joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a040
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
push ebx
test eax, eax
je 0x40a560
test edx, edx
je 0x40a560
call fcn.0040a057
mov eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x40a5a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.0040a040
mov edx, dword [esp + 0xc]
shl ecx, 4
test eax, eax
jne 0x40a611
lea eax, [edx + ecx + 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
movups xmmword [eax], xmm0
movups xmmword [edx], xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmmword [edx - 0x10], xmm1
cmp eax, edx
ja 0x40a5d6
movups xmm0, xmmword [edx]
aesimc xmm0, xmm0
movups xmmword [edx], xmm0
pxor xmm0, xmm0
pxor xmm1, xmm1
xor eax, eax
ret

Function at 0x40af20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push esi
push edi
sub esp, 0x10
mov ebp, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
bswap eax
bswap ebx
bswap ecx
bswap edx
mov dword [edi], eax
mov dword [edi + 4], ebx
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
cmp ebp, 0x80
je 0x40afa4
mov eax, dword [esi + 0x10]
mov ebx, dword [esi + 0x14]
cmp ebp, 0xc0
je 0x40af7c
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0x1c]
jmp 0x40af84
mov ecx, eax
mov edx, ebx
not ecx
not edx
bswap eax
bswap ebx
bswap ecx
bswap edx
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ecx
mov dword [edi + 0x2c], edx
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
nop
call fcn.0040afa9
Function at 0x443d80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
push eax
push ebx
cmp ecx, 0
je 0x443e6a
and ebp, 0xfffffff8
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
je 0x443dfd
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.00443540
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x443dc3
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x443f33
call fcn.00443e0f
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x443eca
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.00443960
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x443e7b
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x443f33
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.00443960
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x443f2e
jmp 0x443f33
mov ecx, dword [esp + 0x3c]
add esp, 0x18
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x448ad0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b9e60
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x6522a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 8]
or esi, 0xffffffff
test eax, eax
je 0x448b93
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x448b93
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x28]
push str.cannot_stop_VPN
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x28], 0x11
push eax
push 0
mov dword [ebp - 0x20], 0x5c769c
mov dword [ebp - 0x1c], 0x10
mov dword [ebp - 0x14], str.AdminDaemonDatas
call fcn.0044ef70
add esp, 0x10
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 4], 0
test ecx, ecx
je 0x448b70
mov eax, esi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x448b70
mov dword [ebp - 0x18], 0
mov eax, dword [ecx]
call dword [eax]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 4], 1
test ecx, ecx
je 0x448b93
mov eax, esi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x448b93
mov dword [ebp - 0x24], 0
mov eax, dword [ecx]
call dword [eax]
mov ecx, dword [edi + 0x10]
mov dword [ebp - 4], 2
test ecx, ecx
je 0x448bb4
lock xadd dword [ecx + 4], esi
dec esi
jne 0x448bb4
mov dword [edi + 0x10], 0
mov eax, dword [ecx]
call dword [eax]
mov ecx, edi
call fcn.0044efc0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x448be0
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
push 0x5c76c4
call fcn.00451070
push 0x44e070
call fcn.00451080
add esp, 8
pop ebp
jmp fcn.0044fee0
Function at 0x44d380
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ba865
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x6522a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov ebx, dword [esi + 0x18]
mov ecx, ebx
mov eax, dword [ebx]
call dword [eax + 4]
mov edi, dword [esi + 0x18]
mov esi, dword [edi + 0x10]
mov ecx, dword [edi + 0xc]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], esi
test esi, esi
je 0x44d3e5
add esi, 4
nop dword [eax]
mov edx, dword [esi]
mov eax, edx
lea ecx, [edx + 1]
lock cmpxchg dword [esi], ecx
cmp eax, edx
jne 0x44d3d0
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [edi + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov edx, dword [eax]
test edx, edx
je 0x44d44a
test ecx, ecx
je 0x44d44a
lea ecx, [ebp - 0x1c]
cmp ecx, eax
je 0x44d44a
push edx
push dword [eax + 8]
call fcn.0044b880
test al, al
jne 0x44d44a
mov dword [ebp - 4], 0
test esi, esi
je 0x44d428
or eax, 0xffffffff
lock xadd dword [esi + 4], eax
dec eax
jne 0x44d428
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov eax, dword [ebx]
mov ecx, ebx
mov dword [ebp - 4], 1
call dword [eax + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov ecx, dword [eax + 8]
mov dword [ebp + 8], ecx
mov dword [eax + 8], 0
or edi, 0xffffffff
mov dword [ebp - 4], 2
test esi, esi
je 0x44d47b
mov eax, edi
lock xadd dword [esi + 4], eax
dec eax
jne 0x44d47b
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov eax, dword [ebx]
mov ecx, ebx
mov dword [ebp - 4], 3
call dword [eax + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x44d531
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x44d531
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], str.stopVpn
mov dword [ebp - 4], 4
mov dword [ebp - 0x28], 0xb
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], str.RpcStartVpn
push str.can_not_stop_VPN
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x28]
push eax
push 0
call fcn.0044ef70
add esp, 0x10
mov ecx, dword [ebp - 0x24]
mov byte [ebp - 4], 6
test ecx, ecx
je 0x44d510
mov eax, edi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x44d510
mov dword [ebp - 0x24], 0
mov eax, dword [ecx]
call dword [eax]
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 4], 7
test ecx, ecx
je 0x44d531
lock xadd dword [ecx + 4], edi
dec edi
jne 0x44d531
mov dword [ebp - 0x30], 0
mov eax, dword [ecx]
call dword [eax]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x456ac0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bb9cf
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x6522a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edx, eax
mov esi, dword [ebp + 8]
mov ecx, edx
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], 4
mov dword [esi], 0
lea edi, [ecx + 1]
mov dword [esi + 4], 0
mov dword [esi + 8], 0x5c763c
mov al, byte [ecx]
inc ecx
test al, al
jne 0x456b21
sub ecx, edi
push ecx
push edx
mov ecx, esi
call fcn.00451de0
or ebx, 0xffffffff
mov dword [ebp - 4], 0
cmp dword [0x64e190], 0
mov dword [ebp - 0x10], 3
je 0x456c52
cmp dword [esi], 0
jbe 0x456c52
mov eax, dword [esi + 8]
mov al, byte [eax]
cmp al, 0x22
jne 0x456c52
push 1
push 0x22
mov ecx, esi
call fcn.00452060
mov ecx, dword [esi + 8]
mov edi, dword [esi + 4]
inc ecx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x14], ecx
cmp eax, dword [0x64e190]
je 0x456bdd
dec eax
mov dword [ebp - 0x20], eax
test edi, edi
je 0x456ba4
add edi, 4
mov edx, dword [edi]
mov eax, edx
lea ecx, [edx + 1]
lock cmpxchg dword [edi], ecx
cmp eax, edx
jne 0x456b92
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], ecx
test ecx, ecx
jne 0x456bc2
push 0x341
push 0x5c7560
push str.m_string
call fcn.00597603
add esp, 0xc
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 2
push eax
mov ecx, esi
call fcn.00448ed0
mov dword [ebp - 4], 3
jmp 0x456c39
mov eax, dword [esi]
dec eax
mov dword [ebp - 0x20], eax
test edi, edi
je 0x456c02
add edi, 4
nop word [eax + eax]
mov edx, dword [edi]
mov eax, edx
lea ecx, [edx + 1]
lock cmpxchg dword [edi], ecx
cmp eax, edx
jne 0x456bf0
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], ecx
test ecx, ecx
jne 0x456c20
push 0x341
push 0x5c7560
push str.m_string
call fcn.00597603
add esp, 0xc
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 4
push eax
mov ecx, esi
call fcn.00448ed0
mov dword [ebp - 4], 5
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x456c4e
mov eax, ebx
lock xadd dword [ecx + 4], eax
dec eax
jne 0x456c4e
mov eax, dword [ecx]
call dword [eax]
mov byte [ebp - 4], 0
lea eax, [ebp - 0x2c]
mov ecx, esi
push eax
call fcn.00453720
push eax
mov ecx, esi
mov dword [ebp - 4], 6
call fcn.00448ed0
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 4], 7
test ecx, ecx
je 0x456c8d
lock xadd dword [ecx + 4], ebx
dec ebx
jne 0x456c8d
mov dword [ebp - 0x28], 0
mov edx, dword [ecx]
call dword [edx]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x456f90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bba45
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
mov eax, dword [0x6522a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x655590
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jne 0x457001
mov ecx, 0x655590
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x456fd5
mov eax, dword [ebp + 8]
sub ecx, edx
mov dword [eax], ecx
mov dword [eax + 4], 0
mov dword [eax + 8], 0x655590
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x28], 0x1f
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], str.getUserApplicationDataDirectory
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 4
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], str.File
push str.can_not_retrieve_user_application_data_folder
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
call fcn.0044ef70
add esp, 0x10
mov ecx, dword [ebp - 0x18]
or esi, 0xffffffff
mov byte [ebp - 4], 2
test ecx, ecx
je 0x457070
mov eax, esi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x457070
mov dword [ebp - 0x18], 0
mov eax, dword [ecx]
call dword [eax]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 4], 3
test ecx, ecx
je 0x457091
lock xadd dword [ecx + 4], esi
dec esi
jne 0x457091
mov dword [ebp - 0x24], 0
mov eax, dword [ecx]
call dword [eax]
push 0x655698
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov ecx, 0x655698
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4570b0
mov eax, dword [ebp + 8]
sub ecx, edx
mov dword [eax], ecx
mov dword [eax + 4], 0
mov dword [eax + 8], 0x655698
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4570e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bba45
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
mov eax, dword [0x6522a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x655488
push 0
push 0
push 0x28
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jne 0x457151
mov ecx, 0x655488
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x457125
mov eax, dword [ebp + 8]
sub ecx, edx
mov dword [eax], ecx
mov dword [eax + 4], 0
mov dword [eax + 8], 0x655488
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x28], 0x17
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], str.getUserProfileDirectory
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 4
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], str.File
push str.can_not_retrieve_user_profile_folder
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
call fcn.0044ef70
add esp, 0x10
mov ecx, dword [ebp - 0x18]
or esi, 0xffffffff
mov byte [ebp - 4], 2
test ecx, ecx
je 0x4571c0
mov eax, esi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4571c0
mov dword [ebp - 0x18], 0
mov eax, dword [ecx]
call dword [eax]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 4], 3
test ecx, ecx
je 0x4571e1
lock xadd dword [ecx + 4], esi
dec esi
jne 0x4571e1
mov dword [ebp - 0x24], 0
mov eax, dword [ecx]
call dword [eax]
push 0x655698
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov ecx, 0x655698
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x457200
mov eax, dword [ebp + 8]
sub ecx, edx
mov dword [eax], ecx
mov dword [eax + 4], 0
mov dword [eax + 8], 0x655698
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x457230
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bba7d
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
mov eax, dword [0x6522a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x1c]
push 0x5c
push 0x2f
push eax
call fcn.00452a00
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0
call fcn.00453230
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x457289
test al, 0x10
je 0x457289
mov bl, 1
jmp 0x45728b
xor bl, bl
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 4], 1
test ecx, ecx
je 0x4572af
or edx, 0xffffffff
lock xadd dword [ecx + 4], edx
dec edx
jne 0x4572af
mov dword [ebp - 0x18], 0
mov edx, dword [ecx]
call dword [edx]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x457460
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bbab5
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push esi
mov eax, dword [0x6522a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ecx + 0x10], 2
jne 0x4574a7
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push 0
push eax
push esi
push dword [ebp + 8]
push dword [ecx + 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x10], esi
jne 0x4574b9
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
push 0x25
lea eax, [ebp - 0x1c]
push str.C:Devgit_toolkitlibs_base_file.cpp
push eax
call fcn.00448a50
mov esi, eax
push 5
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push str.EFile
push eax
call fcn.00448a50
add esp, 0x18
push 0x178
push esi
push eax
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 1
call fcn.00456400
push 0x6402e8
lea eax, [ebp - 0x4c]
push eax
call fcn.00594600
int3

Function at 0x457940
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bbbad
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
push esi
mov eax, dword [0x6522a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x1c]
push 0x5c
push 0x2f
push eax
call fcn.00452a00
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0
call fcn.00453230
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x4579c4
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 4], 3
test ecx, ecx
je 0x4579b4
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4579b4
mov dword [ebp - 0x18], 0
mov eax, dword [ecx]
call dword [eax]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0x25
lea eax, [ebp - 0x28]
push str.C:Devgit_toolkitlibs_base_file.cpp
push eax
call fcn.00448a50
mov esi, eax
push 5
lea eax, [ebp - 0x34]
push str.EFile
push eax
call fcn.00448a50
add esp, 0x18
push 0x394
push esi
push eax
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 2
call fcn.00456400
push 0x6402e8
lea eax, [ebp - 0x58]
push eax
call fcn.00594600
int3
Function at 0x457e80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bbc95
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push esi
push edi
mov eax, dword [0x6522a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ecx + 0x14], 1
jne 0x457f60
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push 0
push eax
push esi
push dword [ebp + 8]
push dword [ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x457f73
cmp dword [ebp - 0x10], esi
je 0x457f60
push 5
lea eax, [ebp - 0x1c]
push str.write
push eax
call fcn.00448a50
mov esi, eax
push 4
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 4
push str.File
push eax
call fcn.00448a50
push str.can_not_write_file__bad_sizes
push esi
push eax
push 0
mov byte [ebp - 4], 5
call fcn.0044ef70
add esp, 0x28
lea ecx, [ebp - 0x28]
call fcn.004482d0
lea ecx, [ebp - 0x1c]
call fcn.004482d0
push 0x25
lea eax, [ebp - 0x28]
push str.C:Devgit_toolkitlibs_base_file.cpp
push eax
call fcn.00448a50
mov esi, eax
push 5
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 6
push str.EFile
push eax
call fcn.00448a50
add esp, 0x18
mov byte [ebp - 4], 7
push 0x11a
jmp 0x458000
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea eax, [ebp - 0x28]
push 5
push str.write
push eax
add edi, str.can_not_write_file__error:
call fcn.00448a50
mov esi, eax
push 4
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 0
push str.File
push eax
call fcn.00448a50
push edi
push esi
push eax
push 0
mov byte [ebp - 4], 1
call fcn.0044ef70
add esp, 0x28
lea ecx, [ebp - 0x1c]
call fcn.004482d0
lea ecx, [ebp - 0x28]
call fcn.004482d0
push 0x25
lea eax, [ebp - 0x28]
push str.C:Devgit_toolkitlibs_base_file.cpp
push eax
call fcn.00448a50
mov esi, eax
push 5
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 2
push str.EFile
push eax
call fcn.00448a50
add esp, 0x18
mov byte [ebp - 4], 3
push 0x116
push esi
push eax
lea ecx, [ebp - 0x4c]
call fcn.00456400
push 0x6402e8
lea eax, [ebp - 0x4c]
push eax
call fcn.00594600
int3
Function at 0x458290
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bbdaa
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x6522a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
lea esi, [ebx + 4]
mov dword [ebp - 0x14], esi
push 0x18
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.005927e6
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea ecx, [esi + 8]
mov dword [ebp - 4], 0
call fcn.004624f0
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [ebx + 0x28], eax
cmp eax, 0xffffffff
jne 0x45831b
push str.ERROR:_unable_to_allocate_a_TLS_entry_for_currentThread_var_n
call fcn.0045a910
add esp, 4
push 0x18
call fcn.005927e6
mov edi, eax
add esp, 4
mov dword [ebp - 0x14], edi
mov byte [ebp - 4], 2
test edi, edi
je 0x45842f
mov dword [ebp - 0x28], 0xa
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], str.MainThread
mov dword [edi], vtable.p2ptoolkit::Thread.0
mov dword [edi + 8], 0
mov dword [edi + 4], 0xa
mov dword [edi + 0xc], str.MainThread
push 0x4c
mov byte [ebp - 4], 4
mov byte [edi + 0x10], 1
call fcn.005927e6
mov ebx, eax
add esp, 4
mov dword [ebp - 0x18], ebx
mov byte [ebp - 4], 5
test ebx, ebx
je 0x45840d
lea ecx, [ebx + 4]
mov dword [ebx], vtable.p2ptoolkit::ThreadPrivateBase.0
call fcn.0044ef90
lea ecx, [ebx + 0x10]
mov byte [ebp - 4], 6
mov word [ebx + 0xc], 0
call fcn.00461ac0
lea esi, [ebx + 0x14]
mov byte [ebp - 4], 7
mov dword [ebp - 0x1c], esi
push 0x18
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.005927e6
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea ecx, [esi + 8]
mov byte [ebp - 4], 8
call fcn.004624f0
lea ecx, [ebx + 0x44]
mov byte [ebp - 4], 9
mov dword [ebx], vtable.p2ptoolkit::ThreadPrivate.0
mov dword [ebx + 0x40], 0
call fcn.00461ac0
lea ecx, [ebx + 0x48]
mov byte [ebp - 4], 0xa
call fcn.00461ac0
jmp 0x45840f
xor ebx, ebx
mov dword [edi + 0x14], ebx
mov eax, dword [ebp - 0x10]
mov dword [edi], vtable.p2ptoolkit::MainThread.0
mov dword [eax], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebx], 0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret