joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45cd60
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4a20c8
mov eax, dword fs:[0]
push eax
sub esp, 0x68
push esi
mov eax, dword [0x4c6280]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov esi, ecx
push 0x40
lea eax, [esp + 0x2c]
push 0
push eax
call fcn.004806d0
xor eax, eax
add esp, 0xc
lea ecx, [esp + 0xc]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 0x44
mov dword [esp + 0x50], 0x181
call fcn.0040fcf0
push edi
push ebx
lea ecx, [esp + 0x14]
push str.__s___s
push ecx
mov dword [esp + 0x88], 0
call fcn.004147a0
add esp, 0x10
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x28]
push ecx
push 0
push 0
push 0
mov edx, esi
neg edx
push 0
sbb edx, edx
push 0
and edx, 0xa
push 0
lea ecx, [esp + 0x2c]
mov word [esp + 0x74], dx
call fcn.00410760
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x45ce59
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.QMTFunction::RunApp_CreateProcessW_error:_d__show:_d__path:_ws__cmd:_s
mov esi, 0x4ca290
call fcn.0045f140
add esp, 0x14
lea ecx, [esp + 0xc]
call fcn.0040fde0
xor eax, eax
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [esp + 0x18]
push edx
lea ecx, [esp + 0x14]
call fcn.004377d0
mov esi, dword [esp + 0x14]
lea ecx, [esp + 0x10]
call fcn.00421e50
lea ecx, [esp + 0xc]
call fcn.0040fde0
mov eax, esi
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x45ce90
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x230
mov eax, dword [0x4c6280]
xor eax, esp
mov dword [esp + 0x22c], eax
push ebx
push ebp
mov ebp, dword [esp + 0x23c]
push esi
xor ebx, ebx
push ebx
push 2
mov dword [edi], ebx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x45cedf
lea eax, [esp + 0xc]
push eax
push esi
mov dword [esp + 0x14], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x45cf00
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.0047f404
add esp, 0x230
ret
cmp dword [esp + 0x14], ebx
jbe 0x45cf18
lea ecx, [esp + 0x30]
push ebp
push ecx
call fcn.00482c1c
add esp, 8
test eax, eax
je 0x45cf29
lea edx, [esp + 0xc]
push edx
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x45cf00
jmp 0x45cf34
mov eax, dword [esp + 0x14]
mov dword [edi], eax
mov ebx, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x238]
pop esi
pop ebp
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.0047f404
add esp, 0x230
ret
Function at 0x45cf60
Capabilities:
Terminate process

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
push edi
mov esi, 1
mov dword [esp + 0x10], 0
lea ebx, [ebx]
mov eax, dword [esp + 0x1c]
push eax
lea edi, [esp + 0x18]
mov dword [esp + 0x18], 0
call fcn.0045ce90
mov ebx, dword [esp + 0x18]
add esp, 4
test eax, eax
je 0x45cff3
push ebx
xor edi, edi
push edi
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x45cff1
push edi
push esi
call ebp
push 0x1f4
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x45cff1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x45cff1
push ebx
push str.QMTProcess::CloseProcessByID___d
mov ecx, 0x4ca290
call fcn.0045ef50
add esp, 8
mov esi, edi
add dword [esp + 0x10], 1
test ebx, ebx
je 0x45d007
cmp dword [esp + 0x10], 0xa
jl 0x45cf80
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x45d470
Capabilities:
Query service status

Disassembly:
sub esp, 0x24
push esi
mov esi, eax
test esi, esi
je 0x45d541
cmp word [esi], 0
je 0x45d541
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
xor eax, eax
test edi, edi
mov dword [esp + 0xc], edi
je 0x45d4dd
push 4
push esi
push edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
mov dword [esp + 8], esi
jne 0x45d4e3
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
pop edi
pop esi
add esp, 0x24
ret
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x45d507
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop edi
xor eax, eax
pop esi
add esp, 0x24
ret
cmp dword [esp + 0x14], 1
lea esi, [esp + 8]
jne 0x45d528
call fcn.0045d570
lea esi, [esp + 0xc]
call fcn.0045d570
pop edi
xor eax, eax
pop esi
add esp, 0x24
ret
call fcn.0045d570
lea esi, [esp + 0xc]
call fcn.0045d570
pop edi
mov eax, 1
pop esi
add esp, 0x24
ret
xor eax, eax
pop esi
add esp, 0x24
ret

Function at 0x45db80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a2048
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4c6280]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov eax, dword [esp + 0x34]
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 8], 0
call fcn.00421d40
mov ecx, dword [esp + 0x38]
push ecx
mov ecx, eax
mov dword [esp + 0x30], 0
call fcn.0042e270
push eax
mov ecx, esi
call fcn.00421d40
lea ecx, [esp + 8]
call fcn.00421d90
mov eax, esi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
add esp, 0x2c
ret

Function at 0x45df20
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4a1f9b
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x4c6280]
xor eax, esp
mov dword [esp + 0x228], eax
mov eax, dword [0x4c6280]
xor eax, esp
push eax
lea eax, [esp + 0x230]
mov dword fs:[0], eax
push 0x206
lea eax, [esp + 0x2a]
push 0
push eax
mov dword [esp + 0x10], 0
mov word [esp + 0x30], 0
call fcn.004806d0
mov eax, 1
add esp, 0xc
test byte [0x4ca490], al
jne 0x45dfa4
or dword [0x4ca490], eax
mov ecx, 0x4ca474
call fcn.00419600
push 0x4a66d0
call fcn.0048086e
add esp, 4
mov ecx, 0x4ca474
call fcn.0044c280
test al, al
je 0x45dffa
push 0x104
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea edx, [esp + 0x24]
push edx
lea ecx, [esp + 0xc]
call fcn.00419660
push eax
mov ecx, 0x4ca474
mov dword [esp + 0x23c], 0
call fcn.00419690
lea ecx, [esp + 8]
mov dword [esp + 0x238], 0xffffffff
call fcn.00419810
push 0x4ca474
mov ecx, esi
call fcn.00419630
mov eax, esi
mov ecx, dword [esp + 0x230]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.0047f404
add esp, 0x238
ret
Function at 0x45e030
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4a2ee2
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x4c6280]
xor eax, esp
mov dword [esp + 0x214], eax
push edi
mov eax, dword [0x4c6280]
xor eax, esp
push eax
lea eax, [esp + 0x220]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
call fcn.00419600
push 0x208
lea eax, [esp + 0x16]
mov dword [esp + 0x22c], 0
push 0
push eax
mov dword [esp + 0x14], 1
mov word [esp + 0x1c], 0
call fcn.004806d0
add esp, 0xc
push 0
push 0x10
lea ecx, [esp + 0x18]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edx, [esp + 0x10]
push edx
mov ecx, edi
call fcn.004196c0
call fcn.0045e640
mov eax, edi
mov ecx, dword [esp + 0x220]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.0047f404
add esp, 0x224
ret

Function at 0x45e100
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4a2ee2
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x4c6280]
xor eax, esp
mov dword [esp + 0x214], eax
push edi
mov eax, dword [0x4c6280]
xor eax, esp
push eax
lea eax, [esp + 0x220]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
call fcn.00419600
push 0x208
lea eax, [esp + 0x16]
mov dword [esp + 0x22c], 0
push 0
push eax
mov dword [esp + 0x14], 1
mov word [esp + 0x1c], 0
call fcn.004806d0
add esp, 0xc
push 0
push 0x19
lea ecx, [esp + 0x18]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edx, [esp + 0x10]
push edx
mov ecx, edi
call fcn.004196c0
call fcn.0045e640
mov eax, edi
mov ecx, dword [esp + 0x220]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.0047f404
add esp, 0x224
ret

Function at 0x45e1d0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4a2ee2
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x4c6280]
xor eax, esp
mov dword [esp + 0x214], eax
push edi
mov eax, dword [0x4c6280]
xor eax, esp
push eax
lea eax, [esp + 0x220]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
call fcn.00419600
push 0x208
lea eax, [esp + 0x16]
mov dword [esp + 0x22c], 0
push 0
push eax
mov dword [esp + 0x14], 1
mov word [esp + 0x1c], 0
call fcn.004806d0
add esp, 0xc
push 0
push 2
lea ecx, [esp + 0x18]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edx, [esp + 0x10]
push edx
mov ecx, edi
call fcn.004196c0
call fcn.0045e640
mov eax, edi
mov ecx, dword [esp + 0x220]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.0047f404
add esp, 0x224
ret
Function at 0x45e2a0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4a2ee2
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x4c6280]
xor eax, esp
mov dword [esp + 0x214], eax
push edi
mov eax, dword [0x4c6280]
xor eax, esp
push eax
lea eax, [esp + 0x220]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
call fcn.00419600
push 0x208
lea eax, [esp + 0x16]
mov dword [esp + 0x22c], 0
push 0
push eax
mov dword [esp + 0x14], 1
mov word [esp + 0x1c], 0
call fcn.004806d0
add esp, 0xc
push 0
push 0x17
lea ecx, [esp + 0x18]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edx, [esp + 0x10]
push edx
mov ecx, edi
call fcn.004196c0
call fcn.0045e640
mov eax, edi
mov ecx, dword [esp + 0x220]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.0047f404
add esp, 0x224
ret

Function at 0x45e9e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
call fcn.00421e20
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
ret
Function at 0x45ed20
Capabilities:
Create thread

Disassembly:
sub esp, 0xf4
mov eax, dword [0x4c6280]
xor eax, esp
mov dword [esp + 0xec], eax
cmp dword [0x4ca2cc], 0
push esi
push edi
mov esi, ecx
je 0x45ed5d
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0xec]
xor ecx, esp
call fcn.0047f404
add esp, 0xf4
ret
call fcn.0045f570
push esi
mov ecx, 0x4ca2a0
call fcn.004196c0
xor eax, eax
push 0xc6
push eax
mov dword [esp + 0x11], eax
mov dword [esp + 0x15], eax
mov dword [esp + 0x19], eax
mov dword [esp + 0x1d], eax
mov word [esp + 0x21], ax
mov byte [esp + 0x23], al
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov word [esp + 0x30], ax
lea eax, [esp + 0x32]
push eax
mov dword [0x4ca2cc], 1
mov byte [esp + 0x14], 0
call fcn.004806d0
add esp, 0xc
push 1
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea eax, [esp + 8]
mov dword [esp + 0x1c], 0xc
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.GlobalBFD88F2D_0990_4de4_AD0F_764F5894389A__d
lea ecx, [esp + 0x30]
push 0x63
push ecx
call fcn.0047f3be
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
add esp, 0x10
lea edx, [esp + 0x28]
push edx
push 1
push 1
lea eax, [esp + 0x28]
push eax
call esi
mov ecx, 0x4ca294
mov edi, eax
call fcn.00424350
mov ecx, 0x4ca294
mov dword [0x4ca294], edi
call fcn.00410760
push 0
push 0
push 0
push 0
call esi
mov ecx, 0x4ca298
mov esi, eax
call fcn.00424350
mov ecx, 0x4ca298
mov dword [0x4ca298], esi
call fcn.00410760
mov ecx, 0x4ca294
call fcn.00410760
test eax, eax
je 0x45eed5
mov ecx, 0x4ca298
call fcn.00410760
test eax, eax
je 0x45eed5
push 0
push 0
push 0x4ca290
push 0x45f2d0
push 0
push 0
call fcn.00483fdc
add esp, 0x18
mov ecx, 0x4ca29c
mov esi, eax
call fcn.00424350
mov ecx, 0x4ca29c
mov dword [0x4ca29c], esi
call fcn.00410760
mov ecx, 0x4ca29c
call fcn.00410760
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
mov ecx, dword [esp + 0xec]
xor ecx, esp
call fcn.0047f404
add esp, 0xf4
ret
mov ecx, dword [esp + 0xf4]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.0047f404
add esp, 0xf4
ret

Function at 0x45f4e0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp dword [eax + 0x2c], 0
push esi
lea esi, [eax + 0x2c]
jne 0x45f55b
push 0x4b8b00
lea ecx, [eax + 0x10]
call fcn.00421e20
push eax
push esi
call fcn.004837b6
mov eax, dword [esi]
add esp, 0xc
test eax, eax
je 0x45f55b
push edi
push 2
push 0
push eax
call fcn.00484988
mov eax, dword [esi]
push eax
call fcn.00484ba5
mov ecx, dword [esi]
push 0
push 0
push ecx
mov edi, eax
call fcn.00484988
add esp, 0x1c
test edi, edi
pop edi
jne 0x45f55b
mov edx, dword [esi]
push edx
push 2
lea eax, [esp + 0xc]
mov word [esp + 0xd], 0
push 1
push eax
mov byte [esp + 0x14], 0xff
mov byte [esp + 0x15], 0xfe
mov byte [esp + 0x16], 0
call fcn.00484d72
add esp, 0x10
xor eax, eax
cmp dword [esi], eax
pop esi
setne al
pop ecx
ret
Function at 0x45f570
Capabilities:
Get file size
Move file
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4a5228
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4c6280]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ecx, 0x4ca2a0
call fcn.00421e20
push 0
push 0x80
push 3
push 0
push 3
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x45f652
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x45f5d6
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, 0x80000
jb 0x45f652
mov ecx, 0x4ca2a0
call fcn.00421e20
push eax
lea ecx, [esp + 0x18]
call fcn.0040ff10
push 0x4b8b10
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], 0
call fcn.00420ac0
mov ecx, 0x4ca2a0
call fcn.00421e20
lea ecx, [esp + 0x14]
mov edi, eax
call fcn.00410760
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov esi, eax
push 0
push esi
call ebx
push 1
push esi
call fcn.0045b3b0
add esp, 8
push 0
push edi
call ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
lea ecx, [esp + 0x14]
call fcn.0040fde0
mov eax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x45f9e0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0
push 0x80
mov esi, edx
push esi
push eax
push 0xc0000000
push ecx
mov ecx, ebx
call fcn.004570a0
xor ecx, ecx
cmp eax, ecx
jl 0x45fb24
cmp edi, 0xffffffff
jne 0x45fab3
cmp esi, 4
jne 0x45faae
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
lea esi, [esp + 0x10]
mov ecx, ebx
xor edi, edi
call fcn.0045fce0
cmp dword [esp + 0x14], edi
ja 0x45fa4a
cmp dword [esp + 0x10], 2
jb 0x45fab3
lea ecx, [esp + 0x18]
call fcn.00407550
mov eax, dword [ebx]
lea esi, [esp + 0x18]
call fcn.0045fc40
test eax, eax
jl 0x45faa3
mov ecx, esi
call fcn.00410760
test eax, eax
je 0x45faa3
mov ecx, esi
call fcn.00410760
movzx eax, word [eax]
cmp eax, 0xfeff
je 0x45fa9e
cmp eax, 0xfffe
je 0x45fa9e
mov ecx, esi
call fcn.00410760
mov ebx, dword [esp + 0x1c]
mov ecx, eax
call fcn.0045f930
test eax, eax
mov ebx, dword [ebp + 8]
je 0x45faa3
mov edi, 1
lea ecx, [esp + 0x18]
call fcn.00407580
jmp 0x45fab3
mov edi, 1
cmp edi, 1
mov dword [ebx + 4], edi
jne 0x45fafd
mov eax, dword [ebx]
lea edx, [esp + 0x14]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x45fadf
call fcn.004019f0
test eax, eax
jl 0x45fae5
mov eax, dword [esp + 0x10]
or eax, dword [esp + 0x14]
jne 0x45fafd
push 0
push 2
lea ecx, [esp + 0x18]
push ecx
mov ecx, ebx
mov dword [esp + 0x1c], 0xfeff
call fcn.00457120
push 2
xor eax, eax
lea edx, [esp + 0x18]
push edx
push eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov eax, dword [ebx]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x45fb22
call fcn.004019f0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x45fc40
Capabilities:
Get file size

Disassembly:
sub esp, 0x10
push edi
mov edi, eax
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0xc]
push 0
push eax
push ecx
push 2
push 0
push edi
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test eax, eax
mov dword [esi + 8], eax
jne 0x45fc7a
call fcn.004019f0
pop edi
add esp, 0x10
ret
mov ecx, dword [esp + 8]
push 0
push ecx
mov dword [esi + 0x10], 0
mov edx, dword [esi + 0x10]
push edx
mov dword [esi + 4], ecx
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x14]
push ecx
push 4
push eax
mov dword [esi + 0x18], 4
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
test eax, eax
mov dword [esi], eax
jne 0x45fccf
call fcn.004019f0
mov edx, dword [esi + 8]
push edx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0
mov eax, edi
pop edi
add esp, 0x10
ret
xor eax, eax
pop edi
add esp, 0x10
ret

Function at 0x45fce0
Capabilities:
Get file size

Disassembly:
sub esp, 0xc
mov edx, dword [ecx]
lea eax, [esp + 4]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esp], eax
jne 0x45fd05
call fcn.004019f0
test eax, eax
jl 0x45fd10
mov eax, dword [esp]
mov dword [esi], eax
mov eax, dword [esp + 4]
mov dword [esi + 4], eax
xor eax, eax
add esp, 0xc
ret
Function at 0x45fde0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4a47b1
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x4c6280]
xor eax, esp
mov dword [esp + 0x60], eax
push ebp
push esi
mov eax, dword [0x4c6280]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov esi, ecx
xor ebp, ebp
mov ecx, edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x24], ebp
call fcn.00419600
mov dword [esp + 0x78], ebp
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], 1
call fcn.00437530
push ebp
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
mov dword [esp + 0x80], 1
call fcn.00421e20
push eax
call fcn.0045bcb0
add esp, 0xc
test eax, eax
je 0x45ffb8
lea ecx, [esp + 0xc]
call fcn.00427750
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
call fcn.004375b0
mov edx, dword [eax]
lea ecx, [esp + 0x28]
mov dword [esp + 0xc], edx
mov eax, dword [eax + 4]
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], eax
call fcn.004375f0
push eax
lea ecx, [esp + 0x10]
call fcn.00437790
test al, al
je 0x45ffac
lea ebp, [ebx + 0x40]
lea ecx, [esp + 0xc]
call fcn.004376a0
push eax
lea ecx, [esp + 0x38]
call fcn.00419630
lea edx, [esp + 0x34]
push edx
lea ecx, [esp + 0x54]
mov byte [esp + 0x7c], 2
call fcn.0045dde0
mov ecx, ebp
mov byte [esp + 0x78], 3
call fcn.00410760
mov esi, eax
push esi
call fcn.004063e0
add esp, 4
push eax
push esi
lea eax, [esp + 0x58]
push eax
call fcn.0045dcc0
test eax, eax
jne 0x45ff65
add dword [esp + 0x14], 1
mov ecx, edi
call fcn.0044c280
test al, al
je 0x45ff14
lea ecx, [esp + 0x34]
push ecx
jmp 0x45ff2b
lea edx, [esp + 0x34]
push edi
push edx
call fcn.0042b820
add esp, 8
test al, al
je 0x45ff32
lea eax, [esp + 0x34]
push eax
mov ecx, edi
call fcn.00419690
lea esi, [ebx + 0x24]
mov ecx, esi
call fcn.0044c280
test al, al
je 0x45ff47
lea ecx, [esp + 0x34]
push ecx
jmp 0x45ff5e
lea edx, [esp + 0x34]
push edx
push esi
call fcn.0042b820
add esp, 8
test al, al
je 0x45ff65
lea eax, [esp + 0x34]
push eax
mov ecx, esi
call fcn.00419690
lea ecx, [esp + 0x50]
call fcn.00419810
lea ecx, [esp + 0x34]
mov byte [esp + 0x78], 1
call fcn.00419810
lea ecx, [esp + 0xc]
call fcn.004376d0
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x1c]
call fcn.004375f0
push eax
lea ecx, [esp + 0x10]
call fcn.00437790
test al, al
jne 0x45feb0
cmp dword [esp + 0x14], 3
jge 0x45ffb8
push 0x4b6d5c
mov ecx, edi
call fcn.004196c0
lea ecx, [esp + 0x18]
call fcn.00437580
mov eax, edi
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.0047f404
add esp, 0x70
ret
Function at 0x460190
Capabilities:
Copy file

Disassembly:
push 0xffffffffffffffff
push 0x4a51b0
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x4c6280]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4c6280]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x60]
cmp dword [ebp + 4], 0
je 0x46025e
lea esi, [esp + 0x30]
call fcn.0045c980
mov edi, esi
mov dword [esp + 0x58], 0
call fcn.0045e640
lea edi, [ebp + 8]
push edi
lea ecx, [esp + 0x18]
call fcn.0045dde0
push eax
mov ebx, esi
mov byte [esp + 0x5c], 1
call fcn.0045e710
xor ebx, ebx
lea ecx, [esp + 0x14]
mov byte [esp + 0x58], bl
call fcn.00419810
mov ecx, esi
call fcn.00421e20
push eax
mov ecx, edi
call fcn.00421e20
push eax
push str.Copy_File___s______s_
mov esi, 0x4ca290
call fcn.0045f140
add esp, 0xc
call fcn.0045eef0
push 1
lea ecx, [esp + 0x34]
call fcn.00421e20
push eax
mov ecx, edi
call fcn.00421e20
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ecx, [esp + 0x30]
mov dword [ebp + 4], ebx
call fcn.00419810
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.0047f404
add esp, 0x48
ret 4