joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44b8d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5148c5
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x55f2b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x14], esi
cmp esi, 0x40
jb 0x44ba00
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x44ba00
mov ebx, dword [edi + 0x3c]
test ebx, ebx
js 0x44b9fe
cmp esi, ebx
jb 0x44b9fe
sub edx, ebx
lea ecx, [ebx + edi]
cmp edx, 4
jb 0x44b9fe
cmp dword [ecx], 0x4550
jne 0x44b9fe
sub edx, 4
cmp edx, 0x14
jb 0x44b9fe
movzx eax, word [ecx + 4]
sub edx, 0x14
mov dword [ebp - 0x34], 0x14c
cmp ax, word [ebp - 0x34]
jne 0x44b98d
cmp edx, 0xe0
jb 0x44b9fe
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x44b9fe
mov eax, dword [ecx + 0x98]
mov ecx, dword [ecx + 0x9c]
jmp 0x44b9c6
mov dword [ebp - 0x34], 0x8664
cmp ax, word [ebp - 0x34]
je 0x44b9a7
mov dword [ebp - 0x34], 0xaa64
cmp ax, word [ebp - 0x34]
jne 0x44b9fe
cmp edx, 0xf0
jb 0x44b9fe
mov eax, 0x20b
cmp word [ecx + 0x18], ax
jne 0x44b9fe
mov eax, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xac]
lea edx, [ebx + 0x58]
lea ebx, [ecx + eax]
mov dword [ebp - 0x34], ebx
mov ebx, edx
cmp dword [ebp - 0x34], esi
ja 0x44ba00
cmp dword [ebp - 0x34], eax
jb 0x44ba00
test eax, eax
jne 0x44b9e4
test ecx, ecx
cmove eax, esi
dec eax
xor ecx, ecx
cmp eax, esi
jae 0x44b9f8
cmp byte [eax + edi], 0
jne 0x44b9f8
inc ecx
dec eax
cmp ecx, 8
jl 0x44b9e7
inc eax
mov dword [ebp - 0x14], eax
jmp 0x44ba00
xor ebx, ebx
lea eax, [ebp - 0x14]
mov edx, edi
push eax
lea ecx, [ebp - 0x30]
call fcn.0044ac60
add esp, 4
mov dword [ebp - 4], 0
cmp byte [ebp - 0x24], 0
jne 0x44ba25
xor bl, bl
jmp 0x44bac0
push ebx
push dword [ebp - 0x14]
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
mov edx, edi
movq qword [ebp - 0x20], xmm0
lea ecx, [ebp - 0x20]
call fcn.0044af80
lea eax, [ebp + 8]
mov byte [ebp - 4], 1
push eax
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x20]
call fcn.0044b380
mov edx, dword [ebp - 0x20]
add esp, 0xc
mov bl, al
test edx, edx
je 0x44ba8a
mov ecx, dword [ebp - 0x18]
mov eax, edx
sub ecx, edx
cmp ecx, 0x1000
jb 0x44ba80
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44bade
push ecx
push edx
call fcn.004d06e3
add esp, 8
cmp byte [ebp - 0x24], 0
je 0x44bac0
mov ecx, dword [ebp - 0x30]
test ecx, ecx
je 0x44bac0
mov edx, dword [ebp - 0x28]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x44bab6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44bade
push edx
push ecx
call fcn.004d06e3
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d0675
mov esp, ebp
pop ebp
ret
call fcn.004ebf29
int3
Function at 0x44baf0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x514925
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x55f2b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x50], edx
mov eax, ecx
mov dword [ebp - 0x4c], eax
lea ecx, [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x44bc42
mov esi, dword [ebp - 0x18]
mov eax, esi
mov edi, dword [ebp - 0x14]
or eax, edi
jne 0x44bb5e
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d0675
mov esp, ebp
pop ebp
ret
xorps xmm0, xmm0
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x44], 0xffffffff
movups xmmword [ebp - 0x34], xmm0
movq qword [ebp - 0x24], xmm0
mov dword [ebp - 4], 0
mov byte [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
movlpd qword [ebp - 0x34], xmm0
mov dword [ebp - 0x2c], 0
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
sub esp, 0x10
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x44]
push dword [ebp - 0x4c]
call fcn.00464170
xor eax, eax
mov dword [ebp - 4], 3
cmp eax, edi
jne 0x44bc24
test edi, edi
jg 0x44bbd6
jl 0x44bc64
test esi, esi
jb 0x44bc64
cmp byte [ebp - 0x28], al
je 0x44bc82
push dword [ebp - 0x50]
mov edx, esi
mov esi, dword [ebp - 0x24]
mov ecx, esi
call fcn.0044b8d0
add esp, 4
mov byte [ebp - 0x45], al
test esi, esi
je 0x44bbff
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [ebp - 0x3c]
test ecx, ecx
je 0x44bc0d
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x44]
cmp eax, 0xffffffff
je 0x44bc1c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 0x45]
jmp 0x44bb43
xorps xmm0, xmm0
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x1c]
movq qword [ebp - 0x1c], xmm0
call fcn.0041cc90
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.0041ccb0
push str.Unable_to_get_file_size_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x30]
call fcn.00468e50
push 0x55c1ac
lea eax, [ebp - 0x30]
push eax
call fcn.004e81cb
xorps xmm0, xmm0
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x1c]
movq qword [ebp - 0x1c], xmm0
call fcn.0041cc90
mov ecx, eax
mov byte [ebp - 4], 5
call fcn.0041ccb0
push str.Unable_to_retrieve_pointer_of_the_unmapped_view_
lea ecx, [ebp - 0x64]
call fcn.00468e20
push 0x55c1ac
lea eax, [ebp - 0x64]
push eax
call fcn.004e81cb
int3
Function at 0x44cf90
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0x58
mov esi, ecx
call fcn.004d06b3
push 0x58
mov edi, eax
push 0
push edi
call fcn.004e8d40
add esi, 4
lea eax, [ebp - 4]
add esp, 0x10
cmp esi, eax
je 0x44cfc5
mov eax, dword [esi]
mov dword [esi], edi
test eax, eax
je 0x44cfd0
push 0x58
push eax
jmp 0x44cfc8
push 0x58
push edi
call fcn.004d06e3
add esp, 8
mov eax, dword [esi]
pop edi
pop esi
mov dword [eax + 0x14], 0
mov dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov esp, ebp
pop ebp
ret

Function at 0x44d730
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x55f2b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
je 0x44d80c
push ebx
mov ebx, dword [ebp + 8]
test edi, edi
jne 0x44d75b
test bl, 1
je 0x44d7b5
mov edx, dword [esi + 0x10]
mov ecx, 0x78
mov eax, dword [esi + 0x14]
mov dword [ebp - 0xc], edx
shr edx, 3
mov dword [ebp - 8], eax
and edx, 0x3f
sub ecx, edx
mov eax, 0x38
sub eax, edx
cmp edx, 0x38
mov edx, 0x543f88
cmovae eax, ecx
mov ecx, esi
push eax
call fcn.0044d670
push 8
lea edx, [ebp - 0xc]
mov ecx, esi
call fcn.0044d670
add esp, 8
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
test edi, edi
je 0x44d7b5
movups xmm0, xmmword [esi]
movups xmmword [edi], xmm0
test bl, 3
je 0x44d7f9
test bl, 2
je 0x44d80b
pop ebx
pop edi
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d0675
mov esp, ebp
pop ebp
ret
test bl, 8
je 0x44d80b
push 0x58
push 0
push esi
call fcn.004e8d40
add esp, 0xc
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004d0675
mov esp, ebp
pop ebp
ret
Function at 0x4503b0
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x55f2b4]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x25c]
mov dword [0x566704], eax
mov eax, dword [ebp - 0x244]
mov dword [0x566620], eax
mov eax, dword [ebp - 0x254]
mov dword [0x55fd80], eax
mov eax, dword [ebp - 0x24c]
push 0x118
mov dword [0x55fd88], eax
lea eax, [ebp - 0x11c]
push 0
push eax
mov dword [0x55fd84], 0
call fcn.004e8d40
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x45044e
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push esi
mov esi, dword [0x566700]
test esi, esi
jne 0x45047c
push str.RtlGetVersion
push str.NTDLL.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [0x566700], esi
test esi, esi
je 0x4504c6
push 0x118
lea eax, [ebp - 0x238]
push 0
push eax
call fcn.004e8d40
add esp, 0xc
mov dword [ebp - 0x23c], 0x11c
lea eax, [ebp - 0x23c]
mov ecx, esi
push eax
call dword [0x51a4a0]
call esi
test eax, eax
jne 0x4504c6
push edi
mov ecx, 0x47
lea esi, [ebp - 0x23c]
lea edi, [ebp - 0x120]
rep movsd dword es:[edi], dword [esi]
pop edi
cmp dword [ebp - 0x110], 2
pop esi
jne 0x450606
mov ecx, dword [ebp - 0x11c]
mov eax, 0xa
cmp ecx, 5
jb 0x45065b
mov eax, 0xb
cmp ecx, 6
jb 0x4505f6
mov eax, 0xd
cmp ecx, 7
jb 0x4505be
mov eax, 0x11
cmp ecx, 0xa
jb 0x45065b
mov ecx, dword [ebp - 0x114]
cmp ecx, 0x4a38
jb 0x45052a
mov eax, 0x1a
jmp 0x45065b
cmp ecx, 0x47bb
jb 0x45053c
mov eax, 0x19
jmp 0x45065b
cmp ecx, 0x4650
jb 0x45054e
mov eax, 0x18
jmp 0x45065b
cmp ecx, 0x44c0
jb 0x450560
mov eax, 0x17
jmp 0x45065b
cmp ecx, 0x4268
jb 0x450572
mov eax, 0x16
jmp 0x45065b
cmp ecx, 0x3e80
jb 0x450584
mov eax, 0x15
jmp 0x45065b
cmp ecx, 0x3a98
jb 0x450596
mov eax, 0x14
jmp 0x45065b
cmp ecx, 0x36b0
jb 0x4505a8
mov eax, 0x13
jmp 0x45065b
cmp ecx, 0x295a
jb 0x45065b
mov eax, 0x12
jmp 0x45065b
mov ecx, dword [ebp - 0x118]
cmp ecx, 1
jb 0x45065b
mov eax, 0xe
cmp ecx, 2
jb 0x45065b
mov eax, 0xf
cmp ecx, 3
jb 0x45065b
mov eax, 0x10
cmp ecx, 4
jb 0x45065b
mov eax, 0x11
jmp 0x45065b
cmp dword [ebp - 0x118], 1
jb 0x45065b
mov eax, 0xc
jmp 0x45065b
cmp dword [ebp - 0x11c], 4
jne 0x450659
mov ecx, dword [ebp - 0x118]
mov eax, 1
test ecx, ecx
jne 0x450633
mov ecx, 0x457
cmp word [ebp - 0x114], cx
jb 0x45065b
mov eax, 2
jmp 0x45065b
cmp ecx, 0x5a
jae 0x450652
mov ecx, 0x8ae
mov eax, 3
cmp word [ebp - 0x114], cx
jb 0x45065b
mov eax, 4
jmp 0x45065b
mov eax, 5
jmp 0x45065b
xor eax, eax
mov ecx, dword [ebp - 4]
mov dword [0x566708], eax
xor ecx, ebp
xor eax, eax
call fcn.004d0675
mov esp, ebp
pop ebp
ret
Function at 0x456fb0
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5153f1
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x55f2b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x14], edi
test ebx, ebx
jne 0x457009
push 0x13
xor eax, eax
mov dword [edi + 0x10], edx
mov dword [edi + 0x14], 7
push str.System_Idle_Process
mov word [edi], ax
call fcn.00414320
jmp 0x45711a
cmp ebx, 4
jne 0x457032
push 6
xor eax, eax
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
push str.System
mov word [edi], ax
call fcn.00414320
jmp 0x45711a
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x566854]
cmp eax, dword [ecx + 4]
jle 0x45708b
push 0x566854
call fcn.004d0b9a
add esp, 4
cmp dword [0x566854], 0xffffffff
jne 0x45708b
mov dword [ebp - 4], 0
call fcn.00466a60
test al, al
mov edx, 0x1000
mov ecx, 0x400
cmovne ecx, edx
push 0x566854
mov dword [0x566858], ecx
call fcn.004d0b50
add esp, 4
push ebx
push 0
push dword [0x566858]
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 1
test esi, esi
je 0x457138
push 0x10000
call fcn.004d0ce9
add esp, 4
mov dword [ebp - 0x14], eax
push 0x8000
push eax
push esi
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameW]
test eax, eax
je 0x45715b
mov ebx, dword [ebp - 0x14]
xor eax, eax
mov ecx, ebx
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
mov word [edi], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4570f2
sub ecx, edx
sar ecx, 1
push ecx
push ebx
mov ecx, edi
call fcn.00414320
push ebx
call fcn.004d0c70
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d0675
mov esp, ebp
pop ebp
ret
push ebx
push str.Unable_to_open_process__ld_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00457a70
push 0x55c1ac
lea eax, [ebp - 0x2c]
push eax
call fcn.004e81cb
push ebx
push str.Unable_to_get_image_path_of_process__ld_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00457a70
push 0x55c1ac
lea eax, [ebp - 0x2c]
push eax
call fcn.004e81cb
int3
Function at 0x45b8b0
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x515bad
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
mov eax, dword [0x55f2b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
sub esp, 0x14
mov dword [ebp - 0x24], 0
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
mov word [ebp - 0x14], 0x500
push 0x12
push ecx
push eax
lea ecx, [ebp - 0xb4]
call fcn.0045b770
mov dword [ebp - 4], 0
mov ebx, 1
push dword [eax]
mov dword [ebp - 0x24], ebx
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x45b97d
sub esp, 0x14
lea eax, [ebp - 0x18]
push 0x13
push ecx
push eax
lea ecx, [ebp - 0x84]
call fcn.0045b770
mov dword [ebp - 4], ebx
mov ebx, 3
push dword [eax]
mov dword [ebp - 0x24], ebx
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x45b97d
sub esp, 0x14
lea eax, [ebp - 0x18]
push 0x14
push ecx
push eax
lea ecx, [ebp - 0x54]
call fcn.0045b770
mov ebx, 7
push dword [eax]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov byte [ebp - 0x1d], 0
test eax, eax
je 0x45b981
mov byte [ebp - 0x1d], 1
test bl, 4
je 0x45b9dd
and ebx, 0xfffffffb
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], 2
mov edi, dword [ebp - 0x28]
test edi, edi
je 0x45b9dd
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x1c], eax
mov eax, dword [edi]
mov esi, dword [eax + 8]
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
call dword [0x51a4a0]
mov ecx, edi
call esi
mov edi, dword [ebp - 0x28]
test edi, edi
je 0x45b9dd
mov eax, dword [edi]
mov esi, dword [eax + 0x10]
lea eax, [ebp - 0x4c]
cmp edi, eax
mov ecx, esi
setne al
push eax
call dword [0x51a4a0]
mov ecx, edi
call esi
mov dword [ebp - 0x28], 0
test bl, 2
je 0x45ba3c
and ebx, 0xfffffffd
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], 3
mov edi, dword [ebp - 0x58]
test edi, edi
je 0x45ba3c
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x1c], eax
mov eax, dword [edi]
mov esi, dword [eax + 8]
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
call dword [0x51a4a0]
mov ecx, edi
call esi
mov edi, dword [ebp - 0x58]
test edi, edi
je 0x45ba3c
mov eax, dword [edi]
mov esi, dword [eax + 0x10]
lea eax, [ebp - 0x7c]
cmp edi, eax
mov ecx, esi
setne al
push eax
call dword [0x51a4a0]
mov ecx, edi
call esi
mov dword [ebp - 0x58], 0
mov dword [ebp - 4], 0xffffffff
test bl, 1
je 0x45baa1
mov dword [ebp - 4], 4
mov edi, dword [ebp - 0x88]
test edi, edi
je 0x45baa1
mov eax, dword [ebp - 0xb4]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [edi]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x51a4a0]
mov ecx, edi
call esi
mov edi, dword [ebp - 0x88]
test edi, edi
je 0x45baa1
mov esi, dword [edi]
lea eax, [ebp - 0xac]
cmp edi, eax
setne dl
mov esi, dword [esi + 0x10]
mov ecx, esi
movzx edx, dl
push edx
call dword [0x51a4a0]
mov ecx, edi
call esi
mov al, byte [ebp - 0x1d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d0675
mov esp, ebp
pop ebp
ret
Function at 0x45c9c0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x55f2b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
cmp esi, 0xffffffff
je 0x45cabb
mov edi, dword [ebp + 0xc]
test edi, edi
jl 0x45cabb
mov ebx, dword [ebp + 8]
jg 0x45c9f6
test ebx, ebx
jb 0x45cabb
push 1
lea eax, [ebp - 0x10]
xorps xmm0, xmm0
push eax
movq qword [ebp - 0x30], xmm0
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x45ca57
push 0
push 0
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x45ca9b
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x45ca9b
push 0
push 0
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x45ca79
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d0675
mov esp, ebp
pop ebp
ret
push str.Unable_to_retrieve_the_file_pointer_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x24]
call fcn.00468e50
push 0x55c1ac
lea eax, [ebp - 0x24]
push eax
call fcn.004e81cb
push str.Unable_to_set_the_file_pointer_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x24]
call fcn.00468e50
push 0x55c1ac
lea eax, [ebp - 0x24]
push eax
call fcn.004e81cb
push edi
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x24]
call fcn.0045cc00
push 0x55c1ac
lea eax, [ebp - 0x24]
push eax
call fcn.004e81cb
push 0x57
lea ecx, [ebp - 0x24]
call fcn.00468df0
push 0x55c1ac
mov eax, ecx
push eax
call fcn.004e81cb
int3
Function at 0x45d150
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x515dfd
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x55f2b4]
xor eax, ebp
mov dword [ebp - 0x18], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x30], ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x2c]
push eax
xorps xmm0, xmm0
xor edi, edi
push esi
movlpd qword [ebp - 0x2c], xmm0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x45d1aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x45d2c6
cmp dword [ebp - 0x28], edi
je 0x45d1b9
mov edi, 0xdf
jmp 0x45d2c6
mov dword [ebp - 4], 0
xorps xmm0, xmm0
push ecx
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
movq qword [ebp - 0x24], xmm0
mov dword [ebp - 0x1c], 0
call fcn.0045b6e0
push 0
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
push eax
push dword [ebp - 0x2c]
push dword [ebp - 0x24]
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x45d23b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x24]
mov edi, eax
test ecx, ecx
je 0x45d2c6
mov edx, dword [ebp - 0x1c]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x45d22c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45d2f0
push edx
push ecx
call fcn.004d06e3
add esp, 8
jmp 0x45d2c6
mov ebx, dword [ebp - 0x20]
mov edx, ebx
mov esi, dword [ebp - 0x24]
sub edx, esi
mov ecx, dword [ebp - 0x2c]
cmp ecx, edx
jae 0x45d254
lea eax, [esi + ecx]
mov dword [ebp - 0x20], eax
jmp 0x45d27f
jbe 0x45d27f
mov eax, dword [ebp - 0x1c]
sub eax, esi
cmp ecx, eax
jbe 0x45d26b
push ecx
push ecx
lea ecx, [ebp - 0x24]
call fcn.0044bfd0
jmp 0x45d27f
sub ecx, edx
push ecx
push 0
push ebx
lea esi, [ebx + ecx]
call fcn.004e8d40
add esp, 0xc
mov dword [ebp - 0x20], esi
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x24]
push eax
call fcn.0045d300
mov ecx, dword [ebp - 0x24]
test ecx, ecx
je 0x45d2c6
mov edx, dword [ebp - 0x1c]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x45d22c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45d2f0
jmp 0x45d22c
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
sete al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.004d0675
mov esp, ebp
pop ebp
ret 4
call fcn.004ebf29
int3
Function at 0x45d700
Capabilities:
Clear file content
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x515e8d
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x55f2b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor edi, edi
xorps xmm0, xmm0
mov dword [ebp - 0x14], edi
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
push ecx
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], edi
push eax
call fcn.0045d840
test al, al
jne 0x45d788
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x1c]
mov edi, eax
test ecx, ecx
je 0x45d7db
mov edx, dword [ebp - 0x14]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x45d784
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45d833
push edx
push ecx
jmp 0x45d7d3
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
sub eax, esi
push 0
push ecx
push eax
push esi
push ebx
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x45d805
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test esi, esi
je 0x45d7db
mov ecx, dword [ebp - 0x14]
mov eax, esi
sub ecx, esi
cmp ecx, 0x1000
jb 0x45d7d1
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45d833
push ecx
push esi
call fcn.004d06e3
add esp, 8
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
sete al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d0675
mov esp, ebp
pop ebp
ret 8
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x45d7a6
test esi, esi
je 0x45d7db
mov ecx, dword [ebp - 0x14]
mov eax, esi
sub ecx, esi
cmp ecx, 0x1000
jb 0x45d7d1
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x45d7d1
call fcn.004ebf29
int3
Function at 0x4625d0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
xor eax, eax
push ebx
push esi
push edi
mov esi, ecx
mov ebx, dword [esi + 0x14]
mov ecx, esi
mov edi, dword [esi + 0x10]
cmp ebx, 8
jb 0x4625ef
mov ecx, dword [esi]
push dword [esp + 0xc]
inc eax
mov edx, edi
push 2
push 0x546848
push eax
call fcn.00417f70
add esp, 0x10
mov dword [esp + 0xc], eax
cmp eax, 0xffffffff
je 0x4626a6
xor ecx, ecx
mov dword [esp + 0x20], 0
mov word [esp + 0x10], cx
lea ecx, [eax + 1]
cmp edi, ecx
mov dword [esp + 0x24], 7
mov eax, esi
cmovb ecx, edi
cmp ebx, 8
jb 0x46263b
mov eax, dword [esi]
push ecx
push eax
lea ecx, [esp + 0x18]
call fcn.00414320
cmp dword [esp + 0x24], 8
lea eax, [esp + 0x10]
push 0
cmovae eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0xc]
cmp edx, 8
jb 0x4625e0
mov ecx, dword [esp + 0x10]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x462693
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4626eb
push edx
push ecx
call fcn.004d06e3
mov eax, dword [esp + 0x14]
add esp, 8
jmp 0x4625e0
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4626b8
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp dword [esi + 0x14], 8
jb 0x4626c9
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4626e2
test al, 0x10
je 0x4626e2
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004ebf29
int3