joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404fb0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e0ab7
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x57af80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
push dword [ebp + 8]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QObject::constructor_class_QObject__]
mov dword [ebx], vtable.CCompleter.0
mov byte [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov word [ebx + 0x10], 0
mov eax, dword [sym.imp.Qt5Core.dll_struct_QListData::Data_const_QListData::shared_null]
mov dword [ebp - 4], 0
mov dword [ebx + 0x14], eax
lea ecx, [ebx + 0x18]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_void_]
lea edi, [ebx + 0x20]
mov byte [ebp - 4], 2
push 0
mov ecx, edi
mov byte [ebx + 0x1c], 0
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QStringListModel::constructor_class_QObject__]
lea ecx, [ebx + 0x30]
mov byte [ebp - 4], 3
call fcn.00405d20
push edi
lea ecx, [ebx + 0x30]
mov byte [ebp - 4], 4
call fcn.00406420
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4158d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e2d5b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x57af80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_class_QString_const__]
push 0xffffffffffffffff
lea ecx, [ebx + 4]
mov dword [ebp - 4], 0
lea eax, [edi + 4]
mov dword [ecx + 0x14], 0xf
push 0
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.00402410
mov eax, dword [edi + 0x1c]
lea ecx, [ebx + 0x28]
mov dword [ebx + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [ebx + 0x20], eax
mov eax, dword [edi + 0x24]
mov dword [ebx + 0x24], eax
lea eax, [edi + 0x28]
push eax
mov byte [ebp - 4], 1
call fcn.00403860
mov al, byte [edi + 0x2c]
lea esi, [ebx + 0x2c]
mov byte [esi], al
lea ecx, [esi + 4]
lea eax, [edi + 0x30]
mov byte [ebp - 4], 2
push eax
mov dword [ebp + 8], esi
call fcn.00415400
lea eax, [edi + 0x34]
mov byte [ebp - 4], 3
push eax
lea ecx, [esi + 8]
call fcn.004154d0
lea eax, [edi + 0x38]
mov byte [ebp - 4], 4
push eax
lea ecx, [esi + 0xc]
call fcn.00415400
lea eax, [edi + 0x3c]
mov byte [ebp - 4], 5
push eax
lea ecx, [esi + 0x10]
call fcn.004154d0
lea eax, [edi + 0x40]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebx + 0x40]
call fcn.0040e920
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x419720
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Get socket status
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x330
mov eax, dword [0x57af80]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov eax, 0x5dc
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
push edi
mov edi, dword [ebp + 0x14]
cmovle esi, eax
cmp word [ebp + 0xc], 0x15
jne 0x41976e
cmp byte [ebp + 0x18], 0
je 0x41975d
push 0x320
jmp 0x419762
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esi, 0x1f4
lea ecx, [ebp - 0x10c]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QTime::constructor_void_]
lea ecx, [ebp - 0x10c]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QTime::start_void_]
mov eax, 0x10624dd3
imul esi
push 6
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0x118], eax
imul eax, eax, 0x3e8
push 1
push 2
sub esi, eax
imul eax, esi, 0x3e8
mov dword [ebp - 0x114], eax
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x419946
cmp dword [ebx + 0x14], 0x10
jb 0x4197d0
mov ebx, dword [ebx]
push ebx
call dword [sym.imp.WS2_32.dll_inet_addr]
push dword [ebp + 0xc]
mov dword [ebp - 0x124], eax
call dword [sym.imp.WS2_32.dll_htons]
mov ebx, dword [sym.imp.WS2_32.dll_ioctlsocket]
mov word [ebp - 0x126], ax
mov eax, 2
mov word [ebp - 0x128], ax
lea eax, [ebp - 0x108]
push eax
push 0x8004667e
push esi
mov dword [ebp - 0x108], 1
call ebx
test eax, eax
jne 0x419936
push 0x10
lea eax, [ebp - 0x128]
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x419936
lea eax, [ebp - 0x108]
mov dword [ebp - 0x108], 0
push eax
push 0x8004667e
push esi
call ebx
test eax, eax
jne 0x419936
lea eax, [ebp - 0x118]
mov dword [ebp - 0x228], esi
push eax
lea eax, [ebp - 0x330]
mov dword [ebp - 0x22c], 1
push eax
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x32c], esi
push eax
push 0
push 0
mov dword [ebp - 0x330], 1
call dword [sym.imp.WS2_32.dll_select]
lea eax, [ebp - 0x22c]
push eax
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x419936
push 4
lea eax, [ebp - 0x110]
mov dword [ebp - 0x110], 0x12c
push eax
push 0x1006
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x419946
cmp dword [edi + 0x14], 0x10
mov dword [edi + 0x10], eax
jb 0x4198e2
mov eax, dword [edi]
jmp 0x4198e4
mov eax, edi
mov byte [eax], 0
lea eax, [ebp - 0x103]
push 0xff
push 0
push eax
mov byte [ebp - 0x104], 0
call sub.MSVCR120.dll_memset
mov ebx, dword [sym.imp.WS2_32.dll_recv]
add esp, 0xc
lea ebx, [ebx]
push 0
push 0x100
lea eax, [ebp - 0x104]
push eax
push esi
call ebx
test eax, eax
jle 0x419936
push eax
lea eax, [ebp - 0x104]
mov ecx, edi
push eax
call fcn.00419a20
jmp 0x419910
push 2
push esi
call dword [sym.imp.WS2_32.dll_shutdown]
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004df262
mov esp, ebp
pop ebp
ret
Function at 0x433c00
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e7c3b
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x57af80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor eax, eax
mov dword [esi], 0
mov dword [esi + 4], 0
mov word [esi + 8], ax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov eax, dword [sym.imp.Qt5Core.dll_struct_QListData::Data_const_QListData::shared_null]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x24]
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0x3f800000
mov dword [esi + 0x20], 0
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QTime::constructor_void_]
lea ecx, [esi + 0x28]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_void_]
lea ecx, [esi + 0x30]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QByteArray::constructor_void_]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x440c30
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Get socket status
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x57af80]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 0x14]
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x440da1
push dword [ebp + 0xc]
mov eax, 2
mov word [ebp - 0x18], ax
call dword [sym.imp.WS2_32.dll_htons]
push dword [ebp + 8]
mov word [ebp - 0x16], ax
xor eax, eax
mov byte [ebp - 0x14], 0
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov word [ebp - 0xb], ax
mov byte [ebp - 9], al
call dword [sym.imp.WS2_32.dll_htonl]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, 0x10624dd3
mul ecx
mov dword [ebp - 0x12c], esi
shr edx, 6
imul eax, edx, 0x3e8
mov dword [ebp - 0x130], 1
mov dword [ebp - 0x2c], edx
mov dword [ebp - 8], 0
mov dword [ebp - 0x24], 1
sub ecx, eax
lea eax, [ebp - 0x24]
push eax
push 0x8004667e
push esi
mov dword [ebp - 0x28], ecx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
jne 0x440d9a
push 0x10
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x440d63
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 8], eax
cmp eax, 0x2733
jne 0x440d94
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x130]
push eax
push eax
push 0
push 0
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jle 0x440d75
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 4
push eax
lea eax, [ebp - 8]
push eax
push 0x1007
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_getsockopt]
mov eax, dword [ebp - 8]
test eax, eax
jne 0x440d94
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push 0x8004667e
push esi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
jne 0x440d91
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004df262
mov esp, ebp
pop ebp
ret
jne 0x440d81
mov eax, 0x274c
mov dword [ebp - 8], eax
jmp 0x440d94
cmp eax, 0xffffffff
jne 0x440d91
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 8], eax
jmp 0x440d94
mov eax, dword [ebp - 8]
test edi, edi
je 0x440d9a
mov dword [edi], eax
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
xor ecx, ebp
pop esi
call fcn.004df262
mov esp, ebp
pop ebp
ret
Function at 0x441140
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x57af80]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x118
lea eax, [ebp - 0x11c]
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 5
jne 0x44119f
cmp byte [ebp - 6], 1
jne 0x44119f
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004df262
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
call fcn.004df262
mov esp, ebp
pop ebp
ret
Function at 0x4430d0
Capabilities:
Connect network resource

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ea249
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x57af80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0x10]
xorps xmm0, xmm0
mov edi, dword [ebp + 0xc]
movdqu xmmword [ebp - 0x34], xmm0
push esi
mov dword [ebp - 0x3c], eax
movdqu xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x30], 0
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_class_QString_const__]
push 1
push ecx
mov ecx, esp
mov dword [ebp - 4], 0
push 0x5c
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QChar::constructor_int_]
mov ecx, esi
call dword [sym.imp.Qt5Core.dll_public:_bool___thiscall_QString::startsWith_class_QChar__enum_Qt::CaseSensitivity_const]
test al, al
jne 0x443169
push esi
lea eax, [ebp - 0x38]
push 0x5054a4
push eax
call fcn.0041abe0
add esp, 0xc
lea ecx, [ebp - 0x14]
push eax
call dword [sym.imp.Qt5Core.dll_public:_class_QString____thiscall_QString::operator_class_QString_const__]
lea ecx, [ebp - 0x38]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
lea ecx, [ebp - 0x14]
call dword [sym.imp.Qt5Core.dll_public:_class_QChar_const____thiscall_QString::unicode_void_const]
push 0
mov ecx, edi
mov dword [ebp - 0x20], eax
call dword [sym.imp.Qt5Core.dll_public:_class_QChar_const____thiscall_QString::unicode_void_const]
mov ecx, dword [ebp - 0x3c]
push eax
call dword [sym.imp.Qt5Core.dll_public:_class_QChar_const____thiscall_QString::unicode_void_const]
push eax
lea eax, [ebp - 0x34]
push eax
call sub.MPR.dll_WNetAddConnection2W
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
mov esi, eax
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004df262
mov esp, ebp
pop ebp
ret
Function at 0x4431d0
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ea27c
mov eax, dword fs:[0]
push eax
sub esp, 0x818
mov eax, dword [0x57af80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ecx, eax
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x824], eax
call dword [sym.imp.Qt5Core.dll_public:_class_QChar_const____thiscall_QString::unicode_void_const]
push esi
lea ecx, [ebp - 0x818]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_class_QString_const__]
lea ecx, [ebp - 0x818]
mov dword [ebp - 4], 0
call dword [sym.imp.Qt5Core.dll_public:_int___thiscall_QString::length_void_const]
test eax, eax
jne 0x443247
push 0x507f90
lea ecx, [ebp - 0x818]
call dword [0x502558]
lea eax, [ebp - 0x820]
push eax
push 0
push 0x13
push 0
push 1
call sub.MPR.dll_WNetOpenEnumW
test eax, eax
jne 0x4433cc
push 0x800
push eax
lea eax, [ebp - 0x810]
mov dword [ebp - 0x81c], 0x800
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0x814], 0
lea eax, [ebp - 0x81c]
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x814]
push eax
push dword [ebp - 0x820]
call sub.MPR.dll_WNetEnumResourceW
test eax, eax
jne 0x4433cc
jmp 0x4432c0
mov eax, dword [ebp - 0x814]
test eax, eax
je 0x4433cc
xor ebx, ebx
test eax, eax
jle 0x44337a
lea edi, [ebp - 0x7fc]
mov edi, edi
mov ecx, dword [ebp - 0x824]
mov esi, dword [edi]
call dword [sym.imp.Qt5Core.dll_public:_class_QChar_const____thiscall_QString::unicode_void_const]
mov edi, edi
mov cx, word [eax]
cmp cx, word [esi]
jne 0x443316
test cx, cx
je 0x443312
mov cx, word [eax + 2]
cmp cx, word [esi + 2]
jne 0x443316
add eax, 4
add esi, 4
test cx, cx
jne 0x4432f0
xor eax, eax
jmp 0x44331b
sbb eax, eax
or eax, 1
test eax, eax
je 0x44335f
mov esi, dword [edi]
lea ecx, [ebp - 0x818]
call dword [sym.imp.Qt5Core.dll_public:_class_QChar_const____thiscall_QString::unicode_void_const]
lea ecx, [ecx]
mov cx, word [eax]
cmp cx, word [esi]
jne 0x443356
test cx, cx
je 0x443352
mov cx, word [eax + 2]
cmp cx, word [esi + 2]
jne 0x443356
add eax, 4
add esi, 4
test cx, cx
jne 0x443330
xor eax, eax
jmp 0x44335b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x44336a
push 1
push 1
push dword [edi]
call sub.MPR.dll_WNetCancelConnection2W
inc ebx
add edi, 0x20
cmp ebx, dword [ebp - 0x814]
jl 0x4432e0
push 0x800
lea eax, [ebp - 0x810]
mov dword [ebp - 0x81c], 0x800
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0x814], 0
lea eax, [ebp - 0x81c]
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x814]
push eax
push dword [ebp - 0x820]
call sub.MPR.dll_WNetEnumResourceW
test eax, eax
je 0x4432c0
lea ecx, [ebp - 0x818]
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004df262
mov esp, ebp
pop ebp
ret
Function at 0x445eb0
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1888
call fcn.004dfa50
mov eax, dword [0x57af80]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x1879
lea eax, [ebp - 0x187f]
mov byte [ebp - 0x1880], 0
push 0
push eax
mov esi, ecx
call sub.MSVCR120.dll_memset
mov eax, dword [esi + 0x24]
xor edx, edx
add eax, 0xffffffe7
mov ecx, 0xbfd80
div ecx
add esp, 0xc
mov ecx, esi
mov ebx, edx
mov edi, eax
call fcn.004472c0
test eax, eax
je 0x445f35
cmp ebx, 0x80
jae 0x445f9e
imul eax, edi, 0xbfd80
push 0
push 0
add eax, 0x19
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x445f48
mov dword [esi + 0x28], 0xa
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004df262
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 0x1888]
mov dword [ebp - 0x1888], 0
push eax
push 0x80
lea eax, [ebp - 0x1880]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x445f8d
pop edi
mov dword [esi + 0x28], 4
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004df262
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x1888], 0x80
jne 0x445f73
mov ebx, 0x80
lea ecx, [ebx - 0x80]
mov eax, 0xaad56003
mul ecx
imul ecx, edi, 0xbfd80
push 0
mov ebx, edx
shr ebx, 0xc
imul eax, ebx, 0x17fa
push 0
add ecx, 0x99
add eax, ecx
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x445f2e
push 0
lea eax, [ebp - 0x1884]
mov dword [ebp - 0x1884], 0
push eax
push 0x17fa
lea eax, [ebp - 0x1880]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x445f73
cmp dword [ebp - 0x1884], 0x17fa
jne 0x445f73
push 0
push dword [esi]
mov dword [esi + 0x44], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetFileSize]
shl edi, 7
mov ecx, esi
push 0
add edi, ebx
mov dword [esi + 0x24], eax
push edi
call fcn.00448150
mov ecx, dword [ebp - 4]
neg eax
pop edi
sbb eax, eax
xor ecx, ebp
pop esi
neg eax
pop ebx
call fcn.004df262
mov esp, ebp
pop ebp
ret
Function at 0x446270
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x57af80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
mov edi, ecx
test eax, eax
jne 0x4462a2
mov dword [edi + 0x28], 0xb
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004df262
mov esp, ebp
pop ebp
ret 8
push 0
push 0x20
push 2
push 0
push 0
push 0xc0000000
push eax
call fcn.004037b0
add esp, 0x1c
mov dword [edi], eax
cmp eax, 0xffffffff
jne 0x4462db
mov dword [edi + 0x28], 2
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004df262
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
push esi
lea esi, [edi + 4]
movdqu xmmword [esi], xmm0
movq qword [esi + 0x10], xmm0
mov byte [esi + 0x18], 0
mov dword [esi], eax
mov dword [edi + 8], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0
mov dword [edi + 0xc], eax
lea eax, [ebp - 8]
push eax
push 0x19
push esi
push dword [edi]
mov dword [edi + 0x10], 0x17fa
mov dword [edi + 0x14], 0x80
mov dword [edi + 0x18], 0
mov byte [edi + 0x1c], 1
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
test eax, eax
jne 0x446362
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0xffffffff
xor eax, eax
mov dword [edi + 0x28], 4
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004df262
mov esp, ebp
pop ebp
ret 8
cmp dword [ebp - 8], 0x19
jne 0x44633a
mov ecx, dword [ebp - 4]
mov eax, 1
mov dword [edi + 0x24], 0x19
xor ecx, ebp
pop edi
call fcn.004df262
mov esp, ebp
pop ebp
ret 8
Function at 0x446390
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x57af80]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
test ebx, ebx
jne 0x4463c3
pop esi
lea eax, [ebx + 1]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004df262
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x24]
xor edx, edx
add eax, 0xffffffe7
mov ecx, 0xbfd80
div ecx
push edi
mov edi, eax
shl edi, 7
cmp edx, 0x80
jbe 0x4463ef
lea ecx, [edx - 0x80]
mov eax, 0xaad56003
mul ecx
shr edx, 0xc
add edi, edx
cmp ebx, edi
mov eax, edi
cmovb eax, ebx
sub edi, eax
mov eax, edi
mov ebx, edi
shr eax, 7
imul eax, eax, 0xbfd80
mov dword [ebp - 0x208], eax
lea ecx, [eax + 0x19]
and ebx, 0x7f
je 0x44641e
imul eax, ebx, 0x17fa
sub ecx, 0xffffff80
add ecx, eax
push 0
push 0
push ecx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x44647b
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x4464d9
test ebx, ebx
je 0x4464f5
push 0x200
lea eax, [ebp - 0x204]
push 0
push eax
call sub.MSVCR120.dll_memset
mov eax, dword [ebp - 0x208]
add esp, 0xc
add eax, 0x19
add eax, ebx
push 0
push 0
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x446497
pop edi
mov dword [esi + 0x28], 0xa
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004df262
mov esp, ebp
pop ebp
ret 4
push 0
lea ecx, [ebp - 0x208]
mov dword [ebp - 0x208], 0
push ecx
mov eax, 0x80
sub eax, ebx
push eax
mov dword [ebp - 0x20c], eax
lea eax, [ebp - 0x204]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4464d9
mov eax, dword [ebp - 0x20c]
cmp dword [ebp - 0x208], eax
je 0x4464f5
pop edi
mov dword [esi + 0x28], 4
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004df262
mov esp, ebp
pop ebp
ret 4
push 0
push dword [esi]
mov dword [esi + 0x44], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp dword [esi + 0x18], edi
mov ecx, esi
mov dword [esi + 0x24], eax
cmovb edi, dword [esi + 0x18]
mov dword [esi + 0x18], edi
call fcn.004472c0
mov ecx, dword [ebp - 4]
neg eax
pop edi
sbb eax, eax
xor ecx, ebp
pop esi
neg eax
pop ebx
call fcn.004df262
mov esp, ebp
pop ebp
ret 4
Function at 0x4469b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x57af80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x34], ecx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x30], edi
test eax, eax
je 0x446b1b
test edi, edi
je 0x446b1b
test ecx, ecx
je 0x446b1b
push esi
push 0
push 0x20
push 3
push 0
push 1
push SysReAllocStringLen
push eax
call fcn.004037b0
mov esi, eax
add esp, 0x1c
cmp esi, 0xffffffff
jne 0x446a8c
mov esi, dword [ebp - 0x2c]
lea eax, [ebp - 0xc]
push eax
push esi
mov dword [ebp - 0xc], 0
call fcn.00403710
add esp, 8
test eax, eax
je 0x446a80
test byte [ebp - 0xc], 0x10
je 0x446a4b
mov dword [ebx + 0x28], 8
pop esi
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004df262
mov esp, ebp
pop ebp
ret 0xc
xor edi, edi
lea ecx, [ecx]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0x20
push 3
push 0
push 1
push SysReAllocStringLen
push esi
call fcn.004037b0
mov esi, eax
add esp, 0x1c
cmp esi, 0xffffffff
jne 0x446a89
mov esi, dword [ebp - 0x2c]
inc edi
cmp edi, 0x32
jb 0x446a50
mov dword [ebx + 0x28], 1
jmp 0x446a36
mov edi, dword [ebp - 0x30]
push 0
lea eax, [ebp - 8]
mov byte [ebp - 0x10], 0
push eax
push 0x19
lea eax, [ebp - 0x28]
mov dword [ebp - 8], 0
xorps xmm0, xmm0
push eax
push esi
movdqu xmmword [ebp - 0x28], xmm0
movq qword [ebp - 0x18], xmm0
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
test eax, eax
jne 0x446ace
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x28], 5
jmp 0x446a36
cmp dword [ebp - 8], 0x19
je 0x446ae6
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x28], 3
jmp 0x446a36
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0x10], 1
jne 0x446a36
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
mov dword [edi], eax
mov eax, dword [ebp - 0x1c]
pop esi
pop edi
mov dword [ecx], eax
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004df262
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
mov dword [ebx + 0x28], 0xb
xor ecx, ebp
pop ebx
call fcn.004df262
mov esp, ebp
pop ebp
ret 0xc