joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45c880
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a8c86
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x4db06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
push esi
call dword [sym.imp.KERNEL30.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x45c9bb
and eax, 0x11
cmp al, 0x11
jne 0x45c9bb
mov dword [ebp - 0x220], 0
lea eax, [ebp - 0x220]
mov dword [ebp - 4], 0
push eax
push 0x4ab44c
push 1
push 0
push 0x4ab48c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x45c903
xor esi, esi
jmp 0x45c9a0
mov dword [ebp - 0x21c], 0
mov byte [ebp - 4], 2
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 0x220]
push edx
push 0x4ab4cc
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
js 0x45c980
mov eax, dword [ebp - 0x21c]
push 0
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
test eax, eax
js 0x45c980
mov eax, dword [ebp - 0x220]
lea ecx, [ebp - 0x218]
push 2
push 0
push 0x104
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0xc]
test eax, eax
js 0x45c980
push SysReAllocString
push 0x4c1430
lea edx, [ebp - 0x218]
mov ecx, edi
call fcn.00462880
add esp, 8
mov esi, 1
jmp 0x45c982
xor esi, esi
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x45c9a0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x21c], 0
mov dword [ebp - 4], 0xa
mov ecx, dword [ebp - 0x220]
test ecx, ecx
je 0x45c9b7
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
mov eax, esi
jmp 0x45c9bd
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00487555
mov esp, ebp
pop ebp
ret
Function at 0x45ca10
Capabilities:
Get session user name
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x518
mov eax, dword [0x4db06c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
push esi
push edi
mov dword [ebp - 0x508], edx
mov edi, dword [eax]
mov eax, dword [0x4f3ed0]
mov dword [ebp - 0x518], ecx
cmp eax, dword [edi + 4]
jle 0x45ca7d
push 0x4f3ed0
call fcn.00487731
add esp, 4
cmp dword [0x4f3ed0], 0xffffffff
jne 0x45ca7d
push 2
push 8
push 0x4f3ee4
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
push 0x4f3ed0
mov dword [0x4f3ed8], eax
call fcn.004876e7
add esp, 4
xor eax, eax
mov esi, 0x4f3ee4
cmp dword [0x4f3ed8], eax
cmove esi, eax
cmp dword [ebp - 0x508], eax
je 0x45cbce
mov eax, dword [0x4f3ee0]
cmp eax, dword [edi + 4]
jle 0x45cbc4
push 0x4f3ee0
call fcn.00487731
add esp, 4
cmp dword [0x4f3ee0], 0xffffffff
jne 0x45cbc4
push 0x100
lea eax, [ebp - 0x104]
mov dword [ebp - 0x514], 0x200
push 0
push eax
call fcn.0048b570
push 0x100
lea eax, [ebp - 0x304]
push 0
push eax
call fcn.0048b570
push 0x100
lea eax, [ebp - 0x204]
push 0
push eax
call fcn.0048b570
add esp, 0x24
mov dword [ebp - 0x508], 0x80
lea eax, [ebp - 0x508]
mov dword [ebp - 0x510], 0x80
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x45cbaf
lea eax, [ebp - 0x50c]
mov dword [ebp - 0x50c], 1
push eax
lea eax, [ebp - 0x510]
push eax
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x514]
push eax
lea eax, [ebp - 0x504]
push eax
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x304]
push eax
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x45cbaf
push 0x200
call fcn.0049143e
add esp, 4
mov edi, eax
push 2
push 0x200
push edi
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
lea eax, [ebp - 0x504]
push eax
push 0x10000000
push 2
push edi
call dword [sym.imp.ADVAPI32.dll_AddAccessAllowedAce]
jmp 0x45cbb1
xor edi, edi
push 0x4f3ee0
mov dword [0x4f3edc], edi
call fcn.004876e7
add esp, 4
mov eax, dword [0x4f3edc]
test eax, eax
cmovne esi, eax
test esi, esi
jne 0x45cbe4
