joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46c580
Capabilities:
Get disk information

Disassembly:
push ebp
lea ebp, [esp - 0x808]
sub esp, 0x808
push 0xffffffffffffffff
push 0x55f960
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x5b0070]
xor eax, ebp
mov dword [ebp + 0x804], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
mov edi, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
lea eax, [ebp + 4]
push eax
push 0x3fe
call edi
mov ebx, eax
mov dword [ebp - 0x14], ebx
test ebx, ebx
je 0x46c647
lea edx, [ebp + 4]
mov dword [ebp], 0
xor esi, esi
mov dword [ebp - 0x10], edx
mov dword [ebp], esi
mov dword [ebp - 4], esi
cmp ebx, 0x3fe
jbe 0x46c66c
xor ecx, ecx
lea eax, [ebx + 2]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004e5d58
add esp, 4
mov dword [ebp - 0x10], eax
mov esi, eax
mov dword [ebp], esi
push eax
push ebx
call edi
test eax, eax
je 0x46c631
cmp eax, ebx
ja 0x46c631
mov edx, esi
xor ecx, ecx
mov ebx, eax
mov dword [ebp - 0x14], ebx
mov dword [edx + eax*2], ecx
jmp 0x46c694
mov dword [ebp - 4], 0xffffffff
mov eax, esi
test eax, eax
je 0x46c647
push eax
call fcn.004e5d53
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x804]
xor ecx, ebp
call fcn.004e562e
lea esp, [ebp + 0x808]
pop ebp
ret
lea eax, [ebx + ebx]
cmp eax, 0x800
jae 0x46c799
xor ecx, ecx
mov word [ebp + eax + 4], cx
add eax, 2
cmp eax, 0x800
jae 0x46c799
mov word [ebp + eax + 4], cx
xor eax, eax
xor edi, edi
test ebx, ebx
je 0x46c77e
mov ecx, dword [ebp - 0x14]
mov ebx, 2
nop dword [eax + eax]
cmp word [edx + ebx - 2], 0
jne 0x46c772
cmp eax, edi
je 0x46c772
lea edx, [edx + eax*2]
mov dword [ebp - 0x24], 0
mov ecx, edx
mov dword [ebp - 0x20], 0
xor eax, eax
mov dword [ebp - 0x24], 0
mov word [ebp - 0x34], ax
mov dword [ebp - 0x20], 7
lea eax, [ecx + 2]
mov dword [ebp - 0x18], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x46c6f1
sub ecx, dword [ebp - 0x18]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x34]
call fcn.00403570
mov byte [ebp - 4], 1
lea eax, [ebp - 0x34]
mov ecx, dword [ebp - 0x1c]
push eax
call fcn.0041d740
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x20]
cmp edx, 8
jb 0x46c755
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x46c74b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x46c79e
push edx
push ecx
call fcn.004e566f
add esp, 8
mov ecx, dword [ebp - 0x14]
xor eax, eax
mov edx, dword [ebp - 0x10]
mov word [ebp - 0x34], ax
lea eax, [edi + 1]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 7
inc edi
add ebx, 2
cmp edi, ecx
jb 0x46c6b0
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x46c792
push esi
call fcn.004e5d53
add esp, 4
mov al, 1
jmp 0x46c649
call fcn.004e5e82
call fcn.0050ac18
int3
Function at 0x46ce00
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x5b0070]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [ecx]
push esi
push edi
mov edi, dword [esp + 0x14]
test eax, eax
je 0x46ce63
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x46ce63
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x46ce3e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x46ce63
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, esi
mov dword [edi], ecx
adc eax, 0
mov dword [edi + 4], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.004e562e
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.004e562e
add esp, 8
ret 4

Function at 0x46f820
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x560725
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x5b0070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x1050
call fcn.004e563f
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
push 0x1050
push 0
push esi
call fcn.00500e00
lea ecx, [esi + 0x44]
mov dword [esi], 0
mov eax, ecx
mov dword [esi + 4], 0
neg eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
lea edx, [esi + 0x1044]
mov dword [esi + 0x10], 0
and eax, 3
mov dword [esi + 0x14], 0
add esp, 0x10
mov dword [esi + 0x18], 0
add eax, ecx
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [ebp - 0x14], esi
mov dword [edx], 0
mov dword [esi + 0x1048], 0
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edx
mov byte [ebp - 4], 2
mov dword [esi + 0x104c], 0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov dword [edi], esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x470560
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x47058b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00471640
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x4705ad
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x4705af
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x470633
jg 0x4705c4
test esi, esi
je 0x470633
test ecx, ecx
jl 0x47060d
jg 0x4705ce
test eax, eax
je 0x47060d
cmp edi, ecx
jg 0x4705e2
jl 0x4705d8
cmp esi, eax
jae 0x4705e2
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call fcn.00500300
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x470610
mov edx, dword [ebp + 8]
test edi, edi
jl 0x470633
jg 0x47061a
test esi, esi
je 0x470633
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x470633
push eax
push esi
push 1
push edx
call fcn.005274d7
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x470650
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x47067b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00471720
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], eax
test eax, eax
je 0x47069d
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x47069f
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test ebx, ebx
jl 0x47073e
jg 0x4706bc
test esi, esi
je 0x47073e
test ecx, ecx
jl 0x470709
jg 0x4706c6
test eax, eax
je 0x470709
cmp ebx, ecx
jg 0x4706da
jl 0x4706d0
cmp esi, eax
jae 0x4706da
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
push eax
push dword [esp + 0x18]
push dword [ebp + 8]
call fcn.00500300
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [edi + 0x2c]
add edx, ecx
sub esi, ecx
mov dword [esp + 0xc], edx
sbb ebx, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x470710
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
test ebx, ebx
jl 0x47073e
jg 0x47071a
test esi, esi
je 0x47073e
cmp dword [edi + 0x4c], 0
je 0x47073e
mov ecx, edi
call fcn.00472060
push dword [edi + 0x4c]
push esi
push 1
push dword [esp + 0x18]
call fcn.00527b27
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
pop edi
pop esi
sbb edx, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x470ac0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x30
mov eax, dword [0x5b0070]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
mov ebx, dword [esp + 0x38]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x470af0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.004e562e
add esp, 0x30
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x470b2d
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x470b2d
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.004e562e
add esp, 0x30
ret 4
cmp dword [esi + 0x4c], 0
je 0x470c22
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x470b55
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x470b89
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.005269b3
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.004e562e
add esp, 0x30
ret 4
lea eax, [esp + 0xc]
mov byte [esp + 0x17], bl
mov edx, dword [ecx]
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x2b]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x470c22
cmp eax, 1
jle 0x470bf1
cmp eax, 3
jne 0x470c22
push dword [esi + 0x4c]
movsx eax, byte [esp + 0x1b]
push eax
call fcn.005269b3
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.004e562e
add esp, 0x30
ret 4
mov edi, dword [esp + 0xc]
lea eax, [esp + 0x18]
sub edi, eax
je 0x470c10
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.005274d7
add esp, 0x10
cmp edi, eax
jne 0x470c22
lea eax, [esp + 0x17]
mov byte [esi + 0x3d], 1
cmp dword [esp + 0x10], eax
jne 0x470b17
mov ecx, dword [esp + 0x38]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004e562e
add esp, 0x30
ret 4
Function at 0x483360
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x562d58
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x5b0070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
cmp esi, 0xffffffff
jne 0x48339b
xor al, al
jmp 0x48345f
and esi, 0xffffb1af
mov eax, edi
cmp dword [edi + 0x14], 8
jb 0x4833ab
mov eax, dword [edi]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
push eax
call ebx
test eax, eax
je 0x4833c0
mov al, 1
jmp 0x48345f
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
lea edx, [ebp - 0x28]
mov ecx, edi
call fcn.00484a30
test al, al
je 0x48340a
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push esi
cmovae eax, dword [ebp - 0x28]
push eax
call ebx
test eax, eax
je 0x48340a
mov bl, 1
jmp 0x48340c
xor bl, bl
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x483449
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x48343f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x48347b
push edx
push ecx
call fcn.004e566f
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
mov al, bl
mov dword [ebp - 0x14], 7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e562e
mov esp, ebp
pop ebp
ret
call fcn.0050ac18
int3

Function at 0x483490
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x562d88
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x5b0070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4834c6
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x483570
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.00484a30
test al, al
je 0x48351f
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x48355c
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x483552
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x48358d
push edx
push ecx
call fcn.004e566f
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e562e
mov esp, ebp
pop ebp
ret
call fcn.0050ac18
int3
Function at 0x483af0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x562e40
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x5b0070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
cmp dword [edi + 0x14], 8
mov ecx, edi
jb 0x483b29
mov ecx, dword [edi]
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x483b33
mov eax, dword [esi]
mov ebx, dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0
push ecx
push eax
call ebx
test eax, eax
je 0x483b4a
mov al, 1
jmp 0x483c91
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov byte [ebp - 0x41], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
mov dword [ebp - 4], eax
lea edx, [ebp - 0x40]
mov ecx, esi
call fcn.00484a30
movzx ecx, byte [ebp - 0x41]
test al, al
mov edx, 1
mov dword [ebp - 0x18], 0
cmovne ecx, edx
mov dword [ebp - 0x14], 0
xor eax, eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], dl
lea edx, [ebp - 0x28]
mov ecx, edi
call fcn.00484a30
test al, al
jne 0x483bc6
cmp byte [ebp - 0x48], al
je 0x483bea
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
push 0
cmovae ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
push ecx
cmovae eax, dword [ebp - 0x40]
push eax
call ebx
test eax, eax
je 0x483bea
mov bl, 1
jmp 0x483bec
xor bl, bl
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x483c2a
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x483c20
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x483cad
push edx
push ecx
call fcn.004e566f
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x483c7b
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x483c71
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x483cb2
push edx
push ecx
call fcn.004e566f
add esp, 8
xor eax, eax
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
mov al, bl
mov dword [ebp - 0x2c], 7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e562e
mov esp, ebp
pop ebp
ret
call fcn.0050ac18
call fcn.0050ac18
int3
Function at 0x484400
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x5b0070]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
mov ebx, dword [esp + 0x218]
lea eax, [esp + 4]
push esi
push edi
push 0x20c
push 0
push eax
mov edi, edx
mov esi, ecx
call fcn.00500e00
add esp, 0xc
cmp dword [edi + 0x14], 8
jb 0x48443e
mov edi, dword [edi]
cmp dword [esi + 0x14], 8
jb 0x484446
mov esi, dword [esi]
lea eax, [esp + 0xc]
push eax
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x4844a6
xor eax, eax
lea edx, [esp + 0xc]
mov word [esp + 0x216], ax
lea esi, [edx + 2]
nop word [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x484470
sub edx, esi
lea eax, [esp + 0xc]
sar edx, 1
mov ecx, ebx
push edx
push eax
call fcn.00403570
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.004e562e
add esp, 0x210
ret
mov ecx, dword [esp + 0x218]
xor al, al
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004e562e
add esp, 0x210
ret
Function at 0x484e40
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x5a3198
push 0x4ff8d0
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x5b0070]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x28], 0
xor esi, esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x2c], esi
xor ebx, ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x24], ebx
mov word [ebp - 0x20], 0x100
mov eax, dword [ecx]
mov edi, dword [eax + 0x28]
mov dword [ebp - 0x40], edi
test edi, edi
jne 0x484ea9
xor eax, eax
jmp 0x48501f
mov dword [ebp - 4], ebx
push str.InitializeSecurityDescriptor
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x484fea
push 1
push dword [ebp - 0x34]
call eax
test eax, eax
je 0x484fea
push 0x589a14
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x484fea
lea ecx, [ebp - 0x28]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
lea ecx, [ebp - 0x24]
push ecx
call eax
test eax, eax
je 0x484fea
push str.GetLengthSid
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x484fea
push dword [ebp - 0x28]
call eax
add eax, 0x10
mov dword [ebp - 0x30], eax
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x3c], esi
test esi, esi
je 0x484fea
push str.InitializeAcl
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x484fea
push 2
push dword [ebp - 0x30]
push esi
call eax
test eax, eax
je 0x484fea
push str.AddAccessAllowedAce
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x484fea
push dword [ebp - 0x28]
push 0x10000000
push 2
push esi
call eax
test eax, eax
je 0x484fea
push str.SetSecurityDescriptorDacl
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x30], eax
test eax, eax
je 0x484fea
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x484fd3
push 0
push ecx
push 1
push dword [ebp - 0x34]
call eax
test eax, eax
je 0x484fc0
mov ebx, 1
mov dword [ebp - 0x38], ebx
cmp dword [ebp - 0x2c], 0
je 0x484fd0
jmp 0x484fea
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x30]
push 0
push esi
push 1
push dword [ebp - 0x34]
call eax
mov ecx, 1
test eax, eax
cmovne ebx, ecx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 4], 0xfffffffe
call fcn.00485046
test ebx, ebx
jne 0x48501d
test esi, esi
je 0x48500f
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor esi, esi
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x48501d
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004e562e
mov esp, ebp
pop ebp
ret 0xc
Function at 0x488f40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x563ac8
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x5b0070]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
mov esi, dword [ebp + 8]
mov ecx, esi
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x3c]
push eax
push 2
push 0xffffffffffffffff
push 0xffff8000
movlpd qword [ebp - 0x3c], xmm0
call fcn.0046ce80
test al, al
jne 0x488fa0
mov eax, 1
jmp 0x48911d
push 0x10000
call fcn.004e5d58
mov ebx, eax
mov dword [ebp - 0x18], 0
add esp, 4
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], 0
push 0x10000
push 0
push ebx
call fcn.00500e00
mov eax, dword [esi]
add esp, 0xc
mov dword [ebp - 0x1c], 0
test eax, eax
je 0x4890f6
test ebx, ebx
je 0x4890f6
cmp dword [eax], 0xffffffff
je 0x4890f6
push 0
lea ecx, [ebp - 0x1c]
push ecx
push 0x8000
push ebx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4890f6
mov esi, dword [ebp - 0x20]
mov ecx, 0x8000
xor ebx, ebx
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], ecx
add esi, ecx
nop word [eax + eax]
cmp byte [edi + 0x9c], 0
jne 0x4890ec
lea edx, [ebp - 0x30]
mov dword [ebp - 0x30], 0
push edx
lea edx, [ebp - 0x24]
mov dword [ebp - 0x24], 0
push edx
push ecx
mov ecx, dword [ebp - 0x34]
lea eax, [esi + ebx]
push eax
call fcn.004c73d0
test al, al
je 0x4890df
mov eax, dword [ebp - 0x24]
test eax, eax
jne 0x489092
mov eax, dword [edi + 0xc0]
test eax, eax
je 0x489081
push 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [edi + 0x9c], 0
jne 0x4890ec
inc dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
jmp 0x48909c
add ebx, eax
cmp ebx, 0x8000
je 0x4890ac
cmp dword [ebp - 0x28], 0xf
ja 0x4890d5
mov ecx, dword [ebp - 0x2c]
sub ecx, eax
mov dword [ebp - 0x2c], ecx
jne 0x489030
mov ebx, dword [ebp - 0x20]
mov edx, 0x7ffc
mov ecx, ebx
mov eax, dword [ecx]
cmp eax, dword [esi]
jne 0x4890ce
add ecx, 4
add esi, 4
sub edx, 4
jae 0x4890b6
mov esi, 4
jmp 0x489107
mov esi, 5
jmp 0x489107
mov ebx, dword [ebp - 0x20]
mov esi, 3
jmp 0x489107
mov eax, dword [ebp - 0x30]
mov esi, 3
mov ebx, dword [ebp - 0x20]
jmp 0x489101
mov ebx, dword [ebp - 0x20]
mov esi, 2
jmp 0x489107
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 1
mov dword [edi + 0xb0], eax
mov dword [ebp - 4], 0xffffffff
test ebx, ebx
je 0x48911b
push ebx
call fcn.004e5d53
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004e562e
mov esp, ebp
pop ebp
ret 0xc