joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41deec
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4474cc
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x459008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push dword [esi + 0xcc]
call fcn.004377b3
push dword [esi + 0xc0]
call fcn.004377b3
push dword [esi + 0x9c]
call fcn.004377b3
push dword [esi + 0x90]
call fcn.004377b3
push dword [esi + 0x30]
call fcn.004377b3
push dword [esi + 0x24]
call fcn.004377b3
push dword [esi + 0x18]
call fcn.004377b3
add esp, 0x1c
and dword [ebp - 4], 0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x41df69
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 1
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x41df7d
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 2
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x41df91
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 3
mov ecx, dword [esi]
test ecx, ecx
je 0x41dfa4
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x423456
Capabilities:
Get file system object information

Disassembly:
push 0x1d0
mov eax, 0x447e72
call fcn.00444f9d
mov ebx, ecx
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x1d0]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x1ac], eax
call fcn.004093d0
and dword [ebp - 4], 0
cmp byte [edi], 0
je 0x4234d9
push dword [edi + 0xc]
lea ecx, [ebp - 0x1b8]
push dword [edi + 8]
call fcn.00423318
push eax
mov edx, 0xdb0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c4]
call fcn.004233b5
push eax
lea ecx, [ebp - 0x1d0]
mov byte [ebp - 4], 2
call fcn.00409516
push dword [ebp - 0x1c4]
call fcn.004377b3
pop ecx
mov byte [ebp - 4], 0
push dword [ebp - 0x1b8]
call fcn.004377b3
pop ecx
lea eax, [edi + 0x18]
mov ecx, eax
mov dword [ebp - 0x1a8], eax
call fcn.004097d2
mov esi, eax
lea eax, [ebp - 0x1c4]
lea ecx, [esi + 1]
push ecx
push eax
lea ecx, [edi + 0x18]
call fcn.004147b5
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1b8]
mov eax, dword [edi + 0x18]
add eax, 2
lea eax, [eax + esi*2]
push eax
call fcn.004093f4
lea eax, [ebp - 0x1c4]
mov byte [ebp - 4], 4
push eax
mov ecx, ebx
call fcn.004233f5
lea eax, [ebp - 0x1b8]
mov ecx, ebx
push eax
call fcn.004233f5
lea eax, [ebp - 0x1c4]
push eax
lea ecx, [ebp - 0x1a0]
call fcn.0040947d
lea ecx, [ebp - 0x1a0]
mov byte [ebp - 4], 5
call fcn.004096ad
lea eax, [ebp - 0x1b8]
push eax
lea ecx, [ebp - 0x1a0]
call fcn.0040971c
lea ecx, [ebp - 0x1a0]
call fcn.004096ad
lea eax, [ebp - 0x1d0]
push eax
lea ecx, [ebp - 0x1a0]
call fcn.0040971c
lea ecx, [ebp - 0x1a0]
call fcn.004096ad
cmp byte [edi + 1], 0
je 0x4235f6
mov edx, 0x3f4
lea ecx, [ebp - 0x1dc]
call fcn.0040d127
push eax
lea ecx, [ebp - 0x1a0]
mov byte [ebp - 4], 6
call fcn.0040971c
mov byte [ebp - 4], 5
push dword [ebp - 0x1dc]
call fcn.004377b3
lea ecx, [ebp - 0x1a0]
mov dword [esp], 0x44f514
call fcn.0040975a
push 0
lea eax, [ebp - 0x34]
push eax
lea ecx, [edi + 0x10]
call fcn.0040ce9d
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x1a0]
call fcn.0040975a
push dword [ebp + 8]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push dword [ebx + 4]
call edi
push dword [ebp - 0x1a0]
lea ecx, [ebp - 0x1a4]
mov dword [ebp - 0x1a4], eax
call fcn.0042069e
mov edx, dword [ebp - 0x1a8]
lea ecx, [ebp - 0x1dc]
call fcn.0040a7e1
push 0x110
push 0x160
lea ecx, [ebp - 0x194]
push ecx
push 0x80
push dword [eax]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
push dword [ebp - 0x1dc]
mov esi, eax
call fcn.004377b3
pop ecx
test esi, esi
je 0x42367b
push dword [ebp - 0x1ac]
push dword [ebx + 4]
call edi
push 0
push dword [ebp - 0x194]
push 0x170
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [ebp - 0x1a0]
call fcn.004377b3
pop ecx
push dword [ebp - 0x1b8]
call fcn.004377b3
pop ecx
push dword [ebp - 0x1c4]
call fcn.004377b3
pop ecx
push dword [ebp - 0x1d0]
call fcn.004377b3
pop ecx
call fcn.00444f47
ret 0xc
Function at 0x425bee
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 0x28
mov eax, dword [edx]
push esi
mov esi, ecx
cmp eax, dword [esi + 0xb4]
jne 0x425c21
cmp dword [edx + 8], 0xffffff65
jne 0x425c21
movzx eax, word [edx + 0xc]
sub eax, 0x2d
je 0x425c5d
sub eax, 0x14
je 0x425c2a
dec eax
sub eax, 1
je 0x425c5d
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x425c21
push 2
pop eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x28]
push eax
push 0xffffffffffffffff
push 0x102b
push dword [esi + 0xb4]
call dword [sym.imp.USER32.dll_SendMessageA]
mov al, 1
jmp 0x425c23
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x425c21
mov ecx, esi
call fcn.00425c75
jmp 0x425c59

Function at 0x425da3
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x4481d7
call fcn.00444f69
mov edi, ecx
xor esi, esi
mov dword [ebp - 0x10], esi
lea eax, [ebp - 0x14]
mov dword [ebp - 4], esi
push eax
push esi
push edi
push 0x425d65
push esi
push esi
call fcn.0043d585
add esp, 0x18
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x425dee
call fcn.0040896c
test eax, eax
je 0x425dee
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
jmp 0x425dfd
push ecx
lea eax, [ebp - 0x10]
mov ecx, edi
push eax
push dword [ebp + 8]
call fcn.00425329
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 2
call fcn.0040897d
mov eax, esi
call fcn.00444f32
ret 8

Function at 0x4260fb
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2d0
mov eax, dword [0x459008]
xor eax, esp
mov dword [esp + 0x2cc], eax
cmp byte [0x884bd1], 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, edx
jne 0x42615e
mov edx, ecx
lea ecx, [esp + 0xc]
call fcn.004099e8
push 0x4010
push 0x160
lea ecx, [esp + 0x20]
or esi, 0x80
push ecx
push esi
push dword [eax]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
push dword [esp + 0xc]
mov esi, eax
call fcn.004377b3
pop ecx
mov eax, esi
jmp 0x426180
mov eax, dword [0x884d0c]
test eax, eax
je 0x426180
push 0x4010
push 0x2b4
lea edx, [esp + 0x20]
or esi, 0x80
push edx
push esi
push ecx
call eax
mov ecx, dword [esp + 0x1c]
mov dword [edi], ecx
mov ecx, dword [esp + 0x2d4]
pop edi
pop esi
xor ecx, esp
call fcn.004377a2
mov esp, ebp
pop ebp
ret 4

Function at 0x426406
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x168
mov eax, dword [0x459008]
xor eax, esp
mov dword [esp + 0x164], eax
test cl, cl
mov edx, 0x4011
mov eax, 0x4110
cmovne eax, edx
push eax
push 0x160
lea eax, [esp + 8]
push eax
push 0x90
push 0x44e81c
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov ecx, dword [esp + 0x164]
xor ecx, esp
call fcn.004377a2
mov esp, ebp
pop ebp
ret
Function at 0x427885
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x268
mov eax, 0x448524
call fcn.00444f9d
mov dword [ebp - 0x274], ecx
push 0x208
xor ebx, ebx
lea eax, [ebp - 0x238]
push ebx
push eax
call fcn.00438c60
add esp, 0xc
lea eax, [ebp - 0x238]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocStringLen
lea eax, [ebp - 0x238]
mov dword [ebp - 0x270], ebx
xorps xmm0, xmm0
push eax
movlpd qword [ebp - 0x260], xmm0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
lea ecx, [ebp - 0x258]
mov dword [ebp - 0x254], eax
push ecx
push eax
mov dword [ebp - 0x258], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x427925
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x427925
mov edi, dword [ebp - 0x260]
jmp 0x427937
mov eax, dword [ebp - 0x258]
xor edi, edi
add edi, esi
adc eax, ebx
mov dword [ebp - 0x25c], eax
lea eax, [edi + 0x80]
push eax
lea ecx, [ebp - 0x260]
call fcn.00419380
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x270]
mov ebx, dword [ebp - 0x260]
push 0
push eax
push edi
lea esi, [ebx + 0x80]
push esi
push dword [ebp - 0x254]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x8831a8]
mov ecx, ebx
mov dword [ebx], eax
call fcn.004080a6
push edi
mov edx, esi
call fcn.004084ee
push 7
mov byte [ebp - 0x30], 0
lea edi, [ebp - 0x2f]
xor eax, eax
lea edx, [ebp - 0x30]
pop ecx
rep stosd dword es:[edi], eax
mov ecx, ebx
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00408579
xor eax, eax
lea ecx, [ebp - 0x26c]
mov byte [ebp - 0x254], al
push dword [ebp - 0x254]
mov dword [ebp - 0x26c], eax
mov dword [ebp - 0x268], eax
mov dword [ebp - 0x264], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.004374c5
mov byte [ebp - 4], 1
push dword [ebp - 0x25c]
push 0
push ebx
call fcn.00438c60
add esp, 0xc
lea edx, [ebp - 0x26c]
lea ecx, [ebp - 0x250]
call fcn.00427801
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], 0x10
jb 0x427a05
mov eax, dword [eax]
push 0x40
push eax
push dword [ebp - 0x274]
call fcn.004386e0
add esp, 0xc
push 0
push 1
lea ecx, [ebp - 0x250]
mov byte [ebp - 4], 3
call fcn.00436f84
mov ecx, dword [ebp - 0x26c]
test ecx, ecx
je 0x427a42
mov edx, dword [ebp - 0x264]
sub edx, ecx
push 1
call fcn.00427284
mov dword [ebp - 4], 4
push dword [ebx - 4]
call fcn.0043d421
pop ecx
call fcn.00444f47
ret
Function at 0x4370d3
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
xor edx, edx
movzx eax, byte [edx + edi]
xor eax, esi
imul esi, eax, 0x1000193
inc edx
cmp edx, 2
jb 0x4370e2
mov eax, dword [ecx + 0x18]
pop edi
and eax, esi
pop esi
pop ebp
ret 4
Function at 0x401fa0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
xor ecx, ecx
test esi, esi
je 0x401fcb
mov edx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x401fb4
pop edi
mov eax, edx
pop esi
pop ebp
ret
mov eax, dword [ebp + 8]
pop esi
pop ebp
ret
Function at 0x405590
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e4ace
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x68e500]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], 0
xorps xmm0, xmm0
mov edi, dword [ebp + 8]
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov eax, dword [ebp + 0x10]
xor esi, esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 1
test eax, eax
je 0x40575f
mov ecx, dword [ebp + 0xc]
dec eax
mov dword [ebp + 0x10], eax
mov al, byte [ecx]
inc ecx
mov byte [ebp + esi - 0x14], al
inc esi
mov ah, byte [ebp - 0x12]
mov dl, byte [ebp - 0x13]
mov dh, byte [ebp - 0x14]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0xf], ah
mov byte [ebp - 0xd], dl
mov byte [ebp - 0xe], dh
cmp esi, 3
jne 0x405695
mov al, dh
mov cl, dh
shr al, 2
and cl, 3
mov byte [ebp - 0x18], al
mov al, dl
shl cl, 4
shr al, 4
add cl, al
mov al, ah
mov byte [ebp - 0x17], cl
and ah, 0x3f
mov cl, dl
shr al, 6
and cl, 0xf
mov byte [ebp - 0x15], ah
shl cl, 2
add cl, al
xor esi, esi
mov byte [ebp - 0x16], cl
nop
cmp dword [0x693518], 0xf
mov ecx, 0x693504
movzx eax, byte [ebp + esi - 0x18]
cmova ecx, dword [0x693504]
movzx eax, byte [eax + ecx]
mov ecx, edi
push eax
call fcn.00409a30
inc esi
cmp esi, 4
jl 0x405660
mov ecx, dword [ebp + 0xc]
xor esi, esi
mov dl, byte [ebp - 0xd]
mov dh, byte [ebp - 0xe]
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x405604
mov dword [ebp + 0xc], esi
test esi, esi
je 0x40575f
mov eax, esi
cmp esi, 3
jge 0x4056d1
cmp eax, 3
jae 0x405774
mov byte [ebp + eax - 0x14], 0
inc eax
cmp eax, 3
jl 0x4056b5
mov cl, byte [ebp - 0x12]
mov dl, byte [ebp - 0x13]
mov dh, byte [ebp - 0x14]
jmp 0x4056d4
mov cl, byte [ebp - 0xf]
mov al, dh
and dh, 3
shr al, 2
mov byte [ebp - 0x18], al
mov al, dl
shr al, 4
and dl, 0xf
shl dh, 4
add dh, al
shl dl, 2
mov al, cl
mov byte [ebp - 0x17], dh
shr al, 6
and cl, 0x3f
add dl, al
mov byte [ebp - 0x15], cl
lea eax, [esi + 1]
mov byte [ebp - 0x16], dl
mov dword [ebp + 0x10], eax
test eax, eax
jle 0x40573d
xor esi, esi
nop
cmp dword [0x693518], 0xf
mov ecx, 0x693504
movzx eax, byte [ebp + esi - 0x18]
cmova ecx, dword [0x693504]
movzx eax, byte [eax + ecx]
mov ecx, edi
push eax
call fcn.00409a30
inc esi
cmp esi, dword [ebp + 0x10]
jl 0x405710
mov esi, dword [ebp + 0xc]
cmp esi, 3
jge 0x40575f
mov eax, 3
sub eax, esi
mov dword [ebp + 0xc], eax
nop dword [eax]
push 0x3d
mov ecx, edi
call fcn.00409a30
sub dword [ebp + 0xc], 1
jne 0x405750
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
call fcn.005aa668
int3
Function at 0x40bea0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x40bed1
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x40bec0
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x4499e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e9c88
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x68e500]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [ebp - 4], 0
xorps xmm0, xmm0
mov dword [edi + 8], 0
movups xmmword [edi + 0xc], xmm0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0xf
mov byte [edi + 0xc], 0
lea esi, [edi + 0x24]
mov byte [ebp - 4], 1
push 0x40
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.005aa743
xorps xmm0, xmm0
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov eax, edi
movups xmmword [edi + 0x2c], xmm0
movq qword [edi + 0x3c], xmm0
mov dword [edi + 0x44], 0
movups xmmword [edi + 0x30], xmm0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0xf
mov byte [edi + 0x30], 0
mov dword [edi + 0x2c], vtable.cpr::Url.0
movsd qword [edi + 0x48], xmm0
mov byte [edi + 0x50], 1
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
movups xmmword [edi + 0x60], xmm0
movq qword [edi + 0x70], xmm0
mov dword [edi + 0x78], 0
mov dword [edi + 0x60], 0
movups xmmword [edi + 0x64], xmm0
mov dword [edi + 0x74], 0
mov dword [edi + 0x78], 0xf
mov byte [edi + 0x64], 0
movups xmmword [edi + 0x7c], xmm0
mov dword [edi + 0x8c], 0
mov dword [edi + 0x90], 0xf
mov byte [edi + 0x7c], 0
movups xmmword [edi + 0x94], xmm0
mov dword [edi + 0xa4], 0
mov dword [edi + 0xa8], 0xf
mov byte [edi + 0x94], 0
movups xmmword [edi + 0xac], xmm0
mov dword [edi + 0xbc], 0
mov dword [edi + 0xc0], 0xf
mov byte [edi + 0xac], 0
mov dword [edi + 0xc8], 0
mov dword [edi + 0xcc], 0
mov dword [edi + 0xd0], 0
mov dword [edi + 0xd4], 0
mov dword [edi + 0xd8], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44ecc0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e9fc5
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x68e500]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x693178
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x34]
push eax
push 0x6931a0
push 0x6931b4
lea eax, [ebp - 0x70]
mov dword [ebp - 0x48], 2
push eax
push 7
push 2
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x70], 0
push eax
push 0
push 0
push 1
xorps xmm0, xmm0
mov dword [ebp - 0x6c], 0
push 0
movlpd qword [ebp - 0x5c], xmm0
mov dword [ebp - 0x60], 0x1c
mov dword [ebp - 0x68], 0x3c
mov dword [ebp - 0x64], 1
mov dword [ebp - 0x38], 2
mov dword [ebp - 0x4c], 0x20
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x54], 1
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x1c], 0xb000
mov dword [ebp - 0x18], 0xa000
call dword [sym.imp.d3d11.dll_D3D11CreateDeviceAndSwapChain]
test eax, eax
jne 0x44eeb1
call fcn.0044f390
test al, al
je 0x44eeb1
push esi
call fcn.0044f400
call fcn.004220f0
cmp byte [0x693313], 0
je 0x44edc9
sub esp, 0x18
mov ecx, esp
push 0x69329c
call fcn.00409c90
call fcn.004227d0
add esp, 0x18
lea ecx, [ebp - 0x88]
call fcn.00423370
push eax
mov ecx, edi
call fcn.00409bc0
mov ecx, dword [ebp - 0x74]
cmp ecx, 0xf
jbe 0x44ee13
mov edx, dword [ebp - 0x88]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x44ee09
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44eed0
push ecx
push edx
call fcn.005aacb2
add esp, 8
push 4
call fcn.005aa743
add esp, 4
mov dword [ebp - 0x20], eax
mov dword [eax], 0x423750
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
push ecx
push 0
push eax
push 0x465070
push 0
push 0
call fcn.005b193f
add esp, 0x18
mov dword [ebp - 0x30], eax
test eax, eax
je 0x44eee8
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 1
call fcn.0041d880
push 4
call fcn.005aa743
add esp, 4
mov dword [ebp - 0x20], eax
mov dword [eax], 0x431390
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 2
push ecx
push 0
push eax
push 0x465070
push 0
push 0
call fcn.005b193f
add esp, 0x18
mov dword [ebp - 0x28], eax
test eax, eax
je 0x44eeda
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.0041d880
cmp dword [ebp - 0x24], 0
jne 0x44eed5
cmp dword [ebp - 0x2c], 0
jne 0x44eed5
mov al, 1
jmp 0x44eeb3
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005aa453
mov esp, ebp
pop ebp
ret 4
call fcn.005b110a
call fcn.005b8bf4
push 6
mov dword [ebp - 0x24], 0
call fcn.0059750b
push 6
mov dword [ebp - 0x2c], 0
call fcn.0059750b
int3
Function at 0x451270
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x4512a2
jl 0x451295
test ecx, ecx
jne 0x4512a2
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x451362
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.00454640
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x45130e
jg 0x4512cd
test esi, esi
je 0x45130e
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x4512e5
mov eax, dword [esp + 0x10]
jl 0x4512df
cmp eax, esi
jae 0x4512e5
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.005ac620
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x45132f
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x45134b
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x4512b4
jl 0x45134b
test ecx, ecx
jne 0x4512b4
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov esi, dword [ebp + 0x10]
sbb esi, edx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
lea esi, [ebx + 0x2c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x4513a0
mov eax, dword [esi]
mov eax, dword [eax]
test eax, eax
je 0x4513a0
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push dword [esp + 0x14]
call fcn.005ac620
mov eax, dword [ebx + 0x2c]
sub edi, esi
add dword [esp + 0x18], esi
add esp, 0xc
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
lea esi, [ebx + 0x2c]
cmp dword [ebx + 0x4c], 0
je 0x451409
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x4513c6
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
cmp edi, 0xfff
jbe 0x4513f4
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.005b9bc8
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x451409
cmp edi, eax
ja 0x4513d2
test edi, edi
je 0x451409
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.005b9bc8
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x454db0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e5b60
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x68e500]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.005aa743
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.00596017
add esp, 8
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.00454d50
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret