joyce8/EMBER2024-capa huggingface dataset:
Function at 0x444700
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push 0
push 0x80
push 3
push 0
push 1
push 0xc0000000
lea eax, [ebp + 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [esp + 0x10], esi
cmp esi, 0xffffffff
jne 0x44473d
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
pop ebp
pop ecx
ret 4
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x44476a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
pop ecx
ret 4
test edi, edi
jne 0x444788
push esi
mov dword [esp + 0x10], 0x54f
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
pop ecx
ret 4
push ebx
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, dword [esp + 0x18]
xor ebx, ebx
push ebx
lea ecx, [esp + 0x14]
push ecx
mov esi, eax
push edi
push esi
push edx
mov dword [ebp + 4], esi
mov dword [ebp + 0x434], esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4447c7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x4447e9
cmp dword [esp + 0x10], edi
je 0x4447d4
mov ebx, 0x1e
jmp 0x4447e9
xor eax, eax
test edi, edi
jbe 0x4447e9
lea ebx, [ebx]
xor byte [eax + esi], 0x67
inc eax
cmp eax, edi
jb 0x4447e0
mov dword [esp + 0x10], ebx
test ebx, ebx
jne 0x444863
mov esi, dword [ebp + 4]
mov eax, edi
shr eax, 1
test esi, esi
je 0x444839
cmp eax, 0x7fffffff
ja 0x444839
mov edx, eax
mov ecx, esi
test eax, eax
je 0x444824
jmp 0x444810
cmp word [ecx], 0
je 0x444820
add ecx, 2
sub edx, 1
jne 0x444810
jmp 0x444824
test edx, edx
jne 0x444835
mov ebx, 0x80070057
xor eax, eax
mov ecx, ebx
test ebx, ebx
jl 0x44483e
add eax, eax
jmp 0x444840
sub eax, edx
jmp 0x44482b
mov ecx, 0x80070057
xor eax, eax
test ecx, ecx
jl 0x444863
add eax, 2
lea ecx, [eax + 4]
cmp ecx, edi
ja 0x444863
mov edx, dword [esi + eax]
sub edi, eax
lea ecx, [esi + eax + 4]
sub edi, 4
mov dword [ebp + 0x14], edx
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x10], edi
mov esi, dword [esp + 0x18]
pop ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
pop ecx
ret 4
Function at 0x444a20
Capabilities:
Check if file exists
Create directory
Get file attributes
Link many functions at runtime

Disassembly:
push esi
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RtlNtStatusToDosError
push eax
mov dword [0x512d08], eax
call esi
mov dword [0x512d0c], eax
mov eax, dword [0x512d08]
push str.ZwQueryInformationFile
push eax
call esi
mov ecx, dword [0x512d08]
push str.ZwCreateFile
push ecx
mov dword [0x512d1c], eax
call esi
mov edx, dword [0x512d08]
push str.RtlInitUnicodeString
push edx
mov dword [0x512d14], eax
call esi
mov dword [0x512d10], eax
mov eax, dword [0x512d08]
push str.ZwSetInformationFile
push eax
call esi
mov ecx, dword [esp + 8]
mov dword [0x512d18], eax
push ecx
mov eax, SysReAllocString
mov ecx, 0x104
mov edx, 0x512b00
call fcn.00442cb0
pop esi
test eax, eax
jge 0x444ab9
xor edx, edx
mov word [0x512b00], dx
lea eax, [edx + 0x57]
ret
push 0x512b00
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x444ae0
push 0
push 0x512b00
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x444ae0
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
ret

Function at 0x444d00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x210
mov eax, dword [0x4ff0f4]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push esi
push ebx
xor esi, esi
call ebp
cmp eax, 0xffffffff
jne 0x444e31
push edi
mov esi, 3
mov dword [esp + 0xc], 0
test ebx, ebx
je 0x444d58
lea edi, [esp + 0xc]
mov ecx, 0x104
mov edx, ebx
call fcn.00442c70
test eax, eax
jl 0x444d5d
mov ecx, dword [esp + 0xc]
add ecx, ecx
jmp 0x444d5f
mov eax, 0x80070057
xor ecx, ecx
test eax, eax
jne 0x444d73
shr ecx, 1
je 0x444d73
cmp word [ebx + ecx*2], 0x5c
je 0x444d8d
sub ecx, 1
jne 0x444d67
pop edi
mov eax, esi
pop esi
pop ebp
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.004a9c1c
add esp, 0x210
ret
lea edi, [ebx + ecx*2]
test edi, edi
je 0x444d73
lea eax, [esp + 0x10]
mov esi, 0x512b00
mov ecx, eax
mov edx, 0x104
sub esi, ecx
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x444dc6
movzx ecx, word [esi + eax]
test cx, cx
je 0x444dc6
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x444da6
jmp 0x444dca
test edx, edx
jne 0x444dcd
sub eax, 2
xor edx, edx
push edi
lea esi, [esp + 0x14]
mov word [eax], dx
call fcn.00442c30
mov eax, esi
push eax
call ebp
cmp eax, 0xffffffff
je 0x444e14
mov ecx, esi
push ecx
mov eax, SysReAllocString
mov ecx, 0x104
mov edx, ebx
call fcn.00442cb0
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.004a9c1c
add esp, 0x210
ret
pop edi
pop esi
mov eax, 3
pop ebp
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.004a9c1c
add esp, 0x210
ret
mov ecx, dword [esp + 0x214]
mov eax, esi
pop esi
pop ebp
xor ecx, esp
call fcn.004a9c1c
add esp, 0x210
ret
Function at 0x445a50
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x680
mov eax, dword [0x4ff0f4]
xor eax, esp
mov dword [esp + 0x67c], eax
mov eax, dword [esp + 0x684]
push ebx
push ebp
push esi
mov dword [esp + 0x10], eax
lea eax, [esp + 0x274]
mov esi, 0x512b00
mov ecx, eax
push edi
mov edx, 0x104
sub esi, ecx
jmp 0x445a90
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x445ab0
movzx ecx, word [esi + eax]
test cx, cx
je 0x445ab0
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x445a90
jmp 0x445ab4
test edx, edx
jne 0x445ab7
sub eax, 2
xor edx, edx
mov word [eax], dx
lea edi, [esp + 0x10]
mov ecx, 0x104
lea edx, [esp + 0x278]
call fcn.00442c70
test eax, eax
jl 0x445af6
mov eax, dword [esp + 0x10]
mov ecx, 0x104
sub ecx, eax
lea edx, [esp + eax*2 + 0x278]
push str..Q
mov eax, SysReAllocString
call fcn.00442cb0
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x27c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x445bb5
mov edi, dword [sym.imp.RPCRT4.dll_UuidFromStringW]
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov ecx, 0x104
lea eax, [esp + 0x54]
lea esp, [esp]
cmp word [eax], 0
je 0x445b40
add eax, 2
sub ecx, 1
jne 0x445b30
jmp 0x445b9e
test ecx, ecx
je 0x445b9e
mov eax, 0x104
sub eax, ecx
add eax, eax
shr eax, 1
sub eax, 4
lea esi, [eax + eax]
push esi
lea edx, [esp + 0x5a]
push edx
lea eax, [esp + 0x488]
push eax
call fcn.004acac0
add esp, 0xc
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x484]
xor ecx, ecx
push eax
mov word [esp + esi + 0x488], cx
call edi
test eax, eax
jne 0x445b9e
mov ecx, dword [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.00404b90
add esp, 8
test al, al
je 0x445bb5
lea eax, [esp + 0x28]
push eax
push ebx
call ebp
test eax, eax
jne 0x445b20
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x68c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.004a9c1c
add esp, 0x680
ret
Function at 0x446340
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4cd6a4
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4ff0f4]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x34]
mov ebp, dword [esp + 0x30]
xor esi, esi
mov dword [esp + 0x18], esi
cmp dword [ebp], esi
jne 0x44637f
call fcn.00445db0
mov eax, dword [ebp + 4]
cmp eax, esi
jne 0x44638b
call fcn.00445db0
push eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x34], esi
call fcn.004a004c
add esp, 4
cmp eax, 6
jne 0x446478
jmp 0x4463b0
cmp dword [esp + 0x14], 0x3e8
jg 0x446478
cmp dword [esp + 0x30], 3
jg 0x446478
push esi
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 8
mov edi, eax
call fcn.004aac11
mov esi, eax
add esp, 4
mov dword [esp + 0x1c], esi
mov dword [esp + 0x28], 1
test esi, esi
je 0x446406
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [esi], edi
mov dword [esi + 4], eax
jmp 0x446408
xor esi, esi
mov byte [esp + 0x28], 0
mov eax, dword [ebp]
push esi
push 0x445bf0
push eax
call fcn.0047b773
add esp, 0xc
nop
push 1
push 0x1388
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
cmp eax, 0xc0
je 0x446420
test eax, eax
je 0x44643d
inc dword [esp + 0x30]
mov ecx, dword [ebp]
push 0
push 0
push ecx
call fcn.0047b773
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp + 4]
inc dword [esp + 0x14]
push edx
call fcn.00493c29
mov eax, dword [ebp + 4]
push eax
call fcn.004a004c
add esp, 8
xor esi, esi
cmp eax, 6
je 0x4463b0
cmp eax, 0x65
jne 0x4464c0
mov eax, dword [ebp + 4]
mov ecx, dword [ebp]
push eax
mov dword [ebx], ecx
mov dword [ebx + 4], eax
mov byte [ebx + 8], 1
call fcn.0045e565
add esp, 4
mov dword [ebx + 0xc], eax
mov byte [ebx + 0x10], 0
mov dword [esp + 0x28], esi
mov dword [esp + 0x18], 1
mov eax, ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 8
cmp eax, 0x64
mov eax, dword [ebp + 4]
push eax
jne 0x4464e6
mov edx, dword [ebp]
mov dword [ebx], edx
mov dword [ebx + 4], eax
mov byte [ebx + 8], 0
call fcn.0045e565
add esp, 4
mov dword [ebx + 0xc], eax
mov byte [ebx + 0x10], 0
jmp 0x44649c
call fcn.00493c29
mov ecx, dword [ebp]
push ecx
mov esi, eax
call fcn.00471f19
add esp, 8
push 0x4eff3c
lea edx, [esp + 0x34]
push edx
mov dword [esp + 0x38], esi
call fcn.004ac631
int3
Function at 0x446820
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4cd6a4
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4ff0f4]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
xor eax, eax
mov dword [esp + 0x18], eax
cmp dword [ebp], eax
jne 0x44685b
call fcn.00445db0
mov dword [esp + 0x14], eax
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x38]
push eax
mov ebx, ebp
call fcn.00446a00
mov ebx, eax
push ebx
call fcn.004a004c
add esp, 4
cmp eax, 6
jne 0x446956
cmp dword [esp + 0x14], 0x3e8
jg 0x446956
cmp dword [esp + 0x30], 3
jg 0x446956
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 8
mov edi, eax
call fcn.004aac11
mov esi, eax
add esp, 4
mov dword [esp + 0x1c], esi
mov dword [esp + 0x28], 1
test esi, esi
je 0x4468dc
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [esi], edi
mov dword [esi + 4], eax
jmp 0x4468de
xor esi, esi
mov byte [esp + 0x28], 0
mov ecx, dword [ebp]
push esi
push 0x445bf0
push ecx
call fcn.0047b773
add esp, 0xc
push 1
push 0x1388
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
cmp eax, 0xc0
je 0x4468f5
test eax, eax
je 0x446912
inc dword [esp + 0x30]
mov edx, dword [ebp]
push 0
push 0
push edx
call fcn.0047b773
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [esp + 0x14]
push ebx
call fcn.00493bdb
mov eax, dword [esp + 0x3c]
add esp, 4
push eax
mov ebx, ebp
call fcn.00446a00
mov ebx, eax
push ebx
call fcn.004a004c
add esp, 4
cmp eax, 6
je 0x446883
push ebx
cmp eax, 0x65
jne 0x4469a3
mov ecx, dword [ebp]
mov esi, dword [esp + 0x38]
mov dword [esi], ecx
mov dword [esi + 4], ebx
mov byte [esi + 8], 1
call fcn.0045e565
add esp, 4
mov dword [esi + 0xc], eax
mov byte [esi + 0x10], 1
mov dword [esp + 0x28], 0
mov dword [esp + 0x18], 1
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0xc
cmp eax, 0x64
jne 0x4469d9
mov edx, dword [ebp]
mov esi, dword [esp + 0x38]
mov dword [esi], edx
mov dword [esi + 4], ebx
mov byte [esi + 8], 0
call fcn.0045e565
mov dword [esi + 0xc], eax
mov eax, 1
add esp, 4
mov byte [esi + 0x10], al
mov dword [esp + 0x28], 0
mov dword [esp + 0x18], eax
jmp 0x44698b
call fcn.00493bdb
mov esi, eax
mov eax, dword [ebp]
push eax
call fcn.00471f19
add esp, 8
push 0x4eff3c
lea ecx, [esp + 0x3c]
push ecx
mov dword [esp + 0x40], esi
call fcn.004ac631
int3
Function at 0x447410
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4cd5ef
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4ff0f4]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea edi, [esi + 0x2c]
mov dword [esi], vtable.ServiceWrapper.0
mov ebp, 7
xor ebx, ebx
xor eax, eax
mov dword [edi + 0x18], ebp
mov dword [edi + 0x14], ebx
mov word [edi + 4], ax
mov dword [esp + 0x1c], ebx
mov eax, dword [esp + 0x2c]
push 0xffffffffffffffff
lea ecx, [esi + 0x48]
push ebx
xor edx, edx
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push eax
mov word [ecx + 4], dx
call fcn.00407a40
mov byte [esp + 0x1c], 1
mov eax, dword [esp + 0x30]
push 0xffffffffffffffff
lea ecx, [esi + 0x64]
push ebx
xor edx, edx
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push eax
mov word [ecx + 4], dx
call fcn.00407a40
mov byte [esp + 0x1c], 2
mov eax, dword [esp + 0x34]
push 0xffffffffffffffff
lea ecx, [esi + 0x80]
push ebx
xor edx, edx
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push eax
mov word [ecx + 4], dx
call fcn.00407a40
mov byte [esp + 0x1c], 3
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [esp + 0x28]
push 0xffffffffffffffff
push ebx
push ecx
mov ecx, edi
mov dword [esi + 0x28], eax
mov byte [esi + 0x24], bl
mov dword [0x512d20], esi
call fcn.00407a40
mov byte [esi + 0x24], bl
mov dword [esp + 0x1c], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x14

Function at 0x447670
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x4ff0f4]
xor eax, esp
mov dword [esp + 0x114], eax
cmp byte [esi + 0x24], 0
je 0x4476a3
mov al, 1
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.004a9c1c
add esp, 0x118
ret 4
cmp edi, 2
jne 0x4476b1
mov dword [esi + 0xc], 0
jmp 0x4476f2
push 0x114
lea eax, [esp + 4]
push 0
push eax
call fcn.004ac890
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4476eb
cmp dword [esp + 4], 6
jb 0x4476eb
mov dword [esi + 0xc], 0x185
jmp 0x4476f2
mov dword [esi + 0xc], 0x85
mov edx, dword [esp + 0x11c]
mov dword [esi + 8], edi
mov dword [esi + 0x10], 0
mov dword [esi + 0x1c], edx
cmp edi, 4
je 0x447720
cmp edi, 1
je 0x447720
mov eax, dword [0x50148c]
inc eax
mov dword [0x50148c], eax
mov dword [esi + 0x18], eax
jmp 0x447727
mov dword [esi + 0x18], 0
mov ecx, dword [esi + 0x20]
lea eax, [esi + 4]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov ecx, dword [esp + 0x114]
test eax, eax
setne al
xor ecx, esp
call fcn.004a9c1c
add esp, 0x118
ret 4
Function at 0x447c90
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4c9f29
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebp
push esi
push edi
mov eax, dword [0x4ff0f4]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x3c]
xor ebp, ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x18], ebp
call fcn.004175f0
mov dword [esp + 0x34], ebp
push ebp
lea eax, [esp + 0x24]
push eax
push ebp
push ebx
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
mov eax, esi
je 0x447d25
call fcn.00440e50
mov eax, dword [esi]
push ebp
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x1c], edi
mov eax, dword [eax]
push edi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x447d1a
cmp dword [esp + 0x14], edi
je 0x447d23
xor edi, edi
mov eax, esi
call fcn.00440e50
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x28
ret

Function at 0x447d40
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push esi
xor esi, esi
xor ebp, ebp
push edi
test ebx, ebx
jb 0x447db6
ja 0x447d59
cmp esi, dword [esp + 0x20]
jae 0x447dba
mov ecx, dword [esp + 0x20]
sub ecx, esi
mov eax, ebx
sbb eax, ebp
test eax, eax
ja 0x447d75
jb 0x447d71
cmp ecx, 0x10000
jae 0x447d75
mov edi, ecx
jmp 0x447d7a
mov edi, 0x10000
mov ecx, dword [esp + 0x1c]
push 0
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x20]
push edi
lea edx, [esi + ecx]
push edx
push eax
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x447db6
mov eax, dword [esp + 0x10]
cmp eax, edi
jne 0x447db6
add esi, eax
adc ebp, 0
cmp ebp, ebx
jb 0x447d59
ja 0x447db6
cmp esi, dword [esp + 0x20]
jb 0x447d59
cmp esi, dword [esp + 0x20]
jne 0x447dd7
cmp ebp, ebx
jne 0x447dd7
or esi, ebp
je 0x447dcf
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret

Function at 0x447ef0
Capabilities:
Get file size

Disassembly:
sub esp, 0xc
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
lea eax, [esp]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x447f16
mov eax, dword [esp]
mov edx, dword [esp + 4]
add esp, 0xc
ret
or eax, 0xffffffff
or edx, 0xffffffff
add esp, 0xc
ret
Function at 0x448230
Capabilities:
Get file size

Disassembly:
push 0xffffffffffffffff
push 0x4cb0d1
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x4ff0f4]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [esp + 0x34]
xor edi, edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x1c], edi
call fcn.004175f0
mov dword [esp + 0x2c], edi
lea eax, [esp + 0x14]
push eax
push ebx
mov dword [esp + 0x24], 1
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x44832e
mov ecx, dword [esp + 0x14]
mov edx, ecx
and edx, dword [esp + 0x18]
cmp edx, 0xffffffff
je 0x44832e
lea eax, [esp + 0x14]
push eax
call fcn.00447c90
add esp, 4
mov ebx, eax
mov dword [esp + 0x2c], 1
mov edi, dword [esi]
add dword [edi + 8], 0xffffffff
jne 0x4482e1
cmp dword [edi + 4], 0
je 0x4482e1
mov eax, dword [edi]
push 0
push eax
call fcn.004aa78c
add esp, 8
mov dword [edi], eax
mov dword [edi + 4], 0
mov eax, dword [ebx]
inc dword [eax + 8]
mov dword [esi], eax
mov byte [esp + 0x2c], 0
mov edi, dword [esp + 0x14]
dec dword [edi + 8]
cmp dword [edi + 8], 0
lea eax, [edi + 8]
jne 0x44832e
cmp dword [edi + 4], 0
je 0x448319
mov eax, dword [edi]
push 0
push eax
call fcn.004aa78c
add esp, 8
mov dword [edi], eax
mov dword [edi + 4], 0
mov ecx, dword [esp + 0x14]
push ecx
call fcn.004a9c11
add esp, 4
mov dword [esp + 0x14], 0
mov eax, esi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x20
ret

Function at 0x4498a0
Capabilities:
Compare security identifiers

Disassembly:
push 0xffffffffffffffff
push 0x4c8a28
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4ff0f4]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, dword [0x512a38]
xor esi, esi
cmp dword [edi], esi
je 0x449970
mov dword [esp + 0x10], esi
mov dword [esp + 0x20], esi
mov eax, dword [esp + 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esp + 0x14], esi
cmp eax, esi
je 0x4498f7
push eax
call ebx
mov dword [esp + 0x10], esi
mov edx, dword [esp + 0x28]
lea eax, [esp + 0x10]
push eax
push esi
push esi
push esi
lea ecx, [esp + 0x24]
push ecx
push 1
push 1
push edx
call dword [sym.imp.ADVAPI32.dll_GetSecurityInfo]
test eax, eax
jne 0x44995d
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x44995d
cmp dword [esp + 0x10], esi
je 0x44995d
mov ecx, dword [edi]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x44995d
mov dword [esp + 0x20], 0xffffffff
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x449946
push eax
call ebx
mov al, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 4
mov dword [esp + 0x20], 0xffffffff
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x449970
push eax
call ebx
xor al, al
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 4
Function at 0x4499a0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4cd501
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4ff0f4]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x18], ebx
mov ecx, dword [esp + 0x2c]
call fcn.00404dc0
mov dword [esp + 0x24], ebx
lea eax, [esp + 0x14]
mov ebp, 1
push eax
mov edi, 0x400
mov dword [esp + 0x1c], ebp
call fcn.004191d0
mov dword [esp + 0x24], ebp
mov ecx, dword [esp + 0x30]
mov esi, dword [esp + 0x14]
mov eax, dword [esi]
push ebp
push ecx
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x449a4e
mov edx, dword [esi]
cmp edx, ebx
jne 0x449a29
mov ebp, dword [esp + 0x2c]
xor eax, eax
push eax
push edx
mov ecx, ebp
call fcn.00408cb0
jmp 0x449a52
mov eax, edx
lea edi, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x449a30
mov ebp, dword [esp + 0x2c]
sub eax, edi
sar eax, 1
push eax
push edx
mov ecx, ebp
call fcn.00408cb0
jmp 0x449a52
mov ebp, dword [esp + 0x2c]
mov byte [esp + 0x24], bl
add dword [esi + 8], 0xffffffff
jne 0x449a70
xor edi, edi
call fcn.0041ba30
push esi
call fcn.004a9c11
add esp, 4
mov dword [esp + 0x14], ebx
mov eax, ebp
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x449c70
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4ce742
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4ff0f4]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, ecx
push 0x4eada4
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], 0
call fcn.00405480
mov ebx, 1
mov dword [esp + 0x24], ebx
lea eax, [esp + 0x14]
lea ecx, [edi + 0x25c]
push eax
call fcn.00407770
mov byte [esp + 0x24], 0
lea ecx, [esp + 0x14]
call fcn.00404f30
mov ebp, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp byte [edi + 8], 0
jne 0x449d11
mov eax, dword [edi]
lea ecx, [edi + 0xc]
push ecx
push eax
mov byte [edi + 8], bl
call ebp
mov esi, eax
mov eax, dword [edi + 0x260]
cmp esi, eax
je 0x449d06
cmp eax, 0xffffffff
je 0x449d06
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [edi + 0x260], esi
cmp esi, 0xffffffff
jmp 0x449d29
mov eax, dword [edi + 0x260]
cmp eax, 0xffffffff
je 0x449d46
lea edx, [edi + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x449d46
lea esi, [edi + 0x38]
call fcn.00447f20
test al, al
jne 0x449cdc
lea eax, [edi + 4]
push eax
lea ecx, [edi + 0x25c]
call fcn.00407770
mov esi, dword [esp + 0x2c]
add edi, 0xc
push edi
push esi
call fcn.00449d80
mov dword [esp + 0x24], 0
mov dword [esp + 0x18], ebx
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4