmp byte [esp + 0x24], 0xa
push 1
push 0
je 0x458bec
mov byte [esi], 0xd
mov eax, dword [edi]
push 0xffffffffffffffff
inc esi
push eax
jmp 0x458bf1
mov ecx, dword [edi]
push 0xfffffffffffffffe
push ecx
call ebx
mov ecx, dword [esp + 0x10]
inc ecx
cmp ecx, ebp
mov dword [esp + 0x10], ecx
jbe 0x458b93
mov ebx, dword [esp + 0x20]
sub esi, ebx
mov eax, esi
pop esi
pop ebp
pop edi
pop ebx
add esp, 0xc
ret 8
cmp ecx, ebp
ja 0x458c23
mov edx, dword [edi]
push 1
sub ebp, ecx
push 0
inc ebp
push ebp
push edx
call ebx
mov ebx, dword [esp + 0x20]
sub esi, ebx
mov eax, esi
pop esi
pop ebp
pop edi
pop ebx
add esp, 0xc
ret 8

Function at 0x458c40
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x10
dec eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push edi
mov edi, dword [esp + 0x20]
mov esi, ecx
je 0x458c9c
dec eax
je 0x458c95
sub eax, 2
jne 0x458ccc
mov eax, dword [esi]
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
jne 0x458c86
call ebx
test eax, eax
je 0x458c82
xor eax, eax
jmp 0x458c86
mov eax, dword [esp + 0x14]
mov edx, edi
neg edx
cmp edx, eax
jg 0x458ccc
mov ecx, 2
jmp 0x458ca2
mov ecx, 1
jmp 0x458ca2
test edi, edi
jl 0x458ccc
xor ecx, ecx
push ecx
mov eax, edi
cdq
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x18], edx
mov edx, dword [esi]
push eax
push edx
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x458cdc
call ebx
test eax, eax
je 0x458cd8
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x10
ret 8
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
add esp, 0x10
ret 8