joyce8/EMBER2024-capa huggingface dataset:
Function at 0x471880
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x30
mov eax, dword [0x5b2070]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
mov ebx, dword [esp + 0x38]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x4718b0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.004e645e
add esp, 0x30
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x4718ed
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x4718ed
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.004e645e
add esp, 0x30
ret 4
cmp dword [esi + 0x4c], 0
je 0x4719e2
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x471915
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x471949
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.005277e3
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.004e645e
add esp, 0x30
ret 4
lea eax, [esp + 0xc]
mov byte [esp + 0x17], bl
mov edx, dword [ecx]
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x2b]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x4719e2
cmp eax, 1
jle 0x4719b1
cmp eax, 3
jne 0x4719e2
push dword [esi + 0x4c]
movsx eax, byte [esp + 0x1b]
push eax
call fcn.005277e3
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.004e645e
add esp, 0x30
ret 4
mov edi, dword [esp + 0xc]
lea eax, [esp + 0x18]
sub edi, eax
je 0x4719d0
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00528307
add esp, 0x10
cmp edi, eax
jne 0x4719e2
lea eax, [esp + 0x17]
mov byte [esi + 0x3d], 1
cmp dword [esp + 0x10], eax
jne 0x4718d7
mov ecx, dword [esp + 0x38]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004e645e
add esp, 0x30
ret 4
Function at 0x484120
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x563ce8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x5b2070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
cmp esi, 0xffffffff
jne 0x48415b
xor al, al
jmp 0x48421f
and esi, 0xffffb1af
mov eax, edi
cmp dword [edi + 0x14], 8
jb 0x48416b
mov eax, dword [edi]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
push eax
call ebx
test eax, eax
je 0x484180
mov al, 1
jmp 0x48421f
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
lea edx, [ebp - 0x28]
mov ecx, edi
call fcn.00485800
test al, al
je 0x4841ca
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push esi
cmovae eax, dword [ebp - 0x28]
push eax
call ebx
test eax, eax
je 0x4841ca
mov bl, 1
jmp 0x4841cc
xor bl, bl
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x484209
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4841ff
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x48423b
push edx
push ecx
call fcn.004e649f
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
mov al, bl
mov dword [ebp - 0x14], 7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e645e
mov esp, ebp
pop ebp
ret
call fcn.0050ba48
int3

Function at 0x484250
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x563d18
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x5b2070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x484286
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x484330
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.00485800
test al, al
je 0x4842df
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x48431c
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x484312
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x48434d
push edx
push ecx
call fcn.004e649f
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e645e
mov esp, ebp
pop ebp
ret
call fcn.0050ba48
int3
Function at 0x4848b0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x563dd0
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x5b2070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
cmp dword [edi + 0x14], 8
mov ecx, edi
jb 0x4848e9
mov ecx, dword [edi]
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4848f3
mov eax, dword [esi]
mov ebx, dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0
push ecx
push eax
call ebx
test eax, eax
je 0x48490a
mov al, 1
jmp 0x484a51
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov byte [ebp - 0x41], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
mov dword [ebp - 4], eax
lea edx, [ebp - 0x40]
mov ecx, esi
call fcn.00485800
movzx ecx, byte [ebp - 0x41]
test al, al
mov edx, 1
mov dword [ebp - 0x18], 0
cmovne ecx, edx
mov dword [ebp - 0x14], 0
xor eax, eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], dl
lea edx, [ebp - 0x28]
mov ecx, edi
call fcn.00485800
test al, al
jne 0x484986
cmp byte [ebp - 0x48], al
je 0x4849aa
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
push 0
cmovae ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
push ecx
cmovae eax, dword [ebp - 0x40]
push eax
call ebx
test eax, eax
je 0x4849aa
mov bl, 1
jmp 0x4849ac
xor bl, bl
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x4849ea
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4849e0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x484a6d
push edx
push ecx
call fcn.004e649f
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x484a3b
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x484a31
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x484a72
push edx
push ecx
call fcn.004e649f
add esp, 8
xor eax, eax
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
mov al, bl
mov dword [ebp - 0x2c], 7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e645e
mov esp, ebp
pop ebp
ret
call fcn.0050ba48
call fcn.0050ba48
int3
Function at 0x4851d0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x5b2070]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
mov ebx, dword [esp + 0x218]
lea eax, [esp + 4]
push esi
push edi
push 0x20c
push 0
push eax
mov edi, edx
mov esi, ecx
call fcn.00501c30
add esp, 0xc
cmp dword [edi + 0x14], 8
jb 0x48520e
mov edi, dword [edi]
cmp dword [esi + 0x14], 8
jb 0x485216
mov esi, dword [esi]
lea eax, [esp + 0xc]
push eax
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x485276
xor eax, eax
lea edx, [esp + 0xc]
mov word [esp + 0x216], ax
lea esi, [edx + 2]
nop word [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x485240
sub edx, esi
lea eax, [esp + 0xc]
sar edx, 1
mov ecx, ebx
push edx
push eax
call fcn.00403570
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.004e645e
add esp, 0x210
ret
mov ecx, dword [esp + 0x218]
xor al, al
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004e645e
add esp, 0x210
ret
Function at 0x485c10
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x5a4348
push 0x500700
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x5b2070]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x28], 0
xor esi, esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x2c], esi
xor ebx, ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x24], ebx
mov word [ebp - 0x20], 0x100
mov eax, dword [ecx]
mov edi, dword [eax + 0x28]
mov dword [ebp - 0x40], edi
test edi, edi
jne 0x485c79
xor eax, eax
jmp 0x485def
mov dword [ebp - 4], ebx
push str.InitializeSecurityDescriptor
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x485dba
push 1
push dword [ebp - 0x34]
call eax
test eax, eax
je 0x485dba
push 0x58aa94
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x485dba
lea ecx, [ebp - 0x28]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
lea ecx, [ebp - 0x24]
push ecx
call eax
test eax, eax
je 0x485dba
push str.GetLengthSid
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x485dba
push dword [ebp - 0x28]
call eax
add eax, 0x10
mov dword [ebp - 0x30], eax
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x3c], esi
test esi, esi
je 0x485dba
push str.InitializeAcl
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x485dba
push 2
push dword [ebp - 0x30]
push esi
call eax
test eax, eax
je 0x485dba
push str.AddAccessAllowedAce
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x485dba
push dword [ebp - 0x28]
push 0x10000000
push 2
push esi
call eax
test eax, eax
je 0x485dba
push str.SetSecurityDescriptorDacl
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x30], eax
test eax, eax
je 0x485dba
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x485da3
push 0
push ecx
push 1
push dword [ebp - 0x34]
call eax
test eax, eax
je 0x485d90
mov ebx, 1
mov dword [ebp - 0x38], ebx
cmp dword [ebp - 0x2c], 0
je 0x485da0
jmp 0x485dba
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x30]
push 0
push esi
push 1
push dword [ebp - 0x34]
call eax
mov ecx, 1
test eax, eax
cmovne ebx, ecx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 4], 0xfffffffe
call fcn.00485e16
test ebx, ebx
jne 0x485ded
test esi, esi
je 0x485ddf
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor esi, esi
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x485ded
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004e645e
mov esp, ebp
pop ebp
ret 0xc
Function at 0x489d10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x564a58
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x5b2070]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
mov esi, dword [ebp + 8]
mov ecx, esi
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x3c]
push eax
push 2
push 0xffffffffffffffff
push 0xffff8000
movlpd qword [ebp - 0x3c], xmm0
call fcn.0046dc40
test al, al
jne 0x489d70
mov eax, 1
jmp 0x489eed
push 0x10000
call fcn.004e6b88
mov ebx, eax
mov dword [ebp - 0x18], 0
add esp, 4
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], 0
push 0x10000
push 0
push ebx
call fcn.00501c30
mov eax, dword [esi]
add esp, 0xc
mov dword [ebp - 0x1c], 0
test eax, eax
je 0x489ec6
test ebx, ebx
je 0x489ec6
cmp dword [eax], 0xffffffff
je 0x489ec6
push 0
lea ecx, [ebp - 0x1c]
push ecx
push 0x8000
push ebx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x489ec6
mov esi, dword [ebp - 0x20]
mov ecx, 0x8000
xor ebx, ebx
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], ecx
add esi, ecx
nop word [eax + eax]
cmp byte [edi + 0x9c], 0
jne 0x489ebc
lea edx, [ebp - 0x30]
mov dword [ebp - 0x30], 0
push edx
lea edx, [ebp - 0x24]
mov dword [ebp - 0x24], 0
push edx
push ecx
mov ecx, dword [ebp - 0x34]
lea eax, [esi + ebx]
push eax
call fcn.004c81f0
test al, al
je 0x489eaf
mov eax, dword [ebp - 0x24]
test eax, eax
jne 0x489e62
mov eax, dword [edi + 0xc0]
test eax, eax
je 0x489e51
push 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [edi + 0x9c], 0
jne 0x489ebc
inc dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
jmp 0x489e6c
add ebx, eax
cmp ebx, 0x8000
je 0x489e7c
cmp dword [ebp - 0x28], 0xf
ja 0x489ea5
mov ecx, dword [ebp - 0x2c]
sub ecx, eax
mov dword [ebp - 0x2c], ecx
jne 0x489e00
mov ebx, dword [ebp - 0x20]
mov edx, 0x7ffc
mov ecx, ebx
mov eax, dword [ecx]
cmp eax, dword [esi]
jne 0x489e9e
add ecx, 4
add esi, 4
sub edx, 4
jae 0x489e86
mov esi, 4
jmp 0x489ed7
mov esi, 5
jmp 0x489ed7
mov ebx, dword [ebp - 0x20]
mov esi, 3
jmp 0x489ed7
mov eax, dword [ebp - 0x30]
mov esi, 3
mov ebx, dword [ebp - 0x20]
jmp 0x489ed1
mov ebx, dword [ebp - 0x20]
mov esi, 2
jmp 0x489ed7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 1
mov dword [edi + 0xb0], eax
mov dword [ebp - 4], 0xffffffff
test ebx, ebx
je 0x489eeb
push ebx
call fcn.004e6b83
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004e645e
mov esp, ebp
pop ebp
ret 0xc
Function at 0x490530
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x565578
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x5b2070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x38]
mov edi, dword [ebp + 0xc]
push esi
push eax
call fcn.00490df0
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
mov dword [ebp - 0x18], 0
mov word [ebp - 0x14], 0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x18]
call fcn.004a3580
xorps xmm0, xmm0
lea eax, [ebp - 0x18]
movlpd qword [ebp - 0x20], xmm0
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov byte [ebp - 0x1c], 0
test eax, eax
jne 0x4905b4
xor bl, bl
jmp 0x4905d2
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4905cc
cmp eax, 0x80
je 0x4905cc
xor bl, bl
jmp 0x4905d2
mov byte [ebp - 0x14], 1
mov bl, 1
mov byte [ebp - 0x1c], bl
mov byte [ebp - 4], 2
lea eax, [ebp - 0x39]
push eax
push edi
push esi
mov byte [ebp - 0x39], 0
call fcn.004906c0
test al, al
jne 0x490600
cmp byte [ebp - 0x39], al
je 0x490600
cmp dword [esi + 0x14], 8
jb 0x4905f9
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], 1
test bl, bl
je 0x49061a
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x490616
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [ebp - 0x14], 0
mov dword [ebp - 0x20], 0
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x49063a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x18], 0
mov word [ebp - 0x14], 0
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x24]
cmp edx, 8
jb 0x49067d
mov ecx, dword [ebp - 0x38]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x490673
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4906af
push edx
push ecx
call fcn.004e649f
add esp, 8
xor eax, eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 7
mov word [ebp - 0x38], ax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e645e
mov esp, ebp
pop ebp
ret 8
call fcn.0050ba48
int3
Function at 0x493354
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x5b2070]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
mov esi, ecx
mov dword [esp + 4], 0x114
push 0x110
lea eax, [esp + 0xc]
push 0
push eax
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov byte [esi], 0
call fcn.00501c30
add esp, 0xc
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, esi
je 0x4933d7
cmp dword [esp + 8], 6
jb 0x4933d7
mov byte [esi], 1
mov ecx, dword [esp + 0x118]
pop esi
xor ecx, esp
call fcn.004e645e
add esp, 0x118
ret
Function at 0x493400
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5658e0
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x5b2070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push 0xc
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x28]
push str.wintrust.dll
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.00403570
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.00478b30
mov ecx, eax
call fcn.00478c00
mov edi, eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x4934b5
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4934ab
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4935ee
push edx
push ecx
call fcn.004e649f
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
push 0xb
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x2c], eax
push str.crypt32.dll
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
call fcn.00403570
mov dword [ebp - 4], 1
lea eax, [ebp - 0x40]
push eax
call fcn.00478b30
mov ecx, eax
call fcn.00478c00
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x49354a
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x49353d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4935f3
push edx
push ecx
call fcn.004e649f
mov eax, dword [ebp - 0x10]
add esp, 8
xor ecx, ecx
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], cx
test edi, edi
je 0x4935dc
test eax, eax
je 0x4935dc
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CryptCATAdminCalcHashFromFileHandle
push edi
call esi
push str.CryptCATAdminAcquireContext
push edi
mov dword [ebx + 4], eax
call esi
push str.CryptCATAdminEnumCatalogFromHash
push edi
mov dword [ebx + 8], eax
call esi
push str.CryptCATCatalogInfoFromContext
push edi
mov dword [ebx + 0xc], eax
call esi
push str.CryptCATAdminReleaseCatalogContext
push edi
mov dword [ebx + 0x10], eax
call esi
push str.CryptCATAdminReleaseContext
push edi
mov dword [ebx + 0x14], eax
call esi
push str.WTHelperProvDataFromStateData
push edi
mov dword [ebx + 0x18], eax
call esi
push str.WTHelperGetProvSignerFromChain
push edi
mov dword [ebx + 0x1c], eax
call esi
push str.WinVerifyTrust
push edi
mov dword [ebx + 0x20], eax
call esi
push str.CertNameToStrW
push dword [ebp - 0x10]
mov dword [ebx + 0x24], eax
call esi
mov dword [ebx + 0x28], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0050ba48
call fcn.0050ba48
int3
Function at 0x494990
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x5b2070]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
push ebx
push ebp
mov ebp, ecx
mov dword [esp + 8], eax
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
push edi
cmp dword [ebp + 0x10], 0xffffffff
mov edi, dword [esp + 0x20]
je 0x494a12
mov ecx, 0x100000
nop dword [eax]
nop word [eax + eax]
cmp esi, 0x100000
mov dword [esp + 0x14], 0
push 0
mov eax, esi
cmova eax, ecx
lea ecx, [esp + 0x18]
push ecx
push eax
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x14]
add ebx, ecx
test eax, eax
je 0x494a12
test ecx, ecx
je 0x494a0e
add edi, ecx
sub esi, ecx
mov ecx, 0x100000
jne 0x4949d0
xor eax, eax
jmp 0x494a17
mov eax, 1
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x494a21
mov dword [ecx], ebx
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004e645e
add esp, 0xc
ret 0xc

Function at 0x494aa0
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x5b2070]
xor eax, esp
mov dword [esp + 4], eax
push esi
mov esi, dword [esp + 0x10]
test esi, esi
jne 0x494ace
mov eax, 1
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.004e645e
add esp, 8
ret 4
mov eax, dword [ecx + 0xc]
cmp eax, 0xffffffff
je 0x494ab7
push edi
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x494b14
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x494b14
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.004e645e
add esp, 8
ret 4
mov ecx, dword [esp + 8]
xor eax, eax
add eax, edi
mov dword [esi], eax
adc ecx, 0
xor eax, eax
mov dword [esi + 4], ecx
mov ecx, dword [esp + 0xc]
pop edi
pop esi
xor ecx, esp
call fcn.004e645e
add esp, 8
ret 4

Function at 0x4999f0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5669bf
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5b2070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, dword [ebp + 8]
mov ecx, edi
push esi
mov dword [ebp - 0x10], edi
call fcn.00407c70
mov dword [ebp - 4], 0
lea eax, [esi + 0x18]
push eax
lea ecx, [edi + 0x18]
call fcn.00407c70
mov byte [ebp - 4], 1
lea eax, [esi + 0x30]
push eax
lea ecx, [edi + 0x30]
call fcn.00407c70
mov byte [ebp - 4], 2
lea eax, [esi + 0x48]
push eax
lea ecx, [edi + 0x48]
call fcn.00407c70
mov byte [ebp - 4], 3
lea ecx, [edi + 0x64]
mov al, byte [esi + 0x60]
mov byte [edi + 0x60], al
lea eax, [esi + 0x64]
push eax
call fcn.00407c70
mov byte [ebp - 4], 4
lea eax, [esi + 0x7c]
push eax
lea ecx, [edi + 0x7c]
call fcn.00407c70
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret