joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439642
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov dword [ebp - 4], edx
xor ebx, ebx
push edi
xor edx, edx
call fcn.0043727c
mov edi, eax
test edi, edi
je 0x4396ac
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov dword [ebp - 8], ecx
cmp esi, 0xffffffff
je 0x439684
test esi, 0x400
je 0x439684
xor eax, eax
inc eax
jmp 0x439686
xor eax, eax
mov edx, dword [ebp - 4]
xor ebx, ebx
test ecx, ecx
push edi
push 0
mov dword [edx], eax
sete bl
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
pop edi
mov eax, ebx
pop ebx
leave
ret
Function at 0x43a8d6
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x48ec38]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor esi, esi
mov dword [ebp - 0x25c], edx
push edi
inc esi
xor edi, edi
test ecx, ecx
je 0x43a9fb
cmp word [ecx], di
je 0x43a9fb
mov edx, 0x409718
call fcn.0043b0c8
mov ebx, eax
test ebx, ebx
jne 0x43a921
push 8
jmp 0x43a9fd
lea eax, [ebp - 0x258]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x43a9e9
mov eax, dword [ebp - 0x25c]
mov dword [eax], esi
test byte [ebp - 0x258], 0x10
je 0x43a9d9
mov ecx, 0x407390
lea eax, [ebp - 0x22c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x43a980
test dx, dx
je 0x43a97c
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x43a980
add eax, 4
add ecx, 4
test dx, dx
jne 0x43a95a
xor eax, eax
jmp 0x43a984
sbb eax, eax
or eax, esi
test eax, eax
je 0x43a9c1
mov ecx, 0x406f00
lea eax, [ebp - 0x22c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x43a9b9
test dx, dx
je 0x43a9b5
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x43a9b9
add eax, 4
add ecx, 4
test dx, dx
jne 0x43a993
xor eax, eax
jmp 0x43a9bd
sbb eax, eax
or eax, esi
test eax, eax
jne 0x43a9d9
lea eax, [ebp - 0x258]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x43a942
jmp 0x43a9e2
mov eax, dword [ebp - 0x25c]
and dword [eax], 0
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x43aa05
push 0x57
mov esi, edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047d650
leave
ret

Function at 0x43ae7d
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x48ec38]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x208], eax
xor eax, eax
push 0x200
push eax
lea eax, [ebp - 0x204]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
test esi, esi
je 0x43af4c
xor ecx, ecx
cmp word [esi], cx
je 0x43af4c
test edi, edi
je 0x43af44
cmp word [edi], cx
je 0x43af44
mov eax, dword [ebp - 0x208]
test eax, eax
je 0x43af20
cmp word [eax], cx
je 0x43af20
push esi
push 0x100
lea ecx, [ebp - 0x204]
push ecx
push 0x40e9e0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test ebx, ebx
je 0x43af34
xor eax, eax
cmp word [ebx], ax
je 0x43af34
lea eax, [ebp - 0x204]
push ebx
push eax
call sub.msvcrt.dll__wcsicmp
neg eax
pop ecx
sbb eax, eax
pop ecx
inc eax
jmp 0x43af4e
push esi
push 0x100
lea eax, [ebp - 0x204]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
xor ecx, ecx
xor eax, eax
cmp cx, word [ebp - 0x204]
setne al
jmp 0x43af4e
push esi
call fcn.00438e87
jmp 0x43af4e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047d650
leave
ret 0x10
Function at 0x43af65
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
mov dword [ebp - 8], edx
push esi
xor esi, esi
mov dword [ebp - 4], ecx
cmp dword [ebp + 0x14], ebx
push edi
setne bl
mov edi, 0x80
inc ebx
add edi, edi
test esi, esi
je 0x43af9b
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
lea eax, [edi + edi]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x43afdf
cmp dword [ebp + 0x10], 0
push dword [ebp - 4]
push edi
push esi
je 0x43afca
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
jmp 0x43afdb
push 0x40e9e0
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, eax
jmp 0x43afe1
xor ecx, ecx
mov eax, edi
sub eax, ebx
cmp ecx, eax
jae 0x43af85
test esi, esi
je 0x43b008
test ecx, ecx
jne 0x43b008
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
neg eax
sbb eax, eax
not eax
and esi, eax
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x14

Function at 0x43b71d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
xor ebx, ebx
mov dword [ebp - 4], ebx
test edi, edi
je 0x43b756
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43b752
mov eax, dword [ebp - 4]
test eax, eax
jne 0x43b75e
mov esi, ebx
jmp 0x43b789
mov eax, reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], eax
cmp dword [ebp + 8], ebx
je 0x43b77b
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
neg eax
sbb esi, esi
mov eax, dword [ebp - 4]
inc esi
jmp 0x43b77e
xor esi, esi
inc esi
test edi, edi
je 0x43b789
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4

Function at 0x43b79f
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push eax
push 0x20006
push 0
push 0x412edc
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x43b7e4
push 0x412ec0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
test esi, esi
pop esi
sete al
leave
ret 4
Function at 0x43b7fd
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push edi
xor edi, edi
mov dword [ebp - 0xc], 4
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x10], edi
test ecx, ecx
jne 0x43b820
push 0x57
jmp 0x43b884
lea eax, [ebp - 4]
push eax
push 0x20019
push edi
push 0x40ea04
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43b883
cmp dword [ebp - 4], edi
je 0x43b883
push esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push edi
push 0x40e9f4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x43b86a
cmp dword [ebp - 0xc], 4
je 0x43b86d
push 0xd
pop esi
mov dword [ebp - 8], edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 8]
pop esi
jmp 0x43b88c
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
leave
ret 4

Function at 0x43b897
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 1
push esi
push edi
test edx, edx
je 0x43b8ff
lea eax, [ebp - 0xc]
xor edi, edi
push eax
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
push edi
push 0x20006
push edi
push 0x40e9e0
push edi
push edx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
jne 0x43b91b
push 4
lea eax, [ebp - 8]
push eax
push 4
push edi
push 0x4137ac
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x43b91b
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push 0x4137ac
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
test esi, esi
pop edi
sete al
pop esi
leave
ret 8
Function at 0x43ec4d
Capabilities:
Delete file

Disassembly:
push 0
mov eax, 0x48a5dd
call fcn.0047dc56
mov esi, ecx
lea ecx, [esi + 0x48]
mov dword [esi], 0x4026d8
mov dword [esi + 4], 0x402730
call fcn.0045f40e
xor edi, edi
cmp dword [esi + 0x50], edi
je 0x43eca5
push ecx
lea ecx, [esi + 0x38]
call fcn.0041a5f4
push ecx
lea ecx, [esi + 0x3c]
call fcn.0041a5f4
cmp dword [esi + 0x2c], edi
je 0x43ec97
push dword [esi + 0x2c]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esi + 0x30], edi
je 0x43eca5
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 4], edi
lea ecx, [esi + 0x3c]
call fcn.0043239d
mov dword [ebp - 4], 1
lea ecx, [esi + 0x38]
call fcn.0043239d
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 2
cmp dword [esi + 0x34], 0
je 0x43ecdb
push dword [esi + 0x34]
call fcn.0043220c
mov dword [esi + 0x34], edi
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 3
cmp dword [esi + 0x30], 0
je 0x43ecf7
push dword [esi + 0x30]
call fcn.0043220c
mov dword [esi + 0x30], edi
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 4
cmp dword [esi + 0x2c], 0
je 0x43ed13
push dword [esi + 0x2c]
call fcn.0043220c
mov dword [esi + 0x2c], edi
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.0045610b
call fcn.0047dc27
ret
Function at 0x455f5e
Capabilities:
Shutdown system

Disassembly:
push 8
mov eax, 0x48ab4f
call fcn.0047dc56
mov ebx, edx
mov edi, ecx
and dword [ebp - 4], 0
and dword [ebp - 0x14], 0
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x10], 0x13
test edi, edi
je 0x455f9e
cmp edi, 1
je 0x455f9e
cmp edi, 2
je 0x455f9e
cmp edi, 3
je 0x455f9e
mov esi, 0x80070057
jmp 0x45602a
push 1
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
call fcn.0042ed9f
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
js 0x45602a
test edi, edi
je 0x455feb
cmp edi, 1
je 0x455feb
cmp edi, 2
je 0x455fc8
cmp edi, 3
jne 0x456030
lea eax, [ebp - 0x10]
push eax
xor eax, eax
cmp edi, 2
setne al
inc eax
push eax
call dword [sym.imp.ntdll.dll_NtShutdownSystem]
push eax
call fcn.004323eb
mov esi, dword [ebp - 0x10]
test eax, eax
je 0x45602a
jmp 0x456030
test ebx, ebx
jne 0x455ff4
mov ebx, 0x80030002
xor eax, eax
mov ecx, 0x411e74
test edi, edi
sete al
test edi, edi
je 0x456009
mov ecx, 0x411ea0
push ebx
push eax
push 1
push 0
push ecx
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownExW]
test eax, eax
jne 0x456030
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004324dd
mov esi, eax
push esi
call fcn.004321e3
push esi
call fcn.00432150
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00432fe4
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x14]
call fcn.00432fe4
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0047dc27
ret

Function at 0x45738e
Capabilities:
Print debug messages

Disassembly:
push 0xc
mov eax, 0x48abb8
call fcn.0047dc56
mov dword [ebp - 0x18], edx
mov edi, ecx
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 1
mov ebx, esi
mov dword [ebp - 0x10], ebx
or dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x4573ce
push esi
mov edi, esi
call fcn.004321e3
jmp 0x457477
sub edi, 1
je 0x4573fe
sub edi, 1
je 0x4573f7
sub edi, 1
je 0x4573f0
sub edi, 1
je 0x4573e9
mov edi, 0x411f30
jmp 0x457403
mov edi, 0x411f24
jmp 0x457403
mov edi, 0x411f14
jmp 0x457403
mov edi, 0x411f08
jmp 0x457403
mov edi, 0x411efc
lea ecx, [ebp - 0x14]
call fcn.00430cd0
mov esi, dword [ebp - 0x14]
test eax, eax
js 0x457440
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push dword [ebp - 0x18]
push edi
push eax
push esi
lea eax, [ebp - 0x10]
push 0x411f40
push eax
call fcn.0041a772
mov edi, eax
add esp, 0x18
test edi, edi
jns 0x45746d
push edi
call fcn.004321e3
mov ebx, dword [ebp - 0x10]
jmp 0x457477
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push dword [ebp - 0x18]
push edi
push eax
lea eax, [ebp - 0x10]
push 0x411f80
push eax
call fcn.0041a772
mov edi, eax
add esp, 0x14
test edi, edi
jns 0x45746d
push edi
call fcn.004321e3
mov esi, dword [ebp - 0x14]
jmp 0x45743b
mov ebx, dword [ebp - 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push edi
call fcn.00432150
mov dword [ebp - 4], 2
test ebx, ebx
je 0x45748e
push ebx
call fcn.0043220c
mov dword [ebp - 4], 3
test esi, esi
je 0x45749f
push esi
call fcn.0043220c
or dword [ebp - 4], 0xffffffff
mov eax, edi
call fcn.0047dc27
ret
Function at 0x457e20
Capabilities:
Hash data using sha1

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x49125c], 0
push ebx
jne 0x457e9f
push eax
push ebx
push ecx
push edx
xor eax, eax
cpuid
xor eax, eax
xor ebx, 0x756e6547
sete al
xor ebx, ebx
xor ecx, 0x6c65746e
sete bl
and eax, ebx
xor ecx, ecx
xor edx, 0x49656e69
sete cl
and eax, ecx
mov dword [ebp - 4], eax
mov eax, 1
cpuid
xor ecx, ecx
xor edx, edx
mov ebx, 0xff0
and ebx, eax
mov dword [ebp - 8], ebx
pop edx
pop ecx
pop ebx
pop eax
cmp dword [ebp - 4], 0
mov ecx, 1
je 0x457e93
cmp dword [ebp - 8], 0x660
sbb eax, eax
not eax
and ecx, eax
mov eax, dword [ecx*4 + 0x4029f8]
mov dword [0x49125c], eax
mov eax, dword [ebp + 8]
pop ebx
mov dword [eax + 0x54], 0
mov dword [eax + 0x58], 0
mov dword [eax + 0x40], 0x67452301
mov dword [eax + 0x44], 0xefcdab89
mov dword [eax + 0x48], 0x98badcfe
mov dword [eax + 0x4c], 0x10325476
mov dword [eax + 0x50], 0xc3d2e1f0
mov esp, ebp
pop ebp
ret 4
Function at 0x458d63
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
xor esi, esi
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x458d86
test al, 0x10
jne 0x458e2d
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x458e2d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x458dab
xor esi, esi
jmp 0x458e2d
movzx eax, word [edi]
mov ecx, edi
push ebx
xor ebx, ebx
test ax, ax
je 0x458e27
push 0x5c
mov edx, eax
pop edi
cmp dx, di
jne 0x458dc4
mov ebx, ecx
add ecx, 2
movzx eax, word [ecx]
mov edx, eax
test ax, ax
jne 0x458dbd
mov edi, dword [ebp - 4]
test ebx, ebx
je 0x458e27
xor eax, eax
xor edx, edx
mov ecx, edi
mov word [ebx], ax
call fcn.00458d63
mov esi, eax
push 0x5c
pop eax
mov word [ebx], ax
test esi, esi
js 0x458e2c
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x458e23
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0xb7
jne 0x458e14
xor esi, esi
inc esi
jmp 0x458e2c
test esi, esi
jle 0x458e2c
movzx esi, si
or esi, 0x80070000
jmp 0x458e2c
xor esi, esi
jmp 0x458e2c
mov esi, 0x80070003
pop ebx
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x459786
Capabilities:
Hash data via bcrypt
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x48ec38]
xor eax, esp
mov dword [esp + 0x38], eax
and dword [esp + 4], 0
xor eax, eax
push ebx
push esi
push edi
push 8
mov ebx, ecx
lea edi, [esp + 0x28]
pop ecx
push 0xa00000
rep stosd dword es:[edi], eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x4597d4
mov esi, 0x8007000e
jmp 0x459907
lea ecx, [esp + 0x10]
call fcn.004593b2
mov eax, dword [ebx + 0x10]
push ecx
mov ecx, dword [ebx]
push dword [eax + 0xc]
push dword [eax + 8]
call fcn.0047be6c
mov esi, eax
test esi, esi
js 0x459907
xor ecx, ecx
xor edx, edx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
mov eax, dword [ebx + 0x10]
mov eax, dword [eax + 0x10]
sub eax, ecx
mov dword [esp + 0x20], eax
mov eax, dword [ebx + 0x10]
mov eax, dword [eax + 0x14]
sbb eax, edx
test eax, eax
jb 0x45982f
ja 0x459828
cmp dword [esp + 0x20], 0xa00000
jbe 0x45982f
mov eax, 0xa00000
jmp 0x459837
mov eax, dword [ebx + 0x10]
mov eax, dword [eax + 0x10]
sub eax, ecx
and dword [esp + 0x14], 0
lea ecx, [esp + 0x14]
push 0
push ecx
push eax
push edi
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4598e9
push 0
push dword [esp + 0x18]
push edi
push dword [esp + 0x1c]
call dword [sym.imp.bcrypt.dll_BCryptHashData]
test eax, eax
jns 0x45986f
push 7
pop ecx
int 0x29
mov ecx, dword [esp + 0x18]
add ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
mov eax, dword [ebx + 0x10]
adc edx, 0
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
cmp edx, dword [eax + 0x14]
jb 0x459804
ja 0x45989d
cmp ecx, dword [eax + 0x10]
jb 0x459804
push 0
push 0x20
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x1c]
call dword [sym.imp.bcrypt.dll_BCryptFinishHash]
test eax, eax
jns 0x4598b9
push 7
pop ecx
int 0x29
push dword [esp + 0x10]
call dword [sym.imp.bcrypt.dll_BCryptDestroyHash]
and dword [esp + 0x10], 0
xor ecx, ecx
mov edx, dword [ebx + 0x10]
lea ebx, [esp + 0x24]
mov eax, dword [edx + ecx*4 + 0x18]
cmp eax, dword [ebx + ecx*4]
jne 0x4598e2
inc ecx
cmp ecx, 8
jne 0x4598d1
jmp 0x459921
mov esi, 0x80004005
jmp 0x459921
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x459900
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x459907
mov esi, 0x80004005
cmp dword [esp + 0x10], 0
je 0x45991d
push dword [esp + 0x10]
call dword [sym.imp.bcrypt.dll_BCryptDestroyHash]
and dword [esp + 0x10], 0
test edi, edi
je 0x459931
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [esp + 0x44]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0047d650
mov esp, ebp
pop ebp
ret 4
Function at 0x459c94
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
xor eax, eax
mov ebx, ecx
push edi
push ecx
push eax
mov ecx, dword [ebx]
mov edi, eax
push eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], eax
call fcn.0047be6c
mov esi, eax
test esi, esi
js 0x459dfa
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
test edi, edi
jne 0x459cfa
mov esi, 0x20000
push esi
push 8
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x459d1d
mov esi, 0x8007000e
jmp 0x459dfa
mov eax, dword [ebp - 0x10]
mov esi, eax
push eax
push edi
push 0
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
test eax, eax
je 0x459dee
mov edi, eax
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
and dword [ebp - 0x18], 0
push 0
push eax
mov eax, esi
sub eax, ecx
push eax
lea eax, [ecx + edi]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x459dce
lea eax, [ebp - 0x14]
mov edx, esi
push eax
lea eax, [ebp - 0xc]
mov ecx, edi
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00459e07
mov esi, eax
cmp esi, 0x8007007a
je 0x459cc8
test esi, esi
js 0x459df3
push dword [ebp - 0xc]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebx + 8], eax
test eax, eax
je 0x459dee
mov eax, dword [ebp - 4]
push dword [eax + 0x1c]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebx + 0xc], eax
test eax, eax
je 0x459dee
push dword [ebp - 0xc]
push dword [ebp - 4]
push dword [ebx + 8]
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 4]
add esp, 0xc
push dword [eax + 0x1c]
push dword [ebp - 0x14]
push dword [ebx + 0xc]
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x459df3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x459de5
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x459df3
mov esi, 0x80004005
jmp 0x459df3
mov esi, 0x8007000e
mov ecx, edi
call fcn.00459362
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x459e07
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, edx
xor esi, esi
mov edx, ecx
mov dword [edi], esi
cmp ebx, 0x40
jae 0x459e32
mov dword [edi], 0x138
mov esi, 0x8007007a
jmp 0x459f15
mov eax, 0x5a4d
cmp ax, word [edx]
jne 0x459f10
mov ecx, dword [edx + 0x3c]
cmp ebx, ecx
jae 0x459e51
lea eax, [ecx + 0xf8]
mov dword [edi], eax
jmp 0x459e28
lea eax, [ecx + edx]
cmp dword [eax], 0x4550
jne 0x459f10
movzx edi, word [eax + 6]
mov dword [ebp - 4], edi
movzx edi, word [eax + 0x14]
imul eax, dword [ebp - 4], 0x28
add eax, 0x18
add eax, ecx
add eax, edi
mov edi, dword [ebp + 8]
cmp ebx, eax
jb 0x459e4d
lea eax, [ecx + edx]
movzx edi, word [eax + 0x14]
lea ecx, [eax + 0x18]
add ecx, edi
mov eax, esi
mov dword [ebp - 8], ecx
cmp dword [ebp - 4], eax
jbe 0x459f10
cmp dword [ecx], 0x786f622e
jne 0x459ea4
cmp dword [ecx + 4], 0x64616f6c
je 0x459ead
inc eax
add ecx, 0x28
cmp eax, dword [ebp - 4]
jb 0x459e93
cmp dword [ebp - 4], eax
jbe 0x459f10
imul ecx, eax, 0x28
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov edi, ecx
mov ecx, dword [ecx + eax + 0x14]
mov eax, dword [edi + eax + 0x10]
mov edi, dword [ebp + 8]
add eax, ecx
cmp ebx, eax
jb 0x459e4d
add ecx, edx
cmp dword [ecx], 0xb0c50002
jne 0x459f10
mov eax, dword [ecx + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ecx + 0x1c]
add eax, dword [ecx + 0x20]
cmp ebx, eax
jb 0x459e4d
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov ecx, dword [eax + ecx + 8]
mov eax, dword [ebp + 0x10]
mov dword [eax], ecx
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0xc]
add ecx, edx
mov dword [eax], ecx
jmp 0x459f15
mov esi, 0x8007000d
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x10