joyce8/EMBER2024-capa huggingface dataset:
Function at 0x437110
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b8170
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x4ea160]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x6fc]
test eax, eax
je 0x437286
push 0x20
lea ecx, [ebp - 0x30]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x48], vtable.FCString.0
call fcn.00451b70
push 0
push 0x100
lea ecx, [ebp - 0x48]
call fcn.00450e40
mov dword [ebp - 4], 0
lea eax, [ebp - 0x30]
push eax
push 0x100
lea ecx, [ebp - 0x48]
call fcn.00450e40
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0xd5
push dword [esi + 0x6fc]
call ebx
mov ecx, dword [ebp - 0x44]
add eax, 0xfffffffe
cmp dword [ecx + 8], eax
jg 0x437277
push 0
push 0
push 0xb0
push dword [esi + 0x6fc]
call ebx
mov ecx, dword [ebp + 8]
mov edi, eax
movzx ebx, di
shr edi, 0x10
mov byte [ebp - 0x2e], 0
movzx edx, word [esi + ecx*2 + 0x7dc]
mov ecx, edx
mov byte [ebp - 0x2f], dl
shr ecx, 8
mov byte [ebp - 0x30], cl
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x3c], vtable.FCString.0
call fcn.00451b70
push 0
push 0x100
lea ecx, [ebp - 0x3c]
call fcn.00450e40
mov byte [ebp - 4], 1
test ebx, ebx
je 0x43721c
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0x3c]
push ebx
push dword [eax + 0x14]
call fcn.00450970
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x3c]
call fcn.00450850
mov ecx, dword [ebp - 0x44]
mov eax, dword [ecx + 8]
cmp edi, eax
jge 0x437243
sub eax, edi
push eax
mov eax, dword [ecx + 0x14]
lea ecx, [ebp - 0x3c]
add eax, edi
push eax
call fcn.00450970
mov eax, dword [ebp - 0x38]
push dword [eax + 0x14]
push dword [esi + 0x6fc]
call dword [sym.imp.USER32.dll_SetWindowTextA]
lea eax, [ebx + 2]
push eax
push eax
push 0xb1
push dword [esi + 0x6fc]
call dword [sym.imp.USER32.dll_SendMessageA]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3c]
call fcn.00450480
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.00450480
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044f18f
mov esp, ebp
pop ebp
ret 4
Function at 0x4393e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b85a4
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4ea160]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
mov dword [ebx], vtable.UxRnf.0
lea ecx, [ebx + 4]
mov dword [ebx + 4], vtable.FCString.0
call fcn.00451b70
push 0
push 0x100
lea ecx, [ebx + 4]
call fcn.00450e40
mov dword [ebp - 4], 0
lea edi, [ebx + 0x10]
mov dword [ebp - 0x18], edi
push 0x28
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.00430fe0
mov esi, eax
lea eax, [ebp - 0x10]
push eax
push esi
mov dword [ebp - 0x10], esi
call fcn.00431050
lea eax, [ebp - 0x10]
push eax
lea ecx, [esi + 4]
push ecx
call fcn.00431050
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 8]
push eax
call fcn.00431050
mov word [esi + 0xc], 0x101
add esp, 0x1c
mov dword [edi], esi
mov byte [ebp - 4], 2
lea ecx, [ebx + 0x1c]
mov dword [ebx + 0x1c], vtable.FCString.0
call fcn.00451b70
push 0
push 0x100
lea ecx, [ebx + 0x1c]
call fcn.00450e40
mov byte [ebp - 4], 3
mov dword [ebx + 0x28], vtable.FCXList_class_FCIdString_.0
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x30], 0
mov byte [ebp - 4], 4
mov ecx, ebx
call fcn.00488a10
push dword [ebp + 8]
mov ecx, ebx
call fcn.00487d90
mov dword [ebp - 4], 0xffffffff
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x43a2c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b8b9c
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4ea160]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [edi + 0x10]
mov dword [edi], 0x4c4624
mov eax, dword [eax + 4]
mov dword [eax + edi + 0x10], 0x4c4628
mov eax, dword [edi + 0x10]
mov edx, dword [eax + 4]
lea eax, [edx - 0x20]
mov dword [edx + edi + 0xc], eax
mov dword [ebp - 4], 0
lea esi, [edi + 0x30]
mov dword [ebp - 0x14], esi
mov eax, dword [esi - 0x20]
mov eax, dword [eax + 4]
mov dword [eax + esi - 0x20], 0x4c4620
mov eax, dword [esi - 0x20]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x20]
mov dword [ecx + esi - 0x24], eax
mov byte [ebp - 4], 0
