joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4595f0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x5142b0]
xor eax, ebp
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
lea eax, [ebp - 0x228]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
push ecx
push str.SELECT__FROM_BooleanExp_WHERE_B_ID___d
mov edx, dword [ebp - 4]
push edx
call fcn.00492848
add esp, 0xc
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.004391f0
add esp, 8
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
cmp dword [edx + 4], 0
je 0x45972a
mov eax, dword [ebp - 0x18]
push eax
call fcn.004378f0
add esp, 4
mov ecx, dword [ebp - 0x18]
push ecx
lea edx, [ebp - 8]
push edx
push str.LEXPRESSION
call fcn.00437990
add esp, 0xc
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.004595f0
add esp, 0xc
mov dword [ebp - 0x230], eax
mov ecx, dword [ebp - 0x18]
push ecx
lea edx, [ebp - 8]
push edx
push str.REXPRESSION
call fcn.00437990
add esp, 0xc
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.004595f0
add esp, 0xc
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x18]
push ecx
lea edx, [ebp - 8]
push edx
push 0x513124
call fcn.00437990
add esp, 0xc
mov dword [ebp - 0xc], eax
push 0x513130
mov eax, dword [ebp - 0xc]
push eax
call fcn.00493b10
add esp, 8
test eax, eax
jne 0x459709
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x230]
push eax
call fcn.00457170
add esp, 0xc
mov dword [ebp - 0x14], eax
jmp 0x459723
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x230]
push eax
call fcn.00457200
add esp, 0xc
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
jmp 0x459754
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00459cb0
add esp, 8
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp - 0x22c]
jmp 0x459754
mov ecx, dword [ebp - 0x24]
xor ecx, ebp
call fcn.0048ed61
mov esp, ebp
pop ebp
ret
Function at 0x4598e0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x5142b0]
xor eax, ebp
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
lea eax, [ebp - 0x218]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
push ecx
push str.SELECT_B_ID_FROM_BooleanExp_WHERE_B_ID___d
mov edx, dword [ebp - 4]
push edx
call fcn.00492848
add esp, 0xc
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004391f0
add esp, 8
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
cmp dword [edx + 4], 0
je 0x459a6a
mov eax, dword [ebp + 8]
push eax
push str.SELECT_LEXPRESSION_FROM_BooleanExp_WHERE_B_ID___d
mov ecx, dword [ebp - 4]
push ecx
call fcn.00492848
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.004391f0
add esp, 8
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 4], 0
je 0x4599a8
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x10]
mov ecx, dword [eax]
cmp dword [ecx + 4], 0
je 0x4599a8
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
mov eax, dword [edx]
mov dword [ebp - 0x21c], eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x21c]
push eax
call fcn.004598e0
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push str.SELECT_OPERATOR_FROM_BooleanExp_WHERE_B_ID___d
mov edx, dword [ebp - 4]
push edx
call fcn.00492848
add esp, 0xc
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004391f0
add esp, 8
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
cmp dword [edx + 4], 0
je 0x4599f5
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
mov edx, dword [ecx]
cmp dword [edx + 4], 0
je 0x4599f5
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call fcn.00441900
add esp, 8
mov eax, dword [ebp + 8]
push eax
push str.SELECT_REXPRESSION_FROM_BooleanExp_WHERE_B_ID___d
mov ecx, dword [ebp - 4]
push ecx
call fcn.00492848
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.004391f0
add esp, 8
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 4], 0
je 0x459a68
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x10]
mov ecx, dword [eax]
cmp dword [ecx + 4], 0
je 0x459a68
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.004598e0
add esp, 0xc
jmp 0x459a7a
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00459a90
add esp, 8
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0048ed61
mov esp, ebp
pop ebp
ret
Function at 0x459cb0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x5142b0]
xor eax, ebp
mov dword [ebp - 0x34], eax
mov dword [ebp - 8], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0xc], 0
mov byte [ebp - 0x1d], 0
mov dword [ebp - 0x23c], 0
lea eax, [ebp - 0x238]
mov dword [ebp - 8], eax
push str.RelationalExp
lea ecx, [ebp - 0x1c]
push ecx
call fcn.0042bfe0
add esp, 8
movzx edx, al
cmp edx, 1
je 0x459d24
xor eax, eax
jmp 0x459e84
mov eax, dword [ebp - 0x1c]
push eax
call fcn.004373c0
add esp, 4
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.00437ce0
add esp, 4
mov dword [ebp - 0x240], eax
mov edx, dword [ebp + 8]
push edx
push str.SELECT__FROM_RelationalExp_WHERE_R_ID___d
mov eax, dword [ebp - 8]
push eax
call fcn.00492848
add esp, 0xc
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x240]
push edx
call fcn.004391f0
add esp, 8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x30]
push eax
call fcn.00438210
add esp, 4
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 4], 0
je 0x459e75
mov edx, dword [ebp - 0x14]
push edx
call fcn.004378f0
add esp, 4
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
push ecx
push str.LIDENTIFIER
call fcn.00437990
add esp, 0xc
mov dword [ebp - 0x23c], eax
mov edx, dword [ebp + 0xc]
push edx
push 0
push 0xf
push 0
push 0
mov eax, dword [ebp - 0x23c]
push eax
push 0
push 0
call fcn.00456e80
add esp, 0x20
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x14]
push ecx
lea edx, [ebp - 0x10]
push edx
push str.RIDENTIFIER
call fcn.00437990
add esp, 0xc
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call fcn.0048f020
add esp, 4
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x14]
push ecx
lea edx, [ebp - 0x10]
push edx
push str.OPERATOR
call fcn.00437990
add esp, 0xc
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x18], 0
jmp 0x459e23
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xa
jg 0x459e4e
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx*4 + 0x51280c]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.00493b10
add esp, 8
test eax, eax
jne 0x459e4c
mov cl, byte [ebp - 0x18]
mov byte [ebp - 0x1d], cl
jmp 0x459e4e
jmp 0x459e1a
mov edx, dword [ebp + 0xc]
push edx
movzx eax, byte [ebp - 0x1d]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0x24]
push eax
call fcn.004570c0
add esp, 0x14
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
jmp 0x459e84
push str._nInvalid_ID_n
call fcn.00423960
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0x34]
xor ecx, ebp
call fcn.0048ed61
mov esp, ebp
pop ebp
ret
Function at 0x45c210
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
push 0
push 1
push str.Microsoft_Base_Cryptographic_Provider_v1.0
push 0
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
jne 0x45c24b
push 8
push 1
push str.Microsoft_Base_Cryptographic_Provider_v1.0
push eax
lea ecx, [ebp - 4]
push ecx
call esi
test eax, eax
jne 0x45c24b
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_CryptGetUserKey]
push ebx
push edi
lea edx, [ebp - 8]
push edx
push 2
push eax
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [sym.imp.ADVAPI32.dll_CryptGenKey]
test eax, eax
jne 0x45c2a8
call ebx
mov edx, dword [ebp - 4]
cmp eax, 0x8009000d
jne 0x45c2e7
lea ecx, [ebp - 8]
push ecx
push 0
push 2
push edx
call edi
test eax, eax
jne 0x45c29e
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push 1
push ecx
call esi
test eax, eax
jne 0x45c303
call ebx
cmp eax, 0x8009000d
mov eax, dword [ebp - 4]
jne 0x45c31b
lea edx, [ebp - 8]
push edx
push 0
push 1
push eax
call edi
test eax, eax
jne 0x45c2f9
mov ecx, dword [ebp - 4]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov ecx, dword [ebp - 4]
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
pop ebx
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x45c500
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
push esi
push str.CreateFolder_:_CreateFolder_function_called_with__S_n
call fcn.00423960
lea eax, [ebp - 4]
push eax
xor ebx, ebx
push esi
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
call fcn.00462840
mov esi, dword [ebp - 4]
add esp, 0x10
cmp esi, ebx
jne 0x45c547
push str.CreateFolder_:_The_directory_to_create_is_NULL_.__n
call fcn.00423ad0
add esp, 4
lea esi, [ebx + 0xd]
jmp 0x45c66b
mov eax, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x45c550
sub eax, edx
je 0x45c585
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x45c560
sub eax, edx
cmp eax, 4
jae 0x45c585
push str.CreateFolder_:_The_Drive_letter_Given.hence_it_cannot_be_created__n
call fcn.00423db0
add esp, 4
mov esi, 0xb7
jmp 0x45c66b
push edi
push esi
call fcn.0045c3c0
mov ecx, dword [ebp - 4]
push eax
push ecx
call fcn.00442940
mov edi, eax
add esp, 0xc
cmp edi, ebx
je 0x45c627
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x45c5a6
sub eax, edx
cmp eax, 3
jbe 0x45c5ca
mov edx, dword [ebp - 4]
mov ecx, edi
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x45c5c0
mov eax, edi
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x45c5d0
sub eax, edx
je 0x45c5ee
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x45c5e0
sub eax, edx
cmp eax, 4
jb 0x45c613
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x45c5f3
sub eax, edx
cmp eax, 4
jne 0x45c627
cmp byte [edi + 1], 0x3a
jne 0x45c627
mov al, 0x5c
cmp byte [edi + 2], al
jne 0x45c627
cmp byte [edi + 3], al
jne 0x45c627
push str.CreateFolder_:_The_Drive_letter_Given.hence_it_cannot_be_created__n
call fcn.00423db0
add esp, 4
mov esi, 0xb7
jmp 0x45c65d
mov edx, dword [ebp - 4]
push edx
push str.CreateFolder_:_The_Directory_to_create_is__s__n
call fcn.00423db0
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
call fcn.004628e0
mov edx, dword [ebp - 8]
add esp, 0x10
push ebx
push edx
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov esi, eax
cmp esi, 0xb7
jne 0x45c65d
xor esi, esi
cmp edi, ebx
je 0x45c66a
push edi
call fcn.0048efd8
add esp, 4
pop edi
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x45c67e
push eax
call fcn.0048efd8
add esp, 4
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 8]
cmp eax, ebx
je 0x45c691
push eax
call fcn.0048efd8
add esp, 4
mov dword [ebp - 8], ebx
push esi
push str.CreateFolder_function_returns_Error_code__d__n
call fcn.00423960
add esp, 8
cmp esi, ebx
je 0x45c6ac
push esi
call fcn.004635b0
add esp, 4
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45cd10
Capabilities:
Check if file exists
Get file size

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0
push 0x80
push 3
push 0
push 0
push SQLAllocStmt
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0xffffffff
je 0x45cd8a
call edi
cmp eax, 2
je 0x45cd8a
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
push edi
push ebx
push str.IsFileExist_:_The_File__s_size_is_given_by_:__d_n
call fcn.00423960
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x45cd80
push ebx
push str.IsFileExist_:_The_required_file___s__size_is_0_bytes._Hence_returning_file_not_found._n
call fcn.00423960
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
call edi
push eax
push ebx
push str.IsFileExist_:_The_File_Name__s_is_not_found__d_n
call fcn.00423960
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x45d720
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x5142b0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x9c
lea eax, [ebp - 0xa0]
push 0
push eax
call fcn.00492ac0
add esp, 0xc
lea ecx, [ebp - 0xa0]
push ecx
mov dword [ebp - 0xa0], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x45d78b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetOsFamily_:_Unable_to_find_the_OSVersion___Errorcode__d__n
call fcn.00423ad0
add esp, 8
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048ed61
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x90], 2
jne 0x45d86b
mov eax, dword [ebp - 0x9c]
cmp eax, 4
jbe 0x45d86b
cmp eax, 6
jne 0x45d811
mov eax, dword [ebp - 0x98]
test eax, eax
jne 0x45d7c9
mov eax, 2
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048ed61
mov esp, ebp
pop ebp
ret
cmp eax, 1
jne 0x45d7e1
mov eax, 3
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048ed61
mov esp, ebp
pop ebp
ret
cmp eax, 2
jne 0x45d7f9
mov eax, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048ed61
mov esp, ebp
pop ebp
ret
cmp eax, 3
jne 0x45d858
mov eax, 5
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048ed61
mov esp, ebp
pop ebp
ret
cmp eax, 0xa
jne 0x45d832
cmp dword [ebp - 0x98], 0
jne 0x45d858
mov eax, 6
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048ed61
mov esp, ebp
pop ebp
ret
cmp eax, 5
jne 0x45d858
mov eax, dword [ebp - 0x98]
test eax, eax
jne 0x45d84f
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048ed61
mov esp, ebp
pop ebp
ret
cmp eax, 1
jae 0x45d778
mov eax, 7
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048ed61
mov esp, ebp
pop ebp
ret
push str.GetOsFamily_:The_windows_is_unable_to_found_.__n
call fcn.00423ad0
mov ecx, dword [ebp - 4]
xor ecx, ebp
add esp, 4
or eax, 0xffffffff
call fcn.0048ed61
mov esp, ebp
pop ebp
ret
Function at 0x45d890
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x45d8e3
push edi
mov edi, dword [ebp + 0xc]
cmp edi, ebx
je 0x45d8e8
push esi
push ebx
push ebx
push 3
push ebx
push ebx
push 0x20000
push eax
mov dword [edi], ebx
mov dword [edi + 4], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x45d8dc
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, edi
pop edi
pop ebx
pop ebp
ret
pop esi
pop edi
mov eax, ebx
pop ebx
pop ebp
ret
mov eax, ebx
pop ebx
pop ebp
ret
pop edi
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x45f3f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c8b18
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5142b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0x45f511
cmp byte [edi + 0x49], bl
je 0x45f511
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
call edx
cmp eax, 0xffffffff
je 0x45f505
mov ecx, 0xf
xor eax, eax
mov byte [ebp - 0x2c], bl
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 8
cmp ecx, 0x10
jae 0x45f465
lea eax, [ebp - 0x2c]
mov byte [eax + 8], bl
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x18]
mov edx, eax
cmp ebx, 0x10
jae 0x45f47d
lea edx, [ebp - 0x2c]
mov eax, edx
add edx, dword [ebp - 0x1c]
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x30]
push ebx
push edx
push eax
lea eax, [edi + 0x4c]
push eax
mov eax, dword [esi + 0x18]
call eax
sub eax, 0
je 0x45f4a6
dec eax
je 0x45f4aa
sub eax, 2
lea ecx, [ebp - 0x2c]
jne 0x45f500
jmp 0x45f50c
mov byte [edi + 0x49], 0
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
cmp ebx, 0x10
jae 0x45f4ba
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, ecx
je 0x45f4e3
cmp ebx, 0x10
jae 0x45f4c9
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call fcn.004952d5
add esp, 0x10
cmp esi, eax
jne 0x45f4fd
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [edi + 0x49], 0
je 0x45f509
test esi, esi
jne 0x45f471
push esi
push 8
lea ecx, [ebp - 0x2c]
call fcn.00411940
jmp 0x45f46b
lea ecx, [ebp - 0x2c]
call fcn.0040f2c0
xor al, al
jmp 0x45f513
lea ecx, [ebp - 0x2c]
call fcn.0040f2c0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048ed61
mov esp, ebp
pop ebp
ret
Function at 0x461a60
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c8bf8
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x5142b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 1
mov dword [ebp - 4], 0
jle 0x461aa6
mov eax, dword [eax - 0xc]
push eax
lea ecx, [ebp + 8]
call fcn.004014b0
mov eax, dword [ebp + 8]
push 0
push 0x2000000
push 3
push 0
push 7
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0xffffffff
jne 0x461ae4
push str.CheckLogSizeReached_:_Unable_to_get_the_file_handle__n
call fcn.00423ad0
add esp, 4
call edi
push eax
call fcn.004634d0
add esp, 4
lea ecx, [ebp - 0x14]
push ecx
push esi
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x461b11
call edi
push eax
push str.CheckLogSizeReached_:_Error_occurred_in_getting_the_size__d__n
call fcn.00423ad0
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 1
jle 0x461b30
mov edx, dword [eax - 0xc]
push edx
lea ecx, [ebp + 8]
call fcn.004014b0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
push ecx
push edx
push eax
push str.CheckLogSizeReached_:_The_log_file_size_of__s_is_given_by__ld__n
call fcn.00423db0
mov ecx, dword [ebp + 0xc]
xor eax, eax
add esp, 0x10
cmp dword [ebp - 0x10], eax
jl 0x461ba0
jg 0x461b57
cmp dword [ebp - 0x14], ecx
jb 0x461ba0
push str.CheckLogSizeReached_:_The_size_is_greater_than_the_given_size_........._n
call fcn.00423db0
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x461b8a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push str.CheckLogSizeReached_:_The_size_is_less_the_required_size__n
call fcn.00423960
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x461bd3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x462140
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x513c74], 0
push esi
je 0x4621dd
push str.WriteEvent:_Registering_Event_Source___n
call fcn.00423db0
add esp, 4
push str.DesktopCentral
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
test esi, esi
jne 0x46218a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._Function_RegisterEventSource_failed___d__n
call fcn.00423db0
add esp, 8
xor eax, eax
pop esi
pop ebp
ret
mov eax, dword [ebp + 0x10]
push eax
push str.WriteEvent:_Reporting_event__s__n
call fcn.00423db0
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
add esp, 8
push 0
lea ecx, [ebp + 0x10]
push ecx
push 0
push 1
push 0
push edx
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
test eax, eax
jne 0x4621ce
push str._WriteEvent:_Function_ReportEvent_failed___d__n
call fcn.00423db0
add esp, 4
xor eax, eax
pop esi
pop ebp
ret
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov eax, 1
pop esi
pop ebp
ret
mov ecx, dword [ebp + 0x10]
push ecx
push str.WriteEvent_:_No_need_to_Report_the_event_message___s__in_the_Event_Viewer_.__n
call fcn.00423db0
add esp, 8
mov eax, 1
pop esi
pop ebp
ret