joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43ce80
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x43ce90
xor eax, eax
jmp 0x43d02d
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 8
jb 0x43cfee
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x4d9168]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x4d9168]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x4d9168]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x4d9168]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x4d9168]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x4d9168]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x4d9168]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x4d9168]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0x10]
sub eax, 8
mov dword [ebp + 0x10], eax
jmp 0x43ce99
cmp dword [ebp + 0x10], 0
je 0x43d027
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x4d9168]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
jne 0x43cff4
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
pop ebp
ret
Function at 0x43eb30
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x808
mov eax, dword [0x4f36a0]
xor eax, esp
mov dword [esp + 0x804], eax
mov ecx, dword [esp + 0x80c]
push esi
lea eax, [esp + 0x814]
push eax
push ecx
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.USER32.dll_wvsprintfW]
mov esi, eax
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [0x4fd904]
lea ecx, [esi + esi]
push ecx
lea edx, [esp + 0x14]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x808]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00497c58
add esp, 0x808
ret

Function at 0x43eba0
Capabilities:
Create process on windows
Print debug messages

Disassembly:
sub esp, 0x474
mov eax, dword [0x4f36a0]
xor eax, esp
mov dword [esp + 0x46c], eax
push esi
push edi
xor eax, eax
push 0x40e
push eax
lea ecx, [esp + 0x6a]
push ecx
mov word [esp + 0x6c], ax
call fcn.0049ca10
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
add esp, 0xc
push 0x4de4c0
lea edx, [esp + 0x64]
push edx
call esi
push 0x4fdf20
lea eax, [esp + 0x64]
push eax
call esi
push 0x4fdf20
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
test edi, edi
jbe 0x43ed95
push 0x4fdf20
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp word [edi*2 + 0x4fdf1e], 0x5c
je 0x43ec25
push 0x4d6528
lea ecx, [esp + 0x64]
push ecx
call esi
push str.crashrpt.exe
lea edx, [esp + 0x64]
push edx
call esi
push 0x4df0e0
lea eax, [esp + 0x64]
push eax
call esi
push 0x4fdd18
lea ecx, [esp + 0x64]
push ecx
call esi
push 0x4df0e0
lea edx, [esp + 0x64]
push edx
call esi
push str.sogoupy
lea eax, [esp + 0x64]
push eax
call esi
push 0x4df0e0
lea ecx, [esp + 0x64]
push ecx
call esi
cmp byte [0x4f906d], 0
mov eax, 0x4dd8cc
jne 0x43ec80
mov eax, 0x4df0e8
push eax
lea edx, [esp + 0x64]
push edx
call esi
push 0x4de4c0
lea eax, [esp + 0x64]
push eax
call esi
push 0x5c
push 0x4fdb10
call fcn.00499142
mov edi, eax
add esp, 8
test edi, edi
je 0x43eccc
push 0x4df0ec
lea ecx, [esp + 0x64]
push ecx
call esi
add edi, 2
push edi
lea edx, [esp + 0x64]
push edx
call esi
push 0x4de4c0
lea eax, [esp + 0x64]
push eax
call esi
push 0x5c
push 0x4fd908
call fcn.00499142
mov edi, eax
add esp, 8
test edi, edi
je 0x43ed04
push 0x4df0ec
lea ecx, [esp + 0x64]
push ecx
call esi
add edi, 2
push edi
lea edx, [esp + 0x64]
push edx
call esi
push 0x4de4c0
lea eax, [esp + 0x64]
push eax
call esi
push 0x44
lea ecx, [esp + 0x1c]
push 0
push ecx
call fcn.0049ca10
add esp, 0xc
cmp byte [0x4f906d], 0
mov dword [esp + 0x18], 0x44
je 0x43ed38
mov edx, 5
mov dword [esp + 0x44], 1
mov word [esp + 0x48], dx
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
call fcn.0044c840
add eax, 8
cmp dword [eax + 4], 0
jne 0x43ed5c
xor eax, eax
jmp 0x43ed70
cmp byte [eax + 0x11c], 0
je 0x43ed6a
add eax, 0xc
jmp 0x43ed6d
mov eax, dword [eax + 8]
add eax, 4
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x1c]
push edx
push eax
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x80]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [esp + 0x474]
pop edi
pop esi
xor ecx, esp
call fcn.00497c58
add esp, 0x474
ret
Function at 0x440e90
Capabilities:
Create directory

Disassembly:
sub esp, 0x254
mov eax, dword [0x4f36a0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push esi
push 0x206
mov esi, ecx
xor ebx, ebx
lea ecx, [esp + 0x4e]
xor eax, eax
push ebx
push ecx
mov word [esp + 0x54], ax
call fcn.0049ca10
add esp, 0xc
lea eax, [esi + 0xc]
cmp byte [esi + 0x11c], bl
jne 0x440ed2
mov eax, dword [esi + 8]
add eax, 4
push eax
lea edx, [esp + 0x4c]
push 0x104
push edx
call fcn.00498b64
lea eax, [esp + 0x54]
push 0x5c
push eax
call fcn.00499142
add esp, 0x14
cmp eax, ebx
jne 0x440f31
cmp byte [esi + 0x11c], bl
je 0x440f05
add esi, 0xc
jmp 0x440f08
mov esi, dword [esi + 8]
add esi, 4
push esi
push 0x4e2884
push edi
call fcn.004477d0
add esp, 0xc
pop esi
pop ebx
mov ecx, dword [esp + 0x24c]
xor ecx, esp
call fcn.00497c58
add esp, 0x254
ret
xor ecx, ecx
lea edx, [esp + 0x18]
mov word [eax], cx
push edx
lea eax, [esp + 0x4c]
push eax
call fcn.0049d7ce
add esp, 8
test eax, eax
je 0x441056
push ebx
lea ecx, [esp + 0x4c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x440f8a
lea edx, [esp + 0x48]
push edx
push 0x4e2898
push edi
call fcn.004477d0
add esp, 0xc
pop esi
pop ebx
mov ecx, dword [esp + 0x24c]
xor ecx, esp
call fcn.00497c58
add esp, 0x254
ret
push 1
push 0x10000000
lea eax, [esp + 0x50]
push 1
push eax
call fcn.00453060
add esp, 0x10
cmp byte [0x4fe13b], bl
jne 0x440fb9
mov byte [0x4fe13b], 1
call fcn.0044d4e0
mov byte [0x4fe13c], al
cmp byte [0x4fe13c], bl
je 0x441056
lea eax, [esp + 0x48]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x440fd0
sub eax, edx
lea ecx, [esp + 0x48]
sar eax, 1
push ecx
call fcn.0044d440
add esp, 4
test eax, eax
jne 0x441056
push ebx
lea edx, [esp + 0xc]
push edx
push 1
push str.S:_ML__NW___LW_
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ebx
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
je 0x441056
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorSacl]
test eax, eax
je 0x44104b
mov ecx, dword [esp + 0xc]
push ecx
push ebx
push ebx
push ebx
push 0x10
push 1
lea edx, [esp + 0x60]
push edx
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [esp + 0x254]
pop esi
pop ebx
xor ecx, esp
mov al, 1
call fcn.00497c58
add esp, 0x254
ret
Function at 0x4435c0
Capabilities:
Set file attributes

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x14]
mov eax, dword [ebx + 0x130]
mov edx, dword [eax + 0x18]
push ebp
mov ebp, dword [esp + 0x20]
push esi
push edi
mov edi, dword [esp + 0x24]
lea esi, [ebx + 0x130]
push ebp
push edi
mov ecx, esi
call edx
test al, al
jne 0x443613
mov ecx, edi
call fcn.00447720
push 0x4e2960
push 0x4d65ac
mov edx, eax
call fcn.00448ff0
add esp, 8
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x10
call fcn.00451c30
test al, al
je 0x4435ec
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x18]
push ecx
mov dword [ebx + 0x348], esi
lea edx, [esp + 0x2c]
mov dword [ebx + 8], eax
push edx
lea ecx, [esp + 0x1c]
mov ebx, eax
mov esi, edi
push ecx
mov eax, esi
call fcn.004433d0
add esp, 0xc
test al, al
jne 0x4436a1
cmp byte [ebp + 0x11c], al
je 0x443665
add ebp, 0xc
jmp 0x443668
mov ebp, dword [ebp + 8]
mov ecx, esi
call fcn.00447720
mov esi, eax
push 0x4e2970
push 0x4d65ac
mov edx, esi
call fcn.00448ff0
add ebp, 4
push ebp
push 0x4d65ac
mov edx, esi
call fcn.00448ff0
add esp, 0x10
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x10
mov edi, dword [esp + 0x18]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
push 0
push 0x80
push edi
push 0
push edx
push eax
mov ecx, ebp
call fcn.004445b0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, dword [esp + 0x20]
mov dword [ebx + 4], eax
mov esi, 1
cmp eax, 0xffffffff
jne 0x443746
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x20], eax
cmp eax, 0x20
jne 0x4436fa
cmp esi, 3
jge 0x443794
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x44371b
cmp eax, 5
jne 0x44375b
cmp esi, 3
jge 0x443794
push 0x80
mov ecx, ebp
call fcn.004445b0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x14]
push 0
push 0x80
push edi
push 0
push ecx
push edx
mov ecx, ebp
call fcn.004445b0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
inc esi
mov dword [ebx + 4], eax
cmp eax, 0xffffffff
je 0x4436d8
push ebp
lea ecx, [ebx + 0xc]
call fcn.00444690
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x10
test eax, eax
jne 0x443794
cmp byte [ebp + 0x11c], al
je 0x44376c
add ebp, 0xc
jmp 0x44376f
mov ebp, dword [ebp + 8]
mov ecx, dword [esp + 0x24]
add ebp, 4
push ebp
push 0x4e2980
call fcn.004032e0
mov ecx, eax
call fcn.00447b70
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x10
cmp byte [ebp + 0x11c], 0
je 0x4437a2
add ebp, 0xc
jmp 0x4437a5
mov ebp, dword [ebp + 8]
mov ecx, dword [esp + 0x24]
call fcn.00447720
mov edi, dword [esp + 0x20]
mov esi, eax
call fcn.00447a60
mov ecx, dword [esp + 0x24]
call fcn.00447720
add ebp, 4
push ebp
push 0x4e2970
mov ecx, eax
call fcn.00447b70
mov ecx, eax
call fcn.00447b70
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0xc
ret 0x10
Function at 0x4438c0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push edi
push 0
mov ebx, eax
mov edi, ecx
mov esi, edx
call ebp
test edi, edi
jne 0x4438e9
test ebx, ebx
je 0x4438df
mov dword [ebx], edi
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
pop ecx
ret 8
mov ecx, dword [esp + 0x1c]
mov edx, dword [esi + 4]
push 0
lea eax, [esp + 0x14]
push eax
push edi
push ecx
push edx
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x44396f
lea ebx, [esi + 0x18]
cmp byte [esi + 0x128], al
jne 0x44391a
mov ebx, dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x18]
mov edi, eax
call fcn.00447720
mov esi, eax
call fcn.00447a60
push 0
call ebp
mov ecx, dword [esp + 0x18]
call fcn.00447720
mov esi, eax
push 0x4e29a0
push 0x4d65ac
mov edx, esi
call fcn.00448ff0
add ebx, 4
push ebx
push 0x4d65ac
mov edx, esi
call fcn.00448ff0
add esp, 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 8
mov eax, dword [esp + 0x10]
test ebx, ebx
je 0x443979
mov dword [ebx], eax
test eax, eax
jne 0x4438df
cmp byte [esi + 0x128], al
je 0x44398e
add esi, 0x18
jmp 0x443991
mov esi, dword [esi + 0x14]
mov ecx, dword [esp + 0x18]
call fcn.00447720
mov edi, eax
push 0x4e29b0
push 0x4d65ac
mov edx, edi
call fcn.00448ff0
add esi, 4
push esi
push 0x4d65ac
mov edx, edi
call fcn.00448ff0
add esp, 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 8

Function at 0x4439d0
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push edi
push 0
mov edi, eax
mov esi, ecx
call ebp
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push 0
lea eax, [esp + 0x10]
push eax
mov eax, dword [esi + 4]
push ecx
push edx
push eax
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x443a6d
push ebx
lea ebx, [esi + 0x18]
cmp byte [esi + 0x128], al
jne 0x443a18
mov ebx, dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x18]
mov edi, eax
call fcn.00447720
mov esi, eax
call fcn.00447a60
push 0
call ebp
mov ecx, dword [esp + 0x18]
call fcn.00447720
mov esi, eax
push 0x4e29d0
push 0x4d65ac
mov edx, esi
call fcn.00448ff0
add ebx, 4
push ebx
push 0x4d65ac
mov edx, esi
call fcn.00448ff0
add esp, 0x10
pop ebx
pop edi
pop esi
xor al, al
pop ebp
pop ecx
ret 0xc
test edi, edi
je 0x443a77
mov ecx, dword [esp + 0xc]
mov dword [edi], ecx
pop edi
pop esi
mov al, 1
pop ebp
pop ecx
ret 0xc

Function at 0x444860
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp byte [ecx + 0x11c], 0
lea eax, [ecx + 0xc]
jne 0x44486f
mov eax, dword [ecx + 8]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x444881
xor al, al
ret
shr eax, 4
not eax
and eax, 1
ret
Function at 0x445080
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x4bab67
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x4f36a0]
xor eax, esp
mov dword [esp + 0x248], eax
push ebx
push esi
push edi
mov eax, dword [0x4f36a0]
xor eax, esp
push eax
lea eax, [esp + 0x25c]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x26c]
mov esi, ecx
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x4450d2
mov eax, dword [esi + 8]
push 2
add eax, 4
push 0x4e2a88
push eax
call fcn.0049e2c7
add esp, 0xc
test eax, eax
je 0x4452d5
mov ecx, esi
call fcn.00444890
test al, al
je 0x445180
cmp byte [esp + 0x270], 0
je 0x4452d5
cmp byte [esi + 0x11c], 0
je 0x445118
add esi, 0xc
jmp 0x44511b
mov esi, dword [esi + 8]
lea ecx, [esp + 0x10]
call fcn.00448930
lea eax, [esi + 4]
lea edx, [esp + 0x10]
call fcn.00448b50
push 0x4e2a90
mov ecx, ebx
mov dword [esp + 0x268], 1
call fcn.00447720
mov edi, eax
lea eax, [esp + 0x14]
call fcn.00447b90
cmp byte [esp + 0x12c], 0
mov dword [esp + 0x10], vtable.t_str.0
jne 0x445179
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
cmp eax, ecx
je 0x445179
push eax
call fcn.00498f5b
add esp, 4
xor al, al
jmp 0x4452d7
lea ecx, [esp + 0x134]
call fcn.00443d50
lea edx, [esp + 0x134]
push edx
mov ecx, esi
mov dword [esp + 0x268], 2
call fcn.00445ae0
test al, al
je 0x4451e0
lea eax, [esp + 0x134]
call fcn.004445d0
test al, al
jne 0x4451e0
push 0
push ebx
lea ecx, [esp + 0x13c]
call fcn.00445080
test al, al
jne 0x4451e0
lea ecx, [esp + 0x134]
call fcn.004444f0
xor al, al
jmp 0x4452d7
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x4451ef
mov eax, dword [esi + 8]
push 0
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x445297
cmp byte [esi + 0x11c], al
je 0x445210
add esi, 0xc
jmp 0x445213
mov esi, dword [esi + 8]
lea ecx, [esp + 0x10]
call fcn.00448930
lea eax, [esi + 4]
lea edx, [esp + 0x10]
call fcn.00448b50
push 0x4e2aac
mov byte [esp + 0x268], 4
call fcn.00447a30
mov edi, eax
lea eax, [esp + 0x14]
call fcn.00447b90
cmp byte [esp + 0x12c], 0
mov esi, vtable.t_str.0
mov dword [esp + 0x10], esi
jne 0x44526d
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
cmp eax, ecx
je 0x44526d
push eax
call fcn.00498f5b
add esp, 4
cmp byte [esp + 0x250], 0
mov dword [esp + 0x134], esi
jne 0x445179
mov eax, dword [esp + 0x13c]
lea edx, [esp + 0x140]
cmp eax, edx
jmp 0x44516e
mov eax, esi
call fcn.00446af0
mov eax, esi
call fcn.00446990
cmp byte [esp + 0x250], 0
mov dword [esp + method.t_str.virtual_0], vtable.t_str.0
jne 0x4452d5
mov eax, dword [esp + 0x13c]
lea ecx, [esp + 0x140]
cmp eax, ecx
je 0x4452d5
push eax
call fcn.00498f5b
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x25c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x248]
xor ecx, esp
call fcn.00497c58
add esp, 0x258
ret 8
Function at 0x446f10
Capabilities:
Check if file exists
Create thread
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4bd8bb
mov eax, dword fs:[0]
push eax
sub esp, 0x130
mov eax, dword [0x4f36a0]
xor eax, esp
mov dword [esp + 0x12c], eax
push edi
mov eax, dword [0x4f36a0]
xor eax, esp
push eax
lea eax, [esp + 0x138]
mov dword fs:[0], eax
mov edi, ecx
call fcn.0044c840
mov al, byte [eax + 0x977]
test al, al
je 0x446f66
cmp al, 1
sete al
test al, al
je 0x4470a0
cmp byte [0x4fe13a], 0
jne 0x4470a0
mov ecx, esi
call fcn.00444890
test al, al
jne 0x446fd9
cmp byte [esi + 0x11c], al
lea eax, [esi + 0xc]
jne 0x446f8c
mov eax, dword [esi + 8]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x446fa4
shr eax, 4
not al
and al, 1
jne 0x446fd9
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x446fb3
mov eax, dword [esi + 8]
lea edi, [eax + 4]
call fcn.00451780
call fcn.00451780
cmp dword [eax + 0x124], 0
je 0x4470a0
push 1
call fcn.00454d30
jmp 0x4470a0
test edi, edi
je 0x447077
mov ecx, edi
mov eax, 0x4dd96c
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x44700e
test dx, dx
je 0x44700a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x44700e
add eax, 4
add ecx, 4
test dx, dx
jne 0x446fe8
xor eax, eax
jmp 0x447013
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x447077
lea ecx, [esp + 0xc]
call fcn.00443d50
lea eax, [esp + 0xc]
push eax
mov ecx, esi
mov dword [esp + 0x144], 0
call fcn.00445ae0
cmp dword [esp + 0x10], 0
mov cl, byte [esp + 0x128]
mov edx, dword [esp + 0x14]
jne 0x44704d
xor edi, edi
jmp 0x44705a
lea eax, [esp + 0x18]
test cl, cl
jne 0x447057
mov eax, edx
lea edi, [eax + 4]
mov dword [esp + 0xc], vtable.t_str.0
test cl, cl
jne 0x447077
lea ecx, [esp + 0x18]
cmp edx, ecx
je 0x447077
push edx
call fcn.00498f5b
add esp, 4
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x447086
mov eax, dword [esi + 8]
add eax, 4
push edi
push eax
call fcn.00446530
push eax
push 0
push 0x446660
call fcn.0049e20e
add esp, 0x14
mov ecx, dword [esp + 0x138]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x12c]
xor ecx, esp
call fcn.00497c58
add esp, 0x13c
ret
Function at 0x4470d0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4bd43c
mov eax, dword fs:[0]
push eax
sub esp, 0x258
push ebp
push esi
push edi
mov eax, dword [0x4f36a0]
xor eax, esp
push eax
lea eax, [esp + 0x268]
mov dword fs:[0], eax
mov edi, ecx
call fcn.0044c840
mov al, byte [eax + 0x977]
test al, al
je 0x44711a
cmp al, 1
sete al
test al, al
je 0x447308
cmp byte [0x4fe13a], 0
jne 0x447308
cmp byte [edi + 0x11c], 0
lea eax, [edi + 0xc]
jne 0x447136
mov eax, dword [edi + 8]
lea esi, [eax + 4]
mov dword [esp + 0x10], esi
call fcn.00451780
or ebp, 0xffffffff
mov dword [esp + 0x14], ebp
mov byte [esp + 0x18], 1
mov ecx, dword [esp + 0x278]
lea eax, [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x278], 0
call fcn.00447330
test al, al
jne 0x4471a6
mov eax, dword [esp + 0x1c]
mov esi, eax
sub esi, 2
neg esi
sbb esi, esi
and esi, eax
mov dword [esp + 0x270], ebp
call fcn.00451780
cmp dword [eax + 0x124], 0
je 0x44719f
mov edi, dword [esp + 0x10]
push esi
call fcn.00454d30
xor al, al
jmp 0x44730a
mov edx, dword [esp + 0x27c]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x4472ea
cmp byte [edi + 0x11c], 0
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x27c]
mov ebp, dword [eax + 0x20]
je 0x4471d8
add edi, 0xc
jmp 0x4471db
mov edi, dword [edi + 8]
lea ecx, [esp + 0x20]
call fcn.00448930
lea eax, [edi + 4]
lea edx, [esp + 0x20]
call fcn.00448b50
push 0x4e2afc
lea ecx, [esp + 0x148]
call fcn.00448a70
mov edi, eax
push ebp
push 0x4e34e4
mov edx, edi
mov byte [esp + 0x278], 3
call fcn.00448ff0
push 0x4e2a84
push 0x4d65ac
mov edx, edi
call fcn.00448ff0
add esp, 0x10
cmp byte [edi + 0x11c], 0
je 0x44723a
add edi, 0xc
jmp 0x44723d
mov edi, dword [edi + 8]
mov esi, dword [esp + 0x278]
add edi, 4
push edi
mov ecx, esi
call fcn.00447720
mov edi, eax
lea eax, [esp + 0x24]
call fcn.00447b90
cmp byte [esp + 0x260], 0
mov edi, vtable.t_str.0
mov dword [esp + 0x144], edi
jne 0x44728b
mov eax, dword [esp + 0x14c]
lea ecx, [esp + 0x150]
cmp eax, ecx
je 0x44728b
push eax
call fcn.00498f5b
add esp, 4
mov byte [esp + 0x270], 0
cmp byte [esp + 0x13c], 0
mov dword [esp + 0x20], edi
jne 0x4472b6
mov eax, dword [esp + 0x28]
lea edx, [esp + 0x2c]
cmp eax, edx
je 0x4472b6
push eax
call fcn.00498f5b
add esp, 4
cmp ebp, 0x20
jg 0x4472c2
mov eax, ebp
call fcn.004474e0
mov dword [esp + 0x270], 0xffffffff
call fcn.00451780
cmp dword [eax + 0x124], 0
je 0x4472e6
mov edi, dword [esp + 0x10]
push 0
call fcn.00454d30
xor al, al
jmp 0x44730a
mov dword [esp + 0x270], ebp
call fcn.00451780
cmp dword [eax + 0x124], 0
je 0x447308
push 0
mov edi, esi
call fcn.00454d30
mov al, 1
mov ecx, dword [esp + 0x268]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x264
ret 8