joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4450a0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x485448
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
lea eax, [esp + 0xc]
mov ecx, dword [esi + 0x1c]
push eax
push ecx
call dword [0x488590]
push 0
lea ecx, [esp + 0x20]
call fcn.0047c061
mov eax, dword [esi + 0xd0]
lea edx, [esp + 0x1c]
push eax
push eax
push edx
mov dword [esp + 0x44], 0
call fcn.00444a40
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x48]
add eax, 0x64
add esp, 0xc
add ecx, 0x64
mov dword [esp + 8], eax
lea eax, [esp + 4]
mov dword [esp + 4], ecx
push eax
lea ecx, [esp + 0x20]
call fcn.0047bf8f
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
push 1
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
lea eax, [edx + ecx + 1]
xor edx, edx
test eax, eax
setl dl
dec edx
mov ecx, esi
and eax, edx
push eax
push 0
push 0
call fcn.00478775
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 8]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
xor ecx, ecx
sar edx, 4
mov eax, edx
push 1
shr eax, 0x1f
lea eax, [edx + eax + 1]
test eax, eax
setl cl
dec ecx
and eax, ecx
mov ecx, esi
push eax
push 0
push 1
call fcn.00478775
push 1
push 0
push 0
mov ecx, esi
call fcn.0047871d
push 1
push 0
push 1
mov ecx, esi
call fcn.0047871d
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.0047c0d3
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret

Function at 0x445220
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x485468
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0x20]
call fcn.0047c061
push 0x3e8
lea eax, [esp + 0x20]
push 0x3e8
push eax
mov dword [esp + 0x44], 0
call fcn.00444a40
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x4c]
add ecx, 0x64
add esp, 0xc
mov dword [esp + 4], ecx
lea ecx, [esp + 4]
add eax, 0x96
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], eax
call fcn.0047bf8f
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0xc]
push edx
push eax
call dword [0x488590]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, eax
mov eax, dword [esp + 0x14]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 4]
cmp dword [esp + 0x44], 1
jne 0x4452e4
cmp dword [esp + 0x40], 1
jne 0x4452e2
cmp ecx, eax
jge 0x4452e4
mov eax, ecx
cmp eax, 0xc8
jge 0x4452f0
mov eax, 0xc8
mov ecx, esi
mov dword [esi + 0xd0], eax
call fcn.004450a0
mov ecx, dword [esi + 0x1c]
push 1
push 0
push ecx
call dword [0x48858c]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.0047c0d3
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret 8
Function at 0x445a70
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4854d3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00476b91
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [0x4880d0]
push eax
mov ecx, edi
call fcn.0047c309
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.0047d861
test eax, eax
je 0x445b8c
mov ecx, dword [esp + 0x3c]
call fcn.0047c336
mov ecx, dword [esi + 0x1c]
mov ebp, dword [0x4885b0]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x445b50
push edi
mov ecx, esi
call fcn.004798f4
mov ecx, esi
call fcn.00445cf0
cmp dword [esp + 0x38], 1
jne 0x445b85
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.00479a5e
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28

Function at 0x4485c0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x4485f3
push esi
call fcn.0044b6b0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x4485ec
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x448679
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x448662
mov eax, dword [esi + 8]
test eax, eax
je 0x448617
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x44865e
cmp eax, 2
je 0x448662
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x44860a
cmp eax, 3
je 0x44863d
cmp eax, 1
jne 0x44860a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x44860a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x44860a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.004486a0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x448688
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.004486a0
add esp, 4
pop esi
ret
Function at 0x458ff0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x485d90
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00458ba0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00458c20
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00458c20
lea ecx, [esi + 0xc]
call fcn.00475521
lea ecx, [esi + 0x10]
call fcn.00475521
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.0045a1b0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.0045a1b0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.0045a1b0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.00475596
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.00475596
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4174f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], esi
mov esi, 1
mov dword [ebp - 0x10], 0
push 1
push 0x5015f0
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x41757c
mov eax, 0x51eb851f
mov ecx, esi
imul esi
sar edx, 5
mov eax, esi
sar ecx, 0x1f
sub edx, ecx
imul edi, edx, 0x64
sub eax, edi
jne 0x41757c
cmp esi, 0x15f90
jl 0x417573
cmp esi, 0x1d4c0
jge 0x417550
mov eax, 0x32
jmp 0x417575
cmp esi, 0x2bf20
jge 0x41755f
mov eax, 0x64
jmp 0x417575
mov eax, 0x1482
cmp esi, 0x57d78
jl 0x417575
mov eax, 0xfa
jmp 0x417575
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 4]
test eax, eax
je 0x417590
inc esi
cmp esi, 0x57e40
jl 0x417508
mov eax, dword [ebp - 4]
test eax, eax
je 0x4175aa
mov dword [ebp - 0x14], 0x98
lea eax, [ebp - 0x14]
push eax
call fcn.00423360
add esp, 4
mov eax, dword [0x5015f4]
test eax, eax
jne 0x4175d8
cmp dword [0x4fd500], 1
je 0x417618
xor edi, edi
xor esi, esi
call fcn.004176b0
mov dword [0x5015f4], 1
cmp dword [0x4fd500], 1
je 0x417603
mov dword [0x5015f0], 0
push dword [0x5015ec]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x417633
mov edx, dword [ebp + 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov dword [edx], eax
xor eax, eax
mov esp, ebp
pop ebp
ret
push esi
push 2
call fcn.00470f80
push edi
push 0x16
call fcn.00470f80
add esp, 0x10
jmp 0x4175d8
push 1
push 2
call fcn.00470f80
mov esi, eax
push 1
push 0x16
call fcn.00470f80
add esp, 0x10
mov edi, eax
jmp 0x4175c0
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x70
call fcn.004265d0
add esp, 0xc
test eax, eax
je 0x41765d
mov edx, dword [ebp + 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov dword [edx], 0
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov edx, 0x70
mov ecx, dword [edx + 0x4fd45c]
mov dword [eax + edx - 4], ecx
mov esi, dword [edx + 0x4fd458]
mov dword [eax + edx - 8], esi
mov edi, dword [edx + 0x4fd454]
mov dword [eax + edx - 0xc], edi
mov ecx, dword [edx + 0x4fd450]
mov dword [eax + edx - 0x10], ecx
sub edx, 0x10
jne 0x417665
push dword [ebp - 0x10]
push dword [0x5015ec]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [ebp - 0x10]
jmp 0x4175f2

Function at 0x4176b0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x5015e0], 0
je 0x4176c0
mov esp, ebp
pop ebp
ret
mov dword [0x5015e0], 1
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x5015ec], eax
cmp eax, 0xffffffff
jne 0x4176e6
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esp, ebp
pop ebp
ret
push 0x4174d0
call fcn.00471550
push 0x417490
call fcn.00471550
add esp, 8
jmp 0x4176bc
Function at 0x417700
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], esi
mov esi, 1
mov dword [ebp - 0x10], 0
push 1
push 0x5015f0
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x41778c
mov eax, 0x51eb851f
mov ecx, esi
imul esi
sar edx, 5
mov eax, esi
sar ecx, 0x1f
sub edx, ecx
imul edi, edx, 0x64
sub eax, edi
jne 0x41778c
cmp esi, 0x15f90
jl 0x417783
cmp esi, 0x1d4c0
jge 0x417760
mov eax, 0x32
jmp 0x417785
cmp esi, 0x2bf20
jge 0x41776f
mov eax, 0x64
jmp 0x417785
mov eax, 0x1482
cmp esi, 0x57d78
jl 0x417785
mov eax, 0xfa
jmp 0x417785
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 4]
test eax, eax
je 0x4177a0
inc esi
cmp esi, 0x57e40
jl 0x417718
mov eax, dword [ebp - 4]
test eax, eax
je 0x4177ba
mov dword [ebp - 0x14], 0x98
lea eax, [ebp - 0x14]
push eax
call fcn.00423360
add esp, 4
mov eax, dword [0x5015f4]
test eax, eax
jne 0x4177e8
cmp dword [0x4fd500], 1
je 0x417836
xor edi, edi
xor esi, esi
call fcn.004176b0
mov dword [0x5015f4], 1
cmp dword [0x4fd500], 1
je 0x417821
mov dword [0x5015f0], 0
push dword [0x5015ec]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
je 0x417871
mov eax, dword [ebp + 8]
mov dword [eax], esi
cmp dword [0x4fd500], 1
je 0x417854
xor eax, eax
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
push esi
push 2
call fcn.00470f80
push edi
push 0x16
call fcn.00470f80
add esp, 0x10
jmp 0x4177e8
push 1
push 2
call fcn.00470f80
mov esi, eax
push 1
push 0x16
call fcn.00470f80
add esp, 0x10
mov edi, eax
jmp 0x4177d0
push 1
push 2
call fcn.00470f80
push 1
push 0x16
mov dword [esi + 0x64], eax
call fcn.00470f80
add esp, 0x10
mov dword [esi + 0x68], eax
jmp 0x417815
lea eax, [ebp - 0x10]
push eax
push 0
push 0x70
call fcn.004265d0
add esp, 0xc
test eax, eax
je 0x417898
mov edx, dword [ebp + 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov dword [edx], 0
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov edx, 0x70
mov ecx, dword [edx + 0x4fd45c]
mov dword [eax + edx - 4], ecx
mov esi, dword [edx + 0x4fd458]
mov dword [eax + edx - 8], esi
mov edi, dword [edx + 0x4fd454]
mov dword [eax + edx - 0xc], edi
mov ecx, dword [edx + 0x4fd450]
mov dword [eax + edx - 0x10], ecx
sub edx, 0x10
jne 0x4178a0
push dword [ebp - 0x10]
push dword [0x5015ec]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esi, dword [ebp - 0x10]
jmp 0x417807
Function at 0x423360
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
call fcn.00435b60
mov ebx, dword [ebp + 8]
cmp dword [0x50bf40], 0
jne 0x423387
test ebx, ebx
je 0x42337c
mov eax, dword [ebx]
jmp 0x42337e
xor eax, eax
push eax
call fcn.00473cc0
add esp, 4
test ebx, ebx
je 0x42338f
mov eax, dword [ebx]
jmp 0x423391
xor eax, eax
push eax
call fcn.004c9280
add esp, 4
jmp 0x423374

Function at 0x4239c0
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
Function at 0x4247f0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp eax, 0xfffffffa
mov dword [ebp - 0x10], ebx
mov ebx, ecx
lea ecx, [eax + 5]
jg 0x424805
mov ecx, eax
mov dword [ebp - 4], eax
mov eax, 0xfb93e673
mov dword [ebp - 8], esi
mov esi, edx
mul ecx
shr edx, 9
mov dword [ebp - 0xc], edi
imul edi, edx, 0x209
sub ecx, edi
mov edi, dword [0x4fd500]
cmp edi, 2
lea eax, [ecx + 0x69]
mov dword [esi], eax
jge 0x424861
lea ecx, [ecx*4 + 0x1a4]
lea edx, [ecx*8]
sub edx, ecx
mov ecx, dword [edx + 0x501864]
test ecx, ecx
jne 0x4248ea
mov dword [edx + 0x501864], 1
mov eax, dword [esi]
jmp 0x4248ea
lea eax, [ecx*4 + 0x1a4]
lea edx, [eax*8]
sub edx, eax
lea ecx, [edx + 0x501864]
push ecx
call fcn.00417940
add esp, 4
test eax, eax
jne 0x4248e2
mov edx, dword [esi]
lea eax, [edx*4]
shl edx, 5
sub edx, eax
cmp dword [edx + 0x501860], 0
je 0x42495a
mov dword [edx + 0x501864], 0
mov edx, dword [esi]
push 0xffffffffffffffff
lea eax, [edx*4]
shl edx, 5
sub edx, eax
push dword [edx + 0x501860]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esi]
lea eax, [edx*4]
shl edx, 5
sub edx, eax
lea ecx, [edx + 0x501864]
push ecx
call fcn.00417940
add esp, 4
mov edi, dword [0x4fd500]
mov eax, dword [esi]
cmp edi, 1
je 0x42493b
mov edx, dword [ebp + 0x14]
lea ecx, [eax*4]
shl eax, 5
sub eax, ecx
mov ecx, dword [eax + 0x501878]
xor eax, eax
mov dword [ebx], ecx
test ecx, ecx
je 0x424933
mov esi, dword [ebp - 4]
cmp esi, dword [ecx + 0x100]
jbe 0x424922
mov eax, ecx
mov ecx, dword [ecx + 0x28]
test ecx, ecx
mov dword [ebx], ecx
jne 0x42490f
mov dword [edx], eax
xor eax, eax
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
mov dword [edx], 0
jmp 0x424924
lea edx, [eax*4]
shl eax, 5
sub eax, edx
lea eax, [eax + 0x501870]
push eax
call fcn.004178f0
add esp, 4
mov eax, dword [esi]
jmp 0x4248ef
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ecx, dword [esi]
lea edx, [ecx*4]
shl ecx, 5
sub ecx, edx
mov dword [ecx + 0x501860], eax
mov dword [ecx + 0x501864], 0
jmp 0x4248a9
Function at 0x426400
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 8], esi
mov dword [ebp - 4], ebx
mov esi, dword [eax + 0x7c]
test esi, esi
mov dword [ebp - 0xc], edi
je 0x4265bc
mov edx, dword [0x4fd500]
mov edi, dword [esi + 0x14]
lea eax, [edi*4]
shl edi, 5
sub edi, eax
cmp edx, 2
lea ebx, [edi + 0x505ce8]
jge 0x42644f
mov eax, dword [ebx]
test eax, eax
jne 0x426490
mov dword [edi + 0x505ce8], 1
jmp 0x426490
push ebx
call fcn.00417940
add esp, 4
test eax, eax
jne 0x42648a
cmp dword [edi + 0x505ce4], 0
je 0x42659c
mov dword [edi + 0x505ce8], 0
push 0xffffffffffffffff
push dword [edi + 0x505ce4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call fcn.00417940
add esp, 4
mov edx, dword [0x4fd500]
cmp edx, 1
je 0x426588
mov eax, dword [esi + 0x18]
dec eax
mov dword [esi + 0x18], eax
test eax, eax
jle 0x4264ff
mov eax, dword [0x4fd500]
cmp eax, 1
je 0x4264e4
cmp eax, 2
jge 0x4264bf
mov dword [edi + 0x505ce8], 0
jmp 0x4264d5
mov dword [edi + 0x505ce8], 0
push dword [edi + 0x505ce4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor eax, eax
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
push dword [edi + 0x505cf8]
push dword [edi + 0x505cf4]
call fcn.00417920
add esp, 8
mov eax, dword [0x4fd500]
jmp 0x4264ae
mov edx, dword [esi]
test edx, edx
je 0x42650b
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 4]
test eax, eax
je 0x426516
mov dword [eax], edx
jmp 0x42651c
mov dword [edi + 0x505ce0], edx
mov eax, dword [ebp + 8]
mov dword [eax + 0x7c], 0
mov eax, dword [0x4fd500]
cmp eax, 1
je 0x42656d
cmp eax, 2
jge 0x426541
mov dword [edi + 0x505ce8], 0
jmp 0x426557
mov dword [edi + 0x505ce8], 0
push dword [edi + 0x505ce4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [esi + 8]
call fcn.00426690
push esi
call fcn.00426690
add esp, 8
jmp 0x4264d5
push dword [edi + 0x505cf8]
push dword [edi + 0x505cf4]
call fcn.00417920
add esp, 8
mov eax, dword [0x4fd500]
jmp 0x426530
lea eax, [edi + 0x505cf4]
push eax
call fcn.004178f0
add esp, 4
jmp 0x426499
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [edi + 0x505ce4], eax
mov dword [edi + 0x505ce8], 0
jmp 0x426473
xor eax, eax
mov esi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x427120
