joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44bfec
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4e0ef6
call fcn.004d1ec0
push ecx
push ebx
push esi
xor ebx, ebx
mov esi, ecx
inc ebx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi + 0xc], ebx
xor edi, edi
lea ecx, [esi + 0x14]
mov dword [ebp - 4], edi
mov dword [esi], 0x4f7bb8
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea ecx, [esi + 0x30]
mov byte [ebp - 4], bl
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 2
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
lea eax, [esi + 0x80]
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
push dword [ebp + 8]
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 5
mov dword [esi + 8], ebx
call dword [0x4ec734]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x78], edi
mov dword [esi + 0x90], edi
mov dword [esi + 0x7c], eax
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x44da9f
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x4e1089
call fcn.004d1ec0
mov eax, 0x4010
call fcn.004d2080
mov eax, dword [0x52f220]
push ebx
push esi
xor eax, ebp
push edi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov edi, ecx
push 0x4eda00
push eax
mov dword [ebp - 0x4018], edi
mov dword [ebp - 0x401c], eax
mov byte [ebp - 0x4011], 1
call dword [sym.imp.MSVCR71.dll__wfopen]
mov esi, eax
xor ebx, ebx
cmp esi, ebx
pop ecx
pop ecx
jne 0x44daf5
xor al, al
jmp 0x44dba5
push ebx
add edi, 4
push ebx
mov ecx, edi
call fcn.0044da49
test byte [esi + 0xc], 0x10
jne 0x44db4b
cmp byte [ebp - 0x4011], bl
je 0x44db97
push esi
push 0x4000
lea eax, [ebp - 0x4010]
push 1
push eax
call dword [sym.imp.MSVCR71.dll_fread]
add esp, 0x10
push ebx
push eax
lea eax, [ebp - 0x4010]
push eax
mov ecx, edi
call fcn.0040dffa
test byte [esi + 0xc], 0x10
mov byte [ebp - 0x4011], al
je 0x44db07
cmp al, bl
je 0x44db97
mov edi, dword [ebp - 0x4018]
cmp dword [edi + 0x18], ebx
je 0x44db97
push 0x48
call fcn.004d1a92
pop ecx
mov dword [ebp - 0x4018], eax
cmp eax, ebx
mov dword [ebp - 4], ebx
je 0x44db74
mov ecx, eax
call fcn.0040deac
mov ebx, eax
push dword [ebp - 0x401c]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebx + 0x10]
call dword [0x4ec734]
mov ecx, dword [edi + 0x18]
push ebx
call fcn.0044ba2f
mov ecx, ebx
call fcn.0040db94
push esi
call dword [sym.imp.MSVCR71.dll_fclose]
mov al, byte [ebp - 0x4011]
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.004d1f17
leave
ret 4
Function at 0x450a20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
xor ecx, ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
xor eax, eax
mov dword [ebp - 0x54], ecx
lea edi, [ebp - 0x50]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [sym.imp.MSVCR71.dll_malloc]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], ecx
xor ebx, ebx
mov dword [ebp - 0x10], ecx
jmp 0x450a67
xor ecx, ecx
push 6
push ecx
lea eax, [ebp - 0x30]
push eax
call sub.MSVCR71.dll_memset
push 0x10
lea eax, [ebp - 0x40]
push 0
push eax
call sub.MSVCR71.dll_memset
mov ecx, dword [ebp - 0x10]
add esp, 0x18
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp + 0xc]
push dword [eax + ecx*4]
call dword [sym.imp.USER32.dll_GetIconInfo]
test eax, eax
je 0x450b8a
push 1
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x48]
call fcn.00450791
add esp, 0x10
test eax, eax
je 0x450b8a
push dword [ebp + 0x14]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x44]
call fcn.00450791
add esp, 0x10
test eax, eax
je 0x450b8a
push dword [ebp - 0x24]
call edi
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
call edi
push dword [ebp - 0x20]
mov ebx, eax
call edi
push dword [ebp - 0x18]
mov dword [ebp - 4], eax
call edi
add esp, 0x10
cmp dword [ebp - 8], 0
mov dword [ebp - 0xc], eax
je 0x450b8a
test ebx, ebx
je 0x450b96
cmp dword [ebp - 4], 0
je 0x450b8a
test eax, eax
je 0x450b8a
push 1
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 0x48]
call fcn.004507ff
add esp, 0x10
test eax, eax
je 0x450b8a
push dword [ebp + 0x14]
push dword [ebp - 0xc]
push ebx
push dword [ebp - 0x44]
call fcn.004507ff
add esp, 0x10
test eax, eax
je 0x450b8a
shl dword [ebx + 8], 1
push 0
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x14]
push ebx
push dword [ebp + 8]
call esi
push 0
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0xc]
push dword [ebp + 8]
call esi
push 0
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x20]
push dword [ebp - 4]
push dword [ebp + 8]
call esi
inc dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0x10]
jl 0x450a65
test ebx, ebx
je 0x450b96
push ebx
call dword [sym.imp.MSVCR71.dll_free]
pop ecx
cmp dword [ebp - 8], 0
je 0x450ba6
push dword [ebp - 8]
call dword [sym.imp.MSVCR71.dll_free]
pop ecx
cmp dword [ebp - 0xc], 0
je 0x450bb6
push dword [ebp - 0xc]
call dword [sym.imp.MSVCR71.dll_free]
pop ecx
cmp dword [ebp - 4], 0
je 0x450bc6
push dword [ebp - 4]
call dword [sym.imp.MSVCR71.dll_free]
pop ecx
cmp dword [ebp - 0x44], 0
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
je 0x450bd7
push dword [ebp - 0x44]
call esi
cmp dword [ebp - 0x48], 0
je 0x450be2
push dword [ebp - 0x48]
call esi
mov eax, dword [ebp - 0x28]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x450cfc
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
mov eax, 0x4e12e3
call fcn.004d1ec0
sub esp, 0x2a8
mov eax, dword [0x52f220]
push ebx
xor eax, ebp
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x2c]
push esi
push eax
call fcn.00454a8c
and dword [ebp - 4], 0
push 0x4f0440
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x64]
push eax
call fcn.00407691
add esp, 0x14
lea eax, [ebp - 0x2b4]
push eax
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 1
call dword [sym.imp.MSVCP71.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x450d7e
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
or dword [ebp - 4], ebx
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
jmp 0x450e28
push edi
mov edi, dword [sym.imp.MSVCR71.dll_wcscmp]
lea eax, [ebp - 0x288]
push 0x4edaf4
push eax
call edi
test eax, eax
pop ecx
pop ecx
je 0x450df8
lea eax, [ebp - 0x288]
push 0x4edaec
push eax
call edi
test eax, eax
pop ecx
pop ecx
je 0x450df8
lea eax, [ebp - 0x288]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00407691
add esp, 0xc
push esi
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call dword [sym.imp.MSVCP71.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
call edi
test eax, eax
pop ecx
pop ecx
je 0x450deb
lea ecx, [ebp - 0x48]
call dword [sym.imp.MSVCP71.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea eax, [ebp - 0x2b4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x450d85
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], al
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
pop edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.004d1f17
leave
ret
Function at 0x450e40
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x4e12f6
call fcn.004d1ec0
sub esp, 0x28
mov eax, dword [ebp + 0x14]
push ebx
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [ebp - 0x10], ebx
jl 0x450f43
cmp eax, 1
jle 0x450e81
cmp eax, 4
je 0x450e81
cmp eax, 8
je 0x450e81
cmp eax, 0x10
je 0x450e81
cmp eax, 0x18
je 0x450e81
cmp eax, 0x20
jne 0x450f43
cmp dword [ebp + 8], ebx
je 0x450f43
cmp dword [ebp + 0x10], ebx
je 0x450f43
push dword [ebp + 0x10]
lea eax, [ebp - 0x34]
push eax
call fcn.00454a8c
pop ecx
pop ecx
mov ecx, eax
mov dword [ebp - 4], ebx
call dword [sym.imp.MSVCP71.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
call fcn.004545ee
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x34]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
push ebx
push ebx
push 2
push ebx
push 1
push 0x40000000
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x450f43
push esi
push 6
lea eax, [ebp - 0x18]
push ebx
push eax
call sub.MSVCR71.dll_memset
mov esi, dword [ebp + 0xc]
add esp, 0xc
push ebx
lea eax, [ebp - 0x10]
push eax
push 6
lea eax, [ebp - 0x18]
push eax
push edi
mov word [ebp - 0x16], 1
mov word [ebp - 0x14], si
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp + 0x14]
push esi
push dword [ebp + 8]
push edi
call fcn.0045084f
push dword [ebp + 0x14]
push esi
push dword [ebp + 8]
push edi
call fcn.00450a20
mov esi, eax
add esp, 0x20
cmp esi, ebx
je 0x450f37
push dword [ebp + 0x10]
call fcn.00450cfc
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
jmp 0x450f45
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x451427
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x45146e
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x45146e
xor edx, edx
mov eax, esi
shl eax, 3
push 6
pop ecx
div ecx
lea ecx, [eax + eax*2]
shl ecx, 1
mov edx, ecx
mov ecx, esi
shl ecx, 3
sub ecx, edx
dec ecx
dec ecx
je 0x451461
dec ecx
dec ecx
jne 0x451464
inc eax
inc eax
jmp 0x451464
add eax, 3
mov ecx, dword [ebp + 0xc]
inc eax
cmp dword [ecx], eax
jae 0x451475
mov dword [ecx], eax
push 0xfffffffffffffff0
pop eax
pop edi
pop esi
leave
ret
push ebx
xor edx, edx
push 3
pop ecx
mov eax, esi
div ecx
mov ecx, dword [ebp + 8]
xor edx, edx
lea eax, [eax + eax*2]
test eax, eax
jbe 0x4514fb
push 3
dec eax
pop esi
div esi
inc eax
lea edx, [eax + eax*2]
mov dword [ebp - 4], edx
movzx esi, byte [edi]
inc edi
movzx edx, byte [edi]
mov ebx, esi
shr ebx, 2
and ebx, 0x3f
mov bl, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc edi
mov dword [ebp + 0x10], edx
movzx edx, byte [edi]
mov byte [ecx], bl
mov ebx, dword [ebp + 0x10]
shr ebx, 4
shl esi, 4
add ebx, esi
and ebx, 0x3f
mov bl, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc edi
inc ecx
mov byte [ecx], bl
mov ebx, dword [ebp + 0x10]
mov esi, edx
shr esi, 6
lea esi, [esi + ebx*4]
and esi, 0x3f
mov bl, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], bl
and edx, 0x3f
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], dl
inc ecx
dec eax
jne 0x451498
mov esi, dword [ebp + 0x14]
mov edx, dword [ebp - 4]
cmp edx, esi
jae 0x451550
movzx eax, byte [edi]
inc edx
cmp edx, esi
jae 0x45150d
movzx edi, byte [edi + 1]
jmp 0x45150f
xor edi, edi
mov ebx, eax
shr ebx, 2
and ebx, 0x3f
mov bl, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], bl
shl eax, 4
mov ebx, edi
shr ebx, 4
add ebx, eax
and ebx, 0x3f
mov al, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc ecx
cmp edx, esi
jae 0x451548
and edi, 0xf
mov al, byte [edi*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
jmp 0x45154b
mov byte [ecx], 0x3d
inc ecx
mov byte [ecx], 0x3d
inc ecx
mov edx, dword [ebp + 0xc]
mov eax, ecx
sub eax, dword [ebp + 8]
pop ebx
mov dword [edx], eax
mov byte [ecx], 0
xor eax, eax
jmp 0x451471
Function at 0x451565
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
push ebx
push esi
push edi
je 0x45167b
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x45167b
xor esi, esi
xor ebx, ebx
xor edx, edx
test edi, edi
jbe 0x451677
mov eax, edi
sub eax, edx
cmp eax, 2
jb 0x4515a6
cmp byte [edx + ecx], 0xd
jne 0x4515a6
cmp byte [edx + ecx + 1], 0xa
je 0x4515e1
mov al, byte [edx + ecx]
cmp al, 0xa
je 0x4515e1
cmp al, 0x3d
jne 0x4515bb
inc ebx
cmp ebx, 2
ja 0x45167b
cmp al, 0x7f
ja 0x45167b
movzx eax, al
mov al, byte [eax + 0x4f7ec8]
cmp al, 0x7f
je 0x45167b
cmp al, 0x40
jae 0x4515e0
test ebx, ebx
jne 0x45167b
inc esi
inc edx
cmp edx, edi
jb 0x451590
test esi, esi
je 0x451677
mov ecx, dword [ebp + 0xc]
lea eax, [esi + esi*2]
lea eax, [eax + eax + 7]
shr eax, 3
cmp dword [ecx], eax
jae 0x451605
mov dword [ecx], eax
push 0xfffffffffffffff0
jmp 0x45167d
mov ecx, dword [ebp + 8]
push 3
xor ebx, ebx
xor esi, esi
test edx, edx
pop edi
jbe 0x45166f
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0xd
je 0x451667
cmp al, 0xa
je 0x451667
movzx eax, al
movzx eax, byte [eax + 0x4f7ec8]
xor edx, edx
cmp al, 0x40
sete dl
shl ebx, 6
and eax, 0x3f
or eax, ebx
mov ebx, eax
sub edi, edx
inc esi
cmp esi, 4
jne 0x451667
xor esi, esi
test edi, edi
jbe 0x451652
shr eax, 0x10
mov byte [ecx], al
inc ecx
cmp edi, 1
jbe 0x45165f
mov eax, ebx
shr eax, 8
mov byte [ecx], al
inc ecx
cmp edi, 2
jbe 0x451667
mov byte [ecx], bl
inc ecx
inc dword [ebp + 0x10]
dec dword [ebp - 4]
jne 0x451616
sub ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
xor eax, eax
jmp 0x45167e
push 0xffffffffffffffee
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x453921
Capabilities:
Delete file

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esi + 8]
call fcn.0045304e
xor ebx, ebx
mov dword [esi + 0x548], ebx
mov eax, dword [sym.imp.MSVCP71.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
push dword [eax]
lea ecx, [esi + 0x54c]
push ebx
call dword [sym.imp.MSVCP71.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::erase_unsigned_int__unsigned_int_]
lea edi, [esi + 0x5a0]
mov eax, dword [edi]
cmp eax, 0xffffffff
mov dword [esi + 0x5a8], ebx
mov dword [esi + 0x5ac], ebx
je 0x453990
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [edi], 0xffffffff
cmp dword [esi + 0x598], ebx
je 0x453990
lea eax, [esi + 0x584]
cmp dword [eax + 0x18], 8
jb 0x453986
mov eax, dword [eax + 4]
jmp 0x453989
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [sym.imp.MSVCP71.dll_unsigned_int_const_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::npos]
push dword [eax]
lea ecx, [esi + 0x568]
push ebx
call dword [sym.imp.MSVCP71.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::erase_unsigned_int__unsigned_int_]
mov eax, dword [sym.imp.MSVCP71.dll_unsigned_int_const_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::npos]
push dword [eax]
lea ecx, [esi + 0x584]
push ebx
call dword [sym.imp.MSVCP71.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::erase_unsigned_int__unsigned_int_]
pop edi
pop esi
pop ebx
ret

Function at 0x453d27
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x1c], 0xc8
push ebx
push esi
push edi
mov esi, ecx
jne 0x453dcc
mov edi, dword [ebp + 0x14]
xor ebx, ebx
cmp edi, ebx
je 0x453dcc
mov eax, dword [ebp + 0x20]
mov byte [eax], bl
lea eax, [esi + 0x5a8]
add dword [eax], edi
adc dword [eax + 4], ebx
cmp dword [esi + 0x5a0], 0xffffffff
jne 0x453d95
lea eax, [esi + 0x584]
cmp dword [eax + 0x18], 8
jb 0x453d76
mov eax, dword [eax + 4]
jmp 0x453d79
add eax, 4
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 0x5a0], eax
mov eax, dword [esi + 0x5a0]
cmp eax, 0xffffffff
je 0x453dbc
push ebx
lea ecx, [ebp + 0xc]
push ecx
push edi
push dword [ebp + 0x10]
mov dword [ebp + 0xc], ebx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x453dbc
cmp dword [ebp + 0xc], edi
je 0x453dcc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call fcn.004539c8
jmp 0x453dce
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x1c
Function at 0x453fab
Capabilities:
Get file size

Disassembly:
push ebp
lea ebp, [esp - 0x200]
sub esp, 0x280
mov eax, dword [0x52f220]
push esi
mov esi, dword [ebp + 0x208]
push edi
xor eax, ebp
xor edi, edi
cmp esi, edi
mov dword [ebp + 0x1fc], eax
je 0x454086
cmp word [esi], di
je 0x454086
lea eax, [ebp - 0x80]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x45400f
test dword [ebp - 0x80], 0x10
jne 0x454091
push 1
push edi
push edi
push dword [ebp - 0x64]
call fcn.004d1ff0
mov ecx, dword [ebp - 0x60]
jmp 0x45403e
lea eax, [ebp - 0x54]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x454046
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
test dword [ebp - 0x54], 0x10
jne 0x454091
push 1
push edi
push edi
push dword [ebp - 0x38]
call fcn.004d1ff0
mov ecx, dword [ebp - 0x34]
xor esi, esi
add eax, ecx
adc edx, esi
jmp 0x454096
push edi
push 0x80
push 3
push edi
push 1
push Ordinal_1
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x454091
push ebx
lea eax, [ebp - 0x5c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, edi
pop ebx
je 0x454091
mov eax, dword [ebp - 0x5c]
mov edx, dword [ebp - 0x58]
jmp 0x454096
push 0x132b3a1
call fcn.0045bdb6
pop ecx
or edx, 0xffffffff
mov eax, edx
mov ecx, dword [ebp + 0x1fc]
pop edi
xor ecx, ebp
pop esi
call fcn.004d1f17
add ebp, 0x200
leave
ret

Function at 0x4540ad
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x4540d2
cmp word [eax], 0
je 0x4540d2
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4540cf
test al, 0x10
je 0x4540cf
xor eax, eax
inc eax
ret
xor eax, eax
ret
push 0x132b3a1
call fcn.0045bdb6
pop ecx
xor al, al
ret
Function at 0x4545ee
Capabilities:
Create directory

Disassembly:
mov eax, 0x4e16e3
call fcn.004d1ec0
sub esp, 0x20
mov eax, dword [0x52f220]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, ebp
xor ebx, ebx
cmp edi, ebx
mov dword [ebp - 0x10], eax
je 0x45467d
cmp word [edi], bx
je 0x45467d
push edi
call fcn.004540ad
test al, al
pop ecx
je 0x454625
mov al, 1
jmp 0x45467f
mov esi, dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push ebx
push edi
push ebx
call esi
cmp eax, ebx
je 0x454621
lea eax, [ebp - 0x2c]
push edi
push eax
call fcn.00454a8c
pop ecx
pop ecx
cmp dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
je 0x45466c
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x454654
lea eax, [ebp - 0x28]
push eax
call fcn.004545ee
cmp al, bl
pop ecx
je 0x45466c
push ebx
push edi
push ebx
call esi
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov al, bl
jmp 0x45467f
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.004d1f17
leave
ret

Function at 0x454eaf
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x52f220]
and word [ebp - 0x7c], 0
and dword [ebp - 0x80], 0
xor eax, ebp
push ebx
mov ebx, dword [ebp + 0x198]
push edi
mov dword [ebp + 0x18c], eax
xor eax, eax
mov ecx, 0x81
lea edi, [ebp - 0x7a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x7c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x454f0b
push 0x4ed274
mov ecx, ebx
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
jmp 0x454f50
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push str.Xunlei
lea eax, [ebp - 0x7c]
push eax
call esi
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x454f38
push 0
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x4ed9a8
lea eax, [ebp - 0x7c]
push eax
call esi
lea eax, [ebp - 0x7c]
push eax
mov ecx, ebx
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
pop esi
mov ecx, dword [ebp + 0x18c]
pop edi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.004d1f17
add ebp, 0x190
leave
ret