joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f2d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x533478
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x59e074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.004045c0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x41f34e
lea ecx, [ebp - 0x28]
call fcn.00404660
mov dword [ebp - 4], 0
lea edx, [ebp - 0x28]
mov ecx, ebx
call fcn.0041f9d0
test al, al
je 0x41f33d
lea ecx, [ebp - 0x28]
call fcn.004045c0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00404600
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00509af6
mov esp, ebp
pop ebp
ret

Function at 0x41f480
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x535940
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x59e074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.004045c0
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call edi
test eax, eax
je 0x41f4c6
mov al, 1
jmp 0x41f5bb
mov ecx, esi
call fcn.004045c0
push eax
lea ecx, [ebp - 0x28]
call fcn.00404610
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0041f2d0
mov ebx, eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00404600
cmp ebx, 0xffffffff
jne 0x41f505
xor al, al
jmp 0x41f5bb
mov ecx, esi
call fcn.004045c0
push eax
lea ecx, [ebp - 0x28]
call fcn.00404610
mov dword [ebp - 4], 1
xor edx, edx
lea ecx, [ebp - 0x28]
call fcn.0041f210
mov bl, al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00404600
test bl, bl
je 0x41f4fe
mov ecx, esi
call fcn.004045c0
push eax
call edi
test eax, eax
jne 0x41f4bf
lea ecx, [ebp - 0x28]
call fcn.00404660
mov dword [ebp - 4], 2
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.0041f9d0
test al, al
je 0x41f57d
lea ecx, [ebp - 0x28]
call fcn.004045c0
push eax
call edi
test eax, eax
je 0x41f57d
mov bl, 1
jmp 0x41f5aa
mov ecx, esi
call fcn.004045c0
push eax
lea ecx, [ebp - 0x44]
call fcn.00404610
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x44]
mov edx, dword [ebp - 0x2c]
call fcn.0041f210
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x44]
call fcn.00404600
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00404600
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00509af6
mov esp, ebp
pop ebp
ret
Function at 0x41f5e0
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x624]
sub esp, 0x624
push 0xffffffffffffffff
push 0x535978
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x59e074]
xor eax, ebp
mov dword [ebp + 0x620], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x5a4454]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x10], 0x5a4454
test eax, eax
je 0x41f635
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
mov ecx, 0x5a4458
call fcn.004045b0
test al, al
jne 0x41f690
mov ecx, 0x5a4458
call fcn.00404680
cmp esi, eax
je 0x41f672
call fcn.00404680
mov edx, eax
cmp dword [eax + 0x14], 8
jb 0x41f667
mov edx, dword [eax]
push dword [eax + 0x10]
push edx
mov ecx, esi
call fcn.00404720
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x5a4454]
test eax, eax
je 0x41f689
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
jmp 0x41f757
push 0x20c
lea eax, [ebp + 0x414]
push 0
push eax
call fcn.0050c400
add esp, 0xc
lea eax, [ebp + 0x414]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x103
ja 0x41f73e
xor eax, eax
push 0x412
push eax
mov word [ebp + 0x61e], ax
lea eax, [ebp]
push eax
call fcn.0050c400
add esp, 0xc
lea eax, [ebp]
push 0x208
push eax
lea eax, [ebp + 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, 0x208
ja 0x41f722
test eax, eax
je 0x41f722
add eax, eax
cmp eax, 0x412
jae 0x41f77f
xor ecx, ecx
mov word [ebp + eax], cx
lea eax, [ebp]
push eax
call fcn.00404920
add esp, 4
push eax
lea eax, [ebp]
push eax
jmp 0x41f66b
lea eax, [ebp + 0x414]
push eax
call fcn.00404920
add esp, 4
push eax
lea eax, [ebp + 0x414]
push eax
jmp 0x41f66b
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x5a4454]
test eax, eax
je 0x41f755
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor al, al
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp + 0x620]
xor ecx, ebp
call fcn.00509af6
lea esp, [ebp + 0x624]
pop ebp
ret
call fcn.0050a28d
int3
Function at 0x41fbf0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x581018
push 0x50b8d0
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x59e074]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x28], 0
xor esi, esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x2c], esi
xor ebx, ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x24], ebx
mov word [ebp - 0x20], 0x100
mov eax, dword [ecx]
mov edi, dword [eax + 0x28]
mov dword [ebp - 0x40], edi
test edi, edi
jne 0x41fc59
xor eax, eax
jmp 0x41fdcf
mov dword [ebp - 4], ebx
push str.InitializeSecurityDescriptor
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41fd9a
push 1
push dword [ebp - 0x34]
call eax
test eax, eax
je 0x41fd9a
push str.AllocateAndInitializeSid
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41fd9a
lea ecx, [ebp - 0x28]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
lea ecx, [ebp - 0x24]
push ecx
call eax
test eax, eax
je 0x41fd9a
push str.GetLengthSid
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41fd9a
push dword [ebp - 0x28]
call eax
add eax, 0x10
mov dword [ebp - 0x30], eax
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x3c], esi
test esi, esi
je 0x41fd9a
push str.InitializeAcl
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41fd9a
push 2
push dword [ebp - 0x30]
push esi
call eax
test eax, eax
je 0x41fd9a
push str.AddAccessAllowedAce
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41fd9a
push dword [ebp - 0x28]
push 0x10000000
push 2
push esi
call eax
test eax, eax
je 0x41fd9a
push str.SetSecurityDescriptorDacl
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x30], eax
test eax, eax
je 0x41fd9a
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x41fd83
push 0
push ecx
push 1
push dword [ebp - 0x34]
call eax
test eax, eax
je 0x41fd70
mov ebx, 1
mov dword [ebp - 0x38], ebx
cmp dword [ebp - 0x2c], 0
je 0x41fd80
jmp 0x41fd9a
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x30]
push 0
push esi
push 1
push dword [ebp - 0x34]
call eax
mov ecx, 1
test eax, eax
cmovne ebx, ecx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 4], 0xfffffffe
call fcn.0041fdf6
test ebx, ebx
jne 0x41fdcd
test esi, esi
je 0x41fdbf
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor esi, esi
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x41fdcd
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00509af6
mov esp, ebp
pop ebp
ret 0xc
Function at 0x420730
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x535b66
mov eax, dword fs:[0]
push eax
sub esp, 0x82c
mov eax, dword [0x59e074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x820], ecx
lea eax, [ebp - 0x810]
push eax
push 0x3fe
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov ebx, eax
mov dword [ebp - 0x818], ebx
test ebx, ebx
je 0x42080e
lea edi, [ebp - 0x810]
mov dword [ebp - 0x814], 0
xor esi, esi
mov dword [ebp - 0x81c], edi
mov dword [ebp - 0x814], esi
mov dword [ebp - 4], esi
cmp ebx, 0x3fe
jbe 0x42082c
xor ecx, ecx
lea eax, [ebx + 2]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00509f18
add esp, 4
mov dword [ebp - 0x81c], eax
mov edi, eax
mov esi, edi
mov dword [ebp - 0x814], esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x4207fa
cmp eax, ebx
ja 0x4207fa
xor ecx, ecx
mov ebx, eax
mov dword [edi + eax*2], ecx
mov dword [ebp - 0x818], ebx
jmp 0x42085a
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x42080e
push edi
call fcn.00509f13
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00509af6
mov esp, ebp
pop ebp
ret
lea eax, [ebx + ebx]
cmp eax, 0x800
jae 0x4208e5
xor ecx, ecx
mov word [ebp + eax - 0x810], cx
add eax, 2
cmp eax, 0x800
jae 0x4208e5
mov word [ebp + eax - 0x810], cx
xor ecx, ecx
xor edi, edi
test ebx, ebx
je 0x4208ca
mov esi, dword [ebp - 0x81c]
mov ebx, 2
mov eax, dword [ebp - 0x818]
cmp word [esi + ebx - 2], 0
jne 0x4208bc
cmp ecx, edi
je 0x4208bc
lea eax, [esi + ecx*2]
push eax
lea ecx, [ebp - 0x838]
call fcn.00404610
mov byte [ebp - 4], 1
lea eax, [ebp - 0x838]
mov ecx, dword [ebp - 0x820]
push eax
call fcn.0040c020
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x838]
call fcn.00404600
mov eax, dword [ebp - 0x818]
lea ecx, [edi + 1]
inc edi
add ebx, 2
cmp edi, eax
jb 0x420873
mov esi, dword [ebp - 0x814]
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x4208de
push esi
call fcn.00509f13
add esp, 4
mov al, 1
jmp 0x420810
call fcn.0050a28d
int3
Function at 0x4225a0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x536068
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x59e074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 0x10]
mov ecx, edi
mov esi, dword [ebp + 0xc]
call fcn.004045b0
test al, al
jne 0x4225fa
cmp byte [ebp + 8], al
jne 0x422601
mov eax, dword [ebx]
test eax, eax
je 0x42275f
cmp byte [eax + 0xa5], 0
je 0x42275f
xor al, al
jmp 0x422773
mov ecx, esi
call fcn.004045b0
test al, al
jne 0x42275f
mov ecx, esi
call fcn.0040cd40
test al, al
je 0x422627
push esi
push edi
call fcn.004221d0
jmp 0x42275b
push 0xb
mov ecx, esi
call fcn.004045c0
push eax
mov ecx, edi
call fcn.004045c0
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push eax
call ebx
test eax, eax
je 0x42264c
mov al, 1
jmp 0x42275b
lea ecx, [ebp - 0x58]
mov byte [ebp - 0x59], 0
call fcn.00404660
mov dword [ebp - 4], 0
lea edx, [ebp - 0x58]
mov ecx, edi
call fcn.0041f9d0
movzx ecx, byte [ebp - 0x59]
test al, al
mov edx, 1
cmovne ecx, edx
mov dword [ebp - 0x60], ecx
lea ecx, [ebp - 0x40]
call fcn.00404660
mov byte [ebp - 4], 1
lea edx, [ebp - 0x40]
mov ecx, esi
call fcn.0041f9d0
test al, al
jne 0x422699
cmp byte [ebp - 0x60], al
je 0x4226d5
push 0xb
lea ecx, [ebp - 0x40]
call fcn.004045c0
push eax
lea ecx, [ebp - 0x58]
call fcn.004045c0
push eax
call ebx
test eax, eax
je 0x4226d5
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00404600
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.00404600
mov al, 1
jmp 0x42275b
mov ecx, esi
call fcn.0041f2d0
cmp eax, 0xffffffff
je 0x42273e
push esi
lea ecx, [ebp - 0x28]
call fcn.004056c0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.0041f790
test al, al
je 0x422732
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.0041f370
test al, al
je 0x422732
mov edx, esi
mov ecx, edi
call fcn.0041f370
lea ecx, [ebp - 0x28]
test al, al
je 0x42272b
call fcn.0041f480
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.00404600
jmp 0x4226b3
mov edx, esi
call fcn.0041f370
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.00404600
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00404600
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.00404600
xor al, al
test al, al
jne 0x422771
mov ecx, edi
call fcn.0040cd40
test al, al
je 0x422771
mov ecx, edi
call fcn.0041f480
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00509af6
mov esp, ebp
pop ebp
ret 0xc
Function at 0x432f40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x80
push esi
mov dword [esp + 4], 0x10d040e
xor esi, esi
mov dword [esp + 8], 0x80b0f02
mov dword [esp + 0xc], 0xc060a03
mov dword [esp + 0x10], 0x7000905
mov dword [esp + 0x14], 0xe08010f
mov dword [esp + 0x18], 0x4030b06
mov dword [esp + 0x1c], 0xd020709
mov dword [esp + 0x20], 0xa05000c
mov dword [esp + 0x24], 0xe09000a
mov dword [esp + 0x28], 0x50f0306
mov dword [esp + 0x2c], 0x70c0d01
mov dword [esp + 0x30], 0x802040b
mov dword [esp + 0x34], 0x30e0d07
mov dword [esp + 0x38], 0xa090600
mov dword [esp + 0x3c], 0x5080201
mov dword [esp + 0x40], 0xf040c0b
mov dword [esp + 0x44], 0x1040c02
mov dword [esp + 0x48], 0x60b0a07
mov dword [esp + 0x4c], 0xf030508
mov dword [esp + 0x50], 0x90e000d
mov dword [esp + 0x54], 0xf0a010c
mov dword [esp + 0x58], 0x8060209
mov dword [esp + 0x5c], 0x4030d00
mov dword [esp + 0x60], 0xb05070e
mov dword [esp + 0x64], 0xe020b04
mov dword [esp + 0x68], 0xd08000f
mov dword [esp + 0x6c], 0x7090c03
mov dword [esp + 0x70], 0x1060a05
mov dword [esp + 0x74], 0x408020d
mov dword [esp + 0x78], 0x10b0f06
mov dword [esp + 0x7c], 0xe03090a
mov dword [esp + 0x80], 0x70c0005
nop dword [eax]
mov ecx, esi
mov edx, esi
sar ecx, 4
and edx, 0xf
movzx eax, byte [esp + ecx + 4]
shl al, 4
or al, byte [esp + edx + 0x14]
mov byte [esi + 0x5a4b20], al
movzx eax, byte [esp + ecx + 0x24]
shl al, 4
or al, byte [esp + edx + 0x34]
mov byte [esi + 0x5a4820], al
movzx eax, byte [esp + ecx + 0x44]
shl al, 4
or al, byte [esp + edx + 0x54]
mov byte [esi + 0x5a4a20], al
movzx eax, byte [esp + ecx + 0x64]
shl al, 4
or al, byte [esp + edx + 0x74]
mov byte [esi + 0x5a4920], al
inc esi
cmp esi, 0x100
jl 0x433050
pop esi
add esp, 0x80
ret
Function at 0x435460
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x533478
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x59e074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
push ecx
lea ecx, [ebp - 0x28]
call fcn.004056c0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0040ef10
lea ecx, [ebp - 0x28]
call fcn.00404710
lea ecx, [ebp - 0x28]
cmp eax, 2
jbe 0x435589
call fcn.00404680
mov esi, eax
mov ecx, esi
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x4354cc
mov ecx, dword [esi]
cmp word [ecx], 0x5c
jne 0x4354e6
mov ecx, esi
cmp eax, 8
jb 0x4354db
mov ecx, dword [esi]
cmp word [ecx + 2], 0x5c
je 0x435604
mov ecx, esi
cmp eax, 8
jb 0x4354ef
mov ecx, dword [esi]
cmp word [ecx], 0x2f
jne 0x435505
mov ecx, esi
cmp eax, 8
jb 0x4354fe
mov ecx, dword [esi]
cmp word [ecx + 2], 0x2f
je 0x43555a
push 0x5c
mov edx, 0x2f
lea ecx, [ebp - 0x28]
call fcn.0040ed50
mov eax, dword [esi + 0x14]
add esp, 4
mov ecx, esi
cmp eax, 8
jb 0x435523
mov ecx, dword [esi]
cmp word [ecx + 2], 0x3a
jne 0x43555a
mov ecx, esi
cmp eax, 8
jb 0x435533
mov ecx, dword [esi]
cmp word [ecx + 4], 0x5c
jne 0x43555a
mov ecx, esi
cmp eax, 8
jb 0x435543
mov ecx, dword [esi]
cmp word [ecx], 0x61
jb 0x43555a
cmp eax, 8
jb 0x435550
mov esi, dword [esi]
cmp word [esi], 0x7a
jbe 0x4355e5
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00404600
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00509af6
mov esp, ebp
pop ebp
ret
call fcn.00404710
cmp eax, 2
jne 0x43555a
lea ecx, [ebp - 0x28]
call fcn.00404680
mov edx, eax
mov ecx, dword [eax + 0x14]
cmp ecx, 8
jb 0x4355a7
mov edx, dword [eax]
cmp word [edx + 2], 0x3a
jne 0x43555a
mov edx, eax
cmp ecx, 8
jb 0x4355b7
mov edx, dword [eax]
cmp word [edx], 0x61
jb 0x43555a
cmp ecx, 8
jb 0x4355c4
mov eax, dword [eax]
cmp word [eax], 0x7a
ja 0x43555a
push 0x565968
call fcn.00404920
add esp, 4
lea ecx, [ebp - 0x28]
push eax
push 0x565968
call fcn.00404be0
lea ecx, [ebp - 0x28]
call fcn.004045c0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x43555a
shr eax, 4
and al, 1
mov byte [edi], al
mov bl, 1
jmp 0x43555c
Function at 0x438030
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x539238
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x59e074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0
mov dword [esi + 0x10], eax
call fcn.005126d4
mov ecx, dword [esi]
add esp, 4
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
test ecx, ecx
je 0x43810a
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x1c], edx
call fcn.0042f7c0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x38]
call fcn.004045b0
test al, al
jne 0x4380fb
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
lea ecx, [ebp - 0x38]
call fcn.004045c0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4380fb
test esi, esi
je 0x4380fb
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push 8
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.00404600
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00509af6
mov esp, ebp
pop ebp
ret 4
Function at 0x43ca40
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x539b0b
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x59e074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 0
push 0
mov dword [ebp - 0x14], edi
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.0042fb90
mov dword [edi], eax
mov dword [ebp - 4], 2
lea esi, [edi + 8]
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004408a0
mov dword [esi], eax
mov byte [ebp - 4], 5
lea esi, [edi + 0x10]
push 0
mov dword [ebp - 0x14], esi
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00440800
mov dword [esi], eax
mov byte [ebp - 4], 8
lea esi, [edi + 0x18]
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004408a0
mov dword [esi], eax
mov byte [ebp - 4], 0xb
lea esi, [edi + 0x20]
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00440760
mov dword [esi], eax
mov byte [ebp - 4], 0xe
lea esi, [edi + 0x28]
push 0
mov dword [ebp - 0x14], esi
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004406c0
mov dword [esi], eax
mov byte [ebp - 4], 0x11
lea esi, [edi + 0x30]
push 0
mov dword [ebp - 0x14], esi
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004406c0
mov dword [esi], eax
mov byte [ebp - 4], 0x14
lea esi, [edi + 0x38]
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
push 0
push 0
call fcn.004406c0
mov dword [esi], eax
mov byte [ebp - 4], 0x17
lea ecx, [edi + 0x40]
call fcn.00405980
mov byte [ebp - 4], 0x18
lea ecx, [edi + 0x78]
call fcn.00404660
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x43cca0
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x539c7b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x59e074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], 8
lea ecx, [ebx + 0x78]
call fcn.00404600
mov byte [ebp - 4], 7
lea ecx, [ebx + 0x40]
call fcn.00404600
mov byte [ebp - 4], 6
lea esi, [ebx + 0x38]
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 0xa
mov ecx, esi
call fcn.0043fe50
mov byte [ebp - 4], 6
push 0x38
push dword [esi]
call fcn.00509dd1
add esp, 8
mov byte [ebp - 4], 5
lea esi, [ebx + 0x30]
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 0xc
mov ecx, esi
call fcn.0043fe50
mov byte [ebp - 4], 5
push 0x38
push dword [esi]
call fcn.00509dd1
add esp, 8
mov byte [ebp - 4], 4
lea esi, [ebx + 0x28]
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 0xe
mov ecx, esi
call fcn.0043ff50
mov byte [ebp - 4], 4
push 0x38
push dword [esi]
call fcn.00509dd1
add esp, 8
mov byte [ebp - 4], 3
lea edi, [ebx + 0x20]
mov dword [ebp - 0x10], edi
mov byte [ebp - 4], 0x11
mov ecx, edi
mov esi, dword [edi]
push dword [esi + 4]
call fcn.00440410
mov eax, dword [edi]
mov dword [eax + 4], esi
mov eax, dword [edi]
mov dword [eax], esi
mov eax, dword [edi]
mov dword [eax + 8], esi
mov dword [edi + 4], 0
mov byte [ebp - 4], 3
push 0x40
push dword [edi]
call fcn.00509dd1
add esp, 8
mov byte [ebp - 4], 2
lea edi, [ebx + 0x18]
mov dword [ebp - 0x10], edi
mov byte [ebp - 4], 0x15
mov ecx, edi
mov esi, dword [edi]
push dword [esi + 4]
call fcn.004404b0
mov eax, dword [edi]
mov dword [eax + 4], esi
mov eax, dword [edi]
mov dword [eax], esi
mov eax, dword [edi]
mov dword [eax + 8], esi
mov dword [edi + 4], 0
mov byte [ebp - 4], 2
push 0x30
push dword [edi]
call fcn.00509dd1
add esp, 8
mov byte [ebp - 4], 1
lea esi, [ebx + 0x10]
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 0x17
mov ecx, esi
call fcn.004400c0
mov byte [ebp - 4], 1
push 0x28
push dword [esi]
call fcn.00509dd1
add esp, 8
mov byte [ebp - 4], 0
lea edi, [ebx + 8]
mov dword [ebp - 0x10], edi
mov byte [ebp - 4], 0x1a
mov ecx, edi
mov esi, dword [edi]
push dword [esi + 4]
call fcn.004404b0
mov eax, dword [edi]
mov dword [eax + 4], esi
mov eax, dword [edi]
mov dword [eax], esi
mov eax, dword [edi]
mov dword [eax + 8], esi
mov dword [edi + 4], 0
mov byte [ebp - 4], 0
push 0x30
push dword [edi]
call fcn.00509dd1
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], 0x1c
mov ecx, ebx
call fcn.0042f9e0
mov dword [ebp - 4], 0xffffffff
push 0x54
push dword [ebx]
call fcn.00509dd1
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret