joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423b30
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov ecx, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
add ecx, 2
cmp word [eax], 0
jne 0x423b40
sub eax, edi
cmp eax, 0xffffffd9
jge 0x423b59
mov eax, 0xffffffff
jmp 0x423b5c
add eax, 0x26
push eax
call fcn.004082f0
add esp, 4
mov dword [esp + 0x1c], eax
mov dword [esp + 0x7a], 0x11b32f92
mov dword [esp + 0x7e], 0x15ba13bd
mov dword [esp + 0x82], 0x19b117b0
mov dword [esp + 0x86], 0x1da01bbd
mov dword [esp + 0x8a], 0x1af1fbd
mov dword [esp + 0x8e], 0x5a203ac
mov dword [esp + 0x92], 0x9af07af
mov dword [esp + 0x96], 0xd9a0be4
mov dword [esp + 0x9a], 0xf1560faa
mov word [esp + 0x9e], 0xf3f2
mov eax, 0xde
mov ecx, 0x7c651f21
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + eax - 0x64]
lea ebp, [eax - 0x7c652000]
mov esi, eax
and esi, ebx
mov edx, ebx
not edx
and edx, ebp
xor ebp, ebx
sub edx, ebp
add edx, ecx
or edx, esi
mov bl, 0xf
sub bl, dl
mov byte [esp + eax - 0x64], bl
inc eax
dec ecx
cmp eax, 0x104
jne 0x423be0
movzx ecx, word [edi]
mov ebp, dword [esp + 0x1c]
mov eax, ebp
test cx, cx
je 0x423c41
mov edx, edi
add edx, 2
mov eax, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x423c30
mov word [eax], 0
movzx ecx, word [esp + 0x7a]
test cx, cx
lea ebx, [esp + 0x7a]
je 0x423c71
lea edx, [esp + 0x7c]
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x423c60
mov word [eax], 0
jmp dword [0x440c64]

Function at 0x423c7c
Capabilities:
Copy file

Disassembly:
push edi
call fcn.00408300
add esp, 4
xor eax, eax
cmp word [ebp], 0x2a
sete al
jmp dword [eax*4 + 0x440c6c]

Function at 0x423c96
Capabilities:
Contain obfuscated stackstrings
Copy file
Encode data using xor

Disassembly:
xor eax, eax
cmp word [ebp], 0x2a
sete al
jmp dword [eax*4 + 0x440c6c]

Function at 0x423fa1
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp ebp, ebx
sete al
jmp dword [eax*4 + 0x440cbc]

Function at 0x424356
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov esi, dword [esp + 0xdc]
lea eax, [esi + 1]
push eax
call fcn.004082f0
add esp, 4
push 0
push esi
mov dword [esp + 0x38], eax
push eax
push dword [esp + 0x44]
call fcn.00439fa0
add esp, 0x10
not eax
shr eax, 0x1f
mov dword [esp], 0
mov edx, edi
jmp dword [eax*4 + 0x440d2c]
Function at 0x424d0a
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xf8
mov dword [esp + 2], 0x97d795f1
mov dword [esp + 6], 0x9b2a9928
mov dword [esp + 0xa], 0x9f3f9dd8
mov dword [esp + 0xe], 0xe343e154
mov dword [esp + 0x12], 0xe7e6e581
mov eax, 0x34
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x32]
lea ecx, [eax - 0x7fcbcd00]
mov esi, eax
or esi, ecx
or ecx, edx
and esi, edx
sub ecx, esi
mov edx, ecx
and edx, 0x5d
mov esi, ecx
and esi, 2
mov edi, esi
xor edi, 2
imul edi, edx
or edx, 2
imul edx, esi
xor ecx, 0x5f
add ecx, edi
add ecx, edx
inc cl
mov byte [esp + eax - 0x32], cl
inc eax
cmp eax, 0x48
jne case.default.0x424dc6
lea esi, [esp + 0xe4]
lea eax, [esp + 2]
mov ecx, 5
mov edi, esi
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0xf8]
lea eax, [esp + 0x16]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea edi, [esp + 0x5c]
push edi
push 0
push 0
push 9
push esi
push 0
call dword [0x445bac]
xor ecx, ecx
cmp eax, 0xc0000023
setne cl
jmp dword [ecx*4 + 0x440e1c]
Function at 0x424e3f
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 2], 0xe58de3a6
mov dword [esp + 6], 0xe98be775
mov dword [esp + 0xa], 0xed7eeb85
mov dword [esp + 0xe], 0x1110ef8a
mov eax, 0x6d4d1a73
mov ecx, 0x92b2e58d
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax - 0x6d4d1a71]
lea edx, [eax - 1]
and edx, esi
add edx, edx
mov edi, edx
sub edi, esi
add edi, ecx
or edi, 0x6f
add edi, esi
sub esi, edx
add esi, eax
dec esi
sub edi, edx
add edi, eax
xor esi, 0x6f
lea edx, [esi + edi*2]
inc dl
mov byte [esp + eax - 0x6d4d1a71], dl
inc eax
dec ecx
cmp eax, 0x6d4d1a83
jne 0x424e70
lea ebp, [esp + 0xa2]
lea eax, [esp + 2]
mov edi, ebp
mov ecx, 4
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0xb2]
lea eax, [esp + 0x12]
xor edx, edx
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov dword [esp + 2], 0x81299f5a
mov dword [esp + 6], 0x85278311
mov dword [esp + 0xa], 0x891a8729
mov dword [esp + 0xe], 0x8d4f8b2e
mov dword [esp + 0x12], 0x71de8f2f
mov dword [esp + 0x16], 0x75e673d3
mov dword [esp + 0x1a], 0x797877ef
nop
nop
nop
movzx ecx, byte [esp + edx + 2]
mov esi, edx
and esi, 0xc
mov eax, edx
and eax, 2
mov edi, eax
xor edi, 2
imul edi, esi
or esi, 2
imul esi, eax
mov eax, edx
xor eax, 0xa871d9ee
add eax, edi
add eax, esi
xor eax, ecx
mov ecx, eax
and ecx, 0xf
xor eax, 0x8f
lea eax, [eax + ecx*2]
inc al
mov byte [esp + edx + 2], al
inc edx
cmp edx, 0x1c
jne 0x424f10
lea edx, [esp + 0xc8]
lea eax, [esp + 2]
mov edi, edx
mov ecx, 7
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0xe4]
lea eax, [esp + 0x1e]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov dword [esp + 2], 0xe941e7a2
mov dword [esp + 6], 0xed4feb79
mov dword [esp + 0xa], 0xd142ef41
mov dword [esp + 0xe], 0xd564d376
mov dword [esp + 0x12], 0xd99ad762
lea ebx, [esp + 0x16]
mov word [esp + 0x16], 0xdbda
mov ecx, 0x56
mov esi, 0xa9
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + ecx - 0x54]
mov eax, esi
xor eax, ecx
and eax, edi
xor eax, ecx
add al, 0x50
mov byte [esp + ecx - 0x54], al
inc ecx
dec esi
cmp ecx, 0x6c
jne 0x424fc0
lea esi, [esp + 0xb2]
lea eax, [esp + 2]
mov edi, esi
mov ecx, 5
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0xc6]
mov ecx, 1
xchg esi, ebx
rep movsw word es:[edi], word [esi]
xchg esi, ebx
mov dword [esp + 0x80], ebp
mov dword [esp + 0x84], edx
mov dword [esp + 0x88], esi
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x425240
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + eax + 0x80]
mov eax, 0xfffffffe
mov dword [esp + 0x40], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ecx + eax + 2], 0
lea eax, [eax + 2]
jne 0x425260
sar eax, 1
mov edx, dword [esp + 0x5c]
mov ecx, edx
xor ecx, 1
mov edi, eax
not edi
and edi, ecx
xor edx, 0xfffffffe
and edx, eax
imul edx, edi
mov edi, ecx
and edi, eax
or ecx, eax
imul ecx, edi
add ecx, edx
shr ecx, 0xb
and ecx, 0xfffffffe
push ecx
call fcn.004082f0
add esp, 4
mov ecx, eax
mov eax, dword [esp + 0x34]
movzx edx, word [eax]
mov eax, ecx
test dx, dx
je 0x4252d1
mov edi, dword [esp + 0x50]
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], dx
add eax, 2
movzx edx, word [edi]
add edi, 2
test dx, dx
jne 0x4252c0
mov dword [esp + 0x44], ecx
mov word [eax], 0x5c
mov dword [esp + 2], 0x7689749f
mov dword [esp + 6], 0x6a8a68e8
mov dword [esp + 0xa], 0x6ef16c8a
mov dword [esp + 0xe], 0x6292604f
mov dword [esp + 0x12], 0x668464f7
mov dword [esp + 0x16], 0x1afc18f3
mov word [esp + 0x1a], 0x1c1b
mov edx, 0x1a41a22b
mov edi, 0x25be5dd4
nop
nop
nop
nop
nop
movzx ebx, byte [esp + edx - 0x1a41a229]
lea ebp, [ebx + ebx]
not ebp
add ebp, ebx
and ebp, 0xe3dea524
and ebx, 0xffffffdb
or ebx, ebp
mov ebp, edi
and ebp, 0x201c0524
mov esi, edx
and esi, 0x1801025b
mov ecx, ebp
xor ecx, 0x201c0524
xor ebp, 0x3e7dffff
or ebp, ecx
not ebp
or ebp, esi
xor ebp, ebx
mov ecx, ebp
and ecx, 0x27
xor ebp, 0xa7
lea ecx, [ecx*2]
add ecx, ebp
inc cl
mov byte [esp + edx - 0x1a41a229], cl
inc edx
dec edi
cmp edx, 0x1a41a245
jne 0x425320
add eax, 2
mov ecx, dword [esp + 0x40]
movzx edx, word [ecx]
test dx, dx
je 0x4253b1
add ecx, 2
nop
nop
nop
nop
nop
nop
nop
mov word [eax], dx
add eax, 2
movzx edx, word [ecx]
add ecx, 2
test dx, dx
jne 0x4253a0
mov word [eax], 0
movzx edx, word [esp + 2]
test dx, dx
mov ecx, dword [esp + 0x44]
je 0x4253e1
mov esi, dword [esp + 0x30]
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], dx
add eax, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x4253d0
mov word [eax], 0
lea eax, [esp + 0x58]
push 0x60
push 3
push 0x120089
push eax
push ecx
call fcn.00439c50
add esp, 0x14
Function at 0x425ef8
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov ebx, dword [esp + 0x68]
mov eax, dword [esp + 0x64]
add eax, 0x10
cmp dword [esp + 0x40], 0xfffffff8
mov ebp, dword [esp + 0x44]
jge 0x425f13
mov eax, 0xffffffff
push eax
call fcn.004082f0
add esp, 4
mov esi, eax
mov dword [esp + 2], 0x309b3e42
mov dword [esp + 6], 0x344d3281
mov dword [esp + 0xa], 0x8bf3681
mov dword [esp + 0xe], 0xc0b0abd
xor eax, eax
movzx ecx, byte [esp + eax + 2]
lea edx, [eax + 0x95]
mov edi, edx
and edi, ecx
not ecx
or ecx, edx
sub ecx, eax
add ecx, 0x278c166b
or ecx, edi
mov edx, 0x3c60b356
sub edx, ecx
mov ecx, edx
and ecx, 1
xor edx, 1
lea ecx, [edx + ecx*2]
mov byte [esp + eax + 2], cl
mov ecx, eax
not ecx
or ecx, 1
add ecx, eax
or eax, 1
add eax, ecx
inc eax
cmp eax, 0x10
jb 0x425f40
movzx ecx, word [ebp]
mov eax, esi
test cx, cx
je 0x425fb1
lea edx, [ebp + 2]
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x425fa0
mov word [eax], 0
movzx ecx, word [esp + 2]
test cx, cx
mov edi, ebx
je 0x425fe1
mov edx, dword [esp + 0x30]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x425fd0
mov word [eax], 0
mov ecx, dword [esp + 0x10c]
push dword [esp + 0x74]
push dword [esp + 0x7c]
push esi
call fcn.004090e0
mov ebx, eax
jmp dword [0x440eac]

Function at 0x426070
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
movzx eax, bl
jmp dword [eax*4 + 0x440edc]
Function at 0x42f0a0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
call fcn.00413af0
sub esp, 0x10
mov edi, esp
push eax
mov esi, esp
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 0
setne al
jmp 0x42f0d0
xor ebx, ebx
test al, 1
jne 0x42f0db
jmp 0x42f281
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
xor ebx, ebx
cmp eax, 0
je 0x42f27b
mov dword [ebp - 0x24], esi
sub esp, 4
mov dword [ebp - 0x30], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
sub esp, 4
mov dword [esp], esi
call fcn.004224b0
add esp, 4
xor ebx, ebx
cmp eax, 0
je 0x42f26c
mov dword [ebp - 0x2c], eax
mov ebx, eax
add ebx, 1
sub esp, 4
mov dword [esp], ebx
call fcn.004082f0
sub esp, 8
mov dword [ebp - 0x28], eax
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
call fcn.004092b0
add esp, 0xc
mov eax, dword [ebp - 0x24]
mov al, byte [eax]
mov byte [ebp - 0x14], al
mov byte [edi], 0xcf
mov byte [edi + 1], 0xa1
mov byte [edi + 2], 0xa7
mov byte [edi + 3], 0xbf
mov byte [edi + 4], 0xb2
mov byte [edi + 5], 0xbe
mov byte [edi + 6], 0xb3
mov byte [edi + 7], 0xa1
mov byte [edi + 8], 0xb0
mov byte [edi + 9], 0xfb
mov byte [edi + 0xa], 0xa2
mov byte [edi + 0xb], 0xaf
mov byte [edi + 0xc], 0xac
mov byte [edi + 0xd], 0x19
xor ecx, ecx
cmp ecx, 0xe
jae 0x42f239
movzx edx, byte [edi + ecx]
mov dword [ebp - 0x1c], edx
mov eax, 0x700a4c93
sub eax, ecx
or eax, edx
mov dword [ebp - 0x20], eax
mov eax, 0x13
sub eax, ecx
mov esi, 0x13
sub esi, ecx
mov dword [ebp - 0x10], ecx
mov ebx, dword [ebp - 0x10]
add ebx, 0x8ff5b36c
mov ecx, dword [ebp - 0x10]
add ecx, 0x8ff5b36c
mov dword [ebp - 0x18], ecx
mov edx, ebx
and edx, 0x86
and eax, 0x79
mov ecx, dword [ebp - 0x18]
and ecx, 0x86
and esi, 0x79
or edx, eax
or ecx, esi
xor edx, ecx
or ebx, dword [ebp - 0x18]
xor ebx, 0xffffffff
or edx, ebx
mov ecx, dword [ebp - 0x10]
and edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
xor eax, 0xffffffff
or edx, eax
mov eax, edx
xor eax, 0x61
shl edx, 1
and edx, 0x3c
sub edx, eax
add dl, 1
mov byte [edi + ecx], dl
add ecx, 1
jmp 0x42f1aa
sub esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [esp], edi
mov esi, dword [ebp - 0x28]
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x2c]
mov dword [esp + 8], eax
call fcn.00409410
mov bl, al
and bl, 1
jmp 0x42f25c
sub esp, 4
mov dword [esp], esi
call fcn.00408300
add esp, 4
jmp 0x42f26c
sub esp, 4
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x437850
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [esp + 2], 0x12851081
mov dword [esp + 6], 0x168914b7
mov dword [esp + 0xa], 0xa57088b
mov dword [esp + 0xe], 0xe910caf
mov dword [esp + 0x12], 0x2010093
mov eax, 0x6d719a27
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x6d719a25]
xor ecx, eax
mov edx, ecx
and edx, 0x47
xor ecx, 0xc7
lea ecx, [ecx + edx*2]
inc cl
mov byte [esp + eax - 0x6d719a25], cl
inc eax
cmp eax, 0x6d719a3b
jne 0x437890
lea eax, [esp + 2]
push eax
call fcn.004391a0
add esp, 4
mov dword [0x44dbcc], eax
xor ecx, ecx
test eax, eax
sete cl
mov ecx, dword [ecx*4 + 0x442734]
mov edx, 0x62c9aeff
xor edx, dword [0x44273c]
add ecx, edx
inc ecx
jmp ecx

Function at 0x4394c0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebx, dword [esp + 0x3c]
movzx eax, word [ebx]
xor ecx, ecx
cmp eax, 0x5a4d
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x443350]
Function at 0x44e150
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
add ah, 9
mov al, ah
xor ebx, eax
mov cx, 0x49
sub cl, ah
shr cl, 1
rol eax, 1
ror ebx, 1
xor ebx, eax
loop 0x44e169
mov dword [ebp + 0xc], ebx
mov eax, dword [ebp + 0xc]
pop ebx
pop ebp
ret
Function at 0x4527f4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45ca88]
jne 0x4527fe
repz ret
jmp fcn.00453596

Function at 0x45322b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x45ca88]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0044fc25
and dword [ebp - 0x14], 0
cmp dword [0x45d7f4], 0
mov dword [ebp - 0x18], eax
jne 0x4532de
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x453386
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x453386
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x45d7f4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x45d7f8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x45d7fc], eax
call edi
push eax
call esi
mov dword [0x45d804], eax
test eax, eax
je 0x4532de
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x45d800], eax
mov eax, dword [0x45d800]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x453337
cmp dword [0x45d804], ecx
je 0x453337
push eax
call esi
push dword [0x45d804]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x453337
test ebx, ebx
je 0x453337
call edi
test eax, eax
je 0x45332e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x45332e
test byte [ebp - 8], 1
jne 0x453337
or dword [ebp + 0x10], 0x200000
jmp 0x45336a
mov eax, dword [0x45d7f8]
cmp eax, dword [ebp - 0x18]
je 0x45336a
push eax
call esi
test eax, eax
je 0x45336a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x45336a
mov eax, dword [0x45d7fc]
cmp eax, dword [ebp - 0x18]
je 0x45336a
push eax
call esi
test eax, eax
je 0x45336a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x45d7f4]
call esi
test eax, eax
je 0x453386
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x453388
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004527f4
leave
ret
Function at 0x454450
Capabilities:
Get file size
Query environment variable
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x811c
call fcn.00453810
mov dword [ebp - 0x811c], ecx
mov eax, dword [ebp - 0x811c]
cmp dword [eax + 0x114], 0
je 0x4544c9
mov ecx, dword [ebp - 0x811c]
mov edx, dword [ecx + 0x114]
push edx
call fcn.00451c6a
add esp, 4
mov ecx, dword [ebp - 0x811c]
mov dword [ecx + 0x124], eax
mov edx, dword [ebp - 0x811c]
mov eax, dword [edx + 0x114]
push eax
mov ecx, dword [ebp - 0x811c]
mov edx, dword [ecx + 0x12c]
push edx
mov eax, dword [ebp - 0x811c]
mov ecx, dword [eax + 0x124]
push ecx
call fcn.0044f2d0
add esp, 0xc
mov al, 1
jmp 0x454617
push 0
push pe_nt_image_headers32
push 3
push 0
push 3
push 0x80000000
mov edx, dword [ebp - 0x811c]
add edx, 8
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x4545a7
push 0x3a
mov eax, dword [ebp - 0x811c]
add eax, 8
push eax
call fcn.00454b00
add esp, 8
test eax, eax
jne 0x4545a7
push 0x7fff
lea ecx, [ebp - 0x8010]
push ecx
push str.PATH
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push 0x45aaa8
lea edx, [ebp - 0x8010]
push edx
call fcn.00455084
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x811c]
add eax, 8
push eax
mov ecx, dword [ebp - 0x10]
push ecx
lea edx, [ebp - 0x8118]
push edx
call fcn.004542b0
add esp, 0xc
push 0
push pe_nt_image_headers32
push 3
push 0
push 3
push 0x80000000
lea eax, [ebp - 0x8118]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x45458f
cmp dword [ebp - 0xc], 0xffffffff
je 0x45458f
jmp 0x4545a7
push 0x45aaac
push 0
call fcn.00455084
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x454542
cmp dword [ebp - 0xc], 0
je 0x4545b3
cmp dword [ebp - 0xc], 0xffffffff
jne 0x4545b7
xor al, al
jmp 0x454617
push 0
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
push edx
call fcn.00451c6a
add esp, 4
mov ecx, dword [ebp - 0x811c]
mov dword [ecx + 0x124], eax
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x811c]
mov edx, dword [ecx + 0x124]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 8]
je 0x454615
xor al, al
jmp 0x454617
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x454890
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x134]
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 0x134]
movzx edx, word [eax + 0x14]
lea eax, [ecx + edx + 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
jmp 0x4548df
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0x10]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x134]
movzx edx, word [ecx + 6]
cmp dword [ebp - 0xc], edx
jae 0x4549c1
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x134]
mov edx, dword [ebp - 8]
cmp edx, dword [ecx + 0x50]
jae 0x4549c1
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 0x124]
mov ecx, dword [ebp - 4]
add eax, dword [ecx + 0x14]
push eax
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 0x120]
mov ecx, dword [ebp - 4]
add eax, dword [ecx + 0xc]
push eax
call fcn.0044f2d0
add esp, 0xc
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 0x134]
movzx ecx, word [eax + 6]
sub ecx, 1
cmp dword [ebp - 0xc], ecx
jae 0x45495f
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov ecx, dword [edx + 0x34]
sub ecx, dword [eax + 0xc]
mov dword [ebp - 0x10], ecx
jmp 0x454968
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1c], 4
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x24]
and edx, 0x20000000
je 0x454984
mov dword [ebp - 0x1c], 0x40
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x120]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 0xc]
push ecx
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 4]
add edx, 0x28
mov dword [ebp - 4], edx
jmp 0x4548cd
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x454a20
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x134]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x134]
movzx edx, word [eax + 0x14]
lea eax, [ecx + edx + 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
jmp 0x454a61
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
add edx, 0x28
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x134]
movzx edx, word [ecx + 6]
cmp dword [ebp - 8], edx
jae 0x454aab
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0
jne 0x454a8b
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
cmp edx, dword [ecx + 0xc]
jb 0x454aa9
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
add ecx, dword [ebp - 0xc]
cmp dword [ebp + 8], ecx
jae 0x454aa9
mov eax, dword [ebp - 4]
jmp 0x454aad
jmp 0x454a4f
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x454ac0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0x40
push 0x3000
mov eax, dword [ebp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esp, ebp
pop ebp
ret 4
Function at 0x402a10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 0xc]
test byte [0x40701c], 1
jne 0x402a2c
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_ExitProcess]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.__d__semi_stub:_no_script_engine_clean_up_n
mov dword [esp + 8], str.Host_Quit
mov dword [esp + 4], 0x40701c
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_1
jmp 0x402a23