joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41dae0
Capabilities:
Access peb ldr_data
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x54c816
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5b0630]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
lea eax, [esi + 0x30]
push eax
call fcn.0041e0b0
lea ecx, [esi + 0x4c]
push ecx
mov dword [esp + 0x18], 0
call fcn.0041e1e0
lea edx, [esi + 0x68]
push edx
mov byte [esp + 0x18], 1
call fcn.0043a3a0
mov edi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push esi
call edi
lea eax, [esi + 0x18]
push eax
call edi
push esi
push 0
push 0x41d300
call fcn.005245c5
push esi
push 0
push 0x41dda0
call fcn.005245c5
add esp, 0x18
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4

Function at 0x41db70
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x54c7e1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5b0630]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, dword [esp + 0x28]
lea eax, [esi + 0x30]
push eax
call fcn.0041e0b0
lea ecx, [esi + 0x4c]
xor ebp, ebp
push ecx
mov dword [esp + 0x24], ebp
call fcn.0041e1e0
lea edi, [esi + 0x68]
push edi
mov byte [esp + 0x24], 1
call fcn.0043a3a0
mov byte [esp + 0x20], 2
mov ebx, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push esi
call ebx
lea edx, [esi + 0x18]
push edx
call ebx
push esi
push ebp
push 0x41d300
call fcn.005245c5
add esp, 0xc
push esi
push ebp
push 0x41dda0
call fcn.005245c5
mov ebx, dword [esp + 0x38]
add esp, 0xc
cmp dword [ebx], ebp
je 0x41dc13
lea esp, [esp]
call fcn.0041e280
mov eax, dword [esp + 0x2c]
inc ebp
cmp dword [eax + ebp*4], 0
lea ebx, [eax + ebp*4]
jne 0x41dc00
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
Function at 0x4201a0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov esi, eax
mov eax, dword [esi]
mov ecx, dword [esi + 8]
push eax
push 1
push ecx
push edi
call fcn.00529a1a
mov ecx, dword [esi + 8]
add esp, 0x10
cmp eax, 1
mov eax, ecx
sete bl
cdq
idiv dword [esi + 0x18]
mov byte [esp + 0x12], bl
mov dword [esi + 0x1c], eax
test bl, bl
je 0x420319
add dword [esi + 0x14], ecx
cmp dword [esi + 0x54], 8
push 0xffffffffffffffff
push eax
push 0x18
push ecx
mov ecx, esp
jb 0x4201f3
mov eax, dword [esi + 0x40]
jmp 0x4201f6
lea eax, [esi + 0x40]
mov dword [ecx], eax
push ecx
mov eax, esp
mov dword [eax], str.read
lea eax, [esi + 0x20]
push eax
mov dword [esp + 0x2c], eax
call fcn.0041ebd0
mov ecx, dword [esi + 0x18]
mov ebx, dword [esi + 0x1c]
add esp, 0x18
xor ebp, ebp
xor eax, eax
cmp ecx, 1
sete byte [esp + 0x13]
test ebx, ebx
je 0x4202b4
xor edx, edx
dec ebx
cmp byte [esp + 0x13], dl
je 0x420238
cmp byte [edi], dl
jmp 0x42023c
cmp word [edi], 0
sete dl
test edx, edx
je 0x420266
test eax, eax
je 0x42025f
cmp edi, eax
je 0x42025f
imul ecx, ebp
mov edx, edi
sub edx, eax
push edx
push eax
sub eax, ecx
push eax
call fcn.005283c0
add esp, 0xc
mov ecx, dword [esi + 0x18]
lea eax, [ecx + edi]
inc ebp
add edi, ecx
test ebx, ebx
jne 0x42022b
test eax, eax
je 0x420289
cmp edi, eax
je 0x420289
mov ecx, dword [esi + 0x18]
imul ecx, ebp
sub edi, eax
push edi
push eax
sub eax, ecx
push eax
call fcn.005283c0
add esp, 0xc
test ebp, ebp
je 0x4202b4
mov edx, dword [esp + 0x14]
push 0xffffffffffffffff
push ebp
push 1
push ecx
mov eax, esp
push ecx
mov dword [eax], 0
mov eax, esp
push edx
mov dword [eax], str.nulls_removed
call fcn.0041ebd0
add esp, 0x18
sub dword [esi + 0x1c], ebp
cmp dword [esi + 0x18], 1
jle 0x42030b
test byte [esi + 4], 0x80
je 0x42030b
mov esi, dword [esi + 0x1c]
test esi, esi
je 0x4202e6
jmp 0x4202d0
mov ecx, dword [esp + 0x1c]
movzx eax, word [ecx + esi*2 - 2]
dec esi
rol ax, 8
mov word [ecx + esi*2], ax
test esi, esi
jne 0x4202d0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push ecx
mov eax, esp
mov dword [eax], 0
push ecx
mov eax, esp
mov dword [eax], str.endian_swap
mov eax, dword [esp + 0x28]
push eax
call fcn.0041ebd0
add esp, 0x18
mov al, byte [esp + 0x12]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
push esi
call fcn.0041fbe0
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 8
ret 4
Function at 0x420820
Capabilities:
Write file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, eax
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
imul ecx, eax
push edi
mov dword [esi + 8], ecx
test ebp, ebp
jne 0x42083c
mov ebp, edx
mov ecx, dword [esi + 4]
xor edi, edi
test cl, cl
jns 0x4208b6
test edx, edx
jne 0x420875
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00450c26
mov edi, eax
mov eax, dword [esi + 0x1c]
add eax, eax
push eax
push ebp
push edi
call fcn.00524680
add esp, 0x10
mov edx, edi
mov ebp, edi
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x420892
lea esp, [esp]
movzx ecx, word [edx + eax*2 - 2]
dec eax
rol cx, 8
mov word [edx + eax*2], cx
test eax, eax
jne 0x420880
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push ecx
mov eax, esp
push ecx
mov dword [eax], 0
mov eax, esp
lea ecx, [esi + 0x20]
push ecx
mov dword [eax], str.endian_swap
call fcn.0041ebd0
add esp, 0x18
mov edx, dword [esi]
mov eax, dword [esi + 8]
push edx
push 1
push eax
push ebp
call fcn.0052a3a4
add esp, 0x10
cmp eax, 1
sete bl
test edi, edi
je 0x4208db
push edi
call fcn.00450c1b
add esp, 4
test bl, bl
je 0x42091e
mov edx, dword [esi + 0x1c]
mov ecx, dword [esi + 8]
add dword [esi + 0x14], ecx
cmp dword [esi + 0x54], 8
push 0xffffffffffffffff
push edx
push 0x18
push ecx
mov ecx, esp
jb 0x4208fb
mov eax, dword [esi + 0x40]
jmp 0x4208fe
lea eax, [esi + 0x40]
push ecx
mov dword [ecx], eax
mov eax, esp
add esi, 0x20
push esi
mov dword [eax], str.write
call fcn.0041ebd0
add esp, 0x18
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
ret 4
push esi
call fcn.0041fbe0
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
ret 4
Function at 0x421bd0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x54a189
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5b0630]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
xor esi, esi
mov dword [esp + 0x18], esi
lea edi, [ebp + 4]
xor eax, eax
mov dword [ebp + 0x18], 7
mov dword [ebp + 0x14], esi
mov dword [esp + 0x1c], ebp
mov word [edi], ax
mov dword [esp + 0x28], esi
mov eax, dword [esp + 0x34]
mov dword [esp + 0x18], 1
mov ebx, eax
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x421c30
sub eax, edx
mov esi, dword [ebp + 0x14]
sar eax, 1
mov ecx, eax
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea eax, [ecx + eax + 7]
cmp esi, eax
ja 0x421c81
cmp dword [ebp + 0x18], eax
je 0x421c81
push 1
push eax
mov ecx, ebp
call fcn.0040c830
test al, al
je 0x421c81
cmp dword [ebp + 0x18], 8
mov dword [ebp + 0x14], esi
jb 0x421c7b
mov edi, dword [edi]
xor ecx, ecx
mov word [edi + esi*2], cx
movzx eax, word [ebx]
test ax, ax
je 0x421d9b
mov esi, dword [esp + 0x38]
and esi, 0x100
mov dword [esp + 0x14], esi
test esi, esi
je 0x421cb8
lea edx, [eax - 0x22]
cmp dx, 0x1c
ja 0x421d81
movzx ecx, ax
movsx edi, byte [ecx + 0x58ee0e]
jmp 0x421ccf
lea edx, [eax - 0x26]
cmp dx, 0x18
ja 0x421d81
movzx ecx, ax
movsx edi, byte [ecx + 0x58ee2a]
test edi, edi
je 0x421d81
test byte [esp + 0x38], 8
je 0x421d57
cmp ax, 0x26
jne 0x421d57
movzx eax, word [ebx + 2]
lea esi, [ebx + 2]
lea edx, [eax - 0x23]
cmp dx, 0x57
ja 0x421d02
movzx ecx, ax
movsx ecx, byte [ecx + 0x58ee4d]
test ecx, ecx
jne 0x421d08
cmp ax, 0x7f
jbe 0x421d57
movzx eax, word [esi + 2]
add esi, 2
cmp ax, 0x3b
je 0x421d3f
lea edx, [eax - 0x2d]
cmp dx, 0x4d
ja 0x421d2c
movzx ecx, ax
movsx ecx, byte [ecx + 0x58eea3]
test ecx, ecx
jne 0x421d32
cmp ax, 0x7f
jbe 0x421d57
movzx eax, word [esi + 2]
add esi, 2
cmp ax, 0x3b
jne 0x421d15
mov eax, esi
sub eax, ebx
sar eax, 1
inc eax
push eax
push ebx
mov ecx, ebp
call fcn.0040c550
mov ebx, esi
mov esi, dword [esp + 0x14]
jmp 0x421d8b
mov edx, dword [edi*4 + 0x5b2b14]
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x421d63
sub eax, esi
sar eax, 1
push eax
push edx
mov ecx, ebp
call fcn.0040c550
mov esi, dword [esp + 0x14]
jmp 0x421d8b
push 1
push ebx
mov ecx, ebp
call fcn.0040c550
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
jne 0x421c9b
mov eax, ebp
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x425080
Capabilities:
Get file size

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push connect
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x425118
lea ecx, [esp + 0x10]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x425111
mov esi, dword [esp + 0x20]
mov ebp, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
mov ecx, esi
add ecx, ebp
mov eax, edi
adc eax, dword [esp + 0x2c]
cmp eax, dword [esp + 0x14]
ja 0x425111
jb 0x4250db
cmp ecx, dword [esp + 0x10]
ja 0x425111
push 0
push 0
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x425111
push 0x28
call fcn.00450bec
add esp, 4
test eax, eax
je 0x425118
mov edx, dword [esp + 0x2c]
push edx
push ebp
push edi
push esi
mov edx, ebx
call fcn.00425030
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x425510
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov ecx, dword [ebp + 0x10]
push ebx
push esi
xor eax, eax
push edi
mov edi, dword [ebp + 8]
mov dword [ecx], eax
xor edx, edx
lea ebx, [edi + 0x21c]
mov word [ebx], dx
mov dword [edi + 0x430], 0xffffffff
mov dword [edi + 0x428], eax
mov dword [edi + 0x424], eax
mov byte [edi + 0x42c], al
cmp dword [ebp + 0x14], eax
jne 0x425614
mov esi, dword [ebp + 0xc]
push esi
mov eax, edi
call fcn.004257a0
test eax, eax
jne 0x4256d5
cmp word [ebx], ax
je 0x425614
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x425575
mov ecx, dword [edi + 0x218]
sub eax, edx
sar eax, 1
inc eax
lea edx, [ecx + eax]
cmp edx, 0x104
jg 0x4256d0
push eax
lea eax, [edi + ecx*2 + 0x10]
push ebx
push eax
call fcn.005241a2
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
lea ebx, [edi + 0x434]
push ebx
push 0x104
lea edx, [edi + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
je 0x4256d0
cmp eax, 0x104
ja 0x4256d0
push esi
call fcn.00425910
test eax, eax
jne 0x4256d5
push esi
call fcn.00425870
test eax, eax
jne 0x4256d5
push esi
mov esi, edi
call fcn.004259b0
test eax, eax
jne 0x4256d5
cmp byte [edi + 0x42c], al
je 0x42561f
push eax
push ebx
push eax
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [esp + 0xc], 0
je 0x4256d0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x425652
test al, 0x10
jne 0x42566e
test al, 1
je 0x425649
and eax, 0xfffffffe
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x42566e
mov eax, dword [esp + 0xc]
movzx esi, word [eax]
xor ecx, ecx
push ecx
push ebx
push ecx
mov word [eax], cx
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov edx, dword [esp + 0xc]
mov word [edx], si
mov eax, ebx
call fcn.00425ae0
mov esi, eax
test esi, esi
jne 0x425698
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x4256d5
and eax, 0xffff
or eax, 0x80070000
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [esi]
mov ecx, dword [eax + 4]
push esi
call ecx
mov edx, dword [esi]
mov eax, dword [edx + 4]
push esi
call eax
mov eax, dword [edi + 0x63c]
test eax, eax
je 0x4256ba
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x63c], esi
mov dword [eax], esi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, 0x80004005
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x42fa30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x54dd23
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5b0630]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov eax, 7
xor edi, edi
xor ecx, ecx
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], edi
mov word [esi + 4], cx
mov dword [esp + 0x14], edi
xor edx, edx
mov dword [esi + 0x34], eax
mov dword [esi + 0x30], edi
mov word [esi + 0x20], dx
mov byte [esp + 0x14], 1
push 4
mov dword [esi + 0x5c], edi
call fcn.00450bec
add esp, 4
cmp eax, edi
je 0x42fa93
mov dword [eax], edi
jmp 0x42fa95
xor eax, eax
push 0xc
mov dword [esi + 0x60], eax
call fcn.00450bec
add esp, 4
cmp eax, edi
je 0x42fab0
mov dword [eax + 8], edi
mov dword [eax + 4], edi
mov dword [eax], edi
jmp 0x42fab2
xor eax, eax
push edi
mov ecx, esi
mov dword [esi + 0x64], eax
mov dword [esi + 0x58], edi
call fcn.00444350
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x441190
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x54dd23
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5b0630]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov eax, 7
xor edi, edi
xor ecx, ecx
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], edi
mov word [esi + 4], cx
mov dword [esp + 0x14], edi
xor edx, edx
mov dword [esi + 0x34], eax
mov dword [esi + 0x30], edi
mov word [esi + 0x20], dx
mov byte [esp + 0x14], 1
push 4
mov dword [esi + 0x5c], edi
call fcn.00450bec
add esp, 4
cmp eax, edi
je 0x4411f3
mov dword [eax], edi
jmp 0x4411f5
xor eax, eax
push 0xc
mov dword [esi + 0x60], eax
call fcn.00450bec
add esp, 4
cmp eax, edi
je 0x441210
mov dword [eax + 8], edi
mov dword [eax + 4], edi
mov dword [eax], edi
jmp 0x441212
xor eax, eax
mov dword [esi + 0x64], eax
mov eax, dword [esp + 0x20]
push eax
mov ecx, esi
mov dword [esi + 0x58], edi
call fcn.00444350
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 8
Function at 0x442be0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov esi, eax
mov eax, dword [esi]
mov ecx, dword [esi + 8]
push eax
push 1
push ecx
push edi
call fcn.00529a1a
mov ecx, dword [esi + 8]
add esp, 0x10
cmp eax, 1
mov eax, ecx
sete bl
cdq
idiv dword [esi + 0x18]
mov byte [esp + 0x12], bl
mov dword [esi + 0x1c], eax
test bl, bl
je 0x442d59
add dword [esi + 0x14], ecx
cmp dword [esi + 0x54], 8
push 0xffffffffffffffff
push eax
push 0x18
push ecx
mov ecx, esp
jb 0x442c33
mov eax, dword [esi + 0x40]
jmp 0x442c36
lea eax, [esi + 0x40]
mov dword [ecx], eax
push ecx
mov eax, esp
mov dword [eax], str.read
lea eax, [esi + 0x20]
push eax
mov dword [esp + 0x2c], eax
call fcn.00441290
mov ecx, dword [esi + 0x18]
mov ebx, dword [esi + 0x1c]
add esp, 0x18
xor ebp, ebp
xor eax, eax
cmp ecx, 1
sete byte [esp + 0x13]
test ebx, ebx
je 0x442cf4
xor edx, edx
dec ebx
cmp byte [esp + 0x13], dl
je 0x442c78
cmp byte [edi], dl
jmp 0x442c7c
cmp word [edi], 0
sete dl
test edx, edx
je 0x442ca6
test eax, eax
je 0x442c9f
cmp edi, eax
je 0x442c9f
imul ecx, ebp
mov edx, edi
sub edx, eax
push edx
push eax
sub eax, ecx
push eax
call fcn.005283c0
add esp, 0xc
mov ecx, dword [esi + 0x18]
lea eax, [ecx + edi]
inc ebp
add edi, ecx
test ebx, ebx
jne 0x442c6b
test eax, eax
je 0x442cc9
cmp edi, eax
je 0x442cc9
mov ecx, dword [esi + 0x18]
imul ecx, ebp
sub edi, eax
push edi
push eax
sub eax, ecx
push eax
call fcn.005283c0
add esp, 0xc
test ebp, ebp
je 0x442cf4
mov edx, dword [esp + 0x14]
push 0xffffffffffffffff
push ebp
push 1
push ecx
mov eax, esp
push ecx
mov dword [eax], 0
mov eax, esp
push edx
mov dword [eax], str.nulls_removed
call fcn.00441290
add esp, 0x18
sub dword [esi + 0x1c], ebp
cmp dword [esi + 0x18], 1
jle 0x442d4b
test byte [esi + 4], 0x80
je 0x442d4b
mov esi, dword [esi + 0x1c]
test esi, esi
je 0x442d26
jmp 0x442d10
mov ecx, dword [esp + 0x1c]
movzx eax, word [ecx + esi*2 - 2]
dec esi
rol ax, 8
mov word [ecx + esi*2], ax
test esi, esi
jne 0x442d10
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push ecx
mov eax, esp
mov dword [eax], 0
push ecx
mov eax, esp
mov dword [eax], str.endian_swap
mov eax, dword [esp + 0x28]
push eax
call fcn.00441290
add esp, 0x18
mov al, byte [esp + 0x12]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
push esi
call fcn.00442620
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 8
ret 4
Function at 0x443260
Capabilities:
Write file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, eax
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
imul ecx, eax
push edi
mov dword [esi + 8], ecx
test ebp, ebp
jne 0x44327c
mov ebp, edx
mov ecx, dword [esi + 4]
xor edi, edi
test cl, cl
jns 0x4432f6
test edx, edx
jne 0x4432b5
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00450c26
mov edi, eax
mov eax, dword [esi + 0x1c]
add eax, eax
push eax
push ebp
push edi
call fcn.00524680
add esp, 0x10
mov edx, edi
mov ebp, edi
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x4432d2
lea esp, [esp]
movzx ecx, word [edx + eax*2 - 2]
dec eax
rol cx, 8
mov word [edx + eax*2], cx
test eax, eax
jne 0x4432c0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push ecx
mov eax, esp
push ecx
mov dword [eax], 0
mov eax, esp
lea ecx, [esi + 0x20]
push ecx
mov dword [eax], str.endian_swap
call fcn.00441290
add esp, 0x18
mov edx, dword [esi]
mov eax, dword [esi + 8]
push edx
push 1
push eax
push ebp
call fcn.0052a3a4
add esp, 0x10
cmp eax, 1
sete bl
test edi, edi
je 0x44331b
push edi
call fcn.00450c1b
add esp, 4
test bl, bl
je 0x44335e
mov edx, dword [esi + 0x1c]
mov ecx, dword [esi + 8]
add dword [esi + 0x14], ecx
cmp dword [esi + 0x54], 8
push 0xffffffffffffffff
push edx
push 0x18
push ecx
mov ecx, esp
jb 0x44333b
mov eax, dword [esi + 0x40]
jmp 0x44333e
lea eax, [esi + 0x40]
push ecx
mov dword [ecx], eax
mov eax, esp
add esi, 0x20
push esi
mov dword [eax], str.write
call fcn.00441290
add esp, 0x18
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
ret 4
push esi
call fcn.00442620
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
ret 4
Function at 0x444660
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x54a189
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5b0630]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
xor esi, esi
mov dword [esp + 0x18], esi
lea edi, [ebp + 4]
xor eax, eax
mov dword [ebp + 0x18], 7
mov dword [ebp + 0x14], esi
mov dword [esp + 0x1c], ebp
mov word [edi], ax
mov dword [esp + 0x28], esi
mov eax, dword [esp + 0x34]
mov dword [esp + 0x18], 1
mov ebx, eax
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x4446c0
sub eax, edx
mov esi, dword [ebp + 0x14]
sar eax, 1
mov ecx, eax
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea eax, [ecx + eax + 7]
cmp esi, eax
ja 0x444711
cmp dword [ebp + 0x18], eax
je 0x444711
push 1
push eax
mov ecx, ebp
call fcn.0040c830
test al, al
je 0x444711
cmp dword [ebp + 0x18], 8
mov dword [ebp + 0x14], esi
jb 0x44470b
mov edi, dword [edi]
xor ecx, ecx
mov word [edi + esi*2], cx
movzx eax, word [ebx]
test ax, ax
je 0x44482b
mov esi, dword [esp + 0x38]
and esi, 0x100
mov dword [esp + 0x14], esi
test esi, esi
je 0x444748
lea edx, [eax - 0x22]
cmp dx, 0x1c
ja 0x444811
movzx ecx, ax
movsx edi, byte [ecx + 0x58ee0e]
jmp 0x44475f
lea edx, [eax - 0x26]
cmp dx, 0x18
ja 0x444811
movzx ecx, ax
movsx edi, byte [ecx + 0x58ee2a]
test edi, edi
je 0x444811
test byte [esp + 0x38], 8
je 0x4447e7
cmp ax, 0x26
jne 0x4447e7
movzx eax, word [ebx + 2]
lea esi, [ebx + 2]
lea edx, [eax - 0x23]
cmp dx, 0x57
ja 0x444792
movzx ecx, ax
movsx ecx, byte [ecx + 0x58ee4d]
test ecx, ecx
jne 0x444798
cmp ax, 0x7f
jbe 0x4447e7
movzx eax, word [esi + 2]
add esi, 2
cmp ax, 0x3b
je 0x4447cf
lea edx, [eax - 0x2d]
cmp dx, 0x4d
ja 0x4447bc
movzx ecx, ax
movsx ecx, byte [ecx + 0x58eea3]
test ecx, ecx
jne 0x4447c2
cmp ax, 0x7f
jbe 0x4447e7
movzx eax, word [esi + 2]
add esi, 2
cmp ax, 0x3b
jne 0x4447a5
mov eax, esi
sub eax, ebx
sar eax, 1
inc eax
push eax
push ebx
mov ecx, ebp
call fcn.0040c550
mov ebx, esi
mov esi, dword [esp + 0x14]
jmp 0x44481b
mov edx, dword [edi*4 + 0x5b2ec4]
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4447f3
sub eax, esi
sar eax, 1
push eax
push edx
mov ecx, ebp
call fcn.0040c550
mov esi, dword [esp + 0x14]
jmp 0x44481b
push 1
push ebx
mov ecx, ebp
call fcn.0040c550
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
jne 0x44472b
mov eax, ebp
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x446de0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
cmp byte [0x5b8529], 0
je 0x446df8
cmp byte [esp + 4], 0
jne 0x446df8
mov eax, 0x11
ret 4
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [edi + 8], eax
test eax, eax
jge 0x446e0c
xor eax, eax
ret 4
push esi
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
jge 0x446e30
cmp eax, 0x80010119
jne 0x446e8d
lea esi, [edi + 4]
push esi
push 0x588eb8
push 1
push 0
push 0x588f88
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x446e87
mov eax, dword [esi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push edi
push 0
push 0
push 0
push 0
push 0
push 0
push 0x58fc40
push eax
call edx
test eax, eax
jl 0x446e87
mov eax, dword [edi]
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push eax
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jge 0x446e8d
xor eax, eax
pop esi
ret 4
mov byte [0x5b8529], 1
mov eax, 1
pop esi
ret 4