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00487555
mov esp, ebp
pop ebp
ret
push 0
push esi
push 0
push 0
push 0x20000004
push 1
push dword [ebp - 0x518]
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov ecx, dword [ebp - 4]
neg eax
pop edi
sbb eax, eax
xor ecx, ebp
inc eax
pop esi
call fcn.00487555
mov esp, ebp
pop ebp
ret
Function at 0x45cd40
Capabilities:
Delete directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [sym.imp.KERNEL30.dll_RemoveDirectoryW]
mov ebx, edx
push edi
mov edi, ecx
push edi
call esi
test eax, eax
jne 0x45ceef
test ebx, ebx
je 0x45cee6
call dword [sym.imp.KERNEL30.dll_GetLastError]
mov dword [ebp - 4], eax
cmp eax, 0x91
je 0x45cd7b
cmp eax, 5
jne 0x45cd8d
mov ecx, edi
call fcn.0045cc20
test eax, eax
jne 0x45ceef
mov eax, dword [ebp - 4]
test bl, 4
je 0x45ce41
cmp eax, 0x91
jne 0x45ce41
push 3
push 1
push edi
call dword [sym.imp.KERNEL30.dll_FindFirstChangeNotificationW]
mov esi, eax
mov eax, dword [sym.imp.KERNEL30.dll_RemoveDirectoryW]
push edi
call eax
cmp esi, 0xffffffff
jne 0x45cdbf
mov edi, eax
jmp 0x45ce28
test eax, eax
jne 0x45ce23
xor ebx, ebx
mov dword [ebp - 4], ebx
nop dword [eax + eax]
push 0x64
push esi
call dword [sym.imp.KERNEL30.dll_WaitForSingleObject]
push edi
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL30.dll_RemoveDirectoryW]
test eax, eax
jne 0x45ce23
call dword [sym.imp.KERNEL30.dll_GetLastError]
cmp eax, 0x91
jne 0x45ce18
cmp dword [ebp - 8], 0x102
jne 0x45ce05
inc ebx
cmp ebx, 1
jae 0x45ce18
jmp 0x45ce0c
push esi
call dword [sym.imp.KERNEL30.dll_FindNextChangeNotification]
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp eax, 0xa
jl 0x45cdd0
push edi
call dword [sym.imp.KERNEL30.dll_RemoveDirectoryW]
mov edi, eax
jmp 0x45ce28
mov edi, 1
test esi, esi
je 0x45ce38
cmp esi, 0xffffffff
je 0x45ce38
push esi
call dword [sym.imp.KERNEL30.dll_FindCloseChangeNotification]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 5
jne 0x45cee6
test bl, 1
je 0x45ce80
xor edx, edx
mov ecx, edi
and ebx, 0xfffffffe
call fcn.0045ca10
push edi
call esi
test eax, eax
jne 0x45ceef
mov ecx, edi
call fcn.0045cc20
test eax, eax
jne 0x45ceef
test ebx, ebx
je 0x45cee6
call dword [sym.imp.KERNEL30.dll_GetLastError]
cmp eax, 5
jne 0x45cee6
test bl, 2
je 0x45ceb5
mov edx, 1
mov ecx, edi
and ebx, 0xfffffffd
call fcn.0045ca10
push edi
call esi
test eax, eax
jne 0x45ceef
mov ecx, edi
call fcn.0045cc20
test eax, eax
jne 0x45ceef
test ebx, ebx
je 0x45cee6
call dword [sym.imp.KERNEL30.dll_GetLastError]
cmp eax, 5
jne 0x45cee6
test ebx, 0x100
je 0x45cee6
push 0x10
push edi
call dword [sym.imp.KERNEL30.dll_SetFileAttributesW]
push edi
call esi
test eax, eax
jne 0x45ceef
mov ecx, edi
call fcn.0045cc20
test eax, eax
jne 0x45ceef
test ebx, 0xfffffeff
je 0x45cee6
call dword [sym.imp.KERNEL30.dll_GetLastError]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45cf00
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
push esi
call dword [sym.imp.KERNEL30.dll_DeleteFileW]
test eax, eax
jne 0x45cfe3
mov ecx, esi
call fcn.0045cc20
test eax, eax
jne 0x45cfe3
test ebx, ebx
je 0x45cfdd
mov edi, dword [sym.imp.KERNEL30.dll_GetLastError]
call edi
cmp eax, 5
jne 0x45cfdd
test bl, 1
je 0x45cf74
xor edx, edx
mov ecx, esi
and ebx, 0xfffffffe
call fcn.0045ca10
push esi
call dword [sym.imp.KERNEL30.dll_DeleteFileW]
test eax, eax
jne 0x45cfe3
mov ecx, esi
call fcn.0045cc20
test eax, eax
jne 0x45cfe3
test ebx, ebx
je 0x45cfdd
call edi
cmp eax, 5
jne 0x45cfdd
test bl, 2
je 0x45cfa9
mov edx, 1
mov ecx, esi
and ebx, 0xfffffffd
call fcn.0045ca10
push esi
call dword [sym.imp.KERNEL30.dll_DeleteFileW]
test eax, eax
jne 0x45cfe3
mov ecx, esi
call fcn.0045cc20
test eax, eax
jne 0x45cfe3
test ebx, ebx
je 0x45cfdd
call edi
cmp eax, 5
jne 0x45cfdd
test ebx, 0x100
je 0x45cfdd
push 0x80
push esi
call dword [sym.imp.KERNEL30.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL30.dll_DeleteFileW]
test eax, eax
jne 0x45cfe3
mov ecx, esi
call fcn.0045cc20
test eax, eax
jne 0x45cfe3
test ebx, 0xfffffeff
je 0x45cfdd
call edi
pop edi
pop esi
xor eax, eax
pop ebx
ret
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x45cff0
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push 0
push dword [ebp + 0x14]
mov eax, edx
mov esi, ecx
push dword [ebp + 0x10]
mov dword [ebp - 4], eax
push 0
push dword [ebp + 8]
push eax
push esi
call dword [sym.imp.KERNEL30.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x45d17b
push ebx
mov ebx, dword [ebp + 0x1c]
push edi
test ebx, ebx
je 0x45d176
mov edi, dword [sym.imp.KERNEL30.dll_GetLastError]
call edi
cmp eax, 5
jne 0x45d176
test bl, 1
je 0x45d07e
xor edx, edx
mov ecx, esi
and ebx, 0xfffffffe
call fcn.0045ca10
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0
push dword [ebp + 8]
push dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL30.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x45d179
test ebx, ebx
je 0x45d176
call edi
cmp eax, 5
jne 0x45d176
test bl, 2
je 0x45d0c5
mov edx, 1
mov ecx, esi
and ebx, 0xfffffffd
call fcn.0045ca10
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0
push dword [ebp + 8]
push dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL30.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x45d179
test ebx, ebx
je 0x45d176
call edi
cmp eax, 5
jne 0x45d176
test ebx, 0x100
je 0x45d176
and ebx, 0xfffffeff
mov dword [ebp - 8], 0
mov eax, ebx
mov dword [ebp + 0x1c], ebx
and eax, 0x200
mov dword [ebp - 0x10], eax
je 0x45d0f7
push esi
call dword [sym.imp.KERNEL30.dll_GetFileAttributesW]
mov dword [ebp - 8], eax
mov eax, ebx
and eax, 0x400
or eax, 0x200
shr eax, 9
xor ebx, ebx
mov dword [ebp - 0xc], eax
nop dword [eax + eax]
push 0x80
push esi
call dword [sym.imp.KERNEL30.dll_SetFileAttributesW]
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0
push dword [ebp + 8]
push dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL30.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x45d14b
call dword [sym.imp.KERNEL30.dll_GetLastError]
cmp eax, 5
jne 0x45d14b
inc ebx
cmp ebx, dword [ebp - 0xc]
jl 0x45d110
cmp dword [ebp - 0x10], 0
mov ebx, dword [ebp + 0x1c]
je 0x45d15e
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL30.dll_SetFileAttributesW]
cmp edi, 0xffffffff
je 0x45d16c
mov eax, edi
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x45d176
call dword [sym.imp.KERNEL30.dll_GetLastError]
or eax, 0xffffffff
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x45ee70
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
mov esi, dword [sym.imp.KERNEL30.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 0x20
push fcn.00487992
mov dword [ebp - 8], fcn.00487992
mov dword [ebp - 0xc], 0x20
mov dword [ebp - 4], 0
call esi
test eax, eax
je 0x45eee9
lea eax, [ebp - 8]
mov dword [ebp - 0x18], eax
lea edx, [ebp - 0x18]
lea eax, [ebp - 0xc]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x28]
lea eax, [ebp - 4]
mov dword [ebp - 0x10], eax
call fcn.0045ef60
cmp byte [ebp - 0x1c], 0
mov ecx, 0x90909090
mov eax, dword [ebp - 8]
mov dword [eax + 5], ecx
mov word [eax + 9], cx
je 0x45eee9
mov eax, dword [ebp - 0x20]
push eax
push dword [eax]
mov eax, dword [ebp - 0x24]
push dword [eax]
mov eax, dword [ebp - 0x28]
push dword [eax]
call esi
lea eax, [ebp - 8]
mov dword [ebp - 4], fcn.004879ba
push eax
push 0x40
push 0x20
push fcn.004879ba
mov dword [ebp - 0xc], 0x20
mov dword [ebp - 8], 0
call esi
test eax, eax
je 0x45ef5b
lea eax, [ebp - 4]
mov dword [ebp - 0x18], eax
lea edx, [ebp - 0x18]
lea eax, [ebp - 0xc]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x28]
lea eax, [ebp - 8]
mov dword [ebp - 0x10], eax
call fcn.0045ef60
cmp byte [ebp - 0x1c], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 0x90909090
mov dword [eax + 0x14], 0x90909090
mov byte [eax + 0x18], 0x90
je 0x45ef5b
mov eax, dword [ebp - 0x20]
push eax
push dword [eax]
mov eax, dword [ebp - 0x24]
push dword [eax]
mov eax, dword [ebp - 0x28]
push dword [eax]
call esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x45ef80
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, ecx
push edi
push 0x104
call dword [sym.imp.KERNEL30.dll_GetTempPathW]
test eax, eax
je 0x45f017
push SysReAllocString
push 0x4bb2b4
xor edx, edx
mov ecx, edi
call fcn.00462880
mov ebx, dword [sym.imp.KERNEL30.dll_GetLastError]
mov ecx, 0x104
add esp, 8
xor esi, esi
sub ecx, eax
lea eax, [edi + eax*2]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
nop dword [eax]
mov edx, 8
lea ecx, [ebp - 0x10]
call fcn.00465a50
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 0x4cd390
push str._s__llx
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00462ec0
add esp, 0x18
push 0
push edi
call dword [sym.imp.KERNEL30.dll_CreateDirectoryW]
test eax, eax
jne 0x45f020
call ebx
cmp eax, 0xb7
jne 0x45f017
inc esi
cmp esi, 0x64
jl 0x45efd0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45f030
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
mov eax, dword [0x4db06c]
xor eax, esp
mov dword [esp + 0x218], eax
push ebx
push esi
mov esi, ecx
mov edx, 8
push edi
lea ecx, [esp + 0x10]
call fcn.00465a50
push SysReAllocString
push dword [esp + 0x18]
push dword [esp + 0x18]
push str.tlib__llx
call fcn.00463290
add esp, 0xc
lea ecx, [esp + 0x1c]
mov edx, esi
push eax
call fcn.00462880
add esp, 8
lea eax, [esp + 0x18]
push 0
push 0x80
push 2
push 0
push 7
push 0x40000000
push eax
call dword [sym.imp.KERNEL30.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x45f0c1
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.00487555
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x45f0ce
push esi
call dword [sym.imp.KERNEL30.dll_CloseHandle]
xor esi, esi
mov ebx, dword [sym.imp.KERNEL30.dll_Sleep]
xor edi, edi
nop word [eax + eax]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL30.dll_DeleteFileW]
test eax, eax
jne 0x45f0fc
push 0xc8
call ebx
inc edi
cmp edi, 0xa
jl 0x45f0e0
test esi, esi
je 0x45f10c
cmp esi, 0xffffffff
je 0x45f10c
push esi
call dword [sym.imp.KERNEL30.dll_CloseHandle]
mov ecx, dword [esp + 0x224]
mov eax, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00487555
mov esp, ebp
pop ebp
ret
Function at 0x45f230
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a6788
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4db06c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x4dbd44], 0xffffffff
jne 0x45f26e
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL30.dll_GetStdHandle]
mov dword [0x4dbd44], eax
xor edx, edx
call fcn.0045f6a0
movzx ebx, al
xor edx, edx
lea eax, [ebp + 0xc]
xor ecx, ecx
push eax
push dword [ebp + 8]
call fcn.00462e60
mov esi, eax
add esp, 8
mov edi, 0
mov dword [ebp - 0x28], edi
add esi, 1
je 0x45f2ae
lea eax, [esi + 1]
push eax
call fcn.00487989
mov edi, eax
add esp, 4
mov dword [ebp - 0x28], edi
mov byte [edi], 0
lea eax, [ebp + 0xc]
mov dword [ebp - 4], 0
push eax
push dword [ebp + 8]
mov edx, esi
mov dword [ebp - 0x24], 0xffffffff
mov ecx, edi
call fcn.00462e60
mov esi, eax
add esp, 8
mov dword [ebp - 0x18], esi
mov eax, 1
test ebx, ebx
jne 0x45f378
test edi, edi
mov dword [ebp - 0x20], ebx
mov ecx, 0x4c1430
mov dword [ebp - 0x1c], 0xffffffff
cmovne ecx, edi
push ebx
push ecx
lea ecx, [ebp - 0x20]
call fcn.00411ee0
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
test ecx, ecx
jns 0x45f32f
test esi, esi
jne 0x45f314
xor ecx, ecx
mov dword [ebp - 0x14], ecx
jmp 0x45f338
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45f320
sub ecx, edx
sar ecx, 1
mov dword [ebp - 0x14], ecx
mov eax, esi
test esi, esi
jne 0x45f33d
mov eax, 0x4c1430
push 0
lea edx, [ebp - 0x14]
push edx
push ecx
push eax
push dword [0x4dbd44]
call dword [sym.imp.KERNEL30.dll_WriteConsoleW]
test eax, eax
mov eax, 1
cmove ebx, eax
test esi, esi
je 0x45f36d
push esi
call fcn.00487954
add esp, 4
mov eax, 1
mov esi, dword [ebp - 0x18]
test ebx, ebx
je 0x45f406
mov edx, eax
call fcn.0045f6a0
test al, al
je 0x45f3d2
lea eax, [esi*2 + 1]
mov dword [ebp - 0x14], eax
inc eax
push eax
call fcn.00487989
mov esi, eax
test edi, edi
mov ecx, 0x4c1430
mov edx, esi
cmovne ecx, edi
mov byte [esi], 0
push dword [ebp - 0x14]
call fcn.0045fa70
add esp, 8
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x14]
push 0
push ecx
push eax
push esi
push dword [0x4dbd44]
call dword [sym.imp.KERNEL30.dll_WriteFile]
push esi
call fcn.00487954
add esp, 4
jmp 0x45f406
test edi, edi
jne 0x45f3df
xor ecx, ecx
mov eax, 0x4c1430
jmp 0x45f3ef
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x45f3e4
sub ecx, edx
mov eax, edi
push 0
lea edx, [ebp - 0x18]
mov dword [ebp - 0x18], ecx
push edx
push ecx
push eax
push dword [0x4dbd44]
call dword [sym.imp.KERNEL30.dll_WriteFile]
test edi, edi
je 0x45f413
push edi
call fcn.00487954
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45f430
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a8e40
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x4db06c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x4dbd44], 0xffffffff
jne 0x45f46e
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL30.dll_GetStdHandle]
mov dword [0x4dbd44], eax
xor edx, edx
call fcn.0045f6a0
movzx ebx, al
xor edx, edx
lea eax, [ebp + 0xc]
xor ecx, ecx
push eax
push dword [ebp + 8]
call fcn.00462ee0
mov esi, eax
add esp, 8
mov edi, 0
mov dword [ebp - 0x18], edi
add esi, 1
je 0x45f4c0
xor ecx, ecx
lea eax, [esi + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00487989
mov edi, eax
add esp, 4
xor eax, eax
mov dword [ebp - 0x18], edi
mov word [edi], ax
lea eax, [ebp + 0xc]
mov dword [ebp - 4], 0
push eax
push dword [ebp + 8]
mov edx, esi
mov dword [ebp - 0x14], 0xffffffff
mov ecx, edi
call fcn.00462ee0
add esp, 8
test ebx, ebx
jne 0x45f52e
test edi, edi
jne 0x45f4f2
xor ecx, ecx
mov eax, 0x4c1430
jmp 0x45f50b
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45f4f7
sub ecx, edx
mov eax, edi
sar ecx, 1
mov dword [ebp - 0x14], ecx
push 0
lea edx, [ebp - 0x10]
mov dword [ebp - 0x10], ecx
push edx
push ecx
push eax
push dword [0x4dbd44]
call dword [sym.imp.KERNEL30.dll_WriteConsoleW]
test eax, eax
je 0x45f52e
test ebx, ebx
je 0x45f621
mov edx, 1
call fcn.0045f6a0
mov ecx, 0x4c1430
test al, al
je 0x45f5d4
test edi, edi
mov dword [ebp - 0x1c], 0xffffffff
cmovne ecx, edi
test ecx, ecx
je 0x45f55e
call fcn.00463750
mov ebx, eax
jmp 0x45f560
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov byte [ebp - 4], 1
test ebx, ebx
jne 0x45f56f
xor ecx, ecx
jmp 0x45f580
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x45f574
sub ecx, edx
mov dword [ebp - 0x1c], ecx
lea eax, [ecx*2 + 1]
mov dword [ebp - 0x10], eax
inc eax
push eax
call fcn.00487989
mov esi, eax
test ebx, ebx
mov ecx, 0x4c1430
mov edx, esi
cmovne ecx, ebx
mov byte [esi], 0
push dword [ebp - 0x10]
call fcn.0045fa70
add esp, 8
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x10]
push 0
push ecx
push eax
push esi
push dword [0x4dbd44]
call dword [sym.imp.KERNEL30.dll_WriteFile]
push esi
call fcn.00487954
add esp, 4
test ebx, ebx
je 0x45f621
push ebx
jmp 0x45f619
test edi, edi
cmovne ecx, edi
call fcn.00463750
mov esi, eax
test esi, esi
jne 0x45f5ed
xor ecx, ecx
mov eax, 0x4c1430
jmp 0x45f5fd
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x45f5f2
sub ecx, edx
mov eax, esi
push 0
lea edx, [ebp - 0x10]
mov dword [ebp - 0x10], ecx
push edx
push ecx
push eax
push dword [0x4dbd44]
call dword [sym.imp.KERNEL30.dll_WriteFile]
test esi, esi
je 0x45f621
push esi
call fcn.00487954
add esp, 4
test edi, edi
je 0x45f62e
push edi
call fcn.00487954
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45f780
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
call fcn.0045f150
mov ebx, eax
call dword [sym.imp.KERNEL30.dll_GetTickCount]
mov edi, eax
mov eax, 0x10624dd3
sub edi, dword [0x4e04c4]
mul edi
mov esi, edx
shr esi, 6
call dword [sym.imp.KERNEL30.dll_GetCurrentThreadId]
push eax
imul eax, esi, 0x3e8
sub edi, eax
mov eax, 0xcccccccd
mul edi
shr edx, 3
push edx
push esi
push 0x4bb660
push ebx
call fcn.0040e1a0
add esp, 0x14
mov esi, eax
lea eax, [ebp + 0xc]
mov edx, 0xfff
sub edx, esi
push eax
push dword [ebp + 8]
lea ecx, [esi + ebx]
call fcn.00462e60
add esp, 8
add esi, eax
push ebx
call dword [sym.imp.KERNEL30.dll_OutputDebugStringA]
mov eax, dword [0x4dc850]
cmp eax, 0xffffffff
je 0x45f813
push 0
lea ecx, [ebp - 4]
mov dword [ebp - 4], esi
push ecx
push esi
push ebx
push eax
call dword [sym.imp.KERNEL30.dll_WriteConsoleA]
call fcn.0044e540
test eax, eax
je 0x45f825
mov edx, esi
mov ecx, ebx
call fcn.0045f720
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45f830
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
call fcn.0045f150
mov ebx, eax
call dword [sym.imp.KERNEL30.dll_GetTickCount]
mov edi, eax
mov eax, 0x10624dd3
sub edi, dword [0x4e04c4]
mul edi
mov esi, edx
shr esi, 6
call dword [sym.imp.KERNEL30.dll_GetCurrentThreadId]
push eax
imul eax, esi, 0x3e8
sub edi, eax
mov eax, 0xcccccccd
mul edi
shr edx, 3
push edx
push esi
push str._04d._02d:___4x_:
push ebx
call fcn.0040e140
add esp, 0x14
mov edi, eax
lea eax, [ebp + 0xc]
mov ecx, 0x800
sub ecx, edi
push eax
push 0
push dword [ebp + 8]
push ecx
lea ecx, [ebx + edi*2]
push ecx
call fcn.0040e100
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call fcn.0048fbea
add esp, 0x1c
mov esi, eax
push ebx
call dword [sym.imp.KERNEL30.dll_OutputDebugStringW]
mov eax, dword [0x4dc850]
cmp eax, 0xffffffff
je 0x45f8e2
or ecx, 0xffffffff
test esi, esi
push 0
cmovs esi, ecx
lea ecx, [esp + 0x10]
push ecx
add esi, edi
push esi
push ebx
push eax
mov dword [esp + 0x20], esi
call dword [sym.imp.KERNEL30.dll_WriteConsoleW]
call fcn.0044e540
test eax, eax
je 0x45f924
test ebx, ebx
je 0x45f90c
mov ecx, ebx
call fcn.00463750
mov esi, eax
test esi, esi
je 0x45f90e
mov edx, esi
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x45f901
sub edx, ecx
jmp 0x45f910
xor esi, esi
xor edx, edx
mov ecx, esi
call fcn.0045f720
test esi, esi
je 0x45f924
push esi
call fcn.00487954
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret