joyce8/EMBER2024-capa huggingface dataset:
Function at 0x450430
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll_fwrite]
push esi
push edi
mov edi, dword [esp + 0x20]
push ebx
push 1
push 0x40c
push edi
call ebp
mov eax, dword [edi + 4]
add esp, 0x10
xor esi, esi
test eax, eax
jle 0x450481
add edi, 0x3fc
mov eax, dword [edi]
push ebx
push 1
push 0x1b000
push eax
call ebp
mov ecx, dword [esp + 0x30]
add esp, 0x10
inc esi
add edi, 4
cmp esi, dword [ecx + 4]
jl 0x450462
mov edi, ecx
mov eax, dword [edi]
mov dword [esp + 0x14], 0
test eax, eax
jle 0x450517
add edi, 0x26c
mov dword [esp + 0x10], edi
mov edx, dword [esp + 0x10]
push ebx
push 1
push 0x58
mov esi, dword [edx]
push esi
call ebp
mov ecx, dword [esi + 0x14]
xor eax, eax
mov al, byte [esi + 2]
push ebx
shl eax, 6
push eax
push 1
push ecx
call ebp
mov al, byte [esi + 2]
add esp, 0x20
xor edi, edi
test al, al
jbe 0x4504f9
lea edx, [esi + 4]
mov dword [esp + 0x1c], edx
mov eax, dword [esp + 0x1c]
push ebx
push 1
push 0x800
mov ecx, dword [eax]
push ecx
call ebp
mov ecx, dword [esp + 0x2c]
xor edx, edx
mov dl, byte [esi + 2]
add esp, 0x10
inc edi
add ecx, 4
cmp edi, edx
mov dword [esp + 0x1c], ecx
jl 0x4504d0
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
inc eax
mov edx, dword [ecx]
add esi, 4
cmp eax, edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], esi
jl 0x45049d
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x454e60
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
push eax
push esi
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
test eax, eax
jne 0x454e8f
push esi
push 0x4bfbb8
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 8
push 1
call dword [sym.imp.MSVCRT.dll_exit]
pop esi
ret

Function at 0x4565c0
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
jne 0x4565ce
mov esi, 2
lea eax, [esi*4 + 8]
push eax
call fcn.004557f0
mov edx, eax
add esp, 4
test edx, edx
jne 0x4565f9
push 0x4bfd2c
call fcn.0042ba70
add esp, 4
push 1
call dword [sym.imp.MSVCRT.dll_exit]
test esi, esi
mov dword [edx + 4], 0
mov dword [edx], esi
jle 0x456611
push edi
lea edi, [edx + 8]
mov ecx, esi
xor eax, eax
rep stosd dword es:[edi], eax
pop edi
mov eax, edx
pop esi
ret

Function at 0x456620
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
cmp edx, ecx
jne 0x456665
lea edx, [ecx*4 + 8]
lea ecx, [ecx*8 + 8]
push edx
push ecx
push eax
call fcn.00455810
add esp, 0xc
test eax, eax
jne 0x45665f
push 0x4bfd50
call fcn.0042ba70
add esp, 4
push 1
call dword [sym.imp.MSVCRT.dll_exit]
mov edx, dword [eax]
shl edx, 1
mov dword [eax], edx
mov ecx, dword [eax + 4]
mov edx, dword [esp + 8]
inc ecx
mov dword [eax + 4], ecx
mov dword [eax + ecx*4 + 4], edx
ret
Function at 0x457160
Capabilities:
Terminate process

Disassembly:
sub esp, 0x400
push ebx
mov ebx, dword [esp + 0x408]
push ebp
push esi
test ebx, ebx
push edi
je 0x4572f1
cmp byte [ebx], 0
je 0x4572f1
mov edi, dword [0x4da04c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x4b1c88
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4bff18
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0x14]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x14]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
test eax, eax
jne 0x45723a
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x10]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x457244
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
lea ecx, [esp + 0x10]
push ecx
call fcn.004558b0
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x4572f1
mov esi, dword [ebp]
cmp byte [esi], 0x23
je 0x4572d2
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
xor ebx, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x45728f
mov al, byte [esi + ebx]
cmp al, 0x20
je 0x45728f
cmp al, 9
je 0x45728f
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
inc ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ebx, ecx
jb 0x457273
mov byte [esi + ebx], 0
mov edx, dword [0x4dba40]
push 0x457300
push esi
push edx
call fcn.004561a0
add esp, 0xc
test eax, eax
je 0x4572db
mov eax, dword [0x4dba40]
push 0x457300
push esi
push eax
call fcn.004561a0
mov eax, dword [eax]
add esp, 0xc
test eax, eax
je 0x4572db
push esi
push eax
mov byte [esi + ebx], 9
call dword [eax + 0xc]
add esp, 8
mov ebp, dword [ebp + 4]
test ebp, ebp
je 0x4572f1
jmp 0x45725b
push esi
push 0x4bfef0
call fcn.0042ba70
add esp, 8
push 1
call dword [sym.imp.MSVCRT.dll_exit]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x400
ret
Function at 0x458450
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [0x4dbad8]
test eax, eax
je 0x45846d
push 0x4c0064
push 0x4c0060
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 8
mov ecx, dword [esp + 0x10]
push ebx
push ebp
push esi
test ecx, ecx
push edi
jle 0x458484
mov edi, dword [esp + 0x1c]
mov eax, 0x1fffff
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x18]
push 0x4bba04
push eax
call fcn.00454e60
mov esi, eax
push 2
push 0
push esi
call dword [sym.imp.MSVCRT.dll_fseek]
push esi
call dword [sym.imp.MSVCRT.dll_ftell]
push esi
mov ebp, eax
call dword [sym.imp.MSVCRT.dll_rewind]
push esi
push 1
lea ecx, [esp + 0x34]
push 4
push ecx
call dword [sym.imp.MSVCRT.dll_fread]
mov edx, dword [esp + 0x3c]
lea eax, [esp + 0x3c]
push eax
lea edi, [edx*4 + 4]
sub edi, ebp
call fcn.0042bc30
mov ecx, dword [esp + 0x40]
lea edx, [esp + 0x40]
push edx
lea ebx, [ecx*4 + 4]
sub ebx, ebp
call fcn.0042bc30
add esp, 0x34
test edi, edi
jge 0x4584f7
neg edi
test ebx, ebx
jge 0x4584fd
neg ebx
cmp ebx, edi
setl bl
test bl, bl
je 0x458513
lea eax, [esp + 0x10]
push eax
call fcn.0042bc30
add esp, 4
mov ecx, dword [esp + 0x10]
mov ebp, dword [esp + 0x1c]
push esi
push ecx
push 4
push ebp
call dword [sym.imp.MSVCRT.dll_fread]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
test bl, bl
je 0x458555
mov eax, dword [esp + 0x10]
xor edi, edi
test eax, eax
jle 0x458555
mov esi, ebp
push esi
call fcn.0042bc30
mov eax, dword [esp + 0x14]
add esp, 4
inc edi
add esi, 4
cmp edi, eax
jl 0x458540
mov ecx, dword [esp + 0x20]
test ecx, ecx
jle 0x458565
mov eax, ebp
add eax, 4
dec ecx
jne 0x45855f
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x45dca0
Capabilities:
Terminate process

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
push edi
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
xor ebx, ebx
xor edx, edx
repne scasb al, byte es:[edi]
mov esi, dword [esp + 0x20]
mov dword [esp + 0x10], edx
not ecx
dec ecx
mov dword [esp + 0x14], 1
dec ecx
mov dword [esp + 0x18], ebx
je 0x45ddee
mov eax, dword [esp + 0x14]
test eax, eax
je 0x45dd1c
movsx eax, byte [ebx + ebp]
push 0
push eax
push edx
push esi
call fcn.00457e90
mov edi, eax
mov eax, dword [0x4dbad8]
add esp, 0x10
test eax, eax
je 0x45dd08
push edi
push 0x4c1900
call fcn.0042ba70
add esp, 8
cmp edi, 0x1fffff
jne 0x45de60
mov dword [esp + 0x14], 0
mov edi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push edi
push ecx
push 2
push esi
call fcn.0045e000
mov edx, dword [esp + 0x20]
mov dword [esp + 0x34], eax
push edx
push esi
call fcn.00457f00
mov ecx, eax
mov eax, dword [esp + 0x28]
add ecx, eax
mov eax, dword [esp + 0x3c]
add esp, 0x18
cmp ecx, eax
jne 0x45dd70
push eax
push 0x4c18e8
call fcn.0042ba70
mov edx, dword [esp + 0x30]
push edi
push edx
push 2
push esi
call fcn.0045e000
add esp, 0x18
mov dword [esp + 0x24], eax
mov eax, dword [0x4dbadc]
test eax, eax
jne 0x45dd8a
movsx eax, byte [ebx + ebp]
push eax
call dword [sym.imp.MSVCRT.dll_tolower]
add esp, 4
mov byte [ebx + ebp], al
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x18]
mov al, byte [ebx + ebp]
push edi
push ecx
push edx
lea ecx, [esp + 0x30]
push eax
lea edx, [esp + 0x20]
push ecx
push edx
push esi
call fcn.0045dbd0
mov eax, dword [0x4dbad8]
add esp, 0x1c
test eax, eax
mov dword [esp + 0x18], 0
je 0x45ddcf
mov eax, dword [esp + 0x24]
push eax
push 0x4c18d4
call fcn.0042ba70
add esp, 8
mov edx, dword [esp + 0x24]
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
inc ebx
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xfffffffe
mov dword [esp + 0x10], edx
cmp ebx, ecx
jb 0x45dcd6
mov eax, dword [0x4dbadc]
mov dword [esp + 0x24], 0
test eax, eax
jne 0x45de10
movsx ecx, byte [ebx + ebp]
push ecx
call dword [sym.imp.MSVCRT.dll_tolower]
add esp, 4
mov byte [ebx + ebp], al
mov edi, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov al, byte [ebx + ebp]
push edi
push edx
push 1
lea ecx, [esp + 0x30]
push eax
lea edx, [esp + 0x20]
push ecx
push edx
push esi
call fcn.0045dbd0
push 0
push esi
call fcn.00457f00
add esp, 0x24
cmp eax, edi
jle 0x45deb7
push 0
push esi
call fcn.00457f00
add esp, 8
push eax
push 0x4c18a8
call fcn.0042ba70
add esp, 8
push 1
call dword [sym.imp.MSVCRT.dll_exit]
mov edi, dword [esi + edi*4]
and edi, 0x1fffff
jne 0x45deb0
mov eax, dword [0x4dbadc]
mov dword [esp + 0x18], 1
test eax, eax
mov dword [esp + 0x14], 0
jne 0x45de95
movsx ecx, byte [ebx + ebp]
push ecx
call dword [sym.imp.MSVCRT.dll_tolower]
add esp, 4
mov byte [ebx + ebp], al
mov dl, byte [ebx + ebp]
mov eax, dword [esp + 0x10]
push 1
push edx
push 0
push eax
push esi
call fcn.0045e260
add esp, 0x14
jmp 0x45dd1c
mov edx, edi
jmp 0x45ddd3
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x45e000
Capabilities:
Terminate process

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebx
mov ebx, dword [esp + 0x18]
push ebp
sub eax, ebx
push esi
push edi
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x10], 0
lea ebp, [eax - 0x28]
push ebp
call fcn.00454e20
add esp, 4
add eax, ebx
xor esi, esi
xor ecx, ecx
test edi, edi
jle 0x45e08c
mov edx, dword [esp + 0x18]
lea edx, [edx + eax*4]
test esi, esi
jne 0x45e055
cmp dword [edx], 0x1fffff
je 0x45e049
mov esi, 1
inc ecx
add edx, 4
cmp ecx, edi
jl 0x45e038
test esi, esi
je 0x45e08c
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0x64
mov dword [esp + 0x10], eax
jl 0x45e01e
mov eax, dword [0x4dbcdc]
mov ecx, dword [0x4dbce4]
mov edx, dword [0x4dbce0]
push eax
push ecx
push edx
push 0x4c1948
call fcn.0042ba70
add esp, 0x10
push 1
call dword [sym.imp.MSVCRT.dll_exit]
mov ecx, dword [0x4dbce0]
pop edi
inc ecx
pop esi
pop ebp
mov dword [0x4dbce0], ecx
pop ebx
pop ecx
ret

Function at 0x45e2a0
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
push edi
push ebx
call fcn.004582c0
push edi
push ebx
mov dword [esp + 0x28], eax
call fcn.00457f00
lea ecx, [eax + edi]
add esp, 0x10
cmp edi, ecx
mov dword [esp + 0x10], eax
mov esi, edi
jge 0x45e34b
lea eax, [ebx + edi*4]
mov dword [esp + 0x1c], eax
mov edx, dword [esp + 0x1c]
mov eax, dword [edx]
movsx edx, byte [esp + 0x28]
mov ebp, eax
shr ebp, 0x18
cmp ebp, edx
jne 0x45e33b
mov edx, dword [esp + 0x24]
test edx, edx
jne 0x45e302
test eax, 0x400000
je 0x45e33b
cmp eax, 0x1fffff
jne 0x45e310
jmp 0x45e33b
test eax, 0x400000
jne 0x45e33b
cmp eax, 0x1fffff
je 0x45e33b
mov ebp, dword [esp + 0x20]
mov edx, eax
and edx, 0x1fffff
cmp edx, ebp
jne 0x45e33b
mov edx, dword [esp + 0x2c]
test edx, edx
je 0x45e32f
and eax, 0x800000
jmp 0x45e337
not eax
shr eax, 0x17
and eax, 1
test eax, eax
jne 0x45e36c
mov edx, dword [esp + 0x1c]
inc esi
add edx, 4
cmp esi, ecx
mov dword [esp + 0x1c], edx
jl 0x45e2d6
mov edx, dword [esp + 0x20]
push edx
push 0x4c1a48
call fcn.0042ba70
push edi
push ebx
call fcn.004582f0
add esp, 0x10
push 1
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [0x4dbad8]
test eax, eax
je 0x45e38a
mov eax, dword [ebx + esi*4]
shr eax, 0x18
push eax
push esi
push 0x4c1a20
call fcn.0042ba70
add esp, 0xc
mov edx, dword [esp + 0x10]
mov dword [ebx + esi*4], 0x1fffff
mov ecx, edx
sub ecx, esi
lea ecx, [ecx + edi - 1]
test ecx, ecx
jle 0x45e3b6
lea eax, [ebx + esi*4 + 4]
mov ebp, dword [eax]
mov dword [eax - 4], ebp
mov dword [eax], 0x1fffff
add eax, 4
dec ecx
jne 0x45e3a5
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x45e3d3
mov edx, dword [esp + 0x18]
lea eax, [edx - 1]
test eax, eax
je 0x45e3f7
mov ecx, esi
sub ecx, edi
cmp eax, ecx
jne 0x45e3f7
jmp 0x45e3e7
mov ebp, dword [esp + 0x18]
mov eax, edx
sub eax, ebp
dec eax
je 0x45e3f7
mov ecx, esi
sub ecx, edi
dec edx
cmp edx, ecx
jne 0x45e3f7
mov ecx, dword [ebx + esi*4 - 4]
lea eax, [ebx + esi*4 - 4]
or ecx, 0x200000
mov dword [eax], ecx
mov eax, dword [0x4dbad8]
test eax, eax
je 0x45e40a
push edi
push ebx
call fcn.004582f0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x45e9f0
Capabilities:
Terminate process

Disassembly:
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 4]
sub esp, 8
push esi
push edi
mov edi, dword [esp + 0x18]
mov esi, ecx
mov byte [esi + 6], 0
mov byte [esi + 0x57], 0
mov dword [edi], 0xffffffff
mov byte [edx], 0
movsx ecx, byte [eax + 0xa]
dec ecx
je 0x45ea2e
sub ecx, 3
jne 0x45ea58
cmp byte [eax + 0xb], 3
jne 0x45ea58
push 0
call dword [sym.imp.MSVCRT.dll_exit]
fld dword [eax + 0xc]
fstp dword [esp + 8]
fld dword [eax + 0x10]
mov ecx, dword [esi + 0x104]
push edx
fstp dword [esp + 0x10]
mov edx, dword [esp + 0x10]
mov eax, dword [ecx]
push edi
push edx
mov edx, dword [esp + 0x14]
push edx
push esi
call dword [eax]
cmp dword [edi], 0xffffffff
jne 0x45ea5e
mov dword [edi], 0
mov ecx, esi
call fcn.0045eac0
pop edi
pop esi
add esp, 8
ret 0xc
Function at 0x462af0
Capabilities:
Read file on windows

Disassembly:
push esi
push edi
push 0
push 0x28
call fcn.00442a90
mov edi, dword [esp + 0x14]
mov esi, eax
push edi
push 1
push 0x28
push esi
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x18
cmp eax, 1
je 0x462b2b
push 0
push 2
push 0x4b9c30
push 0x4dbf58
call fcn.00441210
add esp, 0x10
push 0x4333a0
push edi
lea ecx, [esi + 4]
call fcn.00440340
push 0x43c020
push edi
lea ecx, [esi + 0x24]
call fcn.00440340
mov eax, esi
pop edi
pop esi
ret
Function at 0x462e60
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
push 0
mov edi, ecx
push 0x28
call fcn.00442a90
mov esi, eax
push 0x28
push edi
push esi
call dword [sym.imp.MSVCRT.dll_memmove]
add esp, 0x14
lea ecx, [esi + 4]
call fcn.00440210
lea ecx, [esi + 0x24]
call fcn.00440210
mov ebx, dword [esp + 0x10]
push ebx
push 1
push 0x28
push esi
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
cmp eax, 1
je 0x462ebb
push 0
push 2
push 0x4b9c04
push 0x4dbf54
call fcn.00441210
add esp, 0x10
push 0
push 0x28
push esi
call fcn.00442aa0
add esp, 0xc
lea ecx, [edi + 4]
push 0x433340
push ebx
call fcn.004402a0
push 0x43bf90
push ebx
lea ecx, [edi + 0x24]
call fcn.004402a0
pop edi
pop esi
pop ebx
ret 4
Function at 0x4693a4
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
push edi
push 0x2000
lea edi, [esi + 0x14]
mov dword [esi], eax
push edi
push eax
call dword [sym.imp.MSVCRT.dll__read]
add esp, 0xc
mov dword [esi + 0x10], eax
test eax, eax
jge 0x4693e2
push 0
push 0
push 0x4c28d4
push 0x4dc090
call fcn.00441210
add esp, 0x10
xor ax, ax
pop edi
pop esi
ret 4
xor eax, eax
mov dword [esi + 4], 2
mov ah, byte [esi + 0x15]
mov dword [esi + 0xc], 0x10
mov al, byte [edi]
pop edi
mov dword [esi + 8], eax
pop esi
ret 4

Function at 0x469400
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esp + 8]
push edi
mov edi, dword [esi + 0xc]
mov edx, dword [esi + 8]
and ecx, 0xff
sub edi, ecx
shr edx, cl
mov eax, edi
mov dword [esi + 0xc], edi
cmp eax, 0x10
mov dword [esi + 8], edx
jge 0x469472
mov edi, dword [sym.imp.MSVCRT.dll__read]
mov eax, dword [esi + 4]
mov ecx, dword [esi + 0xc]
xor edx, edx
mov dl, byte [eax + esi + 0x14]
shl edx, cl
add ecx, 8
mov dword [esi + 0xc], ecx
mov ecx, dword [esi + 0x10]
or dword [esi + 8], edx
inc eax
cmp eax, ecx
mov dword [esi + 4], eax
jl 0x46946c
mov ecx, dword [esi]
lea eax, [esi + 0x14]
push 0x2000
push eax
push ecx
call edi
add esp, 0xc
mov dword [esi + 0x10], eax
test eax, eax
jl 0x46947b
mov dword [esi + 4], 0
cmp dword [esi + 0xc], 0x10
jl 0x46942b
mov ax, word [esi + 8]
pop edi
pop esi
ret 4
push 0
push 0
push 0x4c28e8
push 0x4dc090
call fcn.00441210
add esp, 0x10
xor ax, ax
pop edi
pop esi
ret 4
Function at 0x469ce0
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x20]
test eax, eax
jl 0x469cf4
mov eax, dword [esi + 0x14]
test eax, eax
je 0x469d0a
push 0
push 2
push 0x4c2abc
push 0x4dc0cc
call fcn.00441210
add esp, 0x10
mov edi, dword [esp + 0x14]
test edi, edi
jle 0x469d1e
cmp edi, dword [esi + 0xc]
jg 0x469d1e
mov eax, dword [esi + 0x24]
test eax, eax
jne 0x469d21
mov edi, dword [esi + 0xc]
mov eax, dword [esi + 0x18]
mov dword [esi + 0x1c], edi
imul eax, edi
push eax
call fcn.00442a90
add esp, 4
mov dword [esi + 0x14], eax
test eax, eax
jne 0x469d4b
push eax
push eax
push 0x4c2abc
push 0x4dc0fc
jmp 0x469e17
mov ecx, dword [esi + 0xc]
mov byte [esi + 4], 0
mov edx, ecx
mov dword [esi + 0x2c], ecx
sub edx, edi
mov edi, dword [esi + 0x24]
test edi, edi
mov dword [esi + 0x28], edx
je 0x469d87
mov dl, byte [esi + 3]
test dl, dl
jge 0x469d87
mov edx, dword [esi + 0x18]
push edx
mov dl, byte [esi]
push edx
mov edx, dword [esi + 0x20]
push ecx
mov ecx, dword [esi + 8]
push ecx
push eax
push edx
call edi
add esp, 0x18
test al, al
setl bl
jmp 0x469e05
mov cl, byte [esi + 3]
test cl, cl
jne 0x469db2
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0x20]
imul ecx, dword [esi + 0x1c]
push ecx
push eax
push edx
call dword [sym.imp.MSVCRT.dll__read]
mov ecx, dword [esi + 0x18]
add esp, 0xc
imul ecx, dword [esi + 0x1c]
cmp eax, ecx
setne bl
jmp 0x469e05
mov eax, dword [esi + 0x1c]
xor bl, bl
xor edi, edi
test eax, eax
jle 0x469e2f
mov ebp, dword [sym.imp.MSVCRT.dll__read]
test bl, bl
jne 0x469e09
mov eax, dword [esi + 0x18]
mov edx, dword [esi + 0x14]
push eax
imul eax, edi
add eax, edx
mov edx, dword [esi + 0x20]
push eax
push edx
call ebp
mov ebx, dword [esi + 0x18]
mov ecx, dword [esi + 0x20]
cmp eax, ebx
push 1
movsx eax, byte [esi + 3]
push eax
push ecx
setne bl
call dword [sym.imp.MSVCRT.dll__lseek]
add esp, 0x18
test eax, eax
mov eax, dword [esi + 0x1c]
setl dl
or bl, dl
inc edi
cmp edi, eax
jl 0x469dc3
test bl, bl
je 0x469e2f
push 0
push 0
push 0x4c2abc
push 0x4dc0e8
call fcn.00441210
add esp, 0x10
mov ecx, esi
call fcn.0046a420
pop edi
pop esi
pop ebp
or al, 0xff
pop ebx
ret 4
mov eax, dword [esi + 0x28]
test eax, eax
jg 0x469e4a
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.MSVCRT.dll__close]
add esp, 4
mov dword [esi + 0x20], 0xffffffff
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 4
Function at 0x469e60
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x28]
cdq
sub eax, edx
sar eax, 1
lea edx, [eax + edi]
cmp edx, ecx
jl 0x469ea0
sub eax, ecx
mov edx, dword [esi + 8]
push 1
lea ebp, [eax + edi + 1]
mov eax, dword [esi + 0x2c]
sub eax, ebp
push eax
push 0
push esi
push ebp
push edx
push ecx
push 0
push esi
call fcn.0046a5a0
add esp, 0x24
jmp 0x469ea2
xor ebp, ebp
mov ecx, dword [esi + 0x1c]
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, edi
mov edx, eax
mov dword [esi + 0x2c], eax
sub edx, ecx
mov dword [esi + 0x28], edx
jns 0x469ec1
mov dword [esi + 0x28], 0
sub eax, dword [esi + 0x28]
sub eax, ebp
mov edi, eax
mov al, byte [esi + 3]
test al, al
mov dword [esp + 0x14], edi
jne 0x469eff
mov eax, dword [esi + 0x18]
mov edx, dword [esi + 0x14]
mov ecx, eax
imul eax, ebp
imul ecx, edi
add eax, edx
mov edx, dword [esi + 0x20]
push ecx
push eax
push edx
call dword [sym.imp.MSVCRT.dll__read]
mov ecx, dword [esi + 0x18]
add esp, 0xc
imul ecx, edi
cmp eax, ecx
setne bl
jmp 0x469f55
mov eax, dword [esp + 0x14]
xor bl, bl
xor edi, edi
test eax, eax
jle 0x469f78
test bl, bl
jne 0x469f59
mov eax, dword [esi + 0x18]
lea edx, [edi + ebp]
imul edx, eax
mov ecx, dword [esi + 0x14]
push eax
mov eax, dword [esi + 0x20]
add edx, ecx
push edx
push eax
call dword [sym.imp.MSVCRT.dll__read]
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0x20]
cmp eax, ecx
push 1
movsx ecx, byte [esi + 3]
push ecx
push edx
setne bl
call dword [sym.imp.MSVCRT.dll__lseek]
add esp, 0x18
test eax, eax
setl al
or bl, al
mov eax, dword [esp + 0x14]
inc edi
cmp edi, eax
jl 0x469f0b
test bl, bl
je 0x469f78
push 0
push 0
push 0x4c2ac8
push 0x4dc0e8
call fcn.00441210
add esp, 0x10
or al, 0xff
pop edi
pop esi
pop ebp
pop ebx
ret 4
mov eax, dword [esi + 0x28]
test eax, eax
jg 0x469f93
mov ecx, dword [esi + 0x20]
push ecx
call dword [sym.imp.MSVCRT.dll__close]
add esp, 4
mov dword [esi + 0x20], 0xffffffff
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 4
Function at 0x46b210
Capabilities:
Access peb ldr_data
Encode data using xor
Encrypt data using rc4 prga
Get ntdll base address
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x4a5db8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
xor edx, edx
push esi
push edi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], edx
mov byte [esp + 0x14], 8
mov edi, dword [esp + 0x30]
mov bl, 1
mov dword [esp + 0x28], edx
mov al, byte [edi]
mov esi, dword [edi + 0xc]
cmp al, 0x18
mov ebp, dword [edi + 8]
setne cl
dec ecx
and ecx, 2
inc ecx
mov byte [esp + 0x30], cl
movsx ecx, al
shl bl, cl
dec bl
dec esi
test esi, esi
jl 0x46b2b8
mov eax, dword [esp + 0x30]
and eax, 0xff
imul eax, ebp
mov dword [esp + 0x30], eax
lea edx, [esp + 0x10]
mov ecx, edi
push edx
push ebp
push esi
push 0
call fcn.0046b2e0
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x10]
test ecx, ecx
jle 0x46b2a1
mov dl, byte [eax]
xor dl, bl
mov byte [eax], dl
inc eax
dec ecx
jne 0x46b297
lea eax, [esp + 0x10]
mov ecx, edi
push eax
push ebp
push esi
push 0
call fcn.0046b810
dec esi
jns 0x46b27b
mov edx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
mov dword [esp + 0x1c], 0xffffffff
test edx, edx
pop ebx
je 0x46b2d1
push edx
call fcn.00442aa0
add esp, 4
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret