joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43678c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x218], ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x436911
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
xor edx, edx
call fcn.004062bc
lea eax, [ebp - 4]
push eax
call sub.shell32.dll_SHGetMalloc
test eax, eax
jne 0x4368e5
lea eax, [ebp - 8]
push eax
push esi
push 0xffffffffffffffff
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x4368e5
cmp dword [0x555cd0], 0
jne 0x43680e
push 0x436920
push 0x43694c
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.0040929c
mov dword [0x555cd0], eax
cmp dword [0x555cd0], 0
je 0x436840
lea eax, [ebp - 0x212]
push eax
mov eax, dword [ebp - 8]
push eax
call dword [0x555cd0]
test eax, eax
je 0x436840
mov eax, edi
lea edx, [ebp - 0x212]
mov ecx, 0x105
call fcn.004064bc
jmp 0x436877
lea eax, [ebp - 0x212]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
test eax, eax
je 0x436877
lea eax, [ebp - 0x218]
lea edx, [ebp - 0x212]
mov ecx, 0
call fcn.00405770
mov edx, dword [ebp - 0x218]
mov eax, edi
call fcn.004064d8
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
cmp dword [edi], 0
jne 0x4368a3
lea edx, [ebp - 0x21c]
xor eax, eax
call fcn.00434114
mov eax, dword [ebp - 0x21c]
mov edx, edi
call fcn.0040e740
cmp dword [edi], 0
je 0x4368e5
mov eax, dword [edi]
call fcn.0040656c
mov edx, dword [edi]
cmp word [edx + eax*2 - 2], 0x5c
sete al
cmp bl, al
je 0x4368e5
test bl, bl
je 0x4368d0
mov eax, edi
mov edx, 0x436970
call fcn.00406610
jmp 0x4368e5
mov eax, dword [edi]
call fcn.0040656c
mov edx, eax
mov eax, edi
mov ecx, 1
call fcn.004069e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x436918
lea eax, [ebp - 0x21c]
call fcn.004062ac
lea eax, [ebp - 0x218]
call fcn.004054bc
lea eax, [ebp - 4]
call fcn.004082f8
ret
Function at 0x4373bc
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004062a4
xor eax, eax
push ebp
push 0x437472
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x4373f0
call sub.user32.dll_EmptyClipboard
call sub.user32.dll_CloseClipboard
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x43745c
lea eax, [ebp - 4]
call fcn.0040569c
call fcn.0040656c
add eax, eax
add eax, 2
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov ebx, eax
push ebx
call sub.kernel32.dll_GlobalLock
mov esi, eax
test esi, esi
je 0x437457
lea eax, [ebp - 4]
call fcn.0040569c
call fcn.0040656c
add eax, eax
add eax, 2
push eax
mov eax, dword [ebp - 4]
call fcn.00406348
mov edx, esi
pop ecx
call fcn.00403230
push ebx
call sub.kernel32.dll_GlobalUnlock
push ebx
push 0xd
call sub.user32.dll_SetClipboardData
call sub.user32.dll_CloseClipboard
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x437479
lea eax, [ebp - 4]
call fcn.004062ac
ret
Function at 0x439610
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], eax
xor eax, eax
push ebp
push 0x4397c4
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
call fcn.00439544
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x4397a2
push dword fs:[edx]
mov dword fs:[edx], esp
cmp dword [0x549ea4], 0
jne 0x439776
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x14]
call fcn.00434ec8
lea eax, [ebp - 0x30]
push eax
call sub.kernel32.dll_GetCurrentProcessId
mov cl, 0x30
mov edx, 1
call fcn.0040ce70
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
mov edx, 0x4397e4
call fcn.00405900
mov eax, dword [ebp - 0x2c]
call fcn.00405b78
push eax
push 0
push 6
call sub.kernel32.dll_OpenFileMappingA
mov edi, eax
test edi, edi
sete bl
test bl, bl
je 0x4396ea
lea eax, [ebp - 0x38]
push eax
call sub.kernel32.dll_GetCurrentProcessId
mov cl, 0x30
mov edx, 1
call fcn.0040ce70
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x34]
mov edx, 0x4397e4
call fcn.00405900
mov eax, dword [ebp - 0x34]
call fcn.00405b78
push eax
push 4
push 0
push 4
lea eax, [ebp - 0x14]
push eax
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov edi, eax
test edi, edi
jne 0x439705
xor esi, esi
push 0
push 0x4397fc
push 0x439808
push 0
call sub.user32.dll_MessageBoxA_1
jmp 0x439765
test bl, bl
je 0x43974c
push 0
push 0
push 0
push 0xf001f
push edi
call sub.kernel32.dll_MapViewOfFile
mov esi, eax
push 4
push 0x1000
push 0x28
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov ebx, eax
mov dword [esi], ebx
mov eax, ebx
mov edx, 0x28
call fcn.00409f50
mov eax, dword [esi]
mov dword [eax + 4], edi
add eax, 8
push eax
call sub.kernel32.dll_InitializeCriticalSection
jmp 0x439765
push 0
push 0
push 0
push 0xf001f
push edi
call sub.kernel32.dll_MapViewOfFile
mov esi, eax
push edi
call sub.kernel32.dll_CloseHandle_1
test esi, esi
je 0x439776
mov eax, esi
call fcn.00467a94
mov dword [0x549ea4], esi
cmp dword [0x549ea4], 0
je 0x43978c
mov eax, dword [0x549ea4]
mov eax, dword [eax]
inc dword [eax]
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4397a9
mov eax, dword [ebp - 8]
call fcn.004395fc
ret

Function at 0x43d818
Capabilities:
Create thread
Resume thread

Disassembly:
cmp dword [0x549ed0], 0
jne 0x43d8ab
xor eax, eax
call fcn.004190f0
mov dword [0x549ed0], eax
cmp dword [0x549ed0], 0
je 0x43d8ab
mov eax, 0x43d67c
xor ecx, ecx
xor edx, edx
call fcn.004195f4
mov dword [0x549ed4], eax
push 0
push 0
push 0xffffffffffffffff
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x549ee4], eax
push 0x549ec8
push 4
push 0
push 0x43d6c4
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x549ecc], eax
cmp dword [0x549ecc], 0
je 0x43d8ab
mov edx, 0x43d8b8
mov eax, dword [0x549ec8]
call fcn.00435b24
push 2
mov eax, dword [0x549ecc]
push eax
call sub.kernel32.dll_SetThreadPriority
mov eax, dword [0x549ecc]
push eax
call sub.kernel32.dll_ResumeThread
ret
Function at 0x43d8f4
Capabilities:
Terminate thread

Disassembly:
push ebx
cmp dword [0x549ed0], 0
je 0x43d9c5
mov ebx, dword [0x549ee4]
xor eax, eax
mov dword [0x549ee4], eax
push ebx
call sub.kernel32.dll_SetEvent
push ebx
call sub.kernel32.dll_CloseHandle_1
cmp dword [0x549ee0], 0
je 0x43d93d
mov ebx, dword [0x549ee0]
xor eax, eax
mov dword [0x549ee0], eax
push ebx
call sub.kernel32.dll_SetEvent
push ebx
call sub.kernel32.dll_CloseHandle_1
mov dword [0x549edc], 0xffffffff
mov eax, 0x43d67c
xor ecx, ecx
xor edx, edx
call fcn.00419820
push 0x1f4
mov eax, dword [0x549ecc]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
je 0x43d98a
push 0
mov eax, dword [0x549ecc]
push eax
call sub.kernel32.dll_TerminateThread
cmp dword [0x549ee8], 0
je 0x43d98a
mov eax, dword [0x549ee8]
push eax
call sub.kernel32.dll_LocalFree
xor eax, eax
mov dword [0x549ee8], eax
mov eax, dword [0x549ecc]
push eax
call sub.kernel32.dll_CloseHandle_1
push 0
push 0
push 0
xor ecx, ecx
xor edx, edx
mov eax, dword [0x549ec8]
call fcn.00435898
xor eax, eax
mov dword [0x549ecc], eax
xor eax, eax
mov dword [0x549ec8], eax
xor eax, eax
mov dword [0x549ed0], eax
pop ebx
ret
Function at 0x44592c
Capabilities:
Resolve dns

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, esi
call fcn.00405b78
mov edi, eax
push edi
call sub.wsock32.dll_inet_addr
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x445958
push edi
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x445958
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ebx, dword [eax]
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x447554
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
or dword [ebp + 0xc], 0xc11c
cmp byte [0x54956c], 0
je 0x44757a
or dword [ebp + 0xc], 0x80000
push 1
xor eax, eax
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x2c]
push eax
push 1
xor eax, eax
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x34]
push eax
push 1
mov dword [ebp - 0x3c], 2
mov dword [ebp - 0x38], 0x11
lea eax, [ebp - 0x3c]
push eax
push 1
lea ecx, [ebp - 0x24]
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004474ec
push 0
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0
mov eax, dword [ebp + 8]
push eax
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push esi
lea eax, [ebx + 0x44]
push eax
mov eax, dword [ebx + 8]
call dword [eax + 0x18]
mov esi, eax
mov eax, esi
call fcn.00433794
test al, al
jne 0x4475fa
cmp esi, 0x80090318
jne 0x447602
test edi, edi
je 0x447602
mov byte [ebx + 0x5c], 1
mov edi, dword [ebp - 0x1c]
test edi, edi
je 0x447632
cmp dword [ebp - 0x24], 0
je 0x447632
push 0
mov eax, dword [ebp - 0x24]
push eax
push edi
mov eax, dword [ebx + 0x50]
push eax
call sub.wsock32.dll_send
test eax, eax
jg 0x447628
mov esi, 0x80090304
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebx + 8]
call dword [eax + 0x40]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x447646
cmp dword [ebp - 0x18], 0
je 0x447646
push eax
mov eax, dword [ebx + 8]
call dword [eax + 0x40]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x447654
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffeac
mov edi, edx
mov ebx, eax
mov byte [esp], 0
xor esi, esi
xor eax, eax
mov dword [esp + 8], eax
test edi, edi
je 0x4476d9
mov dword [esp + 0x38], 1
mov eax, dword [ebx + 0x50]
mov dword [esp + 0x3c], eax
mov eax, dword [0x54958c]
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
lea eax, [esp + 0x44]
push eax
push 0
call sub.wsock32.dll_select
test eax, eax
jle 0x447813
push 0
mov eax, dword [ebx + 0x74]
sub eax, esi
push eax
mov eax, dword [ebx + 0x78]
add eax, esi
push eax
mov eax, dword [ebx + 0x50]
push eax
call sub.wsock32.dll_recv
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
jle 0x447813
mov eax, dword [esp + 4]
add esi, eax
test esi, esi
sete al
neg al
sbb edi, edi
push 1
mov eax, dword [ebx + 0x78]
mov dword [esp + 0x140], eax
xor eax, eax
mov dword [esp + 0x144], eax
lea eax, [esp + 0x140]
push eax
push 1
mov dword [esp + 0x150], esi
xor eax, eax
mov dword [esp + 0x154], eax
lea eax, [esp + 0x150]
push eax
push 1
mov dword [esp + 0x160], 2
xor eax, eax
mov dword [esp + 0x164], eax
lea eax, [esp + 0x160]
push eax
push 1
lea ecx, [esp + 0x3c]
lea edx, [esp + 0x30]
mov eax, ebx
call fcn.004474ec
push 0
mov eax, dword [esp + 0xc]
push eax
lea eax, [esp + 0x1c]
push eax
lea edx, [ebx + 0x54]
xor ecx, ecx
mov eax, ebx
call fcn.00447554
mov ebp, eax
sub ebp, 0x80090318
je 0x44780b
sub ebp, 0x7ff6fce8
je 0x447788
sub ebp, 0x90312
je 0x4477d0
sub ebp, 0xe
je 0x4477fc
jmp 0x447813
cmp dword [esp + 0x30], 5
jne 0x4477ca
mov eax, dword [esp + 0x2c]
push eax
push 0x40
call sub.kernel32.dll_LocalAlloc_1
mov dword [ebx + 0x84], eax
mov edx, dword [ebx + 0x84]
mov eax, dword [ebx + 0x78]
add eax, esi
sub eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x2c]
call fcn.00403230
mov eax, dword [esp + 0x2c]
mov dword [ebx + 0x7c], eax
mov dword [ebx + 0x80], 2
mov byte [esp], 1
jmp 0x447813
cmp dword [esp + 0x30], 5
jne 0x4477f5
mov edx, dword [ebx + 0x78]
mov eax, dword [ebx + 0x78]
add eax, esi
sub eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x2c]
call fcn.00403230
mov esi, dword [esp + 0x2c]
jmp 0x44766e
xor esi, esi
jmp 0x44766e
or dword [esp + 8], 0x80
xor edi, edi
jmp 0x44766e
or edi, 0xffffffff
jmp 0x44766e
movzx eax, byte [esp]
add esp, 0x154
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x447824
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff84
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405b68
xor eax, eax
push ebp
push 0x4479a1
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 1
mov eax, dword [ebp - 4]
call fcn.00405b78
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
xor edx, edx
call fcn.004056cc
call fcn.00405850
mov edi, eax
mov dword [ebp - 0x10], 0x400
cmp dword [ebx + 8], 0
je 0x44797d
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebx + 0x68]
jbe 0x44797d
mov eax, dword [ebx + 0x68]
mov dword [ebp - 0x10], eax
jmp 0x44797d
cmp edi, dword [ebp - 0x10]
jbe 0x44789a
mov esi, dword [ebp - 0x10]
jmp 0x44789c
mov esi, edi
cmp dword [ebx + 8], 0
je 0x447962
mov edx, dword [ebx + 0x78]
add edx, dword [ebx + 0x60]
mov eax, dword [ebp - 0xc]
mov ecx, esi
call fcn.00403230
push 3
mov eax, dword [ebx + 0x78]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebx + 0x78]
add eax, dword [ebx + 0x60]
mov dword [ebp - 0x58], eax
mov eax, dword [ebx + 0x78]
add eax, dword [ebx + 0x60]
add eax, esi
mov dword [ebp - 0x54], eax
xor eax, eax
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x5c]
push eax
push 3
mov eax, dword [ebx + 0x60]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], esi
mov eax, dword [ebx + 0x64]
mov dword [ebp - 0x64], eax
xor eax, eax
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x6c]
push eax
push 3
mov dword [ebp - 0x7c], 7
mov dword [ebp - 0x78], 1
mov dword [ebp - 0x74], 6
xor eax, eax
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x7c]
push eax
push 3
lea ecx, [ebp - 0x4c]
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.004474ec
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
lea eax, [ebx + 0x54]
push eax
mov eax, dword [ebx + 8]
call dword [eax + 0x64]
test eax, eax
jne 0x447957
push 0
mov eax, dword [ebp - 0x4c]
add eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x34]
push eax
mov eax, dword [ebx + 0x78]
push eax
mov eax, dword [ebx + 0x50]
push eax
call sub.wsock32.dll_send
test eax, eax
jg 0x44795b
xor eax, eax
jmp 0x44795d
mov al, 1
mov byte [ebp - 5], al
jmp 0x447978
push 0
push esi
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebx + 0x50]
push eax
call sub.wsock32.dll_send
test eax, eax
setg byte [ebp - 5]
add dword [ebp - 0xc], esi
sub edi, esi
cmp byte [ebp - 5], 0
je 0x44798b
test edi, edi
ja 0x447890
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4479a8
lea eax, [ebp - 4]
call fcn.004054bc
ret
Function at 0x448714
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdcc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x234], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov edi, eax
mov ebx, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x44897b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetFilePointer_1
movzx eax, byte [edi + 0x8f]
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x448937
cmp byte [0x549574], 0
jne 0x44879f
mov eax, ebx
call fcn.0043559c
test al, al
je 0x4487dc
push 0x44899c
lea edx, [ebp - 0x220]
mov eax, ebx
call fcn.0040e430
mov eax, dword [ebp - 0x220]
lea edx, [ebp - 0x21c]
call fcn.0041b46c
push dword [ebp - 0x21c]
push 0x4489b4
lea eax, [ebp - 4]
mov edx, 3
call fcn.004059cc
jmp 0x4487eb
lea eax, [ebp - 4]
mov edx, ebx
mov ecx, 0
call fcn.00406500
push 0x4489c4
lea eax, [ebp - 0x228]
mov edx, dword [0x549f58]
mov ecx, 0
call fcn.00405770
push dword [ebp - 0x228]
push 0x4489d4
push 0x4489e4
lea edx, [ebp - 0x230]
mov eax, ebx
call fcn.00446374
mov edx, dword [ebp - 0x230]
lea eax, [ebp - 0x22c]
mov ecx, 0
call fcn.00406500
push dword [ebp - 0x22c]
push 0x448a00
push dword [ebp - 4]
push 0x448a18
push 0x4489d4
push 0x448a28
push 0x4489d4
push 0x448a58
push dword [ebp - 4]
push 0x448a18
push 0x4489d4
push 0x4489d4
lea eax, [ebp - 0x224]
mov edx, 0x10
call fcn.004059cc
mov edx, dword [ebp - 0x224]
mov eax, edi
call fcn.00447824
mov esi, dword [ebp - 0xc]
test esi, esi
jbe 0x448937
cmp esi, 0xff
jbe 0x4488a9
mov ebx, 0xff
jmp 0x4488ab
mov ebx, esi
push 0
lea eax, [ebp - 0x14]
push eax
push ebx
lea eax, [ebp - 0x215]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x4488cb
cmp ebx, dword [ebp - 0x14]
je 0x4488dd
mov edx, 0x4489d4
mov eax, edi
call fcn.00447824
mov byte [ebp - 0xd], 0
jmp 0x448937
lea ecx, [ebp - 0x234]
lea eax, [ebp - 0x215]
mov edx, ebx
call fcn.0041b334
lea eax, [ebp - 0x234]
mov edx, 0x4489d4
call fcn.00405884
mov edx, dword [ebp - 0x234]
mov eax, edi
call fcn.00447824
sub esi, ebx
cmp dword [ebp + 8], 0
je 0x44892f
mov eax, dword [ebp - 0xc]
sub eax, esi
imul eax, eax, 0x3e8
xor edx, edx
div dword [ebp - 0xc]
mov edx, eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
call dword [ecx + 0x18]
test esi, esi
ja 0x44889a
mov eax, dword [ebp + 8]
mov edx, dword [eax]
call dword [edx + 0x24]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x448982
lea eax, [ebp - 0x234]
call fcn.004054bc
lea eax, [ebp - 0x230]
call fcn.004062ac
lea eax, [ebp - 0x22c]
mov edx, 5
call fcn.004054e0
lea eax, [ebp - 4]
call fcn.004054bc
ret
Function at 0x44ab40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x44ac67
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
push 0
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetFilePointer_1
mov esi, dword [ebp - 0xc]
cmp byte [ebp + 8], 0
je 0x44ab8a
mov dword [ebp - 0x10], 0x600
jmp 0x44ab91
mov dword [ebp - 0x10], 0x800
lea eax, [ebp - 4]
xor ecx, ecx
mov edx, dword [ebp - 0x10]
call fcn.00405d18
test esi, esi
jbe 0x44ac49
cmp esi, dword [ebp - 0x10]
jae 0x44abb7
lea eax, [ebp - 4]
xor ecx, ecx
mov edx, esi
call fcn.00405d18
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
xor edx, edx
call fcn.004056cc
call fcn.00405850
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x44abf2
lea eax, [ebp - 4]
xor edx, edx
call fcn.004056cc
call fcn.00405850
cmp eax, dword [ebp - 0x14]
je 0x44abf6
xor ebx, ebx
jmp 0x44ac49
cmp byte [ebp + 8], 0
je 0x44ac15
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.0041b46c
mov edx, dword [ebp - 0x18]
mov eax, edi
call fcn.00449e84
mov ebx, eax
jmp 0x44ac21
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.00449e84
mov ebx, eax
test bl, bl
je 0x44ac49
sub esi, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
sub eax, esi
imul eax, eax, 0x3e8
xor edx, edx
div dword [ebp - 0xc]
mov edx, eax
mov eax, edi
call fcn.0044a418
test esi, esi
ja 0x44aba6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44ac6e
lea eax, [ebp - 0x18]
call fcn.004054bc
lea eax, [ebp - 4]
call fcn.004054bc
ret
Function at 0x450464
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004062a4
xor eax, eax
push ebp
push 0x4505b8
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040e740
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.00406310
cmp dword [ebp - 4], 0
je 0x45058e
lea eax, [ebp - 4]
call fcn.0040569c
call fcn.0040656c
mov ebx, eax
lea eax, [ebp - 4]
call fcn.0040569c
cmp word [eax + ebx*2 - 2], 0x5c
jne 0x4504e2
lea eax, [ebp - 4]
call fcn.0040569c
call fcn.0040656c
mov edx, eax
lea eax, [ebp - 4]
mov ecx, 1
call fcn.004069e0
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x45052e
mov eax, dword [ebp - 4]
call fcn.00406348
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
jne 0x45052a
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00450464
pop ecx
test al, al
je 0x450526
push 0
mov eax, dword [ebp - 4]
call fcn.00406348
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x45052a
xor ebx, ebx
jmp 0x450590
mov bl, 1
jmp 0x450590
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.00406500
mov eax, dword [ebp - 0xc]
call fcn.00405b78
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x45058a
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00450464
pop ecx
test al, al
je 0x450586
push 0
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.00406500
mov eax, dword [ebp - 0x10]
call fcn.00405b78
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x45058a
xor ebx, ebx
jmp 0x450590
mov bl, 1
jmp 0x450590
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4505bf
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004054e0
lea eax, [ebp - 8]
mov edx, 2
call fcn.004062b4
ret
Function at 0x453030
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended
Get common file path
Read file via mapping
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd6c
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x290], ecx
mov dword [ebp - 0x294], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov byte [ebp - 9], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x45324a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x70]
mov edx, 0x44
call fcn.00409f50
mov dword [ebp - 0x70], 0x44
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x4530e3
test ebx, ebx
jne 0x453097
call sub.kernel32.dll_GetCommandLineW_1
mov edx, eax
lea eax, [ebp - 4]
call fcn.00406468
jmp 0x4530a1
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00406310
lea eax, [ebp - 0x28a]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryW
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x28a]
push eax
push 0
push 4
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00406348
push eax
push 0
call sub.kernel32.dll_CreateProcessW
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x45314c
test ebx, ebx
jne 0x4530fd
call sub.kernel32.dll_GetCommandLineA
mov edx, eax
lea eax, [ebp - 8]
mov ecx, 0
call fcn.00405770
jmp 0x45310c
lea eax, [ebp - 8]
mov edx, ebx
mov ecx, 0
call fcn.00406500
lea eax, [ebp - 0x28a]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryA
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x28a]
push eax
push 0
push 4
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00405b78
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x4531fd
lea edx, [ebp - 0x2c]
lea eax, [ebp - 0x18]
call fcn.00434ec8
lea eax, [ebp - 0x294]
push eax
mov cl, 0x30
mov edx, 1
mov eax, dword [ebp - 0x78]
call fcn.0040ce70
mov ecx, dword [ebp - 0x294]
lea eax, [ebp - 0x290]
mov edx, 0x453264
call fcn.00405900
mov eax, dword [ebp - 0x290]
call fcn.00405b78
push eax
push 0x58
push 0
push 4
lea eax, [ebp - 0x18]
push eax
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov esi, eax
push 0
push 0
push 0
push 0xf001f
push esi
call sub.kernel32.dll_MapViewOfFile
mov ebx, eax
test ebx, ebx
je 0x4531f4
call sub.kernel32.dll_GetCurrentProcessId
mov dword [ebx], eax
push 2
push 0
push 0
lea eax, [ebx + 4]
push eax
mov eax, dword [ebp - 0x80]
push eax
push esi
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_DuplicateHandle
lea edx, [ebx + 8]
mov eax, 0x5496c4
mov ecx, 0x50
call fcn.00403230
mov eax, dword [ebp - 0x7c]
push eax
call sub.kernel32.dll_ResumeThread
cmp byte [ebp - 9], 0
je 0x453212
push 2
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
jmp 0x45321c
mov eax, 2
call fcn.004053d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x453251
lea eax, [ebp - 0x294]
mov edx, 2
call fcn.004054e0
lea eax, [ebp - 8]
call fcn.004054bc
lea eax, [ebp - 4]
call fcn.004062ac
ret