joyce8/EMBER2024-capa huggingface dataset:
Function at 0x477c70
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x64b058
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov ecx, dword [0x826818]
push ebx
push esi
push edi
mov edi, dword [esp + 0x24]
push edi
call fcn.004474d0
lea ecx, [esp + 0x24]
mov esi, eax
call fcn.00643d62
movsx eax, si
push eax
mov dword [esp + 0x20], 0
call fcn.00476a10
mov ecx, dword [0x73aaac]
add esp, 4
lea edx, [esp + 0x24]
push eax
push ecx
push 0x6a1544
push edx
call fcn.00643d50
mov eax, dword [esp + 0x34]
push 0x69a9d0
push eax
call dword [fcn.0065f1b8]
mov esi, eax
add esp, 0x18
test esi, esi
je 0x477d89
movsx eax, word [edi + 0xa]
mov edi, dword [fcn.0065f1d4]
push ebp
lea ecx, [eax + eax*4]
push 0
push ecx
push esi
call edi
mov ebp, dword [fcn.0065f1bc]
push esi
push 5
lea edx, [esp + 0x24]
push 1
push edx
call ebp
mov al, byte [esp + 0x2c]
mov ebx, dword [esp + 0x48]
add esp, 0x1c
cmp al, 1
jne 0x477d3b
mov eax, dword [esp + 0x11]
push 0
push eax
push esi
call edi
push esi
push 0xb40
push 1
push ebx
call ebp
add esp, 0x1c
push esi
call dword [fcn.0065f1c0]
mov al, byte [esp + 0x14]
add esp, 4
cmp al, 1
pop ebp
jne 0x477d89
xor esi, esi
mov eax, ebx
cmp word [eax], 0
je 0x477d64
inc esi
add eax, 0x10
cmp esi, 0xb4
jl 0x477d52
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00643d26
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00643d26
mov ecx, dword [esp + 0x14]
pop edi
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x477db0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x104
test eax, eax
push ebx
push ebp
push esi
push edi
je 0x477f17
movsx cx, byte [eax + 0xec]
push ecx
mov ecx, dword [0x826818]
push eax
call fcn.00446d60
movsx esi, ax
test esi, esi
jl 0x477f17
mov eax, dword [esp + 0x120]
test eax, eax
je 0x477ef5
mov bp, word [esp + 0x124]
cmp bp, 1
jl 0x477ef5
mov ecx, dword [esp + 0x11c]
xor ebx, ebx
mov eax, 0x6cf8fc
cmp dword [eax - 4], esi
jne 0x477e1e
cmp dword [eax], ecx
je 0x477e37
add eax, 0x10
inc ebx
cmp eax, 0x6d377c
jl 0x477e15
pop edi
pop esi
pop ebp
xor ax, ax
pop ebx
add esp, 0x104
ret
cmp ebx, 0x3e8
jl 0x477e4d
pop edi
pop esi
pop ebp
xor ax, ax
pop ebx
add esp, 0x104
ret
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
rep stosd dword es:[edi], eax
mov edx, dword [0x73aaac]
stosw word es:[edi], ax
stosb byte es:[edi], al
push edx
lea eax, [esp + 0x14]
push 0x6a155c
push eax
call dword [fcn.0065f1cc]
push 0x40
lea ecx, [esp + 0x20]
push 0x6a1558
push ecx
call dword [fcn.0065f1e8]
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x477ea2
pop edi
pop esi
pop ebp
xor ax, ax
pop ebx
add esp, 0x104
ret
shl ebx, 4
movsx eax, bp
mov edi, dword [ebx + 0x6cf900]
cmp eax, edi
jge 0x477eb4
mov edi, eax
mov edx, dword [ebx + 0x6cf904]
push 0
push edx
push esi
call dword [fcn.0065f1d4]
mov eax, dword [esp + 0x12c]
push esi
push edi
push 0x10
push eax
call dword [fcn.0065f1bc]
push esi
call dword [fcn.0065f22c]
push esi
call dword [fcn.0065f1c0]
add esp, 0x24
mov ax, di
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
mov edx, dword [esp + 0x11c]
xor ecx, ecx
mov eax, 0x6cf8fc
cmp dword [eax - 4], esi
jne 0x477f0c
cmp dword [eax], edx
je 0x477f26
add eax, 0x10
inc ecx
cmp eax, 0x6d377c
jl 0x477f03
pop edi
pop esi
pop ebp
or ax, 0xffff
pop ebx
add esp, 0x104
ret
shl ecx, 4
pop edi
pop esi
mov ax, word [ecx + 0x6cf900]
pop ebp
pop ebx
add esp, 0x104
ret
Function at 0x47dea0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x64b408
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, dword [esp + 0x20]
test esi, esi
je 0x47dff3
cmp byte [esi + 0x29], 7
jne 0x47dff3
push 0x69db1c
lea eax, [esp + 0xc]
push 0x73aaac
push eax
call fcn.00643ea6
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0
call fcn.00643d62
lea ecx, [esp + 0x20]
mov byte [esp + 0x14], 1
call fcn.00643d62
movsx ecx, byte [esi + 0xec]
push esi
push ecx
lea edx, [esp + 0xc]
push 0x69db14
push edx
mov byte [esp + 0x24], 2
call fcn.00643d50
mov ecx, dword [esp + 0x34]
add esp, 0x10
test ecx, ecx
mov eax, 0x2710
je 0x47df34
mov eax, 0x3e8
mov ecx, dword [esp + 8]
push ebp
mov ebp, dword [esp + 8]
push edi
push ecx
push eax
push eax
lea ecx, [esp + 0x34]
lea edi, [esi + 0x18]
call fcn.00644434
push eax
push edi
push ebp
push 0x6a195c
call dword [fcn.0065e164]
push 0xffffffffffffffff
lea ecx, [esp + 0x2c]
call fcn.0064456c
push 0x69b108
push 0x6a1960
lea ecx, [esp + 0x30]
call fcn.00644602
mov eax, dword [esp + 0x30]
test eax, eax
je 0x47dfa1
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
push edx
push 0x6a1970
push esi
push edi
push 0x6a1964
push eax
call fcn.00643d50
add esp, 0x18
jmp 0x47dfaf
lea ecx, [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x28]
call fcn.00644098
lea ecx, [esp + 0x28]
mov byte [esp + 0x1c], 1
call fcn.00643d26
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 0
call fcn.00643d26
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00643d26
pop edi
pop ebp
mov eax, 1
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov ecx, dword [esp + 0xc]
xor eax, eax
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x47eef0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x64b538
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov eax, dword [esp + 0x20]
mov dword [esp + 0x14], 0
mov ecx, dword [eax - 8]
test ecx, ecx
jle 0x47f152
mov esi, dword [fcn.0065f1a8]
push 0x12
push 0x6a1b9c
push eax
call esi
add esp, 0xc
test eax, eax
jne 0x47ef97
lea eax, [esp + 0x20]
lea ecx, [esp + 0x1c]
push eax
call fcn.00643edc
lea ecx, [esp + 4]
push 0x12
push ecx
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], 1
call fcn.006440c8
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x18], 2
call fcn.00644098
lea ecx, [esp + 4]
mov byte [esp + 0x14], 1
call fcn.00643d26
mov edx, dword [esp + 0x1c]
push edx
call fcn.0058e310
add esp, 4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x14], 0
call fcn.00643d26
jmp 0x47f152
mov eax, dword [esp + 0x20]
push 0xe
push 0x6a1b8c
push eax
call esi
add esp, 0xc
test eax, eax
jne 0x47f00c
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x28]
call fcn.00643edc
lea edx, [esp + 8]
push 0xe
push edx
lea ecx, [esp + 0x2c]
mov byte [esp + 0x1c], 3
call fcn.006440c8
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x18], 4
call fcn.00644098
lea ecx, [esp + 8]
mov byte [esp + 0x14], 3
call fcn.00643d26
mov eax, dword [esp + 0x24]
push eax
call fcn.0058e310
add esp, 4
lea ecx, [esp + 0x24]
mov byte [esp + 0x14], 0
call fcn.00643d26
jmp 0x47f152
mov ecx, dword [esp + 0x20]
push 0x18
push 0x6a1b70
push ecx
call esi
add esp, 0xc
test eax, eax
jne 0x47f03d
mov eax, dword [0x8975d0]
test eax, eax
je 0x47f152
mov edx, dword [esp + 0x20]
push edx
call eax
add esp, 4
jmp 0x47f152
mov eax, dword [0x6e6928]
test eax, eax
je 0x47f07c
push 0x6a1b64
lea ecx, [esp + 0x24]
call fcn.006445e4
test eax, eax
jle 0x47f07c
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x47f152
mov eax, dword [eax + 0x20]
push 0
push 1
push 0x887
push eax
call dword [fcn.0065f4a0]
jmp 0x47f152
mov ecx, dword [esp + 0x20]
mov esi, dword [fcn.0065f1a4]
push 0x6a1b5c
push ecx
call esi
add esp, 8
test eax, eax
jne 0x47f09d
push eax
push 0x8103
jmp 0x47f0b6
mov ecx, dword [esp + 0x20]
push 0x6a1b50
push ecx
call esi
add esp, 8
test eax, eax
jne 0x47f0d0
push eax
push 0x8104
mov edx, dword [0x826938]
push 0x111
mov eax, dword [edx + 0x20]
push eax
call dword [fcn.0065f4a0]
jmp 0x47f152
mov eax, dword [0x73aa38]
test eax, eax
je 0x47f100
call fcn.00479e50
xor ecx, ecx
test eax, eax
jl 0x47f0f2
mov ecx, dword [0x826818]
push eax
call fcn.004466b0
mov ecx, eax
push ecx
lea ecx, [esp + 0x24]
push ecx
call fcn.0047eaa0
add esp, 8
mov eax, dword [esp + 0x24]
test eax, eax
je 0x47f134
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x47f134
lea edx, [esp + 0x20]
mov ecx, 0x73a868
push edx
call fcn.00644098
mov eax, dword [esi + 0x20]
push 0xffffffffffffffff
push 5
push 0x1900
push eax
call dword [fcn.0065f498]
jmp 0x47f152
call fcn.00471750
test eax, eax
jne 0x47f152
mov ecx, dword [esp + 0x20]
push 5
push eax
push eax
push ecx
push 0x69af6c
push eax
call dword [fcn.0065f2cc]
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], 0xffffffff
call fcn.00643d26
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x47f430
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x64b591
push eax
mov eax, 0x1054
mov dword fs:[0], esp
call fcn.00645130
mov eax, dword [0x828ad0]
push ebx
push ebp
push esi
xor esi, esi
push edi
cmp eax, esi
jne 0x47f68f
mov eax, dword [0x828ad8]
cmp eax, esi
je 0x47f47a
push eax
call fcn.00643cfc
add esp, 4
mov dword [0x828ad8], esi
push 0x6a1bdc
lea eax, [esp + 0x14]
push 0x73aaac
push eax
mov dword [0x828adc], esi
mov dword [0x828ad4], esi
call fcn.00643ea6
mov ecx, dword [esp + 0x10]
push 0x40
push 0x69a9d0
push ecx
mov dword [esp + 0x1078], esi
call dword [fcn.0065f1e8]
add esp, 0xc
lea ecx, [esp + 0x1c]
mov ebp, eax
push 0x14
push 0x6a1bc4
call fcn.00410bc0
cmp ebp, esi
mov byte [esp + 0x106c], 1
je 0x47f612
push ebp
call fcn.00476080
mov ebx, eax
mov eax, 0x5254e78f
mul ebx
mov esi, edx
shr esi, 6
mov eax, esi
shl eax, 5
add eax, esi
lea edx, [eax + eax*2]
lea eax, [esi + edx*2]
push eax
mov dword [esp + 0x1c], eax
call fcn.00643b70
mov edi, eax
add esp, 8
test edi, edi
mov dword [0x828ad8], edi
mov dword [0x828adc], esi
jne 0x47f524
push ebp
call dword [fcn.0065f1c0]
jmp 0x47f60f
mov ecx, dword [esp + 0x14]
xor eax, eax
mov edx, ecx
push ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push esi
and ecx, 3
push 0xc7
rep stosb byte es:[edi], al
mov eax, dword [0x828ad8]
push eax
call dword [fcn.0065f1bc]
mov eax, ebx
mov ecx, dword [0x828ad8]
cdq
and edx, 7
add esp, 0x10
add eax, edx
sar eax, 3
shl eax, 3
push eax
push ecx
lea ecx, [esp + 0x24]
call fcn.00410d50
mov ebx, dword [fcn.0065f1c0]
push ebp
call ebx
add esp, 4
lea edx, [esp + 0x14]
push 0x6a1bb0
push 0x73aaac
push edx
call fcn.00643ea6
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x1070], 2
call fcn.00644098
lea ecx, [esp + 0x14]
mov byte [esp + 0x106c], 1
call fcn.00643d26
mov eax, dword [esp + 0x10]
push 0x40
push 0x69a9d0
push eax
call dword [fcn.0065f1e8]
mov esi, eax
add esp, 0xc
test esi, esi
je 0x47f612
push esi
call fcn.00476080
mov ecx, eax
mov eax, 0x76b981db
mul ecx
mov ebp, edx
mov dword [esp + 0x1c], ecx
shr ebp, 6
mov dword [0x828ad4], ebp
lea eax, [ebp + ebp*2]
shl eax, 3
sub eax, ebp
lea edi, [eax + eax*2]
shl edi, 1
push edi
call fcn.00643b70
mov edx, eax
add esp, 8
test edx, edx
mov dword [0x828ad0], edx
jne 0x47f62a
push esi
call ebx
add esp, 4
lea ecx, [esp + 0x10]
mov dword [esp + 0x106c], 0xffffffff
call fcn.00643d26
xor eax, eax
jmp 0x47f694
mov ecx, edi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push esi
and ecx, 3
push ebp
rep stosb byte es:[edi], al
mov eax, dword [0x828ad0]
push 0x8a
push eax
call dword [fcn.0065f1bc]
mov eax, dword [esp + 0x28]
mov ecx, dword [0x828ad0]
cdq
and edx, 7
add esp, 0x10
add eax, edx
sar eax, 3
shl eax, 3
push eax
push ecx
lea ecx, [esp + 0x24]
call fcn.00410d50
push esi
call ebx
add esp, 4
lea ecx, [esp + 0x10]
mov dword [esp + 0x106c], 0xffffffff
call fcn.00643d26
mov eax, 1
mov ecx, dword [esp + 0x1064]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1060
ret
Function at 0x480620
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x64b610
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
lea ecx, [esp + 0x14]
xor edi, edi
call fcn.00643d62
lea ecx, [esp + 0x10]
mov dword [esp + 0x40], edi
call fcn.00643d62
lea ecx, [esp + 0xc]
mov byte [esp + 0x40], 1
call fcn.00643d62
mov eax, dword [esp + 0x48]
lea ecx, [esp + 0x48]
mov ebx, 2
push eax
push ecx
mov byte [esp + 0x48], bl
call fcn.00482420
add esp, 8
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x44], 3
call fcn.00644098
lea ecx, [esp + 0x48]
mov byte [esp + 0x40], bl
call fcn.00643d26
push 0x69ac30
lea ecx, [esp + 0x24]
call fcn.00643d2c
mov esi, eax
push 0x69ac38
lea ecx, [esp + 0x20]
mov byte [esp + 0x44], 4
call fcn.00643d2c
lea edx, [esp + 0x14]
mov byte [esp + 0x40], 5
push edx
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00644050
push esi
lea ecx, [esp + 0x4c]
push eax
push ecx
mov byte [esp + 0x4c], 6
call fcn.00644050
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x44], 7
call fcn.00644098
lea ecx, [esp + 0x48]
mov byte [esp + 0x40], 6
call fcn.00643d26
lea ecx, [esp + 0x18]
mov byte [esp + 0x40], 5
call fcn.00643d26
lea ecx, [esp + 0x1c]
mov byte [esp + 0x40], 4
call fcn.00643d26
lea ecx, [esp + 0x20]
mov byte [esp + 0x40], bl
call fcn.00643d26
lea ecx, [esp + 0x24]
call fcn.00644056
lea edx, [esp + 0x10]
lea eax, [esp + 0x48]
push edx
push 0x73aaac
mov byte [esp + 0x48], 8
push eax
call fcn.00644050
mov eax, dword [eax]
push edi
push 0x40
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x4c], 9
call fcn.0064404a
lea ecx, [esp + 0x48]
mov esi, eax
mov byte [esp + 0x40], 8
call fcn.00643d26
test esi, esi
je 0x4807d2
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x28]
call fcn.006440a4
test eax, eax
je 0x4807c9
mov esi, dword [esp + 0x4c]
lea edx, [esp + 0xc]
push edx
call fcn.00471eb0
mov eax, dword [esp + 0x10]
add esp, 4
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x4807b7
mov ecx, dword [0x826818]
push eax
call fcn.00446b00
cmp ax, 0xffff
mov word [esi], ax
je 0x4807b7
inc edi
add esi, ebx
lea eax, [esp + 0xc]
lea ecx, [esp + 0x24]
push eax
call fcn.006440a4
test eax, eax
jne 0x480787
lea ecx, [esp + 0x24]
call fcn.00644032
lea ecx, [esp + 0x24]
mov byte [esp + 0x40], bl
call fcn.0064402c
lea ecx, [esp + 0xc]
mov byte [esp + 0x40], 1
call fcn.00643d26
lea ecx, [esp + 0x10]
mov byte [esp + 0x40], 0
call fcn.00643d26
lea ecx, [esp + 0x14]
mov dword [esp + 0x40], 0xffffffff
call fcn.00643d26
mov ecx, dword [esp + 0x38]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret
Function at 0x481ab0
Capabilities:
Check http status code

Disassembly:
push esi
mov esi, dword [esp + 0xc]
cmp esi, 0x32
jl 0x481add
cmp esi, 0x64
jge 0x481add
mov eax, dword [esp + 0x10]
mov ecx, dword [0x826818]
push 0x1770
add esi, 0xffffffce
push eax
push esi
call fcn.0044bd30
movsx eax, ax
pop esi
ret
push esi
call fcn.004825e0
add esp, 4
test eax, eax
jne 0x481b19
mov cx, word [esi*2 + 0x6a71a4]
mov edx, dword [esp + 0x10]
mov eax, dword [esi*4 + 0x6a7168]
mov word [esp + 0xc], cx
mov ecx, dword [esp + 0xc]
push edx
push ecx
mov ecx, dword [0x826818]
push eax
call fcn.00446f60
movsx eax, ax
pop esi
ret
cmp esi, 0x13
jne 0x481b2d
mov edx, dword [esp + 0x10]
push edx
call fcn.004812b0
add esp, 4
pop esi
ret
cmp esi, 0x15
jne 0x481b43
mov eax, dword [esp + 0x10]
push eax
push 0xffffffffffffffff
call fcn.00481390
add esp, 8
pop esi
ret
cmp esi, 0x16
jne 0x481b59
mov ecx, dword [esp + 0x10]
push ecx
mov ecx, 0x8998c0
call fcn.0054baf0
pop esi
ret
cmp esi, 0x17
jne 0x481b6f
mov edx, dword [esp + 0x10]
mov ecx, 0x8a3288
push edx
call fcn.0062bbb0
pop esi
ret
cmp esi, 0x18
jne 0x481b78
xor eax, eax
pop esi
ret
cmp esi, 0x19
jne 0x481b81
xor eax, eax
pop esi
ret
cmp esi, 0x1a
jne 0x481b8a
xor eax, eax
pop esi
ret
cmp esi, 0x14
jne 0x481b9e
mov eax, dword [esp + 0x10]
push eax
call fcn.004817e0
add esp, 4
pop esi
ret
cmp esi, 0x11
jne 0x481bb2
mov ecx, dword [esp + 0x10]
push ecx
call fcn.004811e0
add esp, 4
pop esi
ret
cmp esi, 0x12
jne 0x481bc6
mov edx, dword [esp + 0x10]
push edx
call fcn.00481240
add esp, 4
pop esi
ret
cmp esi, 0xf
jne 0x481bdc
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00480620
add esp, 8
pop esi
ret
cmp esi, 0x10
jne 0x481bf2
mov ecx, dword [esp + 0x10]
push ecx
push 1
call fcn.00480620
add esp, 8
pop esi
ret
mov eax, dword [esp + 8]
cmp eax, 0x190
jge 0x481c10
mov edx, dword [esp + 0x10]
add eax, 2
push edx
push eax
call fcn.00480620
add esp, 8
pop esi
ret
cmp eax, 0x7d0
jl 0x481c43
add eax, 0xfffff830
cmp eax, 0xa
jge 0x481c32
mov eax, dword [esp + 0x10]
mov ecx, 0x8998c0
push eax
call fcn.0054baf0
pop esi
ret
mov ecx, dword [esp + 0x10]
push ecx
mov ecx, 0x899dd8
call fcn.00578450
pop esi
ret
cmp eax, 0x3e8
jl 0x481c5f
mov edx, dword [esp + 0x10]
add eax, 0xfffffc18
push edx
push eax
call fcn.004808c0
add esp, 8
pop esi
ret
cmp eax, 0x320
jl 0x481c7b
mov ecx, dword [esp + 0x10]
add eax, 0xfffffce0
push ecx
push eax
call fcn.004810a0
add esp, 8
pop esi
ret
cmp eax, 0x2bc
jl 0x481c97
mov edx, dword [esp + 0x10]
add eax, 0xfffffd44
push edx
push eax
call fcn.00481150
add esp, 8
pop esi
ret
cmp eax, 0x258
jl 0x481cb3
mov ecx, dword [esp + 0x10]
add eax, 0xfffffda8
push ecx
push eax
call fcn.00480e30
add esp, 8
pop esi
ret
cmp eax, 0x1f4
jl 0x481cd1
mov edx, dword [esp + 0x10]
add eax, 0xfffffe0c
push edx
push eax
push 1
call fcn.00480820
add esp, 0xc
pop esi
ret
mov ecx, dword [esp + 0x10]
add eax, 0xfffffe70
push ecx
push eax
push 0
call fcn.00480820
add esp, 0xc
pop esi
ret
Function at 0x4841d0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x64b9c8
push eax
mov dword fs:[0], esp
sub esp, 0x28
push esi
mov esi, dword [esp + 0x3c]
cmp esi, 0xfffffffd
push edi
jg 0x484206
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret
lea ecx, [esp + 0x1c]
call fcn.00644056
add esi, 2
lea eax, [esp + 0xc]
push esi
push eax
mov dword [esp + 0x40], 0
call fcn.00482420
add esp, 8
lea ecx, [esp + 0x40]
mov byte [esp + 0x38], 1
call fcn.00643d62
push 0x69ac38
lea ecx, [esp + 0x18]
mov byte [esp + 0x3c], 2
call fcn.00643d2c
lea ecx, [esp + 0xc]
lea edx, [esp + 0x10]
push ecx
push eax
push edx
mov byte [esp + 0x44], 3
call fcn.00644050
push 0x69ac30
push eax
lea eax, [esp + 0x10]
mov byte [esp + 0x40], 4
push eax
call fcn.00643ea6
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], 7
call fcn.00643d26
lea ecx, [esp + 0x14]
mov byte [esp + 0x38], 6
call fcn.00643d26
lea ecx, [esp + 8]
lea edx, [esp + 0x18]
push ecx
push 0x73aaac
push edx
xor edi, edi
call fcn.00644050
mov eax, dword [eax]
push edi
push 0x40
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x44], 8
call fcn.0064404a
lea ecx, [esp + 0x18]
mov esi, eax
mov byte [esp + 0x38], 6
call fcn.00643d26
test esi, esi
je 0x484388
lea eax, [esp + 0x40]
lea ecx, [esp + 0x1c]
push eax
call fcn.006440a4
test eax, eax
je 0x484314
lea ecx, [esp + 0x40]
push ecx
call fcn.00471eb0
mov edx, dword [esp + 0x44]
add esp, 4
mov eax, dword [edx - 8]
test eax, eax
jne 0x48430f
lea eax, [esp + 0x40]
lea ecx, [esp + 0x1c]
push eax
call fcn.006440a4
test eax, eax
jne 0x4842e3
jmp 0x484314
mov edi, 1
lea ecx, [esp + 0x1c]
call fcn.00644032
test edi, edi
je 0x484388
push 0
push 0
push 0x31
push 0x6a1e08
push 0
call fcn.00471ac0
add esp, 0x14
cmp eax, 2
jne 0x484388
lea ecx, [esp + 8]
mov byte [esp + 0x38], al
call fcn.00643d26
lea ecx, [esp + 0x40]
mov byte [esp + 0x38], 1
call fcn.00643d26
lea ecx, [esp + 0xc]
mov byte [esp + 0x38], 0
call fcn.00643d26
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.0064402c
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret
lea ecx, [esp + 8]
mov byte [esp + 0x38], 2
call fcn.00643d26
lea ecx, [esp + 0x40]
mov byte [esp + 0x38], 1
call fcn.00643d26
lea ecx, [esp + 0xc]
mov byte [esp + 0x38], 0
call fcn.00643d26
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.0064402c
mov ecx, dword [esp + 0x30]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x34
ret
Function at 0x489c50
Capabilities:
Delete file
Read file on windows

Disassembly:
sub esp, 0x24
mov al, byte [0x6c7010]
xor ecx, ecx
push ebx
push esi
mov dword [esp + 0xd], ecx
mov byte [esp + 0xc], al
push 0x69db7c
lea edx, [esp + 0xc]
mov dword [esp + 0x15], ecx
or eax, 0xffffffff
xor ebx, ebx
push 0x73aaac
push edx
mov word [esp + 0x21], cx
mov dword [esp + 0x23], eax
mov dword [esp + 0x27], eax
mov dword [esp + 0x2b], ebx
mov dword [esp + 0x2f], ebx
mov dword [esp + 0x33], ebx
call fcn.00643ea6
mov eax, dword [eax]
push 0x40
push 0x69a9d0
push eax
call dword [fcn.0065f1e8]
add esp, 0xc
lea ecx, [esp + 8]
mov esi, eax
call fcn.00643d26
cmp esi, ebx
je 0x489cda
push esi
push 1
lea eax, [esp + 0x14]
push 0x1f
push eax
call dword [fcn.0065f1bc]
push esi
mov byte [esp + 0x2a], bl
call dword [fcn.0065f1c0]
add esp, 0x14
lea ecx, [esp + 0xc]
push 0x827a38
push ecx
call dword [fcn.0065f1a4]
add esp, 8
test eax, eax
jne 0x489d5d
mov edx, dword [esp + 0x17]
mov ecx, dword [0x827a43]
mov esi, dword [0x827a47]
cmp edx, ecx
mov edx, dword [esp + 0x1b]
setne al
xor ecx, ecx
cmp edx, esi
setne cl
cmp eax, ebx
mov dword [0x827a58], eax
mov dword [0x827a5c], ecx
jne 0x489d36
mov edx, dword [esp + 0x1f]
mov esi, dword [0x827a4b]
xor eax, eax
cmp edx, esi
setne al
mov dword [0x827a58], eax
cmp ecx, ebx
jne 0x489d51
mov edx, dword [esp + 0x23]
mov esi, dword [0x827a4f]
xor ecx, ecx
cmp edx, esi
setne cl
mov dword [0x827a5c], ecx
cmp eax, ebx
jne 0x489d5d
cmp ecx, ebx
je 0x489dff
push 0x69db7c
lea eax, [esp + 0xc]
push 0x73aaac
push eax
mov dword [0x827a5c], 1
mov dword [0x827a58], 1
call fcn.00643ea6
mov ecx, dword [eax]
mov esi, dword [fcn.0065e15c]
push ecx
call esi
lea ecx, [esp + 8]
call fcn.00643d26
push 0x69dbbc
lea edx, [esp + 0xc]
push 0x73aaac
push edx
call fcn.00643ea6
mov eax, dword [eax]
push eax
call esi
lea ecx, [esp + 8]
call fcn.00643d26
push 0x69dba8
lea ecx, [esp + 0xc]
push 0x73aaac
push ecx
call fcn.00643ea6
mov edx, dword [eax]
push edx
call esi
lea ecx, [esp + 8]
call fcn.00643d26
push 0x69db94
lea eax, [esp + 0xc]
push 0x73aaac
push eax
call fcn.00643ea6
mov ecx, dword [eax]
push ecx
call esi
lea ecx, [esp + 8]
call fcn.00643d26
pop esi
pop ebx
add esp, 0x24
ret
Function at 0x489fb0
Capabilities:
Enumerate pe sections
Read file on windows

Disassembly:
mov eax, 0x1464
call fcn.00645130
push esi
push edi
mov ecx, 0x513
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x69dbbc
lea eax, [esp + 0x14]
push 0x73aaac
push eax
call fcn.00643ea6
mov eax, dword [eax]
push 0x40
push 0x69a9d0
push eax
call dword [fcn.0065f1e8]
mov esi, eax
add esp, 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x18], esi
call fcn.00643d26
test esi, esi
je 0x48a14a
mov edi, dword [esp + 0x1470]
push esi
push edi
lea ecx, [esp + 0x24]
push 0x1a
push ecx
call dword [fcn.0065f1bc]
add esp, 0x10
test edi, edi
jle 0x48a132
mov edx, dword [esp + 0x1478]
push ebx
mov ebx, dword [esp + 0x1478]
mov dword [esp + 0x10], edx
lea edx, [esp + 0x28]
push ebp
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], edi
jmp 0x48a056
mov edx, dword [esp + 0x1c]
cmp word [edx], 0
jne 0x48a067
mov ax, word [edx + 6]
mov word [edx + 8], ax
mov word [edx], ax
mov cl, byte [edx - 8]
or ebp, 0xffffffff
xor eax, eax
add edx, 0xfffffff8
mov byte [esp + 0x13], cl
lea esi, [ebx + 1]
mov cl, byte [esi - 1]
mov bl, byte [esp + 0x13]
cmp bl, cl
jne 0x48a093
mov edi, dword [esp + 0x1c]
mov ebx, dword [esi]
add edi, 0xfffffff9
mov edi, dword [edi]
cmp edi, ebx
je 0x48a0bd
test ebp, ebp
jge 0x48a0a9
test cl, cl
jne 0x48a0a9
cmp byte [esi], 0
jne 0x48a0a9
cmp word [esi + 0x17], 0
jne 0x48a0a9
mov ebp, eax
inc eax
add esi, 0x1a
cmp eax, 0xc8
jl 0x48a079
mov ebx, dword [esp + 0x147c]
jmp 0x48a0df
mov ebx, dword [esp + 0x147c]
lea ecx, [eax + eax*2]
mov esi, edx
lea ecx, [eax + ecx*4]
lea edi, [ebx + ecx*2]
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x14]
movsw word es:[edi], word [esi]
mov word [ecx], ax
cmp eax, 0xc8
jne 0x48a107
test ebp, ebp
jl 0x48a107
lea eax, [ebp + ebp*2]
mov esi, edx
mov edx, dword [esp + 0x14]
lea ecx, [ebp + eax*4]
lea edi, [ebx + ecx*2]
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov word [edx], bp
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
add edx, 0x1a
add ecx, 2
dec eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
jne 0x48a052
mov esi, dword [esp + 0x20]
pop ebp
pop ebx
push esi
call dword [fcn.0065f1c0]
add esp, 4
mov eax, 1
pop edi
pop esi
add esp, 0x1464
ret
pop edi
xor eax, eax
pop esi
add esp, 0x1464
ret