joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43b6b0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x49ef19
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, dword [esp + 0x20]
push edi
lea eax, [esp + 0xc]
xor edi, edi
push eax
mov dword [esp + 0x20], edi
push ecx
mov dword [esp + 0x18], edi
push edi
mov dword [esp + 0x18], edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
cmp eax, edi
jge 0x43b6f7
push 1
push edi
push eax
call fcn.0041cac0
push 0x4d9f40
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov dword [esi], 0x4d9f40
mov dword [esp + 0x1c], edi
push 0x104
mov ecx, esi
mov dword [esp + 0x14], 1
call fcn.00419ec0
mov edx, dword [esp + 0xc]
push eax
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x43b75d
mov edx, dword [esi]
lea eax, [edx + 0xc]
lea ebx, [eax + 2]
jmp 0x43b740
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x43b740
sub eax, ebx
sar eax, 1
mov dword [edx + 4], eax
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + eax*2 + 0xc], dx
jmp 0x43b76a
mov eax, dword [esi]
mov dword [eax + 4], edi
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + 0xc], cx
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [esp + 0x14]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x14
ret
Function at 0x43ce50
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4a0498
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push eax
lea ecx, [esp + 0x14]
push ecx
call fcn.00425730
add esp, 8
xor ebx, ebx
lea edi, [esp + 0x10]
mov dword [esp + 0x34], ebx
call fcn.00426cb0
mov eax, dword [esp + 0x10]
push ebx
lea edx, [esp + 0x24]
push edx
lea ecx, [esp + 0x20]
add eax, 0xc
push ecx
push eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
setne al
cmp al, bl
jne 0x43ceca
mov edx, edi
push edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0041e420
mov ecx, 0xa
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
shrd eax, edx, cl
shr edx, cl
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], eax
cmp edx, ebx
jne 0x43cf31
cmp eax, 0x7fffffff
ja 0x43cf31
mov dword [esp + 0x14], eax
mov dword [esp + 0x34], 0xffffffff
mov eax, dword [esp + 0x10]
push eax
mov edi, eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x43cf19
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [esp + 0x34], 0xffffffff
mov eax, dword [esp + 0x10]
push eax
mov edi, eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x43cf57
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
mov eax, 0x7fffffff
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x43d7c0
Capabilities:
Get thread local storage value

Disassembly:
mov ecx, dword [0x4da0cc]
mov eax, dword [ebx + 4]
push ebp
mov ebp, dword [esp + 8]
push esi
push edi
lea esi, [ebp + ebp*2]
shl esi, 4
push ecx
mov dword [esp + 0x14], eax
add esi, 8
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test eax, eax
jne 0x43d7f0
mov edi, 0x4d79e4
mov edx, dword [edi]
mov eax, dword [edx + 4]
push esi
mov ecx, edi
call eax
mov esi, eax
test esi, esi
jne 0x43d805
call fcn.0041cdf0
add esi, 8
mov dword [esi - 8], edi
jne 0x43d812
call fcn.0041cdf0
mov eax, dword [ebx]
mov edi, dword [esp + 0x10]
mov dword [ebx + 4], esi
test eax, eax
jle 0x43d830
lea ecx, [eax + eax*2]
shl ecx, 4
push ecx
push edi
push esi
call fcn.00445c00
add esp, 0xc
test edi, edi
je 0x43d842
mov ecx, dword [edi - 8]
mov edx, dword [ecx]
lea eax, [edi - 8]
push eax
mov eax, dword [edx + 8]
call eax
pop edi
pop esi
mov dword [ebx + 8], ebp
pop ebp
ret 4
Function at 0x43f970
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4a2048
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c
push esi
lea esi, [ecx + 4]
push edi
push esi
mov dword [esp + 0xc], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [esp + 0xc], 1
mov dword [esp + 0x5c], 0
mov eax, dword [0x4da744]
mov ecx, dword [eax + 4]
lea edx, [eax + 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push ecx
add eax, 0xc
push edx
push eax
call fcn.004473a5
add esp, 0xc
test eax, eax
je 0x43f9ed
push 0
push 0x235
push str.d:_build10_fineobjects_src_virtualfilesystem.cpp
push 0x4b84f0
push 0x4b84f0
push 0
call fcn.0041d410
add esp, 0x18
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x14], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
jne 0x43fa29
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x2c7
push str.d:_build10_fineobjects_src_fineobjects.cpp
push 0x4b84f0
push 0x4b84f0
push 1
call fcn.0041d410
add esp, 0x18
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
mov dword [esp + 8], edx
mov dword [esp + 0xc], eax
mov ecx, 0xa
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
shrd eax, edx, cl
shr edx, cl
test edx, edx
jl 0x43fa5f
jg 0x43fa58
cmp eax, 0x7fffffff
jbe 0x43fa5f
mov edi, 0x7fffffff
jmp 0x43fa61
mov edi, eax
push esi
mov dword [esp + 0x60], 0xffffffff
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x54]
mov eax, edi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x441a00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a31b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
mov esi, edx
cmp byte [esi + 0x10], 0
push edi
mov ebx, ecx
jne 0x441a2f
mov edi, esi
call fcn.00441970
mov ecx, dword [esi]
test ecx, ecx
je 0x441aa1
mov eax, dword [esi + 8]
test eax, eax
jne 0x441a5a
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
push ebp
push ebx
call edx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
cmp eax, 1
jne 0x441a98
mov eax, dword [esi + 0xc]
push eax
push ebp
push ebx
lea eax, [esp + 0x30]
push eax
call fcn.00419d90
mov dword [esp + 0x1c], 0
mov edi, dword [esp + 0x24]
mov eax, dword [edi + 4]
push eax
lea ecx, [edi + 0xc]
push ecx
mov ecx, esi
call fcn.00441bc0
mov dword [esp + 0x1c], 0xffffffff
push edi
jmp 0x441b8f
push 0
push 0x75
jmp 0x441b29
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x441b57
mov eax, dword [esi + 8]
test eax, eax
jne 0x441acf
push ebp
push ebx
call fcn.0041bec0
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
cmp eax, 1
jne 0x441b25
mov eax, dword [esi + 0xc]
push eax
push ebp
push ebx
lea edx, [esp + 0x30]
push edx
call fcn.00419d90
mov dword [esp + 0x1c], 1
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 4]
push ecx
add eax, 0xc
push eax
mov ecx, esi
call fcn.00441bc0
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0xffffffff
call fcn.004021e0
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
push 0
push 0x7d
push str.d:_build10_fineobjects_src_textstream.cpp
push 0x4b84f0
push 0x4b84f0
push 0
call fcn.0041d410
add esp, 0x18
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
mov eax, dword [esi + 0xc]
push eax
push ebx
lea ecx, [esp + 0x18]
call fcn.00419e70
mov dword [esp + 0x1c], 2
mov ecx, dword [eax]
add ecx, 0xc
push ecx
push 0x4c35d0
call fcn.00436380
mov dword [esp + 0x24], 0xffffffff
mov eax, dword [esp + 0x18]
add esp, 8
mov edi, eax
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x441ba6
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x10
ret 4
Function at 0x442cb0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4a3188
push eax
mov dword fs:[0], esp
xor eax, eax
push esi
mov esi, dword [esp + 0x14]
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], 0x1f
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], 0x80
mov dword [esp + 0xc], eax
push eax
mov dword [esi], vtable.FObj::CVirtualMemoryMapping.0
call fcn.0042ff80
mov ecx, dword [esp + 4]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 4
Function at 0x442f60
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x4c
push ebx
push ebp
mov ebp, dword [esp + 0x5c]
push esi
push edi
mov esi, eax
test ebp, ebp
jg 0x442f97
jl 0x442f7a
cmp dword [esp + 0x60], 0
jae 0x442f97
push 0
push 0x5b
push str.d:_build10_fineobjects_src_virtualfile.cpp
push 0x4b84f0
push 0x4b84f0
push 0
call fcn.0041d410
add esp, 0x18
cmp dword [esi + 0x48], 0
mov dword [esp + 0x10], 0
jle 0x442feb
mov ebx, dword [esi + 0x4c]
mov eax, dword [ebx]
mov edi, dword [eax + 0x1c]
cmp ebp, edi
mov ecx, dword [eax + 0x18]
jl 0x442feb
jg 0x442fbc
cmp dword [esp + 0x60], ecx
jb 0x442feb
mov edx, dword [eax + 0x20]
add edx, ecx
mov ecx, dword [eax + 0x24]
adc ecx, edi
cmp ebp, ecx
jl 0x44312f
jg 0x442fda
cmp dword [esp + 0x60], edx
jb 0x44312f
mov eax, dword [esp + 0x10]
inc eax
add ebx, 4
cmp eax, dword [esi + 0x48]
mov dword [esp + 0x10], eax
jl 0x442fa8
mov edx, dword [esi + 0x40]
mov ecx, dword [esi + 0x44]
mov eax, edx
or eax, ecx
jne 0x443034
mov eax, dword [0x4da8e4]
mov ecx, dword [esi + 0x3c]
mov edi, dword [esi + 0x38]
cdq
cmp ecx, edx
jl 0x443011
jg 0x44300d
cmp edi, eax
jbe 0x443011
mov eax, edi
jmp 0x443013
mov ecx, edx
push ecx
push eax
call fcn.00443140
mov ecx, dword [esi + 0x44]
cmp ebp, ecx
mov edx, dword [esi + 0x40]
jg 0x44305d
jl 0x44312f
cmp dword [esp + 0x60], edx
jb 0x44312f
cmp ebp, ecx
jg 0x44305d
jl 0x443040
cmp dword [esp + 0x60], edx
jae 0x44305d
push 0
push 0x72
push str.d:_build10_fineobjects_src_virtualfile.cpp
push 0x4b84f0
push 0x4b84f0
push 0
call fcn.0041d410
add esp, 0x18
mov eax, dword [0x4da8e4]
mov ecx, dword [esi + 0x44]
cdq
cmp ecx, edx
jg 0x443090
jl 0x443073
mov edx, dword [esi + 0x40]
cmp edx, eax
jae 0x443090
push 0
push 0x73
push str.d:_build10_fineobjects_src_virtualfile.cpp
push 0x4b84f0
push 0x4b84f0
push 0
call fcn.0041d410
add esp, 0x18
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
jne 0x4430cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x2c7
push str.d:_build10_fineobjects_src_fineobjects.cpp
push 0x4b84f0
push 0x4b84f0
push 1
call fcn.0041d410
add esp, 0x18
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
push 0
push 0xa
push ecx
push edx
call fcn.0044e9e0
mov ebp, dword [esi + 0x44]
mov ebx, dword [esi + 0x40]
push 0
push 2
push ebp
push ebx
mov dword [esp + 0x20], eax
mov edi, edx
call fcn.0044e9e0
cmp edx, edi
jg 0x443108
jl 0x443102
cmp eax, dword [esp + 0x10]
jae 0x443108
mov ecx, eax
mov eax, edx
jmp 0x44310e
mov ecx, dword [esp + 0x10]
mov eax, edi
mov edi, dword [esp + 0x60]
mov edx, dword [esp + 0x64]
sub edi, ebx
sbb edx, ebp
cmp eax, edx
jg 0x443128
jl 0x443124
cmp ecx, edi
ja 0x443128
mov ecx, edi
mov eax, edx
push eax
push ecx
call fcn.00443140
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret 8
Function at 0x4443c0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4a17f8
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
test esi, esi
jg 0x444410
jl 0x4443f3
test ebx, ebx
jae 0x444410
push 0
push 0x7a
push str.d:_build10_fineobjects_src_nativefile.cpp
push 0x4b84f0
push 0x4b84f0
push 0
call fcn.0041d410
add esp, 0x18
cmp dword [edi + 4], 0xffffffff
jne 0x444433
push 0
push 0x7b
push str.d:_build10_fineobjects_src_nativefile.cpp
push 0x4b84f0
push 0x4b84f0
push 0
call fcn.0041d410
add esp, 0x18
mov eax, dword [edi]
mov edx, dword [eax + 0x14]
push 0
push esi
push ebx
mov ecx, edi
call edx
mov eax, dword [edi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x44446e
lea esi, [esp + 0xc]
mov eax, edi
call fcn.00443e90
push eax
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0041e420
mov ecx, dword [esp + 0x14]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x444490
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4a1818
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 4]
cmp eax, 0xffffffff
jne 0x4444db
push 0
push 0x85
push str.d:_build10_fineobjects_src_nativefile.cpp
push 0x4b84f0
push 0x4b84f0
push 0
call fcn.0041d410
add esp, 0x18
mov eax, dword [edi + 4]
lea ecx, [esp + 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
jne 0x44451d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
je 0x444519
lea esi, [esp + 0xc]
mov eax, edi
call fcn.00443e90
push eax
push ebx
mov dword [esp + 0x2c], 0
call fcn.0041e420
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x444540
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4a17f8
push eax
mov dword fs:[0], esp
sub esp, 0xc
cmp dword [ebp + 0xc], 0
push esi
push edi
mov edi, ecx
jne 0x44457d
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov esi, dword [ebp + 8]
test esi, esi
jne 0x4445a2
push esi
push 0x98
push str.d:_build10_fineobjects_src_nativefile.cpp
push 0x4b84f0
push 0x4b84f0
push esi
call fcn.0041d410
add esp, 0x18
cmp dword [ebp + 0xc], 0
jg 0x4445c8
push 0
push 0x99
push str.d:_build10_fineobjects_src_nativefile.cpp
push 0x4b84f0
push 0x4b84f0
push 0
call fcn.0041d410
add esp, 0x18
cmp dword [edi + 4], 0xffffffff
jne 0x4445ee
push 0
push 0x9a
push str.d:_build10_fineobjects_src_nativefile.cpp
push 0x4b84f0
push 0x4b84f0
push 0
call fcn.0041d410
add esp, 0x18
mov edx, dword [ebp + 0xc]
mov eax, dword [edi + 4]
push 0
lea ecx, [esp + 0xc]
push ecx
push edx
push esi
push eax
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x444630
lea esi, [esp + 0xc]
mov eax, edi
call fcn.00443e90
push eax
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0041e420
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 8]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x444650
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4a17f8
push eax
mov dword fs:[0], esp
sub esp, 0xc
cmp dword [ebp + 0xc], 0
push esi
push edi
mov edi, ecx
je 0x44472f
mov esi, dword [ebp + 8]
test esi, esi
jne 0x4446a1
push esi
push 0xa9
push str.d:_build10_fineobjects_src_nativefile.cpp
push 0x4b84f0
push 0x4b84f0
push esi
call fcn.0041d410
add esp, 0x18
cmp dword [ebp + 0xc], 0
jg 0x4446c7
push 0
push 0xaa
push str.d:_build10_fineobjects_src_nativefile.cpp
push 0x4b84f0
push 0x4b84f0
push 0
call fcn.0041d410
add esp, 0x18
cmp dword [edi + 4], 0xffffffff
jne 0x4446ed
push 0
push 0xab
push str.d:_build10_fineobjects_src_nativefile.cpp
push 0x4b84f0
push 0x4b84f0
push 0
call fcn.0041d410
add esp, 0x18
mov edx, dword [ebp + 0xc]
mov eax, dword [edi + 4]
push 0
lea ecx, [esp + 0xc]
push ecx
push edx
push esi
push eax
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x44472f
lea esi, [esp + 0xc]
mov eax, edi
call fcn.00443e90
push eax
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0041e420
mov ecx, dword [esp + 0x14]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x444940
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, eax
mov eax, dword [edi]
add eax, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
jne 0x444973
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0041e420
mov ecx, dword [esi + 0x20]
cmp eax, ecx
je 0x44499c
test al, 1
je 0x44499c
mov eax, dword [edi]
add eax, 0xc
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x44499c
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0041e420
mov eax, dword [esi]
mov edx, dword [0x4da838]
mov ecx, dword [esi + 4]
mov edi, dword [0x4da83c]
mov dword [esp + 0x10], 0
cmp eax, edx
jne 0x4449bd
cmp ecx, edi
je 0x4449cd
lea ebx, [esp + 0x18]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x10]
xor ebx, ebx
mov dword [esp + 0xc], ebx
cmp eax, edx
jne 0x4449e1
mov ecx, dword [esi + 0x14]
cmp ecx, edi
je 0x4449f7
mov ecx, dword [esi + 0x14]
lea eax, [esp + 0x20]
mov dword [esp + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], eax
mov ecx, dword [esi + 8]
cmp ecx, edx
jne 0x444a05
mov edx, dword [esi + 0xc]
cmp edx, edi
je 0x444a16
mov eax, ecx
mov ecx, dword [esi + 0xc]
lea ebx, [esp + 0x28]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], eax
cmp dword [esp + 0x10], 0
jne 0x444a2c
cmp dword [esp + 0xc], 0
jne 0x444a2c
test ebx, ebx
je 0x444ade
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push 0
push 0x80
push 3
push 0
push 1
add eax, 0xc
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x444a64
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0041e420
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push ebx
push edx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x444a93
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 8]
push ecx
push esi
call fcn.0041e420
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x444aae
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0041e420
mov esi, dword [esi + 0x20]
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x444ade
test al, 1
jne 0x444ade
mov edi, dword [ebp + 8]
mov eax, dword [edi]
add eax, 0xc
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x444ade
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0041e420
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x445620
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x4da0cc]
push ebp
mov ebp, dword [ebx + 4]
push esi
mov esi, dword [esp + 0xc]
push edi
shl esi, 5
push eax
add esi, 8
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test eax, eax
jne 0x445647
mov edi, 0x4d79e4
mov edx, dword [edi]
mov eax, dword [edx + 4]
push esi
mov ecx, edi
call eax
mov esi, eax
test esi, esi
jne 0x44565c
call fcn.0041cdf0
add esi, 8
mov dword [esi - 8], edi
jne 0x445669
call fcn.0041cdf0
mov ecx, dword [ebx]
mov dword [ebx + 4], esi
test ecx, ecx
jle 0x44567c
push ebp
push esi
call fcn.004456b0
add esp, 8
test ebp, ebp
je 0x44569b
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
lea eax, [ebp - 8]
push eax
mov eax, dword [edx + 8]
call eax
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov dword [ebx + 8], ecx
pop ebp
ret 4
mov edx, dword [esp + 0x10]
pop edi
pop esi
mov dword [ebx + 8], edx
pop ebp
ret 4

Function at 0x44c435
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4d54a0]
jne 0x44c43f
repz ret
jmp fcn.00454929

Function at 0x45453b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0044a890
and dword [ebp - 4], 0
cmp dword [0x4d8fa0], 0
mov ebx, eax
jne 0x4545ec
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x45469d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x45469d
push eax
call fcn.0044a81e
mov dword [esp], 0x4ae92c
push edi
mov dword [0x4d8fa0], eax
call esi
push eax
call fcn.0044a81e
mov dword [esp], 0x4ae918
push edi
mov dword [0x4d8fa4], eax
call esi
push eax
call fcn.0044a81e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4d8fa8], eax
call esi
push eax
call fcn.0044a81e
pop ecx
mov dword [0x4d8fb0], eax
test eax, eax
je 0x4545ec
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0044a81e
pop ecx
mov dword [0x4d8fac], eax
mov eax, dword [0x4d8fac]
cmp eax, ebx
je 0x454644
cmp dword [0x4d8fb0], ebx
je 0x454644
push eax
call fcn.0044a899
push dword [0x4d8fb0]
mov esi, eax
call fcn.0044a899
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x454644
test edi, edi
je 0x454644
call esi
test eax, eax
je 0x45463b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x45463b
test byte [ebp - 0xc], 1
jne 0x454644
or dword [ebp + 0x10], 0x200000
jmp 0x45467d
mov eax, dword [0x4d8fa4]
cmp eax, ebx
je 0x45467d
push eax
call fcn.0044a899
pop ecx
test eax, eax
je 0x45467d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x45467d
mov eax, dword [0x4d8fa8]
cmp eax, ebx
je 0x45467d
push eax
call fcn.0044a899
pop ecx
test eax, eax
je 0x45467d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4d8fa0]
call fcn.0044a899
pop ecx
test eax, eax
je 0x45469d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x45469f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret