joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42a4a0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
movzx cx, byte [esp + 0x14]
mov eax, dword [0x1579888]
push ebx
push ebp
mov ebp, dword [esp + 0x18]
mov bx, word [ebp]
shr bx, cl
add ebp, 2
push edi
mov edi, dword [0x157988c]
and bl, 0x1f
dec eax
mov dword [esp + 0xc], eax
mov al, 1
nop
movzx cx, byte [esp + 0x20]
mov dx, word [ebp]
shr dx, cl
add ebp, 2
and dl, 0x1f
cmp dl, bl
mov byte [esp + 0x1c], dl
jne 0x42a543
inc al
cmp al, 0x3f
jbe 0x42a598
mov ecx, dword [esi]
mov byte [edi + ecx], 0xff
mov eax, dword [esi]
mov dl, bl
shl dl, 3
add dl, 7
mov byte [eax + edi + 1], dl
mov eax, dword [esi]
add eax, 2
lea ecx, [eax + 2]
cmp ecx, 0x1f40
mov dword [esi], eax
mov byte [esp + 0x1c], 1
jl 0x42a594
push 0
lea edx, [esp + 0x14]
push edx
push eax
mov eax, dword [0x1579890]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, dword [0x157988c]
mov dword [esi], 0
jmp 0x42a594
mov ecx, dword [esi]
sub al, 0x40
mov byte [edi + ecx], al
mov eax, dword [esi]
shl bl, 3
add bl, 7
mov byte [eax + edi + 1], bl
mov eax, dword [esi]
add eax, 2
lea ecx, [eax + 2]
cmp ecx, 0x1f40
mov dword [esi], eax
jl 0x42a58d
push 0
lea edx, [esp + 0x18]
push edx
push eax
mov eax, dword [0x1579890]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, dword [0x157988c]
mov dl, byte [esp + 0x1c]
mov dword [esi], 0
mov bl, dl
mov byte [esp + 0x1c], 1
mov al, byte [esp + 0x1c]
dec dword [esp + 0xc]
jne 0x42a4d0
test al, al
je 0x42a5e8
mov ecx, dword [esi]
sub al, 0x40
mov byte [edi + ecx], al
mov edx, dword [esi]
shl bl, 3
add bl, 7
mov byte [edx + edi + 1], bl
mov ebx, dword [esi]
add ebx, 2
mov eax, ebx
lea ecx, [eax + 2]
cmp ecx, 0x1f40
mov dword [esi], ebx
jl 0x42a5e8
push 0
lea edx, [esp + 0x24]
push edx
push eax
mov eax, dword [0x1579890]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [esi], 0
pop edi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x42a5f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x94
mov eax, dword [0x4a872c]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, ecx
mov dword [esp + 0x9c], eax
xor eax, eax
mov ecx, 0x20
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
xor edi, edi
lea eax, [edx - 1]
lea ecx, [esi - 1]
push 0x1f40
mov dword [0x1579888], edx
mov byte [esp + 0x1c], 0xa
mov byte [esp + 0x1d], 5
mov byte [esp + 0x1e], 1
mov byte [esp + 0x1f], 8
mov word [esp + 0x20], di
mov word [esp + 0x22], di
mov word [esp + 0x24], ax
mov word [esp + 0x26], cx
mov byte [esp + 0x5d], 3
mov word [esp + 0x5e], dx
call fcn.0047e540
mov edx, dword [ebp + 0x10]
add esp, 4
push edi
push 0x80
push 2
push edi
push 1
push 0x40000000
push edx
mov dword [0x157988c], eax
mov dword [esp + 0x28], edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [0x1579890], eax
je 0x42a728
push edi
lea ecx, [esp + 0x18]
push ecx
push 0x80
lea edx, [esp + 0x24]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp esi, edi
jle 0x42a70d
mov eax, dword [ebp + 0xc]
lea ecx, [eax + eax]
mov dword [esp + 0x10], ecx
mov edi, esi
push 0xb
push ebx
lea esi, [esp + 0x14]
call fcn.0042a4a0
push 6
push ebx
call fcn.0042a4a0
push 0
push ebx
call fcn.0042a4a0
mov ecx, dword [esp + 0x28]
add esp, 0x18
add ebx, ecx
dec edi
jne 0x42a6c2
mov eax, dword [esp + 0xc]
test eax, eax
je 0x42a70d
mov ecx, dword [0x1579890]
push 0
lea edx, [esp + 0x14]
push edx
push eax
mov eax, dword [0x157988c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [0x1579890]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x157988c]
push eax
call fcn.0047e545
add esp, 4
mov ecx, dword [esp + 0x9c]
xor eax, eax
call fcn.00460704
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42fef0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x487488
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
push edi
push 0x433180
push fcn.00433170
mov esi, ecx
push 5
push 0x18
lea eax, [esi + 0x6920]
push eax
mov dword [esp + 0x28], esi
call fcn.0046093b
xor ebx, ebx
lea ebp, [esi + 0x6998]
mov dword [esp + 0x20], ebx
mov edi, ebp
mov dword [esp + 0x10], 0x100
mov ecx, edi
call fcn.0042c3f0
mov eax, dword [esp + 0x10]
add edi, 0x78
dec eax
mov dword [esp + 0x10], eax
jne 0x42ff42
lea edi, [esi + 0xe198]
mov dword [esp + 0x10], 0x100
mov ecx, edi
call fcn.0042c3f0
mov eax, dword [esp + 0x10]
add edi, 0x78
dec eax
mov dword [esp + 0x10], eax
jne 0x42ff65
mov dword [esi + 0x159ac], ebx
mov dword [esi + 0x159b0], ebx
mov dword [esi + 0x159b4], ebx
mov dword [esi + 0x159b8], ebx
mov ecx, dword [esp + 0x28]
lea eax, [esi + 0x1599c]
mov dword [eax + 0x30], ebx
mov dword [eax + 0x34], ebx
mov dword [eax + 0x38], ebx
mov dword [eax + 0x3c], ebx
add eax, 0x20
mov dword [eax + 0x30], ebx
mov dword [eax + 0x34], ebx
mov dword [eax + 0x38], ebx
mov dword [eax + 0x3c], ebx
mov dword [eax + 0x50], ebx
mov dword [eax + 0x54], ebx
mov dword [eax + 0x58], ebx
mov dword [eax + 0x5c], ebx
mov dword [esi + 0xc], ecx
add eax, 0x20
mov byte [esi + 0x61d8], bl
xor eax, eax
mov edx, 1
mov dword [esi], edx
mov dword [esi + 0x6290], edx
lea edi, [esi + 0x18]
mov ecx, 0x1770
rep stosd dword es:[edi], eax
lea edi, [esi + 0x6294]
mov ecx, 0x1a0
rep stosd dword es:[edi], eax
lea edi, [esi + 0x5dd8]
mov ecx, 0x100
rep stosd dword es:[edi], eax
lea edi, [esi + 0x15a1c]
mov ecx, 0xc0
rep stosd dword es:[edi], eax
lea ecx, [esi + 0x15d1c]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x1c], eax
mov edi, ebp
mov ecx, 0x1e00
rep stosd dword es:[edi], eax
lea edi, [esi + 0xe198]
mov ecx, 0x1e00
rep stosd dword es:[edi], eax
mov eax, 0xff
mov dword [esi + 0x6914], eax
mov dword [esi + 0x6918], eax
mov dword [esi + 0x691c], eax
mov dword [esi + 0x620c], ebx
mov dword [esi + 8], edx
xor eax, eax
lea edi, [esi + 0x6210]
mov ecx, 0x20
rep stosd dword es:[edi], eax
mov edi, ebp
mov ecx, 0x1e00
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x18]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 4
Function at 0x438360
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
mov ebp, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x43838f
pop ebp
xor eax, eax
pop ebx
ret 4
push esi
push edi
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea ecx, [esi + 2]
push ecx
call fcn.0047e515
add esp, 4
push 0
lea edx, [esp + 0x18]
push edx
mov edi, eax
push esi
push edi
mov dword [ebp + 4], esi
push ebx
mov byte [edi + esi], 0
mov byte [edi + esi + 1], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [esp + 0x14]
xor eax, eax
cmp ebx, esi
setne al
dec eax
and eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x438550
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
mov al, byte [esi + 4]
xor ebx, ebx
cmp al, 1
mov byte [esi + 0x15], bl
mov dword [esi + 0x2a1], ebx
mov dword [esi + 0x2a5], ebx
mov dword [esi + 0x2a9], ebx
jne 0x4385a4
mov eax, dword [esi + 0x215]
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esi + 0x215]
push ebx
lea ecx, [esp + 0xc]
push ecx
push 0x100
lea edx, [esi + 0x115]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x4385e9
mov eax, dword [esi + 0x13b]
push edi
xor edi, edi
cmp eax, ebx
jle 0x4385d5
push ebp
xor ebp, ebp
mov ecx, dword [esi + 0x21d]
mov edx, dword [ecx + ebp]
push edx
call fcn.0047e545
mov eax, dword [esi + 0x13b]
add esp, 4
inc edi
add ebp, 0x16
cmp edi, eax
jl 0x4385b4
pop ebp
mov eax, dword [esi + 0x21d]
cmp eax, ebx
pop edi
je 0x4385e9
push eax
call fcn.0047e545
add esp, 4
mov eax, dword [esi + 0x215]
cmp eax, ebx
je 0x438600
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x215], ebx
pop esi
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x438610
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x108
push esi
push edi
mov esi, ecx
call fcn.00438550
mov edi, dword [esp + 0x114]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push edi
mov byte [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
lea edx, [esi + 0x15]
mov dword [esi + 0x215], eax
mov eax, edi
sub edx, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x438650
mov eax, dword [esi + 0x215]
cmp eax, 0xffffffff
jne 0x438672
pop edi
xor eax, eax
pop esi
add esp, 0x108
ret 4
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea ecx, [esp + 0x10]
push ecx
push 0x100
lea edx, [esi + 0x115]
push edx
push eax
call ebx
cmp dword [esp + 0xc], 0x100
je 0x4386a7
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x108
ret 4
mov eax, dword [esi + 0x13b]
imul eax, eax, 0x16
push ebp
push eax
call fcn.0047e540
mov ebp, dword [esi + 0x137]
mov dword [esi + 0x21d], eax
mov edi, eax
mov eax, dword [esi + 0x13b]
add esp, 4
test eax, eax
mov dword [esp + 0x14], 0
jg 0x4386f2
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0x108
ret 4
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esi + 0x215]
push 0
push 0
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esi + 0x215]
push 0
lea edx, [esp + 0x14]
push edx
push 0x16
push edi
push eax
call ebx
cmp dword [esp + 0x10], 0x16
jne 0x4387d1
mov ecx, dword [edi]
mov edx, dword [esi + 0x215]
push 0
push 0
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [esi + 0x215]
push 0
lea eax, [esp + 0x14]
push eax
push 0x100
lea ecx, [esp + 0x24]
push ecx
push edx
call ebx
cmp dword [esp + 0x10], 0xd
jbe 0x4387d1
lea eax, [esp + 0x18]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x438760
sub eax, edx
inc eax
push eax
call fcn.0047e540
lea ecx, [esp + 0x1c]
mov ebx, eax
mov edx, ecx
add esp, 4
sub ebx, edx
lea ecx, [ecx]
mov dl, byte [ecx]
mov byte [ebx + ecx], dl
inc ecx
test dl, dl
jne 0x438780
mov ecx, eax
lea ebx, [ecx + 1]
nop
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x438790
sub ecx, ebx
mov dword [edi], eax
mov eax, dword [esp + 0x14]
lea ecx, [ecx + ebp + 0x17]
mov ebp, dword [edi + 8]
mov dword [edi + 4], ecx
mov ecx, dword [esi + 0x13b]
inc eax
add edi, 0x16
cmp eax, ecx
mov dword [esp + 0x14], eax
jl 0x4386ec
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0x108
ret 4
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x108
ret 4
Function at 0x4387e0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
push edi
push 0
push 0
mov ebp, ecx
mov ecx, dword [ebp + 0x215]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [esp + 0x1c]
push edx
call fcn.0047e540
mov ebx, dword [esp + 0x24]
mov edi, eax
lea eax, [ebx + 2]
push eax
call fcn.0047e540
mov edx, dword [esp + 0x24]
add esp, 8
push 0
lea ecx, [esp + 0x14]
push ecx
mov esi, eax
push edx
mov byte [esi + ebx], 0
mov byte [esi + ebx + 1], 0
mov eax, dword [ebp + 0x215]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x1c]
push ecx
push edi
lea edx, [esp + 0x20]
mov ecx, esi
mov dword [esp + 0x20], ebx
call fcn.00438a60
push edi
call fcn.0047e545
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x45b8f0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x45c1d0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x30
lea eax, [esp]
push ebx
mov ebx, dword [esp + 0x38]
push ebp
push esi
push edi
push 0x10
push ebx
push eax
call fcn.0045adc0
mov esi, dword [esp + 0x58]
push 0x10
lea ecx, [esp + 0x30]
push esi
push ecx
call fcn.0045adc0
mov ecx, ebx
lea edi, [esp + 0x48]
add esp, 0x18
sub ecx, esi
mov eax, esi
sub edi, esi
mov ebp, 0x10
mov dl, byte [ecx + eax]
xor dl, byte [eax]
inc eax
dec ebp
mov byte [edi + eax - 1], dl
jne 0x45c20d
xor eax, eax
xor edx, edx
xor ecx, ecx
mov al, byte [eax + str._.C]
xor byte [esp + ecx + 0x10], al
mov al, byte [esp + ecx + 0x10]
and eax, 0xff
inc ecx
cmp ecx, 0x30
jb 0x45c220
add eax, edx
and eax, 0xff
inc edx
cmp edx, 0x12
jb 0x45c21e
lea ecx, [esp + 0x10]
push 0x10
push ecx
push ebx
call fcn.0045adc0
mov eax, dword [esp + 0x54]
xor ecx, ecx
add esp, 0xc
sub esi, eax
mov cl, byte [eax + 0xf]
mov edi, 0x10
xor edx, edx
mov dl, byte [esi + eax]
xor edx, ecx
mov cl, byte [edx + str._.C]
mov dl, byte [eax]
xor dl, cl
mov cl, dl
mov byte [eax], dl
and ecx, 0xff
inc eax
dec edi
jne 0x45c266
push 0x30
lea edx, [esp + 0x14]
push 0
push edx
call fcn.0045ada0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret

Function at 0x45c2a0
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x18], ecx
mov dword [eax + 0x14], ecx
ret
Function at 0x461ab6
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.004619c0
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x461b51
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x21f1684]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x461b51
cmp eax, 1
je 0x461b72
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x461b51
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x461b1e
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x461b4d
xor eax, eax
inc eax
jmp 0x461b91
cmp edi, eax
jae 0x461b55
xor eax, eax
jmp 0x461b91
cmp eax, esi
jae 0x461b5c
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x21f1684]
jmp 0x461b75
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x464b9e
Capabilities:
Terminate process

Disassembly:
push 8
push 0x493f90
call fcn.00463798
push 8
call fcn.00465b9b
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x21f16c4], esi
jne 0x464bd2
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x21f16c0], esi
mov al, byte [ebp + 0x10]
mov byte [0x21f16bc], al
cmp dword [ebp + 0xc], edi
jne 0x464c1c
cmp dword [0x21f2fb4], edi
je 0x464c0c
mov eax, dword [0x21f2fb0]
sub eax, 4
mov dword [0x21f2fb0], eax
cmp eax, dword [0x21f2fb4]
jb 0x464c0c
mov eax, dword [eax]
cmp eax, edi
je 0x464bed
call eax
jmp 0x464bed
push 0x49e1b0
mov eax, 0x49e1a8
call fcn.00464b1c
pop ecx
push 0x49e1bc
mov eax, 0x49e1b4
call fcn.00464b1c
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x464c4d
cmp dword [ebp + 0x10], edi
jne 0x464c5b
mov dword [0x21f16c4], esi
push dword [ebp + 8]
call fcn.00464ada
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x464c5a
push 8
call fcn.00465ae6
pop ecx
ret
call fcn.004637d3
ret
Function at 0x46880d
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3a0]
sub esp, 0x420
mov eax, dword [0x4a872c]
push edi
xor edi, edi
cmp dword [ebp + 0x3b0], edi
mov dword [ebp + 0x39c], eax
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x7c], edi
jne 0x46883e
xor eax, eax
jmp 0x4689c7
mov eax, dword [ebp + 0x3a8]
push ebx
mov ebx, dword [ebp + 0x3a8]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x21f1e60]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x46887a
push 2
push edi
push edi
push dword [ebp + 0x3a8]
call fcn.0046e6ed
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x468955
cmp dword [ebp + 0x3b0], edi
mov eax, dword [ebp + 0x3ac]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x6c], edi
jbe 0x468993
mov ecx, dword [ebp - 0x74]
sub ecx, dword [ebp + 0x3ac]
lea eax, [ebp - 0x68]
mov dword [ebp - 0x70], edi
cmp ecx, dword [ebp + 0x3b0]
jae 0x4688de
mov edx, dword [ebp - 0x74]
inc dword [ebp - 0x74]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x4688cf
inc dword [ebp - 0x7c]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 0x70]
mov byte [eax], dl
inc eax
inc dword [ebp - 0x70]
cmp dword [ebp - 0x70], 0x400
jl 0x4688af
mov edi, eax
lea eax, [ebp - 0x68]
sub edi, eax
push 0
lea eax, [ebp - 0x80]
push eax
push edi
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x46891e
mov eax, dword [ebp - 0x80]
add dword [ebp - 0x78], eax
cmp eax, edi
jl 0x468927
mov eax, dword [ebp - 0x74]
sub eax, dword [ebp + 0x3ac]
xor edi, edi
cmp eax, dword [ebp + 0x3b0]
jb 0x4688a0
jmp 0x468929
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
xor edi, edi
mov eax, dword [ebp - 0x78]
cmp eax, edi
jne 0x4689c2
cmp dword [ebp - 0x6c], edi
je 0x468993
push 5
pop esi
cmp dword [ebp - 0x6c], esi
jne 0x468988
call fcn.00463dc9
mov dword [eax], 9
call fcn.00463dd2
mov dword [eax], esi
jmp 0x4689bd
push edi
lea ecx, [ebp - 0x80]
push ecx
push dword [ebp + 0x3b0]
push dword [ebp + 0x3ac]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x46897d
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x78], eax
jmp 0x468929
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
jmp 0x468929
push dword [ebp - 0x6c]
call fcn.00463ddb
pop ecx
jmp 0x4689bd
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x4689ab
mov eax, dword [ebp + 0x3ac]
cmp byte [eax], 0x1a
jne 0x4689ab
xor eax, eax
jmp 0x4689c5
call fcn.00463dc9
mov dword [eax], 0x1c
call fcn.00463dd2
mov dword [eax], edi
or eax, 0xffffffff
jmp 0x4689c5
sub eax, dword [ebp - 0x7c]
pop esi
pop ebx
mov ecx, dword [ebp + 0x39c]
pop edi
call fcn.00460704
add ebp, 0x3a0
leave
ret
Function at 0x469c7f
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x469cad
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x469cb4
cmp ebx, dword [eax + 4]
jae 0x469cb4
xor eax, eax
jmp 0x469ea4
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x469cc5
xor eax, eax
inc eax
jmp 0x469ea3
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x469cdb
cmp ecx, edx
jae 0x469e20
cmp dword [eax + 4], 0
je 0x469ce4
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x469ccc
cmp dword [ebp + 8], 0
je 0x469d06
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x469e20
cmp eax, esi
jae 0x469e20
mov eax, dword [0x21f1858]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x469d2b
cmp dword [esi*4 + 0x21f1860], edi
je 0x469e24
inc esi
cmp esi, eax
jl 0x469d19
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x469ea0
cmp dword [ebp - 8], 0x1000000
jne 0x469ea0
test byte [ebp - 0xc], 0xcc
je 0x469da9
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x469ea0
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x469ea0
cmp word [eax + 0x18], 0x10b
jne 0x469ea0
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x469ea0
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x469da9
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x469da9
test byte [ecx + 0x27], 0x80
jne 0x469e20
push 1
push 0x21f18a0
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x469cbd
mov ecx, dword [0x21f1858]
test ecx, ecx
mov edx, ecx
jle 0x469ddd
lea eax, [ecx*4 + 0x21f185c]
cmp dword [eax], edi
je 0x469ddd
dec edx
sub eax, 4
test edx, edx
jg 0x469dd1
test edx, edx
jne 0x469e0e
push 0xf
pop ebx
cmp ecx, ebx
jg 0x469dea
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x469e02
lea eax, [edx*4 + 0x21f1860]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x469df0
cmp ecx, 0x10
jge 0x469e0e
inc ecx
mov dword [0x21f1858], ecx
push 0
push 0x21f18a0
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x469cbd
xor eax, eax
jmp 0x469ea3
test esi, esi
jle 0x469cbd
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
push 0x21f18a0
call ebx
test eax, eax
jne 0x469cbd
cmp dword [esi*4 + 0x21f1860], edi
je 0x469e7a
mov eax, dword [0x21f1858]
lea esi, [eax - 1]
test esi, esi
jl 0x469e68
cmp dword [esi*4 + 0x21f1860], edi
je 0x469e64
dec esi
jns 0x469e58
test esi, esi
jge 0x469e78
cmp eax, 0x10
jge 0x469e73
inc eax
mov dword [0x21f1858], eax
lea esi, [eax - 1]
jmp 0x469e7a
je 0x469e92
xor ecx, ecx
test esi, esi
jl 0x469e92
lea eax, [ecx*4 + 0x21f1860]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x469e80
push 0
push 0x21f18a0
call ebx
jmp 0x469cbd
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret