joyce8/EMBER2024-capa huggingface dataset:
Function at 0x449f9d
Capabilities:
Allocate or change rwx memory
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp esi, 0x7ff80000
mov ebx, 0x10000
jbe 0x449fc1
lea eax, [esi - 0x7ff80000]
mov dword [ebp + 8], eax
jmp 0x449fc4
mov dword [ebp + 8], ebx
cmp esi, 0x80000000
jae 0x449fd7
lea eax, [esi + 0x7ff80000]
mov dword [ebp - 4], eax
jmp 0x449fde
mov dword [ebp - 4], 0xfff80000
mov eax, dword [0x4f43a4]
mov ecx, dword [0x4f43a0]
test eax, eax
jne 0x449ff8
test ecx, ecx
je 0x44a00d
mov eax, ecx
mov dword [0x4f43a4], eax
mov edx, dword [eax + 8]
test edx, edx
je 0x44a00d
cmp edx, dword [ebp + 8]
jb 0x44a00d
cmp edx, dword [ebp - 4]
jbe 0x44a166
mov eax, ecx
test ecx, ecx
mov dword [0x4f43a4], eax
je 0x44a03d
test eax, eax
je 0x44a031
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x44a031
cmp ecx, dword [ebp + 8]
jb 0x44a031
cmp ecx, dword [ebp - 4]
jbe 0x44a166
mov eax, dword [eax + 4]
test eax, eax
mov dword [0x4f43a4], eax
jne 0x44a01c
mov eax, esi
and eax, 0xffff
sub esi, eax
cmp esi, dword [ebp + 8]
mov edi, esi
jbe 0x44a0a5
cmp edi, 0x70000000
jb 0x44a062
cmp edi, 0x80000000
ja 0x44a062
mov edi, 0x6fff0000
lea eax, [ebp - 0x20]
push 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x44a0a5
cmp dword [ebp - 0x10], ebx
jne 0x44a07d
cmp dword [ebp - 0x14], ebx
jae 0x44a08d
mov eax, dword [ebp - 0x1c]
lea edi, [eax - 0x10000]
cmp edi, dword [ebp + 8]
ja 0x44a04d
jmp 0x44a0a5
push 0x40
push 0x3000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
mov dword [0x4f43a4], eax
jne 0x44a11c
cmp esi, dword [ebp - 4]
jae 0x44a18d
cmp esi, 0x70000000
jb 0x44a0c3
cmp esi, 0x80000000
ja 0x44a0c3
mov esi, 0x80010000
lea eax, [ebp - 0x20]
push 0x1c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x44a18d
cmp dword [ebp - 0x10], ebx
jne 0x44a111
cmp dword [ebp - 0x14], ebx
jb 0x44a111
mov ecx, esi
and ecx, 0xffff
je 0x44a0f9
mov eax, ebx
sub eax, ecx
sub dword [ebp - 0x14], eax
add dword [ebp - 0x20], eax
mov esi, dword [ebp - 0x20]
push 0x40
push 0x3000
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
mov dword [0x4f43a4], eax
jne 0x44a11c
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x14]
lea esi, [eax + ecx]
jmp 0x44a0a5
mov dword [eax], 0x52727464
mov eax, dword [0x4f43a4]
xor ecx, ecx
mov dword [eax + 8], ecx
mov eax, dword [0x4f43a4]
mov edx, dword [0x4f43a0]
mov dword [eax + 4], edx
mov eax, dword [0x4f43a4]
mov dword [0x4f43a0], eax
add eax, 0xffe0
mov edx, 0x7fd
mov dword [eax + 0x18], ecx
mov ecx, eax
sub eax, 0x20
dec edx
jne 0x44a14e
mov eax, dword [0x4f43a4]
mov dword [eax + 8], ecx
mov eax, dword [0x4f43a4]
mov esi, dword [eax + 8]
cmp esi, dword [ebp + 8]
jb 0x44a18d
cmp esi, dword [ebp - 4]
ja 0x44a18d
mov ecx, dword [esi + 0x18]
push 0x20
push 0xcc
push esi
mov dword [eax + 8], ecx
call fcn.0048e0e0
add esp, 0xc
mov eax, esi
jmp 0x44a18f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x44a194
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ac790
push 0x48dfb8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x1c
lea eax, [ebp - 0x38]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x44a209
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x34]
cmp word [ecx], 0x5a4d
jne 0x44a205
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x3c], eax
cmp dword [eax], 0x4550
jne 0x44a205
cmp word [eax + 0x14], 0
jne 0x44a1fa
xor eax, eax
or dword [ebp - 4], 0xffffffff
jmp 0x44a20b
mov eax, ecx
jmp 0x44a1f4
or dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x44a21a
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x4f43ac], eax
je 0x44a239
mov eax, 0x10dd
jmp 0x44a30f
mov eax, dword [0x4f43b0]
test eax, eax
jne 0x44a30f
mov edi, dword [ebp + 8]
test edi, edi
jne 0x44a255
push 6
pop eax
jmp 0x44a30f
cmp dword [edi], 0
jne 0x44a267
push 6
pop eax
mov dword [0x4f43b0], eax
jmp 0x44a309
push 0x18
call fcn.004892be
mov esi, eax
pop ecx
test esi, esi
jne 0x44a27a
push 8
pop edi
jmp 0x44a2f3
mov edi, dword [edi]
push 0
push dword [ebp + 0xc]
call fcn.004497af
movzx ecx, byte [edi + 0x17]
mov ebx, dword [edi + 0x18]
xor edx, edx
sub ebx, ecx
cmp ecx, edx
je 0x44a2e8
cmp ecx, 0x17
ja 0x44a2e8
cmp dword [edi + 0x1c], eax
jne 0x44a2e8
lea eax, [ebp - 4]
mov dword [ebp - 4], edx
push eax
push 0x40
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x44a2be
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x44a2f3
mov eax, dword [ebp + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], eax
mov dword [esi + 0x10], edi
mov dword [esi + 0xc], ebx
mov eax, dword [ebp - 4]
mov dword [esi + 0x14], eax
mov eax, dword [0x4f43bc]
mov dword [esi], eax
mov dword [0x4f43bc], esi
xor eax, eax
jmp 0x44a30f
cmp dword [0x4f43a8], edx
push 9
pop edi
jne 0x44a2f9
mov dword [0x4f43b0], edi
test esi, esi
je 0x44a304
push esi
call fcn.00488e55
pop ecx
mov eax, edi
mov edi, dword [ebp + 8]
mov dword [0x4f43b4], edi
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x44c1f5
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp dword [esp + 4], eax
jle 0x44c21e
push esi
movzx edx, byte [ecx]
movzx edx, byte [edx + 0x4ae570]
mov esi, eax
shl esi, 3
xor edx, esi
xor eax, edx
inc ecx
dec dword [esp + 8]
cmp dword [esp + 8], 0
jg 0x44c1fe
pop esi
ret
Function at 0x44c6c9
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x20]
push edi
test eax, eax
je 0x44c70a
cdq
push esi
mov esi, eax
add eax, dword [ebp + 0xc]
mov edi, edx
mov ecx, edx
adc ecx, dword [ebp + 0x10]
push edi
sub eax, 1
push esi
sbb ecx, 0
push ecx
push eax
call fcn.0048e600
push edi
push esi
push edx
push eax
call fcn.0048e980
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x10], edx
pop esi
push dword [ebp + 0x10]
mov edi, ebx
push dword [ebp + 0xc]
call fcn.0044c56a
pop ecx
pop ecx
test eax, eax
jne 0x44c733
push dword [ebx + 8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x44c73a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + 0x10], eax
mov dword [ebp - 4], 0x60a
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret

Function at 0x44c765
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [ebp + 8]
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x44c795
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x44c795
mov dword [esi + 0x10], eax
mov eax, 0x70a
jmp 0x44c7b5
push 1
push 0
push 0
push dword [ebp + 8]
call fcn.0048e980
mov ecx, eax
xor eax, eax
add ecx, edi
adc edx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
mov dword [eax + 4], edx
xor eax, eax
pop edi
pop esi
pop ebp
ret

Function at 0x44ca98
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push ebx
push ebp
push edi
push dword [esp + 0x14]
xor ebp, ebp
xor ebx, ebx
call fcn.0044ca85
mov edi, eax
pop ecx
test edi, edi
jne 0x44cab7
push 7
pop eax
jmp 0x44cb40
push esi
call fcn.0044c349
test eax, eax
je 0x44caf3
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x44cae3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 5
jne 0x44cb25
inc ebp
cmp ebp, 5
jge 0x44cb25
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x44cac1
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x44cb15
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 5
jne 0x44cb25
inc ebp
cmp ebp, 5
jge 0x44cb25
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x44caf3
push edi
call fcn.004897dc
pop ecx
cmp esi, 0xffffffff
pop esi
jne 0x44cb3b
cmp ebx, 2
jne 0x44cb3b
xor eax, eax
jmp 0x44cb40
mov eax, 0xa0a
pop edi
pop ebp
pop ebx
ret
Function at 0x4545c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
mov eax, dword [0x4dbc40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [sym.JHotNews.exe_sqlite3_temp_directory]
push ebx
push esi
test eax, eax
je 0x4545fa
push eax
push 0x4c43f4
lea eax, [ebp - 0x10c]
push eax
push 0xe6
call sym.JHotNews.exe_sqlite3_snprintf
add esp, 0x10
jmp 0x454672
call fcn.0044c349
mov esi, 0xe6
test eax, eax
je 0x45463a
lea eax, [ebp - 0x314]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x314]
push eax
call fcn.0044c3f6
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x454656
push 7
pop eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00488e60
leave
ret
lea eax, [ebp - 0x210]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x210]
push eax
call sym.JHotNews.exe_sqlite3_win32_mbcs_to_utf8
jmp 0x454622
push ebx
push 0x4c43f4
lea eax, [ebp - 0x10c]
push eax
push esi
call sym.JHotNews.exe_sqlite3_snprintf
push ebx
call fcn.004897dc
add esp, 0x14
mov ecx, str.etilqs_
call fcn.0044b602
lea ecx, [ebp - 0x10c]
mov edx, eax
call fcn.0044b602
lea eax, [edx + eax + 0x11]
mov edx, dword [ebp + 8]
cmp eax, edx
jl 0x454699
xor eax, eax
inc eax
jmp 0x45462c
lea ecx, [ebp - 0x10c]
call fcn.0044b602
test eax, eax
jbe 0x4546b2
dec ecx
cmp byte [ecx + eax], 0x5c
jne 0x4546b2
dec eax
jne 0x4546a9
mov byte [ebp + eax - 0x10c], 0
lea eax, [ebp - 0x10c]
push eax
push str._setilqs_
add edx, 0xffffffef
push edi
push edx
call sym.JHotNews.exe_sqlite3_snprintf
mov ecx, edi
call fcn.0044b602
mov esi, eax
lea eax, [edi + esi]
push eax
push 0xf
call sym.JHotNews.exe_sqlite3_randomness
add esp, 0x18
push 0xf
pop ecx
movzx eax, byte [edi + esi]
xor edx, edx
push 0x3e
pop ebx
div ebx
mov al, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [edi + esi], al
inc esi
dec ecx
jne 0x4546ea
mov byte [edi + esi], cl
xor eax, eax
jmp 0x45462c
Function at 0x454899
Capabilities:
Get disk size

Disassembly:
push ebp
lea ebp, [esp - 0x94]
sub esp, 0x114
mov eax, dword [0x4dbc40]
xor eax, ebp
mov dword [ebp + 0x90], eax
mov eax, dword [ebp + 0xa0]
lea ecx, [ebp - 0x78]
push ecx
push 0x104
push eax
push dword [ebp + 0x9c]
mov dword [ebp - 0x80], 0x200
call fcn.004547c3
add esp, 0x10
test eax, eax
jne 0x45496d
push ebx
lea eax, [ebp - 0x78]
push esi
push eax
call fcn.0044ca85
mov esi, eax
xor ebx, ebx
pop ecx
cmp esi, ebx
je 0x454964
push edi
call fcn.0044c349
test eax, eax
mov eax, esi
je 0x454930
cmp word [esi], bx
je 0x45491a
cmp word [eax], 0x5c
je 0x454915
inc eax
inc eax
cmp word [eax], bx
jne 0x454906
jmp 0x45491a
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x7c]
push eax
push eax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x7c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x454956
cmp byte [esi], bl
je 0x454942
cmp byte [eax], 0x5c
je 0x454940
inc eax
cmp byte [eax], bl
jne 0x454934
jmp 0x454942
mov byte [eax], bl
lea eax, [ebp - 0x7c]
push eax
push eax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x7c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
push esi
mov edi, eax
call fcn.004897dc
pop ecx
cmp edi, ebx
pop edi
jne 0x45496b
mov dword [ebp - 0x80], 0x200
pop esi
pop ebx
mov ecx, dword [ebp + 0x90]
mov eax, dword [ebp - 0x80]
xor ecx, ebp
call fcn.00488e60
add ebp, 0x94
leave
ret
Function at 0x45782c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
test edi, edi
je 0x457944
test esi, esi
je 0x457944
movzx edx, word [edi + 2]
mov eax, 0x800
mov ecx, edx
and ecx, eax
mov ebx, eax
cmp cx, bx
je 0x4578e8
movzx ecx, word [esi + 2]
mov ebx, ecx
and ebx, eax
cmp bx, ax
je 0x4578e8
xor cl, dl
test cl, 0x10
jne 0x4578e8
mov al, byte [edi]
cmp al, byte [esi]
jne 0x4578e8
push dword [esi + 8]
push dword [edi + 8]
call fcn.0045782c
pop ecx
pop ecx
test eax, eax
jne 0x4578e8
push dword [esi + 0xc]
push dword [edi + 0xc]
call fcn.0045782c
pop ecx
pop ecx
test eax, eax
jne 0x4578e8
mov ebx, dword [esi + 0x10]
mov edi, dword [edi + 0x10]
call fcn.00450969
test eax, eax
jne 0x4578e8
mov edi, dword [esp + 0x10]
mov eax, dword [edi + 0x18]
cmp eax, dword [esi + 0x18]
jne 0x4578e8
mov ax, word [edi + 0x1c]
cmp ax, word [esi + 0x1c]
jne 0x4578e8
movzx eax, word [edi + 2]
mov ecx, eax
mov eax, 0x400
and ecx, eax
mov edx, eax
cmp cx, dx
jne 0x4578ed
mov cx, word [esi + 2]
and cx, dx
cmp cx, ax
jne 0x4578e8
mov eax, dword [edi + 4]
cmp eax, dword [esi + 4]
je 0x457917
push 2
pop eax
jmp 0x45794f
cmp byte [edi], 0x98
je 0x457917
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x457917
mov dx, word [esi + 2]
mov ebx, eax
and dx, bx
cmp dx, ax
je 0x4578e8
mov edx, dword [esi + 4]
test edx, edx
je 0x4578e8
call fcn.0044b677
test eax, eax
jne 0x4578e8
movzx ecx, word [edi + 2]
mov dx, word [esi + 2]
mov eax, 0x100
and ecx, eax
and dx, ax
cmp cx, dx
je 0x457933
xor eax, eax
inc eax
jmp 0x45794f
test cx, cx
je 0x457940
mov eax, dword [edi + 0x14]
cmp eax, dword [esi + 0x14]
jne 0x4578e8
xor eax, eax
jmp 0x45794f
mov eax, esi
sub eax, edi
neg eax
sbb eax, eax
and eax, 2
pop edi
pop esi
pop ebx
ret
Function at 0x458f10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0xc]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebx]
lea esi, [edi + 2]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esi
call fcn.00450a1a
mov esi, eax
mov eax, ecx
call fcn.004509cb
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
call fcn.00450946
push 0
push eax
mov ecx, esi
mov eax, ebx
call fcn.00457741
mov ecx, dword [ebp - 4]
add edi, esi
push edi
push dword [ebx + 8]
push 0x35
pop eax
call fcn.0045624d
mov eax, dword [ebp + 8]
inc edi
push edi
mov edi, dword [ebp + 0x14]
xor ebx, ebx
inc ebx
call fcn.004575c7
push dword [ebp - 8]
mov edi, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
push edi
push esi
push 0x1e
pop eax
call fcn.004561b8
push dword [ebp - 8]
mov ebx, dword [ebp + 0xc]
push dword [ebx + 8]
mov ecx, dword [ebp - 4]
push 0x46
pop eax
call fcn.0045624d
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add esp, 0x28
call fcn.004509e6
mov ecx, esi
call fcn.00450a3e
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 0x30]
test ecx, ecx
je 0x45901e
mov eax, dword [eax + 0x34]
lea edi, [eax + 1]
test eax, eax
jne 0x458fc5
mov edi, ecx
mov esi, dword [ebp - 4]
push edi
push 0x73
pop eax
mov ecx, esi
call fcn.0045623c
push 0xffffffffffffffff
push edi
mov dword [ebp + 8], eax
push 0x14
pop eax
mov ecx, esi
call fcn.0045624d
push 1
mov ecx, esi
call fcn.0045622a
mov edi, eax
mov eax, dword [ebp + 8]
mov ecx, esi
call fcn.0044f9fb
push dword [ebx + 8]
mov ecx, esi
push 0x3f
pop eax
call fcn.0045623c
push dword [ebx + 8]
mov ecx, esi
push 0x39
pop eax
call fcn.0045623c
add esp, 0x18
mov eax, edi
mov ecx, esi
call fcn.0044f9fb
pop edi
pop esi
pop ebx
leave
ret

Function at 0x459023
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, eax
mov eax, dword [esi + 0x34]
test eax, eax
je 0x45906d
cmp dword [esp + 8], 0
je 0x45906d
push 0xffffffffffffffff
push eax
push 0x14
pop eax
mov ecx, edi
call fcn.0045624d
push dword [esi + 0x34]
mov ecx, edi
push 0x72
pop eax
call fcn.0045623c
push dword [esp + 0x14]
mov esi, eax
xor eax, eax
push 0
inc eax
mov ecx, edi
call fcn.0045624d
add esp, 0x14
mov eax, esi
mov ecx, edi
pop esi
jmp fcn.0044f9fb
pop esi
ret
Function at 0x45a2e1
Capabilities:
Get system information on windows

Disassembly:
push esi
push 0x24
push 0
mov esi, 0x568b40
push esi
call fcn.0048e0e0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 1
push 0x4db240
call sym.JHotNews.exe_sqlite3_vfs_register
pop ecx
pop ecx
xor eax, eax
pop esi
ret
Function at 0x45c7a6
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, eax
cmp dword [ebx + 0x30], 0
push esi
mov esi, ecx
jne 0x45c8f0
mov eax, esi
call fcn.00450946
cmp dword [ebx + 0x28], 0
je 0x45c8f0
inc dword [esi + 0x48]
mov eax, dword [esi + 0x48]
push edi
mov edi, esi
mov dword [ebp - 4], eax
mov dword [ebx + 0x30], eax
call fcn.0045c77d
mov edi, eax
mov dword [ebp - 0xc], edi
test edi, edi
je 0x45c8ef
mov edx, dword [ebx + 0x28]
lea eax, [ebp - 8]
push eax
push edx
call fcn.004506c5
pop ecx
pop ecx
test eax, eax
je 0x45c83e
push dword [ebp - 4]
mov ecx, edi
push dword [ebp - 8]
push 7
pop eax
call fcn.0045624d
cmp dword [ebp - 8], 0
pop ecx
pop ecx
jne 0x45c82c
push dword [ebp + 8]
xor eax, eax
push 0
inc eax
mov ecx, edi
call fcn.0045624d
pop ecx
pop ecx
jmp 0x45c86a
fild dword [ebp - 8]
fcom qword [ebx + 0x48]
fnstsw ax
test ah, 5
jp 0x45c868
fstp qword [ebx + 0x48]
jmp 0x45c86a
mov edi, dword [ebp - 4]
mov eax, edx
call fcn.00457673
mov ecx, dword [ebp - 0xc]
push edi
push 0x15
pop eax
call fcn.0045623c
push dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
push edi
push 0x73
pop eax
call fcn.0045624d
add esp, 0xc
jmp 0x45c86a
fstp st(0)
cmp dword [ebx + 0x2c], 0
je 0x45c8ef
inc dword [esi + 0x48]
mov edi, dword [esi + 0x48]
mov dword [ebx + 0x34], edi
inc dword [esi + 0x48]
mov eax, dword [ebx + 0x2c]
call fcn.00457673
mov esi, dword [ebp - 0xc]
push edi
push 0x15
pop eax
mov ecx, esi
call fcn.0045623c
push edi
push 0x71
pop eax
mov ecx, esi
call fcn.0045623c
push edi
push 0
mov ebx, eax
push 7
pop eax
mov ecx, esi
call fcn.0045624d
mov eax, ebx
mov ecx, esi
call fcn.0044f9fb
lea ebx, [edi + 1]
push ebx
push edi
push dword [ebp - 4]
mov ecx, esi
push 0x56
pop eax
call fcn.004561b8
push dword [ebp - 4]
mov ecx, esi
push 0x71
pop eax
call fcn.0045623c
push ebx
push 0xffffffffffffffff
mov edi, eax
push 7
pop eax
mov ecx, esi
call fcn.0045624d
add esp, 0x28
mov eax, edi
mov ecx, esi
call fcn.0044f9fb
pop edi
pop esi
pop ebx
leave
ret
Function at 0x45d716
Capabilities:
Get system information on windows

Disassembly:
push 0xa
call sym.JHotNews.exe_sqlite3_malloc
pop ecx
test eax, eax
jne 0x45d726
push 7
pop eax
ret
push eax
call sym.JHotNews.exe_sqlite3_free
pop ecx
jmp sym.JHotNews.exe_sqlite3_os_init

Function at 0x45ecb8
Capabilities:
Terminate process

Disassembly:
call fcn.0045c77d
mov ecx, eax
test ecx, ecx
je 0x45eccb
push 0x64
pop eax
jmp fcn.0045623c
ret

Function at 0x45fd6c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov ebx, dword [esi + 0xc]
push edi
mov edi, dword [esi + 0x1a0]
mov dword [ebp - 0x10], eax
test edi, edi
je 0x45febd
jmp 0x45fd92
mov esi, eax
mov edx, dword [edi + 8]
mov eax, dword [ebp - 0x10]
shl edx, 4
add edx, dword [eax + 8]
mov eax, dword [edi + 0xc]
mov dword [ebp - 0xc], eax
mov eax, esi
call fcn.004509cb
push 0x27
push dword [edi + 8]
mov dword [ebp - 4], eax
mov eax, dword [edx + 0xc]
push 0
push esi
mov esi, dword [eax + 0x48]
call fcn.0045fb68
mov eax, dword [ebp - 0xc]
inc eax
push eax
mov dword [ebp - 8], eax
push 0x4a
pop eax
mov ecx, ebx
call fcn.0045623c
push 0x41
mov ecx, ebx
mov dword [ebp - 0x1c], eax
call fcn.0045622a
push dword [ebp - 4]
xor esi, esi
push esi
push esi
mov dword [ebp - 0x18], eax
push 0x1c
pop eax
mov ecx, ebx
call fcn.004561b8
push dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
dec eax
push esi
push eax
mov dword [ebp - 0x20], eax
push 0x4c
pop eax
mov ecx, ebx
call fcn.004561b8
push dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
push esi
push 0x43
pop eax
mov ecx, ebx
call fcn.0045624d
mov eax, dword [ebp - 0x18]
mov ecx, ebx
call fcn.0044f9fb
push dword [ebp - 8]
mov ecx, ebx
push esi
push 0x36
pop eax
call fcn.0045624d
add esp, 0x40
push 1
mov ecx, ebx
call fcn.0045622a
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov ecx, ebx
call fcn.0044f9fb
push dword [ebp - 8]
mov ecx, ebx
push esi
push 0x3d
pop eax
call fcn.0045624d
mov eax, dword [ebp - 0x1c]
mov ecx, ebx
call fcn.0044f9fb
mov eax, dword [ebp - 0x18]
mov ecx, ebx
call fcn.0044f9fb
push dword [ebp - 4]
mov ecx, ebx
push 2
push dword [ebp - 0x20]
push 0x1e
pop eax
call fcn.004561b8
push dword [ebp - 8]
mov ecx, ebx
push dword [ebp - 4]
push esi
push 0x37
pop eax
call fcn.004561b8
mov dl, 8
mov ecx, ebx
call fcn.0044f9e9
push 0x2b
mov ecx, ebx
call fcn.0045622a
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
add esp, 0x28
call fcn.004509e6
mov edi, dword [edi]
cmp edi, esi
jne 0x45fd90
pop edi
pop esi
pop ebx
leave
ret
Function at 0x462b39
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, eax
mov eax, dword [edi]
push 0x24
mov dword [ebp - 4], eax
xor ebx, ebx
lea eax, [ebp - 0x2c]
push ebx
push eax
call fcn.0048e0e0
mov eax, dword [ebp + 0x14]
add esp, 0xc
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], edi
call fcn.00462af2
test eax, eax
jne 0x462c48
mov eax, dword [ebp + 0x18]
lea ecx, [ebp - 0x2c]
call fcn.00462af2
test eax, eax
jne 0x462c48
mov eax, dword [ebp + 0x1c]
lea ecx, [ebp - 0x2c]
call fcn.00462af2
test eax, eax
jne 0x462c48
cmp esi, ebx
je 0x462bc1
cmp byte [esi], 0x5e
jne 0x462ba7
mov eax, dword [esi + 4]
jmp 0x462ba9
xor eax, eax
push ebx
push ebx
push eax
push dword [ebp + 0xc]
mov eax, edi
call fcn.00457dc9
add esp, 0x10
test eax, eax
jne 0x462c4b
call fcn.0045c77d
push 4
pop esi
mov ecx, edi
mov dword [ebp - 8], eax
call fcn.00450a1a
mov ebx, eax
mov eax, dword [ebp + 0x14]
mov edi, ebx
mov esi, ecx
call fcn.00457673
mov eax, dword [ebp + 0x18]
lea edi, [ebx + 1]
call fcn.00457673
mov eax, dword [ebp + 0x1c]
lea edi, [ebx + 2]
call fcn.00457673
mov edi, dword [ebp - 8]
test edi, edi
je 0x462c4b
mov esi, dword [ebp + 0x10]
lea eax, [ebx + 3]
push eax
movsx eax, word [esi]
sub ebx, eax
add ebx, 3
push ebx
push 0
push 0x12
pop eax
mov ecx, edi
call fcn.004561b8
mov dl, byte [esi]
mov ecx, edi
call fcn.0044f9e9
push 0xfffffffffffffffb
push esi
push edi
or eax, 0xffffffff
call fcn.00456496
xor eax, eax
cmp dword [ebp + 0xc], 0x18
mov ecx, edi
sete al
push eax
push 0x7a
pop eax
call fcn.0045623c
add esp, 0x1c
jmp 0x462c4b
inc dword [edi + 0x40]
push dword [ebp + 0x14]
push dword [ebp - 4]
call fcn.004572b8
push dword [ebp + 0x18]
push dword [ebp - 4]
call fcn.004572b8
push dword [ebp + 0x1c]
push dword [ebp - 4]
call fcn.004572b8
add esp, 0x18
pop edi
pop esi
pop ebx
leave
ret
Function at 0x464aab
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [edi + 0x1c], 0
jne 0x464b24
mov ecx, dword [edi + 0xc]
push esi
mov esi, eax
imul esi, esi, 0x18
lea eax, [ebp - 4]
push eax
add ecx, esi
movzx eax, byte [ecx + 0x16]
push eax
mov eax, ebx
call fcn.0044ff43
mov eax, dword [eax + 8]
mov eax, dword [eax + 0xc]
movzx eax, byte [eax + 0x4d]
push eax
push dword [ecx + 4]
mov eax, ebx
call fcn.0044ff43
push eax
call fcn.0046127c
add esp, 0x14
cmp dword [ebp - 4], 0
je 0x464b05
push 0xfffffffffffffff8
push dword [ebp - 4]
or eax, 0xffffffff
push ebx
call fcn.00456496
add esp, 0xc
cmp dword [ebp + 8], 0
jl 0x464b23
mov eax, dword [edi + 0xc]
cmp byte [esi + eax + 0x16], 0x65
jne 0x464b23
push dword [ebp + 8]
mov ecx, ebx
push 0x16
pop eax
call fcn.0045623c
pop ecx
pop esi
leave
ret