joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438c70
Capabilities:
Create thread

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov edx, dword [0x4b11a8]
mov dword [esp + 0x2c], 0x5c3a78
test edx, edx
je 0x438cd0
mov esi, dword [0x4b11a0]
mov edi, 0x41
mov ebx, 1
lea ebp, [esp + 0x2c]
lea esi, [esi]
lea ecx, [edi - 0x41]
mov edx, ebx
shl edx, cl
test edx, esi
je 0x438cc0
mov eax, edi
mov dword [esp + 4], ebp
mov byte [esp + 0x2c], al
mov eax, dword [esp + 0x54]
mov dword [esp], eax
call dword [esp + 0x50]
add edi, 1
cmp edi, 0x5b
jne 0x438ca0
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
sub esp, 0x10
mov dword [esp + 0x28], eax
test eax, eax
je 0x438cc8
lea eax, [esp + 0x28]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x438590
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4b11a8], eax
sub esp, 0x18
test eax, eax
je 0x438d59
mov eax, dword [esp + 0x28]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x4b11a8]
sub esp, 4
test eax, eax
jne 0x438c89
jmp 0x438cc8

Function at 0x438e90
Capabilities:
Get common file path

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x23c
lea ebx, [esp + 0x28]
mov dword [esp + 0xc], 0
mov ebp, dword [esp + 0x254]
mov dword [esp + 0x10], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x801a
mov dword [esp], 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
sub esp, 0x14
test eax, eax
js 0x438f70
mov eax, ebx
call fcn.004388d0
mov ebx, eax
test eax, eax
je 0x438f7c
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov edi, eax
mov eax, dword [esp + 0x250]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov dword [esp], ebp
mov esi, eax
call sub.msvcrt.dll_strlen
lea edx, [edi + esi + 4]
mov dword [esp + 4], 0
lea edi, [edx + eax]
mov dword [esp], edi
call dword [0x4af104]
mov esi, eax
test eax, eax
je 0x438f80
mov eax, dword [esp + 0x250]
mov dword [esp + 0x14], ebp
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 8], str._s_s_s_
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.00438c40
mov dword [esp], ebx
call dword [0x4af10c]
add esp, 0x23c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0x1a
call sym.makedocs.exe_PHYSFS_setErrorCode
xor esi, esi
jmp 0x438f5b
mov dword [esp], ebx
xor esi, esi
call dword [0x4af10c]
mov dword [esp], 2
call sym.makedocs.exe_PHYSFS_setErrorCode
jmp 0x438f5b
Function at 0x439250
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x27c
mov edi, dword [ebp + 8]
mov dword [esp], edi
call sub.msvcrt.dll_strlen
lea edx, [eax + 3]
mov esi, eax
xor eax, eax
cmp edx, 0xff
ja 0x43928d
lea eax, [esi + 0x22]
shr eax, 4
shl eax, 4
call fcn.004739d0
sub esp, eax
lea eax, [esp + 0x27]
and eax, 0xfffffff0
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004241f0
mov ebx, eax
test eax, eax
je 0x43946b
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
cmp byte [ebx + esi - 1], 0x5c
je 0x4392c1
movzx eax, word [0x48c680]
mov word [ebx + esi], ax
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov edx, 0x2a
lea esi, [eax + eax + 4]
mov word [ebx + eax], dx
xor eax, eax
cmp esi, 0xff
jbe 0x439420
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.004241f0
mov edi, eax
test eax, eax
je 0x439440
mov dword [esp + 4], eax
mov dword [esp], ebx
mov dword [esp + 8], esi
mov dword [esp + 0xc], 0
call sym.makedocs.exe_PHYSFS_utf8ToUtf16
mov dword [esp], ebx
call fcn.00424240
lea eax, [ebp - 0x268]
mov dword [esp], edi
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
sub esp, 0x18
mov ebx, eax
mov dword [esp], edi
call fcn.00424240
cmp ebx, 0xffffffff
jne 0x43938f
jmp 0x439479
cmp esi, 1
jne 0x439467
lea eax, [ebp - 0x268]
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
sub esp, 8
test eax, eax
je 0x439460
cmp word [ebp - 0x23c], 0x2e
jne 0x4393ab
movzx eax, word [ebp - 0x23a]
test ax, ax
je 0x439371
cmp ax, 0x2e
je 0x439410
lea eax, [ebp - 0x23c]
call fcn.004388d0
mov edi, eax
test eax, eax
je 0x4393ec
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x14]
mov dword [esp], eax
call dword [ebp + 0xc]
mov dword [esp], edi
mov esi, eax
call dword [0x4af10c]
cmp esi, 0xffffffff
jne 0x439368
mov dword [esp], 0x1d
call sym.makedocs.exe_PHYSFS_setErrorCode
mov edi, 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, edi
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp word [ebp - 0x238], 0
jne 0x4393ab
jmp 0x439371
lea eax, [esi + 0x1f]
shr eax, 4
shl eax, 4
call fcn.004739d0
sub esp, eax
lea eax, [esp + 0x27]
and eax, 0xfffffff0
jmp 0x4392e4
mov dword [esp], ebx
call fcn.00424240
lea esp, [ebp - 0xc]
mov edi, 0xffffffff
pop ebx
mov eax, edi
pop esi
pop edi
pop ebp
ret
mov edi, 1
jmp 0x4393f1
mov edi, esi
jmp 0x4393f1
mov dword [esp], 2
call sym.makedocs.exe_PHYSFS_setErrorCode
jmp 0x439448
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
call fcn.004383a0
test eax, eax
je 0x439448
call ebx
call fcn.004383a0
mov dword [esp], eax
call sym.makedocs.exe_PHYSFS_setErrorCode
jmp 0x439448
Function at 0x4394a0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x439540
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
lea edi, [eax + eax + 2]
xor eax, eax
cmp edi, 0xff
ja 0x4394e1
lea eax, [edi + 0x1f]
shr eax, 4
shl eax, 4
call fcn.004739d0
sub esp, eax
lea eax, [esp + 0x1f]
and eax, 0xfffffff0
mov dword [esp + 4], edi
mov dword [esp], eax
call fcn.004241f0
mov esi, eax
test eax, eax
je 0x439540
mov dword [esp + 8], edi
mov dword [esp + 0xc], 0
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym.makedocs.exe_PHYSFS_utf8ToUtf16
mov dword [esp + 4], 0
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
sub esp, 8
mov ebx, eax
mov dword [esp], esi
call fcn.00424240
test ebx, ebx
je 0x439548
mov ebx, 1
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
xor esi, esi
jmp 0x43950b
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
call fcn.004383a0
test eax, eax
je 0x439532
call esi
call fcn.004383a0
mov dword [esp], eax
call sym.makedocs.exe_PHYSFS_setErrorCode
jmp 0x439532

Function at 0x439a90
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov esi, dword [ebp + 8]
test esi, esi
je 0x439b78
mov dword [esp], esi
call sub.msvcrt.dll_strlen
lea edi, [eax + eax + 2]
xor eax, eax
cmp edi, 0xff
jbe 0x439b40
mov dword [esp + 4], edi
mov dword [esp], eax
call fcn.004241f0
mov ebx, eax
test eax, eax
je 0x439b78
mov dword [esp + 4], eax
mov dword [esp + 8], edi
mov dword [esp + 0xc], 0
mov dword [esp], esi
call sym.makedocs.exe_PHYSFS_utf8ToUtf16
lea eax, [ebp - 0x3c]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
sub esp, 0xc
test eax, eax
je 0x439b60
test byte [ebp - 0x3c], 0x10
mov dword [esp], ebx
je 0x439b90
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
sub esp, 4
mov esi, 1
test eax, eax
je 0x439b60
mov dword [esp], ebx
call fcn.00424240
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [edi + 0x1f]
shr eax, 4
shl eax, 4
call fcn.004739d0
sub esp, eax
lea eax, [esp + 0x1f]
and eax, 0xfffffff0
jmp 0x439abe
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
call fcn.004383a0
test eax, eax
jne 0x439ba0
xor esi, esi
jmp 0x439b2a
mov dword [esp], 2
xor esi, esi
call sym.makedocs.exe_PHYSFS_setErrorCode
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
sub esp, 4
jmp 0x439b21
call esi
xor esi, esi
call fcn.004383a0
mov dword [esp], eax
call sym.makedocs.exe_PHYSFS_setErrorCode
jmp 0x439b2a
Function at 0x43aee0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push edi
push esi
push ebx
mov eax, dword [esp + 0x10]
cmp eax, 0x7f
jbe 0x43af80
mov esi, eax
shr esi, 8
xor esi, eax
cmp eax, 0xffff
ja 0x43af48
mov ecx, esi
mov ebx, eax
movzx edx, cl
movzx edi, byte [edx*8 + 0x48c7c4]
test edi, edi
je 0x43afa0
mov edx, dword [edx*8 + 0x48c7c0]
xor ecx, ecx
jmp 0x43af2a
add ecx, 1
add edx, 4
cmp edi, ecx
je 0x43afa0
cmp word [edx], bx
jne 0x43af20
movzx eax, word [edx + 2]
mov edi, dword [esp + 0x14]
mov dword [edi], eax
mov eax, 1
pop ebx
pop esi
pop edi
ret
and esi, 0xf
movzx ebx, byte [esi*8 + 0x48c744]
test ebx, ebx
je 0x43af8c
mov edx, dword [esi*8 + 0x48c740]
xor ecx, ecx
jmp 0x43af72
add ecx, 1
add edx, 8
cmp ebx, ecx
je 0x43af8c
cmp dword [edx], eax
jne 0x43af68
mov eax, dword [edx + 4]
jmp 0x43af8c
lea ecx, [eax - 0x41]
lea edx, [eax + 0x20]
cmp ecx, 0x1a
cmovb eax, edx
mov edi, dword [esp + 0x14]
mov dword [edi], eax
mov eax, 1
jmp 0x43af3e
mov edx, esi
and edx, 0xf
movzx ecx, byte [edx*8 + 0x48c6c4]
test cl, cl
je 0x43aff0
mov edx, dword [edx*8 + 0x48c6c0]
lea ecx, [ecx + ecx*2]
lea ecx, [edx + ecx*2]
jmp 0x43afc7
add edx, 6
cmp ecx, edx
je 0x43aff0
cmp word [edx], bx
jne 0x43afc0
movzx eax, word [edx + 2]
mov edi, dword [esp + 0x14]
mov dword [edi], eax
movzx eax, word [edx + 4]
mov dword [edi + 4], eax
mov eax, 2
jmp 0x43af3e
and esi, 3
movzx edi, byte [esi*8 + 0x48c6a4]
test edi, edi
je 0x43af8c
mov edx, dword [esi*8 + 0x48c6a0]
xor ecx, ecx
jmp 0x43b01e
add ecx, 1
add edx, 8
cmp edi, ecx
je 0x43af8c
cmp word [edx], bx
jne 0x43b010
movzx eax, word [edx + 2]
mov edi, dword [esp + 0x14]
mov dword [edi], eax
movzx eax, word [edx + 4]
mov dword [edi + 4], eax
movzx eax, word [edx + 6]
mov dword [edi + 8], eax
mov eax, 3
jmp 0x43af3e
Function at 0x457930
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov dword [esp], 0x4b14d0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
sub esp, 4
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [esp], 0xb4
mov dword [0x4b14ec], eax
call fcn.004686f0
lea edi, [eax + 0xc]
lea ecx, [eax + 8]
mov dword [eax + 4], 0
mov ebx, eax
and edi, 0xfffffffc
mov dword [eax + 8], 0
mov dword [eax + 0x84], 0
sub ecx, edi
xor eax, eax
sub ecx, 0xffffff80
shr ecx, 2
rep stosd dword es:[edi], eax
mov dword [ebx + 0x88], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebx + 0xb0], eax
call ebp
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edi, eax
call ebp
lea edx, [ebx + 0xac]
mov dword [esp + 8], esi
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
sub esp, 0x1c
test eax, eax
je 0x457a21
mov eax, dword [0x4b14ec]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x4b14f8]
mov dword [0x4b14f0], ebx
sub esp, 8
mov dword [0x4b14f8], ebx
mov dword [ebx], eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0xffffffff
call sub.msvcrt.dll_exit
lea esi, [esi]

Function at 0x457c90
Capabilities:
Resume thread

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov eax, dword [eax + 0xac]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
sub esp, 4
add esp, 0x1c
ret

Function at 0x457ef0
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
sub esp, 0x1c
mov eax, dword [0x4b1504]
test eax, eax
je 0x457f18
mov eax, dword [0x4b1500]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
add esp, 0x1c
ret
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x4b1504], 1
mov dword [0x4b1500], eax
jmp 0x457f01
Function at 0x457f80
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov edx, dword [0x4b1504]
mov eax, dword [0x4b1500]
test edx, edx
je 0x457fc8
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x458010
mov eax, dword [ebx + 4]
cmp eax, dword [ebx + 8]
je 0x457fe0
lea edx, [eax + 0x48]
mov dword [eax + 0x44], 1
mov dword [ebx + 4], edx
add esp, 0x10
pop ebx
pop esi
pop edi
ret
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x4b1504], 1
mov dword [0x4b1500], eax
jmp 0x457f95
mov edx, dword [ebx]
sub eax, edx
mov dword [esp], edx
lea edi, [eax + 0x2d0]
mov dword [esp + 4], eax
mov esi, eax
mov dword [esp + 8], edi
call fcn.0043e6c0
add edi, eax
mov dword [ebx], eax
add eax, esi
mov dword [ebx + 8], edi
jmp 0x457faf
mov dword [esp], 0xc
call fcn.0043e690
mov dword [eax], 0
mov ebx, eax
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov eax, dword [0x4b1504]
test eax, eax
je 0x458058
mov eax, dword [0x4b1500]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
jmp 0x457fa7
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x4b1504], 1
mov dword [0x4b1500], eax
jmp 0x458040

Function at 0x4580d0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov edx, dword [0x4b1504]
mov eax, dword [0x4b1500]
test edx, edx
je 0x458108
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov eax, dword [eax + 4]
sub esp, 4
mov esi, dword [eax + 0x40]
cmp eax, dword [ebx]
je 0x458120
add esp, 0x14
mov eax, esi
pop ebx
pop esi
ret
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x4b1504], 1
mov dword [0x4b1500], eax
jmp 0x4580e4
mov dword [esp], eax
call fcn.0043e6a0
mov dword [esp], ebx
call fcn.0043e6a0
mov eax, dword [0x4b1504]
test eax, eax
je 0x458160
mov eax, dword [0x4b1500]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, esi
sub esp, 8
add esp, 0x14
pop ebx
pop esi
ret
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x4b1504], 1
mov dword [0x4b1500], eax
jmp 0x45813e
Function at 0x458180
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
sub esp, 0x18
mov edx, dword [0x4b1504]
mov eax, dword [0x4b1500]
test edx, edx
je 0x4581b8
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov eax, dword [eax + 4]
sub esp, 4
sub eax, 0x48
mov dword [ebx + 4], eax
cmp eax, dword [ebx]
je 0x4581d0
add esp, 0x18
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x4b1504], 1
mov dword [0x4b1500], eax
jmp 0x458193
mov dword [esp], eax
call fcn.0043e6a0
mov dword [esp], ebx
call fcn.0043e6a0
mov eax, dword [0x4b1504]
test eax, eax
je 0x458210
mov eax, dword [0x4b1500]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
add esp, 0x18
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x4b1504], 1
mov dword [0x4b1500], eax
jmp 0x4581ee

Function at 0x4598e0
Capabilities:
Query environment variable

Disassembly:
push ebx
sub esp, 0x148
lea ebx, [esp + 0x2c]
mov dword [esp + 8], 0x105
mov dword [esp + 4], ebx
mov dword [esp], str.GC_LOG_FILE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
sub eax, 1
sub esp, 0xc
cmp eax, 0x103
ja 0x4599b0
cmp dword [0x4b1564], 2
mov edx, 0x80000080
mov eax, pe_nt_image_headers32
mov dword [esp], ebx
cmovne eax, edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], 4
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x40000000
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x1c
mov ebx, eax
cmp eax, 0xffffffff
jne 0x459978
add esp, 0x148
mov eax, ebx
pop ebx
ret
lea eax, [esp + 0x28]
mov dword [esp], ebx
mov dword [esp + 0x28], 0
mov dword [esp + 0xc], 2
mov dword [esp + 8], eax
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, ebx
sub esp, 0x10
add esp, 0x148
pop ebx
ret
mov dword [esp + 8], 0x105
mov dword [esp + 4], ebx
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
sub esp, 0xc
cmp eax, 4
jle 0x4599dc
lea edx, [eax - 4]
cmp byte [esp + eax + 0x28], 0x2e
cmove eax, edx
add eax, ebx
mov edx, 0x80000080
cmp dword [0x4b1564], 2
mov dword [eax], 0x2e63672e
mov dword [eax + 4], 0x676f6c
mov eax, pe_nt_image_headers32
cmovne eax, edx
mov dword [esp], ebx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x40000000
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x1c
mov ebx, eax
add esp, 0x148
mov eax, ebx
pop ebx
ret
Function at 0x459b20
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, edx
push ebx
mov ebx, eax
sub esp, 0x34
mov eax, dword [0x51a3c4]
or eax, dword [0x51e9dc]
je 0x459b46
mov dword [esp], 0x4b1524
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub esp, 4
mov eax, dword [0x51a388]
test eax, eax
je 0x459bb0
cmp eax, 0xffffffff
je 0x459bbc
lea edx, [esp + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 8], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
mov ebx, eax
mov eax, dword [0x51a3c4]
or eax, dword [0x51e9dc]
jne 0x459b98
test ebx, ebx
je 0x459be0
mov eax, dword [esp + 0x2c]
add esp, 0x34
pop ebx
pop esi
ret
mov dword [esp], 0x4b1524
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
jmp 0x459b87
call fcn.004598e0
mov dword [0x51a388], eax
jmp 0x459b4f
mov eax, dword [0x51a3c4]
or eax, dword [0x51e9dc]
je 0x459be0
mov dword [esp], 0x4b1524
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
lea esi, [esi]
mov eax, 0xffffffff
jmp 0x459b8f
Function at 0x45acb0
Capabilities:
Check for time delay via gettickcount
Query environment variable

Disassembly:
mov eax, dword [0x4b153c]
test eax, eax
je 0x45acc0
ret
jmp fcn.0045a520
Function at 0x45dc70
Capabilities:
Query environment variable

Disassembly:
push esi
push ebx
sub esp, 0x24
mov eax, dword [0x4b153c]
test eax, eax
je 0x45dd90
mov esi, dword [0x4b1578]
test esi, esi
je 0x45dc92
call dword [0x51a3b0]
call fcn.00466ec0
mov ebx, dword [0x51e9dc]
test ebx, ebx
jne 0x45dd50
mov ecx, dword [0x4b1544]
mov esi, dword [0x488224]
test ecx, ecx
je 0x45dcb9
test esi, esi
jg 0x45dd30
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.00461c80
mov eax, dword [0x488234]
mov dword [esp], eax
call fcn.0045d830
mov edx, dword [0x51e9dc]
mov dword [0x488224], esi
mov ebx, eax
test edx, edx
jne 0x45dd68
test ebx, ebx
je 0x45dd1e
mov eax, dword [0x4b1578]
test eax, eax
jne 0x45dd40
call fcn.00466ec0
mov eax, dword [0x51ec00]
test eax, eax
jne 0x45dd80
add esp, 0x24
pop ebx
pop esi
ret
mov dword [0x488224], 1
jmp 0x45dcb9
call dword [0x51a3b0]
jmp 0x45dd19
mov dword [esp], 0x51eafc
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub esp, 4
jmp 0x45dca5
mov dword [esp], 0x51eafc
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
jmp 0x45dd0c
add esp, 0x24
pop ebx
pop esi
jmp fcn.0046df80
call fcn.0045acb0
jmp 0x45dc82
Function at 0x45efd0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x1c
mov dword [esp], 0x51a4a0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x51a4a4]
sub esp, 4
mov dword [0x51a4c4], eax
add esp, 0x1c
ret

Function at 0x45f000
Capabilities:
Get system information on windows

Disassembly:
push ebx
sub esp, 0x38
mov eax, dword [0x51a4c4]
test eax, eax
je 0x45f0a0
call fcn.00460b00
mov dword [esp + 8], 0x1c
mov ebx, eax
mov eax, dword [0x51a4c4]
neg eax
and ebx, eax
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
cmp eax, 0x1c
je 0x45f055
mov dword [esp], 0x49066c
call dword [0x488200]
call dword [sym.imp.KERNEL32.dll_DebugBreak]
mov eax, dword [esp + 0x28]
and ah, 0xfc
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x45f06c
sub eax, 0x40
and eax, 0xffffffbf
jne 0x45f076
cmp dword [esp + 0x24], 0x1000
je 0x45f088
mov eax, dword [esp + 0x40]
mov dword [eax], ebx
add esp, 0x38
xor eax, eax
pop ebx
ret
mov eax, dword [esp + 0x40]
add ebx, dword [esp + 0x20]
mov dword [eax], ebx
add esp, 0x38
xor eax, eax
pop ebx
ret
mov dword [esp], 0x51a4a0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x51a4a4]
sub esp, 4
mov dword [0x51a4c4], eax
jmp 0x45f011

Function at 0x45f540
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push esi
push ebx
sub esp, 0x14
mov edx, dword [0x51a44c]
mov eax, dword [esp + 0x20]
test edx, edx
je 0x45f5b8
mov edx, 0xffffefff
mov dword [esp], 0
cmp eax, edx
cmova eax, edx
add eax, 0x1000
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea ebx, [eax + 0xfff]
sub esp, 8
and ebx, 0xfffff000
cmp dword [0x4b1610], 0x1dff
jbe 0x45f5a1
mov dword [esp], str.Too_many_heap_sections
call dword [0x488200]
call dword [sym.imp.KERNEL32.dll_DebugBreak]
test ebx, ebx
jne 0x45f646
add esp, 0x14
mov eax, ebx
pop ebx
pop esi
ret
cmp dword [0x51e4f0], 1
mov esi, dword [0x51e4e8]
mov dword [esp], 0
sbb ecx, ecx
mov ebx, dword [0x51e4e4]
xor edx, edx
and ecx, 0xffffffc4
add ecx, 0x40
or bh, 0x30
test esi, esi
sete dl
mov dword [esp + 8], ebx
mov esi, edx
add edx, eax
mov dword [esp + 0xc], ecx
not esi
cmp eax, esi
mov eax, 0xffffffff
cmovae edx, eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
sub esp, 0x10
mov ebx, eax
test eax, 0xfff
je 0x45f582
mov dword [esp], str.Bad_VirtualAlloc_result
call dword [0x488200]
mov esi, dword [sym.imp.KERNEL32.dll_DebugBreak]
call esi
mov eax, dword [0x4b1610]
cmp eax, 0x1dff
jbe 0x45f64b
mov dword [esp], str.Too_many_heap_sections
call dword [0x488200]
call esi
mov eax, dword [0x4b1610]
lea edx, [eax + 1]
mov dword [eax*4 + 0x4f5b84], ebx
mov eax, ebx
mov dword [0x4b1610], edx
add esp, 0x14
pop ebx
pop esi
ret
Function at 0x45f7a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [0x51a4c4]
mov edx, dword [esp + 0x50]
mov ebx, eax
lea ecx, [edx + eax - 1]
neg ebx
add edx, dword [esp + 0x54]
and ecx, ebx
add eax, ecx
cmp edx, eax
jb 0x45f8bc
and edx, ebx
mov esi, ecx
sub edx, ecx
mov edi, edx
test ecx, ecx
je 0x45f8bc
test edx, edx
je 0x45f8bc
lea ebp, [esp + 0x14]
jmp 0x45f822
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe
je 0x45f899
mov dword [esp], str.VirtualAlloc_remapping_failed
call dword [0x488200]
call dword [sym.imp.KERNEL32.dll_DebugBreak]
sub dword [0x4b15e4], ebx
add esi, ebx
sub edi, ebx
je 0x45f8bc
mov dword [esp + 8], 0x1c
mov dword [esp + 4], ebp
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
cmp eax, 0x1c
je 0x45f852
mov dword [esp], 0x49066c
call dword [0x488200]
call dword [sym.imp.KERNEL32.dll_DebugBreak]
mov ebx, dword [esp + 0x20]
mov dword [esp + 8], 0x1000
mov dword [esp], esi
cmp edi, ebx
cmovbe ebx, edi
cmp dword [0x51e4f0], 1
sbb eax, eax
and eax, 0xffffffc4
mov dword [esp + 4], ebx
add eax, 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
sub esp, 0x10
cmp esi, eax
je 0x45f812
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
jne 0x45f7f0
mov dword [esp], str.Not_enough_memory_to_process_remapping
add esi, ebx
call dword [0x488200]
call dword [sym.imp.KERNEL32.dll_DebugBreak]
sub dword [0x4b15e4], ebx
sub edi, ebx
jne 0x45f822
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret