joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45a940
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x68ea48
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x748068]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
mov esi, dword [ebp + 8]
mov ecx, esi
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x3c]
push eax
push 2
push 0xffffffffffffffff
push 0xffff8000
movlpd qword [ebp - 0x3c], xmm0
call fcn.00455da0
test al, al
jne 0x45a9a0
mov eax, 1
jmp 0x45ab1d
push 0x10000
call fcn.0064ff25
mov ebx, eax
mov dword [ebp - 0x18], 0
add esp, 4
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], 0
push 0x10000
push 0
push ebx
call fcn.00652810
mov eax, dword [esi]
add esp, 0xc
mov dword [ebp - 0x1c], 0
test eax, eax
je 0x45aaf6
test ebx, ebx
je 0x45aaf6
cmp dword [eax], 0xffffffff
je 0x45aaf6
push 0
lea ecx, [ebp - 0x1c]
push ecx
push 0x8000
push ebx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x45aaf6
mov esi, dword [ebp - 0x20]
mov ecx, 0x8000
xor ebx, ebx
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], ecx
add esi, ecx
nop word [eax + eax]
cmp byte [edi + 0x9c], 0
jne 0x45aaec
lea edx, [ebp - 0x30]
mov dword [ebp - 0x30], 0
push edx
lea edx, [ebp - 0x24]
mov dword [ebp - 0x24], 0
push edx
push ecx
mov ecx, dword [ebp - 0x34]
lea eax, [esi + ebx]
push eax
call fcn.00475b40
test al, al
je 0x45aadf
mov eax, dword [ebp - 0x24]
test eax, eax
jne 0x45aa92
mov eax, dword [edi + 0xc0]
test eax, eax
je 0x45aa81
push 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [edi + 0x9c], 0
jne 0x45aaec
inc dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
jmp 0x45aa9c
add ebx, eax
cmp ebx, 0x8000
je 0x45aaac
cmp dword [ebp - 0x28], 0xf
ja 0x45aad5
mov ecx, dword [ebp - 0x2c]
sub ecx, eax
mov dword [ebp - 0x2c], ecx
jne 0x45aa30
mov ebx, dword [ebp - 0x20]
mov edx, 0x7ffc
mov ecx, ebx
mov eax, dword [ecx]
cmp eax, dword [esi]
jne 0x45aace
add ecx, 4
add esi, 4
sub edx, 4
jae 0x45aab6
mov esi, 4
jmp 0x45ab07
mov esi, 5
jmp 0x45ab07
mov ebx, dword [ebp - 0x20]
mov esi, 3
jmp 0x45ab07
mov eax, dword [ebp - 0x30]
mov esi, 3
mov ebx, dword [ebp - 0x20]
jmp 0x45ab01
mov ebx, dword [ebp - 0x20]
mov esi, 2
jmp 0x45ab07
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 1
mov dword [edi + 0xb0], eax
mov dword [ebp - 4], 0xffffffff
test ebx, ebx
je 0x45ab1b
push ebx
call fcn.00650374
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0064fb08
mov esp, ebp
pop ebp
ret 0xc
Function at 0x45ab40
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x68ea88
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x748068]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x30]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
lea eax, [edi + 0x10]
push eax
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x40], 0
call fcn.00406ff0
mov dword [ebp - 4], 0
xor esi, esi
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x18], esi
mov byte [ebp - 4], 1
push 0x6cd31c
lea ecx, [ebp - 0x58]
mov dword [edi + 0xb4], 0
call fcn.0040ca70
mov byte [ebp - 4], 2
lea eax, [edi + 0x40]
push ecx
mov ecx, dword [ebp - 0x3c]
push eax
lea eax, [edi + 0x58]
push eax
lea eax, [ebp - 0x58]
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 0x30]
push dword [ebp + 0x10]
push eax
push dword [ebx + 4]
call fcn.00474800
mov bl, al
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x58]
call fcn.00405da0
test bl, bl
jne 0x45ac03
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0xb0], eax
jmp 0x45acbe
mov ebx, dword [ebp - 0x3c]
lea eax, [ebp - 0x14]
push ecx
push eax
push 0x13
mov ecx, ebx
mov dword [ebp - 0x14], 0
call fcn.0045e080
test al, al
jne 0x45ac30
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0xb0], eax
jmp 0x45acbe
mov eax, dword [ebp - 0x14]
mov dword [edi + 0xb4], eax
cmp eax, 0xc8
je 0x45acab
cmp eax, 0xce
je 0x45acab
cmp eax, 0x12e
jne 0x45acdf
mov ecx, 0x400
mov dword [ebp - 0x34], ecx
test esi, esi
jne 0x45ac73
push 0x800
call fcn.0064ff25
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
mov ecx, dword [ebp - 0x34]
add ecx, ecx
push ecx
push 0
push esi
call fcn.00652810
add esp, 8
lea eax, [ebp - 0x34]
mov ecx, ebx
push eax
push esi
push 0x21
call fcn.0045e0f0
test al, al
je 0x45acdf
push esi
call fcn.004060d0
add esp, 4
lea ecx, [ebp - 0x30]
push eax
push esi
call fcn.00405ec0
mov ebx, dword [ebp - 0x38]
jmp 0x45accf
cmp dword [ebp + 0x14], 0
ja 0x45acb7
cmp dword [ebp + 0x10], 0
jbe 0x45ace3
cmp eax, 0xce
je 0x45ace3
mov ebx, dword [ebp - 0x38]
cmp dword [ebx + 4], 0
je 0x45acdf
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp eax, 3
jb 0x45aba3
xor bl, bl
jmp 0x45acef
mov dword [edi + 0xb0], 0
mov bl, 1
mov byte [ebp - 4], 0
test esi, esi
je 0x45ad00
push esi
call fcn.00650374
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00405ce0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064fb08
mov esp, ebp
pop ebp
ret 0x10
Function at 0x45fbe0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x68f449
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x748068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov ebx, ecx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
call fcn.00405df0
mov dword [ebp - 4], 0
xor esi, esi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], 1
test eax, eax
je 0x45fd92
nop dword [eax]
dec eax
mov dword [ebp + 8], eax
mov al, byte [edi]
inc edi
mov byte [ebp + esi - 0x14], al
inc esi
mov ch, byte [ebp - 0x12]
mov dl, byte [ebp - 0x13]
mov cl, byte [ebp - 0x14]
mov dword [ebp - 0x20], edi
mov byte [ebp - 0xf], ch
mov byte [ebp - 0xd], dl
mov byte [ebp - 0xe], cl
cmp esi, 3
jne 0x45fcd4
mov al, cl
xor edi, edi
shr al, 2
and cl, 3
mov byte [ebp - 0x18], al
mov al, dl
shl cl, 4
shr al, 4
add cl, al
mov al, ch
mov byte [ebp - 0x17], cl
mov cl, dl
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
mov al, ch
mov byte [ebp - 0x16], cl
and al, 0x3f
mov ecx, 0x752774
mov byte [ebp - 0x15], al
call fcn.00405e20
mov esi, eax
cmp dword [esi + 0x14], 0x10
mov ecx, esi
jb 0x45fcaf
mov ecx, dword [esi]
movzx eax, byte [ebp + edi - 0x18]
movzx eax, byte [eax + ecx]
mov ecx, ebx
push eax
call fcn.0042a7c0
inc edi
cmp edi, 4
jl 0x45fca5
mov edi, dword [ebp - 0x20]
xor esi, esi
mov dl, byte [ebp - 0xd]
mov cl, byte [ebp - 0xe]
mov ch, byte [ebp - 0xf]
mov eax, dword [ebp + 8]
test eax, eax
jne 0x45fc40
mov dword [ebp + 8], esi
test esi, esi
je 0x45fd92
mov eax, esi
cmp esi, 3
jge 0x45fd0e
cmp eax, 3
jae 0x45fda6
mov byte [ebp + eax - 0x14], 0
inc eax
cmp eax, 3
jl 0x45fcf4
mov ch, byte [ebp - 0x12]
mov dl, byte [ebp - 0x13]
mov cl, byte [ebp - 0x14]
mov al, cl
xor edi, edi
shr al, 2
and cl, 3
mov byte [ebp - 0x18], al
mov al, dl
shr al, 4
and dl, 0xf
shl cl, 4
add cl, al
shl dl, 2
mov al, ch
mov byte [ebp - 0x17], cl
shr al, 6
and ch, 0x3f
add dl, al
mov byte [ebp - 0x15], ch
lea eax, [esi + 1]
mov byte [ebp - 0x16], dl
mov dword [ebp - 0x20], eax
test eax, eax
jle 0x45fd78
mov ecx, 0x752774
call fcn.00405e20
mov esi, eax
cmp dword [esi + 0x14], 0x10
mov ecx, esi
jb 0x45fd5e
mov ecx, dword [esi]
movzx eax, byte [ebp + edi - 0x18]
movzx eax, byte [eax + ecx]
mov ecx, ebx
push eax
call fcn.0042a7c0
inc edi
cmp edi, dword [ebp - 0x20]
jl 0x45fd54
mov esi, dword [ebp + 8]
cmp esi, 3
jge 0x45fd92
mov edi, 3
sub edi, esi
push 0x3d
mov ecx, ebx
call fcn.0042a7c0
sub edi, 1
jne 0x45fd84
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0065029a
int3
Function at 0x464600
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x69010f
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x748068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 4
lea ecx, [esi + 0x7c]
call fcn.00405ce0
mov byte [ebp - 4], 3
lea ecx, [esi + 0x64]
call fcn.00405ce0
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.00405ce0
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.00405ce0
mov byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.00405ce0
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00405ce0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x465900
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6902af
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x748068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push esi
call fcn.00415050
mov dword [ebp - 4], 0
lea eax, [esi + 0x18]
push eax
lea ecx, [edi + 0x18]
call fcn.00415050
mov byte [ebp - 4], 1
lea eax, [esi + 0x30]
push eax
lea ecx, [edi + 0x30]
call fcn.00415050
mov byte [ebp - 4], 2
lea eax, [esi + 0x48]
push eax
lea ecx, [edi + 0x48]
call fcn.00415050
mov byte [ebp - 4], 3
lea ecx, [edi + 0x64]
mov al, byte [esi + 0x60]
mov byte [edi + 0x60], al
lea eax, [esi + 0x64]
push eax
call fcn.00415050
mov byte [ebp - 4], 4
lea eax, [esi + 0x7c]
push eax
lea ecx, [edi + 0x7c]
call fcn.00415050
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x466ac0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x69048f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x748068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push esi
call fcn.00406ff0
mov dword [ebp - 4], 0
lea eax, [esi + 0x18]
push eax
lea ecx, [edi + 0x18]
call fcn.00406ff0
mov byte [ebp - 4], 1
lea eax, [esi + 0x30]
push eax
lea ecx, [edi + 0x30]
call fcn.00406ff0
mov byte [ebp - 4], 2
lea eax, [esi + 0x48]
push eax
lea ecx, [edi + 0x48]
call fcn.00406ff0
mov byte [ebp - 4], 3
lea ecx, [edi + 0x64]
mov al, byte [esi + 0x60]
mov byte [edi + 0x60], al
lea eax, [esi + 0x64]
push eax
call fcn.00406ff0
mov byte [ebp - 4], 4
lea eax, [esi + 0x7c]
push eax
lea ecx, [edi + 0x7c]
call fcn.00406ff0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x469270
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6909d0
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x748068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebx], vtable.RC::IMiniDownloadEvent.0
mov dword [ebp - 4], 0
mov dword [ebx], vtable.RC::RCWebOnlineDataDownload.0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
mov byte [ebp - 4], 1
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0
mov byte [ebp - 4], 2
lea esi, [ebx + 0x24]
push 0
mov dword [ebp - 0x14], esi
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0046c6f0
mov dword [esi], eax
mov byte [ebp - 4], 5
push 0x18
call fcn.0064fb19
add esp, 4
mov dword [ebx + 0x2c], eax
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [ebp - 4], 6
lea edi, [ebx + 0x30]
mov dword [ebp - 0x14], edi
lea ecx, [edi + 8]
mov dword [edi], 0
mov byte [edi + 4], 0
call fcn.00405d80
mov byte [ebp - 4], 8
lea esi, [ebx + 0x50]
mov dword [ebp - 0x14], esi
lea ecx, [esi + 8]
mov dword [esi], 0
mov byte [esi + 4], 0
call fcn.00405d80
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x2c]
push 0x6cbab0
mov byte [ebx + 0x70], 1
mov byte [ebx + 0x71], 1
call fcn.00405d30
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x2c]
push 0
push 1
push eax
mov ecx, esi
call fcn.00438800
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x2c]
call fcn.00405ce0
push 0x6cbab0
lea ecx, [ebp - 0x44]
call fcn.00405d30
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x44]
push 0
push 0
push eax
mov ecx, edi
call fcn.00438800
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x44]
call fcn.00405ce0
mov dword [ebp - 4], 0xffffffff
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46fbc0
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x174
mov eax, dword [0x748068]
xor eax, esp
mov dword [esp + 0x170], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x18]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x10]
push 0x118
mov dword [esp + 0x14], eax
lea eax, [esp + 0x60]
push 0
push eax
mov dword [esp + 0x64], 0x11c
call fcn.00652810
add esp, 0xc
lea ecx, [esp + 0x58]
call fcn.004361b0
test al, al
je 0x46fc72
push dword [esp + 0x60]
push dword [esp + 0x60]
push 0x6dfd44
push ebx
call fcn.004304b0
call fcn.00436120
test al, al
mov edx, 0x40
mov ecx, 0x20
cmovne ecx, edx
push ecx
push 0x6ceeb4
push dword [esp + 0x28]
call fcn.004304b0
lea eax, [esp + 0x88]
push eax
call fcn.004060d0
mov ecx, dword [esp + 0x34]
add esp, 0x20
push eax
lea eax, [esp + 0x70]
push eax
call fcn.00405ec0
push 0x40
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.00652810
add esp, 0xc
mov dword [esp + 0x18], 0x40
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
shrd ecx, eax, 0x14
shr eax, 0x14
push eax
push ecx
push 0x6ceeb4
push edi
call fcn.004304b0
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetACP]
push eax
push 0x6ceeb4
push esi
call fcn.004304b0
mov ecx, dword [esp + 0x188]
add esp, 0xc
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0064fb08
mov esp, ebp
pop ebp
ret 0x14
Function at 0x472c90
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x692858
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x748068]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 0x10]
mov ecx, edi
mov esi, dword [ebp + 0xc]
call fcn.00405c90
test al, al
jne 0x472cea
cmp byte [ebp + 8], al
jne 0x472cf1
mov eax, dword [ebx]
test eax, eax
je 0x472e4f
cmp byte [eax + 0xa5], 0
je 0x472e4f
xor al, al
jmp 0x472e63
mov ecx, esi
call fcn.00405c90
test al, al
jne 0x472e4f
mov ecx, esi
call fcn.00436900
test al, al
je 0x472d17
push esi
push edi
call fcn.004728c0
jmp 0x472e4b
push 0xb
mov ecx, esi
call fcn.00405ca0
push eax
mov ecx, edi
call fcn.00405ca0
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push eax
call ebx
test eax, eax
je 0x472d3c
mov al, 1
jmp 0x472e4b
lea ecx, [ebp - 0x58]
mov byte [ebp - 0x59], 0
call fcn.00405d80
mov dword [ebp - 4], 0
lea edx, [ebp - 0x58]
mov ecx, edi
call fcn.00456680
movzx ecx, byte [ebp - 0x59]
test al, al
mov edx, 1
cmovne ecx, edx
mov dword [ebp - 0x60], ecx
lea ecx, [ebp - 0x40]
call fcn.00405d80
mov byte [ebp - 4], 1
lea edx, [ebp - 0x40]
mov ecx, esi
call fcn.00456680
test al, al
jne 0x472d89
cmp byte [ebp - 0x60], al
je 0x472dc5
push 0xb
lea ecx, [ebp - 0x40]
call fcn.00405ca0
push eax
lea ecx, [ebp - 0x58]
call fcn.00405ca0
push eax
call ebx
test eax, eax
je 0x472dc5
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00405ce0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.00405ce0
mov al, 1
jmp 0x472e4b
mov ecx, esi
call fcn.00455fd0
cmp eax, 0xffffffff
je 0x472e2e
push esi
lea ecx, [ebp - 0x28]
call fcn.00406ff0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.00456440
test al, al
je 0x472e22
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.00456070
test al, al
je 0x472e22
mov edx, esi
mov ecx, edi
call fcn.00456070
lea ecx, [ebp - 0x28]
test al, al
je 0x472e1b
call fcn.00456230
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.00405ce0
jmp 0x472da3
mov edx, esi
call fcn.00456070
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.00405ce0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00405ce0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.00405ce0
xor al, al
test al, al
jne 0x472e61
mov ecx, edi
call fcn.00436900
test al, al
je 0x472e61
mov ecx, edi
call fcn.00456230
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064fb08
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4779e0
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x748068]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [ecx]
push esi
push edi
mov edi, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x477a45
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x477a20
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x477a45
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, esi
mov dword [edi], ecx
adc eax, 0
mov dword [edi + 4], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0064fb08
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.0064fb08
add esp, 8
ret 4
Function at 0x4798c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6936a8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x748068]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0
mov dword [esi + 0x10], eax
call fcn.00660a50
mov ecx, dword [esi]
add esp, 4
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
test ecx, ecx
je 0x47999a
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x1c], edx
call fcn.004625c0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x38]
call fcn.00405c90
test al, al
jne 0x47998b
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
lea ecx, [ebp - 0x38]
call fcn.00405ca0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x47998b
test esi, esi
je 0x47998b
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push 8
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.00405ce0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064fb08
mov esp, ebp
pop ebp
ret 4
Function at 0x482960
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x689b78
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x748068]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
push ecx
lea ecx, [ebp - 0x28]
call fcn.00406ff0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00430240
lea ecx, [ebp - 0x28]
call fcn.00405eb0
lea ecx, [ebp - 0x28]
cmp eax, 2
jbe 0x482a89
call fcn.00405e20
mov esi, eax
mov ecx, esi
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x4829cc
mov ecx, dword [esi]
cmp word [ecx], 0x5c
jne 0x4829e6
mov ecx, esi
cmp eax, 8
jb 0x4829db
mov ecx, dword [esi]
cmp word [ecx + 2], 0x5c
je 0x482b04
mov ecx, esi
cmp eax, 8
jb 0x4829ef
mov ecx, dword [esi]
cmp word [ecx], 0x2f
jne 0x482a05
mov ecx, esi
cmp eax, 8
jb 0x4829fe
mov ecx, dword [esi]
cmp word [ecx + 2], 0x2f
je 0x482a5a
push 0x5c
mov edx, 0x2f
lea ecx, [ebp - 0x28]
call fcn.00430040
mov eax, dword [esi + 0x14]
add esp, 4
mov ecx, esi
cmp eax, 8
jb 0x482a23
mov ecx, dword [esi]
cmp word [ecx + 2], 0x3a
jne 0x482a5a
mov ecx, esi
cmp eax, 8
jb 0x482a33
mov ecx, dword [esi]
cmp word [ecx + 4], 0x5c
jne 0x482a5a
mov ecx, esi
cmp eax, 8
jb 0x482a43
mov ecx, dword [esi]
cmp word [ecx], 0x61
jb 0x482a5a
cmp eax, 8
jb 0x482a50
mov esi, dword [esi]
cmp word [esi], 0x7a
jbe 0x482ae5
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00405ce0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064fb08
mov esp, ebp
pop ebp
ret
call fcn.00405eb0
cmp eax, 2
jne 0x482a5a
lea ecx, [ebp - 0x28]
call fcn.00405e20
mov edx, eax
mov ecx, dword [eax + 0x14]
cmp ecx, 8
jb 0x482aa7
mov edx, dword [eax]
cmp word [edx + 2], 0x3a
jne 0x482a5a
mov edx, eax
cmp ecx, 8
jb 0x482ab7
mov edx, dword [eax]
cmp word [edx], 0x61
jb 0x482a5a
cmp ecx, 8
jb 0x482ac4
mov eax, dword [eax]
cmp word [eax], 0x7a
ja 0x482a5a
push 0x6ccbc0
call fcn.004060d0
add esp, 4
lea ecx, [ebp - 0x28]
push eax
push 0x6ccbc0
call fcn.0040cab0
lea ecx, [ebp - 0x28]
call fcn.00405ca0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x482a5a
shr eax, 4
and al, 1
mov byte [edi], al
mov bl, 1
jmp 0x482a5c
Function at 0x483990
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x694e3b
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x748068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 0
push 0
mov dword [ebp - 0x14], edi
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.00462990
mov dword [edi], eax
mov dword [ebp - 4], 2
lea esi, [edi + 8]
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0044bc10
mov dword [esi], eax
mov byte [ebp - 4], 5
lea esi, [edi + 0x10]
push 0
mov dword [ebp - 0x14], esi
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00486f70
mov dword [esi], eax
mov byte [ebp - 4], 8
lea esi, [edi + 0x18]
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0044bc10
mov dword [esi], eax
mov byte [ebp - 4], 0xb
lea esi, [edi + 0x20]
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00486ed0
mov dword [esi], eax
mov byte [ebp - 4], 0xe
lea esi, [edi + 0x28]
push 0
mov dword [ebp - 0x14], esi
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00486e30
mov dword [esi], eax
mov byte [ebp - 4], 0x11
lea esi, [edi + 0x30]
push 0
mov dword [ebp - 0x14], esi
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00486e30
mov dword [esi], eax
mov byte [ebp - 4], 0x14
lea esi, [edi + 0x38]
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
push 0
push 0
call fcn.00486e30
mov dword [esi], eax
mov byte [ebp - 4], 0x17
lea ecx, [edi + 0x40]
call fcn.0041ba40
mov byte [ebp - 4], 0x18
lea ecx, [edi + 0x78]
call fcn.00405d80
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret