joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43432a
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
sub esp, 0x200
lea ebp, [esp - 4]
mov eax, dword [0x4db020]
xor eax, ebp
mov dword [ebp + 0x200], eax
push 0x18
mov eax, 0x4a78fb
call fcn.004674a0
mov eax, dword [ebp + 0x20c]
xor esi, esi
mov edi, ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], esi
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
lea ecx, [ebp - 0x14]
call fcn.00401470
mov ebx, eax
cmp ebx, esi
je 0x4343b2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00401420
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x200]
xor ecx, ebp
call fcn.00467491
add ebp, 0x204
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x4343ca
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x14]
call fcn.0043432a
cmp eax, esi
jne 0x4343fd
lea eax, [ebp - 0x24]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp]
push eax
push esi
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 0x100
call ebx
test eax, eax
je 0x4343ba
lea ecx, [ebp - 0x14]
call fcn.00401420
push dword [ebp - 0x1c]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00401420
mov eax, esi
jmp 0x43438d
Function at 0x4376e8
Capabilities:
Get file size

Disassembly:
push ebp
sub esp, 0x30
push 0x58
mov eax, 0x4a8384
call fcn.004674a0
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 4], ebx
je 0x437747
mov eax, dword [ebp + 0x3c]
cmp eax, ebx
je 0x43770a
mov dword [eax], ebx
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
call dword [eax + 0x18]
mov edi, eax
cmp edi, 0xffffffff
jne 0x437791
xor edi, edi
inc edi
push edi
add esi, 0xc
push esi
lea ecx, [ebp]
call fcn.004372c5
mov dword [ebp - 4], ebx
push edi
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x64]
call fcn.004373ec
push 0x4cee6c
lea eax, [ebp - 0x64]
push eax
call fcn.004675aa
push dword [ebp + 0x3c]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x437791
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
je 0x437791
xor edi, edi
inc edi
push edi
add esi, 0xc
push esi
lea ecx, [ebp]
call fcn.004372c5
mov dword [ebp - 4], edi
push edi
push ebx
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x60]
call fcn.0043738e
push 0x4cee5c
lea eax, [ebp - 0x60]
jmp 0x437741
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add ebp, 0x34
leave
ret 4

Function at 0x437f03
Capabilities:
Read file on windows

Disassembly:
push ebp
sub esp, 0x34
push 0x58
mov eax, 0x4a86db
call fcn.004674a0
mov esi, ecx
mov eax, dword [ebp + 0x44]
and dword [ebp + 0x34], 0
xor edi, edi
inc edi
cmp eax, 0xffffffff
jne 0x437f26
mov eax, edi
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x437f6a
lea edx, [ebp + 0x34]
push edx
push eax
push dword [ebp + 0x40]
call fcn.0045cc36
test al, al
jne 0x437fa8
push edi
add esi, 0xc
push esi
lea ecx, [ebp]
call fcn.004372c5
and dword [ebp - 4], 0
push edi
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x64]
call fcn.004373ec
push 0x4cee6c
lea eax, [ebp - 0x64]
push eax
call fcn.004675aa
push 0
lea ecx, [ebp + 0x34]
push ecx
push eax
push dword [ebp + 0x40]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x437fa8
push edi
add esi, 0xc
push esi
lea ecx, [ebp]
call fcn.004372c5
mov dword [ebp - 4], edi
push edi
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x60]
call fcn.00437301
push 0x4cee5c
lea eax, [ebp - 0x60]
jmp 0x437f64
mov eax, dword [ebp + 0x34]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add ebp, 0x38
leave
ret 8
Function at 0x437fc0
Capabilities:
Read file on windows

Disassembly:
push ebp
sub esp, 0x34
push 0x58
mov eax, 0x4a8706
call fcn.004674a0
mov esi, ecx
mov eax, dword [ebp + 0x44]
and dword [ebp + 0x34], 0
cmp eax, 0xffffffff
jne 0x437fe1
push 8
pop eax
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x438027
lea edx, [ebp + 0x34]
push edx
push eax
push dword [ebp + 0x40]
call fcn.0045cc36
test al, al
jne 0x43806b
push 1
add esi, 0xc
push esi
lea ecx, [ebp]
call fcn.004372c5
and dword [ebp - 4], 0
push 1
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x64]
call fcn.004373ec
push 0x4cee6c
lea eax, [ebp - 0x64]
push eax
call fcn.004675aa
push 0
lea ecx, [ebp + 0x34]
push ecx
push eax
push dword [ebp + 0x40]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x43806b
push 1
add esi, 0xc
push esi
lea ecx, [ebp]
call fcn.004372c5
mov dword [ebp - 4], 1
push 1
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x60]
call fcn.00437301
push 0x4cee5c
lea eax, [ebp - 0x60]
jmp 0x438021
mov eax, dword [ebp + 0x34]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add ebp, 0x38
leave
ret 8
Function at 0x439332
Capabilities:
Create process on windows

Disassembly:
push ebp
sub esp, 0x834
lea ebp, [esp - 4]
mov eax, dword [0x4db020]
xor eax, ebp
mov dword [ebp + 0x834], eax
push 0xa4
mov eax, 0x4a8b76
call fcn.004674a0
xor eax, eax
push 0x7fe
mov word [ebp + 0x34], ax
xor ebx, ebx
lea eax, [ebp + 0x36]
push ebx
push eax
mov esi, ecx
call fcn.00468830
add esp, 0xc
push 0x400
lea eax, [ebp + 0x34]
push eax
push 0x4c1ca0
push str.ClickOncePackage
push str.Startup
lea ecx, [esi + 0x28]
call fcn.0040a311
cmp word [ebp + 0x34], bx
jne 0x4393a2
xor eax, eax
jmp 0x4394bc
lea eax, [ebp - 0x48]
push eax
mov ecx, esi
call fcn.004378a3
mov dword [ebp - 4], ebx
cmp dword [eax + 0x1c], 8
jb 0x4393bb
mov eax, dword [eax + 8]
jmp 0x4393be
add eax, 8
xor esi, esi
inc esi
push esi
lea ecx, [ebp - 0xd]
push ecx
push eax
lea ecx, [ebp]
call fcn.00401850
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x48]
call fcn.00401660
push esi
lea eax, [ebp - 0xd]
push eax
lea eax, [ebp + 0x34]
push eax
lea ecx, [ebp - 0x48]
call fcn.00401850
mov byte [ebp - 4], 3
push ebx
push ebx
lea eax, [ebp - 0x7c]
push eax
lea ecx, [ebp]
call fcn.00401b90
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x48]
push ecx
lea ecx, [ebp - 0xb0]
push ecx
mov ecx, eax
call fcn.004018d0
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp]
call fcn.004016e0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xb0]
call fcn.00401600
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x7c]
call fcn.00401600
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x48]
call fcn.00401600
cmp dword [ebp + 0x1c], 8
mov eax, dword [ebp + 8]
push 4
jae 0x439456
lea eax, [ebp + 8]
sub esp, 0x34
mov ecx, esp
mov dword [ebp - 0x14], esp
push esi
lea edx, [ebp - 0xd]
push edx
push eax
call fcn.00409071
mov byte [ebp - 4], 6
mov byte [ebp - 4], 2
call fcn.0044f09b
add esp, 0x38
cmp al, bl
jne 0x439489
lea eax, [ebp + 0x34]
push eax
lea ecx, [ebp]
call fcn.00402630
cmp dword [ebp + 0x1c], 8
mov eax, dword [ebp + 8]
jae 0x439495
lea eax, [ebp + 8]
push esi
push ebx
push ebx
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x20
pop ecx
cmp ecx, eax
sbb esi, esi
neg esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp]
call fcn.00401600
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x834]
xor ecx, ebp
call fcn.00467491
add ebp, 0x838
leave
ret
Function at 0x43fb76
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp byte [esp + 8], 0
je 0x43fb92
mov ecx, esi
call fcn.0043fa1a
pop esi
ret 4

Function at 0x4404d3
Capabilities:
Get system information on windows
Read file via mapping

Disassembly:
push 0x54
mov eax, 0x4aa18b
call fcn.004674a0
mov esi, ecx
mov ebx, edx
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
mov edi, dword [esi + 0xa8]
cmp edi, eax
jne 0x44050f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004402a4
xor eax, eax
call fcn.00467578
ret
push 0x1c
lea eax, [ebp - 0x3c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x440526
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], eax
push str..debug
call fcn.0043feb8
pop ecx
test eax, eax
je 0x440548
cmp dword [eax + 0xc], edi
jne 0x440548
mov edi, dword [esi + 0xac]
mov ecx, dword [eax + 0x14]
mov dword [ebp - 0x1c], edi
jmp 0x440593
push str..rdata
call fcn.0043feb8
pop ecx
mov ecx, eax
test ecx, ecx
jne 0x44056a
push str..text
call fcn.0043feb8
pop ecx
mov ecx, eax
test ecx, ecx
je 0x4404fb
mov esi, dword [esi + 0xac]
mov eax, esi
push 0x1c
mov dword [ebp - 0x20], esi
xor edx, edx
pop esi
div esi
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x4404fb
sub edi, dword [ecx + 0xc]
mov eax, dword [ecx + 0x14]
lea ecx, [eax + edi]
mov edi, dword [ebp - 0x20]
lea eax, [ecx + ebx]
mov esi, ecx
mov ecx, eax
sub ecx, ebx
cmp ecx, dword [ebp - 0x18]
jbe 0x4405fa
cmp dword [ebp + 8], 0
je 0x4405fa
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
mov eax, esi
div dword [ebp - 0x44]
imul eax, dword [ebp - 0x44]
mov ebx, eax
lea eax, [edx + edi]
push eax
push ebx
push 0
push 4
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
jne 0x4405eb
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004402a4
mov eax, esi
jmp 0x440509
push edi
lea ecx, [ebp - 0x10]
call fcn.0044037e
sub edi, ebx
add edi, esi
mov eax, edi
mov edx, dword [ebp - 0x1c]
test edx, edx
jbe 0x440619
add eax, 0x10
mov ecx, dword [eax]
mov esi, dword [eax + 8]
add esi, ecx
cmp esi, dword [ebp + 0xc]
jbe 0x440613
add dword [ebp - 0x14], ecx
add eax, 0x1c
dec edx
jne 0x440604
mov esi, dword [ebp - 0x14]
jmp 0x4405d8
Function at 0x44065e
Capabilities:
Get system information on windows
Parse pe header
Read file via mapping

Disassembly:
push 0x38
mov eax, 0x4aa1be
call fcn.004674a0
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], 2
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocStringLen
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
lea ecx, [ebp - 0x18]
call fcn.004174a5
cmp dword [ebp - 0x18], 0xffffffff
jne 0x4406db
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.004402be
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x10]
call fcn.00402c80
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00402c80
mov eax, esi
call fcn.00467578
ret
push ebx
push ebx
push ebx
push 2
push ebx
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
lea ecx, [ebp - 0x10]
call fcn.004174a5
cmp dword [ebp - 0x10], ebx
je 0x4406a8
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x40]
push eax
push ebx
push ebx
push 4
push dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push eax
lea ecx, [ebp - 0x14]
call fcn.0044039d
mov edi, dword [ebp - 0x14]
cmp edi, ebx
je 0x4406a8
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x4407ac
mov esi, dword [edi + 0x3c]
push pe_nt_image_headers32
add esi, edi
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x4407a2
cmp dword [esi], 0x4550
jne 0x4407a2
mov eax, dword [esi + 0x54]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], eax
jae 0x4407af
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x20]
push ebx
push ebx
push 4
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push eax
lea ecx, [ebp - 0x14]
call fcn.0044039d
mov edi, dword [ebp - 0x14]
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x4407a2
mov esi, dword [edi + 0x3c]
push pe_nt_image_headers32
add esi, edi
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x4407a2
cmp dword [esi], 0x4550
je 0x4407af
mov esi, 0xc1
jmp 0x4406b0
mov esi, dword [ebp - 0x20]
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x4407bb
mov dword [eax], edi
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp + 0x10]
cmp eax, ebx
je 0x4407ca
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov dword [ebp - 0x18], ebx
mov eax, dword [ebp + 0x14]
cmp eax, ebx
je 0x4407d9
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp + 0x18]
cmp eax, ebx
je 0x4407e2
mov dword [eax], esi
xor esi, esi
jmp 0x4406b0
Function at 0x440bbe
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0x54], 2
push edi
jae 0x440c36
mov ebx, 0x138
push ebx
mov dword [ebp - 4], ebx
call fcn.00468747
push ebx
mov edi, eax
push 0
push edi
call fcn.00468830
add esp, 0x10
mov ecx, esi
call fcn.0043cdd5
push eax
push edi
call fcn.0046acc0
mov eax, dword [esi + 0x34]
mov dword [edi + 0x104], eax
mov eax, dword [esi + 0x40]
mov dword [edi + 0x110], eax
mov eax, dword [esi + 0x3c]
mov dword [edi + 0x10c], eax
mov eax, dword [esi + 0x44]
mov dword [edi + 0x114], eax
mov ax, word [esi + 0x48]
mov word [edi + 0x118], ax
mov ax, word [esi + 0x38]
pop ecx
pop ecx
mov word [edi + 0x108], ax
jmp 0x440c9c
mov ebx, dword [esi + 0x18]
add ebx, ebx
lea eax, [ebx + 0x18]
push eax
mov dword [ebp - 4], eax
call fcn.00445da6
push 0x18
mov edi, eax
push 0
push edi
call fcn.00468830
mov eax, dword [esi + 0x34]
mov dword [edi + 4], eax
mov eax, dword [esi + 0x40]
mov dword [edi + 0xe], eax
mov dword [edi], ebx
mov eax, dword [esi + 0x3c]
mov dword [edi + 0xa], eax
mov eax, dword [esi + 0x44]
mov dword [edi + 0x12], eax
mov ax, word [esi + 0x48]
mov word [edi + 0x16], ax
mov ax, word [esi + 0x38]
add esp, 0x10
mov word [edi + 8], ax
cmp dword [esi + 0x1c], 8
jb 0x440c8b
mov esi, dword [esi + 8]
jmp 0x440c8e
add esi, 8
push ebx
lea eax, [edi + 0x18]
push esi
push eax
call fcn.00468920
add esp, 0xc
xor esi, esi
push esi
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], esi
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x440cbf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push edi
call fcn.00466cfb
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x441216
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push 0x40
mov eax, 0x4aa447
call fcn.004674a0
mov esi, ecx
mov dword [ebp - 0x18], esi
mov eax, dword [ebp + 8]
cmp dword [eax + 0x1c], 8
jb 0x441235
mov eax, dword [eax + 8]
jmp 0x441238
add eax, 8
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x14], eax
cmp eax, 0xffffffff
jne 0x441267
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x48], eax
jmp 0x44131d
mov esi, 0x400
push esi
call fcn.00445da6
pop ecx
mov edi, eax
mov dword [ebp + 8], ebx
mov dword [ebp - 0x10], ebx
jmp 0x4412f3
cmp dword [ebp + 8], ebx
je 0x44130b
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x41], bl
je 0x4412c2
cmp byte [eax + 0x40], bl
je 0x4412c2
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x4c]
push eax
call fcn.00421b61
mov dword [ebp - 4], ebx
mov ecx, eax
call fcn.0043cdd5
push eax
push dword [ebp + 8]
push edi
call fcn.00405884
add esp, 0xc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.00401660
push ebx
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x14]
add dword [ebp - 0x10], eax
cmp ecx, ebx
je 0x4412ee
mov edx, dword [ebp + 0xc]
push dword [edx + 0x3c]
mov eax, dword [ecx]
push dword [ebp - 0x10]
call dword [eax]
cmp dword [ebp + 8], ebx
je 0x44130b
push ebx
lea eax, [ebp + 8]
push eax
push esi
push edi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x44127d
push edi
call fcn.00466cfb
pop ecx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
call fcn.00467578
ret 0x10
Function at 0x441325
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push 0x50
mov eax, 0x4aa46a
call fcn.004674a0
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp + 0xc]
mov edi, dword [eax + 0x3c]
mov eax, dword [eax + 0x34]
mov ebx, eax
shr ebx, 2
xor esi, esi
and bl, 1
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x1c], esi
mov byte [ebp - 0xd], 0
test al, 6
je 0x44135c
mov byte [ebp - 0xd], 1
mov eax, dword [ebp + 8]
cmp dword [eax + 0x1c], 8
jb 0x44136a
mov eax, dword [eax + 8]
jmp 0x44136d
add eax, 8
push esi
push 0x80
push 2
push esi
push esi
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x20], eax
cmp eax, 0xffffffff
jne 0x44139e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x48], eax
xor eax, eax
jmp 0x441480
mov eax, 0x400
mov dword [ebp - 0x14], eax
cmp edi, eax
jae 0x4413ad
mov dword [ebp - 0x14], edi
push dword [ebp - 0x14]
call fcn.00445da6
pop ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, eax
mov dword [ebp - 0x24], 1
jmp 0x441450
test bl, bl
je 0x441405
cmp byte [ebp - 0xd], 0
je 0x441405
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x5c]
push eax
call fcn.00421b61
and dword [ebp - 4], 0
mov ecx, eax
call fcn.0043cdd5
push eax
push dword [ebp + 8]
push edi
call fcn.004058fa
add esp, 0xc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
call fcn.00401660
push 0
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push edi
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x14]
add dword [ebp - 0x1c], eax
test ecx, ecx
je 0x441433
push dword [ebp - 0x28]
mov eax, dword [ecx]
push dword [ebp - 0x1c]
call dword [eax]
test al, al
jne 0x441467
mov eax, dword [ebp + 8]
sub dword [ebp - 0x18], eax
je 0x44146b
test eax, eax
je 0x44146b
cmp dword [ebp - 0x18], 0x400
jae 0x44144e
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
push 0
lea eax, [ebp + 8]
push eax
push dword [ebp - 0x14]
push edi
push dword [ebp + 0x10]
call esi
test eax, eax
jne 0x4413cb
jmp 0x44146b
and dword [ebp - 0x24], 0
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x24]
call fcn.00467578
ret 0x10
Function at 0x4421e1
Capabilities:
Read file on windows

Disassembly:
push ebp
sub esp, 0x138
lea ebp, [esp - 4]
mov eax, dword [0x4db020]
xor eax, ebp
mov dword [ebp + 0x138], eax
push 0x5c
mov eax, 0x4aa62c
call fcn.004674a0
mov edi, dword [ebp + 0x144]
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x54], 2
mov dword [ebp - 0x18], edi
jae 0x4422d9
mov edi, 0x138
push edi
lea eax, [ebp]
push ebx
push eax
call fcn.00468830
add esp, 0xc
push ebx
lea eax, [ebp - 0x10]
push eax
push edi
lea eax, [ebp]
push eax
push dword [ebp - 0x18]
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x442254
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4423cc
cmp dword [ebp - 0x10], edi
je 0x442263
mov eax, 0x103
jmp 0x4423cc
push 1
lea eax, [ebp - 0x11]
push eax
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x68]
call fcn.0040a0dc
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
mov ecx, esi
call fcn.00408f7f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.00401660
mov eax, dword [ebp + 0x104]
mov dword [esi + 0x34], eax
mov ax, word [ebp + 0x108]
mov word [esi + 0x38], ax
mov eax, dword [ebp + 0x10c]
mov dword [esi + 0x3c], eax
mov eax, dword [ebp + 0x110]
mov dword [esi + 0x40], eax
mov eax, dword [ebp + 0x114]
mov dword [esi + 0x44], eax
mov ax, word [ebp + 0x118]
mov word [esi + 0x48], ax
mov eax, dword [ebp + 0x148]
add eax, 0x138
jmp 0x4423c7
push 0x18
lea eax, [ebp - 0x30]
push ebx
push eax
call fcn.00468830
add esp, 0xc
push ebx
lea eax, [ebp - 0x10]
push eax
push 0x18
lea eax, [ebp - 0x30]
push eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x10], ebx
call edi
test eax, eax
je 0x442249
cmp dword [ebp - 0x10], 0x18
jne 0x442259
mov eax, dword [ebp - 0x2c]
push dword [ebp - 0x30]
mov dword [esi + 0x34], eax
mov ax, word [ebp - 0x28]
mov word [esi + 0x38], ax
mov eax, dword [ebp - 0x26]
mov dword [esi + 0x3c], eax
mov eax, dword [ebp - 0x22]
mov dword [esi + 0x40], eax
mov eax, dword [ebp - 0x1e]
mov dword [esi + 0x44], eax
mov ax, word [ebp - 0x1a]
mov word [esi + 0x48], ax
call fcn.00445da6
push dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
push ebx
push eax
call fcn.00468830
add esp, 0x10
push ebx
mov ebx, dword [ebp - 0x34]
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x30]
push ebx
push dword [ebp - 0x18]
call edi
test eax, eax
jne 0x442379
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push ebx
call fcn.00466cfb
pop ecx
mov eax, esi
jmp 0x4423cc
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x10], eax
je 0x442388
mov esi, 0x103
jmp 0x44236e
xor edi, edi
inc edi
push edi
lea ecx, [ebp - 0x11]
push ecx
shr eax, 1
push eax
push ebx
lea ecx, [ebp - 0x68]
call fcn.00409025
mov dword [ebp - 4], edi
push eax
mov ecx, esi
call fcn.00408f7f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.00401660
push ebx
call fcn.00466cfb
mov eax, dword [ebp + 0x148]
pop ecx
mov ecx, dword [ebp - 0x30]
lea eax, [ecx + eax + 0x18]
mov dword [esi + 0x4c], eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x138]
xor ecx, ebp
call fcn.00467491
add ebp, 0x13c
leave
ret 8