joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44b340
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x4fd5c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x44b374
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x44b374
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [ebx]
test ax, ax
je 0x44b438
push esi
mov esi, ebx
mov ecx, ebx
cmp ax, 0x2f
je 0x44b391
cmp ax, 0x5c
jne 0x44b393
mov esi, ecx
movzx eax, word [ecx + 2]
add ecx, 2
test ax, ax
jne 0x44b385
cmp esi, ebx
je 0x44b3df
sub esi, ebx
lea eax, [ebp - 0x414]
and esi, 0xfffffffe
push esi
push ebx
push eax
call fcn.004a2e10
add esp, 0xc
cmp esi, 0x208
jae 0x44b448
xor eax, eax
mov word [ebp + esi - 0x414], ax
lea eax, [ebp - 0x414]
push eax
push edi
call fcn.0044b340
add esp, 8
xor eax, eax
mov word [ebp - 0x20c], ax
pop esi
test edi, edi
je 0x44b402
push edi
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004aabf5
add esp, 0xc
push ebx
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004b3e9b
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x44b438
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004a10e1
mov esp, ebp
pop ebp
ret
call fcn.004a16c4
int3

Function at 0x44bbc0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x44bc8a
cmp dword [esi + 4], 0xffffffff
jne 0x44bc8a
push edi
lea edi, [esi + 0x244]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44bbf1
sub ecx, edx
sar ecx, 1
movzx eax, word [esi + ecx*2 + 0x242]
cmp eax, 0x5c
je 0x44bc25
cmp eax, 0x2f
je 0x44bc25
push 0x4d0dd4
push 0x104
push edi
call fcn.004b3e9b
add esp, 0xc
mov edi, dword [ebp + 0x10]
cmp edi, 1
jne 0x44bc4b
push edi
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x44bc4b
pop edi
mov eax, 0x2000000
pop esi
pop ebp
ret 0xc
lea eax, [ebp + 0x10]
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0044e860
add esp, 0x10
test eax, eax
jne 0x44bc6b
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebp
ret 0xc
push eax
call fcn.0044ef80
add esp, 4
mov dword [esi], eax
xor ecx, ecx
mov edx, 0x200
test eax, eax
cmove ecx, edx
pop edi
mov eax, ecx
pop esi
pop ebp
ret 0xc
mov eax, 0x1000000
pop esi
pop ebp
ret 0xc
Function at 0x44c310
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
movsx eax, byte [ebp + 0xc]
mov ecx, dword [edx]
xor eax, ecx
movzx eax, al
shr ecx, 8
mov eax, dword [eax*4 + 0x4d96a8]
xor eax, ecx
mov ecx, dword [edx + 8]
mov dword [edx], eax
movzx eax, al
add eax, dword [edx + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4d96a8]
mov dword [edx + 8], ecx
pop ebp
ret
Function at 0x44e990
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, ebx
imul esi, dword [ebp + 0x10]
cmp byte [edi], 0
je 0x44e9ce
push 0
lea eax, [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x44e9c2
mov byte [edi + 8], 1
mov eax, dword [ebp + 0xc]
xor edx, edx
pop edi
pop esi
div ebx
pop ebx
pop ebp
ret
mov edx, dword [edi + 0x1c]
mov ecx, dword [edi + 0x18]
lea eax, [edx + esi]
cmp eax, ecx
jbe 0x44e9df
mov esi, ecx
sub esi, edx
mov ecx, dword [edi + 0x14]
push esi
add ecx, edx
push ecx
push dword [ebp + 8]
call fcn.004a2e10
add dword [edi + 0x1c], esi
add esp, 0xc
mov eax, esi
xor edx, edx
div ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x44ea60
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x44ea6e
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
not eax
cmp esi, 8
jb 0x44eb2d
push edi
mov edi, esi
shr edi, 3
movzx ecx, byte [edx]
sub esi, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4d96a8]
movzx ecx, byte [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4d96a8]
movzx ecx, byte [edx + 2]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4d96a8]
movzx ecx, byte [edx + 3]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4d96a8]
movzx ecx, byte [edx + 4]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4d96a8]
movzx ecx, byte [edx + 5]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4d96a8]
movzx ecx, byte [edx + 6]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4d96a8]
movzx ecx, byte [edx + 7]
add edx, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4d96a8]
sub edi, 1
jne 0x44ea86
pop edi
test esi, esi
je 0x44eb4b
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4d96a8]
sub esi, 1
jne 0x44eb31
not eax
pop esi
pop ebp
ret

Function at 0x44fbe0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov dl, byte [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 8]
mov ecx, esi
and ecx, 0xfffd
or ecx, 2
mov eax, ecx
xor eax, 1
imul eax, ecx
mov ecx, dword [edi]
shr eax, 8
xor dl, al
movsx eax, dl
xor eax, ecx
shr ecx, 8
movzx eax, al
mov eax, dword [eax*4 + 0x4d96a8]
xor eax, ecx
mov dword [edi], eax
movzx eax, al
add eax, dword [edi + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [edi + 4], eax
shr eax, 0x18
xor eax, esi
shr esi, 8
movzx ecx, al
mov al, dl
xor esi, dword [ecx*4 + 0x4d96a8]
mov dword [edi + 8], esi
pop edi
pop esi
pop ebp
ret
Function at 0x455290
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cdb93
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4fd5c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.00422720
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 1
mov dword [esi + 0x28], 0
lea ecx, [esi + 0x4c]
mov dword [esi], vtable.duImageStyle.0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 8
mov dword [ebp - 4], 0
jb 0x455356
mov eax, dword [ecx]
jmp 0x455358
mov eax, ecx
xor edx, edx
push edx
push 0x4d0900
mov word [eax], dx
call fcn.004033f0
xor eax, eax
mov dword [esi + 0x78], 7
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 1
mov dword [ecx + 0x10], 0
push eax
push 0x4d0900
mov word [ecx], ax
call fcn.004033f0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4553a0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cdbb8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4fd5c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.00422720
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 1
mov dword [esi + 0x28], 0
xor eax, eax
mov dword [esi], vtable.duLineStyle.0
lea ecx, [esi + 0x34]
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 1
push eax
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x4d0900
mov dword [ebp - 4], 0
mov word [ecx], ax
call fcn.004033f0
push 0
push 0
lea ecx, [esi + 0x4c]
call fcn.00420c70
push 0
push 0
lea ecx, [esi + 0x54]
call fcn.00420c70
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x455470
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cdbb8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4fd5c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.00422720
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 1
mov dword [esi + 0x28], 0
xor eax, eax
mov dword [esi], vtable.duRectStyle.0
lea ecx, [esi + 0x40]
mov dword [esi + 0x2c], 0xffffff
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 1
push eax
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x4d0900
mov dword [ebp - 4], 0
mov word [ecx], ax
call fcn.004033f0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x455540
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cdbfe
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4fd5c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.00422720
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 1
mov dword [esi + 0x28], 0
lea ecx, [esi + 0x34]
mov dword [esi], vtable.duTextStyle.0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 1
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 8
mov dword [ebp - 4], 0
jb 0x4555dc
mov eax, dword [ecx]
jmp 0x4555de
mov eax, ecx
xor edx, edx
push edx
push 0x4d0900
mov word [eax], dx
call fcn.004033f0
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 1
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 8
jb 0x45560d
mov eax, dword [ecx]
jmp 0x45560f
mov eax, ecx
xor edx, edx
push edx
push 0x4d0900
mov word [eax], dx
call fcn.004033f0
xor eax, eax
mov dword [esi + 0x78], 7
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 2
mov dword [ecx + 0x10], 0
push eax
push 0x4d0900
mov word [ecx], ax
call fcn.004033f0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x456700
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cdc2c
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4fd5c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push ebx
push edi
call fcn.00456b30
push str.left_part
push ebx
call fcn.00421cd0
push str.top_part
push ebx
mov dword [edi + 0x2c], eax
call fcn.00421cd0
push str.right_part
push ebx
mov dword [edi + 0x34], eax
call fcn.00421cd0
push str.bottom_part
push ebx
mov dword [edi + 0x30], eax
call fcn.00421cd0
push str.selectleft
push ebx
mov dword [edi + 0x38], eax
call fcn.00421cd0
push str.selecttop
push ebx
mov dword [edi + 0x3c], eax
call fcn.00421cd0
push str.selectwidth
push ebx
mov dword [edi + 0x40], eax
call fcn.00421cd0
push str.selectheight
push ebx
mov dword [edi + 0x44], eax
call fcn.00421cd0
add esp, 0x40
mov dword [edi + 0x48], eax
lea eax, [ebp - 0x28]
push str.picfile
push ebx
push eax
call fcn.00421ee0
mov ecx, eax
lea esi, [edi + 0x4c]
add esp, 0xc
mov dword [ebp - 0x44], ecx
cmp esi, ecx
je 0x456806
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x4567df
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.004034f0
mov ecx, dword [ebp - 0x44]
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x4567f7
mov eax, dword [esi]
jmp 0x4567f9
mov eax, esi
xor edx, edx
push ecx
mov ecx, esi
mov word [eax], dx
call fcn.00402e40
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
cmp eax, 8
jb 0x456822
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.004034f0
push str.paintmode
lea eax, [ebp - 0x40]
push ebx
push eax
call fcn.00421ee0
add esp, 0xc
lea esi, [edi + 0x64]
mov ebx, eax
cmp esi, ebx
je 0x456877
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x456850
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.004034f0
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x456868
mov eax, dword [esi]
jmp 0x45686a
mov eax, esi
xor ecx, ecx
mov word [eax], cx
mov ecx, esi
push ebx
call fcn.00402e40
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x45688c
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.004034f0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a10e1
mov esp, ebp
pop ebp
ret 8
Function at 0x456bd0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cdca2
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4fd5c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push ebx
push edi
call fcn.00456b30
push str.textcolor
push ebx
call fcn.00421c60
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x30]
push eax
push str.bsingleline
push ebx
call fcn.00421c00
push str.font
lea eax, [ebp - 0x28]
push ebx
push eax
call fcn.00421ee0
mov ecx, eax
lea esi, [edi + 0x34]
add esp, 0x20
mov dword [ebp - 0x44], ecx
cmp esi, ecx
je 0x456c80
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x456c59
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.004034f0
mov ecx, dword [ebp - 0x44]
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x456c71
mov eax, dword [esi]
jmp 0x456c73
mov eax, esi
xor edx, edx
push ecx
mov ecx, esi
mov word [eax], dx
call fcn.00402e40
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
cmp eax, 8
jb 0x456c9c
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.004034f0
push str.halign
lea eax, [ebp - 0x28]
push ebx
push eax
call fcn.00421ee0
mov ecx, eax
lea esi, [edi + 0x4c]
add esp, 0xc
mov dword [ebp - 0x44], ecx
cmp esi, ecx
je 0x456cf7
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x456cd0
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.004034f0
mov ecx, dword [ebp - 0x44]
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x456ce8
mov eax, dword [esi]
jmp 0x456cea
mov eax, esi
xor edx, edx
push ecx
mov ecx, esi
mov word [eax], dx
call fcn.00402e40
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
cmp eax, 8
jb 0x456d13
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.004034f0
push str.valign
lea eax, [ebp - 0x40]
push ebx
push eax
call fcn.00421ee0
add esp, 0xc
lea esi, [edi + 0x64]
mov ebx, eax
cmp esi, ebx
je 0x456d68
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x456d41
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.004034f0
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x456d59
mov eax, dword [esi]
jmp 0x456d5b
mov eax, esi
xor ecx, ecx
mov word [eax], cx
mov ecx, esi
push ebx
call fcn.00402e40
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x456d7d
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.004034f0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a10e1
mov esp, ebp
pop ebp
ret 8
Function at 0x457f10
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x458045
cmp word [esi], 0
je 0x458045
mov ecx, dword [ebp + 8]
call fcn.00457a10
push 0
push 0
push 3
push 0
push 7
push accept
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x458045
test esi, esi
je 0x458045
push ebx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
test ebx, ebx
je 0x458034
push edi
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
mov dword [ebp + 0xc], 0
lea eax, [ebp + 0xc]
push eax
push 0
push edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
cmp dword [ebp + 0xc], 0
jne 0x457fae
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 0
lea ecx, [ebp - 4]
mov dword [ebp - 4], 0
push ecx
push ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x45800b
mov ecx, dword [ebp + 8]
push dword [ebp + 0xc]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x40]
test eax, eax
je 0x45800b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop ebx
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x4589b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4fd5c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x458a2f
cmp eax, 0x104
ja 0x458a2f
push esi
push 0
push 0x4da7f4
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x458a2f
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
xor ecx, ecx
cmp eax, 0xffffffff
pop esi
cmove eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a10e1
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.004a10e1
mov esp, ebp
pop ebp
ret 4
Function at 0x458b20
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4fd5c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
test ebx, ebx
je 0x458c11
cmp dword [ebp + 0x10], 0
jle 0x458c11
mov eax, dword [esi + 0x210]
test eax, eax
je 0x458b68
push eax
call dword [sym.imp.USER32.dll_DestroyCursor]
mov dword [esi + 0x210], 0
push edi
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.004589b0
mov edi, eax
test edi, edi
je 0x458bfc
push 0
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0
push eax
push dword [ebp + 0x10]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
test eax, eax
je 0x458be9
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x50
push 0
push 0
push 2
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.USER32.dll_LoadImageW]
mov dword [esi + 0x210], eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esi + 0x210]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a10e1
mov esp, ebp
pop ebp
ret 0xc
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a10e1
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.004a10e1
mov esp, ebp
pop ebp
ret 0xc

Function at 0x467670
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x4fd5c0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x4676c3
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x4676bd
shr eax, 8
cmp al, 2
jne 0x4676bd
call fcn.0046bb30
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a10e1
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [ebp - 4]
mov eax, 2
xor ecx, ebp
call fcn.004a10e1
mov esp, ebp
pop ebp
ret

Function at 0x46c450
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x46c46e
cmp dword [esi + 0x48], 0
je 0x46c46e
push 2
push 3
push esi
call fcn.004805c0
add esp, 0xc
push dword [ebp + 0xc]
call fcn.00477af0
add esp, 4
test esi, esi
je 0x46c48e
cmp dword [esi + 0x48], 0
je 0x46c48e
push 3
push esi
call fcn.00480600
add esp, 8
pop esi
pop ebp
ret