joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45c8a4
Capabilities:
Create process memory minidump
Delete file
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34c
mov eax, dword [0x52e030]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x340], eax
jb 0x45c8cd
mov eax, dword [eax]
xor ebx, ebx
push ebx
push ebx
push 2
push ebx
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x32c], eax
cmp eax, 0xffffffff
jne 0x45c8f4
xor al, al
jmp 0x45c9c4
mov dword [ebp - 0x33c], ebx
xor eax, eax
lea edi, [ebp - 0x338]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x33c], eax
mov eax, dword [esi]
lea esi, [eax + 0xc]
push 0x14
pop ecx
lea edi, [ebp - 0x58]
rep movsd dword es:[edi], dword [esi]
lea esi, [eax + 0x5c]
mov ecx, 0xb3
lea edi, [ebp - 0x328]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x58]
mov dword [ebp - 0x348], eax
lea eax, [ebp - 0x328]
mov dword [ebp - 0x344], eax
xor esi, esi
lea eax, [ebp - 0x348]
inc esi
mov dword [ebp - 0x338], eax
mov dword [ebp - 0x334], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push ebx
push ebx
lea ecx, [ebp - 0x33c]
push ecx
push dword [ebp + 0xc]
push dword [ebp - 0x32c]
push eax
push edi
call dword [sym.imp.dbghelp.dll_MiniDumpWriteDump]
push ebx
push dword [ebp - 0x32c]
mov dword [ebp - 0x330], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push dword [ebp - 0x32c]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, ebx
jne 0x45c9b9
mov eax, dword [ebp - 0x340]
cmp dword [eax + 0x14], 8
jb 0x45c9b2
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
cmp dword [ebp - 0x330], esi
sete al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00475360
leave
ret 8
Function at 0x45c9d5
Capabilities:
Enumerate process modules

Disassembly:
push 0x28
mov eax, 0x4d92fc
call fcn.00475a6c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, dword [sym.imp.PSAPI.DLL_EnumProcessModules]
lea ecx, [ebp - 0x14]
push ecx
xor edi, edi
push edi
lea ecx, [ebp - 0x1c]
push ecx
push eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x1c], edi
call esi
mov eax, dword [ebp - 0x14]
xor ecx, ecx
push 4
shr eax, 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00473a72
mov ebx, eax
pop ecx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], edi
lea ecx, [ebp - 0x10]
push ecx
push dword [ebp - 0x14]
push eax
jmp 0x45ca6a
xor ecx, ecx
push 4
shr eax, 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00473a72
pop ecx
mov dword [ebp - 0x20], eax
cmp eax, ebx
je 0x45ca5e
push ebx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
mov ebx, dword [ebp - 0x20]
pop ecx
mov dword [ebp - 0x24], ebx
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x10]
push ecx
push eax
mov dword [ebp - 0x14], eax
push ebx
push dword [ebp - 0x18]
mov dword [ebp - 0x10], edi
call esi
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x14]
ja 0x45ca31
xor esi, esi
test eax, 0xfffffffc
jbe 0x45cab9
mov eax, dword [ebx + esi*4]
mov dword [ebp - 0x34], eax
xor eax, eax
lea edi, [ebp - 0x30]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0xc
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x34]
push dword [ebp - 0x18]
call dword [sym.imp.PSAPI.DLL_GetModuleInformation]
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x34]
call fcn.0045d0e6
mov eax, dword [ebp - 0x10]
inc esi
shr eax, 2
cmp esi, eax
jb 0x45ca83
or dword [ebp - 4], 0xffffffff
push ebx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
pop ecx
call fcn.00475b44
ret 4
Function at 0x45cda6
Capabilities:
Create process on windows

Disassembly:
push 0x180
mov eax, 0x4e9a5a
call fcn.00475ad5
mov eax, dword [ebp + 8]
mov dword [ebp - 0x130], eax
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x20], ebx
mov word [ebp - 0x30], ax
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x30]
push eax
push 2
call fcn.0046dc49
pop ecx
pop ecx
test al, al
je 0x45cf3a
push str.CrashReporter.exe
lea esi, [ebp - 0x68]
call fcn.00402b82
mov byte [ebp - 4], 1
mov eax, esi
push eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.0043221c
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x30]
push ecx
call fcn.00431857
mov byte [ebp - 4], 1
push 1
xor edi, edi
lea esi, [ebp - 0x84]
call fcn.00402efe
mov byte [ebp - 4], bl
push 1
lea esi, [ebp - 0x68]
call fcn.00402efe
xor eax, eax
mov dword [ebp - 0x144], ebx
lea edi, [ebp - 0x140]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x40
stosd dword es:[edi], eax
lea eax, [ebp - 0x188]
push ebx
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
mov edx, str._s__s
lea ecx, [ebp - 0x12c]
mov dword [ebp - 0x18c], 0x44
mov dword [ebp - 0x160], 0x80
call fcn.0045dd82
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x30]
push ecx
call fcn.0045f09a
pop ecx
push dword [ebp - 0x130]
call fcn.0045f09a
pop ecx
lea ecx, [ebp - 0x4c]
push ecx
mov ecx, eax
call fcn.0045df73
pop ecx
mov byte [ebp - 4], 5
lea eax, [ebp - 0x12c]
push eax
call fcn.0045b7f8
cmp dword [ebp - 0x38], 8
mov eax, dword [ebp - 0x4c]
jae 0x45cec2
lea eax, [ebp - 0x4c]
lea ecx, [ebp - 0x144]
push ecx
lea ecx, [ebp - 0x18c]
push ecx
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x45cf6a
push 0x2710
push dword [ebp - 0x144]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x45cf54
lea eax, [ebp - 0x130]
push eax
push dword [ebp - 0x144]
mov dword [ebp - 0x130], ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x45cf54
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x134], eax
mov byte [ebp - 4], bl
push 1
xor edi, edi
lea esi, [ebp - 0x4c]
call fcn.00402efe
mov ebx, dword [ebp - 0x134]
or dword [ebp - 4], 0xffffffff
push 1
xor edi, edi
lea esi, [ebp - 0x30]
call fcn.00402efe
mov eax, ebx
call fcn.00475b58
ret 4
push dword [ebp - 0x144]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x140]
call esi
mov byte [ebp - 4], bl
push 1
xor edi, edi
lea esi, [ebp - 0x4c]
call fcn.00402efe
jmp 0x45cf3a
Function at 0x46a97c
Capabilities:
Get disk information

Disassembly:
push ebp
lea ebp, [esp - 0xaa8]
sub esp, 0xb28
mov eax, dword [0x52e030]
xor eax, ebp
mov dword [ebp + 0xaa4], eax
mov eax, dword [ebp + 0xab0]
and dword [ebp + 0x38], 0
push ebx
push esi
mov dword [ebp + 0x34], eax
mov eax, dword [ebp + 0xab4]
push edi
mov dword [ebp + 0x30], eax
xor eax, eax
push 0x7fe
push eax
mov word [ebp + 0x94], ax
lea eax, [ebp + 0x96]
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp + 0x94]
push eax
push 0x3ff
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
jne 0x46aa3e
push 2
pop eax
cmp dword [0x536220], eax
jg 0x46aa16
push 0x2f
pop edi
mov ebx, str.file_util_win.cc
lea esi, [ebp - 0x80]
mov dword [ebp + 0x38], 1
call fcn.0042b7c4
add eax, 8
push str.Failed_to_get_drive_mapping.
push eax
call fcn.00403bcc
pop ecx
pop ecx
test byte [ebp + 0x38], 1
je 0x46aa24
lea ebx, [ebp - 0x80]
call fcn.0042b903
xor al, al
mov ecx, dword [ebp + 0xaa4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00475360
add ebp, 0xaa8
leave
ret
cmp word [ebp + 0x94], 0
mov esi, 0x50bf84
lea edi, [ebp + 0xa9c]
movsd dword es:[edi], dword [esi]
lea ebx, [ebp + 0x94]
movsw word es:[edi], word [esi]
je 0x46aa24
mov ax, word [ebx]
mov word [ebp + 0xa9c], ax
push 0x104
lea eax, [ebp + 0x894]
push eax
lea eax, [ebp + 0xa9c]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x46aab4
lea eax, [ebp + 0x894]
push eax
lea esi, [ebp + 0x78]
call fcn.00402b82
push dword [ebp + 0x88]
or dword [ebp + 0x38], 2
push dword [ebp + 0x34]
mov eax, esi
xor edx, edx
call fcn.0043aeab
neg eax
sbb al, al
inc al
mov byte [ebp + 0x3f], 1
jne 0x46aab8
mov byte [ebp + 0x3f], 0
test byte [ebp + 0x38], 2
je 0x46aace
and dword [ebp + 0x38], 0xfffffffd
push 1
xor edi, edi
lea esi, [ebp + 0x78]
call fcn.00402efe
cmp byte [ebp + 0x3f], 0
jne 0x46aaed
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x46aad4
cmp word [ebx], ax
jne 0x46aa5c
jmp 0x46aa24
lea eax, [ebp + 0x894]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x46aaf6
sub eax, edx
push 0xffffffffffffffff
sar eax, 1
push eax
push dword [ebp + 0x34]
lea esi, [ebp + 0x5c]
call fcn.00432965
lea eax, [ebp + 0xa9c]
push eax
mov eax, esi
push eax
call fcn.0046d794
mov ebx, eax
lea esi, [ebp + 0x40]
call fcn.0042bfce
mov eax, esi
push eax
lea esi, [ebp + 0x78]
call fcn.00402b5c
push dword [ebp + 0x30]
mov eax, esi
call fcn.00431857
push 1
xor edi, edi
call fcn.00402efe
push 1
lea esi, [ebp + 0x40]
call fcn.00402efe
push 1
lea esi, [ebp + 0x5c]
call fcn.00402efe
mov al, 1
jmp 0x46aa26
Function at 0x46ad5a
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
lea ebp, [esp - 0x1d8]
sub esp, 0x258
mov eax, dword [0x52e030]
xor eax, ebp
mov dword [ebp + 0x1d4], eax
push edi
mov edi, ecx
cmp dword [edi + 0x10], 0x104
jb 0x46ad88
xor al, al
jmp 0x46ae7b
push ebx
xor ebx, ebx
cmp byte [ebp + 0x1e0], bl
jne 0x46ade6
push esi
lea eax, [ebp - 0x80]
call fcn.0046f592
push edi
mov esi, eax
call fcn.0046bf19
pop ecx
pop esi
test al, al
je 0x46adc8
cmp byte [ebp - 0x78], bl
je 0x46adc8
cmp dword [edi + 0x14], 8
jb 0x46adb7
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
jmp 0x46ae7a
cmp dword [edi + 0x14], 8
jb 0x46add2
mov eax, dword [edi]
jmp 0x46add4
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x46ade6
mov al, 1
jmp 0x46ae7a
xor eax, eax
push 0x208
mov word [ebp - 0x38], ax
lea eax, [ebp - 0x36]
push ebx
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
cmp dword [edi + 0x14], 8
jb 0x46ae06
mov edi, dword [edi]
lea ecx, [ebp - 0x38]
sub ecx, edi
movzx eax, word [edi]
mov word [ecx + edi], ax
add edi, 2
cmp ax, bx
jne 0x46ae0b
xor eax, eax
push 6
mov dword [ebp - 0x58], ebx
pop ecx
lea edi, [ebp - 0x54]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x50], eax
mov eax, 0x414
mov dword [ebp - 0x54], 3
mov word [ebp - 0x48], ax
cmp byte [ebp + 0x1e0], bl
jne 0x46ae50
mov eax, 0x1494
mov word [ebp - 0x48], ax
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
cmp dword [ebp - 0x46], ebx
je 0x46ae63
xor al, al
jmp 0x46ae7a
cmp eax, ebx
je 0x46ae77
cmp eax, 2
je 0x46ae77
cmp eax, 0x402
je 0x46ae77
xor eax, eax
jmp 0x46ae7a
xor eax, eax
inc eax
pop ebx
mov ecx, dword [ebp + 0x1d4]
xor ecx, ebp
pop edi
call fcn.00475360
add ebp, 0x1d8
leave
ret

Function at 0x46b1fc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [eax + 0x14], 8
jb 0x46b204
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne al
ret

Function at 0x46b244
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [eax + 0x14], 8
jb 0x46b24c
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x46b25f
shr eax, 4
and eax, 1
ret
xor al, al
ret
Function at 0x46b927
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x1e4]
sub esp, 0x264
mov eax, dword [0x52e030]
xor eax, ebp
mov dword [ebp + 0x1e0], eax
lea eax, [ebp - 0x2c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x102
ja 0x46b9af
push esi
push edi
lea eax, [ebp - 0x2c]
push eax
lea esi, [ebp - 0x80]
call fcn.00402b82
mov eax, esi
push eax
lea esi, [ebp - 0x64]
call fcn.00402b5c
mov eax, esi
push eax
lea esi, [ebp - 0x48]
call fcn.00402b5c
mov edi, esi
call fcn.00432641
push ebx
mov eax, esi
call fcn.00431857
push 1
xor edi, edi
call fcn.00402efe
push 1
lea esi, [ebp - 0x64]
call fcn.00402efe
push 1
lea esi, [ebp - 0x80]
call fcn.00402efe
pop edi
mov al, 1
pop esi
jmp 0x46b9b1
xor al, al
mov ecx, dword [ebp + 0x1e0]
xor ecx, ebp
call fcn.00475360
add ebp, 0x1e4
leave
ret

Function at 0x46ba5e
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x288]
sub esp, 0x308
mov eax, dword [0x52e030]
xor eax, ebp
mov dword [ebp + 0x284], eax
mov eax, dword [ebp + 0x290]
push ebx
push esi
xor esi, esi
cmp dword [eax + 0x14], 8
push edi
mov dword [ebp + 0x38], eax
mov edi, ecx
mov dword [ebp + 0x3c], esi
jb 0x46ba94
mov eax, dword [eax]
lea ecx, [ebp + 0x78]
push ecx
push esi
push 0x506f40
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x46bb04
xor edi, edi
inc edi
cmp dword [0x536220], edi
jg 0x46bafb
mov dword [ebp + 0x3c], edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], esi
mov eax, edi
mov edi, 0x25e
mov ebx, str.file_util_win.cc
lea esi, [ebp - 0x78]
call fcn.0042b7c4
lea eax, [ebp - 0x70]
push str.Failed_to_get_temporary_file_name_in
push eax
call fcn.00403bcc
mov edx, dword [ebp + 0x38]
cmp dword [edx + 0x14], 8
pop ecx
pop ecx
jb 0x46baf2
mov edx, dword [edx]
push edx
mov ecx, eax
call fcn.0042bf60
pop ecx
test byte [ebp + 0x3c], 1
jmp 0x46bbb5
push 0x104
lea eax, [ebp + 0x78]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, 0x105
ja 0x46bb64
cmp eax, esi
je 0x46bb64
xor ecx, ecx
mov dword [ebp + 0x6c], esi
mov word [ebp + 0x5c], cx
lea ecx, [ebp + 0x78]
lea esi, [ebp + 0x5c]
mov dword [ebp + 0x70], 7
call fcn.004032b4
mov eax, esi
push eax
lea esi, [ebp + 0x40]
call fcn.00402b5c
push edi
mov eax, esi
call fcn.00431857
push 1
xor edi, edi
call fcn.00402efe
push 1
lea esi, [ebp + 0x5c]
call fcn.00402efe
mov al, 1
jmp 0x46bbc1
cmp dword [0x536220], 1
jg 0x46bbb1
mov dword [ebp + 0x3c], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x80], eax
xor eax, eax
mov dword [ebp - 0x7c], esi
inc eax
mov edi, 0x264
mov ebx, str.file_util_win.cc
lea esi, [ebp - 0x78]
call fcn.0042b7c4
lea eax, [ebp + 0x78]
push eax
lea eax, [ebp - 0x70]
push str.Failed_to_get_long_path_name_for
push eax
call fcn.00403bcc
pop ecx
pop ecx
mov ecx, eax
call fcn.0042bf60
pop ecx
test byte [ebp + 0x3c], 2
je 0x46bbbf
lea esi, [ebp - 0x80]
call fcn.0042bdd6
xor al, al
mov ecx, dword [ebp + 0x284]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00475360
add ebp, 0x288
leave
ret
Function at 0x46bd67
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0xdc
mov eax, dword [0x52e030]
xor eax, ebp
mov dword [ebp + 0x70], eax
push ebx
push esi
mov esi, dword [ebp + 0x7c]
push edi
push 8
xor ebx, ebx
pop edi
mov dword [ebp + 0x4c], ebx
cmp dword [esi + 0x14], edi
jb 0x46bd96
mov eax, dword [esi]
mov dword [ebp + 0x50], eax
jmp 0x46bd99
mov dword [ebp + 0x50], esi
push dword [ebp + 0x50]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x46be2e
test al, 0x10
je 0x46bdc3
mov al, 1
mov ecx, dword [ebp + 0x70]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00475360
add ebp, 0x74
leave
ret
xor eax, eax
inc eax
cmp dword [0x536220], eax
jg 0x46be1c
mov edi, 0x29e
mov ebx, str.file_util_win.cc
lea esi, [ebp - 0x68]
mov dword [ebp + 0x4c], 2
call fcn.0042b7c4
push str.conflicts_with_existing_file.
push 0x50c0d0
push dword [ebp + 0x50]
add eax, 8
push str.CreateDirectory_
push eax
call fcn.00403bcc
pop ecx
pop ecx
mov ecx, eax
call fcn.0042bf60
pop ecx
push eax
call fcn.00403bcc
pop ecx
pop ecx
push eax
call fcn.00403bcc
pop ecx
pop ecx
test byte [ebp + 0x4c], 2
je 0x46be2a
lea ebx, [ebp - 0x68]
call fcn.0042b903
xor al, al
jmp 0x46bdb1
push esi
lea eax, [ebp + 0x54]
call fcn.00431ba2
mov eax, esi
lea ecx, [ebp + 0x54]
call fcn.0041c94b
test al, al
je 0x46be53
push 1
xor edi, edi
lea esi, [ebp + 0x54]
call fcn.00402efe
jmp 0x46be2a
lea eax, [ebp + 0x54]
push eax
call fcn.0046bd67
pop ecx
test al, al
jne 0x46be74
push 1
xor edi, edi
lea esi, [ebp + 0x54]
call fcn.00402efe
mov al, bl
jmp 0x46bdb1
push ebx
push dword [ebp + 0x50]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x46be9d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x48], eax
cmp eax, 0xb7
jne 0x46bea1
mov eax, esi
call fcn.0046b244
test al, al
je 0x46bea1
mov bl, 1
jmp 0x46be61
xor eax, eax
inc eax
cmp dword [0x536220], eax
jg 0x46bf01
mov dword [ebp + 0x4c], edi
mov edi, 0x2ba
mov ebx, str.file_util_win.cc
lea esi, [ebp - 0x68]
call fcn.0042b7c4
push 0x50c138
push dword [ebp + 0x48]
add eax, 8
push str.__last_error_is
push dword [ebp + 0x50]
push str.Failed_to_create_directory
push eax
call fcn.00403bcc
pop ecx
pop ecx
mov ecx, eax
call fcn.0042bf60
pop ecx
push eax
call fcn.00403bcc
pop ecx
pop ecx
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.00403bcc
pop ecx
pop ecx
test byte [ebp + 0x4c], 8
je 0x46bf0f
lea ebx, [ebp - 0x68]
call fcn.0042b903
xor bl, bl
jmp 0x46be61
Function at 0x46c05b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [eax + 0x14], 8
jb 0x46c068
mov eax, dword [eax]
push esi
push edi
xor esi, esi
push esi
push 0x8000000
push 3
push esi
push 3
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], esi
call fcn.004376f7
cmp edi, 0xffffffff
je 0x46c099
mov dword [ebp - 4], edi
cmp dword [ebp - 4], esi
jne 0x46c0b0
or esi, 0xffffffff
lea eax, [ebp - 4]
push eax
call fcn.004376f7
pop edi
mov eax, esi
pop esi
leave
ret
push esi
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x46c09e
mov esi, dword [ebp - 8]
cmp esi, dword [ebp + 0xc]
je 0x46c0a1
jmp 0x46c09e
Function at 0x46c2b9
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x1e0]
sub esp, 0x260
mov eax, dword [0x52e030]
xor eax, ebp
mov dword [ebp + 0x1dc], eax
xor eax, eax
push esi
mov word [ebp - 0x2c], ax
lea eax, [ebp - 0x2c]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x46c347
cmp eax, esi
ja 0x46c347
push edi
lea eax, [ebp - 0x2c]
push eax
lea esi, [ebp - 0x80]
call fcn.00402b82
mov eax, esi
push eax
lea esi, [ebp - 0x64]
call fcn.00402b5c
mov eax, esi
push eax
lea esi, [ebp - 0x48]
call fcn.00402b5c
mov edi, esi
call fcn.00432641
push ebx
mov eax, esi
call fcn.00431857
push 1
xor edi, edi
call fcn.00402efe
push 1
lea esi, [ebp - 0x64]
call fcn.00402efe
push 1
lea esi, [ebp - 0x80]
call fcn.00402efe
mov al, 1
pop edi
jmp 0x46c349
xor al, al
mov ecx, dword [ebp + 0x1dc]
xor ecx, ebp
pop esi
call fcn.00475360
add ebp, 0x1e0
leave
ret
Function at 0x46cc87
Capabilities:
Read file via mapping

Disassembly:
push ebp
lea ebp, [esp - 0x1e4]
sub esp, 0x264
mov eax, dword [0x52e030]
xor eax, ebp
mov dword [ebp + 0x1e0], eax
mov eax, dword [ebp + 0x1ec]
cmp dword [eax + 0x14], 8
push ebx
push esi
push edi
mov edi, ecx
jb 0x46ccb5
mov eax, dword [eax]
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 7
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
lea eax, [ebp - 0x78]
push eax
mov dword [ebp - 0x78], ebx
call fcn.004376f7
cmp esi, 0xffffffff
je 0x46cce4
mov dword [ebp - 0x78], esi
cmp dword [ebp - 0x78], ebx
jne 0x46cd0c
lea eax, [ebp - 0x78]
push eax
call fcn.004376f7
xor al, al
mov ecx, dword [ebp + 0x1e0]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00475360
add ebp, 0x1e4
leave
ret
push ebx
push 1
push ebx
push 2
push ebx
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
lea eax, [ebp - 0x7c]
push eax
mov dword [ebp - 0x7c], ebx
call fcn.004376f7
cmp esi, 0xffffffff
je 0x46cd32
mov dword [ebp - 0x7c], esi
cmp dword [ebp - 0x7c], ebx
jne 0x46cd42
lea eax, [ebp - 0x7c]
push eax
call fcn.004376f7
jmp 0x46cce9
push 1
push ebx
push ebx
push 4
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x80], eax
cmp eax, ebx
jne 0x46cd6e
lea eax, [ebp - 0x7c]
push eax
call fcn.004376f7
lea eax, [ebp - 0x78]
push eax
call fcn.004376f7
mov al, bl
jmp 0x46ccf4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x10e
lea ecx, [ebp - 0x3c]
push ecx
push dword [ebp - 0x80]
push eax
call dword [sym.imp.PSAPI.DLL_GetMappedFileNameW]
test eax, eax
je 0x46cdbf
lea eax, [ebp - 0x3c]
push eax
lea esi, [ebp - 0x58]
call fcn.00402b82
mov eax, esi
push eax
lea esi, [ebp - 0x74]
call fcn.00402b5c
push edi
mov eax, esi
call fcn.00431857
push 1
xor edi, edi
call fcn.00402efe
push 1
lea esi, [ebp - 0x58]
call fcn.00402efe
mov bl, 1
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
jmp 0x46cd58

Function at 0x46f37c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
or eax, 0xffffffff
sub esp, 0x14
cmp dword [ebp + 8], eax
je 0x46f3d2
and dword [ebp - 0x14], 0
push edi
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
pop edi
test eax, eax
je 0x46f3c5
mov eax, dword [ebp + 8]
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0x26
neg eax
sbb eax, eax
leave
ret
Function at 0x46f7cb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x46f7e0
xor al, al
jmp 0x46f888
mov ecx, dword [edi + 4]
mov eax, dword [ecx + 0x3c]
mov edx, dword [edi]
push ebx
push dword [eax + ecx + 0x78]
mov ecx, edi
call dword [edx]
mov ebx, eax
mov dword [ebp - 8], ebx
test ebx, ebx
je 0x46f861
mov eax, dword [ebp + 8]
cmp eax, 0xffff
ja 0x46f809
mov word [esi], ax
jmp 0x46f885
push dword [ebx + 0x20]
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
mov ecx, dword [ebx + 0x18]
lea ecx, [eax + ecx*4]
mov dword [ebp - 0xc], eax
mov esi, eax
mov dword [ebp - 4], ecx
cmp eax, ecx
je 0x46f861
mov eax, dword [ebp - 4]
sub eax, esi
sar eax, 2
cdq
sub eax, edx
sar eax, 1
lea ebx, [esi + eax*4]
push dword [ebx]
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
mov ecx, dword [ebp + 8]
mov edx, eax
call fcn.0046f5e7
test eax, eax
je 0x46f85b
jle 0x46f851
lea esi, [ebx + 4]
jmp 0x46f854
mov dword [ebp - 4], ebx
cmp esi, dword [ebp - 4]
jne 0x46f824
jmp 0x46f85d
mov esi, ebx
test eax, eax
je 0x46f865
xor al, al
jmp 0x46f887
mov ebx, dword [ebp - 8]
push dword [ebx + 0x24]
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
sub esi, dword [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
sar esi, 2
mov ax, word [eax + esi*2]
add ax, word [ebx + 0x10]
mov word [ecx], ax
mov al, 1
pop ebx
pop esi
leave
ret 8