joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433a10
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov dword [ecx], 0
mov ebx, dword [eax]
mov dword [eax], 0
lea edi, [ebx + 1]
cmp edi, 2
jae 0x433a38
cmp dword [esi], ebx
jne 0x433a41
jmp 0x433a5b
call fcn.004733d0
cmp dword [esi], ebx
je 0x433a5b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
inc ecx
cmp ecx, 2
jae 0x433a67
cmp edi, 2
jae 0x433a87
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov dword [ebp - 0x10], eax
call fcn.004733d0
push dword [esi]
call fcn.00456a60
mov eax, dword [ebp - 0x10]
add esp, 4
mov dword [esi], 0
cmp edi, 2
jb 0x433a54
mov dword [esi], ebx
mov edi, eax
call fcn.004733d0
mov eax, edi
jmp 0x433a54

Function at 0x433b30
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov ebx, dword [eax]
mov dword [eax], 0
lea edi, [ebx + 1]
cmp edi, 2
jae 0x433b52
cmp dword [esi], ebx
jne 0x433b5b
jmp 0x433b75
call fcn.004733d0
cmp dword [esi], ebx
je 0x433b75
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
inc ecx
cmp ecx, 2
jae 0x433b81
cmp edi, 2
jae 0x433ba1
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov dword [ebp - 0x10], eax
call fcn.004733d0
push dword [esi]
call fcn.00456a60
mov eax, dword [ebp - 0x10]
add esp, 4
mov dword [esi], 0
cmp edi, 2
jb 0x433b6e
mov dword [esi], ebx
mov edi, eax
call fcn.004733d0
mov eax, edi
jmp 0x433b6e

Function at 0x435d60
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x18]
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x435f00
mov edx, dword fs:[0]
mov dword [eax], edx
mov dword fs:[0], eax
mov dword [ecx + 0x18], esi
xor edx, edx
test esi, esi
sete dl
mov dword [ecx + 0x10], edx
xor edx, edx
mov dword [ecx + 0x14], edx
mov dword [ecx + 4], 0x1002
mov dword [ecx + 0xc], edx
mov dword [ecx + 8], 6
xorps xmm0, xmm0
movups xmmword [ecx + 0x20], xmm0
movups xmmword [ecx + 0x30], xmm0
mov dword [ecx + 0x44], edx
mov dword [ebp - 0x20], ecx
mov dword [ecx + 0x40], edx
mov dword [eax + 8], edx
call fcn.00448ab0
mov eax, dword [eax]
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 0x1c], eax
lock inc dword [eax + 4]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x43ce00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, ecx
lea eax, [ebp - 0x18]
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x44d1e0
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov ebx, dword [ebp + 0x10]
mov dword fs:[0], eax
test byte [ebx + 4], 1
jne 0x43ce6f
movzx eax, byte [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [esi]
mov edi, dword [eax + 0x18]
mov ecx, edi
call dword [section..00cfg]
movsx eax, byte [ebp + 0x14]
mov ecx, esi
push dword [ebp - 0x20]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
jmp 0x43cf91
mov eax, dword [ebx + 0x1c]
lea ecx, [ebp - 0x2c]
mov dword [ecx], eax
mov dword [ebp - 0x20], eax
lock inc dword [eax + 4]
mov dword [ebp - 0x10], 0
push 0x59c2c0
call fcn.00448c28
mov esi, eax
xor ebx, ebx
dec ebx
mov eax, ebx
mov ecx, dword [ebp - 0x20]
lock xadd dword [ecx + 4], eax
test eax, eax
mov cl, byte [ebp + 0x18]
jne 0x43cec4
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov edi, dword [eax + 4]
mov dword [ebp - 0x10], 0xffffffff
mov ecx, edi
call dword [section..00cfg]
mov ecx, dword [ebp - 0x20]
call edi
mov cl, byte [ebp + 0x18]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov eax, dword [esi]
xor cl, 1
movzx ecx, cl
mov edi, dword [eax + ecx*4 + 0x14]
mov dword [ebp - 0x10], ebx
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
lea esi, [ebp - 0x2c]
push esi
call edi
mov edi, esi
mov al, byte [ebp - 0x21]
test al, al
jns 0x43cef8
mov edi, dword [ebp - 0x2c]
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
test al, al
js 0x43cf10
movzx eax, al
add eax, ebp
add eax, 0xffffffd4
cmp edi, eax
jne 0x43cf1a
jmp 0x43cf75
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x28]
cmp edi, eax
je 0x43cf79
test ebx, ebx
je 0x43cf32
mov al, byte [edi]
mov ecx, dword [ebx + 0x18]
cmp ecx, dword [ebx + 0x1c]
je 0x43cf36
lea edx, [ecx + 1]
mov dword [ebx + 0x18], edx
mov byte [ecx], al
jmp 0x43cf6f
xor ebx, ebx
jmp 0x43cf6f
mov dword [ebp - 0x20], edi
movzx edi, al
mov eax, dword [ebx]
mov esi, dword [eax + 0x30]
mov dword [ebp - 0x10], 0xffffffff
mov ecx, esi
call dword [section..00cfg]
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x30], ebx
mov ecx, ebx
push edi
call esi
xor ebx, ebx
cmp eax, 0xffffffff
je 0x43cf69
mov ebx, dword [ebp - 0x30]
mov esi, dword [ebp + 8]
mov edi, dword [ebp - 0x20]
inc edi
mov al, byte [ebp - 0x21]
jmp 0x43cefe
mov dword [esi], ebx
jmp 0x43cf86
mov dword [esi], ebx
push dword [ebp - 0x2c]
call fcn.00528424
add esp, 4
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
Function at 0x43e080
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, ecx
lea eax, [ebp - 0x18]
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x44d200
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov ebx, dword [ebp + 0x10]
mov dword fs:[0], eax
test byte [ebx + 4], 1
jne 0x43e0ef
movzx eax, byte [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [esi]
mov edi, dword [eax + 0x18]
mov ecx, edi
call dword [section..00cfg]
movzx eax, word [ebp + 0x14]
mov ecx, esi
push dword [ebp - 0x20]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
jmp 0x43e226
mov eax, dword [ebx + 0x1c]
lea ecx, [ebp - 0x2c]
mov dword [ecx], eax
mov dword [ebp - 0x20], eax
lock inc dword [eax + 4]
mov dword [ebp - 0x10], 0
push 0x59c2c8
call fcn.00448c28
mov esi, eax
xor ebx, ebx
dec ebx
mov eax, ebx
mov ecx, dword [ebp - 0x20]
lock xadd dword [ecx + 4], eax
test eax, eax
mov cl, byte [ebp + 0x18]
jne 0x43e144
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov edi, dword [eax + 4]
mov dword [ebp - 0x10], 0xffffffff
mov ecx, edi
call dword [section..00cfg]
mov ecx, dword [ebp - 0x20]
call edi
mov cl, byte [ebp + 0x18]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov eax, dword [esi]
xor cl, 1
movzx ecx, cl
mov edi, dword [eax + ecx*4 + 0x14]
mov dword [ebp - 0x10], ebx
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
lea esi, [ebp - 0x2c]
push esi
call edi
mov edx, esi
mov al, byte [ebp - 0x21]
test al, al
jns 0x43e178
mov edx, dword [ebp - 0x2c]
mov ebx, dword [ebp + 0xc]
test al, al
js 0x43e191
movzx ecx, al
lea ecx, [ecx*2 - 0x2c]
add ecx, ebp
cmp edx, ecx
jne 0x43e19d
jmp 0x43e203
mov ecx, dword [ebp - 0x28]
add ecx, ecx
add ecx, dword [ebp - 0x2c]
cmp edx, ecx
je 0x43e20a
test ebx, ebx
je 0x43e1b7
movzx esi, word [edx]
mov eax, dword [ebx + 0x18]
cmp eax, dword [ebx + 0x1c]
je 0x43e1bb
lea ecx, [eax + 2]
mov dword [ebx + 0x18], ecx
mov word [eax], si
jmp 0x43e1ec
xor ecx, ecx
jmp 0x43e1f9
mov dword [ebp - 0x30], edx
mov eax, dword [ebx]
mov edi, dword [eax + 0x30]
mov dword [ebp - 0x10], 0xffffffff
mov ecx, edi
call dword [section..00cfg]
mov dword [ebp - 0x10], 1
movzx eax, si
mov dword [ebp - 0x20], ebx
mov ecx, ebx
push eax
call edi
mov esi, eax
mov ebx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x30]
xor ecx, ecx
cmp si, 0xffff
je 0x43e1f6
mov ecx, ebx
mov al, byte [ebp - 0x21]
add edx, 2
mov ebx, ecx
jmp 0x43e17b
mov eax, dword [ebp + 8]
mov dword [eax], ebx
jmp 0x43e21c
mov esi, dword [ebp + 8]
mov dword [esi], ebx
push dword [ebp - 0x2c]
call fcn.00528424
mov eax, esi
add esp, 4
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
Function at 0x456c00
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1010
call fcn.00529740
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [0x597010]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x810]
push 0x800
push 0xff
push ebx
call fcn.0052c210
add esp, 0xc
mov dword [ebp - 0x1014], 1
mov dword [ebp - 0x1018], 0x800
lea eax, [ebp - 0x1018]
lea ecx, [ebp - 0x1014]
push eax
push ebx
push ecx
push 0
push edi
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x456da4
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x1014]
cmp eax, 2
je 0x456caf
mov edi, 0x3f4
cmp eax, 1
jne 0x456da4
push ebx
call fcn.00542c14
add esp, 4
movzx ecx, byte [esi + 0xb]
test cl, cl
js 0x456d18
mov edi, esi
cmp eax, 4
jbe 0x456d40
mov edx, 4
jmp 0x456d28
lea esi, [ebp - 0x1010]
push 0x800
push 0xff
push esi
call fcn.0052c210
add esp, 0xc
push 0x400
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x1018], eax
add eax, 0xfffffbff
mov edi, 0xea
cmp eax, 0xfffffc00
jb 0x456da4
push esi
call fcn.00542c14
add esp, 4
mov ebx, eax
mov esi, dword [ebp + 0xc]
movzx eax, byte [esi + 0xb]
test al, al
js 0x456d79
mov edi, esi
cmp ebx, 4
jbe 0x456dbf
mov edx, 4
jmp 0x456d89
mov edx, 0x7fffffff
and edx, dword [esi + 8]
dec edx
cmp edx, eax
jae 0x456d3e
mov ecx, dword [esi + 4]
mov dword [ebp - 0x101c], ecx
mov edi, eax
sub edi, edx
mov ecx, esi
push ebx
push eax
mov eax, dword [ebp - 0x101c]
jmp 0x456d97
mov edi, dword [esi]
lea ecx, [eax + eax]
push ecx
push ebx
push edi
mov ebx, eax
call fcn.0052bc90
add esp, 0xc
cmp byte [esi + 0xb], 0
js 0x456d6c
cmp ebx, 5
jae 0x456df4
mov eax, ebx
mov byte [esi + 0xb], al
mov word [edi + ebx*2], 0
jmp 0x456da2
mov dword [esi + 4], ebx
mov eax, ebx
mov word [edi + ebx*2], 0
jmp 0x456da2
mov edx, 0x7fffffff
and edx, dword [esi + 8]
dec edx
cmp edx, ebx
jae 0x456dbd
mov eax, dword [esi + 4]
mov edi, ebx
sub edi, edx
mov ecx, esi
lea esi, [ebp - 0x1010]
push esi
push ebx
push eax
push 0
push eax
push edi
push edx
call fcn.0044e0be
xor edi, edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00528e13
mov eax, edi
add esp, 0x1010
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov edi, dword [esi]
lea eax, [ebx + ebx]
push eax
lea eax, [ebp - 0x1010]
push eax
push edi
call fcn.0052bc90
add esp, 0xc
cmp byte [esi + 0xb], 0
js 0x456de9
cmp ebx, 5
jae 0x456df7
mov byte [esi + 0xb], bl
mov word [edi + ebx*2], 0
jmp 0x456da2
mov dword [esi + 4], ebx
mov word [edi + ebx*2], 0
jmp 0x456da2
int3
int3

Function at 0x456e00
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
push ebx
call fcn.00542c14
add esp, 4
lea eax, [eax*2 + 2]
push eax
push ebx
push 1
push 0
push edi
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x457820
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov eax, dword [0x597010]
xor eax, ebp
mov dword [esp + 0x40], eax
movsd xmm1, qword [0x59cbc0]
xorpd xmm0, xmm0
ucomisd xmm1, xmm0
jne 0x45799c
jp 0x45799c
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [esp + 0xc], eax
call esi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x59cbd0]
mov ecx, dword [0x59b038]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4579c1
mov eax, dword [0x59cbe0]
mov ecx, dword [0x59b038]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4579fa
rdtsc
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
lea ebx, [esp + 0x38]
push ebx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x3c]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
push ebx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub esi, dword [0x59cbd8]
sbb edi, dword [0x59cbdc]
movd xmm0, edi
movd xmm1, esi
punpckldq xmm1, xmm0
movq qword [esp + 0x28], xmm1
fild qword [esp + 0x28]
fstp qword [esp + 0x20]
movsd xmm0, qword [esp + 0x20]
fild qword [esp + 0x38]
fstp qword [esp + 0x30]
divsd xmm0, qword [esp + 0x30]
pxor xmm1, xmm1
movsd xmm2, qword [0x580e70]
ucomisd xmm2, xmm0
ja 0x45799c
mov eax, dword [esp + 8]
sub eax, dword [0x59cbc8]
mov ecx, dword [esp + 4]
sbb ecx, dword [0x59cbcc]
movd xmm1, ecx
movd xmm2, eax
punpckldq xmm2, xmm1
punpckldq xmm2, xmmword [0x57f580]
subpd xmm2, xmmword [0x57f590]
movapd xmm1, xmm2
unpckhpd xmm1, xmm2
addsd xmm1, xmm2
divsd xmm1, xmm0
movsd qword [0x59cbc0], xmm1
movsd qword [esp + 0x18], xmm1
fld qword [esp + 0x18]
fstp xword [esp + 0xc]
mov ecx, dword [esp + 0x40]
xor ecx, ebp
call fcn.00528e13
fld xword [esp + 0xc]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x59cbd0
call fcn.00528497
add esp, 4
cmp dword [0x59cbd0], 0xffffffff
jne 0x457892
rdtsc
mov dword [0x59cbc8], eax
mov dword [0x59cbcc], edx
push 0x59cbd0
call fcn.0052850d
add esp, 4
jmp 0x457892
push 0x59cbe0
call fcn.00528497
add esp, 4
cmp dword [0x59cbe0], 0xffffffff
jne 0x4578b3
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [0x59cbdc], ecx
mov dword [0x59cbd8], eax
push 0x59cbe0
call fcn.0052850d
add esp, 4
jmp 0x4578b3
Function at 0x457f40
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov edi, edx
mov ebx, ecx
mov eax, dword [0x597010]
xor eax, ebp
mov dword [ebp - 0x10], eax
test ecx, ecx
jne 0x457f9a
mov eax, dword [0x599b20]
cmp eax, 0xffffffff
jne 0x457f80
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x599b20
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x457f8b
mov eax, dword [0x599b20]
mov ebx, 0x100000
test eax, eax
jne 0x457f9a
jmp 0x457f95
mov dword [0x599b20], 0
mov ebx, 0x80000
push 0x10
call fcn.005283f4
add esp, 4
mov esi, eax
mov eax, edi
shr eax, 0xe
mov ecx, edi
shr ecx, 0x13
mov ecx, dword [ecx*4 + 0x59f9d0]
bt ecx, eax
mov dword [ebp - 0x24], ebx
jae 0x457fca
push edi
call fcn.0042f0b8
add esp, 4
jmp 0x457fd6
mov eax, edi
shr eax, 0x15
mov byte [eax + 0x5a79d0], 1
mov dword [esi], edi
mov ebx, dword [ebp + 8]
test ebx, ebx
setne byte [esi + 4]
mov eax, dword [ebp + 0xc]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0xc], eax
push 0
push 0x10000
push esi
push 0x458440
mov ebx, dword [ebp - 0x24]
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test eax, eax
je 0x45801e
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x4580b4
mov dword [ebx], edi
jmp 0x4580bb
mov dword [ebp - 0x20], edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
je 0x4580d4
mov edi, eax
cmp eax, 0x5af
je 0x4580d4
cmp edi, 0xe
je 0x4580d4
mov eax, dword [0x59cc18]
mov ecx, dword [0x59b038]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4580da
lea eax, [ebp - 0x1c]
push edi
push eax
call fcn.004685b0
add esp, 8
cmp byte [ebp - 0x11], 0
jns 0x458081
push dword [ebp - 0x1c]
call fcn.00528424
add esp, 4
test esi, esi
mov edi, dword [ebp - 0x20]
je 0x4580bb
mov eax, dword [esi]
mov ecx, eax
shr ecx, 0xe
mov edx, eax
shr edx, 0x13
mov edx, dword [edx*4 + 0x59f9d0]
bt edx, ecx
jae 0x4580a9
push eax
call fcn.0042f1aa
add esp, 4
push esi
call fcn.00528424
add esp, 4
jmp 0x4580bb
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00528e13
mov eax, ebx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
push ebx
call fcn.0047f560
push 0x59cc18
call fcn.00528497
add esp, 4
cmp dword [0x59cc18], 0xffffffff
jne 0x458063
push 0x59cc18
call fcn.0052850d
add esp, 4
jmp 0x458063

Function at 0x459970
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
mov dword [ecx], 0
test ebx, ebx
je 0x4599c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jb 0x4599aa
call fcn.004733d0
push dword [esi]
call fcn.00456a60
add esp, 4
mov dword [esi], 0
lea eax, [ebx + 1]
cmp eax, 2
jb 0x4599b9
mov dword [esi], ebx
call fcn.004733d0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp eax, ebx
je 0x4599d7
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 4
int3
Function at 0x4599e0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov edi, dword [eax]
mov dword [eax], 0
lea ebx, [edi + 1]
cmp ebx, 2
jb 0x459a01
call fcn.004733d0
mov dword [esi], 0
test edi, edi
je 0x459a25
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
inc ecx
cmp ecx, 2
jae 0x459a5c
cmp ebx, 2
jae 0x459a7c
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
movzx eax, byte [edi + 4]
mov byte [esi + 4], al
mov byte [edi + 4], 0
mov eax, dword [edi]
inc eax
cmp eax, 2
jb 0x459a50
call fcn.004733d0
push dword [edi]
call fcn.00456a60
add esp, 4
mov dword [edi], 0
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov dword [ebp - 0x10], eax
call fcn.004733d0
push dword [esi]
call fcn.00456a60
mov eax, dword [ebp - 0x10]
add esp, 4
mov dword [esi], 0
cmp ebx, 2
jb 0x459a1e
mov dword [esi], edi
mov edi, eax
call fcn.004733d0
mov eax, edi
jmp 0x459a1e

Function at 0x459a90
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov edi, dword [eax]
mov dword [eax], 0
lea ebx, [edi + 1]
cmp ebx, 2
jae 0x459ab2
cmp dword [esi], edi
jne 0x459abb
jmp 0x459ad5
call fcn.004733d0
cmp dword [esi], edi
je 0x459ad5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
inc ecx
cmp ecx, 2
jae 0x459b0c
cmp ebx, 2
jae 0x459b2c
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
movzx eax, byte [edi + 4]
mov byte [esi + 4], al
mov byte [edi + 4], 0
mov eax, dword [edi]
inc eax
cmp eax, 2
jb 0x459b00
call fcn.004733d0
push dword [edi]
call fcn.00456a60
add esp, 4
mov dword [edi], 0
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov dword [ebp - 0x10], eax
call fcn.004733d0
push dword [esi]
call fcn.00456a60
mov eax, dword [ebp - 0x10]
add esp, 4
mov dword [esi], 0
cmp ebx, 2
jb 0x459ace
mov dword [esi], edi
mov edi, eax
call fcn.004733d0
mov eax, edi
jmp 0x459ace
Function at 0x459ba0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [0x597010]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 4], 0
je 0x459bc6
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x459bc8
mov eax, dword [esi]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x459bea
mov bl, 1
cmp byte [ebp + 0xc], 0
je 0x459c48
cmp byte [esi + 4], 0
je 0x459c29
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x459c2b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [esi + 4], 0
je 0x459bfe
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x459c00
mov eax, dword [esi]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x459c14
xor ebx, ebx
jmp 0x459c48
mov dword [ebp - 0x14], 0xffffffff
cmp byte [esi + 4], 0
je 0x459c39
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x459c3b
mov eax, dword [esi]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x459c48
mov eax, dword [esi]
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00528e13
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x45b500
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov byte [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx], 0x57ade0
mov dword [ecx + 0xc], 0
movaps xmm0, xmmword [0x5813d0]
movups xmmword [esp], xmm0
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
sub esp, 0x10
cmp dword [esi + 0xc], eax
je 0x45b582
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi + 0xc]
inc eax
cmp eax, 2
jb 0x45b566
call fcn.004733d0
mov eax, dword [esi + 0xc]
mov dword [esp], eax
call fcn.00456a60
mov dword [esi + 0xc], 0
lea eax, [edi + 1]
cmp eax, 2
jb 0x45b576
mov dword [esi + 0xc], edi
call fcn.004733d0
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x45d500
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, ecx
mov edi, dword [ebp + 0xc]
mov eax, dword [0x597010]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
mov ebx, esp
push 0x42
push str....._base_files_file_win.cc
push str.Read
push ebx
call fcn.004733a0
add esp, 0x10
lea ecx, [esp + 0x20]
push 0
push 0
call fcn.004a1610
test byte [0x598b10], 0x19
jne 0x45d60f
mov ecx, ebx
mov ebx, 0xffffffff
test edi, edi
js 0x45d5e6
mov eax, dword [ebp + 0x14]
test eax, eax
js 0x45d5e6
mov edx, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x18], 0
pxor xmm0, xmm0
movdqa xmmword [esp], xmm0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], edx
mov dword [esp + 0x14], 0xffffffff
lea edx, [esp + 0x14]
push ecx
push edx
push eax
push ebx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x45d5cd
mov ebx, dword [esp + 0x14]
test ebx, ebx
jns 0x45d5dd
int3
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x26
setne bl
neg ebx
lea ecx, [esp + 0x18]
call fcn.0048b5e0
test byte [0x598b10], 0x19
jne 0x45d647
lea ecx, [esp + 0x20]
call fcn.004a1a80
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.00528e13
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
sub esp, 8
movq xmm0, qword [esp + 0x20]
movq qword [esp], xmm0
lea edx, [esp + 0x1c]
mov ecx, str.ScopedBlockingCall
call fcn.00462090
add esp, 8
jmp 0x45d563
mov dword [esp + 4], 0
mov dword [esp], 0
sub esp, 0x18
movq xmm0, qword [esp + 0x18]
movq qword [esp + 0x10], xmm0
mov dword [esp + 0xc], 0x57f540
mov dword [esp + 8], 0x57d4a9
mov dword [esp + 4], 0x598b10
mov dword [esp], 0x45
call fcn.00433670
add esp, 0x18
jmp 0x45d5ef