joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43fd80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x43fe7a
mov ebp, dword [esp + 0x18]
xor esi, esi
mov edi, 2
jmp 0x43fdb9
lea ecx, [edi + 4]
add edi, 2
mov eax, dword [esp]
mov esi, eax
cmp edi, edx
mov edi, ecx
mov ebp, dword [esp + 0x18]
jae 0x43fe7c
movzx eax, byte [ebp + edi - 2]
push eax
call fcn.00421350
add esp, 4
mov bh, al
movzx eax, byte [ebp + edi - 1]
push eax
call fcn.00421350
mov edx, dword [esp + 0x20]
add esp, 4
mov bl, al
shl bh, 2
shr al, 4
and al, 3
or al, bh
lea ecx, [esi + 1]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov byte [ecx + esi], al
cmp edi, edx
jae 0x43fda0
movzx eax, byte [ebp + edi]
push eax
call fcn.00421350
mov edx, dword [esp + 0x20]
add esp, 4
cmp al, 0x40
je 0x43fda0
shl bl, 4
mov ecx, eax
shr cl, 2
and cl, 0xf
or cl, bl
lea ebx, [esi + 2]
mov dword [esp], ebx
mov ebx, dword [esp + 0x20]
mov byte [ebx + esi + 1], cl
lea ecx, [edi + 1]
cmp ecx, edx
jae 0x43fda0
mov ecx, dword [esp + 0x18]
movzx ecx, byte [ecx + edi + 1]
push ecx
mov ebx, eax
call fcn.00421350
mov edx, dword [esp + 0x20]
add esp, 4
cmp al, 0x40
je 0x43fda0
mov ecx, ebx
shl cl, 6
mov edx, eax
and dl, cl
add dl, dl
xor cl, al
add cl, dl
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov byte [eax + esi + 2], cl
add esi, 3
mov dword [esp], esi
jmp 0x43fda0
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4472e0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebx, dword [esp + 0x3c]
movzx esi, word [ebx]
mov dword [esp], 0x7776dfad
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 3
ja 0x447339
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax]
push dword [esp + 4]
push eax
call fcn.00447920
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 4
jb 0x447310
xor ecx, ecx
cmp dword [esp], esi
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x45460c]
jmp dword [0x454614]
mov dword [esp + 4], 0xf1feb8ac
mov byte [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 4
ja case.0x447343.2
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.004479b0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 5
jb 0x447370
jmp case.0x447343.2
jmp dword [0x454620]
mov esi, dword [ebx + 0x3c]
mov edi, dword [ebx + esi]
mov dword [esp + 4], 0xf1feb8ac
mov byte [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 4
ja 0x4473a0
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.004479b0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 5
jb 0x4473d0
jmp 0x4473a0
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43abcd
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
lea edx, [ebx + 6]
push dword [edx + 0x36]
lea esi, [edx - 6]
mov al, ah
add dword [esp], ebx
pop ecx
inc edi
sub al, bl
add edx, dword [ecx + 0x78]
add esi, dword [edx + 0x1a]
pop ecx
mov edi, edi
lodsd eax, dword [esi]
add ecx, 1
lea edi, [eax + ebx + 4]
cmp dword [edx + 0x12], ecx
je 0x43ac9a
xor eax, eax
sahf
imul eax, eax, 0xf
nop
xor cl, 0
lea edi, [edi]
sub ebx, 0
push eax
or ebp, ebp
movzx eax, byte [edi - 4]
neg eax
lea edi, [edi - 0xe]
sub esp, esi
add esp, esi
sub edi, 0xfffffff1
cmc
add ecx, 0
nop
add dword [esp], eax
mov ebp, ebp
nop
wait
pop eax
nop
cmp byte [edi - 4], 0xa
mov esp, esp
nop
ja 0x43abfe
sub al, 0
clc
nop
mov eax, 0xf01b20a8
nop
xor dword [esp - 4], eax
jmp 0x43aed4
ret
sahf
mov eax, dword [esp + 4]
sub dword [esp - 4], eax
cld
mov dh, dh
jne 0x43abea
lea esi, [esi]
add edx, 0x1b
push dword [edx - 5]
pop edi
add edi, ebx
mov al, al
add ecx, ecx
add ecx, ebx
and ah, 0x18
mov esi, dword [edx + 3]
not ah
mov ax, word [ecx + esi]
inc dl
cwde
push dword [edi + eax*4]
add dword [esp], ebx
pop esi
mov eax, dword [esp]
add esp, 8
not edx
jmp eax
Function at 0x4035d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x403602
jl 0x4035f5
test ecx, ecx
jne 0x403602
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x4036df
mov dword [esp + 0x10], eax
lea eax, [ebx + 0x2c]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax]
mov dword [esp + 0x18], eax
test eax, eax
je 0x403632
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x403634
xor eax, eax
cdq
mov dword [esp + 0x1c], edx
mov esi, eax
test edx, edx
jl 0x403688
jg 0x403645
test esi, esi
je 0x403688
mov eax, dword [esp + 0x10]
cmp eax, edx
jg 0x403659
jl 0x403653
cmp ecx, esi
jae 0x403659
mov esi, ecx
mov dword [esp + 0x1c], eax
push esi
push dword [esp + 0x1c]
push edi
call fcn.00453530
mov eax, dword [esp + 0x20]
add esp, 0xc
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
sub ecx, esi
mov eax, dword [eax]
sbb edx, dword [esp + 0x1c]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov eax, dword [esp + 0x14]
jmp 0x4036ac
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0x10]
cmp eax, 0xffffffff
je 0x4036c8
mov ecx, dword [esp + 0xc]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
lea eax, [ebx + 0x2c]
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ecx
test edx, edx
jg 0x403617
jl 0x4036c8
test ecx, ecx
jne 0x403617
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0xc]
mov ecx, dword [ebp + 0x10]
sbb ecx, edx
mov edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
lea esi, [ebx + 0x2c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x40371d
mov eax, dword [esi]
mov eax, dword [eax]
test eax, eax
je 0x40371d
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push dword [esp + 0x14]
call fcn.00453530
mov eax, dword [ebx + 0x2c]
sub edi, esi
add dword [esp + 0x18], esi
add esp, 0xc
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
lea esi, [ebx + 0x2c]
cmp dword [ebx + 0x4c], 0
je 0x403787
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x403743
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
cmp edi, 0xfff
jbe 0x403772
nop
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.0045ae00
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x403787
cmp edi, eax
ja 0x403750
test edi, edi
je 0x403787
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.0045ae00
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4061f0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x478340
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x491240]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.00451858
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.00450e4f
add esp, 8
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.00406190
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40a780
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x40a7e1
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x40a7c4
cmp edi, 2
jb 0x40a7c4
cmp byte [esi], cl
jne 0x40a7c4
cmp byte [esi + 1], cl
jne 0x40a7c4
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x484878]
jmp 0x40a795
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x484878]
test edi, edi
jne 0x40a795
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x40a810
cmp cl, 0x23
jne 0x40a7f7
cmp byte [esi], cl
jne 0x40a7f7
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x484878]
test cl, cl
jne 0x40a7e8
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
Function at 0x40a920
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x40a933
mov dword [ebx], 0
mov edx, 0x488cf0
call fcn.0040a820
mov esi, eax
test esi, esi
je 0x40aa10
push esi
call fcn.0045bc47
add esp, 4
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x40aa07
push 2
push 0
push esi
call fcn.0045b266
add esp, 0xc
test eax, eax
jne 0x40aa07
push esi
call fcn.0045bc47
mov edi, eax
add esp, 4
cmp edi, 0xffffffff
je 0x40aa07
push 0
push dword [ebp + 8]
push esi
call fcn.0045b266
add esp, 0xc
test eax, eax
jne 0x40aa07
mov eax, dword [0x493128]
test eax, eax
je 0x40a9a6
inc dword [eax + 0xb0]
push edi
call fcn.00460f20
add esp, 4
mov dword [ebp + 8], eax
test eax, eax
je 0x40aa07
push esi
push edi
push 1
push eax
call fcn.0045ae00
add esp, 0x10
push esi
cmp eax, edi
je 0x40a9f1
call fcn.00457092
mov eax, dword [0x493128]
add esp, 4
test eax, eax
je 0x40a9df
dec dword [eax + 0xb0]
push dword [ebp + 8]
call fcn.0045a730
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
call fcn.00457092
add esp, 4
test ebx, ebx
je 0x40a9ff
mov dword [ebx], edi
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret
push esi
call fcn.00457092
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x4187a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x491240]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
lea edx, [ebp - 8]
push ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov eax, dword [0x493128]
push esi
push edi
mov esi, 4
mov edi, dword [eax + 0x3f04]
mov eax, dword [edi + 0xfc]
mov ebx, dword [edi + 0x104]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x484878]
sub esi, 1
jne 0x4187e0
mov eax, dword [0x493128]
not ebx
cmp dword [eax + 0x3f28], ebx
jne 0x41881a
push ecx
push dword [ebp - 0xc]
lea edx, [esi + 0xc]
mov ecx, ebx
call fcn.00429c30
add esp, 8
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push eax
lea ecx, [edi + 0xfc]
call fcn.00429e30
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00451845
mov esp, ebp
pop ebp
ret

Function at 0x418840
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x491240]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
lea edx, [ebp - 8]
push ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov eax, dword [0x493128]
push esi
push edi
mov esi, 4
mov edi, dword [eax + 0x3f04]
mov eax, dword [edi + 0xfc]
mov ebx, dword [edi + 0x104]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x484878]
sub esi, 1
jne 0x418880
mov eax, dword [0x493128]
not ebx
cmp dword [eax + 0x3f28], ebx
jne 0x4188ba
push ecx
push dword [ebp - 0xc]
lea edx, [esi + 4]
mov ecx, ebx
call fcn.00429c30
add esp, 8
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push eax
lea ecx, [edi + 0xfc]
call fcn.00429e30
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00451845
mov esp, ebp
pop ebp
ret
Function at 0x41ebb0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
mov dword [ebp - 4], ecx
push esi
lea esi, [ecx + 1]
push edi
test bl, bl
je 0x41ebf8
or edi, 0xffffffff
nop dword [eax]
cmp bl, 0x23
jne 0x41ebdf
cmp byte [esi], bl
jne 0x41ebdf
cmp byte [esi + 1], bl
cmove eax, edi
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
xor eax, dword [edx*4 + 0x484878]
test bl, bl
jne 0x41ebd0
mov ebx, dword [0x493128]
not eax
mov edi, dword [ebx + 0x5390]
mov esi, edi
neg esi
sbb esi, esi
lea ecx, [edi + 4]
and esi, ecx
je 0x41ec32
cmp dword [esi], eax
je 0x41ec41
mov edx, dword [esi - 4]
mov ecx, dword [ebx + 0x5388]
add edx, esi
add ecx, 4
xor esi, esi
add ecx, edi
cmp edx, ecx
cmovne esi, edx
test esi, esi
jne 0x41ec13
mov ecx, dword [ebp - 4]
call fcn.0041ead0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x41ec32
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41ec50
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
push edi
mov edi, dword [0x493128]
test bl, bl
je 0x41ec96
or edi, 0xffffffff
cmp bl, 0x23
jne 0x41ec77
cmp byte [esi], bl
jne 0x41ec77
cmp byte [esi + 1], bl
cmove eax, edi
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
xor eax, dword [edx*4 + 0x484878]
test bl, bl
jne 0x41ec68
mov edi, dword [0x493128]
mov esi, dword [edi + 0x537c]
xor ecx, ecx
not eax
test esi, esi
jle 0x41ecbc
mov edi, dword [edi + 0x5384]
lea edx, [edi + 4]
nop dword [eax]
cmp dword [edx], eax
je 0x41ecc2
inc ecx
add edx, 0x24
cmp ecx, esi
jl 0x41ecb0
pop edi
pop esi
xor eax, eax
pop ebx
ret
lea eax, [ecx + ecx*8]
lea eax, [edi + eax*4]
pop edi
pop esi
pop ebx
ret
Function at 0x432e90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x432ec6
mov eax, dword [0x493128]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x432eb6
dec dword [eax + 0xb0]
push ecx
call fcn.0045a730
add esp, 4
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x432efa
mov eax, dword [0x493128]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x432eea
dec dword [eax + 0xb0]
push ecx
call fcn.0045a730
add esp, 4
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x432f2e
mov eax, dword [0x493128]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x432f1e
dec dword [eax + 0xb0]
push ecx
call fcn.0045a730
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x432f7e
mov eax, dword [0x493128]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x432f6e
dec dword [eax + 0xb0]
push ecx
call fcn.0045a730
add esp, 4
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x432fb2
mov eax, dword [0x493128]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x432fa2
dec dword [eax + 0xb0]
push ecx
call fcn.0045a730
add esp, 4
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x432fe6
mov eax, dword [0x493128]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x432fd6
dec dword [eax + 0xb0]
push ecx
call fcn.0045a730
add esp, 4
mov dword [esi + 0x5c], 0
lea ecx, [esi + 0x78]
pop esi
jmp fcn.004357d0
Function at 0x44ce90
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
mov eax, dword [0x491240]
xor eax, esp
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_AllocConsole]
test eax, eax
jne 0x44cec2
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push str.Debug
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
push 0
call fcn.0045a0f1
add esp, 4
push eax
push 0x489a00
lea eax, [esp + 0xc]
push str.conin_
push eax
call fcn.00461033
push 1
call fcn.0045a0f1
add esp, 0x14
push eax
push 0x489a0c
lea eax, [esp + 0x10]
push str.conout_
push eax
call fcn.00461033
add esp, 0x10
call fcn.00402d90
call fcn.0044df10
mov ecx, dword [esp + 0xc]
xor eax, eax
xor ecx, esp
call fcn.00451845
mov esp, ebp
pop ebp
ret 0x10
Function at 0x452930
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x45296f
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x45296f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x45296f
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x45296f
cmp dword [ecx + 0x74], 0xe
jbe 0x45296f
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x45b9d7
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1020
call fcn.00452b40
mov eax, dword [0x491240]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.00467358
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x45ba19
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x45bb90
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00476100
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1014], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x492d68]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.0046b843
mov ecx, dword [esi*4 + 0x492d68]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x1020], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x45bb89
cmp eax, dword [edi + ecx + 0x24]
jne 0x45bb89
xor esi, esi
lea eax, [ebp - 0x101c]
push esi
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x45bb89
push dword [ebp - 0x100c]
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0046b843
add esp, 0x14
cmp edx, esi
jl 0x45bb89
jg 0x45bae4
cmp eax, esi
jb 0x45bb89
mov ebx, dword [ebp - 0x1014]
mov eax, dword [ebp - 0x101c]
cmp ebx, esi
jg 0x45bb89
jl 0x45bb06
cmp dword [ebp - 0x1008], eax
ja 0x45bb89
lea edi, [ebp - 0x1004]
xorps xmm0, xmm0
add edi, eax
movlpd qword [ebp - 0x1018], xmm0
lea ecx, [ebp - 0x1004]
cmp dword [ebp - 0x1008], esi
jne 0x45bb2b
cmp ebx, esi
je 0x45bb70
mov edx, dword [ebp - 0x1014]
mov esi, dword [ebp - 0x1018]
cmp ecx, edi
jae 0x45bb70
mov al, byte [ecx]
cmp al, 0xd
jne 0x45bb51
lea eax, [edi - 1]
cmp ecx, eax
jae 0x45bb5d
cmp byte [ecx + 1], 0xa
jne 0x45bb5d
inc ecx
jmp 0x45bb5d
movzx eax, al
movsx eax, byte [eax + 0x491520]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x45bb37
cmp edx, ebx
jne 0x45bb37
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x1020]
jmp 0x45bb8e
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00451845
leave
ret
Function at 0x467547
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x18
mov eax, dword [eax + 0xc]
nop
shr eax, 3
test al, 1
je 0x467561
mov al, 1
leave
ret
mov eax, dword [ebp + 8]
push ebx
push esi
mov eax, dword [eax + 0xc]
nop
test al, 0xc0
mov eax, dword [ebp + 8]
je 0x467578
mov ecx, dword [eax]
cmp ecx, dword [eax + 4]
je 0x4675d0
mov eax, dword [eax + 0x10]
nop
push eax
call fcn.0046eec2
mov esi, eax
pop ecx
cmp esi, 0xffffffff
je 0x4675d0
xor ebx, ebx
lea eax, [ebp - 0x10]
inc ebx
xorps xmm0, xmm0
push ebx
push eax
movlpd qword [ebp - 8], xmm0
push dword [ebp - 4]
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x4675d0
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x4675d0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x18]
jne 0x4675ca
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
je 0x4675cc
xor bl, bl
mov al, bl
jmp 0x4675d2
xor al, al
pop esi
pop ebx
leave
ret
Function at 0x46accf
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov edx, dword [ebp + 8]
mov ecx, edx
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, edx
sar ecx, 6
and eax, 0x3f
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x492d68]
mov dword [ebp - 0x18], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x46ad11
cmp byte [ebx], 0xa
jne 0x46ad11
or byte [edi + eax + 0x28], 4
jmp 0x46ad16
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x46ae19
mov cl, byte [eax]
cmp cl, 0x1a
je 0x46adf4
lea ebx, [eax + 1]
mov dword [ebp - 8], ebx
mov ebx, dword [ebp + 0xc]
cmp cl, 0xd
je 0x46ad45
mov eax, dword [ebp - 8]
jmp 0x46ad65
mov edx, dword [ebp - 0x10]
cmp dword [ebp - 8], edx
mov edx, dword [ebp + 8]
jae 0x46ad81
mov ebx, dword [ebp - 8]
cmp byte [ebx], 0xa
jne 0x46ad5f
add eax, 2
mov cl, 0xa
jmp 0x46ad62
mov eax, dword [ebp - 8]
mov ebx, dword [ebp + 0xc]
mov byte [esi], cl
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], esi
mov esi, dword [ebp - 0xc]
add esi, dword [ebp - 8]
cmp eax, dword [ebp - 0x10]
jb 0x46ad27
jmp 0x46ae19
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x46adef
cmp dword [ebp - 0x10], 0
je 0x46adef
mov edx, dword [ebp - 0x18]
mov eax, dword [edx*4 + 0x492d68]
test byte [eax + edi + 0x28], 0x48
je 0x46adce
mov cl, byte [ebp - 1]
cmp cl, 0xa
jne 0x46adbe
mov byte [esi], 0xa
jmp 0x46ae18
mov byte [esi], 0xd
mov eax, dword [edx*4 + 0x492d68]
mov byte [eax + edi + 0x2a], cl
jmp 0x46ae18
cmp byte [ebp - 1], 0xa
jne 0x46add8
cmp esi, ebx
je 0x46adb9
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0046b861
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x46ae19
mov byte [esi], 0xd
jmp 0x46ae18
mov eax, edx
and edx, 0x3f
sar eax, 6
imul edx, edx, 0x38
mov edi, dword [eax*4 + 0x492d68]
mov al, byte [edi + edx + 0x28]
test al, 0x40
jne 0x46ae16
or al, 2
mov byte [edi + edx + 0x28], al
jmp 0x46ae19
mov byte [esi], cl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret