joyce8/EMBER2024-capa huggingface dataset:
Function at 0x437f40
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f08c8
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x53a00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x30]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
lea eax, [edi + 0x10]
push eax
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x40], 0
call fcn.00403090
mov dword [ebp - 4], 0
xor esi, esi
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x18], esi
mov byte [ebp - 4], 1
push 0x51477a
lea ecx, [ebp - 0x58]
mov dword [edi + 0xb4], 0
call fcn.004031c0
mov byte [ebp - 4], 2
lea eax, [edi + 0x40]
push ecx
mov ecx, dword [ebp - 0x3c]
push eax
lea eax, [edi + 0x58]
push eax
lea eax, [ebp - 0x58]
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 0x30]
push dword [ebp + 0x10]
push eax
push dword [ebx + 4]
call fcn.0044b8a0
mov bl, al
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x58]
call fcn.00403170
test bl, bl
jne 0x438003
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0xb0], eax
jmp 0x4380be
mov ebx, dword [ebp - 0x3c]
lea eax, [ebp - 0x14]
push ecx
push eax
push 0x13
mov ecx, ebx
mov dword [ebp - 0x14], 0
call fcn.0044b470
test al, al
jne 0x438030
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0xb0], eax
jmp 0x4380be
mov eax, dword [ebp - 0x14]
mov dword [edi + 0xb4], eax
cmp eax, 0xc8
je 0x4380ab
cmp eax, 0xce
je 0x4380ab
cmp eax, 0x12e
jne 0x4380df
mov ecx, 0x400
mov dword [ebp - 0x34], ecx
test esi, esi
jne 0x438073
push 0x800
call fcn.004c4acc
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
mov ecx, dword [ebp - 0x34]
add ecx, ecx
push ecx
push 0
push esi
call fcn.004c67e0
add esp, 8
lea eax, [ebp - 0x34]
mov ecx, ebx
push eax
push esi
push 0x21
call fcn.0044b4e0
test al, al
je 0x4380df
push esi
call fcn.00403860
add esp, 4
lea ecx, [ebp - 0x30]
push eax
push esi
call fcn.00403340
mov ebx, dword [ebp - 0x38]
jmp 0x4380cf
cmp dword [ebp + 0x14], 0
ja 0x4380b7
cmp dword [ebp + 0x10], 0
jbe 0x4380e3
cmp eax, 0xce
je 0x4380e3
mov ebx, dword [ebp - 0x38]
cmp dword [ebx + 4], 0
je 0x4380df
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp eax, 3
jb 0x437fa3
xor bl, bl
jmp 0x4380ef
mov dword [edi + 0xb0], 0
mov bl, 1
mov byte [ebp - 4], 0
test esi, esi
je 0x438100
push esi
call fcn.004c48cc
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00402de0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c4269
mov esp, ebp
pop ebp
ret 0x10
Function at 0x439650
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ed528
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x53a00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov ebx, ecx
cmp esi, 0xffffffff
jne 0x439687
xor al, al
jmp 0x4396ea
and esi, 0xffffb1af
push esi
call fcn.00402f50
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x4396a2
mov al, 1
jmp 0x4396ea
lea ecx, [ebp - 0x28]
call fcn.00403070
mov dword [ebp - 4], 0
lea edx, [ebp - 0x28]
mov ecx, ebx
call fcn.00439d30
test al, al
je 0x4396d7
push esi
lea ecx, [ebp - 0x28]
call fcn.00402f50
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x4396d7
mov bl, 1
jmp 0x4396d9
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00402de0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c4269
mov esp, ebp
pop ebp
ret

Function at 0x439710
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ed528
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x53a00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.00402f50
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x43978e
lea ecx, [ebp - 0x28]
call fcn.00403070
mov dword [ebp - 4], 0
lea edx, [ebp - 0x28]
mov ecx, ebx
call fcn.00439d30
test al, al
je 0x43977d
lea ecx, [ebp - 0x28]
call fcn.00402f50
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00402de0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c4269
mov esp, ebp
pop ebp
ret
Function at 0x4398c0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f0c10
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x53a00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.00402f50
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call edi
test eax, eax
je 0x439906
mov al, 1
jmp 0x4399fb
mov ecx, esi
call fcn.00402f50
push eax
lea ecx, [ebp - 0x28]
call fcn.00403020
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00439710
mov ebx, eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00402de0
cmp ebx, 0xffffffff
jne 0x439945
xor al, al
jmp 0x4399fb
mov ecx, esi
call fcn.00402f50
push eax
lea ecx, [ebp - 0x28]
call fcn.00403020
mov dword [ebp - 4], 1
xor edx, edx
lea ecx, [ebp - 0x28]
call fcn.00439650
mov bl, al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00402de0
test bl, bl
je 0x43993e
mov ecx, esi
call fcn.00402f50
push eax
call edi
test eax, eax
jne 0x4398ff
lea ecx, [ebp - 0x28]
call fcn.00403070
mov dword [ebp - 4], 2
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.00439d30
test al, al
je 0x4399bd
lea ecx, [ebp - 0x28]
call fcn.00402f50
push eax
call edi
test eax, eax
je 0x4399bd
mov bl, 1
jmp 0x4399ea
mov ecx, esi
call fcn.00402f50
push eax
lea ecx, [ebp - 0x44]
call fcn.00403020
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x44]
mov edx, dword [ebp - 0x2c]
call fcn.00439650
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x44]
call fcn.00402de0
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00402de0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c4269
mov esp, ebp
pop ebp
ret

Function at 0x439a40
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x53a00c]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
mov ebx, dword [esp + 0x218]
lea eax, [esp + 4]
push esi
push edi
push 0x20c
push 0
push eax
mov esi, edx
mov edi, ecx
call fcn.004c67e0
add esp, 0xc
lea eax, [esp + 0xc]
mov ecx, esi
push eax
push 0
call fcn.00402f50
push eax
mov ecx, edi
call fcn.00402f50
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x439ad5
xor eax, eax
mov word [esp + 0x216], ax
lea eax, [esp + 0xc]
push eax
call fcn.00403860
add esp, 4
mov ecx, ebx
push eax
lea eax, [esp + 0x10]
push eax
call fcn.00403340
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.004c4269
add esp, 0x210
ret
mov ecx, dword [esp + 0x218]
xor al, al
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004c4269
add esp, 0x210
ret
Function at 0x43c230
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f10e8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x53a00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push ebx
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 0
call fcn.00403f00
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebx + 0x1c]
cmp eax, 0x7530
jb 0x43c2df
lea esi, [ebx + 4]
mov ecx, esi
call fcn.00412b84
lea edi, [ebx + 0x10]
mov ecx, edi
call fcn.00412b84
push esi
mov ecx, ebx
call fcn.0043c310
push edi
push 0
push 0
mov ecx, ebx
call fcn.0043c590
push edi
push 1
push 0
mov ecx, ebx
call fcn.0043c590
push edi
push 0
push 1
mov ecx, ebx
call fcn.0043c590
push edi
push 1
push 1
mov ecx, ebx
call fcn.0043c590
push edi
call fcn.0043d2d0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebx + 0x1c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00403f30
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c4269
mov esp, ebp
pop ebp
ret
Function at 0x440800
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x53a00c]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
mov esi, ecx
mov dword [esp + 4], 0x114
push 0x110
lea eax, [esp + 0xc]
push 0
push eax
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov byte [esi], 0
call fcn.004c67e0
add esp, 0xc
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, esi
je 0x440897
cmp dword [esp + 8], 6
jb 0x440897
mov byte [esi], 1
mov ecx, dword [esp + 0x118]
pop esi
xor ecx, esp
call fcn.004c4269
add esp, 0x118
ret

Function at 0x4408b0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f1810
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x53a00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push str.wintrust.dll
lea ecx, [ebp - 0x28]
call fcn.00403020
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.00431490
mov ecx, eax
call fcn.00431550
mov ebx, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00402de0
push str.crypt32.dll
lea ecx, [ebp - 0x40]
call fcn.00403020
mov dword [ebp - 4], 1
lea eax, [ebp - 0x40]
push eax
call fcn.00431490
mov ecx, eax
call fcn.00431550
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00402de0
test ebx, ebx
je 0x4409c5
test esi, esi
je 0x4409c5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CryptCATAdminCalcHashFromFileHandle
push ebx
call esi
push str.CryptCATAdminAcquireContext
push ebx
mov dword [edi + 4], eax
call esi
push str.CryptCATAdminEnumCatalogFromHash
push ebx
mov dword [edi + 8], eax
call esi
push str.CryptCATCatalogInfoFromContext
push ebx
mov dword [edi + 0xc], eax
call esi
push str.CryptCATAdminReleaseCatalogContext
push ebx
mov dword [edi + 0x10], eax
call esi
push str.CryptCATAdminReleaseContext
push ebx
mov dword [edi + 0x14], eax
call esi
push str.WTHelperProvDataFromStateData
push ebx
mov dword [edi + 0x18], eax
call esi
push str.WTHelperGetProvSignerFromChain
push ebx
mov dword [edi + 0x1c], eax
call esi
push str.WinVerifyTrust
push ebx
mov dword [edi + 0x20], eax
call esi
push str.CertNameToStrW
push dword [ebp - 0x10]
mov dword [edi + 0x24], eax
call esi
mov dword [edi + 0x28], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x441400
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x53a00c]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [ecx]
push esi
push edi
mov edi, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x441465
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x441440
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x441465
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, esi
mov dword [edi], ecx
adc eax, 0
mov dword [edi + 4], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.004c4269
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.004c4269
add esp, 8
ret 4
Function at 0x441580
Capabilities:
Get disk information

Disassembly:
push ebp
lea ebp, [esp - 0x808]
sub esp, 0x808
push 0xffffffffffffffff
push 0x4f18a0
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x53a00c]
xor eax, ebp
mov dword [ebp + 0x804], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], ecx
lea eax, [ebp + 4]
push eax
push 0x3fe
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov edi, eax
mov dword [ebp - 0x10], edi
test edi, edi
je 0x441649
lea edx, [ebp + 4]
mov dword [ebp], 0
xor esi, esi
mov dword [ebp - 0x14], edx
mov dword [ebp], esi
mov dword [ebp - 4], esi
cmp edi, 0x3fe
jbe 0x44166e
xor ecx, ecx
lea eax, [edi + 2]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004c4acc
add esp, 4
mov ebx, eax
mov esi, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp], esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x441635
cmp eax, edi
ja 0x441635
mov edx, ebx
xor ecx, ecx
mov edi, eax
mov dword [ebp - 0x10], edi
mov dword [edx + eax*2], ecx
jmp 0x441696
mov dword [ebp - 4], 0xffffffff
test ebx, ebx
je 0x441649
push ebx
call fcn.004c48cc
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x804]
xor ecx, ebp
call fcn.004c4269
lea esp, [ebp + 0x808]
pop ebp
ret
lea eax, [edi + edi]
cmp eax, 0x800
jae 0x44178d
xor ecx, ecx
mov word [ebp + eax + 4], cx
add eax, 2
cmp eax, 0x800
jae 0x44178d
mov word [ebp + eax + 4], cx
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0x18], ebx
test edi, edi
je 0x441772
mov eax, dword [ebp - 0x10]
mov edi, 2
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x1c], edi
cmp word [edx + edi - 2], 0
jne 0x44175d
cmp ecx, ebx
je 0x44175d
lea eax, [edx + ecx*2]
push eax
lea ecx, [ebp - 0x38]
call fcn.00403020
mov byte [ebp - 4], 1
lea eax, [ebp - 0x38]
push eax
call fcn.00403a60
add esp, 4
mov ecx, esi
mov edx, eax
call fcn.004032a0
mov ecx, edx
test al, al
je 0x441733
call fcn.00403210
mov ecx, esi
mov edx, eax
call fcn.00403200
mov ecx, edx
mov ebx, eax
call fcn.00403210
push dword [ebx]
mov edi, eax
push 0x18
call fcn.00401f40
add esp, 8
mov ecx, edi
mov edx, eax
call fcn.00403210
push eax
mov ecx, edx
call fcn.00402fe0
add dword [ebx], 0x18
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
jmp 0x441748
call fcn.00403210
push eax
mov ecx, esi
call fcn.00403200
mov eax, dword [eax]
push eax
call fcn.0040ec3e
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x38]
call fcn.00402de0
mov eax, dword [ebp - 0x10]
lea ecx, [ebx + 1]
mov edx, dword [ebp - 0x14]
inc ebx
add edi, 2
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], edi
cmp ebx, eax
jb 0x4416b3
mov esi, dword [ebp]
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x441786
push esi
call fcn.004c48cc
add esp, 4
mov al, 1
jmp 0x44164b
call fcn.004c49f2
int3
Function at 0x442a80
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f1be8
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x53a00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 0x10]
mov ecx, edi
mov esi, dword [ebp + 0xc]
call fcn.00402f40
test al, al
jne 0x442ada
cmp byte [ebp + 8], al
jne 0x442ae1
mov eax, dword [ebx]
test eax, eax
je 0x442c3f
cmp byte [eax + 0xa5], 0
je 0x442c3f
xor al, al
jmp 0x442c53
mov ecx, esi
call fcn.00402f40
test al, al
jne 0x442c3f
mov ecx, esi
call fcn.004216a0
test al, al
je 0x442b07
push esi
push edi
call fcn.004426b0
jmp 0x442c3b
push 0xb
mov ecx, esi
call fcn.00402f50
push eax
mov ecx, edi
call fcn.00402f50
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push eax
call ebx
test eax, eax
je 0x442b2c
mov al, 1
jmp 0x442c3b
lea ecx, [ebp - 0x58]
mov byte [ebp - 0x59], 0
call fcn.00403070
mov dword [ebp - 4], 0
lea edx, [ebp - 0x58]
mov ecx, edi
call fcn.00439d30
movzx ecx, byte [ebp - 0x59]
test al, al
mov edx, 1
cmovne ecx, edx
mov dword [ebp - 0x60], ecx
lea ecx, [ebp - 0x40]
call fcn.00403070
mov byte [ebp - 4], 1
lea edx, [ebp - 0x40]
mov ecx, esi
call fcn.00439d30
test al, al
jne 0x442b79
cmp byte [ebp - 0x60], al
je 0x442bb5
push 0xb
lea ecx, [ebp - 0x40]
call fcn.00402f50
push eax
lea ecx, [ebp - 0x58]
call fcn.00402f50
push eax
call ebx
test eax, eax
je 0x442bb5
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00402de0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.00402de0
mov al, 1
jmp 0x442c3b
mov ecx, esi
call fcn.00439710
cmp eax, 0xffffffff
je 0x442c1e
push esi
lea ecx, [ebp - 0x28]
call fcn.00403090
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.00439af0
test al, al
je 0x442c12
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.004397b0
test al, al
je 0x442c12
mov edx, esi
mov ecx, edi
call fcn.004397b0
lea ecx, [ebp - 0x28]
test al, al
je 0x442c0b
call fcn.004398c0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.00402de0
jmp 0x442b93
mov edx, esi
call fcn.004397b0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.00402de0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00402de0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.00402de0
xor al, al
test al, al
jne 0x442c51
mov ecx, edi
call fcn.004216a0
test al, al
je 0x442c51
mov ecx, edi
call fcn.004398c0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c4269
mov esp, ebp
pop ebp
ret 0xc
Function at 0x456650
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x80
push esi
mov dword [esp + 4], 0x10d040e
xor esi, esi
mov dword [esp + 8], 0x80b0f02
mov dword [esp + 0xc], 0xc060a03
mov dword [esp + 0x10], 0x7000905
mov dword [esp + 0x14], 0xe08010f
mov dword [esp + 0x18], 0x4030b06
mov dword [esp + 0x1c], 0xd020709
mov dword [esp + 0x20], 0xa05000c
mov dword [esp + 0x24], 0xe09000a
mov dword [esp + 0x28], 0x50f0306
mov dword [esp + 0x2c], 0x70c0d01
mov dword [esp + 0x30], 0x802040b
mov dword [esp + 0x34], 0x30e0d07
mov dword [esp + 0x38], 0xa090600
mov dword [esp + 0x3c], 0x5080201
mov dword [esp + 0x40], 0xf040c0b
mov dword [esp + 0x44], 0x1040c02
mov dword [esp + 0x48], 0x60b0a07
mov dword [esp + 0x4c], 0xf030508
mov dword [esp + 0x50], 0x90e000d
mov dword [esp + 0x54], 0xf0a010c
mov dword [esp + 0x58], 0x8060209
mov dword [esp + 0x5c], 0x4030d00
mov dword [esp + 0x60], 0xb05070e
mov dword [esp + 0x64], 0xe020b04
mov dword [esp + 0x68], 0xd08000f
mov dword [esp + 0x6c], 0x7090c03
mov dword [esp + 0x70], 0x1060a05
mov dword [esp + 0x74], 0x408020d
mov dword [esp + 0x78], 0x10b0f06
mov dword [esp + 0x7c], 0xe03090a
mov dword [esp + 0x80], 0x70c0005
nop dword [eax]
mov ecx, esi
mov edx, esi
sar ecx, 4
and edx, 0xf
movzx eax, byte [esp + ecx + 4]
shl al, 4
or al, byte [esp + edx + 0x14]
mov byte [esi + 0x53d520], al
movzx eax, byte [esp + ecx + 0x24]
shl al, 4
or al, byte [esp + edx + 0x34]
mov byte [esi + 0x53d220], al
movzx eax, byte [esp + ecx + 0x44]
shl al, 4
or al, byte [esp + edx + 0x54]
mov byte [esi + 0x53d420], al
movzx eax, byte [esp + ecx + 0x64]
shl al, 4
or al, byte [esp + edx + 0x74]
mov byte [esi + 0x53d320], al
inc esi
cmp esi, 0x100
jl 0x456760
pop esi
add esp, 0x80
ret
Function at 0x458c00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ed528
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x53a00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
push ecx
lea ecx, [ebp - 0x28]
call fcn.00403090
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0041f360
lea ecx, [ebp - 0x28]
call fcn.00403330
lea ecx, [ebp - 0x28]
cmp eax, 2
jbe 0x458d29
call fcn.00403210
mov esi, eax
mov ecx, esi
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x458c6c
mov ecx, dword [esi]
cmp word [ecx], 0x5c
jne 0x458c86
mov ecx, esi
cmp eax, 8
jb 0x458c7b
mov ecx, dword [esi]
cmp word [ecx + 2], 0x5c
je 0x458da4
mov ecx, esi
cmp eax, 8
jb 0x458c8f
mov ecx, dword [esi]
cmp word [ecx], 0x2f
jne 0x458ca5
mov ecx, esi
cmp eax, 8
jb 0x458c9e
mov ecx, dword [esi]
cmp word [ecx + 2], 0x2f
je 0x458cfa
push 0x5c
mov edx, 0x2f
lea ecx, [ebp - 0x28]
call fcn.0041f140
mov eax, dword [esi + 0x14]
add esp, 4
mov ecx, esi
cmp eax, 8
jb 0x458cc3
mov ecx, dword [esi]
cmp word [ecx + 2], 0x3a
jne 0x458cfa
mov ecx, esi
cmp eax, 8
jb 0x458cd3
mov ecx, dword [esi]
cmp word [ecx + 4], 0x5c
jne 0x458cfa
mov ecx, esi
cmp eax, 8
jb 0x458ce3
mov ecx, dword [esi]
cmp word [ecx], 0x61
jb 0x458cfa
cmp eax, 8
jb 0x458cf0
mov esi, dword [esi]
cmp word [esi], 0x7a
jbe 0x458d85
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00402de0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c4269
mov esp, ebp
pop ebp
ret
call fcn.00403330
cmp eax, 2
jne 0x458cfa
lea ecx, [ebp - 0x28]
call fcn.00403210
mov edx, eax
mov ecx, dword [eax + 0x14]
cmp ecx, 8
jb 0x458d47
mov edx, dword [eax]
cmp word [edx + 2], 0x3a
jne 0x458cfa
mov edx, eax
cmp ecx, 8
jb 0x458d57
mov edx, dword [eax]
cmp word [edx], 0x61
jb 0x458cfa
cmp ecx, 8
jb 0x458d64
mov eax, dword [eax]
cmp word [eax], 0x7a
ja 0x458cfa
push 0x5147c0
call fcn.00403860
add esp, 4
lea ecx, [ebp - 0x28]
push eax
push 0x5147c0
call fcn.00408010
lea ecx, [ebp - 0x28]
call fcn.00402f50
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x458cfa
shr eax, 4
and al, 1
mov byte [edi], al
mov bl, 1
jmp 0x458cfc
Function at 0x45b180
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f5338
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x53a00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0
mov dword [esi + 0x10], eax
call fcn.004c9b5d
mov ecx, dword [esi]
add esp, 4
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
test ecx, ecx
je 0x45b25a
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x1c], edx
call fcn.0044e2f0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x38]
call fcn.00402f40
test al, al
jne 0x45b24b
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
lea ecx, [ebp - 0x38]
call fcn.00402f50
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x45b24b
test esi, esi
je 0x45b24b
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push 8
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.00402de0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c4269
mov esp, ebp
pop ebp
ret 4