joyce8/EMBER2024-capa huggingface dataset:
Function at 0x452ac4
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040704c
xor eax, eax
push ebp
push 0x452c10
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
cmp dword [ebp - 4], 0
je 0x452bf5
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x452b18
mov eax, ebx
sub eax, 0xa
cmp word [eax], 2
je 0x452b18
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.00406450
mov ebx, eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x452b35
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x452b35
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.00406450
test eax, eax
je 0x452b3e
sub eax, 4
mov eax, dword [eax]
cmp word [ebx + eax*2 - 2], 0x5c
je 0x452b53
lea eax, [ebp - 4]
mov edx, 0x452c30
call fcn.00407470
mov eax, dword [ebp - 4]
test eax, eax
je 0x452b70
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x452b70
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.00406450
test eax, eax
je 0x452b79
sub eax, 4
mov eax, dword [eax]
mov esi, eax
test esi, esi
jle 0x452bf1
mov ebx, 1
mov eax, dword [ebp - 4]
test eax, eax
je 0x452ba1
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x452ba1
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.00406450
cmp word [eax + ebx*2 - 2], 0x5c
jne 0x452bed
lea eax, [ebp - 8]
push eax
mov ecx, ebx
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040783c
mov eax, dword [ebp - 8]
call fcn.004070f0
mov edi, eax
push edi
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
jne 0x452be0
push 0
push edi
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x452bed
jmp 0x452bf5
test al, 0x10
jne 0x452bed
push 0x50
call sub.kernel32.dll_SetLastError
jmp 0x452bf5
inc ebx
dec esi
jne 0x452b84
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452c17
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040705c
ret

Function at 0x452c34
Capabilities:
Check if file exists
Enumerate files on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda8
push ebx
push esi
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040704c
xor eax, eax
push ebp
push 0x452cd4
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
cmp byte [ebp - 5], 0
je 0x452ca6
lea eax, [ebp - 0x258]
push eax
mov eax, dword [ebp - 4]
call fcn.004070f0
push eax
call sub.kernel32.dll_FindFirstFileW_1
mov esi, eax
cmp esi, 0xffffffff
je 0x452cbe
test byte [ebp - 0x258], 0x10
setne bl
test bl, bl
jne 0x452c9e
lea eax, [ebp - 0x258]
push eax
push esi
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x452c7f
push esi
call sub.kernel32.dll_FindClose_1
jmp 0x452cbe
mov eax, dword [ebp - 4]
call fcn.004070f0
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x452cbe
test al, 0x10
setne bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452cdb
lea eax, [ebp - 4]
call fcn.00407054
ret
Function at 0x4530fc
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040704c
mov eax, dword [ebp - 8]
call fcn.0040704c
xor eax, eax
push ebp
push 0x45318c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, dword [ebp - 8]
call fcn.00407064
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004070f0
mov edi, eax
push edi
call sub.kernel32.dll_GetEnvironmentVariableW
mov ebx, eax
test ebx, ebx
jbe 0x453171
mov eax, esi
mov edx, ebx
call fcn.004073d8
push ebx
mov eax, dword [esi]
call fcn.004070f0
push eax
push edi
call sub.kernel32.dll_GetEnvironmentVariableW
mov edx, ebx
dec edx
mov eax, esi
call fcn.004073d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x453193
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040705c
ret

Function at 0x45321c
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffdf8
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.00407064
mov eax, esp
xor ecx, ecx
mov edx, 0x208
call fcn.00404818
push esp
push 0
push 0
push esi
push 0
call sub.shell32.dll_SHGetFolderPathW
test eax, eax
jne 0x453275
push esp
call sub.kernel32.dll_lstrlenW_1
mov esi, eax
mov eax, ebx
mov edx, esi
call fcn.004073d8
mov eax, ebx
call fcn.004079dc
mov edx, eax
mov ecx, esi
add ecx, ecx
mov eax, esp
call fcn.00404350
add esp, 0x208
pop esi
pop ebx
ret

Function at 0x4532f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040704c
xor eax, eax
push ebp
push 0x4533a6
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00404818
lea eax, [ebp - 0x58]
xor ecx, ecx
mov edx, 0x10
call fcn.00404818
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 1
mov word [ebp - 0x18], 1
test edi, edi
jne 0x453351
lea esi, [ebp - 0x58]
jmp 0x453353
mov esi, edi
push esi
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004070f0
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x453390
test edi, edi
jne 0x45338e
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4533ad
lea eax, [ebp - 4]
call fcn.00407054
ret
Function at 0x4533b8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040704c
mov eax, dword [ebp - 8]
call fcn.0040704c
xor eax, eax
push ebp
push 0x4534f0
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x44
call fcn.00404818
lea eax, [ebp - 0x60]
xor ecx, ecx
mov edx, 0x10
call fcn.00404818
mov dword [ebp - 0x50], 0x44
mov dword [ebp - 0x24], 1
mov word [ebp - 0x20], 1
test edi, edi
jne 0x453429
lea esi, [ebp - 0x60]
jmp 0x45342b
mov esi, edi
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.004070b8
mov edx, dword [ebp - 4]
mov eax, 0x45350c
call fcn.00407a28
test eax, eax
jle 0x453462
push 0x45351c
push dword [ebp - 4]
push 0x45351c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00407614
jmp 0x453473
cmp dword [ebp - 4], 0
je 0x453473
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.004070b8
cmp dword [ebp - 8], 0
je 0x453491
push dword [ebp - 0xc]
push 0x45350c
push dword [ebp - 8]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00407614
push esi
lea eax, [ebp - 0x50]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.004070f0
push eax
mov eax, dword [ebp - 4]
call fcn.004070f0
push eax
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x4534d5
test edi, edi
jne 0x4534d3
mov eax, dword [ebp - 0x60]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_CloseHandle_1
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4534f7
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040705c
ret

Function at 0x453564
Capabilities:
Enumerate gui resources
Terminate process

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, eax
push edx
push 0x453520
call sub.user32.dll_EnumWindows
push esi
push ebx
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
je 0x453591
push 0
push ebx
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb eax, eax
inc eax
pop esi
pop ebx
ret
mov al, 1
pop esi
pop ebx
ret

Function at 0x453565
Capabilities:
Enumerate gui resources
Terminate process

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, eax
push edx
push 0x453520
call sub.user32.dll_EnumWindows
push esi
push ebx
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
je 0x453591
push 0
push ebx
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb eax, eax
inc eax
pop esi
pop ebx
ret
mov al, 1
pop esi
pop ebx
ret
Function at 0x4536f8
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb4
push ebx
push esi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040704c
mov eax, dword [ebp - 8]
call fcn.0040704c
xor eax, eax
push ebp
push 0x4537c9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x3c
call fcn.00404818
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x40], 0x540
mov eax, 0x4537d8
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 4]
call fcn.004070f0
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
call fcn.004070f0
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x24c]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryW_1
lea eax, [ebp - 0x24c]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 1
lea eax, [ebp - 0x44]
push eax
call sub.shell32.dll_ShellExecuteExW
cmp eax, 1
sbb ebx, ebx
inc ebx
test esi, esi
je 0x4537ae
mov eax, esi
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
xor edx, edx
mov dword [eax + 4], edx
xor edx, edx
mov dword [eax + 8], edx
xor edx, edx
mov dword [eax + 0xc], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4537d0
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040705c
ret

Function at 0x453ef4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040704c
xor eax, eax
push ebp
push 0x453f79
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 8]
call fcn.00407054
mov edx, eax
lea eax, [ebp - 4]
call fcn.00453e6c
mov eax, dword [ebp - 4]
call fcn.00453bb8
mov esi, eax
test esi, esi
je 0x453f5e
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.004070f0
push eax
push esi
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
sete bl
push esi
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x453f80
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040705c
ret
Function at 0x45423c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040704c
mov eax, dword [ebp - 8]
call fcn.0040704c
xor eax, eax
push ebp
push 0x454324
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.00407054
mov edx, eax
lea eax, [ebp - 4]
call fcn.00453e6c
mov eax, dword [ebp - 4]
call fcn.00453dc0
mov ebx, eax
test ebx, ebx
je 0x454309
mov eax, dword [ebp - 8]
test eax, eax
je 0x4542aa
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x4542aa
lea eax, [ebp - 8]
mov edx, dword [ebp - 8]
call fcn.00406450
test eax, eax
je 0x4542b3
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x4542e4
mov eax, dword [ebp - 8]
test eax, eax
je 0x4542d4
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x4542d4
lea eax, [ebp - 8]
mov edx, dword [ebp - 8]
call fcn.00406450
test eax, eax
je 0x4542dd
sub eax, 4
mov eax, dword [eax]
inc eax
mov esi, eax
add esi, esi
jmp 0x4542e6
xor esi, esi
push esi
mov eax, dword [ebp - 8]
call fcn.004070f0
push eax
push 1
push 0
mov eax, dword [ebp - 0xc]
call fcn.004070f0
push eax
push ebx
call sub.advapi32.dll_RegSetValueExW
push ebx
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45432b
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040705c
ret

Function at 0x454334
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040704c
xor eax, eax
push ebp
push 0x454416
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00406264
lea eax, [ebp - 8]
call fcn.00407054
mov edx, eax
lea eax, [ebp - 4]
call fcn.00453e6c
mov eax, dword [ebp - 4]
call fcn.00453dc0
mov ebx, eax
test ebx, ebx
je 0x4543fb
push 0
push 0
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.004070f0
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExW_1
cmp dword [ebp - 0xc], 3
jne 0x4543f5
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.004070f0
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExW_1
mov eax, esi
xor ecx, ecx
mov edx, dword [ebp - 0x10]
call fcn.00406c28
cmp dword [ebp - 0x10], 0
je 0x4543f5
lea eax, [ebp - 0x10]
push eax
mov eax, esi
call fcn.00406a2c
push eax
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.004070f0
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExW_1
push ebx
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45441d
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040705c
ret
Function at 0x454424
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040704c
mov eax, dword [ebp - 0xc]
call fcn.004069a4
xor eax, eax
push ebp
push 0x454504
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.00407054
mov edx, eax
lea eax, [ebp - 4]
call fcn.00453e6c
mov eax, dword [ebp - 4]
call fcn.00453dc0
mov ebx, eax
test ebx, ebx
je 0x4544e1
cmp dword [ebp - 0xc], 0
jne 0x454494
push 0
push 0
push 3
push 0
mov eax, dword [ebp - 8]
call fcn.004070f0
push eax
push ebx
call sub.advapi32.dll_RegSetValueExW
jmp 0x4544e1
lea eax, [ebp - 0xc]
call fcn.00406a2c
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4544be
mov edx, eax
sub edx, 0xa
cmp word [edx], 1
je 0x4544be
lea eax, [ebp - 0xc]
xor ecx, ecx
mov edx, dword [ebp - 0xc]
call fcn.00406480
mov esi, eax
test esi, esi
je 0x4544c9
sub esi, 4
mov esi, dword [esi]
push esi
mov eax, dword [ebp - 0x10]
push eax
push 3
push 0
mov eax, dword [ebp - 8]
call fcn.004070f0
push eax
push ebx
call sub.advapi32.dll_RegSetValueExW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45450b
lea eax, [ebp - 0xc]
call fcn.00406264
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040705c
ret

Function at 0x454cf8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040704c
mov eax, dword [ebp - 8]
call fcn.004069a4
xor eax, eax
push ebp
push 0x454e10
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
mov eax, dword [ebp - 4]
call fcn.004070f0
push eax
call sub.kernel32.dll_CreateFileW
mov ebx, eax
cmp ebx, 0xffffffff
je 0x454df2
mov eax, dword [ebp - 8]
test eax, eax
je 0x454d73
mov edx, eax
sub edx, 0xa
cmp word [edx], 1
je 0x454d73
lea eax, [ebp - 8]
xor ecx, ecx
mov edx, dword [ebp - 8]
call fcn.00406480
test eax, eax
je 0x454d7c
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x454dec
mov esi, dword [ebp - 8]
test esi, esi
je 0x454da1
mov eax, esi
sub eax, 0xa
cmp word [eax], 1
je 0x454da1
lea eax, [ebp - 8]
xor ecx, ecx
mov edx, dword [ebp - 8]
call fcn.00406480
mov esi, eax
lea eax, [ebp - 8]
call fcn.00406a2c
mov esi, eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x454dca
mov edx, eax
sub edx, 0xa
cmp word [edx], 1
je 0x454dca
lea eax, [ebp - 8]
xor ecx, ecx
mov edx, dword [ebp - 8]
call fcn.00406480
mov edi, eax
test edi, edi
je 0x454dd5
sub edi, 4
mov edi, dword [edi]
push 0
lea eax, [ebp - 0x10]
push eax
push edi
push esi
push ebx
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x454e17
lea eax, [ebp - 8]
call fcn.00406264
lea eax, [ebp - 4]
call fcn.00407054
ret
Function at 0x454e24
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040704c
xor eax, eax
push ebp
push 0x454ed0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00406264
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.004070f0
push eax
call sub.kernel32.dll_CreateFileW
mov ebx, eax
cmp ebx, 0xffffffff
je 0x454eba
push 2
push 0
push 0
push ebx
call sub.kernel32.dll_SetFilePointer
mov dword [ebp - 8], eax
push 0
push 0
push 0
push ebx
call sub.kernel32.dll_SetFilePointer
mov eax, esi
xor ecx, ecx
mov edx, dword [ebp - 8]
call fcn.00406c28
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, esi
call fcn.00406a2c
push eax
push ebx
call sub.kernel32.dll_ReadFile
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x454ed7
lea eax, [ebp - 4]
call fcn.00407054
ret

Function at 0x454ee0
Capabilities:
Check if file exists
Enumerate files on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda8
push ebx
push esi
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040704c
xor eax, eax
push ebp
push 0x454fbc
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
cmp byte [ebp - 5], 0
je 0x454f52
lea eax, [ebp - 0x258]
push eax
mov eax, dword [ebp - 4]
call fcn.004070f0
push eax
call sub.kernel32.dll_FindFirstFileW_1
mov esi, eax
cmp esi, 0xffffffff
je 0x454fa6
test byte [ebp - 0x258], 0x10
sete bl
test bl, bl
jne 0x454f4a
lea eax, [ebp - 0x258]
push eax
push esi
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x454f2b
push esi
call sub.kernel32.dll_FindClose_1
jmp 0x454fa6
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.004070f0
mov esi, eax
push esi
call sub.kernel32.dll_CreateFileW
cmp eax, 0xffffffff
setne bl
test bl, bl
je 0x454f86
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x454fa6
push esi
call sub.shlwapi.dll_PathFileExistsW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x454fa6
push esi
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x454fa6
test al, 0x10
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x454fc3
lea eax, [ebp - 4]
call fcn.00407054
ret
Function at 0x455220
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4553ac
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x45194c]
call fcn.004547bc
mov dword [0x49c1b4], eax
call sub.kernel32.dll_GetCommandLineW_1
mov edx, eax
lea eax, [ebp - 8]
call fcn.00407220
xor edi, edi
mov esi, 1
mov byte [ebp - 9], 0
xor ebx, ebx
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.004070b8
jmp 0x4552c4
mov eax, dword [ebp - 8]
movzx eax, word [eax + esi*2 - 2]
sub ax, 0x20
je 0x45529a
sub ax, 2
je 0x455295
sub ax, 0x3a
jne 0x4552c3
mov edi, esi
mov byte [ebp - 9], bl
jmp 0x4552c3
xor bl, 1
jmp 0x4552c3
test bl, bl
jne 0x4552c3
lea eax, [ebp - 4]
push eax
mov ecx, esi
sub ecx, edi
dec ecx
lea edx, [edi + 1]
mov eax, dword [ebp - 8]
call fcn.0040783c
lea eax, [ebp - 8]
mov ecx, esi
mov edx, 1
call fcn.0040790c
jmp 0x4552d5
inc esi
lea eax, [ebp - 8]
call fcn.00406460
call fcn.004073cc
cmp esi, eax
jle 0x455274
cmp byte [ebp - 9], 0
je 0x455377
mov edx, dword [ebp - 4]
mov eax, 0x4553c8
call fcn.00407a28
test eax, eax
jle 0x455302
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, 0x4553d8
call fcn.00407530
jmp 0x455377
mov edx, dword [ebp - 4]
mov eax, 0x4553d8
call fcn.00407a28
mov ebx, eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x45532e
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x45532e
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.00406450
test eax, eax
je 0x455337
sub eax, 4
mov eax, dword [eax]
cmp eax, ebx
jne 0x455377
mov eax, dword [ebp - 4]
test eax, eax
je 0x455358
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x455358
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.00406450
mov ebx, eax
test ebx, ebx
je 0x455363
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 4]
push eax
mov ecx, ebx
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040783c
push dword [ebp - 4]
push 0x4553c8
push dword [ebp - 8]
mov eax, 0x49c1b0
mov edx, 3
call fcn.00407614
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4553b3
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040705c
ret

Function at 0x456bf0
Capabilities:
Create thread

Disassembly:
push ebx
mov eax, dword [0x496458]
mov byte [eax], 1
mov edx, dword [0x45597c]
xor eax, eax
call fcn.00455c0c
mov ebx, eax
mov byte [ebx + 0x18], 1
lea eax, [ebx + 0x1e]
push eax
push 4
push ebx
push 0x456be0
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [ebx + 0x1a], eax
mov eax, ebx
pop ebx
ret

Function at 0x456d30
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
mov byte [ebx + 0x18], 0
mov eax, dword [ebx + 0x1a]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
jbe 0x456d4b
mov byte [ebx + 0x18], 1
pop ebx
ret
cmp word [ebx + 0x2c], 0
je 0x456d5a
mov edx, ebx
mov eax, dword [ebx + 0x2e]
call dword [ebx + 0x2a]
pop ebx
ret
Function at 0x458904
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
and dword [ebx + 0x24], 0xefffffff
test dl, dl
je 0x458919
or dword [ebx + 0x24], 0x10000000
cmp dword [ebx + 0x1c], 0
je 0x45894f
test dl, dl
je 0x458938
mov eax, ebx
call dword [0x49433c]
push 5
mov eax, dword [ebx + 0x1c]
push eax
call sub.user32.dll_ShowWindow
jmp 0x45894f
and byte [ebx + 0x37], 0xfe
push 0
mov eax, dword [ebx + 0x1c]
push eax
call sub.user32.dll_ShowWindow
mov eax, ebx
call dword [0x49433c]
pop ebx
ret

Function at 0x45ed18
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040704c
xor eax, eax
push ebp
push 0x45ee90
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x45ee6a
cmp dword [0x49c638], 0
je 0x45ed5c
cmp dword [0x49c638], 0xffffffff
jne 0x45edd3
cmp dword [0x49c634], 0
je 0x45edd3
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
mov eax, dword [0x49c634]
call fcn.004070f0
push eax
call sub.kernel32.dll_CreateFileW
mov dword [0x49c638], eax
call sub.kernel32.dll_GetLastError_1
sub eax, 1
jb 0x45ed9f
sub eax, 0xb6
je 0x45edc2
jmp 0x45edd3
mov dword [ebp - 0xc], 3
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0x4944f4
mov eax, dword [0x49c638]
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x45edd3
push 2
push 0
push 0
mov eax, dword [0x49c638]
push eax
call sub.kernel32.dll_SetFilePointer
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0040a038
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x45eea8
call fcn.00406704
cmp dword [0x49c638], 0
je 0x45ee6a
cmp dword [0x49c638], 0xffffffff
je 0x45ee6a
mov eax, dword [ebp - 8]
test eax, eax
je 0x45ee1f
mov edx, eax
sub edx, 0xa
cmp word [edx], 1
je 0x45ee1f
lea eax, [ebp - 8]
xor ecx, ecx
mov edx, dword [ebp - 8]
call fcn.00406480
test eax, eax
je 0x45ee28
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x45ee4c
mov eax, ebx
sub eax, 0xa
cmp word [eax], 1
je 0x45ee4c
lea eax, [ebp - 8]
xor ecx, ecx
mov edx, dword [ebp - 8]
call fcn.00406480
mov ebx, eax
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 8]
call fcn.00406a2c
push eax
mov eax, dword [0x49c638]
push eax
call sub.kernel32.dll_WriteFile_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ee97
lea eax, [ebp - 0x10]
call fcn.00406264
lea eax, [ebp - 8]
call fcn.00406264
lea eax, [ebp - 4]
call fcn.00407054
ret