joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439790
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
mov ebx, ecx
cmp dword [ebx + 0x78], 0
push esi
push edi
je 0x4397cb
fld dword [ebp + 8]
sub esp, 8
mov eax, esp
fstp dword [eax]
mov dword [esp + 0x1c], esp
fld dword [ebp + 0xc]
fstp dword [eax + 4]
mov ecx, dword [ebx + 0x78]
mov eax, dword [ecx]
mov edx, dword [eax + 8]
call edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov esi, dword [ebx + 0x3c]
sub esi, dword [ebx + 0x38]
sar esi, 2
sub esi, 1
js 0x43981e
lea esp, [esp]
mov eax, dword [ebx + 0x3c]
sub eax, dword [ebx + 0x38]
sar eax, 2
cmp esi, eax
jb 0x4397f2
call fcn.0046f637
mov ecx, dword [ebx + 0x38]
fld dword [ebp + 8]
mov edi, dword [ecx + esi*4]
sub esp, 8
mov eax, esp
fstp dword [eax]
mov ecx, edi
fld dword [ebp + 0xc]
mov dword [esp + 0x1c], esp
fstp dword [eax + 4]
mov edx, dword [edi]
mov eax, dword [edx + 8]
call eax
test al, al
jne 0x43985f
sub esi, 1
jns 0x4397e0
cmp dword [ebx + 0xb8], 0
je 0x439836
mov esi, dword [ebx + 0xb4]
test esi, esi
je 0x439836
call fcn.00443880
mov eax, dword [ebx + 0xb8]
test eax, eax
je 0x43984a
mov edx, dword [ebx]
push eax
mov eax, dword [edx + 0x28]
mov ecx, ebx
call eax
mov dword [ebx + 0xb8], 0
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 0x5c], 0
jne 0x439877
mov edi, dword [edi + 0x7c]
cmp dword [edi + 0x5c], 0
jne 0x439877
mov ecx, edi
call fcn.0043cf90
mov edi, eax
mov esi, dword [ebx + 0xb4]
test esi, esi
je 0x439923
cmp byte [edi + 0x4d], 0
je 0x439923
mov ecx, dword [edi + 4]
mov edx, dword [edi + 8]
mov eax, dword [edi + 0x10]
mov esi, dword [edi + 0xc]
mov dword [esp + 0x18], ecx
mov ecx, dword [ebx + 0x74]
push ecx
mov dword [esp + 0x20], edx
mov dword [esp + 0x28], eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4398ec
mov eax, dword [ebx + 0x74]
lea edx, [esp + 0x28]
push edx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
fild dword [esp + 0x28]
fstp dword [esp + 0x10]
fild dword [esp + 0x2c]
fstp dword [esp + 0x14]
fld dword [esp + 0x18]
fadd dword [esp + 0x10]
fstp dword [esp + 0x18]
fld dword [esp + 0x14]
fadd dword [esp + 0x1c]
fstp dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x34]
mov dword [eax + 4], edx
push ecx
mov dword [eax + 8], esi
mov dword [eax + 0xc], ecx
mov eax, esp
mov ecx, edi
mov dword [esp + 0x28], esp
call fcn.00438a50
mov ecx, dword [ebx + 0xb4]
call fcn.00443410
jmp 0x439928
call fcn.00443880
mov ecx, dword [ebx + 0xb8]
cmp ecx, edi
je 0x439964
test ecx, ecx
je 0x43995a
mov edx, dword [ecx]
mov eax, dword [edx + 0x30]
call eax
mov ecx, dword [ebx + 0xb8]
mov edx, dword [ecx]
mov eax, dword [edx + 0x20]
call eax
mov edx, dword [ebx]
mov eax, dword [ebx + 0xb8]
mov edx, dword [edx + 0x28]
push eax
mov ecx, ebx
call edx
mov eax, dword [ebx]
mov edx, dword [eax + 0x24]
push edi
mov ecx, ebx
call edx
mov dword [ebx + 0xb8], edi
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x43b0c0
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x4a4100]
xor eax, esp
mov dword [esp + 0x114], eax
mov eax, dword [0x4a8008]
mov edx, dword [eax + 0xc]
push esi
mov ecx, 0x4a8008
call edx
mov esi, eax
lea eax, [esp + 4]
push eax
add esi, 0x10
mov dword [esp + 8], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [esp + 8]
cmp eax, 6
jae 0x43b139
lea eax, [esi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43b121
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, 1
pop esi
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.0046f01c
add esp, 0x118
ret
jne 0x43b142
cmp dword [esp + 0xc], 0
je 0x43b105
lea eax, [esi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43b15e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x118]
pop esi
xor ecx, esp
xor al, al
call fcn.0046f01c
add esp, 0x118
ret
Function at 0x43b1f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4895f8
mov eax, dword fs:[0]
push eax
sub esp, 0x88
push ebx
push esi
push edi
mov eax, dword [0x4a4100]
xor eax, esp
push eax
lea eax, [esp + 0x98]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebx + 0x3c]
mov ecx, dword [ebx + 0x38]
push eax
push ecx
mov byte [esp + 0x1f], 0
call fcn.0043f320
mov edi, eax
xor esi, esi
add esp, 8
cmp edi, esi
jne 0x43b27f
mov edi, dword [ebx + 0x44]
push 0x10
call sub.gdiplus.dll_GdipAlloc
mov esi, eax
test esi, esi
je 0x43b26c
lea eax, [esi + 4]
push eax
push edi
mov dword [esi], vtable.Gdiplus::Image.0
mov dword [eax], 0
call sub.gdiplus.dll_GdipLoadImageFromFile
mov dword [esi + 8], eax
jmp 0x43b26e
xor esi, esi
mov edi, esi
mov byte [esp + 0x17], 1
test esi, esi
je 0x43b3e2
xor esi, esi
fld1
lea edx, [esp + 0x24]
fst dword [esp + 0x2c]
push edx
fldz
mov dword [esp + 0x28], esi
fst dword [esp + 0x34]
fst dword [esp + 0x38]
fst dword [esp + 0x3c]
fst dword [esp + 0x40]
fst dword [esp + 0x44]
fst dword [esp + 0x4c]
fst dword [esp + 0x50]
fst dword [esp + 0x54]
fst dword [esp + 0x58]
fst dword [esp + 0x5c]
fst dword [esp + 0x64]
fst dword [esp + 0x68]
fst dword [esp + 0x6c]
fst dword [esp + 0x70]
fst dword [esp + 0x74]
fxch st(1)
fst dword [esp + 0x48]
fst dword [esp + 0x60]
fld dword [ebp + 0xc]
fstp dword [esp + 0x78]
fxch st(1)
fst dword [esp + 0x7c]
fst dword [esp + 0x80]
fst dword [esp + 0x84]
fst dword [esp + 0x88]
fstp dword [esp + 0x8c]
fstp dword [esp + 0x90]
call sub.gdiplus.dll_GdipCreateImageAttributes
mov dword [esp + 0x28], eax
push esi
push esi
lea eax, [esp + 0x34]
push eax
push 1
mov dword [esp + 0xb0], esi
mov ecx, dword [esp + 0x34]
push esi
push ecx
call sub.gdiplus.dll_GdipSetImageAttributesColorMatrix
cmp eax, esi
je 0x43b332
mov dword [esp + 0x28], eax
mov eax, dword [edi + 4]
lea edx, [esp + 0x18]
push edx
push eax
mov dword [esp + 0x20], esi
call sub.gdiplus.dll_GdipGetImageHeight
cmp eax, esi
je 0x43b34b
mov dword [edi + 8], eax
mov eax, dword [edi + 4]
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x1c]
push edx
push eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x24], esi
call sub.gdiplus.dll_GdipGetImageWidth
cmp eax, esi
je 0x43b36c
mov dword [edi + 8], eax
mov esi, dword [esp + 0x1c]
call fcn.0043b0c0
fild dword [esp + 0x20]
movzx ecx, al
mov eax, dword [esp + 0x20]
neg ecx
sbb ecx, ecx
not ecx
lea edx, [esp + 0x24]
and ecx, edx
test eax, eax
jge 0x43b396
fadd dword [0x495bb8]
sub esp, 0x10
mov dword [esp + 0x30], esi
fstp dword [esp + 0xc]
fild dword [esp + 0x30]
test esi, esi
jge 0x43b3af
fadd dword [0x495bb8]
mov esi, dword [ebp + 8]
fstp dword [esp + 8]
fldz
lea eax, [ebx + 4]
fst dword [esp + 4]
fstp dword [esp]
call fcn.0043cc60
cmp byte [esp + 0x17], 0
je 0x43b3d8
mov edx, dword [edi]
mov eax, dword [edx]
push 1
mov ecx, edi
call eax
mov ecx, dword [esp + 0x24]
push ecx
call sub.gdiplus.dll_GdipDisposeImageAttributes
mov al, 1
mov ecx, dword [esp + 0x98]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x43b460
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x487c49
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x4a4100]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, dword [esp + 0x20]
call fcn.00438770
fld1
xor ebx, ebx
fstp dword [esi + 0x24]
mov dword [esi + 0x30], 0xffffffff
mov byte [esi + 0x34], bl
mov dword [esp + 0x18], ebx
mov dword [esi], vtable.uiLib::CTextExterior.0
mov dword [esi + 0x38], 0xff000000
mov eax, dword [0x4a8008]
mov edx, dword [eax + 0xc]
mov ecx, 0x4a8008
lea edi, [esi + 0x44]
call edx
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0x18], 1
mov eax, dword [0x4a8008]
mov edx, dword [eax + 0xc]
mov ecx, 0x4a8008
call edx
add eax, 0x10
mov dword [esi + 0x50], eax
mov byte [esp + 0x18], 2
mov eax, dword [0x4a8008]
mov edx, dword [eax + 0xc]
mov ecx, 0x4a8008
call edx
add eax, 0x10
mov dword [esi + 0x54], eax
push 6
push str.Tahoma
mov ecx, edi
mov byte [esp + 0x20], 3
call fcn.00402640
fld dword [0x495b7c]
fstp dword [esi + 0x3c]
mov dword [esi + 0x40], ebx
mov dword [esi + 0x38], 0xff000000
mov dword [esi + 0x48], 1
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x58], 5
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4

Function at 0x43e820
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x48ae96
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4a4100]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor eax, eax
mov dword [esi + 0x1c], 7
mov dword [esi + 0x18], 0
mov word [esi + 8], ax
lea ecx, [esi + 0x30]
push ecx
mov dword [esp + 0x18], eax
call fcn.00449510
lea edx, [esi + 0x48]
push edx
mov byte [esp + 0x18], 1
call fcn.00440c00
mov dword [esi], 0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4

Function at 0x43e890
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x48af29
mov eax, dword fs:[0]
push eax
push ecx
push edi
mov eax, dword [0x4a4100]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov dword [esp + 8], esi
lea edi, [esi + 4]
mov dword [esp + 0x14], 0
xor eax, eax
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], 0
mov word [edi + 4], ax
lea ecx, [esi + 0x30]
push ecx
mov byte [esp + 0x18], 1
call fcn.00449510
lea eax, [esi + 0x48]
push eax
mov byte [esp + 0x18], 2
call fcn.00440c00
push 0xffffffffffffffff
push 0
lea edx, [esp + 0x24]
mov byte [esp + 0x1c], 3
push edx
mov ecx, edi
mov dword [esi], 1
call fcn.00405c00
cmp dword [esp + 0x34], 8
jb 0x43e920
mov eax, dword [esp + 0x20]
push eax
call fcn.0046f011
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x10
ret 0x1c
Function at 0x43e9c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x48ae96
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4a4100]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor eax, eax
xor ecx, ecx
mov dword [esi + 0x1c], 7
mov dword [esi + 0x18], eax
mov word [esi + 8], cx
lea edx, [esi + 0x30]
push edx
mov dword [esp + 0x18], eax
call fcn.00449510
lea eax, [esi + 0x48]
push eax
mov byte [esp + 0x18], 1
call fcn.00440c00
fld qword [esp + 0x20]
fstp qword [esi + 0x28]
mov dword [esi], 3
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0xc
Function at 0x4481c0
Capabilities:
Create thread

Disassembly:
sub esp, 0x24
mov eax, dword [0x4a4100]
xor eax, esp
mov dword [esp + 0x20], eax
cmp byte [esi + 0x20], 0
je 0x4481e5
xor al, al
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0046f01c
add esp, 0x24
ret
cmp byte [esi + 0x21], 0
jne 0x44824f
lea eax, [esp]
push eax
push 0
push esi
push 0x4481b0
push 0
push 0
mov byte [esi + 0x21], 1
mov dword [esp + 0x18], 0
call fcn.00470ee2
add esp, 0x18
mov dword [esi + 0x1c], eax
test eax, eax
je 0x4481d4
cmp dword [esi + 0x14], 0
je 0x44824f
lea ecx, [esp + 4]
push 0
push ecx
mov ecx, esi
call fcn.0044a620
mov eax, dword [esp + 0x10]
add esp, 8
cmp dword [esp + 0x1c], 0x10
jae 0x44823c
lea eax, [esp + 8]
mov edx, dword [esp]
push eax
push edx
call fcn.00448510
lea ecx, [esp + 4]
call fcn.00405220
mov ecx, dword [esp + 0x20]
xor ecx, esp
mov al, 1
call fcn.0046f01c
add esp, 0x24
ret

Function at 0x4497e0
Capabilities:
Get file size

Disassembly:
push ecx
mov eax, dword [esi]
push ebx
push ebp
push edi
test eax, eax
je 0x4497f7
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
cmp dword [esi + 0x30], 8
jb 0x449802
mov eax, dword [esi + 0x1c]
jmp 0x449805
lea eax, [esi + 0x1c]
push 0
push 0x80
push 4
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x4498ae
mov eax, dword [esi + 8]
or eax, dword [esi + 0xc]
jne 0x449851
lea ecx, [esp + 0xc]
push ecx
push ebp
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0xc]
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], ecx
mov edx, dword [esp + 0x14]
add dword [esi + 0x10], edx
mov eax, dword [esp + 0x18]
mov edi, dword [esi + 0x10]
adc dword [esi + 0x14], eax
mov ebx, dword [esi + 0x14]
push 0
push 0x4000
push ebx
push edi
call fcn.00482bb0
test edx, edx
jl 0x449890
jg 0x44987d
test eax, eax
jbe 0x449890
sub edi, eax
sbb ebx, edx
add edi, 0x4000
adc ebx, 0
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], ebx
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0x14]
push 0
push ecx
push edx
push 4
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push ebp
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x449a70
Capabilities:
Access peb ldr_data
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x48a0a5
mov eax, dword fs:[0]
push eax
sub esp, 0x280
mov eax, dword [0x4a4100]
xor eax, esp
mov dword [esp + 0x27c], eax
push ebx
push ebp
push esi
mov eax, dword [0x4a4100]
xor eax, esp
push eax
lea eax, [esp + 0x290]
mov dword fs:[0], eax
xor ebp, ebp
mov dword [edi], ebp
mov dword [edi + 0x2c], ebp
mov ebx, 7
mov dword [edi + 0x30], ebx
xor eax, eax
mov word [edi + 0x1c], ax
mov dword [esp + 0x10], edi
mov dword [edi + 8], ebp
mov dword [edi + 0xc], ebp
mov dword [edi + 0x10], ebp
mov dword [edi + 0x14], ebp
lea eax, [edi + 0x38]
push eax
mov dword [esp + 0x29c], ebp
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea esi, [esp + 0x68]
mov byte [esp + 0x298], 1
call fcn.0044a050
push 0x206
lea edx, [esp + 0x8a]
xor ecx, ecx
push ebp
mov byte [esp + 0x2a0], 2
push edx
mov word [esp + 0x90], cx
call fcn.00474b70
add esp, 0xc
push 2
xor eax, eax
push 0x494864
lea ecx, [esp + 0x38]
mov dword [esp + 0x50], ebx
mov dword [esp + 0x4c], ebp
mov word [esp + 0x3c], ax
call fcn.00405fe0
mov bl, 3
lea ecx, [esp + 0x14]
mov byte [esp + 0x298], bl
call fcn.0044afa0
push 0xffffffffffffffff
push ebp
push eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0x2a4], 4
call fcn.00445fa0
mov esi, 8
mov byte [esp + 0x298], bl
cmp dword [esp + 0x2c], esi
jb 0x449b7e
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0046f011
add esp, 4
push 9
push str.gst_log_
lea ecx, [esp + 0x38]
call fcn.0044a310
push 0xffffffffffffffff
push ebp
lea edx, [esp + 0x70]
push edx
lea ecx, [esp + 0x3c]
call fcn.00445fa0
push 4
push str..txt
lea ecx, [esp + 0x38]
call fcn.0044a310
mov ebx, 7
xor eax, eax
mov dword [esp + 0x64], ebx
mov dword [esp + 0x60], ebp
mov word [esp + 0x50], ax
lea ecx, [esp + 0x84]
push ecx
push 0x104
mov byte [esp + 0x2a0], 5
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jbe 0x449c31
mov eax, dword [esp + 0x34]
cmp dword [esp + 0x48], esi
jae 0x449bf0
lea eax, [esp + 0x34]
push eax
lea edx, [esp + 0x88]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp eax, 1
jne 0x449c31
lea eax, [esp + 0x84]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x449c10
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x88]
push eax
lea ecx, [esp + 0x54]
call fcn.00405fe0
lea ecx, [esp + 0x4c]
push ecx
mov ecx, edi
call fcn.004499f0
cmp dword [esp + 0x64], esi
jb 0x449c50
mov edx, dword [esp + 0x50]
push edx
call fcn.0046f011
add esp, 4
xor eax, eax
mov dword [esp + 0x64], ebx
mov dword [esp + 0x60], ebp
mov word [esp + 0x50], ax
cmp dword [esp + 0x48], esi
jb 0x449c72
mov ecx, dword [esp + 0x34]
push ecx
call fcn.0046f011
add esp, 4
xor edx, edx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x44], ebp
mov word [esp + 0x34], dx
cmp dword [esp + 0x80], esi
jb 0x449c97
mov eax, dword [esp + 0x6c]
push eax
call fcn.0046f011
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x290]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x27c]
xor ecx, esp
call fcn.0046f01c
add esp, 0x28c
ret
Function at 0x44a430
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4892f8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x4a4100]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x40]
xor edi, edi
push 0xffffffffffffffff
push edi
xor eax, eax
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], edi
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], edi
mov word [esp + 0x20], ax
call fcn.00405c00
mov edx, dword [esp + 0x44]
mov eax, edx
mov dword [esp + 0x34], edi
lea esi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x44a490
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x18]
call fcn.0044a310
mov esi, dword [esp + 0x3c]
push 0xffffffffffffffff
push edi
xor edx, edx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push eax
mov ecx, esi
mov word [esi + 4], dx
call fcn.00405c00
cmp dword [esp + 0x28], 8
jb 0x44a4dd
mov eax, dword [esp + 0x14]
push eax
call fcn.0046f011
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x2c
ret
Function at 0x44a8e0
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x488838
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x4a4100]
xor eax, esp
mov dword [esp + 0x44], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4a4100]
xor eax, esp
push eax
lea eax, [esp + 0x5c]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x14]
mov dword [esp + 0x1c], esi
test eax, eax
je 0x44a9f8
cmp eax, 3
jb 0x44a9f8
mov ebx, 1
cmp eax, ebx
jae 0x44a93a
call fcn.0046f637
mov edi, 8
cmp dword [esi + 0x18], edi
jb 0x44a949
mov eax, dword [esi + 4]
jmp 0x44a94c
lea eax, [esi + 4]
cmp word [eax + 2], 0x3a
jne 0x44a9f8
push esi
lea ecx, [esp + 0x24]
call fcn.004053a0
mov dword [esp + 0x64], 0
mov eax, dword [esp + 0x34]
lea esi, [eax - 1]
cmp esi, eax
jbe 0x44a979
call fcn.0046f637
mov eax, dword [esp + 0x24]
cmp dword [esp + 0x38], edi
jae 0x44a987
lea eax, [esp + 0x24]
movzx eax, word [eax + esi*2]
cmp ax, 0x5c
je 0x44a9a2
cmp ax, 0x2f
je 0x44a9a2
push 0x5c
lea esi, [esp + 0x24]
call fcn.004401f0
lea eax, [esp + 0x14]
push eax
xor eax, eax
lea edx, [esp + 0x24]
mov dword [esp + 0x18], 0x5c
call fcn.0044b620
lea ecx, [esp + 0x14]
mov esi, eax
push ecx
xor eax, eax
lea edx, [esp + 0x24]
mov dword [esp + 0x18], 0x2f
call fcn.0044b620
cmp esi, 0xffffffff
jne 0x44a9db
or esi, esi
cmp eax, 0xffffffff
jne 0x44a9e2
or eax, eax
mov edi, esi
cmp esi, eax
jb 0x44a9ea
mov edi, eax
cmp edi, 0xffffffff
jne 0x44aa19
lea ecx, [esp + 0x20]
call fcn.00406360
xor eax, eax
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.0046f01c
add esp, 0x54
ret
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [esp + 0x18], ebx
mov edx, dword [esp + 0x1c]
push edx
mov ecx, edi
xor edx, edx
lea esi, [esp + 0x40]
call fcn.0044b5f0
mov eax, dword [esp + 0x40]
mov esi, 8
cmp dword [esp + 0x54], esi
jae 0x44aa48
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x44aa77
mov eax, dword [esp + 0x40]
cmp dword [esp + 0x54], esi
jae 0x44aa61
lea eax, [esp + 0x40]
push 0
push eax
call ebp
test eax, eax
jne 0x44aa77
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x44aae2
lea eax, [esp + 0x14]
lea esi, [edi + 1]
push eax
mov eax, esi
lea edx, [esp + 0x24]
mov dword [esp + 0x18], 0x5c
call fcn.0044b620
lea ecx, [esp + 0x14]
mov edi, eax
push ecx
mov eax, esi
lea edx, [esp + 0x24]
mov dword [esp + 0x18], 0x2f
call fcn.0044b620
cmp edi, 0xffffffff
jne 0x44aab3
or edi, edi
cmp eax, 0xffffffff
jne 0x44aaba
or eax, eax
cmp edi, eax
jb 0x44aac0
mov edi, eax
cmp edi, 0xffffffff
je 0x44aafd
cmp dword [esp + 0x54], 8
jb 0x44aa23
mov edx, dword [esp + 0x40]
push edx
call fcn.0046f011
add esp, 4
jmp 0x44aa23
lea ecx, [esp + 0x3c]
xor esi, esi
call fcn.00406360
lea ecx, [esp + 0x20]
call fcn.00406360
mov eax, esi
jmp 0x44a9fa
lea ecx, [esp + 0x3c]
call fcn.00406360
mov esi, dword [esp + 0x18]
lea ecx, [esp + 0x20]
call fcn.00406360
mov eax, esi
jmp 0x44a9fa
Function at 0x44ab20
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x488808
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4a4100]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x18], 8
jb 0x44ab54
mov eax, dword [edi + 4]
jmp 0x44ab57
lea eax, [edi + 4]
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call esi
cmp eax, 0xffffffff
je 0x44abae
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
call fcn.0044acd0
mov ebp, eax
test edx, edx
jl 0x44abc7
jg 0x44ab95
cmp ebp, 0x40000000
jbe 0x44abc7
mov eax, 3
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
mov eax, 1
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov ecx, edi
call fcn.00406260
push eax
call esi
mov edi, eax
cmp edi, 0xffffffff
je 0x44abae
lea ebx, [ebp + 1]
push 0x4a7da0
push ebx
mov dword [esp + 0x1c], 0
call fcn.00470fd1
mov esi, eax
add esp, 8
test esi, esi
jne 0x44ac29
lea esi, [eax + 4]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
push ebx
push 0
push esi
call fcn.00474b70
add esp, 0xc
xor ebx, ebx
push ebx
lea eax, [esp + 0x18]
push eax
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x44ac5c
push esi
call fcn.0046f324
add esp, 4
lea esi, [ebx + 5]
jmp 0x44ac0c
push eax
push esi
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], 0
call fcn.00404be0
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x50]
mov dword [esp + 0x48], ebx
call fcn.00405090
cmp dword [esp + 0x30], 0x10
jb 0x44aca1
mov edx, dword [esp + 0x1c]
push edx
call fcn.0046f011
add esp, 4
push esi
call fcn.0046f324
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 2
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
Function at 0x44acd0
Capabilities:
Get file size

Disassembly:
push ecx
cmp dword [eax + 0x18], 8
push ebx
push ebp
push esi
push edi
jb 0x44ace0
mov eax, dword [eax + 4]
jmp 0x44ace3
add eax, 4
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x44ad0d
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
lea eax, [esp + 0x10]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x44ad2a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x44ad03
mov ecx, dword [esp + 0x10]
push 1
push 0
push 0
push ecx
call fcn.00474e40
mov edi, edx
mov esi, eax
xor edx, edx
add esi, ebp
push ebx
adc edi, edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, edi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret