joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5cf960
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x5cfa03
test eax, eax
jbe 0x5cfa03
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x5cfa03
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x5cf9ae
xor esi, esi
jmp 0x5cf9b4
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x5cf9df
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.005d1940
add esi, eax
push esi
mov ebx, esi
call fcn.005d1940
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x5cf9c0
pop ebp
test edi, edi
pop edi
jne 0x5cfa03
test ebx, ebx
je 0x5cfa03
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.005d6ae0
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc

Function at 0x5cfb25
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x5cfc3d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x5cfc3d
mov eax, dword [esi + 0x3c]
push eax
call fcn.005e84b4
mov esi, eax
test esi, esi
je 0x5cfc3d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x5cfc3d
mov ecx, esi
call fcn.005cfab0
cmp edi, eax
jge 0x5cfc3d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x5cfbc3
mov dword [esp + 0x34], 1
jmp 0x5cfc1e
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x5cfc3d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.005cf0a0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc
Function at 0x5e8e57
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x5e8e8f
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.005e6efc
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.005e6ed4
jmp 0x5e8e9b
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x5ea548
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x5ea58a
call fcn.005f0191
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x5ea58a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x5ea581
xor eax, eax
jmp 0x5ea592
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.005ea598
pop edi
pop esi
pop ebx
ret 4

Function at 0x5f06c1
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x5f06ef
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x5f070d
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.005f0627
jmp 0x5f070d
mov eax, dword [esi + 0x14]
test eax, eax
je 0x5f070d
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.005f0627
test edi, edi
mov eax, edi
jne 0x5f06f7
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x85d2d2
Capabilities:
Authenticate hmac

Disassembly:
push eax
jmp 0x8651a4
call fcn.00893037
add esp, 4
movsx eax, bp
jmp 0x8ae2d3
push ebp
mov ebp, esp
rol eax, 0xb8
sar ah, 0x7f
dec ax
sub esp, 0x40
xor ax, bp
mov dword [ebp - 4], 0
and al, 0xfc
cwde
mov dword [ebp - 8], 0
shr al, cl
clc
sbb al, 0xc6
mov dword [ebp - 0xc], 0
btc ax, bp
mov dword [ebp - 0x10], 0
bt ax, si
mov ah, bh
shrd ax, ax, 0xca
nop
sar ah, cl
shl ax, cl
nop
nop
add eax, 0x64941de1
movsx eax, sp
nop
xor eax, ecx
sub ax, 0x4004
shrd eax, esi, 0x25
nop
sbb al, 0x55
sub eax, edi
mov ah, 0x9b
nop
bt eax, ebx
sub ah, 0x2c
nop
cbw
and eax, esi
nop
rcr eax, 0x7a
or ax, bx
nop
cmp esp, eax
xor eax, 0x2c5b5f0a
nop
nop
sub ah, ch
rol eax, cl
setl ah
nop
rol eax, cl
btc ax, 0x31
sar ah, 0xf1
nop
add ah, 0x89
rcr eax, 0x87
mov ah, 0x8e
nop
rcr ah, cl
nop
lahf
not ah
nop
shr ax, 0x63
test bh, ch
nop
nop
mov eax, 0x5ff95c
cmp cl, al
test eax, eax
je 0x868c86
push eax
mov eax, dword [eax + 4]
cmp ah, ch
test edi, 0xed77574
add eax, 8
push eax
call fcn.008b5196
pop ecx
mov di, 0x75eb
cmovne edi, ecx
pop esi
mov edi, esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x868c86
call fcn.00401573
mov eax, 0x60986f
test dl, dl
test eax, eax
je 0x8c4a0f
push eax
cmp di, 0x570f
jmp 0x865fa5
mov eax, dword [eax + 4]
stc
add eax, 8
push eax
jmp 0x8c49f0
push eax
shrd bx, dx, 0x7b
btr bx, bp
mov ebx, dword [ebp - 4]
test ax, ax
test ebx, ebx
jmp 0x86d24b
je 0x86d25d
push ebx
call fcn.00893037
add esp, 4
bswap ax
pop eax
jmp 0x8d36ee
pop eax
jmp 0x8c6b78
call fcn.008b5196
pop ecx
setb bl
bswap esi
mov bl, 0x76
pop esi
mov edi, eax
mov bl, 0xb9
movzx bx, dl
rep movsb byte es:[edi], byte [esi]
bsf ebx, ecx
rcr ebx, cl
inc bl
push eax
sbb bh, dh
xadd ebx, ebx
mov ebx, dword [ebp - 4]
test cl, 0x17
test ebx, ebx
jmp 0x8da9e1
mov dword [ebp - 4], eax
jmp 0x4bb9c0
mov dword [ebp - 4], eax
cwde
mov ax, 0x3d09
lea eax, [ebp - 4]
jmp 0x857f59
je 0x8ae2d3
push ebx
jmp 0x85926b
Function at 0x401491
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
push 0x470361
push ecx
call fcn.0045c2e1
add esp, 8
xor esi, esi
test eax, eax
je 0x40151e
mov edi, eax
push 2
push 0
push eax
call fcn.0045a719
add esp, 0xc
push edi
call fcn.0045aa68
add esp, 4
test eax, eax
js 0x401515
mov ebp, eax
push edi
call fcn.0045d8cc
add esp, 4
lea eax, [ebp + 1]
push eax
call dword [0x47d054]
add esp, 4
test eax, eax
je 0x401515
mov ebx, eax
push edi
push ebp
push 1
push eax
call fcn.0045cfb9
add esp, 0x10
test eax, eax
je 0x401503
mov ebp, eax
push edi
call fcn.0045c913
add esp, 4
test eax, eax
je 0x401525
push edi
call fcn.0045c78e
add esp, 4
push ebx
call dword [0x47d050]
jmp 0x40151b
push edi
call fcn.0045c78e
add esp, 4
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
push edi
call fcn.0045c78e
add esp, 4
mov byte [ebx + ebp], 0
mov esi, ebx
jmp 0x40151e

Function at 0x402b5d
Capabilities:
Hash data using djb2

Disassembly:
push ebx
push edi
push esi
test edx, edx
je 0x402b85
mov edi, 0x1505
xor esi, esi
movzx ebx, byte [ecx + esi]
test ebx, ebx
je 0x402b8c
mov eax, edi
shl eax, 5
add eax, edi
add eax, ebx
inc esi
mov edi, eax
cmp edx, esi
jne 0x402b6b
jmp 0x402b8e
mov eax, 0x1505
jmp 0x402b8e
mov eax, edi
pop esi
pop edi
pop ebx
ret
Function at 0x40ded4
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x54
mov ebp, dword [esp + 0x6c]
mov edx, dword [esp + 0x68]
mov edi, esp
mov ecx, 5
mov esi, 0x470760
rep movsd dword es:[edi], dword [esi]
cmp ebp, 0x40
jb 0x40df54
shr ebp, 6
xor ebx, ebx
mov esi, edx
xor edi, edi
movzx eax, byte [esi + edi]
mov dword [esp + edi + 0x14], eax
movzx ecx, byte [esi + edi + 1]
shl ecx, 8
or ecx, eax
mov dword [esp + edi + 0x14], ecx
movzx eax, byte [esi + edi + 2]
shl eax, 0x10
or eax, ecx
mov dword [esp + edi + 0x14], eax
movzx ecx, byte [esi + edi + 3]
shl ecx, 0x18
or ecx, eax
mov dword [esp + edi + 0x14], ecx
add edi, 4
cmp edi, 0x40
jne 0x40deff
mov ecx, esp
lea edx, [esp + 0x14]
call fcn.0040dfee
inc ebx
lea edx, [esi + edi]
cmp ebx, ebp
jne 0x40defb
add esi, edi
mov edx, esi
mov ebp, dword [esp + 0x6c]
xor ebx, ebx
lea edi, [esp + 0x14]
xor eax, eax
mov ecx, 0x10
rep stosd dword es:[edi], eax
mov esi, ebp
and esi, 0x3f
je 0x40df88
xor eax, eax
movzx edi, byte [edx + eax]
mov ecx, ebx
and cl, 0x18
shl edi, cl
mov ecx, eax
and ecx, 0xfffffffc
xor dword [esp + ecx + 0x14], edi
inc eax
add ebx, 8
cmp esi, eax
jne 0x40df6c
lea ebx, [ebp*8]
mov ecx, ebx
and cl, 0x18
or cl, 7
xor eax, eax
inc eax
shl eax, cl
mov ecx, ebp
and ecx, 0x3c
xor dword [esp + ecx + 0x14], eax
cmp esi, 0x38
jb 0x40dfc0
mov ecx, esp
lea edi, [esp + 0x14]
mov edx, edi
call fcn.0040dfee
xor eax, eax
mov ecx, 0xe
rep stosd dword es:[edi], eax
mov esi, dword [esp + 0x70]
lea edx, [esp + 0x14]
mov dword [edx + 0x38], ebx
shr ebp, 0x1d
mov dword [edx + 0x3c], ebp
mov ecx, esp
call fcn.0040dfee
xor eax, eax
mov ecx, dword [esp + eax*4]
mov dword [esi + eax*4], ecx
inc eax
cmp eax, 5
jne 0x40dfda
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x414f08
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x415007
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x415000
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov ebp, esi
sub ebp, eax
xor edx, edx
cmp ebp, 8
mov dword [esp], esi
jb 0x414fb1
xor esi, esi
mov eax, esi
movzx edx, byte [ebx + esi]
add edx, edi
add ecx, edx
movzx esi, byte [ebx + esi + 1]
add esi, edx
add ecx, esi
movzx edx, byte [ebx + eax + 2]
add edx, esi
add ecx, edx
movzx esi, byte [ebx + eax + 3]
add esi, edx
add ecx, esi
movzx edx, byte [ebx + eax + 4]
add edx, esi
add ecx, edx
movzx esi, byte [ebx + eax + 5]
add esi, edx
add ecx, esi
movzx edx, byte [ebx + eax + 6]
add edx, esi
add ecx, edx
movzx edi, byte [ebx + eax + 7]
add edi, edx
add ecx, edi
lea esi, [eax + 8]
add eax, 0xf
cmp eax, ebp
jb 0x414f51
mov edx, ebp
and edx, 0x1ff8
add ebx, esi
mov esi, dword [esp]
mov eax, ebp
sub eax, edx
jbe 0x414fcb
xor edx, edx
movzx esi, byte [ebx + edx]
add edi, esi
add ecx, edi
inc edx
cmp eax, edx
jne 0x414fb9
add ebx, eax
mov esi, dword [esp]
mov eax, edi
mov edx, 0x80078071
mul edx
shr edx, 0xf
imul eax, edx, 0xfff1
sub edi, eax
mov eax, ecx
mov edx, 0x80078071
mul edx
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, ebp
mov ebp, 0x15b0
jne 0x414f45
shl ecx, 0x10
or ecx, edi
jmp 0x41500a
xor ecx, ecx
inc ecx
mov eax, ecx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41a03b
Capabilities:
Read file on windows

Disassembly:
push ebx
push edi
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 0x48]
push dword [eax + 0x3c]
call fcn.0045aa98
add esp, 4
mov ecx, dword [esi + 0x48]
mov edi, dword [ecx + 0x40]
add edi, dword [esp + 0x14]
mov ebx, dword [ecx + 0x44]
adc ebx, dword [esp + 0x18]
js 0x41a07e
xor eax, edi
xor edx, ebx
or edx, eax
je 0x41a085
push 0
push ebx
push edi
push dword [ecx + 0x3c]
call fcn.0045a753
add esp, 0x10
test eax, eax
je 0x41a082
xor eax, eax
jmp 0x41a09a
mov ecx, dword [esi + 0x48]
push dword [ecx + 0x3c]
push dword [esp + 0x24]
push 1
push dword [esp + 0x28]
call fcn.0045cfb9
add esp, 0x10
pop esi
pop edi
pop ebx
ret
Function at 0x41f6de
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x468
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x41f7e4
mov esi, dword [ebp + 0xc]
mov eax, 0xfffffff6
cmp dword [ebx + 0x10], esi
jbe 0x41f7fc
mov ecx, dword [ebx + 0x48]
mov eax, dword [ecx]
test eax, eax
je 0x41f7e9
mov ecx, dword [ecx + 0x10]
mov ecx, dword [ecx + esi*4]
lea edi, [eax + ecx]
add edi, 0x2e
movzx edx, word [edi - 0x12]
mov eax, dword [ebx + 0x5c]
test eax, eax
je 0x41f745
push eax
mov dword [esp + 8], edx
call fcn.0045d1bc
mov edx, dword [esp + 8]
add esp, 4
mov dword [ebx + 0x5c], 0
mov ecx, edi
call fcn.0041f804
mov dword [ebx + 0x5c], eax
test eax, eax
je 0x41f7f0
lea eax, [esp + 8]
push eax
push esi
push ebx
call fcn.0041ad89
add esp, 0xc
test eax, eax
je 0x41f7f7
mov dword [ebx + 0x58], esi
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov dword [ebx + 0x6c], ecx
mov dword [ebx + 0x68], eax
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov dword [ebx + 0x60], ecx
mov dword [ebx + 0x64], eax
mov eax, dword [esp + 0x28]
mov dword [ebx + 0x70], eax
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov dword [ebx + 0x78], ecx
mov dword [ebx + 0x7c], eax
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
mov dword [ebx + 0xa4], ecx
mov dword [ebx + 0xa0], eax
movzx eax, word [esp + 0x1e]
mov word [ebx + 0xa8], ax
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x44]
mov dword [ebx + 0x4e008], ecx
mov ecx, dword [esp + 0x20]
mov dword [ebx + 0x4e014], eax
mov dword [ebx + 0x4e010], ecx
xor eax, eax
jmp 0x41f7fc
xor eax, eax
dec eax
jmp 0x41f7fc
mov eax, 0xfffffff5
jmp 0x41f7fc
mov eax, 0xfffffffe
jmp 0x41f7fc
mov eax, 0xfffffffd
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4284fd
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebx, dword [esp + 0x20]
mov eax, 0xffffffe6
cmp ebx, 0x1000
ja 0x42853d
mov edi, edx
mov esi, ecx
push 0
push dword [esp + 0x20]
push dword [esp + 0x20]
push ecx
call fcn.0045a753
add esp, 0x10
mov ebp, 0xffffffe5
test eax, eax
je 0x428542
push esi
call fcn.0045c78e
add esp, 4
mov eax, ebp
pop esi
pop edi
pop ebx
pop ebp
ret
push esi
push ebx
push 1
push dword [esp + 0x30]
call fcn.0045cfb9
add esp, 0x10
cmp eax, ebx
jne 0x428589
push 0
push dword [esp + 0x18]
push edi
push esi
call fcn.0045a753
add esp, 0x10
test eax, eax
jne 0x428532
push esi
push ebx
push 1
push dword [esp + 0x30]
call fcn.0045d1d7
add esp, 0x10
mov ecx, eax
mov ebp, 0xffffffe3
mov eax, ebx
cmp ecx, ebx
jne 0x428532
jmp 0x42853d
mov eax, ebx
jmp 0x42853d

Function at 0x428842
Capabilities:
Create directory

Disassembly:
push edi
push esi
call fcn.00427dac
mov esi, eax
push eax
call fcn.0045c58e
add esp, 4
mov edi, eax
push esi
call fcn.0045d1bc
add esp, 4
mov eax, edi
pop esi
pop edi
ret
Function at 0x42a291
Capabilities:
Get disk information

Disassembly:
push esi
push eax
xor eax, eax
mov esi, esp
mov dword [esi], eax
push eax
push eax
push eax
push eax
push esi
push eax
push eax
push 0x4727b8
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov eax, dword [esi]
add esp, 4
pop esi
ret

Function at 0x42a961
Capabilities:
Get hostname

Disassembly:
push edi
push esi
push eax
mov eax, 0x400
mov edi, esp
mov dword [edi], eax
push eax
call fcn.0045d564
add esp, 4
mov esi, eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov eax, esi
add esp, 4
pop esi
pop edi
ret
Function at 0x437a8a
Capabilities:
Check http status code
Create process on windows
Decompress data using ucl
Get disk information
Query environment variable
Resolve function by parsing pe exports

Disassembly:
push eax
call fcn.0040c818
mov dword [esp], 0xd84d8ba6
mov eax, 0xd84d8ba6
cmp eax, 0xd84d8ba6
je 0x437aac
cmp eax, 0xfceca297
jne 0x437a9c
jmp 0x437ab3
mov eax, 0xfceca297
jmp 0x437a9c
mov dword [esp], eax
call fcn.00424115
pop eax
jmp fcn.0042dbd0
Function at 0x43befc
Capabilities:
Create process on windows
Get file size
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov esi, esp
mov dword [esi + 0x24], 0xb9be0274
mov eax, 0xb9be0274
xor edi, edi
mov ebx, 0x67
cmp eax, 0xdbd7bab3
jle 0x43bf53
cmp eax, 0x8f0cc60
jg 0x43bfc2
cmp eax, 0xdbd7bab4
je 0x43c046
cmp eax, 0xe107af37
je 0x43c050
cmp eax, 0xf4d8c38d
jne 0x43bf1d
mov eax, 0xcf350614
jmp 0x43bf1d
cmp eax, 0xc1669377
jg 0x43bffd
cmp eax, 0x8af531ab
je 0x43c05c
cmp eax, 0x9f79ae4b
je 0x43c088
cmp eax, 0xb9be0274
jne 0x43bf1d
push eax
sub esp, 0x7fc
mov eax, esp
mov dword [esi + 0xc], eax
sub esp, 0x200
mov eax, esp
mov dword [esi + 4], eax
sub esp, 8
mov eax, esp
and eax, 0xfffffff8
mov esp, eax
mov dword [esi], eax
push eax
sub esp, 0x64
mov eax, esp
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0xc]
mov eax, dword [esi + 4]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [esi + 0x2c], eax
mov eax, 0xf4d8c38d
jmp 0x43bf1d
cmp eax, 0x8f0cc61
je 0x43c095
cmp eax, 0x70f09109
je 0x43c0b7
cmp eax, 0x7beaea4b
jne 0x43bf1d
push eax
sub esp, 0x64
mov eax, esp
mov dword [esi + 8], eax
mov eax, dword [esi + 8]
mov byte [eax + 0x67], 0
mov eax, 0x70f09109
jmp 0x43bf1d
cmp eax, 0xc9f1c1e4
je 0x43c11c
cmp eax, 0xcf350614
jne 0x43c135
push 0x200
push dword [esi + 4]
push dword [esi + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push edi
push edi
push 3
push edi
push 7
push 0x80000000
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0x14], eax
mov eax, 0xe107af37
jmp 0x43bf1d
mov eax, 0x7beaea4b
jmp 0x43bf1d
mov eax, dword [esi]
mov eax, 0x8f0cc61
jmp 0x43bf1d
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
add eax, 0xffffffff
adc ecx, 0xffffffff
mov edx, dword [esi]
mov dword [edx], eax
mov dword [edx + 4], ecx
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, 0xc9f1c1e4
jmp 0x43bf1d
mov eax, dword [esi + 0x10]
mov eax, 0xdbd7bab4
jmp 0x43bf1d
push dword [esi]
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, dword [esi]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esi + 0x18], ecx
mov dword [esi + 0x1c], eax
mov eax, 0x8af531ab
jmp 0x43bf1d
push ebx
push 0x47f3f0
push dword [esi + 8]
call fcn.0044ce50
add esp, 0xc
push 8
push 0x47f457
push ebx
push dword [esi + 8]
call fcn.0043c150
add esp, 0x10
push 0x68
push dword [esi + 8]
push dword [esi + 0x10]
call fcn.0044ce50
add esp, 0xc
mov eax, dword [esi]
mov ecx, dword [esi + 4]
push ecx
push ecx
push dword [eax]
push dword [esi + 0x10]
push 0x800
push dword [esi + 0xc]
call fcn.0042bb48
add esp, 0x18
push 0
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_WinExec]
mov eax, 0xc1669378
jmp 0x43bf1d
imul eax, dword [esi + 0x28], 0x190000
add eax, 0xec851600
mov dword [esi + 0x28], eax
mov eax, 0x9f79ae4b
jmp 0x43bf1d
cmp eax, 0xc1669378
jne 0x43bf1d
mov dword [esi + 0x24], eax
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x44adb9
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x44adf8
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x44adf8
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x44adf8
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x44adf8
cmp dword [ecx + 0x74], 0xe
jbe 0x44adf8
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x459ae5
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00459d3c
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x459c5d
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x459c5d
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x459c0c
jg 0x459b3e
test eax, eax
je 0x459c02
push 1
push 0x1000
call fcn.004622fd
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x459b64
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x459bf9
push 0x8000
push ebx
call fcn.0045bee8
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x459b90
jg 0x459b8b
cmp ecx, 0x1000
jb 0x459b90
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.004635a1
add esp, 0x10
cmp eax, 0xffffffff
je 0x459bd5
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x459b8b
jl 0x459bbc
test ecx, ecx
jne 0x459b7d
push dword [ebp - 0xc]
push ebx
call fcn.0045bee8
push esi
call fcn.00460884
add esp, 0xc
xor edi, edi
jmp 0x459c6e
cmp byte [edi + 0x24], 0
je 0x459bec
cmp dword [edi + 0x20], 5
jne 0x459bec
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x459bf7
mov edi, dword [edi + 0x18]
jmp 0x459bf9
xor edi, edi
push esi
call fcn.00460884
pop ecx
jmp 0x459c6e
test ecx, ecx
jg 0x459bce
jl 0x459c0c
test eax, eax
jae 0x459bce
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00464097
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x459c2f
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x459bce
jmp 0x459c66
push ebx
call fcn.00463136
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x459bce
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x459c6e
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x459c6b
mov edi, dword [edi + 0x18]
jmp 0x459c6e
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.00464097
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret