joyce8/EMBER2024-capa huggingface dataset:
Function at 0x459c20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x68d969
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x73d6e0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov esi, dword [esp + 0x20]
xor eax, eax
push 0xffffffffffffffff
push eax
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
push esi
mov word [edi], ax
call fcn.00409040
mov dword [esp + 0x18], 0
lea ecx, [edi + 0x18]
xor eax, eax
mov dword [ecx + 0x14], 7
push 0xffffffffffffffff
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0x18]
push eax
call fcn.00409040
mov byte [esp + 0x18], 1
lea ecx, [edi + 0x30]
xor eax, eax
mov dword [ecx + 0x14], 7
push 0xffffffffffffffff
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0x30]
push eax
call fcn.00409040
mov byte [esp + 0x18], 2
lea ecx, [edi + 0x48]
xor eax, eax
mov dword [ecx + 0x14], 7
push 0xffffffffffffffff
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0x48]
push eax
call fcn.00409040
mov byte [esp + 0x18], 3
mov eax, dword [esi + 0x60]
mov dword [edi + 0x60], eax
mov eax, dword [esi + 0x64]
mov dword [edi + 0x64], eax
mov eax, dword [esi + 0x68]
mov dword [edi + 0x68], eax
mov eax, dword [esi + 0x70]
mov dword [edi + 0x70], eax
mov eax, dword [esi + 0x74]
mov dword [edi + 0x74], eax
mov dword [esp + 0x18], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x45ef00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x68f708
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x73d6e0]
xor eax, esp
mov dword [esp + 0x18], eax
push esi
push edi
mov eax, dword [0x73d6e0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, edx
mov dword [esp + 0xc], eax
mov edi, ecx
mov ecx, eax
mov dword [esp + 0x20], 0
sub ecx, edi
mov eax, 0x81848da9
imul ecx
xorps xmm0, xmm0
movdqu xmmword [esp + 0x10], xmm0
mov dword [esp + 0x10], 0
add edx, ecx
mov dword [esp + 0x14], 0
sar edx, 9
mov esi, edx
mov dword [esp + 0x18], 0
shr esi, 0x1f
add esi, edx
lea eax, [esi + 1]
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x20], eax
mov dword [esp + 0x30], 0
mov ecx, edi
push dword [esp + 0x40]
mov edx, dword [esp + 0x10]
push eax
push esi
call fcn.0045f030
add esp, 0xc
mov dword [esp + 0x30], 0xffffffff
mov esi, dword [esp + 0x10]
test esi, esi
je 0x45efe0
cmp esi, dword [esp + 0x18]
je 0x45efd7
mov edi, edi
mov ecx, esi
call fcn.0044ed80
add esi, 0x3f4
cmp esi, dword [esp + 0x18]
jne 0x45efc0
mov esi, dword [esp + 0x10]
push esi
call fcn.005472b4
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.005472b9
add esp, 0x28
ret
Function at 0x45ffa0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x68f9a0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov eax, dword [0x73d6e0]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov dword [esp + 0x1c], edx
mov ebp, ecx
mov ebx, dword [esp + 0x4c]
mov eax, dword [esp + 0x48]
mov edi, dword [esp + 0x54]
mov esi, dword [esp + 0x50]
mov dword [esp + 0x20], eax
test ebx, ebx
je 0x460170
test esi, esi
je 0x460170
cmp ebx, esi
jg 0x4600a1
mov ecx, edi
call fcn.0045f480
cmp ebx, eax
jg 0x4600a1
mov ecx, dword [edi + 0x10]
sub esp, 0x14
mov dword [esp + 0x2c], esp
mov eax, dword [ecx]
mov dword [ecx + 4], eax
mov ecx, esp
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov eax, dword [edi + 0x10]
mov dword [ecx + 0x10], eax
mov dword [esp + 0x54], 0
mov esi, dword [esp + 0x30]
push esi
mov dword [esp + 0x58], 0xffffffff
mov edx, ebp
lea ecx, [esp + 0x3c]
call fcn.0045fda0
add esp, 0x18
lea ecx, [esp + 0x24]
call fcn.0045f000
push dword [esp + 0x18]
mov ebx, dword [esp + 0x24]
mov ecx, esi
push ebp
mov edx, ebx
call fcn.0044b4d0
mov eax, dword [edi + 0x10]
push dword [esp + 0x20]
push ebx
mov edx, dword [eax + 4]
mov ecx, dword [eax]
call fcn.00460630
add esp, 0x10
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
mov ecx, edi
call fcn.0045f480
cmp esi, eax
jg 0x460149
mov ecx, dword [edi + 0x10]
sub esp, 0x14
mov dword [esp + 0x2c], esp
mov eax, dword [ecx]
mov dword [ecx + 4], eax
mov ecx, esp
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov eax, dword [edi + 0x10]
mov dword [ecx + 0x10], eax
mov dword [esp + 0x54], 1
mov ebx, dword [esp + 0x34]
push ebx
mov dword [esp + 0x58], 0xffffffff
lea ecx, [esp + 0x3c]
mov edx, dword [esp + 0x34]
call fcn.0045fda0
add esp, 0x18
lea ecx, [esp + 0x24]
call fcn.0045f000
push dword [esp + 0x18]
mov edx, dword [esp + 0x20]
mov ecx, ebp
push ebx
call fcn.00460630
mov eax, dword [edi + 0x10]
push dword [esp + 0x20]
push ebp
mov edx, dword [eax + 4]
mov ecx, dword [eax]
call fcn.0044b4d0
add esp, 0x10
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
mov ebx, dword [esp + 0x20]
mov ecx, ebp
mov edx, dword [esp + 0x1c]
push ebx
call fcn.00460540
add esp, 4
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
imul eax, esi, 0x3f4
add eax, ebp
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
Function at 0x460190
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x68f9f9
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov eax, dword [0x73d6e0]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov esi, edx
mov eax, ecx
mov dword [esp + 0x1c], eax
mov edi, dword [esp + 0x4c]
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x40], 1
mov ebp, dword [esp + 0x48]
mov ebx, dword [esp + 0x50]
cmp esi, ebp
je 0x460217
cmp edi, ebx
je 0x460217
push esi
mov ecx, edi
call fcn.0044f030
lea ecx, [esp + 0x54]
test al, al
je 0x460207
push edi
call fcn.00460580
add edi, 0x3f4
cmp edi, ebx
jmp 0x460215
push esi
call fcn.00460580
add esi, 0x3f4
cmp esi, ebp
jne 0x4601e7
sub esp, 0x14
mov ecx, esp
mov dword [esp + 0x2c], esp
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov eax, dword [esp + 0x78]
mov dword [ecx + 0x10], eax
mov byte [esp + 0x54], 2
push ebp
mov byte [esp + 0x58], 1
mov edx, esi
lea ecx, [esp + 0x3c]
call fcn.0045fda0
add esp, 0x18
mov byte [esp + 0x40], 3
mov eax, dword [eax + 0x10]
mov dword [esp + 0x64], eax
mov byte [esp + 0x40], 1
mov esi, dword [esp + 0x24]
test esi, esi
je 0x4602a0
cmp esi, dword [esp + 0x2c]
je 0x460297
lea ebx, [ebx]
mov ecx, esi
call fcn.0044ed80
add esi, 0x3f4
cmp esi, dword [esp + 0x2c]
jne 0x460280
mov esi, dword [esp + 0x24]
push esi
call fcn.005472b4
add esp, 4
sub esp, 0x14
mov ecx, esp
mov dword [esp + 0x2c], esp
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov eax, dword [esp + 0x78]
mov dword [ecx + 0x10], eax
mov byte [esp + 0x54], 4
push ebx
mov byte [esp + 0x58], 1
mov edx, edi
mov edi, dword [esp + 0x34]
mov ecx, edi
call fcn.0045fda0
add esp, 0x18
mov dword [esp + 0x14], 1
mov byte [esp + 0x40], 0
mov esi, dword [esp + 0x54]
test esi, esi
je 0x460321
cmp esi, dword [esp + 0x5c]
je 0x460318
mov ecx, esi
call fcn.0044ed80
add esi, 0x3f4
cmp esi, dword [esp + 0x5c]
jne 0x460301
mov esi, dword [esp + 0x54]
push esi
call fcn.005472b4
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
Function at 0x464410
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x690240
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x73d6e0]
xor eax, esp
mov dword [esp + 0x34], eax
push ebx
mov eax, dword [0x73d6e0]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
xor eax, eax
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x38], 7
mov dword [esp + 0x34], 0
mov word [esp + 0x24], ax
mov dword [esp + 0x48], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], eax
mov word [esp + 0xc], ax
mov byte [esp + 0x48], 1
mov dword [esp + 8], eax
lea eax, [esp + 8]
push edx
push eax
lea eax, [esp + 0x14]
push eax
lea edx, [esp + 0x30]
call fcn.00463ef0
add esp, 0xc
mov bl, al
mov byte [esp + 0x48], 0
cmp dword [esp + 0x20], 8
jb 0x4644bd
push dword [esp + 0xc]
call fcn.005472b4
add esp, 4
xor eax, eax
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], 0
mov word [esp + 0xc], ax
mov dword [esp + 0x48], 0xffffffff
cmp dword [esp + 0x38], 8
jb 0x4644ef
push dword [esp + 0x24]
call fcn.005472b4
add esp, 4
xor eax, eax
mov dword [esp + 0x38], 7
mov word [esp + 0x24], ax
mov al, bl
mov dword [esp + 0x34], 0
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.005472b9
add esp, 0x44
ret
Function at 0x4647b0
Capabilities:
Access peb ldr_data
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x68aa18
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x73d6e0]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
mov eax, dword [0x73d6e0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, edx
xor eax, eax
mov dword [esp + 0x1c], 0
push 0xffffffffffffffff
push eax
push ecx
mov dword [esp + 0x2c], 0
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], 0
mov word [esp + 0x18], ax
call fcn.00409040
mov dword [esp + 0x30], 0
lea ecx, [esp + 0xc]
call fcn.0041ce60
mov eax, dword [esp + 0x1c]
cmp eax, 2
jbe 0x4648fc
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0xc]
mov edx, dword [esp + 0xc]
cmp ecx, 8
cmovae eax, edx
cmp word [eax], 0x5c
jne 0x464864
cmp ecx, 8
lea eax, [esp + 0xc]
cmovae eax, edx
cmp word [eax + 2], 0x5c
jne 0x464864
mov bl, 1
jmp 0x46496c
cmp ecx, 8
lea eax, [esp + 0xc]
cmovae eax, edx
cmp word [eax], 0x2f
jne 0x464889
cmp ecx, 8
lea eax, [esp + 0xc]
cmovae eax, edx
cmp word [eax + 2], 0x2f
je 0x46496a
push 0x5c
mov edx, 0x2f
lea ecx, [esp + 0x10]
call fcn.0041ccb0
mov edx, dword [esp + 0x10]
mov eax, ecx
mov ecx, dword [esp + 0x24]
add esp, 4
cmp ecx, 8
cmovae eax, edx
cmp word [eax + 2], 0x3a
jne 0x46496a
cmp ecx, 8
lea eax, [esp + 0xc]
cmovae eax, edx
cmp word [eax + 4], 0x5c
jne 0x46496a
cmp ecx, 8
lea eax, [esp + 0xc]
cmovae eax, edx
cmp word [eax], 0x61
jb 0x46496a
cmp ecx, 8
lea eax, [esp + 0xc]
cmovae eax, edx
cmp word [eax], 0x7a
ja 0x46496a
cmp ecx, 8
lea eax, [esp + 0xc]
cmovae eax, edx
jmp 0x464953
jne 0x46496a
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0xc]
mov edx, dword [esp + 0xc]
cmp ecx, 8
cmovae eax, edx
cmp word [eax + 2], 0x3a
jne 0x46496a
cmp ecx, 8
lea eax, [esp + 0xc]
cmovae eax, edx
cmp word [eax], 0x61
jb 0x46496a
cmp ecx, 8
lea eax, [esp + 0xc]
cmovae eax, edx
cmp word [eax], 0x7a
ja 0x46496a
push 0x6ea1a4
lea ecx, [esp + 0x10]
call fcn.00412770
cmp dword [esp + 0x20], 8
lea eax, [esp + 0xc]
cmovae eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x46496a
shr eax, 4
mov bl, 1
and al, 1
mov byte [esi], al
jmp 0x46496c
xor bl, bl
mov dword [esp + 0x30], 0xffffffff
cmp dword [esp + 0x20], 8
jb 0x464987
push dword [esp + 0xc]
call fcn.005472b4
add esp, 4
xor eax, eax
mov dword [esp + 0x20], 7
mov word [esp + 0xc], ax
mov al, bl
mov dword [esp + 0x1c], 0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.005472b9
add esp, 0x28
ret
Function at 0x465aa0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x69053b
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x73d6e0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
push 0
push 0
mov dword [esp + 0x18], edi
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.00449d10
mov dword [edi], eax
mov dword [esp + 0x1c], 2
lea esi, [edi + 8]
mov dword [esp + 0x10], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0046b010
mov dword [esi], eax
mov byte [esp + 0x1c], 7
lea esi, [edi + 0x10]
push 0
push 0
mov dword [esp + 0x18], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0046aeb0
mov dword [esi], eax
mov byte [esp + 0x1c], 0xa
lea esi, [edi + 0x18]
mov dword [esp + 0x10], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0046b010
mov dword [esi], eax
mov byte [esp + 0x1c], 0xf
lea esi, [edi + 0x20]
mov dword [esp + 0x10], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0046b0c0
mov dword [esi], eax
mov byte [esp + 0x1c], 0x14
lea esi, [edi + 0x28]
push 0
push 0
mov dword [esp + 0x18], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0046af60
mov dword [esi], eax
mov byte [esp + 0x1c], 0x17
lea esi, [edi + 0x30]
push 0
push 0
mov dword [esp + 0x18], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0046af60
mov dword [esi], eax
mov byte [esp + 0x1c], 0x1a
lea esi, [edi + 0x38]
push 0
push 0
mov dword [esp + 0x18], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0046af60
mov dword [esi], eax
mov byte [esp + 0x1c], 0x1d
lea ecx, [edi + 0x40]
call fcn.0040f470
mov byte [esp + 0x1c], 0x1e
xor eax, eax
mov dword [edi + 0x84], 7
mov dword [edi + 0x80], 0
mov word [edi + 0x70], ax
mov dword [esp + 0x1c], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret
Function at 0x466010
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x690788
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x73d6e0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 8]
lea ecx, [edi + 8]
push dword [eax + 4]
call fcn.0046a5e0
mov eax, dword [edi + 8]
lea ecx, [edi + 0x18]
mov dword [eax + 4], eax
mov eax, dword [edi + 8]
mov dword [eax], eax
mov eax, dword [edi + 8]
mov dword [eax + 8], eax
mov dword [edi + 0xc], 0
mov eax, dword [edi + 0x18]
push dword [eax + 4]
call fcn.0046a5e0
mov eax, dword [edi + 0x18]
lea ecx, [edi + 0x10]
mov dword [eax + 4], eax
mov eax, dword [edi + 0x18]
mov dword [eax], eax
mov eax, dword [edi + 0x18]
mov dword [eax + 8], eax
mov dword [edi + 0x1c], 0
call fcn.0046a280
mov eax, dword [edi + 0x20]
lea ecx, [edi + 0x20]
push dword [eax + 4]
call fcn.0046a680
mov eax, dword [edi + 0x20]
lea ecx, [edi + 0x28]
mov dword [eax + 4], eax
mov eax, dword [edi + 0x20]
mov dword [eax], eax
mov eax, dword [edi + 0x20]
mov dword [eax + 8], eax
mov dword [edi + 0x24], 0
call fcn.0046a3f0
lea ecx, [edi + 0x30]
call fcn.0046a520
push 0
push 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call fcn.00449d10
mov ecx, eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x20], 2
lea eax, [esp + 0x10]
cmp edi, eax
je 0x466106
mov eax, dword [edi]
mov dword [edi], ecx
mov dword [esp + 0x10], eax
mov eax, dword [edi + 4]
mov dword [edi + 4], 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], 3
lea ecx, [esp + 0x10]
call fcn.00449ca0
mov dword [esp + 0x20], 0xffffffff
push dword [esp + 0x10]
call fcn.005472b4
add esp, 4
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret
Function at 0x46e7f0
Capabilities:
Get file size
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x6918a8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x73d6e0]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x73d6e0]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [esp + 0x5c]
mov esi, dword [esp + 0x50]
mov eax, dword [esp + 0x58]
mov dword [esp + 0x14], esi
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
test ecx, ecx
je 0x46e846
mov dword [ecx], 0
mov dword [eax], 0
cmp dword [edi], 0xffffffff
je 0x46e9cb
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x100000
mov eax, dword [esp + 0x54]
push 0
mov ebx, eax
mov dword [esp + 0x34], 0
cmp eax, 0x100000
lea eax, [esp + 0x34]
push eax
cmova ebx, ecx
push ebx
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
cmp dword [edi + 0x1c], 0
je 0x46e990
test eax, eax
je 0x46e990
mov ecx, dword [esp + 0x30]
jmp 0x46e8b0
cmp ecx, ebx
jae 0x46e994
call ebp
mov ecx, dword [edi]
mov dword [esp + 0x18], eax
cmp ecx, 0xffffffff
je 0x46e8f3
lea eax, [esp + 0x38]
mov dword [esp + 0x38], 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x46e8e6
call ebp
test eax, eax
jne 0x46e8f3
mov eax, dword [esp + 0x38]
xor ecx, ecx
add ecx, esi
adc eax, 0
jmp 0x46e904
xorps xmm0, xmm0
movlpd qword [esp + 0x24], xmm0
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push 0
push dword [esp + 0x1c]
push eax
push ecx
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [esp + 0x40], esp
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [edi + 4]
push eax
call fcn.00409040
mov dword [esp + 0x70], 0
mov ecx, dword [edi + 0x1c]
mov eax, dword [ecx]
mov dword [esp + 0x70], 0xffffffff
call dword [eax + 0x18]
mov esi, dword [esp + 0x14]
test eax, eax
jne 0x46e990
push eax
mov dword [esp + 0x38], eax
lea eax, [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push ebx
add eax, esi
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x30]
neg eax
sbb eax, eax
add ecx, dword [esp + 0x34]
and eax, 0x7fffbffb
mov dword [esp + 0x30], ecx
add eax, 0x80004005
jne 0x46e8b0
jmp 0x46e994
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x20]
add dword [edx], ecx
test eax, eax
jne 0x46e9c1
test ecx, ecx
je 0x46e9bd
mov eax, dword [esp + 0x54]
add esi, ecx
sub eax, ecx
mov dword [esp + 0x14], esi
mov dword [esp + 0x54], eax
mov ecx, 0x100000
jne 0x46e864
mov al, 1
jmp 0x46e9cd
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x46e9cb
mov dword [ecx], eax
xor al, al
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.005472b9
add esp, 0x38
ret 0x10
Function at 0x46e9f0
Capabilities:
Clear file content

Disassembly:
push 0xffffffffffffffff
push 0x6918d8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov eax, dword [0x73d6e0]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [esp + 0x1c]
xorps xmm0, xmm0
push eax
push 1
push 0
push 0
movlpd qword [esp + 0x2c], xmm0
xor bl, bl
call fcn.00457fd0
mov ebp, dword [esp + 0x44]
test al, al
lea eax, [esp + 0x24]
movzx ecx, bl
mov ebx, dword [esp + 0x48]
mov edx, 1
push eax
push 0
cmovne ecx, edx
xorps xmm0, xmm0
push ebx
mov dword [esp + 0x24], ecx
mov ecx, edi
push ebp
movlpd qword [esp + 0x34], xmm0
call fcn.00457fd0
test al, al
je 0x46eb8c
cmp dword [esp + 0x24], ebp
jne 0x46eb8c
cmp dword [esp + 0x28], ebx
jne 0x46eb8c
mov ebp, dword [esp + 0x4c]
mov eax, dword [edi]
test ebp, ebp
jne 0x46eac1
cmp eax, 0xffffffff
jne 0x46eaa4
xor al, al
xor ecx, ecx
test al, al
mov esi, 0x80004005
cmovne esi, ecx
jmp 0x46eb62
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
mov esi, 0x80004005
setne al
xor ecx, ecx
test al, al
cmovne esi, ecx
jmp 0x46eb62
mov ebx, dword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp eax, 0xffffffff
jne 0x46ead0
xor al, al
jmp 0x46ead8
push eax
call ebx
test eax, eax
setne al
xor ecx, ecx
mov esi, 0x80004005
test al, al
cmovne esi, ecx
test esi, esi
je 0x46eb62
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push eax
push dword [esp + 0x50]
xor eax, eax
push dword [esp + 0x50]
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x74], esp
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [edi + 4]
push eax
call fcn.00409040
mov dword [esp + 0x64], 0
mov eax, dword [ebp]
mov dword [esp + 0x64], 0xffffffff
mov ecx, ebp
call dword [eax + 0x1c]
mov esi, eax
test esi, esi
jne 0x46eb62
mov eax, dword [edi]
cmp eax, 0xffffffff
jne 0x46eb4a
xor al, al
jmp 0x46eb52
push eax
call ebx
test eax, eax
setne al
xor ecx, ecx
mov esi, 0x80004005
test al, al
cmovne esi, ecx
test esi, esi
jne 0x46eae8
cmp byte [esp + 0x18], 0
je 0x46eb88
lea eax, [esp + 0x44]
xorps xmm0, xmm0
push eax
push 0
push dword [esp + 0x28]
mov ecx, edi
movlpd qword [esp + 0x50], xmm0
push dword [esp + 0x28]
call fcn.00457fd0
mov eax, esi
jmp 0x46ebb7
cmp byte [esp + 0x18], 0
je 0x46ebb2
lea eax, [esp + 0x44]
xorps xmm0, xmm0
push eax
push 0
push dword [esp + 0x28]
mov ecx, edi
movlpd qword [esp + 0x50], xmm0
push dword [esp + 0x28]
call fcn.00457fd0
mov eax, 0x80004005
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0xc
Function at 0x46ebd0
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x73d6e0]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
mov esi, ecx
mov dword [esp + 4], 0x114
push 0x110
lea eax, [esp + 0xc]
push 0
push eax
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov byte [esi], 0
call fcn.00549c70
add esp, 0xc
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, esi
je 0x46ec67
cmp dword [esp + 8], 6
jb 0x46ec67
mov byte [esi], 1
mov ecx, dword [esp + 0x118]
pop esi
xor ecx, esp
call fcn.005472b9
add esp, 0x118
ret