joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46d860
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [ebp - 0x10], ecx
mov esi, dword [ebp + 0xc]
movzx ebx, byte [esi + 0xb]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
test bl, bl
mov dword [ebp - 0x14], ecx
lea ecx, [eax + ecx]
lea edx, [esi + ebx]
cmovs edx, ecx
cmovs esi, eax
sub edx, esi
cmp edx, 4
mov dword [ebp - 0x20], ebx
jb 0x46d8cd
mov ecx, esi
mov eax, edx
nop word [eax + eax]
imul edi, dword [ecx], 0x5bd1e995
mov ebx, edi
shr ebx, 0x18
xor ebx, edi
imul edi, ebx, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, edi
add ecx, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x46d8a0
cmp edx, 1
jne 0x46d8d6
jmp 0x46d8f2
mov eax, edx
mov ecx, esi
cmp edx, 1
je 0x46d8f2
cmp edx, 2
je 0x46d8e9
cmp edx, 3
jne 0x46d8fd
movzx edx, byte [ecx + 2]
shl edx, 0x10
xor eax, edx
movzx edx, byte [ecx + 1]
shl edx, 8
xor eax, edx
movzx ecx, byte [ecx]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ecx + 4]
xor ecx, ecx
test ebx, ebx
je 0x46da5e
mov edx, eax
shr edx, 0xd
xor edx, eax
imul eax, edx, 0x5bd1e995
mov edi, eax
shr edi, 0xf
xor edi, eax
mov edx, ebx
shr edx, 1
and edx, 0x55555555
mov eax, ebx
sub eax, edx
mov edx, eax
and edx, 0x33333333
shr eax, 2
and eax, 0x33333333
add eax, edx
mov edx, eax
shr edx, 4
add edx, eax
and edx, 0xf0f0f0f
imul eax, edx, 0x1010101
shr eax, 0x18
mov dword [ebp - 0x24], eax
cmp eax, 1
ja 0x46d966
lea edx, [ebx - 1]
and edx, edi
jmp 0x46d972
mov edx, edi
cmp edi, ebx
jb 0x46d972
mov eax, edi
xor edx, edx
div ebx
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x46da5e
mov dword [ebp - 0x18], ebx
mov ebx, dword [eax]
test ebx, ebx
je 0x46da5e
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x20]
test cl, cl
mov eax, dword [ebp - 0x14]
cmovns eax, ecx
mov dword [ebp - 0x14], eax
jmp 0x46d9c5
and eax, dword [ebp - 0x1c]
cmp eax, edx
jne 0x46da5c
mov ebx, dword [ebx]
test ebx, ebx
je 0x46da5c
mov eax, dword [ebx + 4]
cmp eax, edi
jne 0x46da20
movzx eax, byte [ebx + 0x13]
mov ecx, eax
test al, al
jns 0x46d9d9
mov ecx, dword [ebx + 0xc]
cmp ecx, dword [ebp - 0x14]
jne 0x46d9bb
lea ecx, [ebx + 8]
test al, al
jns 0x46d9e7
mov ecx, dword [ecx]
js 0x46da3e
cmp dword [ebp - 0x14], 0
je 0x46da58
xor ecx, ecx
nop word cs:[eax + eax]
movzx edx, byte [ebx + ecx + 8]
cmp dl, byte [esi + ecx]
jne 0x46d9bb
inc ecx
cmp eax, ecx
jne 0x46da00
jmp 0x46da58
cmp dword [ebp - 0x24], 1
mov edx, dword [ebp - 0x10]
jbe 0x46d9b0
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
jb 0x46d9b3
xor edx, edx
div ecx
mov eax, edx
mov edx, dword [ebp - 0x10]
jmp 0x46d9b3
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x46da58
push eax
push esi
push ecx
call fcn.00509f3d
add esp, 0xc
test eax, eax
jne 0x46d9bb
mov ecx, ebx
jmp 0x46da5e
xor ecx, ecx
mov eax, dword [ebp + 8]
mov dword [eax], ecx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x46e140
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x575010]
xor eax, ebp
mov dword [esp + 0x18], eax
mov edi, dword [ecx + 0x38]
test edi, edi
jne 0x46e205
mov esi, ecx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x14], 0x9ffffff
lea edx, [esp + 0xc]
cmp edx, str.discarded
ja 0x46e197
lea eax, [esp + 0x15]
cmp eax, str.discarded
ja 0x46e21c
mov dword [esp + 0x10], 0x65647261
mov dword [esp + 0xc], 0x63736964
mov word [esp + 0x14], 0x64
mov edi, esp
mov ecx, esi
push edx
push edi
call fcn.0046e0b0
push 0x48
call fcn.00507d96
add esp, 4
mov ebx, eax
mov ecx, eax
push edi
push dword [esi + 0x28]
lea eax, [esp + 0x14]
push eax
call fcn.0046e9a0
mov edi, dword [esi + 0x38]
mov dword [esi + 0x38], ebx
test edi, edi
je 0x46e1ef
mov ecx, edi
call fcn.0046ea90
push edi
call fcn.00507dc6
add esp, 4
cmp byte [esp + 0x17], 0
jns 0x46e202
push dword [esp + 0xc]
call fcn.00507dc6
add esp, 4
mov edi, dword [esi + 0x38]
mov ecx, dword [esp + 0x18]
xor ecx, ebp
call fcn.00508d63
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
push str.char_traits::copy_overlapped_range
push str.__s2_____s1____s2_____s1__n
push 0xee
push str....._buildtools_third_partylibc_trunkinclude__stringchar_traits.h
push str._s:_d:_assertion__s_failed:__s
call fcn.0043403c
int3

Function at 0x46f210
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x124
mov eax, dword [0x575010]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x128]
push 0x118
push 0
push eax
call fcn.0050bb40
add esp, 0xc
mov dword [ebp - 0x12c], 0x11c
lea edi, [ebp - 0x12c]
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 0x130], 0
lea eax, [ebp - 0x130]
push eax
push 0
push 0
push dword [ebp - 0x124]
push dword [ebp - 0x128]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0x5c
call fcn.00507d96
add esp, 4
mov esi, eax
mov ebx, dword [ebp - 0x130]
mov eax, dword [0x57ad44]
mov ecx, dword [0x579028]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x46f2ce
mov ecx, esi
push ebx
push 0x57ad20
push edi
call fcn.0046f430
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00508d63
mov eax, esi
add esp, 0x124
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x57ad44
call fcn.00507e37
add esp, 4
cmp dword [0x57ad44], 0xffffffff
jne 0x46f2a9
xorps xmm0, xmm0
movups xmmword [0x57ad30], xmm0
movups xmmword [0x57ad20], xmm0
mov dword [0x57ad40], 0
push 0x57ad20
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x57ad44
call fcn.00507ead
add esp, 4
jmp 0x46f2a9
Function at 0x46f380
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x57ad44]
mov ecx, dword [0x579028]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x46f3d6
movzx eax, word [0x57ad20]
cmp eax, 0xc
ja case.0x46f3ac.1
jmp dword [eax*4 + 0x55eadc]
mov eax, 3
pop ebp
ret
mov eax, 5
pop ebp
ret
mov eax, 2
pop ebp
ret
mov eax, 1
pop ebp
ret
mov eax, 4
pop ebp
ret
push 0x57ad44
call fcn.00507e37
add esp, 4
cmp dword [0x57ad44], 0xffffffff
jne 0x46f3a0
xorps xmm0, xmm0
movups xmmword [0x57ad30], xmm0
movups xmmword [0x57ad20], xmm0
mov dword [0x57ad40], 0
push 0x57ad20
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x57ad44
call fcn.00507ead
add esp, 4
jmp 0x46f3a0

Function at 0x46fb00
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x208
mov eax, dword [0x575010]
xor eax, ebp
mov dword [ebp - 0xc], eax
push 0x1b
push str....._basewinwin_util.cc
call fcn.00485950
add esp, 8
test eax, eax
jle 0x46fb5e
lea esi, [ebp - 0x20c]
mov ecx, esi
push 0xffffffffffffffff
push 0x5f7
push str....._basewinwin_util.cc
call fcn.00485990
lea eax, [ebp - 0x204]
push 0x19
push str.Checking_if_internal_user
push eax
call fcn.0042c863
add esp, 0xc
mov ecx, esi
call fcn.00485d70
lea eax, [ebp - 0x20a]
push 0x1fe
push 0xff
push eax
call fcn.0050bb40
add esp, 0xc
mov word [ebp - 0x20c], 0
mov dword [ebp - 0x210], 0x100
lea eax, [ebp - 0x210]
lea esi, [ebp - 0x20c]
push eax
push esi
push 3
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
je 0x46fbc8
push esi
call fcn.00520fd4
add esp, 4
push 1
push 0x13
push str..corp.microsoft.com
push eax
push esi
call fcn.00471d40
add esp, 0x14
test al, al
je 0x46fbc8
mov bl, 1
jmp 0x46fbf5
mov eax, dword [0x57ad58]
mov ecx, dword [0x579028]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x46fc0b
cmp byte [0x57ad56], 0
setne bl
and bl, byte [0x57ad54]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00508d63
mov eax, ebx
add esp, 0x208
pop esi
pop ebx
pop ebp
ret
push 0x57ad58
call fcn.00507e37
add esp, 4
cmp dword [0x57ad58], 0xffffffff
jne 0x46fbe5
call fcn.00470280
mov byte [0x57ad56], al
push 0x57ad58
call fcn.00507ead
add esp, 4
jmp 0x46fbe5
Function at 0x470770
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, ecx
mov eax, dword [0x575010]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x28], 4
mov dword [ebp - 0x2c], 4
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x11], 0xff
mov ebx, dword [ecx]
lea edi, [ebp - 0x24]
push 0x1a7
push str....._basewin_registry.cc
push str.ReadValue
push edi
call fcn.004877c0
add esp, 0x10
lea ecx, [ebp - 0x11]
push 1
push ebx
push edi
call fcn.0049ce50
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x30]
lea edx, [ebp - 0x28]
push eax
push ecx
push edx
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
lea ecx, [ebp - 0x11]
call fcn.0042a680
test esi, esi
jne 0x47080e
mov eax, dword [ebp - 0x28]
add eax, 0xfffffffd
mov esi, 0x3f4
cmp eax, 1
ja 0x47080e
cmp dword [ebp - 0x2c], 4
jne 0x47080e
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x30]
mov dword [eax], ecx
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00508d63
mov eax, esi
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x470830
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1010
call fcn.00509180
mov esi, ecx
mov eax, dword [0x575010]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x810]
push 0x800
push 0xff
push eax
call fcn.0050bb40
add esp, 0xc
mov dword [ebp - 0x1018], 1
mov dword [ebp - 0x101c], 0x800
mov byte [ebp - 0x1011], 0xff
mov edi, dword [esi]
lea ebx, [ebp - 0x1010]
push 0x1a7
push str....._basewin_registry.cc
push str.ReadValue
push ebx
call fcn.004877c0
add esp, 0x10
lea ecx, [ebp - 0x1011]
push 1
push edi
push ebx
call fcn.0049ce50
lea eax, [ebp - 0x101c]
lea ecx, [ebp - 0x1018]
push eax
lea eax, [ebp - 0x810]
push eax
push ecx
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
lea ecx, [ebp - 0x1011]
call fcn.0042a680
test edi, edi
jne 0x47094c
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x1018]
cmp eax, 2
je 0x470905
mov edi, 0x3f4
cmp eax, 1
jne 0x47094c
mov ecx, esi
lea eax, [ebp - 0x810]
push eax
jmp 0x470945
push 0x800
push 0xff
push ebx
call fcn.0050bb40
add esp, 0xc
push 0x400
push ebx
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x101c], eax
add eax, 0xfffffbff
mov edi, 0xea
cmp eax, 0xfffffc00
jb 0x47094c
mov ecx, esi
push ebx
call fcn.0046751c
xor edi, edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00508d63
mov eax, edi
add esp, 0x1010
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x4711c0
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov eax, dword [0x575010]
xor eax, ebp
mov dword [esp + 0x40], eax
movsd xmm1, qword [0x57ada8]
xorpd xmm0, xmm0
ucomisd xmm1, xmm0
jne 0x47133c
jp 0x47133c
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [esp + 0xc], eax
call esi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x57adb8]
mov ecx, dword [0x579028]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x471361
mov eax, dword [0x57adc8]
mov ecx, dword [0x579028]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x47139a
rdtsc
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
lea ebx, [esp + 0x38]
push ebx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x3c]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
push ebx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub esi, dword [0x57adc0]
sbb edi, dword [0x57adc4]
movd xmm0, edi
movd xmm1, esi
punpckldq xmm1, xmm0
movq qword [esp + 0x28], xmm1
fild qword [esp + 0x28]
fstp qword [esp + 0x20]
movsd xmm0, qword [esp + 0x20]
fild qword [esp + 0x38]
fstp qword [esp + 0x30]
divsd xmm0, qword [esp + 0x30]
pxor xmm1, xmm1
movsd xmm2, qword [0x55f008]
ucomisd xmm2, xmm0
ja 0x47133c
mov eax, dword [esp + 8]
sub eax, dword [0x57adb0]
mov ecx, dword [esp + 4]
sbb ecx, dword [0x57adb4]
movd xmm1, ecx
movd xmm2, eax
punpckldq xmm2, xmm1
punpckldq xmm2, xmmword [0x55efe0]
subpd xmm2, xmmword [0x55eff0]
movapd xmm1, xmm2
unpckhpd xmm1, xmm2
addsd xmm1, xmm2
divsd xmm1, xmm0
movsd qword [0x57ada8], xmm1
movsd qword [esp + 0x18], xmm1
fld qword [esp + 0x18]
fstp xword [esp + 0xc]
mov ecx, dword [esp + 0x40]
xor ecx, ebp
call fcn.00508d63
fld xword [esp + 0xc]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x57adb8
call fcn.00507e37
add esp, 4
cmp dword [0x57adb8], 0xffffffff
jne 0x471232
rdtsc
mov dword [0x57adb0], eax
mov dword [0x57adb4], edx
push 0x57adb8
call fcn.00507ead
add esp, 4
jmp 0x471232
push 0x57adc8
call fcn.00507e37
add esp, 4
cmp dword [0x57adc8], 0xffffffff
jne 0x471253
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [0x57adc4], ecx
mov dword [0x57adc0], eax
push 0x57adc8
call fcn.00507ead
add esp, 4
jmp 0x471253
Function at 0x471920
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
xor eax, eax
cmp dword [ebp + 0xc], 0
sete al
xor ecx, ecx
cmp dword [ebp + 8], 0
sete cl
push 0
push eax
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi], 0
test eax, eax
je 0x4719a2
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jb 0x471977
call fcn.004877f0
push dword [esi]
call fcn.00470390
add esp, 4
mov dword [esi], 0
lea eax, [edi + 1]
cmp eax, 2
jb 0x471986
mov dword [esi], edi
call fcn.004877f0
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi]
mov byte [esi + 4], 0
inc eax
cmp eax, 1
jbe 0x4719a9
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov byte [esi + 4], 0
int3
int3

Function at 0x472430
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
movzx edx, byte [0x57adf4]
test dl, 1
jne 0x472456
test ecx, ecx
je 0x472454
push ecx
push eax
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x472461
pop ebp
ret
call fcn.0049d290
pop ebp
jmp fcn.004a7ed0
int3

Function at 0x472470
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
mov dword [ecx], 0
test ebx, ebx
je 0x4724c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jb 0x4724aa
call fcn.004877f0
push dword [esi]
call fcn.00470390
add esp, 4
mov dword [esi], 0
lea eax, [ebx + 1]
cmp eax, 2
jb 0x4724b9
mov dword [esi], ebx
call fcn.004877f0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp eax, ebx
je 0x4724d7
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 4
int3

Function at 0x4724e0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov edi, dword [eax]
mov dword [eax], 0
lea ebx, [edi + 1]
cmp ebx, 2
jae 0x472502
cmp dword [esi], edi
jne 0x47250b
jmp 0x472525
call fcn.004877f0
cmp dword [esi], edi
je 0x472525
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
inc ecx
cmp ecx, 2
jae 0x47255c
cmp ebx, 2
jae 0x47257c
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
movzx eax, byte [edi + 4]
mov byte [esi + 4], al
mov byte [edi + 4], 0
mov eax, dword [edi]
inc eax
cmp eax, 2
jb 0x472550
call fcn.004877f0
push dword [edi]
call fcn.00470390
add esp, 4
mov dword [edi], 0
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov dword [ebp - 0x10], eax
call fcn.004877f0
push dword [esi]
call fcn.00470390
mov eax, dword [ebp - 0x10]
add esp, 4
mov dword [esi], 0
cmp ebx, 2
jb 0x47251e
mov dword [esi], edi
mov edi, eax
call fcn.004877f0
mov eax, edi
jmp 0x47251e
Function at 0x472650
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [0x575010]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 4], 0
je 0x472676
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x472678
mov eax, dword [esi]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x47269a
mov bl, 1
cmp byte [ebp + 0xc], 0
je 0x4726f8
cmp byte [esi + 4], 0
je 0x4726d9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x4726db
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [esi + 4], 0
je 0x4726ae
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x4726b0
mov eax, dword [esi]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4726c4
xor ebx, ebx
jmp 0x4726f8
mov dword [ebp - 0x14], 0xffffffff
cmp byte [esi + 4], 0
je 0x4726e9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x4726eb
mov eax, dword [esi]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x4726f8
mov eax, dword [esi]
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00508d63
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x473f20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, ecx
mov edi, dword [ebp + 0xc]
mov eax, dword [0x575010]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
mov dword [esp + 0x54], 0xffffffff
mov dword [esp + 0x50], 0xffffffff
lea ebx, [esp + 0x10]
push 0x65
push str....._base_files_file_win.cc
push str.ReadAtCurrentPos
push ebx
call fcn.004877c0
add esp, 0x10
lea ecx, [esp + 0x20]
push 0
push ebx
call fcn.00479320
test edi, edi
js 0x473fe3
mov ebx, dword [ebp + 8]
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x10], 0
call fcn.004c5070
test al, al
je 0x473fb9
lea ecx, [esp + 0x10]
push 0
push edi
push esi
push str.File::ReadAtCurrentPos
call fcn.004c5180
mov dword [esp + 0xc], 0xffffffff
lea eax, [esp + 0xc]
push 0
push eax
push edi
push ebx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x473fea
mov ebx, dword [esp + 0xc]
test ebx, ebx
jns 0x473ffa
int3
mov ebx, 0xffffffff
jmp 0x474003
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x26
setne bl
neg ebx
lea ecx, [esp + 0x10]
call fcn.004c5110
lea ecx, [esp + 0x20]
call fcn.004793a0
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.00508d63
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x474030
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, ecx
mov edi, dword [ebp + 0xc]
mov eax, dword [0x575010]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
mov dword [esp + 0x54], 0xffffffff
mov dword [esp + 0x50], 0xffffffff
lea ebx, [esp + 0x10]
push 0x9d
push str....._base_files_file_win.cc
push str.WriteAtCurrentPos
push ebx
call fcn.004877c0
add esp, 0x10
lea ecx, [esp + 0x20]
push 0
push ebx
call fcn.00479320
test edi, edi
js 0x4740fb
mov ebx, dword [ebp + 8]
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x10], 0
call fcn.004c5070
test al, al
je 0x4740cc
lea ecx, [esp + 0x10]
push 0
push edi
push esi
push str.File::WriteAtCurrentPos
call fcn.004c5180
mov dword [esp + 0xc], 0xffffffff
lea eax, [esp + 0xc]
push 0
push eax
push edi
push ebx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor esi, esi
cmp eax, 1
sbb esi, esi
or esi, dword [esp + 0xc]
lea ecx, [esp + 0x10]
call fcn.004c5110
jmp 0x474100
mov esi, 0xffffffff
lea ecx, [esp + 0x20]
call fcn.004793a0
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.00508d63
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x474120
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, ecx
mov eax, dword [0x575010]
xor eax, ebp
mov dword [esp + 0x5c], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
mov dword [esp + 0x54], 0xffffffff
mov dword [esp + 0x50], 0xffffffff
lea edi, [esp + 0x10]
push 0xb2
push str....._base_files_file_win.cc
push str.GetLength
push edi
call fcn.004877c0
add esp, 0x10
lea ecx, [esp + 0x20]
push 0
push edi
call fcn.00479320
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x10], 0
call fcn.004c5070
test al, al
je 0x4741b2
lea ecx, [esp + 0x10]
push 0
push 0
push esi
push str.File::GetLength
call fcn.004c5180
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], 0xffffffff
lea eax, [esp + 8]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
xor esi, esi
cmp eax, 1
sbb esi, esi
mov edi, dword [esp + 0xc]
or edi, esi
or esi, dword [esp + 8]
lea ecx, [esp + 0x10]
call fcn.004c5110
lea ecx, [esp + 0x20]
call fcn.004793a0
mov ecx, dword [esp + 0x5c]
xor ecx, ebp
call fcn.00508d63
mov eax, esi
mov edx, edi
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
Function at 0x474210
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov esi, ecx
mov ebx, dword [ebp + 8]
mov eax, dword [0x575010]
xor eax, ebp
mov dword [esp + 0x68], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
mov dword [esp + 0x64], 0xffffffff
mov dword [esp + 0x60], 0xffffffff
lea edi, [esp + 0x20]
push 0xbf
push str....._base_files_file_win.cc
push str.SetLength
push edi
call fcn.004877c0
add esp, 0x10
lea ecx, [esp + 0x30]
push 0
push edi
mov edi, dword [ebp + 0xc]
call fcn.00479320
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x20], 0
call fcn.004c5070
test al, al
je 0x4742a7
lea ecx, [esp + 0x20]
push edi
push ebx
push esi
push str.File::SetLength
call fcn.004c5180
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov eax, dword [esi]
sub esp, 0x14
movsd xmm0, qword [esp + 0x24]
movsd qword [esp + 4], xmm0
lea ecx, [esp + 0x2c]
mov dword [esp + 0xc], ecx
mov dword [esp], eax
mov dword [esp + 0x10], 1
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x47437b
mov dword [esp + 8], ebx
mov dword [esp + 0xc], edi
mov eax, dword [esi]
sub esp, 0x14
movsd xmm0, qword [esp + 0x1c]
movsd qword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x47437b
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x47437b
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 4], ecx
mov dword [esp], eax
mov eax, dword [esi]
sub esp, 0x14
movsd xmm0, qword [esp + 0x14]
movsd qword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
setne bl
jmp 0x47437d
xor ebx, ebx
lea ecx, [esp + 0x20]
call fcn.004c5110
lea ecx, [esp + 0x30]
call fcn.004793a0
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.00508d63
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8