joyce8/EMBER2024-capa huggingface dataset:
Function at 0x450660
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x562b70
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x5cc5b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
lea eax, [ebx + 0x20]
push eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x44], vtable.ProtocolFilters::AutoLock.0
mov dword [ebp - 0x40], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
mov ecx, ebx
call fcn.00454570
cmp dword [esi + 0x10], 0
mov byte [ebp - 4], 1
jne 0x4506cb
xor bl, bl
jmp 0x4507ed
mov edi, dword [ebx]
lea eax, [ebp - 0x28]
push eax
mov ecx, ebx
mov dword [ebp - 0x2c], edi
call fcn.0044fb90
mov esi, eax
mov eax, dword [ebx]
cmp esi, eax
je 0x450735
cmp dword [esi + 0x24], 0x10
lea edx, [esi + 0x10]
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x30], eax
jb 0x4506f4
mov edx, dword [edx]
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
mov edi, dword [ebp - 0x18]
cmovae ecx, dword [ebp - 0x28]
cmp edi, eax
cmovb eax, edi
push eax
push edx
push ecx
call fcn.00436e00
mov edi, dword [ebp - 0x2c]
add esp, 0xc
test eax, eax
jne 0x45072c
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x18]
cmp edx, ecx
jb 0x450733
xor eax, eax
cmp edx, ecx
setne al
test eax, eax
js 0x450733
mov dword [ebp - 0x2c], esi
jmp 0x450738
mov eax, dword [ebx]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
cmp dword [eax], edi
jne 0x4507eb
cmp dword [ebx + 0x1c], 8
lea esi, [ebx + 8]
jb 0x450750
mov eax, dword [esi]
jmp 0x450752
mov eax, esi
push 0x5688a4
push eax
call fcn.00505b47
mov edi, eax
add esp, 8
test edi, edi
jne 0x450786
cmp dword [esi + 0x14], 8
jb 0x45076e
mov esi, dword [esi]
push 0x5688ac
push esi
call fcn.00505b47
mov edi, eax
add esp, 8
test edi, edi
jne 0x450786
xor bl, bl
jmp 0x4507ed
push 2
push 0
push edi
call fcn.005056c8
mov eax, dword [ebp - 0x38]
push edi
push 4
push 1
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x34]
push eax
call fcn.00503c46
add esp, 0x1c
cmp eax, 4
jne 0x4507c9
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push edi
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
push 1
push eax
call fcn.00503c46
add esp, 0x10
push edi
call fcn.00503e3c
movzx eax, byte [0x5d3dfe]
add esp, 4
mov ecx, ebx
push eax
lea eax, [ebp - 0x28]
push eax
push 0
lea eax, [ebp - 0x3c]
push eax
call fcn.0044e510
mov bl, 1
cmp dword [ebp - 0x14], 0x10
jb 0x4507fe
push dword [ebp - 0x28]
call fcn.00503a69
add esp, 4
push dword [ebp - 0x40]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00501f35
mov esp, ebp
pop ebp
ret 4
Function at 0x451310
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x562c78
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x5cc5b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
lea eax, [ebx + 0x14]
push eax
mov dword [ebp - 0x44], vtable.ProtocolFilters::AutoLock.0
mov dword [ebp - 0x40], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
mov ecx, ebx
call fcn.00454570
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
mov ecx, ebx
call fcn.0044fb90
mov edi, dword [ebx]
mov esi, eax
cmp esi, edi
je 0x4513d4
cmp dword [esi + 0x24], 0x10
lea edx, [esi + 0x10]
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x3c], eax
jb 0x45138f
mov edx, dword [edx]
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
mov edi, dword [ebp - 0x18]
cmovae ecx, dword [ebp - 0x28]
cmp edi, eax
cmovb eax, edi
push eax
push edx
push ecx
call fcn.00436e00
add esp, 0xc
test eax, eax
jne 0x4513c8
mov ecx, dword [ebp - 0x3c]
mov edx, edi
cmp edx, ecx
jae 0x4513bf
or eax, 0xffffffff
jmp 0x4513c6
xor eax, eax
cmp edx, ecx
setne al
test eax, eax
mov edi, dword [ebx]
sets al
mov dword [ebp - 0x3c], esi
test al, al
je 0x4513d7
mov dword [ebp - 0x3c], edi
lea esi, [ebp - 0x3c]
mov esi, dword [esi]
cmp esi, edi
je 0x451479
push 0
push dword [esi + 0x28]
push dword [ebx + 0x10]
call fcn.005056c8
push dword [ebx + 0x10]
lea eax, [ebp - 0x38]
push 0x10
push 1
push eax
call fcn.0050558d
add esp, 0x1c
cmp eax, 0x10
jne 0x451479
push 0
push dword [esi + 0x28]
push dword [ebx + 0x10]
call fcn.005056c8
push dword [ebx + 0x10]
xor eax, eax
push 0x10
mov word [ebp - 0x36], ax
lea eax, [ebp - 0x38]
push 1
push eax
call fcn.00503c46
add esp, 0x1c
cmp eax, 0x10
jne 0x451479
mov edi, dword [esi + 0x40]
test edi, edi
je 0x45145e
mov dword [ebp - 0x3c], edi
lea ecx, [edi + 0x18]
mov byte [ebp - 4], 2
call fcn.0044cf70
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.0044cf70
push edi
call fcn.00503a69
add esp, 4
push esi
lea eax, [ebp - 0x3c]
mov ecx, ebx
push eax
call fcn.004516c0
push dword [ebx + 0x10]
call fcn.00502e30
add esp, 4
mov bl, 1
jmp 0x45147b
xor bl, bl
cmp dword [ebp - 0x14], 0x10
jb 0x45148c
push dword [ebp - 0x28]
call fcn.00503a69
add esp, 4
push dword [ebp - 0x40]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00501f35
mov esp, ebp
pop ebp
ret 4
Function at 0x4534f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x563128
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x5cc5b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
cmp dword [edi + 0x1c], 8
lea eax, [edi + 8]
mov dword [ebp - 4], 0
mov bl, 1
jb 0x453543
mov eax, dword [eax]
push 0x5688a4
push eax
call fcn.00505b47
mov esi, eax
add esp, 8
test esi, esi
jne 0x45355e
xor bl, bl
jmp 0x453612
push esi
push 4
lea eax, [ebp - 0x2c]
push 1
push eax
call fcn.0050558d
add esp, 0x10
cmp eax, 4
jne 0x453609
jmp 0x453580
mov ecx, dword [ebp - 0x2c]
cmp ecx, 0x7d0
ja 0x453607
mov eax, dword [ebp - 0x18]
cmp ecx, eax
ja 0x4535a6
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], ecx
cmovae eax, dword [ebp - 0x28]
mov byte [eax + ecx], 0
jmp 0x4535b3
sub ecx, eax
push 0
push ecx
lea ecx, [ebp - 0x28]
call fcn.0043dfb0
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push esi
push dword [ebp - 0x2c]
cmovae eax, dword [ebp - 0x28]
push 1
push eax
call fcn.0050558d
add esp, 0x10
cmp eax, dword [ebp - 0x2c]
jne 0x453607
movzx eax, byte [0x5d3dfe]
mov ecx, edi
push eax
lea eax, [ebp - 0x28]
push eax
push 0
lea eax, [ebp - 0x34]
push eax
call fcn.0044e510
push esi
push 4
lea eax, [ebp - 0x2c]
push 1
push eax
call fcn.0050558d
add esp, 0x10
cmp eax, 4
je 0x453580
jmp 0x453609
xor bl, bl
push esi
call fcn.00503e3c
add esp, 4
cmp dword [ebp - 0x14], 0x10
jb 0x453623
push dword [ebp - 0x28]
call fcn.00503a69
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00501f35
mov esp, ebp
pop ebp
ret
Function at 0x453710
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x563158
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x5cc5b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
xor edi, edi
mov dword [ebp - 4], 0
push edi
push edi
push dword [ebx + 0x10]
call fcn.005056c8
add esp, 0xc
lea eax, [ebp - 0x38]
push dword [ebx + 0x10]
push 0x10
push 1
push eax
call fcn.0050558d
add esp, 0x10
cmp eax, 0x10
sete al
test al, al
je 0x4538b9
mov ax, word [ebp - 0x36]
test ax, ax
jne 0x45379d
movzx eax, word [ebp - 0x38]
add edi, eax
push 0
push edi
jmp 0x45375d
movzx ecx, ax
mov eax, dword [ebp - 0x18]
cmp ecx, eax
ja 0x4537bb
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], ecx
cmovae eax, dword [ebp - 0x28]
mov byte [eax + ecx], 0
jmp 0x4537c8
sub ecx, eax
push 0
push ecx
lea ecx, [ebp - 0x28]
call fcn.0043dfb0
push dword [ebx + 0x10]
movzx esi, word [ebp - 0x36]
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
push esi
cmovae eax, dword [ebp - 0x28]
push 1
push eax
call fcn.0050558d
add esp, 0x10
cmp eax, esi
jne 0x4538b9
mov eax, dword [ebp - 0x30]
xorps xmm0, xmm0
mov dword [ebp - 0x58], eax
mov ecx, ebx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x68], edi
movlpd qword [ebp - 0x60], xmm0
mov dword [ebp - 0x50], 0
call fcn.0044fb90
mov esi, eax
cmp esi, dword [ebx]
je 0x453869
cmp dword [esi + 0x24], 0x10
lea edx, [esi + 0x10]
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x3c], eax
jb 0x45382e
mov edx, dword [edx]
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
mov ebx, dword [ebp - 0x18]
cmovae ecx, dword [ebp - 0x28]
cmp ebx, dword [ebp - 0x3c]
cmovb eax, ebx
push eax
push edx
push ecx
call fcn.00436e00
mov ebx, dword [ebp - 0x48]
add esp, 0xc
test eax, eax
jne 0x453867
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x18]
cmp edx, ecx
jb 0x453869
xor eax, eax
cmp edx, ecx
setne al
test eax, eax
jns 0x453897
lea eax, [ebp - 0x28]
mov ecx, ebx
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x3d]
push eax
lea eax, [ebp - 0x3c]
push eax
push 0x5d3dfd
call fcn.0044d3c0
push eax
add eax, 0x10
mov ecx, ebx
push eax
push esi
lea eax, [ebp - 0x44]
push eax
call fcn.0044de00
mov esi, dword [ebp - 0x44]
movdqu xmm0, xmmword [ebp - 0x68]
push 0
movdqu xmmword [esi + 0x28], xmm0
movdqu xmm0, xmmword [ebp - 0x58]
movdqu xmmword [esi + 0x38], xmm0
movzx eax, word [ebp - 0x38]
add edi, eax
push edi
jmp 0x45375d
cmp dword [ebp - 0x14], 0x10
jb 0x4538ca
push dword [ebp - 0x28]
call fcn.00503a69
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00501f35
mov esp, ebp
pop ebp
ret
Function at 0x453980
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x5cc5b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
cmp dword [eax + 0x14], 8
jb 0x4539a3
mov eax, dword [eax]
push 0x5688b4
push eax
call fcn.00505b47
mov esi, eax
add esp, 8
test esi, esi
jne 0x4539cb
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00501f35
mov esp, ebp
pop ebp
ret 8
push 0
mov ecx, edi
call fcn.0044d1e0
push esi
push 0x200
lea eax, [ebp - 0x204]
push 1
push eax
call fcn.0050558d
add esp, 0x10
test eax, eax
je 0x453a1c
nop
push 1
push eax
lea eax, [ebp - 0x204]
mov ecx, edi
push eax
call fcn.0044d0e0
push esi
push 0x200
lea eax, [ebp - 0x204]
push 1
push eax
call fcn.0050558d
add esp, 0x10
test eax, eax
jne 0x4539f0
push esi
call fcn.00503e3c
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
mov al, 1
pop edi
pop esi
call fcn.00501f35
mov esp, ebp
pop ebp
ret 8
Function at 0x453cb0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5631c8
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x5cc5b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
lea eax, [edi + 0x14]
push eax
mov dword [ebp - 0x44], vtable.ProtocolFilters::AutoLock.0
mov dword [ebp - 0x40], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea ecx, [ebp - 0x5c]
mov dword [ebp - 4], 0
call fcn.0044cf40
push esi
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 1
push eax
mov ecx, edi
call fcn.00454570
mov ebx, eax
push ebx
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.0044fb90
mov esi, eax
cmp esi, dword [edi]
je 0x453d4c
cmp dword [esi + 0x24], 0x10
lea eax, [esi + 0x10]
mov ecx, dword [eax + 0x10]
jb 0x453d35
mov eax, dword [eax]
push ecx
push eax
push dword [ebx + 0x10]
mov ecx, ebx
push 0
call fcn.00440710
test eax, eax
js 0x453d4c
mov dword [ebp - 0x3c], esi
jmp 0x453d51
mov eax, dword [edi]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x24], 0x10
lea esi, [ebp - 0x3c]
mov esi, dword [esi]
jb 0x453d67
push dword [ebp - 0x38]
call fcn.00503a69
add esp, 4
mov dword [ebp - 0x24], 0xf
mov dword [ebp - 0x28], 0
mov byte [ebp - 0x38], 0
cmp esi, dword [edi]
je 0x453deb
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
push 0
push dword [esi + 0x28]
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], eax
push dword [edi + 0x10]
call fcn.005056c8
push dword [edi + 0x10]
lea eax, [ebp - 0x20]
push 0x10
push 1
push eax
call fcn.0050558d
add esp, 0x1c
cmp eax, 0x10
jne 0x453deb
mov eax, dword [ebp + 0x10]
push 0
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], eax
push dword [esi + 0x28]
push dword [edi + 0x10]
call fcn.005056c8
push dword [edi + 0x10]
lea eax, [ebp - 0x20]
push 0x10
push 1
push eax
call fcn.00503c46
add esp, 0x1c
cmp eax, 0x10
jne 0x453deb
push dword [edi + 0x10]
call fcn.00502e30
add esp, 4
mov bl, 1
jmp 0x453ded
xor bl, bl
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0
call fcn.0044cf70
lea eax, [edi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00501f35
mov esp, ebp
pop ebp
ret 0xc
Function at 0x454360
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x50], 0xffffffff
je 0x454394
push dword [esi + 0x4c]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0xffffffffffffffff
push dword [esi + 0x50]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 0x50]
cmp eax, 0xffffffff
je 0x454394
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x50], 0xffffffff
push dword [esi + 0x4c]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0
push 0
push esi
push 0x4527c0
push 0
push 0
call fcn.005041fa
mov edi, eax
add esp, 0x18
test edi, edi
je 0x4543d2
mov ecx, dword [esi + 0x50]
cmp ecx, 0xffffffff
je 0x4543cf
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x50], 0xffffffff
mov dword [esi + 0x50], edi
pop edi
pop esi
ret

Function at 0x4543e0
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov esi, ecx
call fcn.00454430
push dword [esi + 0x58]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0
push 0
push esi
push 0x454f40
push 0
push 0
call fcn.005041fa
mov edi, eax
add esp, 0x18
test edi, edi
je 0x454427
mov ecx, dword [esi + 0x5c]
cmp ecx, 0xffffffff
je 0x454424
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x5c], 0xffffffff
mov dword [esi + 0x5c], edi
pop edi
pop esi
ret

Function at 0x454f90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ecx + 0x10]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call fcn.00503c46
add esp, 0x10
cmp eax, dword [ebp + 0xc]
sete al
pop ebp
ret 8

Function at 0x4550b0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5cc5b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov eax, ecx
push edi
mov edi, eax
mov dword [ebp - 0x210], eax
mov edx, esi
sub edi, esi
jmp 0x4550e0
movzx eax, word [edx]
lea edx, [edx + 2]
mov word [edi + edx - 2], ax
test ax, ax
jne 0x4550e0
push 0
push 0x10
push 3
push 0
push 0
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, 0xffffffff
je 0x45511a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x45511f
push 0
push esi
call edi
lea ecx, [ebp - 0x20c]
sub ecx, esi
jmp 0x455130
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x455130
lea ecx, [ebp - 0x20c]
add ecx, 0xfffffffe
lea esp, [esp]
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x455150
mov eax, dword [str.SSL]
push 0
push 0x10
mov dword [ecx], eax
mov eax, dword [0x568a30]
push 3
mov dword [ecx + 4], eax
mov ax, word [0x568a34]
push 0
push 0
mov word [ecx + 8], ax
lea eax, [ebp - 0x20c]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x45519f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4551aa
push 0
lea eax, [ebp - 0x20c]
push eax
call edi
mov ecx, dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push eax
add ecx, 0x208
call fcn.00452fb0
mov ecx, dword [ebp - 4]
test al, al
pop edi
setne al
xor ecx, ebp
pop esi
call fcn.00501f35
mov esp, ebp
pop ebp
ret 4
Function at 0x457230
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 4]
sub esp, 8
cmp eax, 0xffffffff
jne 0x457246
xor eax, eax
xor edx, edx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4591e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
mov ecx, ebx
push esi
call fcn.0044d1b0
push 0x5688b4
push dword [ebp + 8]
call fcn.00505b47
mov esi, eax
add esp, 8
test esi, esi
jne 0x45920b
pop esi
xor al, al
pop ebx
pop ebp
ret
push edi
push 2
push 0
push esi
call fcn.005056c8
push esi
call fcn.00505adb
push 0
push 0
push esi
mov edi, eax
call fcn.005056c8
add esp, 0x1c
test edi, edi
je 0x459263
push edi
mov ecx, ebx
call fcn.0044d1e0
push esi
test al, al
je 0x459254
push edi
push 1
mov ecx, ebx
call fcn.0046d4f0
push eax
call fcn.0050558d
add esp, 0x10
cmp eax, edi
je 0x459263
push esi
call fcn.00503e3c
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret
push esi
call fcn.00503e3c
add esp, 4
mov al, 1
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4593d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push edi
push 0x44
lea eax, [ebp - 0x54]
push 0
push eax
call fcn.00505070
add esp, 0xc
mov dword [ebp - 0x54], 0x44
xor eax, eax
mov dword [ebp - 0x28], 1
mov word [ebp - 0x24], ax
xorps xmm0, xmm0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push dword [ebp + 0xc]
movdqu xmmword [ebp - 0x10], xmm0
push 0
push 8
push 0
push 0
push 0
push dword [ebp + 8]
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
test edi, edi
je 0x459448
push 0xffffffffffffffff
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x464870
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56474e
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5cc5b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov word [esi + 4], 0x100
mov eax, dword [ebp + 8]
lea ecx, [esi + 0x14]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], 0
mov dword [esi], vtable.ProtocolFilters::POP3Filter.0
mov dword [esi + 0xc], eax
call fcn.0044cf40
push 1
push 1
push 0x12c
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
call fcn.0046d160
mov ecx, dword [esi + 8]
lea eax, [esi + 0x44]
push eax
mov byte [ebp - 4], 2
call fcn.0045aac0
mov dword [esi + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x2c], eax
mov eax, esi
mov byte [esi + 5], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x465450
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56474e
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5cc5b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov word [esi + 4], 0x100
mov eax, dword [ebp + 8]
lea ecx, [esi + 0x14]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], 0
mov dword [esi], vtable.ProtocolFilters::SMTPFilter.0
mov dword [esi + 0xc], eax
call fcn.0044cf40
push 1
push 1
push 0x190
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
call fcn.0046d160
mov ecx, dword [esi + 8]
lea eax, [esi + 0x44]
push eax
mov byte [ebp - 4], 2
call fcn.0045aac0
mov dword [esi + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x2c], eax
mov eax, esi
mov byte [esi + 5], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x4693d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56474e
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5cc5b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov word [esi + 4], 0x100
mov eax, dword [ebp + 8]
lea ecx, [esi + 0x14]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], 0
mov dword [esi], vtable.ProtocolFilters::NNTPFilter.0
mov dword [esi + 0xc], eax
call fcn.0044cf40
push 1
push 1
push 0x384
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
call fcn.0046d160
mov ecx, dword [esi + 8]
lea eax, [esi + 0x44]
push eax
mov byte [ebp - 4], 2
call fcn.0045aac0
mov dword [esi + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x2c], eax
mov eax, esi
mov byte [esi + 5], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8