joyce8/EMBER2024-capa huggingface dataset:
Function at 0x457370
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5003c3
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5355a0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov dword [esi + 4], fcn.004c328d
mov dword [esi + 8], fcn.004c53b2
mov dword [esi + 0xc], fcn.004c31b0
xor edi, edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], 0x1fff8
mov dword [esi], vtable.t_heap.0
mov dword [esp + 0x14], edi
mov eax, 0x40
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
lea eax, [esi + 0x68]
push eax
mov dword [esi + 0x24], 0x1332ba5
mov dword [esi + 0x28], 1
mov dword [esi + 0x34], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
call fcn.004704a0
lea ecx, [esi + 0x80]
push ecx
mov byte [esp + 0x18], 1
call fcn.0045b830
mov dword [esi + 0xb4], edi
mov dword [esi + 0xb8], edi
xor eax, eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0xa0], edi
mov dword [esi + 0xa4], edi
mov dword [esi + 0xa8], edi
mov dword [esi + 0xac], edi
mov dword [esi + 0xb0], edi
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x459a50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x505c51
mov eax, dword fs:[0]
push eax
sub esp, 0x144
mov eax, dword [0x5355a0]
xor eax, esp
mov dword [esp + 0x140], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5355a0]
xor eax, esp
push eax
lea eax, [esp + 0x158]
mov dword fs:[0], eax
mov eax, dword [esp + 0x168]
mov ebp, dword [esp + 0x16c]
mov esi, ecx
mov ecx, dword [0x53d314]
push ecx
lea edx, [esp + 0x20]
xor ebx, ebx
push edx
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [esp + 0x1c], ebx
jne 0x459ace
mov ecx, esi
call fcn.00433db0
push 0x522388
jmp 0x459c4b
cmp ebp, ebx
je 0x459c3f
mov edi, dword [ebp + ebx*4]
mov eax, edi
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x459ae0
sub eax, edx
sar eax, 1
je 0x459c3f
lea ecx, [esp + 0x2c]
call fcn.004349d0
mov eax, edi
lea edx, [esp + 0x2c]
call fcn.00434c20
mov dword [esp + 0x160], 1
cmp byte [esp + 0x148], 0
lea eax, [esp + 0x38]
jne 0x459b26
mov eax, dword [esp + 0x34]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x459bed
shr eax, 4
not al
and al, 1
je 0x459bed
mov dword [esp + 0x160], 0xffffffff
cmp byte [esp + 0x148], 0
mov dword [esp + 0x2c], vtable.t_str.0
jne 0x459b78
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x38]
cmp eax, ecx
je 0x459b78
push eax
call fcn.004c31b0
add esp, 4
inc ebx
cmp ebx, 1
jl 0x459ad6
mov dword [esp + 0x24], vtable.t_mutex::t_locker.0
mov dword [esp + 0x28], 0
push esi
mov edi, 0x538398
mov dword [esp + 0x164], 2
call fcn.0043ac80
test al, al
je 0x459c31
mov dword [esp + 0x28], edi
lea edi, [esp + 0x1b]
mov byte [esp + 0x1b], 0
call fcn.00457a20
mov eax, dword [esp + 0x20]
push eax
push esi
mov ecx, ebp
call fcn.00459520
add esp, 8
mov edi, 0x538398
mov bl, al
mov dword [esp + 0x160], 0xffffffff
call fcn.0043adc0
mov al, bl
jmp 0x459c5c
mov ecx, esi
call fcn.00433db0
push str.invalid_parameter.
push 0x51620c
mov edx, eax
call fcn.004351e0
add esp, 8
cmp byte [esp + 0x148], 0
mov dword [esp + 0x2c], vtable.t_str.0
jne 0x459c5a
mov eax, dword [esp + 0x34]
lea edx, [esp + 0x38]
cmp eax, edx
je 0x459c5a
push eax
call fcn.004c31b0
add esp, 4
jmp 0x459c5a
mov ecx, esi
call fcn.00433db0
push 0x52266c
jmp 0x459c4b
mov ecx, esi
call fcn.00433db0
push str.invalid_parameter.
push 0x51620c
mov edx, eax
call fcn.004351e0
add esp, 8
xor al, al
mov ecx, dword [esp + 0x158]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x140]
xor ecx, esp
call fcn.004c31a1
add esp, 0x150
ret
Function at 0x45a200
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x505c51
mov eax, dword fs:[0]
push eax
sub esp, 0x144
mov eax, dword [0x5355a0]
xor eax, esp
mov dword [esp + 0x140], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5355a0]
xor eax, esp
push eax
lea eax, [esp + 0x158]
mov dword fs:[0], eax
mov eax, dword [esp + 0x168]
mov ebp, dword [esp + 0x16c]
mov esi, ecx
mov ecx, dword [0x53d314]
push ecx
lea edx, [esp + 0x20]
xor ebx, ebx
push edx
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [esp + 0x1c], ebx
jne 0x45a27e
mov ecx, esi
call fcn.00433db0
push 0x522388
jmp 0x45a3f9
cmp ebp, ebx
je 0x45a3ed
mov edi, dword [ebp + ebx*4]
mov eax, edi
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x45a290
sub eax, edx
sar eax, 1
je 0x45a3ed
lea ecx, [esp + 0x2c]
call fcn.004349d0
mov eax, edi
lea edx, [esp + 0x2c]
call fcn.00434c20
mov dword [esp + 0x160], 1
cmp byte [esp + 0x148], 0
lea eax, [esp + 0x38]
jne 0x45a2d6
mov eax, dword [esp + 0x34]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x45a39b
shr eax, 4
not al
and al, 1
je 0x45a39b
mov dword [esp + 0x160], 0xffffffff
cmp byte [esp + 0x148], 0
mov dword [esp + 0x2c], vtable.t_str.0
jne 0x45a328
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x38]
cmp eax, ecx
je 0x45a328
push eax
call fcn.004c31b0
add esp, 4
inc ebx
cmp ebx, 1
jl 0x45a286
mov dword [esp + 0x24], vtable.t_mutex::t_locker.0
mov dword [esp + 0x28], 0
push esi
mov edi, 0x538398
mov dword [esp + 0x164], 2
call fcn.0043ac80
test al, al
je 0x45a3df
mov dword [esp + 0x28], edi
lea edi, [esp + 0x1b]
mov byte [esp + 0x1b], 0
call fcn.00457a20
mov ecx, dword [esp + 0x20]
push ebp
push esi
call fcn.00459c90
add esp, 8
mov edi, 0x538398
mov bl, al
mov dword [esp + 0x160], 0xffffffff
call fcn.0043adc0
mov al, bl
jmp 0x45a40a
mov ecx, esi
call fcn.00433db0
push str.invalid_parameter.
push 0x51620c
mov edx, eax
call fcn.004351e0
add esp, 8
cmp byte [esp + 0x148], 0
mov dword [esp + 0x2c], vtable.t_str.0
jne 0x45a408
mov eax, dword [esp + 0x34]
lea edx, [esp + 0x38]
cmp eax, edx
je 0x45a408
push eax
call fcn.004c31b0
add esp, 4
jmp 0x45a408
mov ecx, esi
call fcn.00433db0
push 0x52266c
jmp 0x45a3f9
mov ecx, esi
call fcn.00433db0
push str.invalid_parameter.
push 0x51620c
mov edx, eax
call fcn.004351e0
add esp, 8
xor al, al
mov ecx, dword [esp + 0x158]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x140]
xor ecx, esp
call fcn.004c31a1
add esp, 0x150
ret
Function at 0x45a690
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x502f28
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5355a0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [0x53d314]
mov ebp, dword [esp + 0x38]
mov esi, ecx
push eax
lea ecx, [esp + 0x20]
xor ebx, ebx
push ecx
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [esp + 0x1c], ebx
jne 0x45a70b
mov ecx, ebp
call fcn.00433db0
push 0x522388
push 0x51620c
mov edx, eax
call fcn.004351e0
add esp, 8
xor al, al
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], vtable.t_lockerMemSharable.0
push ebp
mov edi, 0x537d28
mov dword [esp + 0x34], ebx
call fcn.0043ac80
test al, al
je 0x45a780
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], edi
push eax
mov edi, ebp
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], ebx
call fcn.00457470
add esp, 8
test al, al
jne 0x45a791
mov ecx, ebp
call fcn.00433db0
push 0x5222a8
push 0x51620c
mov edx, eax
call fcn.004351e0
add esp, 8
mov edi, 0x537d28
mov dword [esp + 0x30], 0xffffffff
call fcn.0043adc0
jmp 0x45a6f5
mov ecx, ebp
call fcn.00433db0
push 0x522398
jmp 0x45a6e6
call fcn.0045b210
mov edx, dword [esp + 0x18]
mov edi, eax
mov eax, dword [esp + 0x14]
mov ecx, ebp
call fcn.00462320
test al, al
jne 0x45a7b9
push str.Attach
mov ecx, ebp
call fcn.00402790
jmp 0x45a769
mov edx, dword [esp + 0x3c]
lea ecx, [esp + 0x14]
push ecx
push edx
mov dword [esp + 0x1c], ebx
call fcn.0045b210
mov ecx, ebp
mov ebx, eax
call fcn.00462520
test al, al
jne 0x45a7fb
push 0x522728
mov ecx, ebp
call fcn.00402790
lea esi, [esp + 0x20]
mov dword [esp + 0x30], 0xffffffff
call fcn.00440d00
jmp 0x45a6f5
mov edi, dword [esp + 0x14]
mov eax, dword [edi]
mov ebx, dword [esp + 0x18]
mov dword [esi], eax
mov cx, word [edi + 0x22]
mov word [esi + 0x34], cx
mov dx, word [edi + 0x20]
mov word [esi + 0x36], dx
mov eax, dword [edi + 0x28]
mov dword [esi + 0x40], eax
mov eax, dword [edi + 0x18]
movzx ecx, word [eax + ebx]
add eax, ebx
push ecx
add eax, 2
push eax
lea edx, [esi + 4]
push edx
call fcn.004cab90
mov eax, dword [edi + 0x1c]
add eax, ebx
mov dword [esi + 0x38], eax
mov ecx, dword [eax]
add dword [esi + 0x38], 4
mov dword [esi + 0x3c], ecx
add esp, 0xc
lea esi, [esp + 0x20]
mov dword [esp + 0x30], 0xffffffff
call fcn.00440d00
mov al, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x45ac60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x504f4c
mov eax, dword fs:[0]
push eax
sub esp, 0x148
mov eax, dword [0x5355a0]
xor eax, esp
mov dword [esp + 0x140], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5355a0]
xor eax, esp
push eax
lea eax, [esp + 0x15c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x16c]
mov esi, ecx
test ebp, ebp
je 0x45ae8f
mov eax, ebp
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x45acb1
sub eax, edx
sar eax, 1
je 0x45ae8f
lea ecx, [esp + 0x2c]
call fcn.004349d0
mov eax, ebp
lea edx, [esp + 0x2c]
call fcn.00434c20
mov ebx, 1
mov dword [esp + 0x164], ebx
cmp byte [esp + 0x148], 0
lea eax, [esp + 0x38]
jne 0x45acf8
mov eax, dword [esp + 0x34]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x45ad10
shr eax, 4
not al
and al, bl
jne 0x45ad5f
mov ecx, esi
call fcn.00433db0
push str.invalid_parameter.
push 0x51620c
mov edx, eax
call fcn.004351e0
add esp, 8
cmp byte [esp + 0x148], 0
mov dword [esp + 0x2c], vtable.t_str.0
jne 0x45aeaa
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x38]
cmp eax, ecx
je 0x45aeaa
push eax
call fcn.004c31b0
add esp, 4
jmp 0x45aeaa
mov dword [esp + 0x20], vtable.t_mutex::t_locker.0
mov dword [esp + 0x24], 0
push esi
mov edi, 0x538398
mov byte [esp + 0x168], 2
call fcn.0043ac80
test al, al
je 0x45aded
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], vtable.t_lockerMemSharable.0
lea edx, [esp + 0x18]
push edx
mov eax, esi
mov byte [esp + 0x168], 3
call fcn.00420de0
test al, al
jne 0x45ae17
push 0x522398
mov ecx, esi
call fcn.00402790
lea esi, [esp + 0x18]
mov byte [esp + 0x164], 2
call fcn.00440d00
lea ecx, [esp + 0x20]
mov byte [esp + 0x164], bl
call fcn.0043a930
lea ecx, [esp + 0x2c]
call fcn.00434b70
jmp 0x45aeaa
push 0x52266c
mov ecx, esi
call fcn.00402790
lea ecx, [esp + 0x20]
mov byte [esp + 0x164], bl
call fcn.0043a930
lea ecx, [esp + 0x2c]
call fcn.00434b70
jmp 0x45aeaa
call fcn.00465110
mov edi, eax
mov ecx, esi
test edi, edi
jne 0x45ae2b
push str.invalid_sugg_dict_pointer_
jmp 0x45adb9
lea eax, [esp + 0x18]
push eax
push edi
mov edx, ebp
call fcn.00463960
test al, al
jne 0x45ae46
push 0x5227d8
jmp 0x45adb7
lea ecx, [esp + 0x18]
push ecx
push esi
mov ecx, edi
call fcn.004630d0
test al, al
jne 0x45ae61
push 0x5227f0
jmp 0x45adb7
lea esi, [esp + 0x18]
mov byte [esp + 0x164], 2
call fcn.00440d00
lea ecx, [esp + 0x20]
mov byte [esp + 0x164], bl
call fcn.0043a930
lea ecx, [esp + 0x2c]
call fcn.00434b70
mov al, bl
jmp 0x45aeac
mov ecx, esi
call fcn.00433db0
push str.invalid_parameter.
push 0x51620c
mov edx, eax
call fcn.004351e0
add esp, 8
xor al, al
mov ecx, dword [esp + 0x15c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x140]
xor ecx, esp
call fcn.004c31a1
add esp, 0x154
ret
Function at 0x45d9b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x502ef6
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5355a0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor eax, eax
mov dword [esi + 0x10], 1
mov dword [esi + 0x1c], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov ecx, 0x40
mov dword [esi + 0x14], ecx
mov dword [esi + 0x18], ecx
mov edx, 0x1332ba5
mov dword [esi + 0xc], edx
mov dword [esi + 0x50], fcn.004c328d
mov dword [esi + 0x54], fcn.004c53b2
mov dword [esi + 0x58], fcn.004c31b0
mov dword [esi + 0x5c], eax
mov dword [esi + 0x60], 0x1fff8
mov dword [esi + 0x4c], vtable.t_heap.0
mov dword [esp + 0x14], eax
mov dword [esi + 0x78], eax
mov dword [esi + 0x80], eax
mov dword [esi + 0x7c], eax
mov dword [esi + 0x90], eax
mov dword [esi + 0x94], eax
mov eax, 0x34
mov dword [esi + 0x6c], eax
mov dword [esi + 0x84], eax
mov dword [esi + 0x88], eax
mov dword [esi + 0x8c], eax
lea eax, [esi + 0x98]
push eax
mov dword [esi + 0x64], edx
mov dword [esi + 0x68], 1
mov dword [esi + 0x70], 0x30
mov dword [esi + 0x74], 0xc
call fcn.0046b920
lea ecx, [esi + 0x120]
push ecx
mov byte [esp + 0x18], 1
call fcn.0046aec0
lea edx, [esi + 0x5e4]
push edx
mov byte [esp + 0x18], 2
call fcn.004704a0
lea eax, [esi + 0x5fc]
push eax
mov byte [esp + 0x18], 3
call fcn.004704a0
lea ecx, [esi + 0x614]
push ecx
mov byte [esp + 0x18], 4
call fcn.004704a0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
Function at 0x45daf0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x503ee9
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x5355a0]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, dword [esp + 0x34]
xor edi, edi
mov dword [esi], 0x1332ba5
mov dword [esi + 4], 1
mov dword [esi + 0x14], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0xc], 0x30
mov dword [esi + 0x10], 0xc
mov eax, 0x34
mov dword [esi + 8], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov eax, 0x40
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
lea eax, [esi + 0x74]
push eax
mov dword [esi + 0x34], 0x1332ba5
mov dword [esi + 0x38], 1
mov dword [esi + 0x44], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
call fcn.0046b920
lea ecx, [esi + 0xfc]
push ecx
mov dword [esp + 0x30], edi
call fcn.0046de20
lea edx, [esi + 0x208]
push edx
mov byte [esp + 0x30], 1
call fcn.0045d9b0
lea eax, [esi + 0x83c]
push eax
mov byte [esp + 0x30], 2
call fcn.004704a0
lea ecx, [esi + 0x854]
push ecx
mov byte [esp + 0x30], 3
call fcn.004704a0
lea edx, [esp + 0x10]
push edx
mov dword [esi + 0x86c], edi
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [esi + 0x870]
push eax
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov eax, esi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x24
ret 4
Function at 0x4642f0
Capabilities:
Get file size

Disassembly:
push 0xffffffffffffffff
push 0x503deb
mov eax, dword fs:[0]
push eax
sub esp, 0x364
mov eax, dword [0x5355a0]
xor eax, esp
mov dword [esp + 0x35c], eax
push ebx
push ebp
push esi
mov eax, dword [0x5355a0]
xor eax, esp
push eax
lea eax, [esp + 0x374]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x384]
lea esi, [esp + 0x14]
mov ebx, ecx
call fcn.0043a2a0
xor esi, esi
mov dword [esp + 0x14], vtable.t_fileRead.0
mov dword [esp + method.t_fileRead.1.virtual_0], vtable.t_fileRead.1.0
mov dword [esp + 0x364], esi
mov dword [esp + 0x368], esi
push esi
push edi
lea eax, [esp + 0x1c]
push eax
mov eax, ebx
mov dword [esp + 0x388], esi
call fcn.0043a3e0
test al, al
je 0x4643fc
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push edx
mov dword [esp + 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4643a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
je 0x4643a5
xor eax, eax
jmp 0x4643a7
mov eax, ebx
mov dword [esp + 0x364], eax
sub eax, dword [esp + 0x368]
push eax
call fcn.004c669c
mov ecx, dword [esp + 0x368]
sub ecx, dword [esp + 0x36c]
add esp, 4
push ecx
push eax
push edi
lea ecx, [esp + 0x36c]
mov dword [ebp], eax
call fcn.00441fe0
test al, al
jne 0x464442
mov ebp, dword [ebp]
push ebp
call fcn.004c6691
add esp, 4
mov ecx, edi
call fcn.00433db0
push 0x517c34
jmp 0x464408
mov ecx, edi
call fcn.00433db0
push 0x51f1fc
push 0x51620c
mov edx, eax
call fcn.004351e0
mov dword [esp + 0x384], 0xffffffff
add esp, 8
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], vtable.t_fileRead.0
mov dword [esp + method.t_byteStreamRead.virtual_0], vtable.t_byteStreamRead.0
call fcn.0043a310
xor al, al
jmp 0x464469
mov dword [esp + 0x37c], 0xffffffff
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], vtable.t_fileRead.0
mov dword [esp + method.t_byteStreamRead.virtual_0], vtable.t_byteStreamRead.0
call fcn.0043a310
mov ecx, dword [esp + 0x374]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x35c]
xor ecx, esp
call fcn.004c31a1
add esp, 0x370
ret 4
Function at 0x46b920
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x502c65
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5355a0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
push esi
call fcn.004704a0
lea eax, [esi + 0x18]
xor edi, edi
push eax
mov dword [esp + 0x18], edi
call fcn.004704a0
lea ecx, [esi + 0x30]
push ecx
mov byte [esp + 0x18], 1
call fcn.0046c8e0
mov dword [esi + 0x50], edi
mov eax, 0x34
mov dword [esi + 0x5c], eax
mov dword [esi + 0x74], eax
mov dword [esi + 0x78], eax
mov dword [esi + 0x7c], eax
mov dword [esi + 0x54], 0x1332ba5
mov dword [esi + 0x58], 1
mov dword [esi + 0x68], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0x84], edi
mov dword [esi + 0x60], 0x30
mov dword [esi + 0x64], 0xc
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4

Function at 0x46b9d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x502c65
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5355a0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
lea eax, [esi + 0x30]
push eax
mov dword [esp + 0x18], 1
call fcn.0046c500
mov eax, dword [esi + 0x24]
test eax, eax
je 0x46ba17
push eax
call fcn.004c55cd
add esp, 4
mov eax, dword [esi + 0x18]
push eax
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
call fcn.004c55cd
add esp, 4
push esi
mov dword [esp + 0x18], 0xffffffff
call fcn.00461300
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
Function at 0x471650
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
push eax
mov esi, ecx
call fcn.004801f0
test al, al
jne 0x471715
xor ebx, ebx
cmp byte [esi + 0x11c], bl
je 0x471678
add esi, 0xc
jmp 0x47167b
mov esi, dword [esi + 8]
add esi, 4
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4716be
shr eax, 4
not al
and al, 1
je 0x4716be
mov ecx, edi
mov dword [ebp + 4], 1
call fcn.00433db0
push 0x523d2c
push 0x51620c
mov edx, eax
call fcn.004351e0
add esp, 8
xor al, al
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
mov ecx, dword [esp + 0x18]
mov dword [ebp + 4], 2
mov eax, dword [ecx]
cmp eax, ebx
je 0x471707
mov edx, dword [esp + 0x1c]
mov ecx, 0x40
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], ecx
mov dword [eax], 0x1332ba5
mov dword [eax + 4], ebx
mov dword [eax + 0x14], ebx
mov dword [eax + 0x18], ebx
mov dword [eax + 0x1c], ebx
mov dword [eax + 0x20], ebx
mov ecx, edi
mov dword [edx], 0x50
call fcn.00433db0
push 0x523d70
jmp 0x4716a6
mov ecx, edi
call fcn.00433db0
push 0x523d48
jmp 0x4716a6
pop esi
pop ebp
mov al, 1
pop ebx
pop ecx
ret 0xc
Function at 0x471720
Capabilities:
Get file size

Disassembly:
push 0xffffffffffffffff
push 0x5039ab
mov eax, dword fs:[0]
push eax
sub esp, 0x3a4
mov eax, dword [0x5355a0]
xor eax, esp
mov dword [esp + 0x39c], eax
push ebx
push ebp
push esi
mov eax, dword [0x5355a0]
xor eax, esp
push eax
lea eax, [esp + 0x3b4]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x3c4]
lea esi, [esp + 0x54]
mov ebx, ecx
call fcn.0043a2a0
xor esi, esi
mov dword [esp + 0x54], vtable.t_fileRead.0
mov dword [esp + method.t_fileRead.1.virtual_0], vtable.t_fileRead.1.0
mov dword [esp + 0x3a4], esi
mov dword [esp + 0x3a8], esi
push esi
push edi
lea eax, [esp + 0x5c]
push eax
mov eax, ebx
mov dword [esp + 0x3c8], esi
call fcn.0043a3e0
test al, al
je 0x47184c
mov edx, dword [esp + 0x58]
lea ecx, [esp + 0x10]
push ecx
push edx
mov dword [esp + 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4717d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
je 0x4717d3
xor ebx, ebx
mov eax, 0x40
push eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
lea eax, [esp + 0x18]
push eax
push edi
lea ecx, [esp + 0x3ac]
mov dword [esp + 0x3b0], ebx
mov dword [esp + 0x20], 0x1332ba5
mov dword [esp + 0x24], 1
mov dword [esp + 0x30], esi
mov dword [esp + 0x4c], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], esi
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], esi
mov dword [esp + 0x5c], esi
call fcn.00441fe0
test al, al
jne 0x471892
mov ecx, edi
call fcn.00433db0
push 0x523dac
jmp 0x471858
mov ecx, edi
call fcn.00433db0
push 0x523d94
push 0x51620c
mov edx, eax
call fcn.004351e0
mov dword [esp + 0x3c4], 0xffffffff
add esp, 8
lea ecx, [esp + 0x54]
mov dword [esp + 0x54], vtable.t_fileRead.0
mov dword [esp + method.t_byteStreamRead.virtual_0], vtable.t_byteStreamRead.0
call fcn.0043a310
xor al, al
jmp 0x4718c2
mov ecx, dword [esp + 0x18]
mov dword [ebp], ecx
mov dword [esp + 0x3bc], 0xffffffff
lea ecx, [esp + 0x54]
mov dword [esp + 0x54], vtable.t_fileRead.0
mov dword [esp + method.t_byteStreamRead.virtual_0], vtable.t_byteStreamRead.0
call fcn.0043a310
mov al, 1
mov ecx, dword [esp + 0x3b4]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x39c]
xor ecx, esp
call fcn.004c31a1
add esp, 0x3b0
ret

Function at 0x474350
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 8
push esi
push edi
push eax
mov esi, ecx
call fcn.004801f0
test al, al
jne 0x4743c7
cmp byte [esi + 0x11c], al
je 0x47436e
add esi, 0xc
jmp 0x474371
mov esi, dword [esi + 8]
add esi, 4
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4743b2
shr eax, 4
not al
and al, 1
je 0x4743b2
mov ecx, edi
mov dword [ebx + 4], 1
call fcn.00433db0
push 0x524000
push 0x51620c
mov edx, eax
call fcn.004351e0
add esp, 8
xor al, al
pop esi
add esp, 8
ret
mov ecx, edi
mov dword [ebx + 4], 2
call fcn.00433db0
push 0x524018
jmp 0x47439c
mov al, 1
pop esi
add esp, 8
ret