joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4581c9
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
call fcn.00452bb0
mov esi, dword [esp + 0x30]
mov ebp, dword [esp + 0x3c]
mov ebx, dword [esp + 0x40]
lea edi, [esi + 1]
call fcn.004f7e70
test eax, eax
je 0x4581f1
mov dword [esp + 0x10], 0
xorps xmm0, xmm0
movlpd qword [esp + 0x18], xmm0
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebx
cmp edi, 3
ja case.default.0x4581ba
jmp dword [edi*4 + 0x4582ac]
xor esi, esi
jmp case.default.0x4581ba
push 0xfffffffffffffff6
jmp 0x4581cf
push 0xfffffffffffffff5
jmp 0x4581cf
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
push 0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
push esi
jmp 0x458283
mov dword [esp + 0x14], ebx
cmp edi, 3
ja case.default.0x4581fa
jmp dword [edi*4 + 0x4582bc]
xor eax, eax
jmp 0x458225
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x458225
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x458225
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x458225
mov eax, esi
push 0
lea ecx, [esp + 0x18]
push ecx
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x458260
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x458260
push 0
push 0
call fcn.00461550
add esp, 8
xor esi, esi
call fcn.00452bb0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
push 0
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
push esi
call fcn.00456d00
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
neg eax
sbb eax, eax
neg eax
push eax
call fcn.00461550
mov esi, dword [esp + 0x18]
add esp, 8
call fcn.00452bb0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x4581cd
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
call fcn.00452bb0
mov esi, dword [esp + 0x30]
mov ebp, dword [esp + 0x3c]
mov ebx, dword [esp + 0x40]
lea edi, [esi + 1]
call fcn.004f7e70
test eax, eax
je 0x4581f1
mov dword [esp + 0x10], 0
xorps xmm0, xmm0
movlpd qword [esp + 0x18], xmm0
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebx
cmp edi, 3
ja case.default.0x4581ba
jmp dword [edi*4 + 0x4582ac]
xor esi, esi
jmp case.default.0x4581ba
push 0xfffffffffffffff6
jmp 0x4581cf
push 0xfffffffffffffff5
jmp 0x4581cf
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
push 0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
push esi
jmp 0x458283
mov dword [esp + 0x14], ebx
cmp edi, 3
ja case.default.0x4581fa
jmp dword [edi*4 + 0x4582bc]
xor eax, eax
jmp 0x458225
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x458225
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x458225
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x458225
mov eax, esi
push 0
lea ecx, [esp + 0x18]
push ecx
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x458260
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x458260
push 0
push 0
call fcn.00461550
add esp, 8
xor esi, esi
call fcn.00452bb0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
push 0
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
push esi
call fcn.00456d00
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
neg eax
sbb eax, eax
neg eax
push eax
call fcn.00461550
mov esi, dword [esp + 0x18]
add esp, 8
call fcn.00452bb0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x458201
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
call fcn.00452bb0
mov esi, dword [esp + 0x30]
mov ebp, dword [esp + 0x3c]
mov ebx, dword [esp + 0x40]
lea edi, [esi + 1]
call fcn.004f7e70
test eax, eax
je 0x4581f1
mov dword [esp + 0x10], 0
xorps xmm0, xmm0
movlpd qword [esp + 0x18], xmm0
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebx
cmp edi, 3
ja case.default.0x4581ba
jmp dword [edi*4 + 0x4582ac]
xor esi, esi
jmp case.default.0x4581ba
push 0xfffffffffffffff6
jmp 0x4581cf
push 0xfffffffffffffff5
jmp 0x4581cf
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
push 0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
push esi
jmp 0x458283
mov dword [esp + 0x14], ebx
cmp edi, 3
ja case.default.0x4581fa
jmp dword [edi*4 + 0x4582bc]
xor eax, eax
jmp 0x458225
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x458225
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x458225
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x458225
mov eax, esi
push 0
lea ecx, [esp + 0x18]
push ecx
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x458260
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x458260
push 0
push 0
call fcn.00461550
add esp, 8
xor esi, esi
call fcn.00452bb0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
push 0
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
push esi
call fcn.00456d00
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
neg eax
sbb eax, eax
neg eax
push eax
call fcn.00461550
mov esi, dword [esp + 0x18]
add esp, 8
call fcn.00452bb0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x458205
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
call fcn.00452bb0
mov esi, dword [esp + 0x30]
mov ebp, dword [esp + 0x3c]
mov ebx, dword [esp + 0x40]
lea edi, [esi + 1]
call fcn.004f7e70
test eax, eax
je 0x4581f1
mov dword [esp + 0x10], 0
xorps xmm0, xmm0
movlpd qword [esp + 0x18], xmm0
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebx
cmp edi, 3
ja case.default.0x4581ba
jmp dword [edi*4 + 0x4582ac]
xor esi, esi
jmp case.default.0x4581ba
push 0xfffffffffffffff6
jmp 0x4581cf
push 0xfffffffffffffff5
jmp 0x4581cf
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
push 0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
push esi
jmp 0x458283
mov dword [esp + 0x14], ebx
cmp edi, 3
ja case.default.0x4581fa
jmp dword [edi*4 + 0x4582bc]
xor eax, eax
jmp 0x458225
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x458225
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x458225
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x458225
mov eax, esi
push 0
lea ecx, [esp + 0x18]
push ecx
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x458260
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x458260
push 0
push 0
call fcn.00461550
add esp, 8
xor esi, esi
call fcn.00452bb0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
push 0
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
push esi
call fcn.00456d00
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
neg eax
sbb eax, eax
neg eax
push eax
call fcn.00461550
mov esi, dword [esp + 0x18]
add esp, 8
call fcn.00452bb0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x45820f
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
call fcn.00452bb0
mov esi, dword [esp + 0x30]
mov ebp, dword [esp + 0x3c]
mov ebx, dword [esp + 0x40]
lea edi, [esi + 1]
call fcn.004f7e70
test eax, eax
je 0x4581f1
mov dword [esp + 0x10], 0
xorps xmm0, xmm0
movlpd qword [esp + 0x18], xmm0
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebx
cmp edi, 3
ja case.default.0x4581ba
jmp dword [edi*4 + 0x4582ac]
xor esi, esi
jmp case.default.0x4581ba
push 0xfffffffffffffff6
jmp 0x4581cf
push 0xfffffffffffffff5
jmp 0x4581cf
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
push 0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
push esi
jmp 0x458283
mov dword [esp + 0x14], ebx
cmp edi, 3
ja case.default.0x4581fa
jmp dword [edi*4 + 0x4582bc]
xor eax, eax
jmp 0x458225
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x458225
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x458225
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x458225
mov eax, esi
push 0
lea ecx, [esp + 0x18]
push ecx
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x458260
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x458260
push 0
push 0
call fcn.00461550
add esp, 8
xor esi, esi
call fcn.00452bb0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
push 0
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
push esi
call fcn.00456d00
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
neg eax
sbb eax, eax
neg eax
push eax
call fcn.00461550
mov esi, dword [esp + 0x18]
add esp, 8
call fcn.00452bb0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x458219
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
call fcn.00452bb0
mov esi, dword [esp + 0x30]
mov ebp, dword [esp + 0x3c]
mov ebx, dword [esp + 0x40]
lea edi, [esi + 1]
call fcn.004f7e70
test eax, eax
je 0x4581f1
mov dword [esp + 0x10], 0
xorps xmm0, xmm0
movlpd qword [esp + 0x18], xmm0
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebx
cmp edi, 3
ja case.default.0x4581ba
jmp dword [edi*4 + 0x4582ac]
xor esi, esi
jmp case.default.0x4581ba
push 0xfffffffffffffff6
jmp 0x4581cf
push 0xfffffffffffffff5
jmp 0x4581cf
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
push 0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
push esi
jmp 0x458283
mov dword [esp + 0x14], ebx
cmp edi, 3
ja case.default.0x4581fa
jmp dword [edi*4 + 0x4582bc]
xor eax, eax
jmp 0x458225
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x458225
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x458225
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x458225
mov eax, esi
push 0
lea ecx, [esp + 0x18]
push ecx
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x458260
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x458260
push 0
push 0
call fcn.00461550
add esp, 8
xor esi, esi
call fcn.00452bb0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
push 0
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
push esi
call fcn.00456d00
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
neg eax
sbb eax, eax
neg eax
push eax
call fcn.00461550
mov esi, dword [esp + 0x18]
add esp, 8
call fcn.00452bb0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret

Function at 0x4582d0
Capabilities:
Read file on windows

Disassembly:
call fcn.00452bb0
mov eax, dword [esp + 4]
lea ecx, [eax + 1]
cmp ecx, 3
ja case.default.0x4582e1
jmp dword [ecx*4 + 0x458338]
xor eax, eax
jmp case.default.0x4582e1
push 0xfffffffffffffff6
jmp 0x4582f6
push 0xfffffffffffffff5
jmp 0x4582f6
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push esi
push 0
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x18]
push dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor esi, esi
test eax, eax
push 0
cmovne esi, dword [esp + 0xc]
xor ecx, ecx
test eax, eax
setne cl
push ecx
call fcn.00461550
add esp, 8
call fcn.00452bb0
mov eax, esi
pop esi
ret
Function at 0x4582e8
Capabilities:
Read file on windows

Disassembly:
call fcn.00452bb0
mov eax, dword [esp + 4]
lea ecx, [eax + 1]
cmp ecx, 3
ja case.default.0x4582e1
jmp dword [ecx*4 + 0x458338]
xor eax, eax
jmp case.default.0x4582e1
push 0xfffffffffffffff6
jmp 0x4582f6
push 0xfffffffffffffff5
jmp 0x4582f6
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push esi
push 0
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x18]
push dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor esi, esi
test eax, eax
push 0
cmovne esi, dword [esp + 0xc]
xor ecx, ecx
test eax, eax
setne cl
push ecx
call fcn.00461550
add esp, 8
call fcn.00452bb0
mov eax, esi
pop esi
ret

Function at 0x4582ec
Capabilities:
Read file on windows

Disassembly:
call fcn.00452bb0
mov eax, dword [esp + 4]
lea ecx, [eax + 1]
cmp ecx, 3
ja case.default.0x4582e1
jmp dword [ecx*4 + 0x458338]
xor eax, eax
jmp case.default.0x4582e1
push 0xfffffffffffffff6
jmp 0x4582f6
push 0xfffffffffffffff5
jmp 0x4582f6
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push esi
push 0
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x18]
push dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor esi, esi
test eax, eax
push 0
cmovne esi, dword [esp + 0xc]
xor ecx, ecx
test eax, eax
setne cl
push ecx
call fcn.00461550
add esp, 8
call fcn.00452bb0
mov eax, esi
pop esi
ret

Function at 0x4582f0
Capabilities:
Read file on windows

Disassembly:
call fcn.00452bb0
mov eax, dword [esp + 4]
lea ecx, [eax + 1]
cmp ecx, 3
ja case.default.0x4582e1
jmp dword [ecx*4 + 0x458338]
xor eax, eax
jmp case.default.0x4582e1
push 0xfffffffffffffff6
jmp 0x4582f6
push 0xfffffffffffffff5
jmp 0x4582f6
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push esi
push 0
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x18]
push dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor esi, esi
test eax, eax
push 0
cmovne esi, dword [esp + 0xc]
xor ecx, ecx
test eax, eax
setne cl
push ecx
call fcn.00461550
add esp, 8
call fcn.00452bb0
mov eax, esi
pop esi
ret

Function at 0x4582f4
Capabilities:
Read file on windows

Disassembly:
call fcn.00452bb0
mov eax, dword [esp + 4]
lea ecx, [eax + 1]
cmp ecx, 3
ja case.default.0x4582e1
jmp dword [ecx*4 + 0x458338]
xor eax, eax
jmp case.default.0x4582e1
push 0xfffffffffffffff6
jmp 0x4582f6
push 0xfffffffffffffff5
jmp 0x4582f6
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push esi
push 0
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x18]
push dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor esi, esi
test eax, eax
push 0
cmovne esi, dword [esp + 0xc]
xor ecx, ecx
test eax, eax
setne cl
push ecx
call fcn.00461550
add esp, 8
call fcn.00452bb0
mov eax, esi
pop esi
ret
Function at 0x458350
Capabilities:
Move file

Disassembly:
push ebx
push esi
push edi
push dword [esp + 0x10]
call fcn.00457d80
push dword [esp + 0x18]
mov ebx, eax
call fcn.00457d80
add esp, 8
mov edi, eax
call fcn.00452bb0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
neg eax
push 0
sbb esi, esi
neg esi
push esi
call fcn.00461550
add esp, 8
call fcn.00452bb0
test ebx, ebx
je 0x45839c
push ebx
call fcn.0048bed0
add esp, 4
test edi, edi
je 0x4583a9
push edi
call fcn.0048bed0
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x4583b0
Capabilities:
Delete directory

Disassembly:
push esi
push edi
push dword [esp + 0xc]
call fcn.00457d80
add esp, 4
mov edi, eax
call fcn.00452bb0
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
neg eax
push 0
sbb esi, esi
neg esi
push esi
call fcn.00461550
add esp, 8
call fcn.00452bb0
test edi, edi
je 0x4583ef
push edi
call fcn.0048bed0
add esp, 4
pop edi
mov eax, esi
pop esi
ret

Function at 0x458580
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
call fcn.00452bb0
push dword [esp + 0x10]
call fcn.00457d80
mov ebx, dword [esp + 0x18]
add esp, 4
mov edx, ebx
mov ecx, ebx
and edx, 1
mov edi, eax
mov esi, edx
mov eax, ebx
or esi, 2
and cl, 2
cmove esi, edx
mov ecx, esi
or ecx, 4
and al, 4
cmove ecx, esi
mov eax, ecx
or eax, 0x20
and bl, 0x20
cmove eax, ecx
mov ecx, 0x80
test eax, eax
cmove eax, ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
neg eax
push 0
sbb esi, esi
neg esi
push esi
call fcn.00461550
add esp, 8
test edi, edi
je 0x4585f3
push edi
call fcn.0048bed0
add esp, 4
call fcn.00452bb0
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x458620
Capabilities:
Timestomp file

Disassembly:
sub esp, 0x40
mov eax, dword [0x887490]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x50]
lea eax, [esp + 0x14]
push edi
mov edi, dword [esp + 0x58]
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x18]
push eax
push edi
call fcn.004f60a0
mov ebp, dword [esp + 0x6c]
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x38]
push eax
push ebp
call fcn.004f66e0
call fcn.00452bb0
push 0
push 0x42
push esi
call fcn.00458050
mov esi, eax
xor ebx, ebx
add esp, 0x30
cmp esi, 0xffffffff
setne bl
je 0x458753
test edi, edi
jle 0x4586a1
test ebp, ebp
js 0x4586a1
xorps xmm0, xmm0
movups xmmword [esp + 0x3c], xmm0
jmp 0x4586ac
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
test edi, edi
jle 0x4586ce
movzx eax, word [esp + 0x10]
mov word [esp + 0x3c], ax
movzx eax, word [esp + 0x14]
mov word [esp + 0x3e], ax
movzx eax, word [esp + 0x18]
mov word [esp + 0x42], ax
test ebp, ebp
js 0x4586fa
movzx eax, word [esp + 0x1c]
mov word [esp + 0x44], ax
movzx eax, word [esp + 0x20]
mov word [esp + 0x46], ax
movzx eax, word [esp + 0x24]
mov word [esp + 0x48], ax
movzx eax, word [esp + 0x28]
mov word [esp + 0x4a], ax
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x458740
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
lea eax, [esp + 0x2c]
push eax
push eax
push 0
push esi
call fcn.00456d00
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov ebx, eax
neg ebx
sbb ebx, ebx
neg ebx
jmp 0x458742
xor ebx, ebx
push 0
push ebx
call fcn.00461550
push esi
call fcn.00456fe0
add esp, 0xc
call fcn.00452bb0
mov ecx, dword [esp + 0x4c]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005091ef
add esp, 0x40
ret
Function at 0x458850
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
call fcn.00452bb0
mov esi, dword [esp + 0x30]
mov ebp, dword [esp + 0x3c]
mov ebx, dword [esp + 0x40]
lea edi, [esi + 1]
call fcn.004f7e70
test eax, eax
je 0x4588d1
mov dword [esp + 0x10], 0
xorps xmm0, xmm0
movlpd qword [esp + 0x18], xmm0
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebx
cmp edi, 3
ja case.default.0x45889a
jmp dword [edi*4 + 0x45898c]
xor esi, esi
jmp case.default.0x45889a
push 0xfffffffffffffff6
jmp 0x4588af
push 0xfffffffffffffff5
jmp 0x4588af
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
push 0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
push esi
jmp 0x458963
mov dword [esp + 0x14], ebx
cmp edi, 3
ja case.default.0x4588da
jmp dword [edi*4 + 0x45899c]
xor eax, eax
jmp 0x458905
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x458905
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x458905
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x458905
mov eax, esi
push 0
lea ecx, [esp + 0x18]
push ecx
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x458940
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x458940
push 0
push 0
call fcn.00461550
add esp, 8
xor esi, esi
call fcn.00452bb0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
push 0
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
push esi
call fcn.00456d00
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
neg eax
push eax
call fcn.00461550
mov esi, dword [esp + 0x18]
add esp, 8
call fcn.00452bb0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret

Function at 0x4589b0
Capabilities:
Clear file content
Write file on windows

Disassembly:
push ecx
push esi
xor esi, esi
call fcn.00452bb0
mov eax, dword [esp + 0xc]
lea ecx, [eax + 1]
cmp dword [esp + 0x14], esi
je 0x458a21
cmp ecx, 3
ja case.default.0x4589cb
jmp dword [ecx*4 + 0x458a64]
xor eax, eax
jmp case.default.0x4589cb
push 0xfffffffffffffff6
jmp 0x4589e0
push 0xfffffffffffffff5
jmp 0x4589e0
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
lea ecx, [esp + 8]
push ecx
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, eax
test ecx, ecx
push 0
cmovne esi, dword [esp + 8]
xor eax, eax
test ecx, ecx
setne al
push eax
call fcn.00461550
add esp, 8
call fcn.00452bb0
mov eax, esi
pop esi
pop ecx
ret
cmp ecx, 3
ja case.default.0x458a26
jmp dword [ecx*4 + 0x458a74]
xor eax, eax
jmp case.default.0x458a26
push 0xfffffffffffffff6
jmp 0x458a3b
push 0xfffffffffffffff5
jmp 0x458a3b
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
neg eax
sbb eax, eax
neg eax
push eax
call fcn.00461550
add esp, 8
call fcn.00452bb0
mov eax, esi
pop esi
pop ecx
ret
Function at 0x461df0
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esp + 4]
push esi
push edi
lea eax, [ecx - 1]
cmp eax, 0xff
ja 0x461e23
lea eax, [ecx + ecx*2]
shl eax, 4
test byte [eax + 0x8b4be0], 2
lea esi, [eax + 0x8b4bc8]
jne 0x461e25
mov dword [esi + 0x1c], 2
mov dword [esi + 0x20], 0
xor esi, esi
or edi, 0xffffffff
test esi, esi
je 0x461ee6
call fcn.00452bb0
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jg 0x461e54
jl 0x461e47
mov eax, dword [esp + 0x18]
test eax, eax
jae 0x461e58
xorps xmm0, xmm0
movlpd qword [esp + 0x18], xmm0
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
cmp dword [esi + 0x10], eax
jne 0x461e62
cmp dword [esi + 0x14], ecx
je 0x461e8c
push ecx
push eax
push dword [esi + 0xc]
push dword [esi + 8]
push esi
call fcn.00461f50
add esp, 0x14
test eax, eax
jne 0x461e8c
push 1
push esi
call fcn.00461ef0
add esp, 8
call fcn.00452bb0
mov eax, edi
pop edi
pop esi
ret
push 0
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
or edi, 0xffffffff
test eax, eax
cmovne edi, dword [esp + 0xc]
test edi, edi
jne 0x461ed0
mov dword [esi + 0x20], edi
or edi, 0xffffffff
mov dword [esi + 0x1c], 3
call fcn.00452bb0
mov eax, edi
pop edi
pop esi
ret
xor ecx, ecx
test eax, eax
sete cl
push ecx
push esi
call fcn.00461ef0
add esp, 8
call fcn.00452bb0
mov eax, edi
pop edi
pop esi
ret