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
Function at 0x454c30
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]

Function at 0x454c3c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], esi
mov esi, ecx
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 8], ebx
mov ebx, edx
mov dword [ebp - 4], edi
mov edx, eax
mov dword [ecx], 0
cmp dword [0x50bf40], 0
je 0x454d11
cmp dword [ebp + 0x20], 2
je 0x454c73
cmp dword [ebp + 0x20], 1
jne 0x454c82
mov eax, 0xffffffff
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0x18], 0
je 0x454c92
cmp dword [ebp + 0x20], 0xfffffffa
je 0x454dd6
cmp dword [ebp + 0x20], 0
je 0x454de2
xor ecx, ecx
cmp dword [ebp + 0x18], 0
je 0x454cc5
cmp dword [ebp + 0x1c], 0
je 0x454cc5
push edi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], edx
call fcn.004c9030
push edi
call fcn.004c91a0
mov edx, dword [ebp - 0x10]
add esp, 8
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x454d11
push edi
push esi
push ebx
call fcn.004c90d0
add esp, 0xc
mov esi, eax
mov eax, dword [ebp + 0x14]
cmp esi, 0xffffffff
mov dword [eax], esi
je 0x454e06
push 0
push edi
push 2
push 0x4e744c
call fcn.004c9090
add esp, 0x10
mov edx, dword [ebp + 0x14]
mov eax, 1
mov byte [esi + ebx], 0xa
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
inc dword [edx]
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x10], edx
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x24]
test ecx, ecx
mov edx, dword [ebp - 0x10]
mov dword [edi], 0
je 0x454d39
mov edi, dword [ecx + 0x140]
test edi, edi
jne 0x454d3e
mov edi, 0x20000
cmp esi, edi
jbe 0x454db2
cmp dword [ebp + 0x20], 0
je 0x454db2
test ecx, ecx
je 0x454d56
mov edi, dword [ecx + 0x140]
test edi, edi
jne 0x454d5b
mov edi, 0x20000
mov dword [ebp - 0x10], edx
push 0
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x18]
push eax
push edi
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x454da0
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x18]
add ebx, edx
sub esi, edx
add dword [ecx], edx
cmp dword [ebp + 0x24], 0
je 0x454d95
mov edx, dword [ebp + 0x24]
mov edx, dword [edx + 0x140]
test edx, edx
jne 0x454d9a
mov edx, 0x20000
cmp esi, edx
ja 0x454da0
mov edi, esi
test esi, esi
je 0x454dc9
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0x18]
jne 0x454dc9
test eax, eax
jne 0x454d5e
jmp 0x454dc9
push 0
lea ecx, [ebp - 0x18]
push ecx
push esi
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x18]
mov dword [ecx], edx
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov edi, edx
mov ecx, 1
jmp 0x454ca4
mov dword [ebp - 0x10], edx
call fcn.004c92c0
mov edx, dword [ebp - 0x10]
mov edi, eax
cmp dword [0x50bf40], 0
je 0x454cc9
mov ecx, 1
jmp 0x454c9e
xor eax, eax
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4c9240
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 0xc], 0
mov dword [ebp + 8], 0x28f
mov esp, ebp
pop ebp
jmp fcn.0041fa10
Function at 0x456709
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x456741
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x45672f
mov al, 1
jmp 0x45678b
cmp dword [ebx + 0x54], ecx
jne 0x456738
mov al, 2
jmp 0x45678b
cmp dword [ebx + 0x7c], ecx
jne 0x45678b
mov al, 3
jmp 0x45678b
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x456756
mov al, 4
jmp 0x45678b
cmp ecx, 5
jne 0x456776
cmp ebx, 0
jne 0x456764
mov al, 5
jmp 0x45678b
cmp ebx, 1
jne 0x45676d
mov al, 6
jmp 0x45678b
cmp ebx, 2
jne 0x456776
mov al, 7
jmp 0x45678b
cmp ecx, 6
jne 0x456782
cmp ebx, 0
jne 0x456784
mov al, 8
jmp 0x45678b
cmp ebx, 1
jne 0x45678b
mov al, 9
pop ebx
mov esp, ebp
pop ebp
ret