joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44a400
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x1020
call fcn.004b63b0
mov eax, dword [0x78e580]
xor eax, esp
mov dword [esp + 0x101c], eax
mov eax, dword [esp + 0x1024]
push ebx
push ebp
mov ebp, dword [esp + 0x1030]
xor ebx, ebx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x1034]
push esi
mov dword [esp + 0x24], eax
xor esi, esi
mov eax, dword [esp + 0x103c]
push edi
mov dword [esp + 0x24], eax
xor edi, edi
mov eax, dword [esp + 0x1044]
push ebp
mov dword [esp + 0x1c], eax
call fcn.004ca943
pop ecx
jmp 0x44a510
push ebp
push 0x1000
lea eax, [esp + 0x34]
push 1
push eax
call fcn.004bd0d6
add esp, 0x10
mov dword [esp + 0x10], eax
call fcn.004bb8cc
mov ecx, dword [esp + 0x10]
mov eax, dword [eax]
mov dword [esp + 0x20], eax
or eax, 0xffffffff
sub eax, ecx
cmp esi, eax
ja 0x44a5ce
lea eax, [ecx + esi]
mov dword [esp + 0x1c], eax
cmp eax, edi
jb 0x44a4e1
test ebx, ebx
je 0x44a4b5
cmp edi, 0x7fffffff
ja 0x44a5ce
add edi, edi
jmp 0x44a4c4
lea eax, [ecx + 1]
mov ecx, 0x1000
cmp eax, ecx
mov edi, ecx
cmovb edi, eax
push edi
push ebx
call fcn.00441e99
pop ecx
pop ecx
test eax, eax
je 0x44a562
mov ebx, eax
mov ecx, dword [esp + 0x10]
cmp dword [esp + 0x1c], edi
jae 0x44a4a1
push ebp
call fcn.004ca96f
pop ecx
test eax, eax
jne 0x44a59f
mov eax, dword [esp + 0x10]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esi + ebx]
push eax
call fcn.004b8970
mov esi, dword [esp + 0x28]
push ebp
call fcn.004ca943
add esp, 0x10
test eax, eax
je 0x44a461
push ebp
call fcn.004bcd32
pop ecx
test edi, edi
jne 0x44a532
push 1
push 1
call fcn.00441e16
pop ecx
pop ecx
mov ebx, eax
xor esi, esi
mov eax, dword [esp + 0x24]
mov byte [esi + ebx], 0
test eax, eax
je 0x44a540
mov dword [eax], esi
mov ecx, dword [esp + 0x28]
xor eax, eax
inc eax
mov dword [ecx], ebx
mov ecx, dword [esp + 0x102c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004b5ec4
add esp, 0x1020
ret
push dword [esp + 0x14]
call fcn.00458495
pop ecx
mov esi, eax
push esi
push edi
push edi
push str.Could_not_allocate__lu_bytes_to_read_file__s
push str.Could_not_allocate__lu_byte_to_read_file__s
push str.glib20
call fcn.00451b36
add esp, 0x10
push eax
push 0xd
call fcn.00449b7d
push eax
push dword [esp + 0x2c]
call fcn.004418a5
add esp, 0x18
jmp 0x44a5fb
push dword [esp + 0x14]
call fcn.00458495
mov edi, dword [esp + 0x24]
mov esi, eax
push edi
call fcn.00447d32
pop ecx
pop ecx
push eax
push esi
push str.Error_reading_file__s:__s
call fcn.00451b5b
pop ecx
push eax
push edi
call fcn.00449a7e
pop ecx
push eax
jmp 0x44a58b
push dword [esp + 0x14]
call fcn.00458495
pop ecx
mov esi, eax
push esi
push str.File__s_is_too_large
call fcn.00451b5b
pop ecx
push eax
push 0x18
call fcn.00449b7d
push eax
push dword [esp + 0x28]
call fcn.004418a5
add esp, 0x14
push esi
call fcn.00441dce
push ebx
call fcn.00441dce
push ebp
call fcn.004bcd32
add esp, 0xc
xor eax, eax
jmp 0x44a549

Function at 0x44b172
Capabilities:
Hash data using djb2

Disassembly:
mov edx, dword [esp + 4]
mov ecx, 0x1505
jmp 0x44b186
imul ecx, ecx, 0x21
movsx eax, al
add ecx, eax
inc edx
mov al, byte [edx]
test al, al
jne 0x44b17d
mov eax, ecx
ret
Function at 0x44d068
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, dword [edi]
test esi, esi
jne 0x44d0e0
push 0x78fe7c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [edi]
test esi, esi
jne 0x44d0d5
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esi, eax
xor ebp, ebp
test esi, esi
jne 0x44d0a3
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push ebp
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsFree]
cmp esi, 0xffffffff
je 0x44d0ce
test esi, esi
je 0x44d0ce
push edi
push dword [0x78fe78]
call fcn.0046835a
push esi
push ebp
push edi
mov dword [0x78fe78], eax
call fcn.0044131a
add esp, 0x14
test eax, eax
je 0x44d0e6
jmp 0x44d0d5
push 0x52a764
jmp 0x44d0eb
push 0x78fe7c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebp
ret
push str.g_private_get_impl_2_
push ebp
call fcn.0044d372
int3

Function at 0x44d0f2
Capabilities:
Set thread local storage value

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 4], 0
je 0x441c7b
call fcn.00441d18
cmp dword [esp + 0xc], 0
mov eax, dword [eax + 0x24]
je 0x441c72
push dword [esp + 0xc]
push esi
push eax
call fcn.0044aa72
add esp, 0xc
pop esi
ret
push esi
push eax
call fcn.0044ade6
pop ecx
pop ecx
pop esi
ret
push dword [esp + 8]
push dword [esp + 8]
call fcn.0044d068
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x441c48
Function at 0x44d226
Capabilities:
Create thread
Resume thread

Disassembly:
push ecx
push ebx
push ebp
push edi
push 0x34
call fcn.00446395
mov ecx, dword [esp + 0x18]
mov edi, eax
push dword [esp + 0x24]
xor eax, eax
xor ebp, ebp
inc eax
mov dword [edi + 0x14], eax
mov dword [edi + 8], eax
mov eax, dword [esp + 0x2c]
mov dword [edi], eax
mov eax, dword [esp + 0x30]
mov dword [edi + 0x2c], ecx
mov dword [edi + 0x30], ebp
mov dword [edi + 0x10], 2
mov dword [edi + 4], eax
call fcn.00447c7a
push ebp
push ebp
mov dword [edi + 0x18], eax
call fcn.0044ad70
mov dword [edi + 0x24], eax
lea eax, [esp + 0x1c]
push eax
push 4
push edi
push 0x44d4e0
push dword [esp + 0x38]
push ebp
call fcn.004caaf7
add esp, 0x28
mov dword [edi + 0x30], eax
test eax, eax
jne 0x44d29a
mov ebx, str.Error_creating_thread
jmp 0x44d2e9
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x44d2a6
mov eax, dword [eax]
jmp 0x44d2b3
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
cmp eax, 0x7fffffff
jne 0x44d2c1
mov ebx, str.Error_getting_current_thread_priority
jmp 0x44d2e9
push eax
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
jne 0x44d2d6
mov ebx, str.Error_setting_new_thread_priority
jmp 0x44d2e9
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x44d33f
mov ebx, str.Error_resuming_new_thread
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0045621f
pop ecx
mov esi, eax
push esi
push ebx
push str._s:__s
push ebp
call fcn.00441a43
push eax
push dword [esp + 0x44]
call fcn.004418a5
push esi
call fcn.00441dce
add esp, 0x1c
pop esi
cmp dword [edi + 0x30], ebp
je 0x44d328
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [edi + 0x24]
call fcn.0044b111
push edi
push 0x34
call fcn.004463df
add esp, 0xc
xor eax, eax
jmp 0x44d341
mov eax, edi
pop edi
pop ebp
pop ebx
pop ecx
ret
Function at 0x44d3e4
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
lea eax, [ebp - 0x34]
push esi
push edi
push 0x34
push 0
push eax
call fcn.004b6f20
add esp, 0xc
push str.KERNEL32.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x44d4da
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.InitializeSRWLock
push esi
call edi
mov dword [ebp - 0x34], eax
test eax, eax
je 0x44d4da
push str.AcquireSRWLockExclusive
push esi
call edi
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x44d4da
push str.TryAcquireSRWLockExclusive
push esi
call edi
mov dword [ebp - 0x28], eax
test eax, eax
je 0x44d4da
push str.ReleaseSRWLockExclusive
push esi
call edi
mov dword [ebp - 0x24], eax
test eax, eax
je 0x44d4da
push str.AcquireSRWLockShared
push esi
call edi
mov dword [ebp - 0x20], eax
test eax, eax
je 0x44d4da
push str.TryAcquireSRWLockShared
push esi
call edi
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x44d4da
push str.ReleaseSRWLockShared
push esi
call edi
mov dword [ebp - 0x18], eax
test eax, eax
je 0x44d4da
push str.InitializeConditionVariable
push esi
call edi
mov dword [ebp - 0x14], eax
test eax, eax
je 0x44d4da
push str.SleepConditionVariableSRW
push esi
call edi
mov dword [ebp - 0xc], eax
test eax, eax
je 0x44d4da
push str.WakeAllConditionVariable
push esi
call edi
mov dword [ebp - 8], eax
test eax, eax
je 0x44d4da
push str.WakeConditionVariable
push esi
call edi
mov dword [ebp - 4], eax
test eax, eax
je 0x44d4da
push 0xd
pop ecx
lea esi, [ebp - 0x34]
mov edi, 0x78fe2c
xor eax, eax
rep movsd dword es:[edi], dword [esi]
inc eax
jmp 0x44d4dc
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x44d740
Capabilities:
Query environment variable

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
xor eax, eax
push eax
push eax
push eax
push 0xffffffffffffffff
push dword [esp + 0x28]
call fcn.0044bdbd
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
add esp, 0x14
mov ebx, eax
lea eax, [esp + 0x10]
push 2
pop esi
push esi
push eax
push ebx
call ebp
mov edi, eax
test edi, edi
jne 0x44d7a4
push ebx
call fcn.00441dce
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
jne 0x44d78d
xor eax, eax
jmp 0x44d851
push 0x4ff5cd
call fcn.004413b4
push eax
call fcn.004413f1
pop ecx
pop ecx
jmp 0x44d851
cmp edi, 1
push esi
cmove edi, esi
push edi
call fcn.00441e16
pop ecx
pop ecx
push edi
mov esi, eax
push esi
push ebx
call ebp
lea ecx, [edi - 1]
cmp eax, ecx
je 0x44d7d1
push ebx
call fcn.00441dce
push esi
call fcn.00441dce
pop ecx
pop ecx
jmp 0x44d786
push 0x25
push esi
call fcn.004b944e
pop ecx
pop ecx
test eax, eax
je 0x44d81f
push 2
lea eax, [esp + 0x14]
mov edi, esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebp, eax
test ebp, ebp
je 0x44d81f
push 2
push ebp
call fcn.00441e16
pop ecx
pop ecx
push ebp
mov esi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, ebp
je 0x44d818
push esi
call fcn.00441dce
mov esi, edi
jmp 0x44d81e
push edi
call fcn.00441dce
pop ecx
xor eax, eax
push eax
push eax
push eax
push 0xffffffffffffffff
push esi
call fcn.0044b6eb
push ebx
mov edi, eax
call fcn.00441dce
push esi
call fcn.00441dce
push edi
call fcn.004413c2
push edi
mov esi, eax
call fcn.00441dce
push esi
call fcn.004413f1
add esp, 0x28
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x4554b4
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ecx
push esi
lea eax, [esp + 8]
xor esi, esi
push eax
push 1
push esi
push str.SYSTEMCurrentControlSetControlTimeZoneInformation
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x455543
push ebp
lea eax, [esp + 8]
mov dword [esp + 8], esi
push eax
push esi
push esi
push esi
mov ebp, str.TimeZoneKeyName
push ebp
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x455538
push edi
push dword [esp + 0xc]
call fcn.00441ddc
mov edi, eax
pop ecx
test edi, edi
je 0x455530
lea eax, [esp + 0xc]
push eax
push edi
push esi
push esi
push ebp
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x455530
push esi
push esi
push esi
push 0xffffffffffffffff
push edi
call fcn.0044b6eb
add esp, 0x14
mov esi, eax
jmp 0x455537
push edi
call fcn.00441dce
pop ecx
pop edi
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
mov eax, esi
pop esi
pop ecx
pop ecx
ret

Function at 0x45589a
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov edx, dword [esp + 4]
push edi
mov edi, dword [edx + 0x9c0]
cmp edi, 0x270
jb 0x45594a
push ebx
xor edi, edi
mov ebx, closesocket
push esi
mov esi, edi
mov ecx, dword [edx + esi*4 + 4]
xor ecx, dword [edx + esi*4]
and ecx, ebx
xor ecx, dword [edx + esi*4]
mov eax, ecx
shr ecx, 1
and eax, 1
xor ecx, dword [eax*4 + 0x52b1b4]
xor ecx, dword [edx + esi*4 + 0x634]
mov dword [edx + esi*4], ecx
inc esi
cmp esi, 0xe3
jl 0x4558bc
mov ecx, dword [edx + esi*4 + 4]
xor ecx, dword [edx + esi*4]
and ecx, ebx
xor ecx, dword [edx + esi*4]
mov eax, ecx
shr ecx, 1
and eax, 1
xor ecx, dword [eax*4 + 0x52b1b4]
xor ecx, dword [edx + esi*4 - 0x38c]
mov dword [edx + esi*4], ecx
inc esi
cmp esi, 0x26f
jl 0x4558e9
mov ecx, dword [edx + 0x9bc]
xor ecx, dword [edx]
and ecx, ebx
xor ecx, dword [edx + 0x9bc]
mov eax, ecx
shr ecx, 1
and eax, 1
pop esi
pop ebx
mov eax, dword [eax*4 + 0x52b1b4]
xor eax, dword [edx + 0x630]
xor eax, ecx
mov dword [edx + 0x9bc], eax
mov dword [edx + 0x9c0], edi
mov ecx, dword [edx + edi*4]
lea eax, [edi + 1]
mov dword [edx + 0x9c0], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop edi
ret
Function at 0x455aba
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, dword [esp + 0xc]
call fcn.00455c33
mov edx, dword [esp + 8]
sub eax, 0x14
je 0x455b04
xor ecx, ecx
mov dword [edx], esi
inc ecx
mov dword [edx + 0x9c0], ecx
mov eax, dword [edx + ecx*4 - 4]
shr eax, 0x1e
xor eax, dword [edx + ecx*4 - 4]
imul eax, eax, 0x6c078965
add eax, ecx
mov dword [edx + ecx*4], eax
inc dword [edx + 0x9c0]
mov ecx, dword [edx + 0x9c0]
cmp ecx, 0x270
jb 0x455ad8
pop esi
ret
test esi, esi
mov eax, 0x6b842128
cmovne eax, esi
xor ecx, ecx
inc ecx
mov dword [edx], eax
mov dword [edx + 0x9c0], ecx
imul eax, dword [edx + ecx*4 - 4], 0x10dcd
mov dword [edx + ecx*4], eax
inc dword [edx + 0x9c0]
mov ecx, dword [edx + 0x9c0]
cmp ecx, 0x270
jb 0x455b19
pop esi
ret

Function at 0x456473
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x2c
mov eax, dword [0x78e580]
xor eax, esp
mov dword [esp + 0x28], eax
push ebp
push esi
xor ebp, ebp
push str.LC_ALL
mov esi, ebp
call fcn.0044d740
pop ecx
test eax, eax
je 0x45649b
cmp byte [eax], 0
jne 0x4564c3
push str.LC_MESSAGES
call fcn.0044d740
pop ecx
test eax, eax
je 0x4564af
cmp byte [eax], 0
jne 0x4564c3
push str.LANG
call fcn.0044d740
pop ecx
test eax, eax
je 0x4564cf
cmp byte [eax], 0
je 0x4564cf
push eax
call fcn.00447c7a
pop ecx
jmp 0x456597
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov edi, eax
push 0x14
lea eax, [esp + 0x14]
push eax
push 0x59
push edi
call ebx
test eax, eax
je 0x45658a
push 0x14
lea eax, [esp + 0x28]
push eax
push 0x5a
push edi
call ebx
test eax, eax
je 0x45658a
movzx ecx, di
mov eax, ecx
and ecx, 0x3ff
shr eax, 0xa
cmp ecx, 0x1a
je 0x456535
cmp ecx, 0x2c
je 0x456524
cmp ecx, 0x43
jne 0x456545
sub eax, 1
je 0x456540
sub eax, 1
jne 0x456545
mov esi, str._Cyrl
jmp 0x456545
dec eax
sub eax, 1
je 0x456540
sub eax, 4
jne 0x456545
mov esi, str._Latn
push ebp
push ebp
push ebp
lea eax, [esp + 0x1c]
push 0xffffffffffffffff
push eax
call fcn.0044b6eb
push ebp
push ebp
push ebp
mov ebx, eax
lea eax, [esp + 0x44]
push 0xffffffffffffffff
push eax
call fcn.0044b6eb
push ebp
push esi
mov edi, eax
push edi
push 0x501a1c
push ebx
call fcn.00447c0a
push edi
mov esi, eax
call fcn.00441dce
add esp, 0x40
push ebx
call fcn.00441dce
mov eax, esi
jmp 0x456594
push 0x52ae14
call fcn.00447c7a
pop ecx
pop edi
pop ebx
mov ecx, dword [esp + 0x30]
pop esi
pop ebp
xor ecx, esp
call fcn.004b5ec4
add esp, 0x2c
ret
Function at 0x456b0f
Capabilities:
Read file via mapping

Disassembly:
sub esp, 0x50
mov eax, dword [0x78e580]
xor eax, esp
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x58]
push ebx
mov ebx, dword [esp + 0x60]
push ebp
mov ebp, dword [esp + 0x5c]
push esi
push edi
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x70]
push 0x14
mov dword [esp + 0x24], eax
call fcn.00446395
mov edi, eax
xor eax, eax
inc eax
mov dword [edi + 0xc], eax
lea eax, [esp + 0x28]
push eax
push ebp
mov dword [edi + 8], fcn.00456a18
call fcn.004cb85a
add esp, 0xc
cmp eax, 0xffffffff
jne 0x456b8c
call fcn.004bb8cc
mov ebp, dword [eax]
test ebx, ebx
je 0x456b78
push ebx
call fcn.00458495
pop ecx
mov esi, eax
jmp 0x456b7a
xor esi, esi
push ebp
call fcn.00447d32
mov dword [esp], str.Failed_to_get_attributes_of_file__s_s_s_s:_fstat___failed:__s
jmp 0x456c4d
mov eax, dword [esp + 0x3c]
or eax, dword [esp + 0x40]
jne 0x456bc5
mov eax, dword [esp + 0x2a]
mov ecx, 0x8000
and eax, 0xf000
cmp ax, cx
jne 0x456bc5
xor esi, esi
mov dword [edi + 4], esi
mov dword [edi], esi
mov eax, edi
mov ecx, dword [esp + 0x5c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004b5ec4
add esp, 0x50
ret
or dword [edi], 0xffffffff
xor esi, esi
mov eax, dword [esp + 0x3c]
cmp dword [esp + 0x10], esi
push esi
push esi
push esi
push 2
mov dword [edi + 4], eax
pop eax
push 8
pop ecx
cmovne eax, ecx
push eax
push esi
push ebp
call fcn.004c2526
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ecx, eax
mov dword [edi + 0x10], ecx
test ecx, ecx
je 0x456c27
cmp dword [esp + 0x10], esi
push esi
push esi
push esi
push 4
pop eax
push 1
pop edx
cmovne eax, edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [edi], eax
test eax, eax
jne 0x456c27
push dword [edi + 0x10]
or dword [edi], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x10], esi
cmp dword [edi], 0xffffffff
jne 0x456bb0
call fcn.004bb8cc
mov ebp, dword [eax]
test ebx, ebx
je 0x456c40
push ebx
call fcn.00458495
pop ecx
mov esi, eax
push ebp
call fcn.00447d32
mov dword [esp], str.Failed_to_map__s_s_s_s:_mmap___failed:__s
mov dword [esp + 0x14], eax
call fcn.00451b5b
push ebp
mov dword [esp + 0x1c], eax
call fcn.00449a7e
pop ecx
pop ecx
mov dword [esp + 0x18], eax
call fcn.00449b7d
mov ebp, 0x4ff5cd
mov dword [esp + 0x1c], eax
test esi, esi
mov eax, ebp
mov edx, 0x52b3a4
mov ecx, 0x507b28
mov ebx, 0x4fe7d0
cmovne eax, esi
cmove edx, ebp
cmovne ecx, esi
cmove ebx, ebp
push dword [esp + 0x10]
push ebx
push eax
push edx
push ecx
push dword [esp + 0x28]
push dword [esp + 0x30]
push dword [esp + 0x38]
push dword [esp + 0x40]
call fcn.004418a5
push esi
call fcn.00441dce
push edi
push 0x14
call fcn.004463df
add esp, 0x30
xor eax, eax
jmp 0x456bb2
Function at 0x4571d9
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test eax, eax
jne 0x457209
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.004bb8cc
push esi
mov ecx, eax
call fcn.00457c01
add esp, 4
mov dword [ecx], eax
or eax, 0xffffffff
jmp 0x457286
test eax, 0x400
jne 0x45721d
call fcn.004bb8cc
mov dword [eax], 0x16
jmp 0x457204
push edi
push 0
and eax, 0x10
shl eax, 0x15
or eax, 0x200080
push eax
push 3
push 0
push 7
push 8
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x457262
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.004bb8cc
push esi
mov ecx, eax
call fcn.00457c01
add esp, 4
mov dword [ecx], eax
or eax, edi
jmp 0x457285
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.00457074
add esp, 0x18
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebp
ret
Function at 0x45735b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x88
mov eax, dword [0x78e580]
xor eax, esp
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x90]
push ebx
mov ebx, dword [esp + 0x90]
push ebp
push esi
mov esi, dword [esp + 0xa0]
push edi
xor edi, edi
mov dword [esp + 0x18], ebx
push ebx
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x4573ce
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.004bb8cc
push esi
mov ecx, eax
call fcn.00457c01
add esp, 4
mov dword [ecx], eax
or eax, 0xffffffff
jmp 0x4574cd
mov edx, 0x80
test esi, esi
je 0x4573e5
test ebp, 0x400
mov eax, 0x200080
cmovne edx, eax
mov ecx, edx
mov eax, ebp
push edi
or ecx, 0x2000000
test al, 0x10
cmove ecx, edx
push ecx
push 3
push edi
push 7
push 0x88
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4573ac
lea eax, [esp + 0x60]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x1c], eax
test esi, esi
jne 0x45743f
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.004bb8cc
push dword [esp + 0x1c]
jmp 0x4573ba
mov esi, dword [esp + 0x18]
test ebp, 0x400
je 0x457490
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x10]
xor edx, edx
test ecx, ecx
push 1
cmovne eax, edx
push eax
push edi
push edi
lea eax, [esp + 0x24]
push eax
xor eax, eax
test ecx, ecx
cmovne eax, ebx
test ecx, ecx
push eax
mov eax, esi
cmovne eax, edx
push eax
call fcn.0045717f
add esp, 0x1c
test eax, eax
jns 0x45748c
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4573c6
mov edi, dword [esp + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x64]
push eax
push dword [esp + 0x18]
push esi
call fcn.00456e94
push dword [esp + 0x20]
call fcn.00441dce
push dword [esp + 0x38]
lea eax, [esp + 0x78]
push edi
push eax
lea eax, [esp + 0x48]
push eax
call fcn.00456ddf
add esp, 0x24
xor eax, eax
mov ecx, dword [esp + 0x94]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004b5ec4
add esp, 0x88
ret

Function at 0x4578a2
Capabilities:
Create directory

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push 0xffffffffffffffff
push dword [esp + 0x18]
call fcn.0044bdbd
mov ebx, eax
add esp, 0x14
test ebx, ebx
jne 0x4578cc
call fcn.004bb8cc
pop ebx
mov dword [eax], 0x16
or eax, 0xffffffff
ret
push esi
push edi
push ebx
call fcn.004cbc0a
mov edi, eax
call fcn.004bb8cc
push ebx
mov esi, dword [eax]
call fcn.00441dce
pop ecx
pop ecx
call fcn.004bb8cc
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x4579a9
Capabilities:
Move file

Disassembly:
push ebx
push esi
push edi
xor esi, esi
or edi, 0xffffffff
push esi
push esi
push esi
push edi
push dword [esp + 0x20]
call fcn.0044bdbd
mov ebx, eax
add esp, 0x14
test ebx, ebx
jne 0x4579d4
call fcn.004bb8cc
mov dword [eax], 0x16
jmp 0x457a38
push ebp
push esi
push esi
push esi
push edi
push dword [esp + 0x28]
call fcn.0044bdbd
mov ebp, eax
add esp, 0x14
test ebp, ebp
jne 0x4579ff
push ebx
call fcn.00441dce
pop ecx
call fcn.004bb8cc
mov dword [eax], 0x16
jmp 0x457a37
push 1
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x457a11
mov edi, esi
jmp 0x457a22
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00457c01
add esp, 4
mov esi, eax
push ebx
call fcn.00441dce
push ebp
call fcn.00441dce
pop ecx
pop ecx
call fcn.004bb8cc
mov dword [eax], esi
pop ebp
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x45a35b
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x78e580]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x790128
push esi
call fcn.0044196b
pop ecx
test eax, eax
je 0x45a40a
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x20c], 0x101
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x45a3cb
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x208]
push 0xffffffffffffffff
push eax
call fcn.0044b6eb
push eax
mov dword [0x79012c], eax
call fcn.00447c7a
add esp, 0x18
mov dword [0x790130], eax
cmp dword [0x79012c], 0
jne 0x45a3e4
push str.somebody
call fcn.00447c7a
pop ecx
mov dword [0x79012c], eax
cmp dword [0x790130], 0
jne 0x45a3fd
push str.Unknown
call fcn.00447c7a
pop ecx
mov dword [0x790130], eax
push 0x79012c
push esi
call fcn.004419e4
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov eax, dword [0x790128]
xor ecx, ebp
pop esi
call fcn.004b5ec4
leave
ret

Function at 0x45a49a
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x78e580]
xor eax, ebp
mov dword [ebp + 0x190], eax
push esi
lea eax, [ebp - 0x80]
xor esi, esi
push eax
push dword [ebp + 0x19c]
mov dword [ebp - 0x80], esi
push esi
call sub.SHELL32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x45a4fc
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0x80]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x45a4f3
push esi
push esi
push esi
lea eax, [ebp - 0x7c]
push 0xffffffffffffffff
push eax
call fcn.0044b6eb
add esp, 0x14
mov esi, eax
push dword [ebp - 0x80]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [ebp + 0x190]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004b5ec4
add ebp, 0x194
leave
ret