joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431880
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x676300]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x3ff
mov esi, ecx
lea eax, [ebp - 0x403]
push 0
push eax
mov dword [esi], 0
mov dword [esi + 4], 0
mov byte [ebp - 0x404], 0
call fcn.00534b40
add esp, 0xc
push 0x400
lea ecx, [ebp - 0x404]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x404]
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4318e0
mov edx, dword [str.RzxIdinfoOpt.dll]
mov ecx, dword [0x57aa1c]
mov dword [eax], edx
mov edx, dword [0x57aa20]
mov dword [eax + 4], ecx
mov ecx, dword [0x57aa24]
mov dword [eax + 8], edx
mov dx, word [0x57aa28]
mov dword [eax + 0xc], ecx
mov word [eax + 0x10], dx
lea eax, [ebp - 0x404]
push eax
call fcn.004ee6fe
add esp, 4
test eax, eax
jne 0x431974
lea ecx, [ebp - 0x404]
push ecx
call fcn.004f05e1
lea eax, [ebp - 0x404]
add esp, 4
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x431940
mov edx, dword [0x57aa04]
mov ecx, dword [0x57aa08]
mov dword [eax], edx
mov edx, dword [0x57aa0c]
mov dword [eax + 4], ecx
mov ecx, dword [0x57aa10]
mov dword [eax + 8], edx
mov dl, byte [0x57aa14]
mov dword [eax + 0xc], ecx
mov byte [eax + 0x10], dl
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea eax, [ebp - 0x404]
push eax
call edi
lea ecx, [ebp - 0x404]
push ecx
call edi
mov dword [esi + 4], eax
pop edi
test eax, eax
je 0x4319a3
push str.RzxGetCurrentIdInfo
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi], eax
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00534bba
mov esp, ebp
pop ebp
ret
Function at 0x432070
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
mov eax, dword [0x676300]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [str.ExePath]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov ecx, 6
mov esi, str.SOFTWARERzxCorpSureName
lea edi, [ebp - 0x34]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x57aa88]
push 0x103
lea edx, [ebp - 0x137]
push 0
push edx
movsw word es:[edi], word [esi]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
mov byte [ebp - 0x138], 0
call fcn.00534b40
mov eax, dword [str.IpList.dll]
mov ecx, dword [0x57aa60]
mov edx, dword [0x57aa64]
add esp, 0xc
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x13c]
mov dword [ebp - 0xc], ecx
push eax
lea ecx, [ebp - 0x34]
push ecx
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x140], 0x104
mov dword [ebp - 8], edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x43216e
lea edx, [ebp - 0x140]
push edx
mov edx, dword [ebp - 0x13c]
lea eax, [ebp - 0x138]
push eax
push 0
push 0
lea ecx, [ebp - 0x18]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov eax, dword [ebp - 0x13c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x43216e
push 0x104
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x138]
push edx
call fcn.00537b90
lea eax, [ebp - 0x138]
push esi
push eax
call fcn.0053861d
add esp, 0x14
test eax, eax
je 0x43216e
mov byte [ebp - 0x138], 0
jmp 0x43217b
cmp byte [ebp - 0x138], 0
jne 0x43222d
push 0x104
lea ecx, [ebp - 0x138]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x104
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x138]
push eax
call fcn.00537b90
lea ecx, [ebp - 0x138]
push 0
push ecx
call fcn.0053861d
add esp, 0x14
test eax, eax
je 0x432203
push ebx
call fcn.004f05e1
add esp, 4
lea eax, [ebx - 1]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4321c3
mov edx, dword [0x57aa50]
mov dword [eax], edx
mov ecx, dword [0x57aa54]
mov dword [eax + 4], ecx
mov dx, word [0x57aa58]
pop edi
mov word [eax + 8], dx
mov cl, byte [0x57aa5a]
pop esi
mov byte [eax + 0xa], cl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00534bba
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x138]
mov edx, ebx
mov ecx, eax
sub edx, ecx
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x432210
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00534bba
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x138]
mov edx, ebx
mov ecx, eax
sub edx, ecx
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x432240
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00534bba
mov esp, ebp
pop ebp
ret 4
Function at 0x4322a0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x676300]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
mov esi, ecx
push 0x3ff
lea eax, [ebp - 0x403]
push ebx
push eax
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x48], ebx
mov byte [ebp - 0x404], bl
call fcn.00534b40
add esp, 0xc
lea ecx, [ebp - 0x404]
push ecx
mov ecx, esi
call fcn.00432070
lea edx, [ebp - 0x404]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esi + 0x48], eax
cmp eax, ebx
je 0x43242c
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.FindInfoByIP
push eax
call edi
mov dword [esi], eax
mov eax, dword [esi + 0x48]
push str.FindInfoByCustomerName_s
push eax
call edi
mov ecx, dword [esi + 0x48]
push str.FindInfoByHostName_s
push ecx
mov dword [esi + 4], eax
call edi
mov edx, dword [esi + 0x48]
push str.GetNextOnlineInfo_s
push edx
mov dword [esi + 8], eax
call edi
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x48]
push str.GetFirstOnlineInfoPos
push eax
call edi
mov ecx, dword [esi + 0x48]
push str.GetNextClientReg
push ecx
mov dword [esi + 0x10], eax
call edi
mov edx, dword [esi + 0x48]
push str.CloseClientRegFile
push edx
mov dword [esi + 0x14], eax
call edi
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x48]
push str.GetFirstClientRegPos
push eax
call edi
mov ecx, dword [esi + 0x48]
push str.OpenClientRegFile
push ecx
mov dword [esi + 0x1c], eax
call edi
mov edx, dword [esi + 0x48]
push str.FindInfoByIP_s
push edx
mov dword [esi + 0x20], eax
call edi
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x48]
push str.GetNextOnlineInfo
push eax
call edi
mov ecx, dword [esi + 0x48]
push str.IsLimitUseByIP
push ecx
mov dword [esi + 0x28], eax
call edi
mov edx, dword [esi + 0x48]
push str.IsUsed
push edx
mov dword [esi + 0x2c], eax
call edi
mov dword [esi + 0x30], eax
mov eax, dword [esi + 0x48]
push str.FindIPIsShowedCallbroad
push eax
call edi
mov ecx, dword [esi + 0x48]
push str.GetNewHostMachInfo
push ecx
mov dword [esi + 0x34], eax
call edi
mov edx, dword [esi + 0x48]
push str.GetHostNameByIP
push edx
mov dword [esi + 0x38], eax
call edi
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x48]
push str.GetOnlineCount
push eax
call edi
mov ecx, dword [esi + 0x48]
push str.getLimitIPInfoByIP
push ecx
mov dword [esi + 0x40], eax
call edi
mov dword [esi + 0x44], eax
pop edi
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00534bba
mov esp, ebp
pop ebp
ret
Function at 0x433340
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x676300]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0x57ae40
push 0x679040
call fcn.00536808
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x433382
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00534bba
mov esp, ebp
pop ebp
ret
push 0x5c
lea eax, [ebp - 0x60]
push 0
push eax
mov dword [esi], ebx
call fcn.00534b40
mov eax, dword [0x57ae30]
mov ecx, dword [str.__RZX_LogPath_File__]
mov edx, dword [0x57ae2c]
mov dword [ebp - 0x58], eax
mov al, byte [0x57ae3c]
mov byte [ebp - 0x4c], al
xor eax, eax
mov dword [ebp - 0x60], ecx
mov ecx, dword [0x57ae34]
mov dword [ebp - 0x5c], edx
mov edx, dword [0x57ae38]
add esp, 0xc
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x42], 0x10000
mov dword [ebp - 0x3e], eax
mov dword [ebp - 0x3a], eax
cmp edi, eax
je 0x4333e5
mov ecx, 0x17
lea esi, [ebp - 0x60]
rep movsd dword es:[edi], dword [esi]
push ebx
push 1
lea ecx, [ebp - 0x60]
push 0x5c
push ecx
call fcn.00535138
mov ecx, dword [ebp - 4]
add esp, 0x10
dec eax
neg eax
pop edi
sbb eax, eax
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.00534bba
mov esp, ebp
pop ebp
ret
Function at 0x433410
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x676300]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
push 0x679040
call fcn.004ee6fe
add esp, 4
test eax, eax
je 0x433574
push 0x679040
call fcn.004ee684
add esp, 4
or eax, edx
je 0x433574
lea eax, [ebp - 0x84]
push eax
push 0x679040
call fcn.00539959
add esp, 8
test eax, eax
je 0x433484
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00534bba
mov esp, ebp
pop ebp
ret
push esi
push 0x679040
call fcn.00536808
mov esi, eax
add esp, 8
test esi, esi
je 0x433471
cmp dword [ebp - 0x70], 0x5c
jb 0x433471
xor eax, eax
push 0x3e
push eax
lea ecx, [ebp - 0x42]
push ecx
mov dword [ebx], esi
mov byte [ebp - 0x60], 0
mov dword [ebp - 0x5f], eax
mov dword [ebp - 0x5b], eax
mov dword [ebp - 0x57], eax
mov dword [ebp - 0x53], eax
mov dword [ebp - 0x4f], eax
mov dword [ebp - 0x4b], eax
mov dword [ebp - 0x47], eax
mov byte [ebp - 0x43], al
call fcn.00534b40
push 0
push 0
push esi
call fcn.00536a84
push esi
push 1
lea edx, [ebp - 0x60]
push 0x5c
push edx
call fcn.00535632
add esp, 0x28
cmp eax, 1
jne 0x433574
cmp dword [ebp - 0x42], 0x10000
jne 0x43354d
mov edx, str.__RZX_LogPath_File__
lea ecx, [ebp - 0x60]
nop
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x433520
test al, al
je 0x43351c
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x433520
add ecx, 2
add edx, 2
test al, al
jne 0x433500
xor eax, eax
jmp 0x433525
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x43354d
test edi, edi
je 0x433537
mov ecx, 0x17
lea esi, [ebp - 0x60]
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00534bba
mov esp, ebp
pop ebp
ret
push esi
call fcn.00536f74
push edi
push ebx
mov dword [ebx], 0
call fcn.00433340
add esp, 0xc
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00534bba
mov esp, ebp
pop ebp
ret
push edi
push ebx
call fcn.00433340
mov ecx, dword [ebp - 4]
add esp, 8
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00534bba
mov esp, ebp
pop ebp
ret
Function at 0x433a60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56b8b6
mov eax, dword fs:[0]
push eax
sub esp, 0x110
mov eax, dword [0x676300]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ecx, 0x679440
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xb0], esi
mov dword [ebp - 0xc0], 0x679440
call fcn.004ef6fb
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xb4], ebx
xor eax, eax
push 0x3e
lea ecx, [ebp - 0xfe]
push ebx
push ecx
mov byte [ebp - 4], 1
mov byte [ebp - 0x11c], bl
mov dword [ebp - 0x11b], eax
mov dword [ebp - 0x117], eax
mov dword [ebp - 0x113], eax
mov dword [ebp - 0x10f], eax
mov dword [ebp - 0x10b], eax
mov dword [ebp - 0x107], eax
mov dword [ebp - 0x103], eax
mov byte [ebp - 0xff], al
call fcn.00534b40
add esp, 0xc
cmp esi, 0x64
jle 0x433b1c
mov dword [ebp - 0xb0], 0x64
lea edx, [ebp - 0x11c]
push edx
lea eax, [ebp - 0xb4]
push 0x65cca4
push eax
call fcn.00433410
add esp, 0xc
test eax, eax
jne 0x433b66
mov eax, dword [ebp - 0xb4]
cmp eax, ebx
je 0x433b4e
push eax
call fcn.00536f74
add esp, 4
mov ecx, 0x679440
mov dword [ebp - 4], 0xffffffff
call fcn.004ef710
xor eax, eax
jmp 0x433c41
mov edi, dword [ebp - 0xb4]
mov dword [ebp - 0xb8], ebx
cmp dword [ebp - 0xfa], ebx
jle 0x433c1d
mov esi, 0x5c
push 0x9a
lea ecx, [ebp - 0xac]
push 0
push ecx
call fcn.00534b40
push 0
push esi
push edi
call fcn.00536a84
push edi
push 1
lea edx, [ebp - 0xac]
push 0x9a
push edx
call fcn.00535632
add esp, 0x28
cmp dword [ebp - 0xac], 3
jne 0x433bfe
lea eax, [ebp - 0xac]
push eax
call fcn.00433130
mov ecx, dword [ebp - 0xb0]
mov eax, dword [ebp - 0xbc]
push ecx
lea edx, [ebp - 0xa8]
push edx
push eax
call fcn.00537970
mov eax, dword [ebp - 0xbc]
mov ecx, dword [ebp - 0xb0]
add esp, 0x10
mov byte [ecx + eax - 1], 0
cmp byte [eax], 0
jne 0x433c13
inc ebx
add esi, 0x9a
cmp ebx, dword [ebp - 0xfa]
jl 0x433b83
jmp 0x433c1d
mov dword [ebp - 0xb8], 1
test edi, edi
je 0x433c2a
push edi
call fcn.00536f74
add esp, 4
mov ecx, 0x679440
mov dword [ebp - 4], 0xffffffff
call fcn.004ef710
mov eax, dword [ebp - 0xb8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00534bba
mov esp, ebp
pop ebp
ret

Function at 0x433ce0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00433a60
Function at 0x4341c0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
xor ecx, ecx
xor eax, eax
mov edi, esi
mov byte [edi], al
inc eax
mov edx, 0x100
inc edi
cmp ax, dx
jl 0x4341d0
mov word [esi + 0x100], cx
xor dl, dl
mov dword [ebp - 4], 0x100
mov edi, edi
mov edi, dword [ebp + 8]
movzx eax, dl
mov dl, byte [esi]
movzx edi, byte [eax + edi]
movzx ebx, dl
add ecx, edi
add ecx, ebx
and ecx, 0x800000ff
jns 0x434213
dec ecx
or ecx, 0xffffff00
inc ecx
mov edi, dword [ebp + 0x10]
movzx ecx, cl
mov bl, byte [ecx + edi]
inc eax
mov byte [esi], bl
mov byte [ecx + edi], dl
cdq
idiv dword [ebp + 0xc]
inc esi
dec dword [ebp - 4]
jne 0x4341f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x434240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
push edi
xor edi, edi
mov dword [ebp - 8], edi
cmp dword [ebp + 0xc], edi
jle 0x4342ec
push ebx
push esi
movzx ecx, cl
movzx esi, dl
lea esp, [esp]
inc ecx
and ecx, 0x800000ff
jns 0x434281
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [ebp + 0x13], cl
movzx ecx, cl
mov dl, byte [ecx + eax]
movzx ebx, dl
add ebx, esi
and ebx, 0x800000ff
jns 0x43429f
dec ebx
or ebx, 0xffffff00
inc ebx
movzx esi, bl
mov byte [ebp - 1], bl
movzx ebx, byte [esi + eax]
mov byte [ecx + eax], bl
mov byte [esi + eax], dl
movzx ebx, byte [ecx + eax]
movzx edx, dl
add edx, ebx
and edx, 0x800000ff
jns 0x4342c8
dec edx
or edx, 0xffffff00
inc edx
movzx edx, dl
movzx ebx, byte [edx + eax]
mov edx, dword [ebp + 8]
xor byte [edi + edx], bl
mov edx, dword [ebp - 8]
inc edx
movsx edi, dx
mov dword [ebp - 8], edx
cmp edi, dword [ebp + 0xc]
jl 0x434270
mov cl, byte [ebp + 0x13]
mov dl, byte [ebp - 1]
pop esi
pop ebx
mov byte [eax + 0x101], dl
mov byte [eax + 0x100], cl
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x434f20
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x676300]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push 0x80
push 4
push 0
push 3
push 0x1f01ff
add ecx, 4
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x434f6a
or eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00534bba
mov esp, ebp
pop ebp
ret 4
push ebx
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 0x18
jae 0x434fb1
xor eax, eax
push eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x114]
push eax
push 0x18
lea ecx, [ebp - 0x1c]
push ecx
push esi
mov dword [ebp - 0x14], 0x34
call edi
mov eax, 0x18
lea edx, [eax - 0x18]
mov eax, 0x10fef011
mul edx
shr edx, 4
imul edx, edx, 0xf1
push 0
push 0
add edx, 0x18
push edx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0x7f
lea eax, [ebp - 0x10f]
push 0
push eax
mov byte [ebp - 0x110], 0
call fcn.00534b40
push 0x71
lea ecx, [ebp - 0x90]
push 0
push ecx
call fcn.00534b40
mov ebx, dword [ebp + 8]
add esp, 0x18
test ebx, ebx
je 0x43501f
push 0
lea edx, [ebp - 0x114]
push edx
push 0xf1
lea eax, [ebp - 0x110]
push eax
push esi
call edi
dec ebx
jne 0x435004
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop ebx
xor ecx, ebp
xor eax, eax
pop esi
call fcn.00534bba
mov esp, ebp
pop ebp
ret 4
Function at 0x435270
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x676300]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x40], esi
call fcn.00435180
push 0x31
lea eax, [ebp - 0x37]
push 0
push eax
mov byte [ebp - 0x38], 0
call fcn.00534b40
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x38]
push str.NET110_SYSLISTFILE_MAPFILENAME__d
push edx
call fcn.00535bfb
add esp, 0x18
lea eax, [ebp - 0x38]
push eax
push 0
push 0xf001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov edi, eax
test edi, edi
jne 0x435372
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x3c], eax
lea edi, [esi + 4]
lea ebx, [ebx]
push 0
push 0x90000080
push 3
push 0
push 3
push 0xc0000000
push edi
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x43531d
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp eax, 0xa
jl 0x4352e0
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00534bba
mov esp, ebp
pop ebp
ret 4
push 1
lea ecx, [ebp - 0x60]
push ecx
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 1
push 0
push 1
lea edx, [ebp - 0x60]
push edx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea ecx, [ebp - 0x38]
push ecx
push 0
push 0
push 4
lea edx, [ebp - 0x4c]
push edx
lea eax, [ebp - 0x60]
push esi
mov dword [ebp - 0x44], 1
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x4c], 0xc
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x435308
mov esi, dword [ebp - 0x40]
push 0
push 0
push 0
push 0xf001f
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push edi
mov dword [esi + 0x108], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi + 0x108], 0
mov ecx, dword [ebp - 4]
pop edi
setne al
pop esi
xor ecx, ebp
pop ebx
call fcn.00534bba
mov esp, ebp
pop ebp
ret 4

Function at 0x435590
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
or edi, 0xffffffff
test esi, esi
jne 0x4355a5
or eax, edi
pop edi
pop esi
pop ebp
ret
mov ecx, 0x679850
call fcn.004ef6fb
push 0x65cca4
push esi
call fcn.00536808
mov esi, eax
add esp, 8
test esi, esi
je 0x4355e9
mov eax, dword [ebp + 0xc]
push esi
push 0x3d0
push 1
push eax
call fcn.00535632
add esp, 0x10
cmp eax, 0x3d0
jne 0x4355e0
xor edi, edi
push esi
call fcn.00536f74
add esp, 4
mov ecx, 0x679850
call fcn.004ef710
mov eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x438f50
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56be82
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x676300]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp + 8], eax
je 0x438fa5
mov dword [edi], 0x57b7a4
mov dword [edi + 0x10], 0x57b79c
mov dword [edi + 0x70], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 1
mov ecx, dword [edi]
mov edx, dword [ecx + 4]
mov dword [edi + edx], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov eax, dword [edi]
mov ebx, dword [eax + 4]
add ebx, edi
mov ecx, ebx
call fcn.00401820
lea esi, [edi + 0x18]
push 0x20
mov ecx, ebx
mov dword [ebx + 0x38], esi
mov dword [ebx + 0x3c], 0
call fcn.0040a630
cmp dword [ebx + 0x38], 0
mov byte [ebx + 0x40], al
jne 0x438ff7
mov eax, dword [ebx + 0xc]
or eax, 4
or eax, 4
push 0
push eax
mov ecx, ebx
call fcn.004016e0
mov ecx, dword [edi + 0x10]
mov edx, dword [ecx + 4]
mov dword [edi + edx + 0x10], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
mov dword [edi + ecx], vtable.std::basic_iostream_char__struct_std::char_traits_char__.0
mov edx, dword [edi]
mov eax, dword [edx + 4]
mov ecx, esi
mov dword [ebp - 4], 5
mov dword [edi + eax], vtable.std::basic_fstream_char__struct_std::char_traits_char__.0
call fcn.0040b4d0
lea ecx, [esi + 8]
mov dword [esi + 0x10], ecx
lea ecx, [esi + 0x1c]
mov dword [esi + 0x24], ecx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x50], 0
mov byte [esi + 0x49], 0
lea edx, [esi + 0x18]
mov dword [esi + 0x20], edx
lea ecx, [esi + 0x2c]
mov dword [esi + 0x34], ecx
xor ecx, ecx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea edx, [esi + 0x28]
mov dword [esi + 0x30], edx
mov dword [eax], ecx
mov edx, dword [esi + 0x24]
mov dword [edx], ecx
mov eax, dword [esi + 0x34]
mov dword [eax], ecx
mov edx, dword [esi + 0x10]
mov dword [edx], ecx
mov eax, dword [esi + 0x20]
mov dword [eax], ecx
mov edx, dword [esi + 0x30]
mov dword [edx], ecx
mov dword [esi + 0x54], ecx
mov eax, dword [0x6810f4]
mov dword [esi + 0x4c], eax
mov dword [esi + 0x44], ecx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4