mov ecx, esi
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_iostream_char__struct_std::char_traits_char__::destructor_void_]
mov dword [ebp - 4], 0xffffffff
mov ecx, edi
call fcn.00450480
mov ecx, esi
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x446200
Capabilities:
Enumerate gui resources

Disassembly:
push esi
push 0x3e8
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, esi
call fcn.004462b0
mov ecx, esi
pop esi
jmp fcn.00446330

Function at 0x446330
Capabilities:
Enumerate gui resources

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x1960], 0
je 0x44642f
cmp dword [esi + 0x1964], 0
je 0x44642f
cmp dword [esi + 0x1968], 0
je 0x44642f
cmp dword [esi + 0x196c], 0
je 0x44642f
push esi
push 0x43bb90
mov dword [esi + 0x1954], 2
mov dword [esi + 0x195c], 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [esi + 0x1960]
test ecx, ecx
je 0x4463ad
cmp dword [ecx - 4], 0
lea eax, [ecx - 4]
je 0x4463a2
mov eax, dword [ecx]
push 3
call dword [eax]
jmp 0x4463ad
push 4
push eax
call fcn.0044f5ab
add esp, 8
mov ecx, dword [esi + 0x1964]
test ecx, ecx
je 0x4463d3
cmp dword [ecx - 4], 0
lea eax, [ecx - 4]
je 0x4463c8
mov eax, dword [ecx]
push 3
call dword [eax]
jmp 0x4463d3
push 4
push eax
call fcn.0044f5ab
add esp, 8
mov ecx, dword [esi + 0x1968]
test ecx, ecx
je 0x4463f9
cmp dword [ecx - 4], 0
lea eax, [ecx - 4]
je 0x4463ee
mov eax, dword [ecx]
push 3
call dword [eax]
jmp 0x4463f9
push 4
push eax
call fcn.0044f5ab
add esp, 8
push dword [esi + 0x196c]
call fcn.0044f34c
add esp, 4
mov dword [esi + 0x1960], 0
mov dword [esi + 0x1964], 0
mov dword [esi + 0x1968], 0
mov dword [esi + 0x196c], 0
pop esi
ret
Function at 0x447850
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b9cb7
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4ea160]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [esi + 0x1971], 0
je 0x447ab6
mov ecx, dword [esi + 0x1960]
test ecx, ecx
je 0x4478ad
cmp dword [ecx - 4], 0
lea eax, [ecx - 4]
je 0x4478a2
mov eax, dword [ecx]
push 3
call dword [eax]
jmp 0x4478ad
push 4
push eax
call fcn.0044f5ab
add esp, 8
mov ecx, dword [esi + 0x1964]
test ecx, ecx
je 0x4478d3
cmp dword [ecx - 4], 0
lea eax, [ecx - 4]
je 0x4478c8
mov eax, dword [ecx]
push 3
call dword [eax]
jmp 0x4478d3
push 4
push eax
call fcn.0044f5ab
add esp, 8
mov ecx, dword [esi + 0x1968]
test ecx, ecx
je 0x4478f9
cmp dword [ecx - 4], 0
lea eax, [ecx - 4]
je 0x4478ee
mov eax, dword [ecx]
push 3
call dword [eax]
jmp 0x4478f9
push 4
push eax
call fcn.0044f5ab
add esp, 8
mov eax, dword [esi + 0x196c]
test eax, eax
je 0x44790c
push eax
call fcn.0044f34c
add esp, 4
push esi
push 0x43bb90
mov dword [esi + 0x1954], 0
mov dword [esi + 0x1958], 0
call dword [sym.imp.USER32.dll_EnumWindows]
add dword [esi + 0x1958], 8
mov edi, dword [esi + 0x1958]
cmp edi, 1
jl 0x447ab6
xor ecx, ecx
mov dword [ebp - 0x10], edi
mov eax, edi
mov edx, 0xc
mul edx
seto cl
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call fcn.0044f5a2
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x447994
push fcn.00450480
push fcn.004327a0
push edi
lea ebx, [eax + 4]
mov dword [eax], edi
push 0xc
push ebx
call fcn.0044f1c3
jmp 0x447996
xor ebx, ebx
mov dword [ebp - 4], 0xffffffff
xor ecx, ecx
mov dword [esi + 0x1960], ebx
mov edx, 0xc
mov ebx, dword [esi + 0x1958]
mov eax, ebx
mul edx
mov dword [ebp - 0x14], ebx
seto cl
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call fcn.0044f5a2
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 1
test eax, eax
je 0x4479fb
push fcn.00450480
push fcn.004327a0
push ebx
lea edi, [eax + 4]
mov dword [eax], ebx
push 0xc
push edi
call fcn.0044f1c3
jmp 0x4479fd
xor edi, edi
mov dword [ebp - 4], 0xffffffff
xor ecx, ecx
mov ebx, dword [esi + 0x1958]
mov edx, 0x14
mov eax, ebx
mov dword [esi + 0x1964], edi
mul edx
mov dword [ebp - 0x14], ebx
seto cl
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call fcn.0044f5a2
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 2
test eax, eax
je 0x447a62
push fcn.00433660
push 0x434900
push ebx
lea edi, [eax + 4]
mov dword [eax], ebx
push 0x14
push edi
call fcn.0044f1c3
jmp 0x447a64
xor edi, edi
mov dword [ebp - 4], 0xffffffff
xor ecx, ecx
mov eax, dword [esi + 0x1958]
mov edx, 4
mul edx
mov dword [esi + 0x1968], edi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044f5a2
add esp, 4
mov dword [esi + 0x196c], eax
mov dword [esi + 0x1954], 1
mov dword [esi + 0x195c], 0
push esi
push 0x43bb90
call dword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44e6b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x4ea160]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
xor cl, cl
push ebx
mov ebx, dword [ebp + 8]
cmp dword [eax + 0xc], 0x201
jne 0x44e733
add eax, 0x18
push eax
push 0
push 0x437
push dword [ebp + 0xc]
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
lea eax, [ebp - 0x804]
push eax
push 0
push 0x43e
push dword [ebp + 0xc]
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push 1
push 0
push 0
lea eax, [ebp - 0x804]
push eax
push 0
push dword [ebx + 4]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
pop ebx
seta al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044f18f
mov esp, ebp
pop ebp
ret
mov al, cl
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0044f18f
mov esp, ebp
pop ebp
ret
Function at 0x44e9c0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ba5f0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x4ea160]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x30], vtable.FCPathName.0
mov dword [ebp - 0x2c], vtable.FCString.0
call fcn.00451b70
push 0
push 0x200
lea ecx, [ebp - 0x2c]
call fcn.00450e40
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x30]
push 0x7778
call fcn.00453320
mov dword [ebp - 4], 1
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
cmp dword [eax + 8], 0
je 0x44ea52
push dword [eax + 0x14]
lea ecx, [ebp - 0x2c]
call fcn.00450850
mov eax, dword [ebp - 0x28]
push 0
push dword [eax + 0x14]
call fcn.004549a0
add esp, 8
test eax, eax
jne 0x44ea5f
push 0x7777
lea ecx, [ebp - 0x30]
call fcn.00453320
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 0x10], 0
push dword [eax + 0x14]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
je 0x44eb96
push esi
call fcn.0044f5a2
mov edi, eax
add esp, 4
test edi, edi
je 0x44eb96
mov ecx, dword [ebp - 0x28]
push edi
push esi
push dword [ebp - 0x10]
push dword [ecx + 0x14]
call sub.VERSION.dll_GetFileVersionInfoA
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 8]
push eax
push str.StringFileInfo041104b0FileVersion
push edi
call sub.VERSION.dll_VerQueryValueA
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], vtable.FCString.0
call fcn.00451b70
push 0
push 0x100
lea ecx, [ebp - 0x20]
call fcn.00450e40
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x20]
push dword [ebp + 8]
call fcn.00450850
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x20]
push 0
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x18], eax
call fcn.00452dd0
mov ecx, dword [ebp + 0xc]
push 0x4c3868
mov dword [ecx], eax
lea ecx, [ebp - 0x20]
call fcn.004514b0
push 0
push 0
push 0x4c3868
lea ecx, [ebp - 0x20]
call fcn.00452290
push 1
lea ecx, [ebp - 0x20]
call fcn.00452dd0
mov ecx, dword [ebp + 0x10]
push 0x4c3868
mov dword [ecx], eax
lea ecx, [ebp - 0x20]
call fcn.004514b0
push 0
push 0
push 0x4c3868
lea ecx, [ebp - 0x20]
call fcn.00452290
push 1
lea ecx, [ebp - 0x20]
call fcn.00452dd0
mov ecx, dword [ebp + 0x14]
push 0x4c3868
mov dword [ecx], eax
lea ecx, [ebp - 0x20]
call fcn.004514b0
push 0
push 0
push 0x4c3868
lea ecx, [ebp - 0x20]
call fcn.00452290
push 1
lea ecx, [ebp - 0x20]
call fcn.00452dd0
mov ecx, dword [ebp + 0x18]
push edi
mov dword [ecx], eax
call fcn.0044f34c
add esp, 4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
call fcn.00450480
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x30], vtable.FCPathName.0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00450480
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4537a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ba9db
mov eax, dword fs:[0]
push eax
sub esp, 0x114
mov eax, dword [0x4ea160]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [ebp - 0x114]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
jne 0x453883
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x120]
mov dword [ebp - method.FCString.virtual_0], vtable.FCString.0
mov esi, eax
call fcn.00451b70
push str.FCPathName___create__
push 0x100
lea ecx, [ebp - 0x120]
call fcn.00450e40
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x120]
push 0x4c94c8
call fcn.00450850
push 0x20
push 0
push 0xa
push esi
lea ecx, [ebp - 0x120]
call fcn.00450750
push 0x4c94f0
lea ecx, [ebp - 0x120]
call fcn.00450850
mov eax, dword [ebp - 0x11c]
push 0x12000
push str.FCString_class
push dword [eax + 0x14]
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x120]
call fcn.00450480
jmp 0x4538d0
mov eax, dword [esi + 8]
cmp dword [eax + 8], 0
je 0x453894
lea ecx, [esi + 4]
call fcn.00450c50
lea eax, [ebp - 0x114]
push eax
push 0x100
lea ecx, [esi + 4]
call fcn.00450e40
mov ecx, dword [esi + 8]
mov eax, dword [ecx + 8]
add eax, dword [ecx + 0x14]
mov dword [esi + 0xc], eax
cmp byte [eax - 1], 0x5c
je 0x4538ca
push 0x4c4164
lea ecx, [esi + 4]
call fcn.00450850
mov ecx, dword [esi + 8]
mov eax, dword [ecx + 0x14]
mov dword [esi + 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044f18f
mov esp, ebp
pop ebp
ret

Function at 0x453af0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x4ef718], 0
jne 0x453b69
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov edi, eax
mov dword [ebp - 4], 0x5c3a41
mov bl, 0x41
nop word [eax + eax]
movzx ecx, bl
mov eax, 1
sub ecx, 0x41
shl eax, cl
test edi, eax
je 0x453b3f
lea eax, [ebp - 4]
mov byte [ebp - 4], bl
push eax
call esi
cmp eax, 5
je 0x453b4d
inc bl
cmp bl, 0x5a
jle 0x453b20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx eax, byte [ebp - 4]
pop edi
mov byte [0x4ef718], al
movzx eax, byte [ebp - 3]
pop esi
mov byte [0x4ef719], al
mov byte [0x4ef71a], 0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x454460
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4baaa8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x4ea160]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
cmp dword [ebp + 8], esi
je 0x4544ff
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x1c], vtable.FCPathName.0
mov dword [ebp - 0x18], vtable.FCString.0
call fcn.00451b70
push esi
push 0x200
lea ecx, [ebp - 0x18]
call fcn.00450e40
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x1c]
push dword [ebp + 8]
call fcn.00453660
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x14]
push dword [eax + 0x14]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4544e2
test dword [ebp + 0xc], eax
mov eax, 1
cmovne esi, eax
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x1c], vtable.FCPathName.0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00450480
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4549a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4baaa8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x4ea160]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
cmp dword [ebp + 8], esi
je 0x454a44
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x1c], vtable.FCPathName.0
mov dword [ebp - 0x18], vtable.FCString.0
call fcn.00451b70
push esi
push 0x200
lea ecx, [ebp - 0x18]
call fcn.00450e40
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x1c]
push dword [ebp + 8]
call fcn.00453660
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x14]
push dword [eax + 0x14]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
cmp ecx, 0xffffffff
je 0x454a27
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x454a22
mov dword [eax], ecx
mov esi, 1
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x1c], vtable.FCPathName.0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00450480
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x454c70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b9668
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4ea160]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x454cc0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00489d60
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ebx, dword [ebp + 0xc]
push 0
lea eax, [ebp + 0xc]
mov ecx, edi
push eax
push ebx
push dword [ebp + 8]
call fcn.00454990
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x454dd6
mov ecx, edi
call fcn.00454980
push eax
lea ecx, [ebp - 0x18]
call fcn.00450260
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea ecx, [esi - 5]
cmp ecx, 0x1c
ja case.0x454d11.6
movzx ecx, byte [ecx + 0x454e24]
jmp dword [ecx*4 + 0x454e0c]
push 0x4c9760
lea ecx, [ebp - 0x18]
call fcn.00450850
jmp 0x454d9d
push 0x4c978c
lea ecx, [ebp - 0x18]
call fcn.00450850
jmp 0x454d9d
push 0x4c9674
lea ecx, [ebp - 0x18]
call fcn.00450850
jmp 0x454d9d
push 0x4c9694
lea ecx, [ebp - 0x18]
call fcn.00450850
jmp 0x454d9d
push 0x4c97b8
lea ecx, [ebp - 0x18]
call fcn.00450850
jmp 0x454d9d
push 0x4c97d8
lea ecx, [ebp - 0x18]
call fcn.00450850
push 0x20
push 0
push 0xa
push esi
lea ecx, [ebp - 0x18]
call fcn.00450750
push str._nFile_handle_:
lea ecx, [ebp - 0x18]
call fcn.00450850
push 0x20
push 0
push 0xa
push dword [edi + 4]
lea ecx, [ebp - 0x18]
call fcn.00450750
mov eax, dword [ebp - 0x14]
push 0x12005
push str.FCFile___read
push dword [eax + 0x14]
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov esi, eax
mov dword [ebp + 0xc], 0xffffffff
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00450480
cmp esi, 4
je 0x454cc3
mov eax, dword [ebp + 0xc]
cmp eax, 0xffffffff
jne 0x454cac
mov ecx, edi
call fcn.00454980
mov ecx, eax
call fcn.00454f20
push eax
push str.cannot_read
lea ecx, [ebp - 0x18]
call fcn.00453d60
push 0x4e00c0
lea eax, [ebp - 0x18]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push esp
dec ebp
inc ebp
add byte [esi], dh
dec ebp
inc ebp
add byte [ebp + 0x4d], al
inc ebp
add byte [eax], bl
dec ebp
inc ebp
add byte [edi], ah
dec ebp
inc ebp
add byte [ebx + 0x4d], ah
inc ebp
add byte [eax], al
add eax, 0x5050505
add eax, 84215045
add eax, 84215045
add dword [84215045], eax
add eax, 33883397
add eax, dword [esp + ecx*8]
int3
Function at 0x454ff0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b9668
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4ea160]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x455040
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00489ef0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ebx, dword [ebp + 0xc]
push 0
lea eax, [ebp + 0xc]
mov ecx, edi
push eax
push ebx
push dword [ebp + 8]
call fcn.00454990
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x455138
mov ecx, edi
call fcn.00454980
push eax
lea ecx, [ebp - 0x18]
call fcn.00450260
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea ecx, [esi - 5]
cmp ecx, 0x1c
ja case.0x455091.6
movzx ecx, byte [ecx + 0x455188]
jmp dword [ecx*4 + 0x455170]
push 0x4c9760
lea ecx, [ebp - 0x18]
call fcn.00450850
jmp 0x4550ff
push 0x4c978c
lea ecx, [ebp - 0x18]
call fcn.00450850
jmp 0x4550ff
push 0x4c9674
lea ecx, [ebp - 0x18]
call fcn.00450850
jmp 0x4550ff
push 0x4c9694
lea ecx, [ebp - 0x18]
call fcn.00450850
jmp 0x4550ff
push 0x4c9828
lea ecx, [ebp - 0x18]
call fcn.00450850
jmp 0x4550ff
push 0x4c9848
lea ecx, [ebp - 0x18]
call fcn.00450850
push 0x20
push 0
push 0xa
push esi
lea ecx, [ebp - 0x18]
call fcn.00450750
mov eax, dword [ebp - 0x14]
push 0x12005
push str.FCFile___write
push dword [eax + 0x14]
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov esi, eax
mov dword [ebp + 0xc], 0xffffffff
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00450480
cmp esi, 4
je 0x455043
mov eax, dword [ebp + 0xc]
cmp eax, 0xffffffff
jne 0x45502c
mov ecx, edi
call fcn.00454980
mov ecx, eax
call fcn.00454f20
push eax
push str.cannot_write
lea ecx, [ebp - 0x18]
call fcn.00453e30
push 0x4e00f8
lea eax, [ebp - 0x18]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
nop
aam 0x50
inc ebp
add byte [esi - 0x3affbab0], dh
push eax
inc ebp
add byte [eax - 0x58ffbab0], bl
push eax
inc ebp
add bl, ah
push eax
inc ebp
add byte [eax], al
add eax, 0x5050505
add eax, 84215045
add eax, 84215045
add dword [84215045], eax
add eax, 33883397
add eax, dword [esp + ecx*8]
int3