joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43fc20
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5759b8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5d2020]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [0x5dcd6c]
mov edx, dword [eax + 0xc]
xor ebp, ebp
mov ecx, 0x5dcd6c
mov dword [esp + 0x18], ebp
call edx
lea edi, [eax + 0x10]
mov dword [esp + 0x14], edi
push ebp
push 0x80
push 2
push ebp
push 1
mov dword [esp + 0x40], ebp
mov eax, dword [ebx + 0x14]
push 0x40000000
push eax
mov dword [esp + 0x38], ebp
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x43fd0b
cmp dword [ebx + 0x18], ebp
jne 0x43fcba
mov eax, dword [esp + 0x34]
mov ebx, dword [eax]
lea eax, [esp + 0x14]
call fcn.0040e6f0
mov edi, dword [esp + 0x14]
mov eax, dword [edi - 0xc]
push ebp
lea ecx, [esp + 0x20]
push ecx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x43fcf8
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push ebp
lea edx, [esp + 0x24]
push edx
push 2
lea eax, [esp + 0x20]
push eax
push esi
mov byte [esp + 0x28], 0xff
mov byte [esp + 0x29], 0xfe
mov dword [esp + 0x34], ebp
call ebx
test eax, eax
je 0x43fd04
mov ecx, dword [esp + 0x34]
mov eax, dword [ecx]
mov ecx, dword [eax - 0xc]
push ebp
lea edx, [esp + 0x20]
push edx
add ecx, ecx
push ecx
push eax
push esi
call ebx
cmp eax, ebp
je 0x43fd04
mov dword [esp + 0x18], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add edi, 0xfffffff0
mov dword [esp + 0x2c], 0xffffffff
lea eax, [edi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x43fd2f
mov ecx, dword [edi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push edi
call eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 4

Function at 0x43fd50
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 8
push esi
push edi
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
push eax
mov byte [esp + 0x24], 0
mov byte [esp + 0x25], 0
mov dword [esp + 0x28], edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x43fdc2
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 2
jb 0x43fdbb
push edi
lea ecx, [esp + 0x10]
push ecx
push 2
lea edx, [esp + 0x14]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x43fdbb
cmp byte [esp + 8], 0xff
jne 0x43fdbb
cmp byte [esp + 9], 0xfe
jne 0x43fdbb
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
add esp, 8
ret
Function at 0x4423d0
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x577188
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5d2020]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x5dcd6c]
mov edx, dword [eax + 0xc]
xor ebx, ebx
mov ecx, 0x5dcd6c
mov dword [esp + 0x14], ebx
call edx
lea edi, [eax + 0x10]
mov dword [esp + 0x18], edi
cmp esi, ebx
mov dword [esp + 0x24], ebx
je 0x4424aa
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x4424aa
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp + 0x14], eax
add eax, 1
push eax
call fcn.0044e4eb
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x4424a3
mov ecx, dword [esp + 0x14]
push ebx
lea eax, [esp + 0x18]
push eax
push ecx
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x44249a
mov edx, dword [esp + 0x14]
push esi
lea edi, [esp + 0x1c]
mov byte [esi + edx], bl
call fcn.00442570
mov eax, dword [esp + 0x30]
mov edi, dword [esp + 0x1c]
add esp, 4
push eax
mov ecx, edi
call fcn.00442080
mov ebx, eax
push esi
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [edi - 0x10]
mov dword [esp + 0x24], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4424ce
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
Function at 0x443380
Capabilities:
Delete directory
Get file attributes
Set file attributes

Disassembly:
push ecx
lea eax, [esp]
push eax
mov ecx, esi
mov dword [esp + 4], 1
call fcn.00445a10
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 1
je 0x4433ae
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop ecx
ret

Function at 0x4433c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x577d4a
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5d2020]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, dword [esp + 0x24]
call fcn.004452d0
mov dword [edi + 4], eax
mov bl, 1
mov byte [eax + 0x11], bl
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
xor ebp, ebp
mov dword [eax + 8], eax
mov dword [edi + 8], ebp
mov dword [esp + 0x1c], ebp
mov eax, dword [0x5dcd6c]
mov edx, dword [eax + 0xc]
mov ecx, 0x5dcd6c
lea esi, [edi + 0xc]
call edx
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0x1c], bl
mov eax, dword [0x5dcd6c]
mov edx, dword [eax + 0xc]
mov ecx, 0x5dcd6c
call edx
add eax, 0x10
mov dword [edi + 0x10], eax
lea eax, [edi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [edi + 0x30], ebp
mov byte [esp + 0x1c], 4
mov eax, dword [0x5dcd6c]
mov edx, dword [eax + 0xc]
mov ecx, 0x5dcd6c
call edx
add eax, 0x10
mov dword [edi + 0x40], eax
mov byte [esp + 0x1c], 5
mov eax, dword [0x5dcd6c]
mov edx, dword [eax + 0xc]
mov ecx, 0x5dcd6c
call edx
add eax, 0x10
mov dword [edi + 0x44], eax
mov byte [esp + 0x1c], 6
mov eax, dword [edi + 4]
mov ecx, dword [eax + 4]
push ecx
mov ecx, edi
call fcn.00444a70
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [edi + 8], ebp
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
push 0x5c39ac
xor ebx, ebx
mov eax, esi
call fcn.00402030
push 0x5c39ac
lea eax, [edi + 0x40]
mov dword [edi + 0x2c], ebp
mov dword [edi + 0x34], ebp
mov dword [edi + 0x38], ebp
mov dword [edi + 0x3c], ebp
call fcn.00402030
push 0x5c39ac
lea eax, [edi + 0x10]
call fcn.00402030
push 0x5c39ac
lea eax, [edi + 0x44]
call fcn.00402030
mov edx, dword [esi]
mov dword [edi + 0x48], ebp
mov dword [edi + 0x4c], ebp
cmp dword [edx - 0xc], ebp
jne 0x4434fd
push 1
push edi
call fcn.004442a0
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
Function at 0x443650
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x575880
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
mov eax, dword [0x5d2020]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x48], 0
je 0x443726
test edi, edi
je 0x443726
mov eax, edi
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x443690
sub eax, edx
sar eax, 1
je 0x443726
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x443726
lea esi, [ebx + 0x14]
push esi
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [esp + 0xc]
push eax
mov ecx, edi
mov dword [esp + 0x2c], 0
call fcn.00401bd0
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
mov byte [esp + 0x30], 1
call fcn.00444960
mov byte [esp + 0x28], 0
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x44370b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x20
ret
mov eax, 4
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x20
ret
Function at 0x443850
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x5771e8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5d2020]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
cmp dword [ebx + 0x48], 0
je 0x443917
mov eax, dword [0x5dcd6c]
mov edx, dword [eax + 0xc]
mov ecx, 0x5dcd6c
call edx
add eax, 0x10
mov dword [esp + 0xc], eax
push 0
push ebx
lea esi, [esp + 0x14]
mov dword [esp + 0x20], 0
call fcn.004442a0
mov esi, eax
test esi, esi
je 0x4438e9
mov dword [esp + 0x18], 0xffffffff
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4438d5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
mov edi, dword [esp + 0xc]
cmp dword [edi - 0xc], 0
jne 0x44392e
lea eax, [edi - 0x10]
mov dword [esp + 0x18], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x443917
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 4
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x44393e
test al, 0x10
jne 0x443976
lea eax, [edi - 0x10]
mov dword [esp + 0x18], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4439ba
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
mov ecx, dword [ebx + 0x44]
lea esi, [esp + 0xc]
call fcn.00410b30
test eax, eax
jl 0x4439b1
mov esi, edi
call fcn.00443380
test eax, eax
jne 0x4439b1
lea eax, [esp + 0xc]
call fcn.00401b90
mov eax, 7
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
lea eax, [esp + 0xc]
call fcn.00401b90
xor eax, eax
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x443d20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x5792d8
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push edi
mov eax, dword [0x5d2020]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x20]
mov eax, dword [esi]
mov ecx, dword [eax - 0xc]
test ecx, ecx
jne 0x443d68
lea eax, [ecx + 4]
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
add esp, 0xc
ret 8
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x443d8d
mov eax, 8
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
add esp, 0xc
ret 8
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x443e03
test al, 0x10
jne 0x443e03
mov ecx, dword [esi]
lea ebx, [esp + 0x20]
call fcn.00438db0
lea edi, [ebp + 0x40]
mov dword [esp + 0x18], 0
call fcn.004042f0
mov dword [esp + 0x18], 0xffffffff
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x443de2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x24]
push esi
push ecx
push ebp
call fcn.00443e20
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
add esp, 0xc
ret 8
push ebp
mov ecx, esi
call fcn.004440a0
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
add esp, 0xc
ret 8
Function at 0x4440a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x5792a8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5d2020]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
mov ecx, dword [eax - 0xc]
xor ebp, ebp
cmp ecx, ebp
jne 0x4440dc
lea eax, [ebp + 4]
jmp 0x4441be
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4440ec
test al, 0x10
jne 0x4440f6
mov eax, 8
jmp 0x4441be
mov edi, dword [esp + 0x3c]
add edi, 0x40
mov eax, esi
call fcn.004042f0
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x34], ebp
mov ecx, dword [esi]
lea edx, [esp + 0x14]
lea eax, [esp + 0x18]
push edx
mov dword [esp + 0x18], eax
call fcn.004454e0
add esp, 4
cmp eax, 1
je 0x444140
lea esi, [esp + 0x18]
call fcn.00404230
mov eax, 0xf
jmp 0x4441be
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
cmp esi, edi
jbe 0x444156
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov edi, dword [esp + 0x20]
cmp dword [esp + 0x1c], edi
mov ebx, edi
jbe 0x444168
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov edi, dword [esp + 0x20]
cmp esi, ebx
je 0x4441a2
cmp esi, edi
jb 0x444176
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov eax, dword [esp + 0x3c]
push esi
lea ecx, [eax + 0x38]
push ecx
push eax
call fcn.00443e20
mov edi, dword [esp + 0x20]
mov ebp, eax
test ebp, ebp
jne 0x4441a2
cmp esi, edi
jb 0x44419d
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov edi, dword [esp + 0x20]
add esi, 4
jmp 0x444156
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4441bc
call fcn.00404650
mov edx, dword [esp + 0x1c]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, ebp
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 4

Function at 0x4441e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [edi + 0xc]
cmp dword [eax - 0xc], 0
push esi
lea esi, [edi + 0xc]
jne 0x4441f9
push 1
push edi
call fcn.004442a0
test eax, eax
jne 0x444246
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x44420b
test al, 0x10
jne 0x44421f
mov ecx, dword [esi]
call fcn.00443070
test eax, eax
jne 0x44421f
mov eax, 6
pop esi
ret 4
push edi
mov esi, ebx
call fcn.004444c0
test eax, eax
jne 0x444246
mov eax, dword [ebx]
push eax
call fcn.0044a260
mov ecx, dword [esp + 0xc]
mov dword [ecx], eax
add esp, 4
neg eax
sbb eax, eax
and eax, 0xfffffff0
add eax, 0x10
pop esi
ret 4
Function at 0x4442a0
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x577146
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x5d2020]
xor eax, esp
mov dword [esp + 0x214], eax
push ebp
push edi
mov eax, dword [0x5d2020]
xor eax, esp
push eax
lea eax, [esp + 0x224]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x234]
mov eax, dword [ebp + 0x44]
mov eax, dword [eax - 0xc]
test eax, eax
jne 0x4442f4
mov eax, 4
jmp 0x444494
push 0x208
lea ecx, [esp + 0x1a]
push 0
push ecx
mov word [esp + 0x20], 0
call fcn.0044ea7c
add esp, 0xc
lea edx, [esp + 0x14]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x44434c
lea eax, [esp + 0x14]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x444330
sub eax, edx
sar eax, 1
je 0x44434c
lea edx, [esp + 0x14]
mov edi, esi
call fcn.00401ff0
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
je 0x4442ea
mov edx, dword [0x5dcd6c]
mov eax, dword [edx + 0xc]
mov ecx, 0x5dcd6c
call eax
add eax, 0x10
mov dword [esp + 0xc], eax
push esi
mov eax, 1
lea ecx, [esp + 0x14]
mov dword [esp + 0x230], 0
call fcn.00407b10
lea edi, [esp + 0xc]
mov byte [esp + 0x22c], 1
call fcn.004042f0
mov byte [esp + 0x22c], 0
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4443be
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [esp + 0xc]
mov ecx, 0x5c3a94
mov eax, edi
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4443f6
test dx, dx
je 0x4443f2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4443f6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4443d0
xor eax, eax
jmp 0x4443fb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
setne al
test al, al
je 0x444427
lea ecx, [esp + 0xc]
push ecx
mov ecx, 0x5c3b70
call fcn.00407d20
add esp, 4
test al, al
je 0x444427
push 1
push 0x5c3a94
push esi
call fcn.00407d80
lea eax, [edi - 0x10]
mov dword [esp + 0x22c], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x44444e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp + 0x44]
mov ecx, dword [eax - 0xc]
push ecx
push eax
push esi
call fcn.00407d80
cmp dword [esp + 0x238], 0
je 0x444492
mov ecx, dword [esi]
call fcn.00443070
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x44447f
test al, 0x10
jne 0x444492
mov edx, 0x5c39ac
mov edi, esi
call fcn.00401ff0
mov eax, 0xc
jmp 0x444494
xor eax, eax
mov ecx, dword [esp + 0x224]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.0044e502
add esp, 0x224
ret 8
Function at 0x4444c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x577110
mov eax, dword fs:[0]
push eax
push ecx
push edi
mov eax, dword [0x5d2020]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0x44]
mov ecx, dword [ecx - 0xc]
test ecx, ecx
jne 0x444506
lea eax, [ecx + 4]
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x10
ret 4
add eax, 0xc
mov edi, esi
call fcn.004042f0
mov edx, dword [0x5dcd6c]
mov eax, dword [edx + 0xc]
mov ecx, 0x5dcd6c
call eax
add eax, 0x10
mov dword [esp + 0x1c], eax
push esi
mov eax, 1
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], 0
call fcn.00407b10
lea edi, [esp + 0x1c]
mov byte [esp + 0x14], 1
call fcn.004042f0
mov byte [esp + 0x14], 0
mov eax, dword [esp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x444571
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [esp + 0x1c]
mov ecx, 0x5c3a94
mov eax, edi
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4445a6
test dx, dx
je 0x4445a2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4445a6
add eax, 4
add ecx, 4
test dx, dx
jne 0x444580
xor eax, eax
jmp 0x4445ab
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
setne al
test al, al
je 0x4445d7
lea ecx, [esp + 0x1c]
push ecx
mov ecx, 0x5c3b70
call fcn.00407d20
add esp, 4
test al, al
je 0x4445d7
push 1
push 0x5c3a94
push esi
call fcn.00407d80
lea eax, [edi - 0x10]
mov dword [esp + 0x14], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4445fb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0xc
push str.kzip_tmp.zip
push esi
call fcn.00407d80
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x44463d
test al, 0x10
jne 0x44463d
mov ecx, esi
call fcn.0044a3c0
test eax, eax
jne 0x44463d
mov eax, 7
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x10
ret 4
xor eax, eax
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x10
ret 4
Function at 0x445fd0
Capabilities:
Create thread

Disassembly:
push 0xc
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
jne 0x445fdf
ret
mov ecx, dword [esp + 4]
push 0
push 0
push eax
push 0x4463a0
push 0
push 0
mov dword [eax], ecx
mov dword [eax + 8], 0
mov dword [eax + 4], 0x443d10
call dword [sym.imp.MSVCR80.dll__beginthreadex]
add esp, 0x18
ret

Function at 0x4465f0
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
sub esp, 0x4c
push ebx
push ebp
push esi
mov esi, eax
push edi
lea eax, [esp + 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x446616
mov eax, 0x200
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret
mov eax, dword [esp + 0x28]
mov edx, eax
xor ebp, ebp
and edx, 1
je 0x446628
mov ebp, 1
test al, 2
je 0x44662f
or ebp, 2
test al, 4
je 0x446636
or ebp, 4
mov ecx, eax
and ecx, 0x10
je 0x446640
or ebp, 0x10
test al, 0x20
je 0x446647
or ebp, 0x20
test ecx, ecx
je 0x446653
or ebp, 0x40000000
jmp 0x446659
or ebp, 0x80000000
or ebp, 0x1000000
test edx, edx
jne 0x446669
or ebp, 0x800000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x28
mov dword [esp + 0x18], eax
jbe 0x446714
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push 0
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea ecx, [esp + 0x20]
push ecx
push 2
lea edx, [esp + 0x20]
push edx
push esi
call ebx
push 0
push 0
push 0x24
push esi
call edi
push 0
lea eax, [esp + 0x20]
push eax
push 4
lea ecx, [esp + 0x2c]
push ecx
push esi
call ebx
cmp word [esp + 0x14], 0x54ad
jne 0x446714
mov eax, dword [esp + 0x20]
lea edx, [eax + 0x34]
cmp dword [esp + 0x18], edx
jbe 0x446714
push 0
push 0
push eax
push esi
call edi
push 0
lea eax, [esp + 0x20]
push eax
push 4
lea ecx, [esp + 0x30]
push ecx
push esi
call ebx
mov eax, dword [esp + 0x24]
cmp eax, 0x5a4d
je 0x44670e
cmp eax, 0x454e
je 0x44670e
cmp eax, 0x454c
je 0x44670e
cmp eax, 0x4550
jne 0x446714
or ebp, 0x400000
mov eax, dword [esp + 0x60]
test eax, eax
je 0x44671e
mov dword [eax], ebp
mov eax, dword [esp + 0x64]
test eax, eax
je 0x44672c
mov edx, dword [esp + 0x18]
mov dword [eax], edx
mov ebx, dword [esp + 0x68]
test ebx, ebx
mov esi, dword [esp + 0x40]
mov edi, dword [esp + 0x3c]
je 0x4467a4
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
push 0
sub eax, 0xd53e8000
push 0x989680
sbb ecx, 0x19db1de
push ecx
push eax
call fcn.00497b40
mov dword [ebx], eax
push 0
mov edx, edi
sub edx, 0xd53e8000
mov eax, esi
push 0x989680
sbb eax, 0x19db1de
push eax
push edx
call fcn.00497b40
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
push 0
sub ecx, 0xd53e8000
push 0x989680
sbb edx, 0x19db1de
push edx
push ecx
mov dword [ebx + 4], eax
call fcn.00497b40
mov dword [ebx + 8], eax
mov ebx, dword [esp + 0x6c]
test ebx, ebx
je 0x4467d1
push esi
push edi
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x20]
push ecx
call fcn.00446510
movzx edx, word [esp + 0x24]
movzx eax, word [esp + 0x28]
shl edx, 0x10
add esp, 0x10
or edx, eax
mov dword [ebx], edx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x4c
ret