joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44e9a5
Capabilities:
Set registry value

Disassembly:
push 8
mov eax, 0x51ef15
call fcn.004fc6ce
xor edi, edi
cmp dword [ebp + 0x14], edi
je 0x44ea46
cmp dword [ebp + 8], edi
je 0x44ea46
cmp dword [ebp + 0xc], edi
je 0x44ea46
mov eax, dword [0x590e04]
mov ecx, 0x590e04
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push dword [ebp + 8]
lea eax, [ebp - 0x14]
push dword [ebp + 0x14]
mov dword [ebp - 4], edi
push str._s_s
call fcn.0042ee4a
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x14]
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
mov dword [ebp - 0x10], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x44ea1c
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], edi
mov edi, dword [ebp - 0x14]
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push dword [ebp + 0xc]
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov ebx, eax
neg ebx
sbb bl, bl
lea eax, [edi - 0x10]
inc bl
call fcn.00405521
mov al, bl
jmp 0x44ea48
xor al, al
call fcn.004fc7a6
ret

Function at 0x44ea4e
Capabilities:
Set registry value

Disassembly:
push 8
mov eax, 0x51ef15
call fcn.004fc6ce
xor eax, eax
mov esi, str.software360TotalSecurity
cmp eax, esi
je 0x44eaed
xor edi, edi
cmp dword [ebp + 8], edi
je 0x44eaed
cmp dword [ebp + 0xc], edi
je 0x44eaed
mov eax, dword [0x590e04]
mov ecx, 0x590e04
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push dword [ebp + 8]
lea eax, [ebp - 0x14]
push esi
push str._s_s
mov dword [ebp - 4], edi
call fcn.0042ee4a
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
push esi
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
mov dword [ebp - 0x10], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x44eac3
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], edi
mov edi, dword [ebp - 0x14]
push 8
lea eax, [ebp + 0x10]
push eax
push 0xb
push dword [ebp + 0xc]
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov ebx, eax
neg ebx
sbb bl, bl
lea eax, [edi - 0x10]
inc bl
call fcn.00405521
mov al, bl
jmp 0x44eaef
xor al, al
call fcn.004fc7a6
ret
Function at 0x44eaf5
Capabilities:
Set registry value

Disassembly:
push 8
mov eax, 0x51ef15
call fcn.004fc6ce
xor eax, eax
mov esi, str.Software360
cmp eax, esi
je 0x44eb9d
mov edi, str.360Speedld
cmp eax, edi
je 0x44eb9d
mov ebx, str.myboottime
cmp eax, ebx
je 0x44eb9d
mov eax, dword [0x590e04]
mov ecx, 0x590e04
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
and dword [ebp - 4], 0
push edi
push esi
push str._s_s
lea eax, [ebp - 0x14]
call fcn.0042ee4a
and dword [ebp - 0x10], 0
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
push esi
mov esi, SysReAllocString
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x44eb75
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x10], 0
mov edi, dword [ebp - 0x14]
push 8
lea eax, [ebp + 8]
push eax
push 0xb
push ebx
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov ebx, eax
neg ebx
sbb bl, bl
lea eax, [edi - 0x10]
inc bl
call fcn.00405521
mov al, bl
jmp 0x44eb9f
xor al, al
call fcn.004fc7a6
ret

Function at 0x44eba5
Capabilities:
Query or enumerate registry value

Disassembly:
push 8
mov eax, 0x51f048
call fcn.004fc6ce
xor eax, eax
mov esi, str.software360TotalSecurity
cmp eax, esi
je 0x44ec40
mov ebx, 0x54ca80
cmp eax, ebx
je 0x44ec40
mov edi, str.Device
cmp eax, edi
je 0x44ec40
cmp dword [ebp + 8], eax
je 0x44ec40
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
je 0x44ec40
mov eax, dword [0x590e04]
mov ecx, 0x590e04
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
push ebx
push esi
push str._s_s
lea eax, [ebp - 0x10]
call fcn.0042ee4a
mov esi, dword [ebp - 0x10]
and dword [ebp - 0x14], 0
add esp, 0xc
push dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push dword [ebp + 8]
mov bl, 1
push eax
push edi
push esi
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x44ec32
cmp dword [ebp - 0x14], 3
je 0x44ec34
xor bl, bl
lea eax, [esi - 0x10]
call fcn.00405521
mov al, bl
jmp 0x44ec42
xor al, al
call fcn.004fc7a6
ret

Function at 0x44ec48
Capabilities:
Set registry value

Disassembly:
push 8
mov eax, 0x51ef15
call fcn.004fc6ce
xor eax, eax
mov esi, str.software360TotalSecurity
cmp eax, esi
je 0x44ecf0
mov edi, 0x54ca80
cmp eax, edi
je 0x44ecf0
mov ebx, str.Device
cmp eax, ebx
je 0x44ecf0
mov eax, dword [0x590e04]
mov ecx, 0x590e04
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
and dword [ebp - 4], 0
push edi
push esi
push str._s_s
lea eax, [ebp - 0x14]
call fcn.0042ee4a
and dword [ebp - 0x10], 0
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
push esi
mov esi, SysReAllocString
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x44ecc8
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x10], 0
push dword [ebp + 0xc]
mov edi, dword [ebp - 0x14]
push dword [ebp + 8]
push 3
push ebx
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov ebx, eax
neg ebx
sbb bl, bl
lea eax, [edi - 0x10]
inc bl
call fcn.00405521
mov al, bl
jmp 0x44ecf2
xor al, al
call fcn.004fc7a6
ret
Function at 0x44f506
Capabilities:
Get geographical location

Disassembly:
push 0x24
mov eax, 0x527a29
call fcn.004fc6ce
mov eax, dword [0x590e04]
mov ecx, 0x590e04
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
and dword [ebp - 4], 0
and dword [ebp - 0x18], 0
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push str.Country
push eax
lea esi, [ebp - 0x14]
call fcn.00428a59
push ecx
mov byte [ebp - 4], 1
mov eax, esp
mov dword [ebp - 0x20], esp
mov ebx, str.SOFTWARE360TotalSecurityDailyNews
push ebx
push eax
call fcn.004056ee
mov ecx, dword [ebp - 0x18]
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
lea eax, [ebp - 0x30]
push eax
mov byte [ebp - 4], 0
call fcn.0040499a
push eax
mov byte [ebp - 4], 2
call fcn.00404869
pop ecx
lea esi, [ebp - 0x30]
mov byte [ebp - 4], 0
call fcn.00401105
push dword [ebp - 0x14]
call fcn.004f192a
mov esi, dword [ebp + 8]
pop ecx
push dword [ebp - 0x14]
call fcn.00404d75
mov eax, dword [0x590e04]
mov ecx, 0x590e04
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
push ecx
mov byte [ebp - 4], 3
mov eax, esp
mov dword [ebp - 0x20], esp
push str.Lang
push eax
lea esi, [ebp - 0x18]
call fcn.00428a59
push ecx
mov byte [ebp - 4], 4
mov eax, esp
mov dword [ebp - 0x1c], esp
push ebx
push eax
call fcn.004056ee
push edi
lea eax, [ebp - 0x30]
push eax
xor ecx, ecx
mov byte [ebp - 4], 3
call fcn.0040499a
push eax
mov byte [ebp - 4], 5
call fcn.00404869
pop ecx
lea esi, [ebp - 0x30]
mov byte [ebp - 4], 3
call fcn.00401105
mov edi, dword [ebp - 0x18]
push edi
call fcn.004f192a
mov esi, dword [ebp + 0xc]
pop ecx
push edi
call fcn.00404d75
lea eax, [edi - 0x10]
call fcn.00405521
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00405521
call fcn.004fc7a6
ret

Function at 0x44f627
Capabilities:
Get geographical location

Disassembly:
push 0x24
mov eax, 0x5279de
call fcn.004fc6ce
mov eax, dword [ebp + 8]
xor esi, esi
cmp dword [eax + 0x18], 8
push esi
jb 0x44f644
mov eax, dword [eax + 4]
jmp 0x44f647
add eax, 4
push eax
push ecx
mov eax, esp
mov dword [ebp + 8], esp
push str.Country
push eax
call fcn.00428a59
push ecx
mov eax, esp
mov dword [ebp - 0x10], esp
mov ebx, str.SOFTWARE360TotalSecurityDailyNews
push ebx
push eax
mov dword [ebp - 4], esi
call fcn.004056ee
or dword [ebp - 4], 0xffffffff
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
lea eax, [ebp - 0x20]
push eax
mov ecx, esi
call fcn.0040499a
push eax
call fcn.00404a80
add esp, 0xc
lea esi, [ebp - 0x20]
call fcn.00401105
mov eax, dword [ebp + 0xc]
xor esi, esi
cmp dword [eax + 0x18], 8
push esi
jb 0x44f6a5
mov eax, dword [eax + 4]
jmp 0x44f6a8
add eax, 4
push eax
push ecx
mov eax, esp
mov dword [ebp + 8], esp
push str.Lang
push eax
call fcn.00428a59
push ecx
mov eax, esp
mov dword [ebp + 0xc], esp
push ebx
push eax
mov dword [ebp - 4], 1
call fcn.004056ee
or dword [ebp - 4], 0xffffffff
push edi
lea eax, [ebp - 0x30]
push eax
mov ecx, esi
call fcn.0040499a
push eax
call fcn.00404a80
add esp, 0xc
lea esi, [ebp - 0x30]
call fcn.00401105
call fcn.004fc7a6
ret
Function at 0x452a2c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 4
mov eax, 0x52aaa4
call fcn.004fc6ce
mov ebx, dword [ebp + 8]
mov dword [ebp + 8], esi
xor edi, edi
mov dword [ebp - 4], edi
cmp esi, edi
je 0x452b3d
cmp dword [esi + 0x18], edi
je 0x452a69
cmp dword [esi + 0x1c], 8
jb 0x452a5b
mov edx, dword [esi + 8]
jmp 0x452a5e
lea edx, [esi + 8]
movzx eax, byte [esi]
push eax
mov ecx, ebx
call fcn.00453af7
cmp dword [esi + 0x34], edi
je 0x452aa6
cmp dword [esi + 0x38], 8
jb 0x452a79
mov eax, dword [esi + 0x24]
jmp 0x452a7c
lea eax, [esi + 0x24]
cmp eax, edi
je 0x452aa6
push eax
mov eax, dword [ebx + 0x1ac]
push 0x3ed
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
mov dword [ecx], eax
cmp eax, edi
je 0x452a9e
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
call fcn.00456d58
add esp, 0xc
cmp dword [esi + 0x54], edi
je 0x452ac8
cmp dword [esi + 0x58], 8
jb 0x452ab6
mov eax, dword [esi + 0x44]
jmp 0x452ab9
lea eax, [esi + 0x44]
movzx ecx, byte [esi + 0x3c]
push ecx
push eax
push 1
mov ecx, ebx
call fcn.00453eb2
cmp dword [esi + 0x90], edi
je 0x452af0
lea eax, [esi + 0x7c]
cmp dword [eax + 0x18], 8
jb 0x452ade
mov eax, dword [eax + 4]
jmp 0x452ae1
add eax, 4
movzx ecx, byte [esi + 0x78]
push ecx
push eax
push 2
mov ecx, ebx
call fcn.00453eb2
mov eax, dword [esi + 0xb4]
mov edi, dword [ebx + 0x1bc]
cmp eax, 0xffffffff
je 0x452b03
mov edi, eax
mov eax, dword [esi + 0xb8]
cmp eax, 0xffffffff
je 0x452b16
push eax
mov eax, ebx
call fcn.00453f4d
push dword [ebx + 0x1b8]
push edi
push ebx
call fcn.00452ca3
or dword [ebp - 4], 0xffffffff
push 0x452219
push 3
push 0x3c
push esi
call fcn.004f5d4b
push esi
call fcn.004f1890
pop ecx
xor eax, eax
call fcn.004fc7a6
ret 4
Function at 0x4632d5
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
jne 0x4632e9
xor al, al
jmp 0x46337a
push edi
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push dword [ebp + 8]
mov byte [ebp - 1], bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x463362
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, ebx
je 0x463355
mov eax, dword [ebp + 0x10]
push 0x590f51
push esi
mov dword [eax], esi
call fcn.004f5946
pop ecx
pop ecx
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
cmp eax, ebx
je 0x463355
push ebx
lea ecx, [ebp - 8]
push ecx
push esi
push eax
push edi
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x463355
cmp dword [ebp - 8], esi
jne 0x463355
mov byte [ebp - 1], 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
cmp byte [ebp - 1], bl
jne 0x463376
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0046324e
add esp, 0xc
mov byte [ebp - 1], al
mov al, byte [ebp - 1]
pop edi
pop ebx
leave
ret

Function at 0x46623b
Capabilities:
Delete file

Disassembly:
push 0x1c
mov eax, 0x52f233
call fcn.004fc6ce
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x14], 0x60
call fcn.00465fb8
mov esi, eax
pop ecx
pop ecx
mov dword [ebp - 0x18], esi
test esi, esi
je 0x466362
push dword [ebp + 0xc]
push esi
call fcn.004660bb
pop ecx
pop ecx
mov ebx, eax
call fcn.0043dd30
mov edi, eax
call fcn.0043dd10
imul edi, dword [ebp + 0xc]
push dword [ebp + 0xc]
mov dword [ebp - 0x28], edi
push dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
call fcn.0044b15b
lea esi, [ebp - 0x28]
call fcn.00465e26
test al, al
je 0x4662c8
push 0
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push ebx
call fcn.00475105
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4662c8
test ebx, ebx
je 0x4662c6
mov eax, dword [ebx]
push 1
mov ecx, ebx
call dword [eax]
mov ebx, esi
and dword [ebp - 0x1c], 0
push ebx
lea edi, [ebp - 0x14]
call fcn.00475428
pop ecx
and dword [ebp - 4], 0
mov edi, dword [ebp - 0x14]
cmp dword [edi - 0xc], 0
je 0x466342
lea esi, [ebp - 0x20]
call fcn.0043dea5
mov byte [ebp - 4], 1
mov esi, dword [ebp - 0x20]
test esi, esi
je 0x46632d
push ecx
mov edi, esp
mov dword [ebp - 0x1c], esp
push str.disable_resize
call fcn.00427950
push ecx
mov byte [ebp - 4], 2
mov edi, esp
mov dword [ebp - 0x24], esp
push dword [ebp - 0x14]
call fcn.00427950
mov byte [ebp - 4], 3
mov edx, esi
mov byte [ebp - 4], 1
call fcn.0043dc64
mov edi, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], 0
test esi, esi
je 0x466342
mov eax, dword [esi]
push esi
call dword [eax + 8]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx]
push 1
call dword [eax]
test ebx, ebx
je 0x466357
mov eax, dword [ebx]
push 1
mov ecx, ebx
call dword [eax]
lea eax, [edi - 0x10]
call fcn.00405521
mov eax, dword [ebp - 0x1c]
call fcn.004fc7a6
ret
Function at 0x46db1b
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push 0x268
mov eax, 0x52311c
call fcn.004fc737
mov dword [ebp - 4], 2
mov eax, dword [0x590e04]
mov ecx, 0x590e04
mov bl, 1
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x268], eax
push 0x24c
lea eax, [ebp - 0x260]
push 0
mov byte [ebp - 4], 3
and dword [ebp - 0x264], 0
push eax
call fcn.004f18b0
add esp, 0xc
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x46db77
push dword [ebp + 8]
lea eax, [ebp - 0x268]
push 0x54d86c
push eax
call fcn.0040450f
add esp, 0xc
lea eax, [ebp - 0x264]
push eax
push dword [ebp - 0x268]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x26c], eax
cmp eax, 0xffffffff
jne 0x46dbae
mov bl, 1
lea eax, [ebp - 0x238]
push eax
push dword [ebp + 0xc]
call fcn.004f5171
pop ecx
pop ecx
test eax, eax
jg 0x46dc49
lea eax, [ebp - 0x238]
push eax
push dword [ebp + 0x10]
call fcn.004f5171
pop ecx
pop ecx
test eax, eax
jl 0x46dc49
lea eax, [ebp - 0x274]
push 0x5481d0
push eax
lea edi, [ebp + 8]
call fcn.00405a46
lea ecx, [ebp - 0x238]
push ecx
lea ecx, [ebp - 0x270]
push ecx
mov edi, eax
mov byte [ebp - 4], 4
call fcn.00405a46
add esp, 0x10
lea edi, [ebp - 0x268]
mov byte [ebp - 4], 5
call fcn.00404477
mov eax, dword [ebp - 0x270]
add eax, 0xfffffff0
call fcn.00405521
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x274]
add eax, 0xfffffff0
call fcn.00405521
push esi
mov ecx, edi
call fcn.0046de8b
test eax, eax
pop ecx
setne bl
lea eax, [ebp - 0x264]
push eax
push dword [ebp - 0x26c]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x46dbae
push dword [ebp - 0x26c]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x268]
add eax, 0xfffffff0
call fcn.00405521
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.00405521
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
call fcn.00405521
mov eax, dword [ebp + 0x10]
add eax, 0xfffffff0
call fcn.00405521
movzx eax, bl
call fcn.004fc7ba
ret
Function at 0x46e532
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
mov ecx, dword [esi + 4]
xor ebx, ebx
push edi
cmp ecx, ebx
je 0x46e60b
cmp dword [ebp + 8], ebx
je 0x46e60b
mov eax, dword [esi + 0x1008]
mov edi, dword [ebp + 0xc]
cmp edi, eax
ja 0x46e58e
push edi
lea ebx, [esi + 8]
push ebx
push dword [ebp + 8]
call fcn.004f4830
mov eax, dword [ebp + 0x10]
mov dword [eax], edi
sub dword [esi + 0x1008], edi
push dword [esi + 0x1008]
lea eax, [edi + esi + 8]
push eax
push ebx
call fcn.004fa750
add esp, 0x18
xor eax, eax
inc eax
jmp 0x46e60d
mov edx, dword [esi + 0x100c]
cmp edx, dword [esi + 0x1010]
jb 0x46e5c3
cmp eax, ebx
jbe 0x46e5b0
push eax
lea eax, [esi + 8]
push eax
push dword [ebp + 8]
call fcn.004f4830
add esp, 0xc
mov eax, dword [esi + 0x1008]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov dword [esi + 0x1008], ebx
jmp 0x46e589
push ebx
lea edx, [ebp + 0xc]
push edx
mov edx, 0x1000
sub edx, eax
push edx
lea eax, [eax + esi + 8]
push eax
push ecx
mov dword [ebp + 0xc], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x46e606
mov eax, dword [ebp + 0xc]
cmp eax, ebx
jbe 0x46e606
push dword [ebp + 0x10]
add dword [esi + 0x1008], eax
add dword [esi + 0x100c], eax
push edi
push dword [ebp + 8]
mov ecx, esi
call fcn.0046e532
jmp 0x46e60d
mov eax, dword [ebp + 0x10]
mov dword [eax], ebx
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x46e6f2
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi + 4]
push edi
mov edi, dword [esi + 8]
sub edi, eax
je 0x46e70d
push edi
push eax
push dword [esi]
call fcn.004f4830
add esp, 0xc
mov eax, dword [esi]
and dword [ebp - 4], 0
push 0
lea ecx, [ebp - 4]
push ecx
mov ecx, 0x1000
sub ecx, edi
mov dword [esi + 4], eax
add eax, edi
push ecx
push eax
push dword [esi + 0xc]
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
mov eax, dword [ebp - 4]
pop edi
je 0x46e74a
test eax, eax
je 0x46e74a
add dword [esi + 8], eax
cmp eax, dword [ebp + 8]
sbb eax, eax
inc eax
jmp 0x46e74f
add dword [esi + 8], eax
xor eax, eax
leave
ret 4

Function at 0x46e811
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi + 4]
mov ecx, dword [esi]
cmp eax, ecx
jne 0x46e823
xor eax, eax
inc eax
leave
ret
push 0
lea edx, [ebp - 4]
push edx
sub eax, ecx
push eax
push ecx
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x46e84b
mov eax, dword [esi]
mov ecx, dword [esi + 4]
sub ecx, eax
cmp dword [ebp - 4], ecx
jne 0x46e84b
mov dword [esi + 4], eax
jmp 0x46e81e
mov eax, dword [esi]
mov dword [esi + 4], eax
xor eax, eax
leave
ret
Function at 0x46e937
Capabilities:
Get file size

Disassembly:
push 0x70
mov eax, 0x523077
call fcn.004fc6ce
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
mov ecx, dword [esi + 0xc]
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov byte [ebp - 4], 1
cmp dword [ebp + 0x20], 8
mov eax, dword [ebp + 0xc]
jae 0x46e971
lea eax, [ebp + 0xc]
push ebx
push 0x80
push 3
push ebx
push 2
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x14], eax
cmp eax, 0xffffffff
je 0x46e9e5
push 0x1000
call fcn.004f4fb6
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
pop ecx
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x20]
call fcn.0046e7d1
test eax, eax
jne 0x46e9fa
cmp dword [ebp - 0x14], 0xffffffff
je 0x46e9d3
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x20]
jne 0x46e9ca
lea esi, [ebp - 0x20]
call fcn.0046e811
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x20], ebx
je 0x46e9e1
push dword [ebp - 0x20]
call fcn.004f29a6
pop ecx
xor edi, edi
jmp 0x46e9e8
xor edi, edi
inc edi
push ebx
push 1
lea esi, [ebp + 8]
call fcn.00404e29
mov eax, edi
jmp 0x46eaf6
cmp dword [ebp - 0x38], 1
jne 0x46e9b4
jmp 0x46ea3c
lea edi, [ebp - 0x2c]
lea eax, [ebp - 0x20]
call fcn.0046e753
test eax, eax
je 0x46ea55
mov edi, dword [esi + 0x20]
lea eax, [ebp - 0x34]
push eax
push dword [edi + 4]
push edi
call fcn.00473d81
mov ecx, dword [esi + 0x24]
mov edx, 0xfffffff
sub edx, ecx
cmp edx, 1
jb 0x46ea90
inc ecx
mov dword [esi + 0x24], ecx
mov dword [edi + 4], eax
mov ecx, dword [eax + 4]
mov dword [ecx], eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
call fcn.0046e7d1
test eax, eax
jne 0x46ea02
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
je 0x46ea85
push 1
push ebx
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x46ea85
xor ecx, ecx
cmp edi, eax
sete cl
mov eax, ecx
cmp eax, ebx
jne 0x46eabb
push esi
call fcn.0046eba1
jmp 0x46e9b4
push str.list_T__too_long
lea ecx, [ebp - 0x54]
call fcn.0040531c
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 2
call fcn.004058c6
push 0x565cf4
lea eax, [ebp - 0x7c]
push eax
call fcn.004fc29c
cmp dword [ebp - 0x14], 0xffffffff
je 0x46eada
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x20]
jne 0x46ead1
lea esi, [ebp - 0x20]
call fcn.0046e811
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x20], ebx
je 0x46eae8
push dword [ebp - 0x20]
call fcn.004f29a6
pop ecx
push ebx
push 1
lea esi, [ebp + 8]
call fcn.00404e29
xor eax, eax
inc eax
call fcn.004fc7a6
ret 0x1c
Function at 0x46eee3
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
push ebx
push edi
xor edi, edi
cmp dword [esi + 0x20], edi
je 0x46ef9d
cmp dword [esi + 0x24], 8
jb 0x46ef04
mov eax, dword [esi + 0x10]
jmp 0x46ef07
lea eax, [esi + 0x10]
lea ecx, [ebp - 0x34]
push ecx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x46ef9d
cmp dword [ebp - 0x18], edi
ja 0x46ef9d
cmp dword [ebp - 0x14], 0x800000
jae 0x46ef9d
cmp dword [esi + 0x24], 8
mov dword [ebp - 4], edi
jb 0x46ef37
mov eax, dword [esi + 0x10]
jmp 0x46ef3a
lea eax, [esi + 0x10]
push 3
push eax
lea eax, [ebp - 0xb8]
lea ecx, [ebp - 0xb4]
push eax
mov dword [ebp - 0xb8], ecx
call fcn.004454cc
push 0x54d904
push dword [ebp - 0xb8]
lea eax, [ebp - 4]
push eax
call fcn.004fab79
add esp, 0xc
test eax, eax
lea eax, [ebp - 0xb4]
setne bl
cmp dword [ebp - 0xb8], eax
je 0x46ef8b
push dword [ebp - 0xb8]
call fcn.004f29a6
pop ecx
test bl, bl
je 0x46efa3
cmp dword [ebp - 4], edi
je 0x46ef9d
push dword [ebp - 4]
call fcn.004f727b
pop ecx
xor eax, eax
pop edi
pop ebx
leave
ret
cmp dword [ebp - 4], edi
je 0x46ef9d
push dword [ebp - 4]
mov edi, dword [ebp - 0x14]
and dword [ebp - 0xc], 0
push 4
lea eax, [ebp - 0xc]
push 1
push eax
call fcn.004f71e7
add esp, 0x10
cmp eax, 4
jne 0x46f042
cmp dword [ebp - 0xc], 1
jne 0x46f06f
lea eax, [edi - 4]
mov edi, 0xaa0
xor edx, edx
mov ecx, edi
div ecx
mov ebx, eax
test edx, edx
jne 0x46f042
mov eax, dword [esi + 8]
test eax, eax
je 0x46eff7
push eax
call fcn.004f29a6
and dword [esi + 8], 0
pop ecx
and dword [esi + 4], 0
push 0
push 4
push dword [ebp - 4]
call fcn.004f6ec2
mov eax, ebx
imul eax, eax, 0xaa0
push eax
call fcn.004f4fb6
add esp, 0x10
mov dword [esi + 8], eax
test eax, eax
je 0x46f042
push dword [ebp - 4]
push ebx
push edi
push eax
call fcn.004f71e7
add esp, 0x10
cmp eax, ebx
je 0x46f04b
push dword [esi + 8]
call fcn.004f29a6
and dword [esi + 8], 0
and dword [esi + 4], 0
pop ecx
cmp dword [ebp - 4], 0
jmp 0x46ef92
test ebx, ebx
jle 0x46f06c
and dword [ebp - 8], 0
mov dword [ebp - 0x10], ebx
mov eax, dword [esi + 8]
add eax, dword [ebp - 8]
je 0x46f064
push eax
call fcn.0046f69e
add dword [ebp - 8], edi
dec dword [ebp - 0x10]
jne 0x46f056
mov dword [esi + 4], ebx
push dword [ebp - 4]
call fcn.004f727b
xor eax, eax
pop ecx
inc eax
jmp 0x46ef9f