joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4220a0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54af3f
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x6fb4c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], 0
mov esi, dword [ebp + 8]
mov dword [esi], 0x6e8124
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x14]
mov ebx, 1
mov dword [ebp - 4], 0
push eax
mov dword [ebp - 0x10], ebx
call fcn.0040d690
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
mov dword [ebp - 0x20], edi
test edi, edi
je 0x42223a
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
cmp eax, dword [ebp - 0x14]
jge 0x422134
mov eax, dword [ecx]
cmp eax, ebx
je 0x422127
test eax, eax
je 0x422127
push dword [ebp - 0x14]
mov ecx, esi
call fcn.00402450
jmp 0x422131
push dword [ebp - 0x14]
mov ecx, esi
call fcn.0040ecd0
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
lea eax, [edi + eax*4]
mov dword [ebp - 0x24], eax
cmp edi, eax
jae 0x422231
mov esi, dword [ebp - 0x28]
push 0xffffffffffffffff
push dword [edi]
lea eax, [ebp - 0x18]
push eax
call fcn.00408df0
add esp, 0xc
mov ecx, eax
mov eax, dword [ecx]
or ebx, 0xa
mov dword [ebp - 0x1c], eax
mov dword [ecx], 0x6e80cc
mov dword [ebp - 0x10], ebx
test bl, 4
je 0x4221a0
mov eax, dword [esi]
and ebx, 0xfffffffb
mov dword [ebp - 0x10], ebx
test eax, eax
je 0x422190
cmp eax, 0xffffffff
je 0x42219d
or eax, 0xffffffff
lock xadd dword [esi], eax
dec eax
setne al
test al, al
jne 0x42219d
push 4
push 2
push esi
call fcn.00403690
add esp, 0xc
mov ebx, dword [ebp - 0x10]
test bl, 2
je 0x4221da
mov eax, dword [ebp - 0x18]
and ebx, 0xfffffffd
mov dword [ebp - 0x10], ebx
mov eax, dword [eax]
test eax, eax
je 0x4221cb
cmp eax, 0xffffffff
je 0x4221da
mov eax, dword [ebp - 0x18]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
setne al
test al, al
jne 0x4221da
push 4
push 2
push dword [ebp - 0x18]
call fcn.00403690
add esp, 0xc
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 4], 2
call fcn.00406090
mov eax, dword [ebp - 0x1c]
mov byte [ebp - 4], 0
mov ecx, dword [eax]
mov eax, dword [ebp - 0x1c]
test ecx, ecx
je 0x422211
cmp ecx, 0xffffffff
je 0x42221e
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
setne cl
test cl, cl
jne 0x42221e
push 4
push 2
push eax
call fcn.00403690
add esp, 0xc
add edi, 4
cmp edi, dword [ebp - 0x24]
jae 0x42222e
mov ebx, dword [ebp - 0x10]
jmp 0x422148
mov esi, dword [ebp + 8]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x425b80
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x5c
mov eax, dword [0x6fb4c0]
xor eax, esp
mov dword [esp + 0x58], eax
push edi
mov edi, dword [esp + 0x64]
lea eax, [esp + 4]
push eax
push 0x20119
push 0
push str.SOFTWAREMicrosoftCryptography
mov dword [esp + 0x18], edi
push 0x80000002
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x425c1e
push esi
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x4a
push eax
lea eax, [esp + 0x18]
push eax
push 0
push 0
push str.MachineGuid
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x425c1e
mov eax, dword [esp + 8]
lea ecx, [esp + 0x10]
dec eax
push ecx
shr eax, 1
push eax
push edi
call fcn.00407f00
add esp, 0xc
mov eax, edi
pop edi
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.00524900
add esp, 0x5c
ret
mov ecx, dword [esp + 0x5c]
mov eax, edi
mov dword [edi], 0x6e80cc
pop edi
xor ecx, esp
call fcn.00524900
add esp, 0x5c
ret
Function at 0x429550
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54bc3d
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x6fb4c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], 0x6fd124
mov ecx, 1
mov edi, 0x6fd124
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
je 0x42959a
mov ecx, edi
call fcn.0043f1e0
mov byte [ebp - 0x14], 1
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [ebx]
cmp dword [eax + 4], 0x7ffe
jg 0x4295c6
mov ecx, ebx
call fcn.0040d690
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x42969d
push 0xfffe
call fcn.00524d72
mov edx, eax
xor esi, esi
mov eax, dword [ebx]
add esp, 4
mov dword [ebp - 0x10], edx
cmp dword [eax + 4], esi
jle 0x429694
mov ebx, 0x7ffe
nop word [eax + eax]
mov ecx, dword [eax + 4]
mov edi, ecx
sub edi, esi
mov dword [ebp - 0x14], ecx
cmp edi, 0x7ffe
mov ecx, edi
cmovg ecx, ebx
cmp eax, 0x6e80cc
jne 0x429610
xor ebx, ebx
jmp 0x429615
mov ebx, dword [eax + 0xc]
add ebx, eax
cmp ecx, 0xffffffff
je 0x42963f
lea edx, [ecx + esi]
mov eax, esi
mov ecx, dword [ebp - 0x14]
cmp ecx, edx
cmovl edx, ecx
cmp ecx, esi
cmovl eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
xor edi, edi
test edx, edx
cmovg edi, edx
mov edx, dword [ebp - 0x10]
sub edi, ecx
cmp dword [ebp - 0x14], esi
mov ecx, esi
cmovl ecx, dword [ebp - 0x14]
xor eax, eax
test ecx, ecx
cmovg eax, ecx
add edi, edi
lea eax, [ebx + eax*2]
test eax, eax
je 0x429663
push edi
push eax
push edx
call fcn.00526230
add esp, 0xc
mov eax, dword [ebp - 0x10]
xor ecx, ecx
push eax
mov word [edi + eax], cx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ebx, dword [ebp + 8]
add esi, 0x7ffe
mov edx, dword [ebp - 0x10]
mov eax, dword [ebx]
mov ebx, 0x7ffe
cmp esi, dword [eax + 4]
jl 0x4295f0
mov edi, 0x6fd124
push edx
call fcn.00524d7b
add esp, 4
xor edx, edx
mov eax, 1
lock cmpxchg dword [edi], edx
cmp eax, 1
je 0x4296b4
mov ecx, edi
call fcn.0043f610
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x439f40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54d10c
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x6fb4c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0
push 8
mov dword [ebp - 4], 0
call fcn.00524591
add esp, 4
mov dword [ebp - 0x14], eax
push 0
push dword [ebp + 8]
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.00493160
mov esi, eax
mov byte [ebp - 4], 0
push 1
mov ecx, esi
call fcn.00442290
mov edx, dword [esi]
mov ecx, esi
push dword [ebp + 0xc]
call dword [edx + 0x30]
mov dword [edi + 4], esi
mov eax, edi
mov word [edi + 8], 1
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0x13
mov dword [edi + 0x14], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x43db10
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov edx, dword [esp + 0x10]
xor eax, eax
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x14]
mov ecx, edi
sub ecx, esi
mov dword [esp + 0xc], ecx
cmp edx, 0x20
jb 0x43db94
mov edi, 0x10
add esi, 0x10
sub edi, dword [esp + 0x1c]
nop dword [eax]
mov edx, dword [esp + 0x14]
lea esi, [esi + 0x20]
movups xmm2, xmmword [ecx + esi - 0x20]
lea ecx, [edi + esi]
movups xmm1, xmmword [eax + edx]
mov edx, dword [esp + 0x18]
add eax, 0x20
cmp ecx, edx
mov ecx, dword [esp + 0xc]
movaps xmm0, xmm1
psrlw xmm1, 8
psllw xmm0, 8
xorps xmm0, xmm1
movups xmmword [esi - 0x30], xmm0
movaps xmm0, xmm2
psrlw xmm2, 8
psllw xmm0, 8
xorps xmm0, xmm2
movups xmmword [esi - 0x20], xmm0
jbe 0x43db40
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x14]
jmp 0x43db98
mov dword [esp + 0xc], ecx
lea ecx, [eax + 0x10]
mov dword [esp + 8], ecx
cmp ecx, edx
mov ecx, dword [esp + 0xc]
ja 0x43dbc3
movups xmm1, xmmword [eax + edi]
movaps xmm0, xmm1
psrlw xmm1, 8
psllw xmm0, 8
xorps xmm0, xmm1
movups xmmword [eax + esi], xmm0
mov eax, dword [esp + 8]
xor edi, edi
cmp eax, edx
jae 0x43dbf5
add esi, eax
nop dword [eax + eax]
cmp edi, 0x10
jae 0x43dbf5
mov cx, word [ecx + esi]
add eax, 2
mov dh, cl
add edi, 2
mov dl, ch
mov ecx, dword [esp + 0xc]
mov word [esi], dx
add esi, 2
mov edx, dword [esp + 0x18]
cmp eax, edx
jb 0x43dbd0
pop edi
mov eax, edx
pop esi
add esp, 8
ret

Function at 0x43e0f0
Capabilities:
Encode data using add xor sub operations

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
test edx, edx
je 0x43e122
movzx ecx, word [esi]
lea esi, [esi + 2]
shl eax, 4
add ecx, eax
mov eax, ecx
shr eax, 0x17
and eax, 0x1e0
xor eax, ecx
and eax, 0xfffffff
sub edx, 1
jne 0x43e101
pop esi
ret
Function at 0x44b490
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
cmp eax, 0x270
jne 0x44b4df
lea edx, [esi + 8]
mov edi, eax
mov ecx, dword [edx]
lea edx, [edx + 4]
xor ecx, dword [edx - 8]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x44b4a2
mov eax, dword [esi]
jmp 0x44b5c8
cmp eax, 0x4e0
jb 0x44b5c8
push ebx
mov ebx, dword [esi + 0x9c4]
lea edi, [esi + 0x9c4]
push ebp
mov ebp, 0xe3
nop dword [eax]
lea edx, [edi]
mov eax, ebx
mov ebx, dword [edx + 4]
lea edi, [edx + 4]
mov ecx, ebx
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x634]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub ebp, 1
jne 0x44b500
mov ebx, dword [esi + 0xd50]
lea edi, [esi + 0xd50]
mov ebp, 0x18c
nop dword [eax]
mov eax, ebx
lea edx, [edi]
mov ebx, dword [edx + 4]
lea edi, [edx + 4]
mov ecx, eax
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx - 0xd4c]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub ebp, 1
jne 0x44b550
mov eax, dword [esi + 0x1380]
mov ecx, dword [esi + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop ebp
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
xor eax, eax
pop ebx
mov dword [esi], 0
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
ret

Function at 0x44b600
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push edi
mov edi, ecx
cmp dword [edi], 0
je 0x44b67d
push ebp
mov ebp, 0x6fd480
cmp edi, 0x6fd4c0
jne 0x44b62d
mov ecx, 1
xor eax, eax
lock cmpxchg dword [ebp], ecx
test eax, eax
je 0x44b62d
mov ecx, ebp
call fcn.0043f1e0
push ebx
mov ebx, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x14]
cmp esi, ebx
je 0x44b656
nop dword [eax + eax]
lea ecx, [edi + 4]
call fcn.0044b490
mov dword [esi], eax
add esi, 4
cmp esi, ebx
jne 0x44b640
mov ebp, 0x6fd480
pop esi
pop ebx
cmp edi, 0x6fd4c0
jne 0x44b678
xor edx, edx
mov eax, 1
lock cmpxchg dword [ebp], edx
cmp eax, 1
je 0x44b678
mov ecx, ebp
call fcn.0043f610
pop ebp
pop edi
ret 8
pop edi
mov ecx, 0x6fd488
jmp fcn.0044b690
Function at 0x44b690
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54e220
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x6fb4c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movq xmm0, qword [0x700a00]
xor ebx, ebx
mov edi, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
sub edi, edx
movq qword [ebp - 0x14], xmm0
mov ecx, dword [ebp - 0x14]
mov eax, ecx
sar edi, 2
or eax, dword [ebp - 0x10]
jne 0x44b6e6
call fcn.00494280
mov edx, dword [ebp + 8]
mov ecx, eax
and ecx, 0x1000
or ecx, ebx
je 0x44b6fc
push edi
push edx
call fcn.00494480
add esp, 8
mov ebx, eax
cmp ebx, edi
je 0x44b75b
mov esi, edi
sub esi, ebx
shl esi, 2
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 4], 0
lea eax, [eax + ebx*4]
push eax
call dword [sym.imp.ADVAPI32.dll_SystemFunction036]
xor ecx, ecx
test al, al
cmovne ecx, esi
mov eax, ecx
cdq
and edx, 3
add eax, edx
sar eax, 2
add ebx, eax
cmp ebx, edi
je 0x44b75b
mov eax, dword [ebp + 8]
sub edi, ebx
lea esi, [eax + ebx*4]
lea edi, [esi + edi*4]
cmp esi, edi
je 0x44b75b
lea eax, [ebp + 8]
push eax
call fcn.0052ff07
mov eax, dword [ebp + 8]
add esp, 4
mov dword [esi], eax
add esi, 4
cmp esi, edi
jne 0x44b743
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x44b7e0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub esp, 0x9c4
mov eax, dword [0x6fb4c0]
xor eax, esp
mov dword [esp + 0x9c0], eax
push ebx
mov ebx, dword [esp + 0x9cc]
mov edx, 0x1571
push ebp
push esi
mov ecx, 1
mov dword [ebx], 1
lea esi, [ebx + 0xc]
mov dword [ebx + 0x1388], 0xffffffff
mov dword [ebx + 8], 0x1571
mov eax, edx
lea esi, [esi + 4]
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
inc ecx
mov dword [esi - 4], edx
cmp ecx, 0x270
jb 0x44b822
push edi
lea eax, [esp + 0x9d0]
mov dword [ebx + 4], 0x270
push eax
lea eax, [esp + 0x14]
mov ecx, 0x6fd488
push eax
call fcn.0044b690
xor edx, edx
lea edi, [ebx + 8]
xor esi, esi
mov eax, dword [esp + esi*4 + 0x10]
lea edi, [edi + 4]
mov ecx, eax
mov dword [edi - 4], eax
or ecx, edx
mov edx, eax
shr edx, 0x1f
test esi, esi
cmovne edx, ecx
inc esi
cmp esi, 0x270
jb 0x44b866
pop edi
test edx, edx
jne 0x44b893
mov dword [ebx + 8], 0x80000000
mov ecx, dword [esp + 0x9cc]
pop esi
pop ebp
mov dword [ebx + 4], 0x270
pop ebx
xor ecx, esp
call fcn.00524900
add esp, 0x9c4
ret
Function at 0x450180
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54eb05
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x6fb4c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebx + 0x60]
mov esi, dword [ebx + 0xc]
mov dword [ebp - 0x20], esi
test eax, eax
jne 0x4502a9
cmp dword [ebx + 0x78], 0xffffffff
jne 0x45031d
cmp dword [ebx + 0x64], 0xffffffff
je 0x450304
mov eax, dword [ebp + 0x10]
xorps xmm0, xmm0
mov edi, dword [ebp + 0xc]
movlpd qword [ebp - 0x1c], xmm0
mov ecx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ecx
nop dword [eax]
test eax, eax
jg 0x450202
jl 0x4501fe
cmp edi, 0x2000000
jae 0x450202
mov eax, edi
jmp 0x450207
mov eax, 0x2000000
push 0
lea ecx, [ebp - 0x18]
push ecx
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
push dword [ebx + 0x64]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 0x10]
test eax, eax
je 0x450262
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x45024a
add esi, eax
adc ecx, 0
sub edi, eax
mov eax, dword [ebp - 0x14]
sbb eax, 0
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], eax
cmp ecx, dword [ebp + 0x10]
jg 0x45024a
jl 0x4501f0
cmp esi, dword [ebp + 0xc]
jb 0x4501f0
mov eax, esi
mov edx, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, esi
or eax, ecx
jne 0x45024a
lea eax, [ebp + 8]
push 0xffffffffffffffff
push eax
call fcn.00450d30
add esp, 8
mov ecx, dword [ebp - 0x20]
push eax
push 1
mov dword [ebp - 4], 1
call fcn.0044c590
lea ecx, [ebp + 8]
call fcn.00401a70
or eax, 0xffffffff
or edx, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push eax
call fcn.0053216d
push eax
call fcn.005327c6
add esp, 8
cmp eax, 0xffffffff
je 0x45031d
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
je 0x4502ce
cmp eax, 3
jne 0x45031d
push dword [ebx + 0x60]
call fcn.005300a4
add esp, 4
test eax, eax
je 0x45031d
lea eax, [ebp + 0x10]
push 0xffffffffffffffff
push eax
call fcn.00450f00
add esp, 8
push eax
push 1
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.0044c590
lea ecx, [ebp + 0x10]
call fcn.00401a70
or eax, 0xffffffff
or edx, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push dword [ebp + 0x10]
mov ecx, ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0044df60
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4505a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54eb6d
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x6fb4c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x60], 0
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x20], eax
jne 0x4506c1
cmp dword [ebx + 0x78], 0xffffffff
jne 0x4506c1
cmp dword [ebx + 0x64], 0xffffffff
je 0x4506a8
mov eax, dword [ebp + 0x10]
xorps xmm0, xmm0
mov edi, dword [ebp + 0xc]
movlpd qword [ebp - 0x1c], xmm0
mov ecx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ecx
test eax, eax
jg 0x45061a
jl 0x450616
cmp edi, 0x2000000
jae 0x45061a
mov eax, edi
jmp 0x45061f
mov eax, 0x2000000
push 0
lea ecx, [ebp - 0x18]
push ecx
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
push dword [ebx + 0x64]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0x10]
test eax, eax
je 0x45067a
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x450662
add esi, eax
adc ecx, 0
sub edi, eax
mov eax, dword [ebp - 0x14]
sbb eax, 0
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], eax
cmp ecx, dword [ebp + 0x10]
jg 0x450662
jl 0x450608
cmp esi, dword [ebp + 0xc]
jb 0x450608
mov eax, esi
mov edx, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, esi
or eax, ecx
jne 0x450662
lea eax, [ebp + 8]
push 0xffffffffffffffff
push eax
call fcn.00450d30
add esp, 8
mov ecx, dword [ebp - 0x20]
push eax
push 2
mov dword [ebp - 4], 0
call fcn.0044c590
lea ecx, [ebp + 8]
call fcn.00401a70
or eax, 0xffffffff
or edx, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0044ea20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x450970
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54ebfd
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x6fb4c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 4]
mov ebx, dword [eax + 0x64]
cmp ebx, 0xffffffff
jne 0x450a9a
cmp dword [eax + 0x78], ebx
jne 0x450a6c
cmp dword [eax + 0x60], 0
jne 0x450a6c
lea ecx, [eax + 0x10]
mov eax, dword [ecx]
cmp dword [eax + 4], 0
jne 0x4509d4
mov eax, dword [ecx + 4]
cmp dword [eax + 4], 0
je 0x450b2f
lea eax, [ebp - 0x14]
push eax
call fcn.0044c7a0
push eax
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0
call fcn.00449c00
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.00401a70
push ecx
mov eax, esp
lea ecx, [ebp - 0x1c]
mov dword [eax], 3
call fcn.00449f10
lea ecx, [ebp - 0x1c]
test al, al
je 0x450a62
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0044a2a0
mov bl, al
test bl, bl
jne 0x450a44
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0041ae70
push eax
push 0xc
mov ecx, edi
mov byte [ebp - 4], 3
call fcn.0044c590
lea ecx, [ebp + 0xc]
call fcn.00401a70
lea ecx, [ebp - 0x1c]
call fcn.00449cd0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.00449cd0
jmp 0x450b2f
cmp ebx, 0xffffffff
jne 0x450a9a
mov ecx, dword [eax + 0x60]
test ecx, ecx
je 0x450a83
push ecx
call fcn.0053216d
add esp, 4
jmp 0x450a86
mov eax, dword [eax + 0x78]
push eax
call fcn.005327c6
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
je 0x450b2f
mov eax, dword [edi]
mov ecx, edi
mov eax, dword [eax + 0x18]
call eax
mov ecx, dword [edi]
push dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
push dword [ebp + 8]
mov esi, dword [ecx + 0x1c]
mov ecx, edi
mov dword [ebp - 0x14], edx
call esi
test al, al
je 0x450b21
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x450b21
mov eax, dword [edi]
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebp + 0xc]
mov ebx, dword [eax + 0x1c]
cmp ecx, esi
jg 0x450afe
mov eax, dword [ebp - 0x10]
jl 0x450b05
mov edx, dword [ebp + 8]
cmp eax, edx
jae 0x450b01
push ecx
push eax
mov ecx, edi
call ebx
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp + 8]
mov eax, edx
mov ecx, esi
push ecx
push eax
mov ecx, edi
call ebx
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x14]
mov eax, dword [edi]
push ecx
push dword [ebp - 0x10]
mov ecx, edi
call dword [eax + 0x1c]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x451a30
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54eda5
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x6fb4c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push eax
call fcn.0044cc70
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.0040d690
mov ecx, dword [ebp + 8]
mov esi, eax
lea eax, [ebp - 0x10]
push eax
call fcn.0044cc70
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.0040d690
push 1
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [ebp - 0x10]
mov edi, eax
test edi, edi
setne bl
or esi, 0xffffffff
mov ecx, dword [ecx]
test ecx, ecx
je 0x451abd
cmp ecx, esi
je 0x451acc
mov eax, dword [ebp - 0x10]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
setne al
test al, al
jne 0x451acc
push 4
push 2
push dword [ebp - 0x10]
call fcn.00403690
add esp, 0xc
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
test eax, eax
je 0x451ae9
cmp eax, 0xffffffff
je 0x451af8
mov eax, dword [ebp - 0x14]
lock xadd dword [eax], esi
dec esi
setne al
test al, al
jne 0x451af8
push 4
push 2
push dword [ebp - 0x14]
call fcn.00403690
add esp, 0xc
test edi, edi
jne 0x451b0e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov dword [ecx + 4], 2
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret