joyce8/EMBER2024-capa huggingface dataset:
Function at 0x447fa0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x270
mov eax, dword [0x58a014]
xor eax, ebp
mov dword [esp + 0x268], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x220]
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea ebx, [esp + 0x18]
push 0x3c3
push str....._base_files_file_util_win.cc
push 0x575f56
push ebx
call fcn.00495240
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.0049ca20
lea esi, [esp + 0x1a]
push 0x206
push 0xff
push esi
call fcn.004bd870
add esp, 0xc
mov word [esi - 2], 0
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
add esi, 0xfffffefb
cmp esi, 0xfffffefc
jb 0x448071
push ebx
call fcn.004d43b4
add esp, 4
mov edi, esp
mov ecx, edi
push eax
push ebx
call fcn.00494380
lea ebx, [esp + 0xc]
mov ecx, edi
push ebx
call fcn.0043e4e0
mov ecx, dword [ebp + 8]
push ebx
call fcn.0043d6e0
mov ecx, ebx
call fcn.004944b0
mov ecx, edi
call fcn.004944b0
cmp esi, 0xfffffefc
setae bl
lea ecx, [esp + 0x220]
call fcn.0049caa0
mov ecx, dword [esp + 0x268]
xor ecx, ebp
call fcn.004babe3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4480a0
Capabilities:
Check if file exists
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4f8
mov ebx, edx
mov edi, ecx
mov eax, dword [0x58a014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x2a4]
push 0x294
push 0xff
push esi
call fcn.004bd870
add esp, 0xc
mov ecx, esi
mov dword [ebp - 0x504], ebx
push ebx
push 3
push 0
push edi
call fcn.004544c0
xor eax, eax
dec eax
lea edi, [ebp - 0x500]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov ecx, esi
push edi
call fcn.00454680
movzx eax, byte [edi + 0xb]
test al, al
jns 0x44810f
mov eax, dword [ebp - 0x4fc]
jmp 0x448112
and eax, 0x7f
xor esi, esi
test eax, eax
jne 0x448145
lea ecx, [ebp - 0x500]
call fcn.004944b0
lea ecx, [ebp - 0x2a4]
call fcn.004545d0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004babe3
mov eax, esi
add esp, 0x4f8
pop esi
pop edi
pop ebx
pop ebp
ret
xor ebx, ebx
push 0x250
push 0xff
lea esi, [ebp - 0x4f4]
push esi
call fcn.004bd870
add esp, 0xc
lea ecx, [ebp - 0x2a4]
push esi
call fcn.00454640
mov eax, dword [ebp - 0x4f4]
test al, 1
jne 0x448252
mov ecx, esi
call fcn.004544b0
test al, al
jne 0x44820f
cmp byte [ebp - 0x4f5], 0
mov eax, edi
jns 0x44819a
mov eax, dword [ebp - 0x500]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x44828e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
and ecx, 0xfffffffe
xor esi, esi
cmp ecx, 2
je 0x4481bd
mov esi, eax
test ebx, ebx
cmovne esi, ebx
lea ebx, [ebp - 0x4f4]
mov ecx, ebx
call fcn.0042a720
lea ecx, [ebp - 0x2a4]
push ebx
call fcn.00454680
mov ecx, edi
push ebx
call fcn.0043d6e0
mov ecx, ebx
call fcn.004944b0
movzx eax, byte [ebp - 0x4f5]
test al, al
jns 0x4481fd
mov eax, dword [ebp - 0x4fc]
jmp 0x448200
and eax, 0x7f
mov ebx, esi
test eax, eax
je 0x448118
jmp 0x448147
xor esi, esi
cmp byte [ebp + 8], 0
je 0x4481bd
mov ecx, edi
mov edx, dword [ebp - 0x504]
push 1
call fcn.004480a0
add esp, 4
test eax, eax
jne 0x4481bb
cmp byte [ebp - 0x4f5], 0
mov eax, edi
jns 0x44823e
mov eax, dword [ebp - 0x500]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x4481bd
jmp 0x4481a9
cmp byte [ebp + 8], 0
je 0x44826c
and eax, 0xfffffffe
cmp byte [ebp - 0x4f5], 0
jns 0x448295
mov ecx, dword [ebp - 0x500]
jmp 0x44829b
lea ecx, [ebp - 0x4f4]
call fcn.004544b0
test al, al
je 0x4482ae
lea ecx, [ebp - 0x4f4]
call fcn.004544b0
test al, al
je 0x448189
xor esi, esi
jmp 0x4481bd
lea ecx, [ebp - 0x500]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea esi, [ebp - 0x4f4]
jmp 0x44817a
mov eax, dword [ebp - 0x4f4]
jmp 0x448258
Function at 0x448300
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov esi, ecx
mov eax, dword [0x58a014]
xor eax, ebp
mov dword [esp + 0x68], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x20]
movdqa xmmword [edi + 0x30], xmm0
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea ebx, [esp + 0x10]
push 0x93
push str....._base_files_file_win.cc
push str.WriteAtCurrentPos
push ebx
call fcn.00495240
add esp, 0x10
mov ecx, edi
push 0
push ebx
call fcn.0049ca20
cmp dword [ebp + 0xc], 0
js 0x4483c7
mov edi, dword [ebp + 8]
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x10], 0
call fcn.004a2ba0
test al, al
jne 0x4483cc
lea ebx, [esp + 0xc]
mov dword [ebx], 0xffffffff
push 0
push ebx
push dword [ebp + 0xc]
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor esi, esi
cmp eax, 1
sbb esi, esi
or esi, dword [ebx]
lea ecx, [esp + 0x10]
call fcn.004a2c40
lea ecx, [esp + 0x20]
call fcn.0049caa0
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.004babe3
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
xor esi, esi
dec esi
jmp 0x4483a7
lea ecx, [esp + 0x10]
push 0
push dword [ebp + 0xc]
push esi
push str.File::WriteAtCurrentPos
call fcn.0050b9e0
jmp 0x44837c

Function at 0x4483f0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov dword [esp + 4], ecx
mov eax, dword [0x58a014]
xor eax, ebp
mov dword [esp + 0x68], eax
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x20]
movdqa xmmword [ebx + 0x30], xmm0
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea edi, [esp + 0x10]
push 0xa8
push str....._base_files_file_win.cc
push str.GetLength
push edi
call fcn.00495240
add esp, 0x10
xor esi, esi
mov ecx, ebx
push esi
push edi
call fcn.0049ca20
mov dword [edi + 4], 0xffffffff
mov dword [edi], esi
call fcn.004a2ba0
test al, al
jne 0x4484ad
xor eax, eax
dec eax
lea ebx, [esp + 8]
mov dword [ebx + 4], eax
mov dword [ebx], eax
push ebx
mov eax, dword [esp + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp eax, 1
sbb esi, esi
mov edi, dword [ebx + 4]
or edi, esi
or esi, dword [ebx]
lea ecx, [esp + 0x10]
call fcn.004a2c40
lea ecx, [esp + 0x20]
call fcn.0049caa0
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.004babe3
mov eax, esi
mov edx, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea ecx, [esp + 0x10]
push esi
push esi
push dword [esp + 0xc]
push str.File::GetLength
call fcn.0050b9e0
jmp 0x44845f
Function at 0x4484d0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x90
mov dword [esp + 0xc], ecx
mov eax, dword [0x58a014]
xor eax, ebp
mov dword [esp + 0x88], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x40]
movdqa xmmword [edi + 0x30], xmm0
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea esi, [esp + 0x30]
push 0xb5
push str....._base_files_file_win.cc
push str.SetLength
push esi
call fcn.00495240
add esp, 0x10
xor ebx, ebx
mov ecx, edi
push ebx
push esi
call fcn.0049ca20
mov dword [esi + 4], 0xffffffff
mov dword [esi], ebx
call fcn.004a2ba0
test al, al
jne 0x448632
xor eax, eax
dec eax
lea ecx, [esp + 0x28]
mov dword [ecx + 4], eax
mov dword [ecx], eax
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ebx
mov esi, dword [esp + 0xc]
mov eax, dword [esi]
sub esp, 0x14
movsd xmm0, qword [esp + 0x34]
movsd qword [esp + 4], xmm0
mov dword [esp + 0xc], ecx
mov dword [esp], eax
mov dword [esp + 0x10], 1
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x448606
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x1c], eax
mov eax, dword [esi]
sub esp, 0x14
movsd xmm0, qword [esp + 0x2c]
movsd qword [esp + 4], xmm0
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x448606
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor ebx, ebx
test eax, eax
je 0x448606
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
mov eax, dword [esi]
sub esp, 0x14
movsd xmm0, qword [esp + 0x24]
movsd qword [esp + 4], xmm0
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
setne bl
lea ecx, [esp + 0x30]
call fcn.004a2c40
lea ecx, [esp + 0x40]
call fcn.0049caa0
mov ecx, dword [esp + 0x88]
xor ecx, ebp
call fcn.004babe3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
lea ecx, [esp + 0x30]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esp + 0x14]
push str.File::SetLength
call fcn.0050b9e0
jmp 0x448549
Function at 0x4489b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov dword [esp + 8], ecx
mov ebx, dword [ebp + 0xc]
mov eax, dword [0x58a014]
xor eax, ebp
mov dword [esp + 0x68], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x20]
movdqa xmmword [edi + 0x30], xmm0
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea esi, [esp + 0x10]
push 0x16f
push str....._base_files_file_win.cc
push str.DoInitialize
push esi
call fcn.00495240
add esp, 0x10
mov ecx, edi
push 0
push esi
call fcn.0049ca20
mov eax, ebx
and eax, 1
neg eax
and eax, 3
xor ecx, ecx
inc ecx
test bl, 2
cmove ecx, eax
test bl, 4
mov edx, 4
cmovne ecx, edx
test bl, 8
mov esi, 2
cmove esi, ecx
test bl, 0x10
mov eax, 5
cmove eax, esi
test eax, eax
je 0x448bb7
mov ecx, ebx
and ecx, 0x40
shl ecx, 0x18
test bl, 0x80
cmove edx, ecx
mov ecx, ebx
rol ecx, 0x1a
mov esi, ebx
shl esi, 0xb
and esi, 0x20000000
mov edi, ebx
shr edi, 4
and edi, 0x10000
and ecx, 0x80000100
or ecx, esi
or ecx, edi
or ecx, edx
mov esi, ebx
shr esi, 8
and esi, 3
mov edx, ebx
shr edx, 0xd
and edx, 4
or edx, esi
and ebx, 0x400
mov dword [esp + 0xc], ebx
shl ebx, 0x14
mov esi, dword [ebp + 0xc]
shr esi, 3
and esi, 0x100
or esi, ebx
mov ebx, dword [ebp + 0xc]
mov edi, ebx
shr edi, 0xb
and edi, 2
or edi, esi
mov esi, ebx
shl esi, 0xd
and esi, 0x4000000
or esi, edi
mov edi, ebx
shl edi, 8
and edi, 0xa000000
or edi, esi
mov esi, dword [ebp + 8]
xor edx, 3
cmp byte [esi + 0xb], 0
jns 0x448ae2
mov esi, dword [esi]
xor ebx, ebx
push ebx
push edi
push eax
push ebx
push edx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov esi, dword [esp + 8]
cmp dword [esi], eax
je 0x448b6f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
inc ecx
cmp ecx, 2
jae 0x448b99
mov ecx, edi
inc ecx
cmp ecx, 2
mov ebx, dword [ebp + 0xc]
jb 0x448b23
mov dword [esi], edi
mov edi, eax
call fcn.00495270
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [esi]
inc edi
cmp edi, 2
jb 0x448b74
mov eax, dword [esp + 0xc]
shr eax, 0xa
mov dword [esi + 0x14], 0
mov byte [esi + 0x19], al
test bl, 4
jne 0x448b88
test bl, 0xa
je 0x448b51
mov byte [esi + 0x18], 1
lea ecx, [esp + 0x20]
call fcn.0049caa0
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.004babe3
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov ebx, dword [ebp + 0xc]
jmp 0x448b2c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00448880
add esp, 4
mov dword [esi + 0x14], eax
jmp 0x448b51
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
setne byte [esi + 0x18]
jmp 0x448b51
mov ebx, eax
call fcn.00495270
push dword [esi]
call fcn.0049e730
mov eax, ebx
add esp, 4
mov dword [esi], 0
jmp 0x448b0d
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 8]
mov dword [eax + 0x14], 0xffffffff
jmp 0x448b51
Function at 0x448bd0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 8]
cmp dword [ecx], ebx
je 0x448c05
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x448c0c
lea eax, [ebx + 1]
cmp eax, 2
jb 0x448bfe
mov dword [esi], ebx
call fcn.00495270
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.00495270
push dword [esi]
call fcn.0049e730
add esp, 4
mov dword [esi], 0
jmp 0x448bef
Function at 0x448f50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, edx
mov ebx, ecx
mov eax, dword [0x58a014]
xor eax, ebp
mov dword [ebp - 0x10], eax
test ecx, ecx
jne 0x448f87
mov eax, dword [0x58bb60]
cmp eax, 0xffffffff
je 0x449014
mov ebx, 0x100000
test eax, eax
jne 0x448f87
mov ebx, 0x80000
push 0x10
call fcn.004ba1be
add esp, 4
mov esi, eax
mov eax, edi
shr eax, 0xe
mov ecx, edi
shr ecx, 0x13
mov ecx, dword [ecx*4 + 0x592d68]
bt ecx, eax
jb 0x449009
mov eax, edi
shr eax, 0x15
mov byte [eax + 0x59ad68], 1
mov dword [esi], edi
mov edi, dword [ebp + 8]
test edi, edi
setne byte [esi + 4]
mov eax, dword [ebp + 0xc]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0xc], eax
xor eax, eax
push eax
push 0x10000
push esi
push 0x4493f0
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x449038
test edi, edi
je 0x449096
mov dword [edi], eax
test eax, eax
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004babe3
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
push edi
call fcn.00496420
add esp, 4
jmp 0x448fb5
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x58bb60
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x44910a
mov eax, dword [0x58bb60]
jmp 0x448f79
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
je 0x449054
mov edi, eax
cmp eax, 0x5af
je 0x449054
cmp edi, 0xe
jne 0x4490a6
push ebx
call fcn.0050dd80
add esp, 4
test esi, esi
mov eax, dword [ebp - 0x20]
je 0x448ff0
mov eax, dword [esi]
mov ecx, eax
shr ecx, 0xe
mov edx, eax
shr edx, 0x13
mov edx, dword [edx*4 + 0x592d68]
bt edx, ecx
jae 0x449085
push eax
call fcn.00496540
add esp, 4
push esi
call fcn.004ba1ee
add esp, 4
mov eax, dword [ebp - 0x20]
jmp 0x448ff0
push eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x448ff0
mov eax, dword [0x590acc]
mov ecx, dword [0x58e4fc]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x449119
lea ebx, [ebp - 0x1c]
push edi
push ebx
call fcn.00443960
add esp, 8
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x4490e0
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
jmp 0x4490e3
and eax, 0x7f
push eax
push ebx
push dword [0x590ac8]
call fcn.004a3bc0
add esp, 0xc
cmp byte [ebp - 0x11], 0
jns 0x44905d
push dword [ebp - 0x1c]
call fcn.004ba1ee
jmp 0x44905a
mov dword [0x58bb60], 0
jmp 0x448f82
push 0x590acc
call fcn.004ba267
add esp, 4
cmp dword [0x590acc], 0xffffffff
jne 0x4490c3
push 0x20
push str.create_thread_last_error
call fcn.00457270
add esp, 8
mov dword [0x590ac8], eax
push 0x590acc
call fcn.004ba2dd
add esp, 4
jmp 0x4490c3
Function at 0x449630
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x58a014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, 4
lea edx, [ebp - 0x14]
mov dword [edx], eax
lea esi, [ebp - 0x18]
mov dword [esi], eax
xor eax, eax
lea edi, [ebp - 0x1c]
mov dword [edi], eax
mov ebx, dword [ebp + 8]
push esi
push edi
push edx
push eax
push ebx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4496a3
mov eax, dword [ebp - 0x14]
add eax, 0xfffffffd
mov esi, 0x3f4
cmp eax, 1
ja 0x44968d
cmp dword [ebp - 0x18], 4
jne 0x44968d
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004babe3
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov esi, eax
jmp 0x44968d

Function at 0x4496b0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x100c
call fcn.004bb510
mov esi, ecx
mov eax, dword [0x58a014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ebx, 0x800
lea edi, [ebp - 0x810]
push ebx
push 0xff
push edi
call fcn.004bd870
add esp, 0xc
lea eax, [ebp - 0x1014]
mov dword [eax], 1
lea ecx, [ebp - 0x1018]
mov dword [ecx], ebx
push ecx
push edi
push eax
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x449749
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x1014]
cmp eax, 1
jne 0x44974d
push edi
call fcn.004d43b4
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.00439700
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004babe3
mov eax, esi
add esp, 0x100c
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov esi, eax
jmp 0x449730
cmp eax, 2
jne 0x449799
lea ebx, [ebp - 0x1010]
push 0x800
push 0xff
push ebx
call fcn.004bd870
add esp, 0xc
push 0x400
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x1018], eax
add eax, 0xfffffbff
cmp eax, 0xfffffc00
jb 0x4497a0
push ebx
call fcn.004d43b4
add esp, 4
mov ecx, esi
push eax
push ebx
jmp 0x449729
mov esi, 0x3f4
jmp 0x449730
mov esi, 0xea
jmp 0x449730
Function at 0x450f60
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00450c80
Function at 0x451480
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x451498
cmp dword [ebp + 0x10], 0
jne 0x451494
call fcn.00464690
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.00450f70

Function at 0x453dd0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, ecx
mov eax, dword [0x58a014]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x10]
movdqa xmmword [edi + 0x30], xmm0
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
mov ebx, esp
push 0x1b
push str....._base_filesmemory_mapped_file_win.cc
push str.MapImageToMemory
push ebx
call fcn.00495240
add esp, 0x10
mov ecx, edi
push 0
push ebx
call fcn.0049ca20
mov ecx, esi
call fcn.004482c0
test al, al
je 0x453f55
mov ecx, esi
call fcn.004482d0
sub esp, 0x18
movdqa xmm0, xmmword [0x578ff0]
movdqu xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edi, eax
cmp dword [esi + 0x24], eax
je 0x453e93
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi + 0x24]
inc eax
cmp eax, 2
jae 0x453f39
mov eax, edi
inc eax
cmp eax, 2
jb 0x453e89
mov dword [esi + 0x24], edi
call fcn.00495270
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [esi + 0x24]
lea eax, [edi + 1]
cmp eax, 2
jb 0x453f55
sub esp, 0x14
movdqa xmm0, xmmword [0x579000]
movdqu xmmword [esp + 4], xmm0
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
mov eax, dword [esi + 0x1c]
mov ecx, eax
shr ecx, 0xe
mov edx, eax
shr edx, 0x13
mov edx, dword [edx*4 + 0x592d68]
bt edx, ecx
jb 0x453f59
mov eax, edi
shr eax, 0xe
mov ecx, edi
shr ecx, 0x13
mov ecx, dword [ecx*4 + 0x592d68]
bt ecx, eax
jb 0x453f67
mov eax, edi
shr eax, 0x15
mov byte [eax + 0x59ad68], 1
mov dword [esi + 0x1c], edi
test edi, edi
je 0x453f55
mov ecx, esp
mov dword [ecx], fcn.004fe560
mov dword [ecx + 4], edi
call fcn.00464fe0
mov eax, dword [eax + 0x50]
mov dword [esi + 0x20], eax
mov bl, 1
lea ecx, [esp + 0x10]
call fcn.0049caa0
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.004babe3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.00495270
push dword [esi + 0x24]
call fcn.0049e730
add esp, 4
mov dword [esi + 0x24], 0
jmp 0x453e79
xor ebx, ebx
jmp 0x453f19
push eax
call fcn.00496540
add esp, 4
jmp 0x453ed8
push edi
call fcn.00496420
add esp, 4
jmp 0x453efa
Function at 0x459a90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
je 0x459a96
jmp 0x459a9b
jmp 0x459397

Function at 0x45ddc0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x59f4c0]
mov ecx, dword [0x58e4fc]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x45ddf1
movzx eax, word [0x59f49c]
cmp eax, 9
jne 0x45de3c
xor eax, eax
inc eax
pop ebp
ret
push 0x59f4c0
call fcn.004ba267
add esp, 4
cmp dword [0x59f4c0], 0xffffffff
jne 0x45dde0
xorps xmm0, xmm0
movups xmmword [0x59f4ac], xmm0
movups xmmword [0x59f49c], xmm0
mov dword [0x59f4bc], 0
push 0x59f49c
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x59f4c0
call fcn.004ba2dd
add esp, 4
jmp 0x45dde0
test eax, eax
je 0x45ddef
cmp eax, 6
jne 0x45de4c
mov eax, 2
jmp 0x45ddef
cmp eax, 0xc
jne 0x45de58
mov eax, 3
jmp 0x45ddef
mov eax, 4
jmp 0x45ddef
Function at 0x467080
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 0xc]
cmp eax, 3
je 0x467097
test eax, eax
je 0x467097
pop esi
pop edi
pop ebp
ret 0xc
test eax, eax
jne 0x4670a5
mov ecx, dword [0x59f5ec]
test ecx, ecx
jne 0x4670e1
cmp dword [0x59f5e4], 0
je 0x467091
mov esi, dword [0x59f5e8]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test edi, edi
jne 0x4670eb
test esi, esi
je 0x467091
mov ecx, dword [0x59f5e4]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
jmp 0x467091
call dword [section..00cfg]
call ecx
jmp 0x4670a5
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4670c9

Function at 0x469aa0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x58a014]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
cmp eax, 3
je 0x469ad0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004babe3
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
lea eax, [ebp - 0x14]
mov dword [eax], 0x469bd0
push 0
push eax
push 0x469a80
push 0x59f618
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x469bcb
cmp dword [0x59f61c], 0
jne 0x469abc
push dword [0x59f620]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x469abc
mov esi, eax
mov eax, 0x59f624
push eax
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov edi, dword [0x59f628]
mov ebx, dword [0x59f62c]
mov eax, dword [0x59f630]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x59f634]
mov dword [ebp - 0x20], eax
mov eax, dword [0x59f638]
mov dword [ebp - 0x24], eax
mov eax, 0x59f624
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
test edi, edi
je 0x469b64
mov eax, dword [esi]
mov dword [ebp - 0x18], eax
mov ecx, edi
call dword [section..00cfg]
push dword [ebp - 0x18]
call edi
add esp, 4
test ebx, ebx
je 0x469b79
mov edi, dword [esi + 4]
mov ecx, ebx
call dword [section..00cfg]
push edi
call ebx
add esp, 4
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x469b8f
mov edi, dword [esi + 8]
call dword [section..00cfg]
push edi
call ecx
add esp, 4
mov ecx, dword [ebp - 0x20]
test ecx, ecx
mov ebx, dword [ebp - 0x24]
je 0x469ba8
mov edi, dword [esi + 0xc]
call dword [section..00cfg]
push edi
call ecx
add esp, 4
test ebx, ebx
je 0x469bbd
mov edi, dword [esi + 0x10]
mov ecx, ebx
call dword [section..00cfg]
push edi
call ebx
add esp, 4
push esi
call fcn.004ac340
add esp, 4
jmp 0x469abc
call fcn.004cc3d0
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x59f620], eax
xor ecx, ecx
cmp eax, 0xffffffff
sete cl
mov dword [0x59f61c], ecx
pop ebp
ret