joyce8/EMBER2024-capa huggingface dataset:
Function at 0x447e7d
Capabilities:
Shutdown system

Disassembly:
push 8
mov eax, 0x4766ea
call fcn.00472e78
mov ebx, edx
mov edi, ecx
and dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0x13
test edi, edi
je 0x447eb5
cmp edi, 1
je 0x447eb5
cmp edi, 2
je 0x447eb5
cmp edi, 3
je 0x447eb5
mov esi, 0x80070057
jmp 0x447f4a
push 1
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
call fcn.00424bc3
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
js 0x447f4a
test edi, edi
je 0x447f0a
cmp edi, 1
je 0x447f0a
cmp edi, 2
je 0x447edf
cmp edi, 3
jne 0x447f51
xor eax, eax
cmp edi, 2
setne al
inc eax
push eax
call dword [sym.imp.ntdll.dll_NtShutdownSystem]
test eax, eax
jne 0x447ef7
xor esi, esi
jmp 0x447f51
lea edx, [ebp - 0x10]
mov ecx, eax
call fcn.00427484
mov esi, dword [ebp - 0x10]
test eax, eax
je 0x447f4a
jmp 0x447f51
test ebx, ebx
jne 0x447f13
mov ebx, 0x80030002
mov ecx, 0x4119d4
test edi, edi
je 0x447f21
mov ecx, 0x411a00
xor eax, eax
test edi, edi
push ebx
sete al
push eax
push 1
push 0
push ecx
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownExW]
test eax, eax
jne 0x447f51
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.0042754e
mov esi, eax
mov ecx, esi
call fcn.00427566
mov ecx, esi
call fcn.0042757e
and dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004276f7
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.004276f7
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.00472e55
ret

Function at 0x44939b
Capabilities:
Print debug messages

Disassembly:
push 0xc
mov eax, 0x476745
call fcn.00472e78
mov dword [ebp - 0x18], edx
mov ebx, ecx
xor edi, edi
xor esi, esi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x4493ce
xor ecx, ecx
xor ebx, ebx
call fcn.00427566
jmp 0x449475
sub ebx, 1
je 0x4493fe
sub ebx, 1
je 0x4493f7
sub ebx, 1
je 0x4493f0
sub ebx, 1
je 0x4493e9
mov esi, 0x411a90
jmp 0x449403
mov esi, 0x411a84
jmp 0x449403
mov esi, 0x411a74
jmp 0x449403
mov esi, 0x411a68
jmp 0x449403
mov esi, 0x411a5c
lea ecx, [ebp - 0x14]
call fcn.004260fd
mov edi, dword [ebp - 0x14]
push dword [ebp - 0x18]
push esi
test eax, eax
js 0x449441
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push edi
lea eax, [ebp - 0x10]
push 0x411aa0
push eax
call fcn.00416afb
mov ebx, eax
add esp, 0x18
test ebx, ebx
jns 0x44946b
mov ecx, ebx
call fcn.00427566
mov esi, dword [ebp - 0x10]
jmp 0x449475
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
lea eax, [ebp - 0x10]
push 0x411ae0
push eax
call fcn.00416afb
mov ebx, eax
add esp, 0x14
test ebx, ebx
jns 0x44946b
mov ecx, ebx
call fcn.00427566
mov edi, dword [ebp - 0x14]
jmp 0x44943c
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, ebx
call fcn.0042757e
and dword [ebp - 4], 0
test esi, esi
je 0x44948b
mov ecx, esi
call fcn.00427347
mov dword [ebp - 4], 1
test edi, edi
je 0x44949d
mov ecx, edi
call fcn.00427347
or dword [ebp - 4], 0xffffffff
mov eax, ebx
call fcn.00472e55
ret
Function at 0x44a0e0
Capabilities:
Hash data using sha1

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x47bfec], 0
push ebx
jne 0x44a15f
push eax
push ebx
push ecx
push edx
xor eax, eax
cpuid
xor eax, eax
xor ebx, 0x756e6547
sete al
xor ebx, ebx
xor ecx, 0x6c65746e
sete bl
and eax, ebx
xor ecx, ecx
xor edx, 0x49656e69
sete cl
and eax, ecx
mov dword [ebp - 4], eax
mov eax, 1
cpuid
xor ecx, ecx
xor edx, edx
mov ebx, 0xff0
and ebx, eax
mov dword [ebp - 8], ebx
pop edx
pop ecx
pop ebx
pop eax
cmp dword [ebp - 4], 0
mov ecx, 1
je 0x44a153
cmp dword [ebp - 8], 0x660
sbb eax, eax
not eax
and ecx, eax
mov eax, dword [ecx*4 + 0x401b10]
mov dword [0x47bfec], eax
mov eax, dword [ebp + 8]
pop ebx
mov dword [eax + 0x54], 0
mov dword [eax + 0x58], 0
mov dword [eax + 0x40], 0x67452301
mov dword [eax + 0x44], 0xefcdab89
mov dword [eax + 0x48], 0x98badcfe
mov dword [eax + 0x4c], 0x10325476
mov dword [eax + 0x50], 0xc3d2e1f0
mov esp, ebp
pop ebp
ret 4

Function at 0x44b04f
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
xor esi, esi
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x44b072
test al, 0x10
jne 0x44b119
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x44b119
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x44b097
xor esi, esi
jmp 0x44b119
movzx eax, word [edi]
mov ecx, edi
push ebx
xor ebx, ebx
test ax, ax
je 0x44b113
push 0x5c
mov edx, eax
pop edi
cmp dx, di
jne 0x44b0b0
mov ebx, ecx
add ecx, 2
movzx eax, word [ecx]
mov edx, eax
test ax, ax
jne 0x44b0a9
mov edi, dword [ebp - 4]
test ebx, ebx
je 0x44b113
xor eax, eax
xor edx, edx
mov ecx, edi
mov word [ebx], ax
call fcn.0044b04f
mov esi, eax
push 0x5c
pop eax
mov word [ebx], ax
test esi, esi
js 0x44b118
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x44b10f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0xb7
jne 0x44b100
xor esi, esi
inc esi
jmp 0x44b118
test esi, esi
jle 0x44b118
movzx esi, si
or esi, 0x80070000
jmp 0x44b118
xor esi, esi
jmp 0x44b118
mov esi, 0x80070003
pop ebx
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x44b9c5
Capabilities:
Hash data via bcrypt
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x479b74]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
push edi
push 8
mov ebx, ecx
lea edi, [esp + 0x28]
pop ecx
xor esi, esi
xor eax, eax
push 0xa00000
rep stosd dword es:[edi], eax
push esi
mov dword [esp + 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x44ba14
mov esi, 0x8007000e
jmp 0x44bb58
push ecx
call fcn.0044b635
push esi
push esi
push esi
push esi
push esi
lea ecx, [esp + 0x24]
push ecx
push eax
call dword [sym.imp.bcrypt.dll_BCryptCreateHash]
test eax, eax
jns 0x44ba34
push 7
pop ecx
int 0x29
mov eax, dword [ebx + 0x10]
push ecx
mov ecx, dword [ebx]
push dword [eax + 0xc]
push dword [eax + 8]
call fcn.0045c36c
mov esi, eax
test esi, esi
js 0x44bb58
mov ecx, dword [ebx + 0x10]
xor edx, edx
and dword [esp + 0x18], edx
mov dword [esp + 0x1c], edx
mov eax, dword [ecx + 0x10]
sub eax, edx
mov dword [esp + 0x20], eax
mov eax, dword [ecx + 0x14]
sbb eax, dword [esp + 0x18]
test eax, eax
jb 0x44ba83
ja 0x44ba7c
cmp dword [esp + 0x20], 0xa00000
jbe 0x44ba83
mov eax, 0xa00000
jmp 0x44ba88
mov eax, dword [ecx + 0x10]
sub eax, edx
and dword [esp + 0x14], 0
lea ecx, [esp + 0x14]
push 0
push ecx
push eax
push edi
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x44bb3a
push 0
push dword [esp + 0x18]
push edi
push dword [esp + 0x1c]
call dword [sym.imp.bcrypt.dll_BCryptHashData]
test eax, eax
jns 0x44bac0
push 7
pop ecx
int 0x29
mov edx, dword [esp + 0x1c]
add edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov ecx, dword [ebx + 0x10]
adc eax, 0
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], eax
cmp eax, dword [ecx + 0x14]
ja 0x44baee
jb 0x44ba5c
cmp edx, dword [ecx + 0x10]
jb 0x44ba5c
push 0
push 0x20
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x1c]
call dword [sym.imp.bcrypt.dll_BCryptFinishHash]
test eax, eax
jns 0x44bb0a
push 7
pop ecx
int 0x29
push dword [esp + 0x10]
call dword [sym.imp.bcrypt.dll_BCryptDestroyHash]
and dword [esp + 0x10], 0
xor ecx, ecx
mov edx, dword [ebx + 0x10]
lea ebx, [esp + 0x24]
mov eax, dword [edx + ecx*4 + 0x18]
cmp eax, dword [ebx + ecx*4]
jne 0x44bb33
inc ecx
cmp ecx, 8
jne 0x44bb22
jmp 0x44bb6e
mov esi, 0x80004005
jmp 0x44bb6e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x44bb51
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x44bb58
mov esi, 0x80004005
cmp dword [esp + 0x10], 0
je 0x44bb6e
push dword [esp + 0x10]
call dword [sym.imp.bcrypt.dll_BCryptDestroyHash]
and dword [esp + 0x10], 0
test edi, edi
je 0x44bb82
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [esp + 0x44]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004729c0
mov esp, ebp
pop ebp
ret 4
Function at 0x44bf3c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
xor eax, eax
mov ebx, ecx
push edi
push ecx
push eax
mov ecx, dword [ebx]
mov edi, eax
push eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], eax
call fcn.0045c36c
mov esi, eax
test esi, esi
js 0x44c0b8
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
test edi, edi
jne 0x44bfa2
mov esi, 0x20000
push esi
push 8
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x44bfc5
mov esi, 0x8007000e
jmp 0x44c0b8
mov eax, dword [ebp - 0x10]
mov esi, eax
push eax
push edi
push 0
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
test eax, eax
je 0x44c096
mov edi, eax
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
and dword [ebp - 0x18], 0
push 0
push eax
mov eax, esi
sub eax, ecx
push eax
lea eax, [ecx + edi]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x44c076
lea eax, [ebp - 0x14]
mov edx, esi
push eax
lea eax, [ebp - 0xc]
mov ecx, edi
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0044c0bf
mov esi, eax
cmp esi, 0x8007007a
je 0x44bf70
test esi, esi
js 0x44c09b
push dword [ebp - 0xc]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebx + 8], eax
test eax, eax
je 0x44c096
mov eax, dword [ebp - 4]
push dword [eax + 0x1c]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebx + 0xc], eax
test eax, eax
je 0x44c096
push dword [ebp - 0xc]
push dword [ebp - 4]
push dword [ebx + 8]
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 4]
add esp, 0xc
push dword [eax + 0x1c]
push dword [ebp - 0x14]
push dword [ebx + 0xc]
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x44c09b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x44c08d
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x44c09b
mov esi, 0x80004005
jmp 0x44c09b
mov esi, 0x8007000e
test edi, edi
je 0x44c0b8
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
jne 0x44c0b8
call fcn.0044b60f
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x44c0bf
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, edx
xor esi, esi
mov edx, ecx
mov dword [edi], esi
cmp ebx, 0x40
jae 0x44c0ea
mov dword [edi], 0x138
mov esi, 0x8007007a
jmp 0x44c1d4
mov eax, 0x5a4d
cmp ax, word [edx]
jne 0x44c1cf
mov ecx, dword [edx + 0x3c]
cmp ebx, ecx
jae 0x44c109
lea eax, [ecx + 0xf8]
mov dword [edi], eax
jmp 0x44c0e0
lea eax, [ecx + edx]
cmp dword [eax], 0x4550
jne 0x44c1cf
movzx edi, word [eax + 6]
mov dword [ebp - 4], edi
movzx edi, word [eax + 0x14]
imul eax, dword [ebp - 4], 0x28
add eax, 0x18
add eax, edi
mov edi, dword [ebp + 8]
add eax, ecx
cmp ebx, eax
jb 0x44c105
lea eax, [ecx + edx]
movzx edi, word [eax + 0x14]
lea ecx, [eax + 0x18]
add ecx, edi
mov eax, esi
mov dword [ebp - 8], ecx
cmp dword [ebp - 4], eax
jbe 0x44c1cf
cmp dword [ecx], 0x786f622e
jne 0x44c160
cmp dword [ecx + 4], 0x64616f6c
je 0x44c169
inc eax
add ecx, 0x28
cmp eax, dword [ebp - 4]
jb 0x44c14f
cmp dword [ebp - 4], eax
jbe 0x44c1cf
imul ecx, eax, 0x28
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], ecx
mov edi, dword [ecx + eax + 0x14]
mov eax, dword [ecx + eax + 0x10]
mov ecx, edi
add eax, ecx
mov dword [ebp - 4], edi
mov edi, dword [ebp + 8]
cmp ebx, eax
jb 0x44c105
add ecx, edx
cmp dword [ecx], 0xb0c50002
jne 0x44c1cf
mov eax, dword [ecx + 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0x1c]
add eax, dword [ecx + 0x20]
cmp ebx, eax
jb 0x44c105
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov ecx, dword [eax + ecx + 8]
mov eax, dword [ebp + 0x10]
mov dword [eax], ecx
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 4]
add ecx, edx
mov dword [eax], ecx
jmp 0x44c1d4
mov esi, 0x8007000d
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x10
Function at 0x44c1dd
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x274
mov eax, dword [0x479b74]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
or dword [ebp - 0x264], 0xffffffff
push ebx
mov dword [ebp - 0x268], eax
xor ebx, ebx
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x270], edx
inc eax
push edi
lea edx, [ebp - 0x260]
mov dword [ebp - 0x26c], eax
mov dword [ebp - 0x260], ebx
mov dword [ebp - 0x25c], ebx
call fcn.0045c253
mov esi, eax
test esi, esi
js 0x44c3c1
mov edx, dword [ebp - 0x260]
lea ecx, [ebp - 0x25c]
push ebx
call fcn.0044b169
mov esi, eax
test esi, esi
js 0x44c3b0
push ebx
mov edx, 0x411c64
lea ecx, [ebp - 0x25c]
call fcn.0044b2b9
mov esi, eax
test esi, esi
js 0x44c3b0
mov edi, dword [ebp - 0x25c]
lea eax, [ebp - 0x258]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x44c2a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x44c2a1
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x44c3b6
test byte [ebp - 0x258], 0x10
jne 0x44c33b
mov edx, dword [ebp - 0x268]
xor eax, eax
add eax, dword [ebp - 0x238]
mov ecx, dword [ebp - 0x23c]
adc ecx, 0
mov edx, dword [edx + 0x10]
cmp eax, dword [edx + 0x10]
jne 0x44c33b
cmp ecx, dword [edx + 0x14]
jne 0x44c33b
mov edx, dword [ebp - 0x260]
lea ecx, [ebp - 0x25c]
push 0
call fcn.0044b169
mov esi, eax
test esi, esi
js 0x44c383
push 0
lea edx, [ebp - 0x22c]
lea ecx, [ebp - 0x25c]
call fcn.0044b2b9
mov esi, eax
test esi, esi
js 0x44c383
mov ecx, dword [ebp - 0x270]
lea eax, [ebp - 0x264]
mov edi, dword [ebp - 0x25c]
push eax
lea eax, [ebp - 0x26c]
mov edx, dword [ecx]
push eax
lea eax, [ecx + 4]
mov ecx, edi
push eax
call fcn.0044c3e8
mov esi, eax
test esi, esi
jns 0x44c363
lea eax, [ebp - 0x258]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x44c2a7
mov eax, dword [ebp - 0x264]
cmp eax, 0xffffffff
jne 0x44c38b
mov esi, 0x80070002
jmp 0x44c3a2
mov ecx, dword [ebp - 0x268]
mov edx, edi
push 0
lea ecx, [ecx + 4]
call fcn.0044b169
mov esi, eax
test esi, esi
jns 0x44c351
mov eax, dword [ebp - 0x264]
jmp 0x44c396
mov edi, dword [ebp - 0x25c]
jmp 0x44c37b
mov ecx, dword [ebp - 0x268]
mov dword [ecx], eax
or eax, 0xffffffff
cmp eax, 0xffffffff
je 0x44c3a2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 0xffffffff
je 0x44c3b6
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x44c3b6
mov edi, dword [ebp - 0x25c]
test edi, edi
je 0x44c3c1
mov ecx, edi
call fcn.0044b47d
cmp dword [ebp - 0x260], 0
je 0x44c3d5
mov ecx, dword [ebp - 0x260]
call fcn.0044b47d
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004729c0
leave
ret 8
Function at 0x44c3e8
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x479b74]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor esi, esi
mov dword [ebp - 0x30], edx
push esi
push 0x80
push 3
push esi
push 7
push SysReAllocString
push ecx
mov dword [ebp - 0x34], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x44c450
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x44c440
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x44c508
mov esi, 0x80004005
jmp 0x44c508
push esi
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], esi
push eax
push 0x24
lea eax, [ebp - 0x28]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x44c489
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x44c480
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x44c4fc
mov esi, 0x80004005
jmp 0x44c4fc
cmp dword [ebp - 0x2c], 0x24
je 0x44c496
mov esi, 0x8007001e
jmp 0x44c4fc
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x30]
cmp ecx, eax
je 0x44c4c0
test ecx, ecx
jne 0x44c4b9
cmp eax, 0xb0c50000
je 0x44c4c0
cmp eax, 0xb0c50001
je 0x44c4c0
cmp eax, 0xb0c50002
je 0x44c4c0
mov esi, 0x8007000d
jmp 0x44c4fc
mov edx, dword [ebp + 8]
test edx, edx
je 0x44c4dd
mov ecx, esi
mov eax, dword [edx + ecx*4]
lea edx, [ebp - 0x24]
cmp eax, dword [edx + ecx*4]
mov edx, dword [ebp + 8]
jne 0x44c4b9
inc ecx
cmp ecx, 4
jne 0x44c4c9
test ebx, ebx
je 0x44c4f4
mov eax, dword [ebx]
cmp eax, 0xffffffff
jne 0x44c4ef
mov eax, dword [ebp - 0x14]
mov dword [ebx], eax
jmp 0x44c4f4
cmp eax, dword [ebp - 0x14]
jne 0x44c4b9
mov eax, dword [ebp - 0x34]
mov dword [eax], edi
or edi, 0xffffffff
cmp edi, 0xffffffff
je 0x44c508
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004729c0
leave
ret 0xc
Function at 0x44c51b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x479b74]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x2c], 0
push ebx
push esi
push edi
mov edi, ecx
push ecx
mov dword [ebp - 0x34], edi
mov eax, dword [edi + 0x10]
mov ecx, dword [edi]
push dword [eax + 0xc]
push dword [eax + 8]
call fcn.0045c36c
mov ebx, eax
test ebx, ebx
js 0x44c658
push 0
lea eax, [ebp - 0x2c]
push eax
push 0x24
pop esi
push esi
lea eax, [ebp - 0x28]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x44c595
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x44c585
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0x44c658
mov ebx, 0x80004005
jmp 0x44c658
cmp dword [ebp - 0x2c], esi
je 0x44c5a4
mov ebx, 0x8007001e
jmp 0x44c658
push dword [ebp - 0x10]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [ebp - 0x30], edx
test edx, edx
jne 0x44c5c9
mov ebx, 0x8007000e
jmp 0x44c658
push 9
pop ecx
lea esi, [ebp - 0x28]
mov edi, edx
rep movsd dword es:[edi], dword [esi]
and dword [ebp - 0x2c], 0
mov edi, dword [ebp - 0x34]
push 0x24
pop esi
push 0
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x10]
sub eax, esi
push eax
lea eax, [esi + edx]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x44c61a
add esi, dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0
mov edx, dword [ebp - 0x30]
jne 0x44c5dd
mov eax, edx
cmp esi, dword [ebp - 0x10]
je 0x44c613
mov ebx, 0x8007001e
jmp 0x44c63b
mov dword [edi + 0x14], eax
xor eax, eax
jmp 0x44c63b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x44c631
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
mov eax, dword [ebp - 0x30]
js 0x44c63b
mov ebx, 0x80004005
test eax, eax
je 0x44c658
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
jne 0x44c658
call fcn.0044b60f
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004729c0
leave
ret
Function at 0x44c80c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0xc], ecx
push 0xa00000
push eax
mov edi, edx
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x18], eax
test eax, eax
jne 0x44c848
mov esi, 0x8007000e
jmp 0x44c9e4
mov ecx, dword [ebp + 8]
lea edx, [ebp - 4]
call fcn.0045c253
mov esi, eax
test esi, esi
js 0x44c9c4
mov ecx, dword [ebp - 4]
call fcn.0044b04f
mov esi, eax
test esi, esi
js 0x44c9c4
push 0
push 0x8000080
push 2
push 0
push 5
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x44c8b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x44c8a8
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x44c9c4
mov esi, 0x80004005
jmp 0x44c9c4
push ecx
push dword [edi + 0x24]
mov ecx, ebx
push dword [edi + 0x20]
call fcn.0045c36c
mov esi, eax
test esi, esi
js 0x44c9bd
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x44c99f
xor eax, eax
push eax
push eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x44c99f
mov edx, dword [ebp - 0xc]
push ecx
mov eax, dword [edx + 0x10]
mov ecx, dword [eax + 8]
add ecx, dword [edi + 0x18]
mov eax, dword [eax + 0xc]
adc eax, dword [edi + 0x1c]
push eax
push ecx
mov ecx, dword [edx]
call fcn.0045c36c
mov esi, eax
test esi, esi
js 0x44c9bd
mov eax, dword [edi + 0x20]
xor edx, edx
mov ecx, dword [edi + 0x24]
xor esi, esi
sub eax, edx
sbb ecx, esi
test ecx, ecx
jb 0x44c93c
ja 0x44c935
cmp eax, 0xa00000
jbe 0x44c93c
mov eax, 0xa00000
jmp 0x44c942
mov eax, dword [edi + 0x20]
sub eax, dword [ebp - 8]
mov esi, dword [ebp - 0x18]
lea ecx, [ebp - 0x10]
and dword [ebp - 0x10], 0
push 0
push ecx
push eax
mov eax, dword [ebp - 0xc]
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x44c99f
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
mov edx, esi
mov ecx, ebx
call fcn.0045c3a9
mov esi, eax
test esi, esi
js 0x44c9bd
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x14]
and dword [ebp - 0x14], 0
mov edx, eax
mov ecx, dword [edi + 0x24]
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x20]
cmp dword [ebp - 0x14], ecx
ja 0x44c9bd
jb 0x44c99a
cmp edx, eax
jae 0x44c9bd
mov esi, dword [ebp - 0x14]
jmp 0x44c924
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x44c9b6
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x44c9bd
mov esi, 0x80004005
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x18]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 4], 0
je 0x44c9e4
mov ecx, dword [ebp - 4]
call fcn.0044b47d
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc