joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418c6f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4302ec]
jne 0x418c79
repz ret
jmp fcn.0041a5c8

Function at 0x42405b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041d6e8
and dword [ebp - 4], 0
cmp dword [0x4321e0], 0
mov ebx, eax
jne 0x42410c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4241bd
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4241bd
push eax
call fcn.0041d676
mov dword [esp], 0x42b0ac
push edi
mov dword [0x4321e0], eax
call esi
push eax
call fcn.0041d676
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4321e4], eax
call esi
push eax
call fcn.0041d676
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4321e8], eax
call esi
push eax
call fcn.0041d676
pop ecx
mov dword [0x4321f0], eax
test eax, eax
je 0x42410c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041d676
pop ecx
mov dword [0x4321ec], eax
mov eax, dword [0x4321ec]
cmp eax, ebx
je 0x424164
cmp dword [0x4321f0], ebx
je 0x424164
push eax
call fcn.0041d6f1
push dword [0x4321f0]
mov esi, eax
call fcn.0041d6f1
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x424164
test edi, edi
je 0x424164
call esi
test eax, eax
je 0x42415b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x42415b
test byte [ebp - 0xc], 1
jne 0x424164
or dword [ebp + 0x10], 0x200000
jmp 0x42419d
mov eax, dword [0x4321e4]
cmp eax, ebx
je 0x42419d
push eax
call fcn.0041d6f1
pop ecx
test eax, eax
je 0x42419d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x42419d
mov eax, dword [0x4321e8]
cmp eax, ebx
je 0x42419d
push eax
call fcn.0041d6f1
pop ecx
test eax, eax
je 0x42419d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4321e0]
call fcn.0041d6f1
pop ecx
test eax, eax
je 0x4241bd
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4241bf
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x427a52
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x432348], 0
push esi
jne 0x4279c5
call fcn.004278eb
test eax, eax
je 0x427a08
mov eax, dword [0x432348]
cmp eax, 1
jne 0x4279e6
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x427a08
pop esi
ret
push eax
call dword [0x432350]
test eax, eax
jne 0x427a50
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x427a0c
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x432348]
call dword [0x432350]
mov edi, eax
test edi, edi
je 0x427a31
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x427a4d
mov edi, esi
add esi, 0xff0
push edi
push dword [0x432348]
call dword [0x43234c]
add edi, 0x10
cmp edi, esi
jb 0x427a39
mov eax, edi
pop edi
pop esi
ret
jmp 0x4279b2
Function at 0x4390d0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
mov edx, dword [esp + 8]
push 0xffffffffffffffff
push 0x46c418
push eax
mov dword fs:[0], esp
mov eax, dword [edx + 0xc]
movzx eax, word [eax + 6]
mov ecx, dword [edx + 0x18]
sub eax, 2
sub esp, 0x1c
lea eax, [eax + eax*4]
lea eax, [ecx + eax*8]
mov ecx, dword [eax + 0x10]
push esi
cmp ecx, dword [eax + 8]
jne 0x43913e
cmp ecx, 0x5000
jne 0x43913e
mov ecx, dword [eax + 0x38]
add eax, 0x28
test ecx, ecx
jne 0x43913e
cmp dword [eax + 8], 0x1000
jne 0x43913e
mov ecx, dword [edx + 4]
sub eax, 0x28
mov eax, dword [eax + 0x14]
dec ecx
cmp ecx, eax
jbe 0x43913e
mov edx, dword [edx]
cmp byte [edx + ecx], 0
jne 0x439150
dec ecx
cmp ecx, eax
ja 0x439133
pop esi
xor al, al
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret
cmp byte [edx + ecx], 0xc3
jne 0x43913e
push 0x405b14
lea ecx, [esp + 8]
call fcn.00436500
mov eax, dword [esp + 0x38]
lea edx, [eax + eax*2]
mov eax, dword [edx*4 + 0x401e88]
push eax
lea ecx, [esp + 8]
mov dword [esp + 0x2c], 0
call fcn.004376d0
push 2
push 0x405b10
lea ecx, [esp + 0xc]
call fcn.00437590
mov esi, dword [esp + 0x30]
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esi + 4]
call fcn.00436320
lea ecx, [esp + 4]
mov byte [esi], 1
call fcn.004537b0
mov ecx, dword [esp + 0x20]
pop esi
mov al, 1
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x4391d0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x46c43b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x46c
mov eax, 0xab00
push ebx
mov edx, 0xeb
mov ecx, 1
mov word [esp + 8], ax
mov word [esp + 0x12], ax
mov word [esp + 0x14], ax
mov word [esp + 0x16], ax
mov word [esp + 0x1e], ax
mov word [esp + 0x24], ax
mov word [esp + 0x26], ax
mov word [esp + 0x28], ax
xor ebx, ebx
mov eax, 0x64
push esi
mov esi, dword [esp + 0x484]
mov word [esp + 0x32], ax
mov word [esp + 0x3e], ax
cmp dword [esi + 0x20], ebx
mov word [esp + 8], dx
mov word [esp + 0xa], cx
mov word [esp + 0x12], dx
mov word [esp + 0x14], cx
mov word [esp + 0x1e], dx
mov word [esp + 0x20], cx
mov edx, 0x68
mov ecx, 0x67
mov word [esp + 0xe], 0xe3
mov word [esp + 0x10], 5
mov word [esp + 0x1c], 0x59
mov word [esp + 0x24], 0x90
mov word [esp + 0x26], dx
mov word [esp + 0x2e], bx
mov word [esp + 0x30], cx
mov word [esp + 0x34], 0xff
mov word [esp + 0x36], 0x36
mov word [esp + 0x38], bx
mov word [esp + 0x3a], bx
mov word [esp + 0x3c], cx
mov word [esp + 0x40], 0x89
mov word [esp + 0x42], 0x26
mov word [esp + 0x44], bx
mov word [esp + 0x46], bx
mov word [esp + 0x48], dx
mov word [esp + 0x4a], 0x33
mov word [esp + 0x4c], 0xc0
mov word [esp + 0x4e], 0xf1
jne 0x4392fc
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x46c]
mov dword fs:[0], ecx
add esp, 0x478
ret
push edi
mov edi, dword [esp + 0x48c]
mov eax, dword [edi + 0xc]
movzx eax, word [eax + 6]
mov ecx, dword [edi + 0x18]
lea eax, [eax + eax*4]
mov edx, dword [ecx + eax*8 - 0x18]
lea eax, [ecx + eax*8 - 0x28]
cmp edx, dword [eax + 8]
jne 0x4393ea
push 0x24
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x78]
call fcn.00437340
cmp dword [esp + 0x74], 0x24
mov edi, dword [edi]
jg 0x4393ea
mov ecx, dword [esi + 0x20]
lea edx, [edi + ecx - 0x24]
push 0x24
push edx
lea ecx, [esp + 0x78]
call fcn.004373c0
cmp al, bl
je 0x4393ea
push 0x405b34
lea ecx, [esp + 0x58]
call fcn.00436500
mov eax, dword [esp + 0x490]
lea eax, [eax + eax*2]
mov edi, dword [eax*4 + 0x401e88]
mov eax, edi
mov dword [esp + 0x480], ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x439385
sub eax, edx
push eax
push edi
lea ecx, [esp + 0x5c]
call fcn.00437590
push 2
push 0x405b10
lea ecx, [esp + 0x5c]
call fcn.00437590
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x5c]
push ecx
lea ecx, [esi + 4]
call fcn.00436320
cmp dword [esp + 0x6c], 0x10
mov byte [esi], 1
jb 0x4393d0
mov edx, dword [esp + 0x58]
push edx
call fcn.00461b2d
add esp, 4
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [esp + 0x46c]
mov dword fs:[0], ecx
add esp, 0x478
ret
mov ecx, dword [esp + 0x478]
pop edi
pop esi
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x478
ret
Function at 0x43e460
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x108
push ebx
push 0
push 0x80
push 4
push 0
push 3
push 0xc0000000
push 0x406338
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [esp + 8], ebx
jne 0x43e4b2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10
push 0x406330
push 0x406310
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop ebx
add esp, 0x108
ret
mov eax, dword [0x401e88]
push esi
push edi
xor edi, edi
test eax, eax
je 0x43e50d
mov esi, 0x401e88
movzx ecx, word [esi + 8]
push ecx
push eax
push edi
lea edx, [esp + 0x20]
push 0x4062f8
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x28]
add esp, 0x14
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x43e4e5
push 0
sub eax, ecx
lea ecx, [esp + 0x10]
push ecx
push eax
lea edx, [esp + 0x20]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 0xc]
add esi, 0xc
inc edi
test eax, eax
jne 0x43e4c4
mov eax, dword [0x401c88]
xor esi, esi
test eax, eax
je 0x43e571
mov ebx, 0x401c88
push ebp
mov edi, edi
push eax
lea eax, [esi + edi]
push eax
lea ecx, [esp + 0x20]
push 0x4062e0
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x28]
add esp, 0x10
lea ebp, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43e540
mov ecx, dword [esp + 0x14]
push 0
lea edx, [esp + 0x14]
push edx
sub eax, ebp
push eax
lea eax, [esp + 0x24]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebx + 0xc]
add ebx, 0xc
inc esi
test eax, eax
jne 0x43e520
mov ebx, dword [esp + 0x14]
pop ebp
lea edx, [esi + edi - 1]
push edx
lea eax, [esp + 0x18]
push 0x4062a0
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x14]
pop edi
lea edx, [eax + 1]
pop esi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43e592
push 0
lea ecx, [esp + 8]
push ecx
sub eax, edx
push eax
lea edx, [esp + 0x18]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
add esp, 0x108
ret

Function at 0x4408a0
Capabilities:
Get file size

Disassembly:
push ebx
push esi
mov esi, ecx
mov cl, byte [esp + 0x10]
test cl, cl
push edi
mov eax, 0xc0000000
mov edi, 4
mov ebx, 2
mov byte [esi], cl
je 0x4408ca
mov edi, ebx
mov eax, 0x80000000
mov ebx, 4
push 0
push 0x80
push 3
push 0
push 1
push eax
mov eax, dword [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
je 0x44092d
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esi + 4]
push 0
push 0
push 0
push edi
push 0
push ecx
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
test eax, eax
mov dword [esi + 8], eax
je 0x440926
push 0
push 0
push 0
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [esi + 0xc], eax
jne 0x440935
mov ecx, esi
call fcn.00440850
pop edi
pop esi
xor al, al
pop ebx
ret 8
pop edi
pop esi
mov al, 1
pop ebx
ret 8
Function at 0x442320
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x442379
test al, 0x10
je 0x442379
mov eax, esi
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x442340
sub eax, edx
cmp byte [eax + esi - 1], 0x5c
push edi
je 0x442365
mov edi, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x442354
mov ax, word [0x4064c8]
mov word [edi], ax
dec esi
mov edi, esi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x442368
mov ecx, dword [0x4064c4]
mov dword [edi], ecx
pop edi
pop esi
ret

Function at 0x442b50
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
push eax
push 1
mov ecx, 0x4710c8
call fcn.00441e70
mov ecx, dword [esp + 4]
push ecx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x442b91
push 0x40000
push 0x406698
push 0x40667c
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
pop ecx
ret
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x442bbe
push 0x40000
push 0x406698
push 0x40665c
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ecx
ret
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ecx
ret
Function at 0x4432d0
Capabilities:
Compare security identifiers
Get token privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 8], ebx
push eax
mov ax, cs
test al, 4
jne 0x4432ed
mov dword [ebp - 8], 1
pop eax
cmp dword [ebp - 8], ebx
je 0x443406
lea eax, [ebp - 8]
push eax
push ebx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x44333d
call esi
cmp eax, 0x3f0
jne 0x4433f4
lea ecx, [ebp - 8]
push ecx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4433f4
mov eax, dword [ebp - 8]
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea edx, [ebp - 4]
push edx
push ebx
push ebx
push 2
push eax
call edi
test eax, eax
jne 0x4433f4
call esi
cmp eax, 0x7a
jne 0x4433f4
mov ecx, dword [ebp - 4]
add ecx, 3
and ecx, 0xfffffffc
push ecx
call fcn.00461694
mov ecx, dword [ebp - 8]
add esp, 4
mov esi, eax
mov eax, dword [ebp - 4]
lea edx, [ebp - 4]
push edx
push eax
push esi
push 2
push ecx
call edi
test eax, eax
je 0x4433eb
lea edx, [ebp - 0xc]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], bl
mov byte [ebp - 0x13], bl
mov byte [ebp - 0x12], bl
mov byte [ebp - 0x11], bl
mov byte [ebp - 0x10], bl
mov byte [ebp - 0xf], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x4433eb
mov eax, dword [esi]
xor edi, edi
cmp eax, ebx
jbe 0x4433eb
lea ebx, [esi + 4]
lea esp, [esp]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebx]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x4433fd
mov eax, dword [esi]
inc edi
add ebx, 8
cmp edi, eax
jb 0x4433d0
push esi
call fcn.00462416
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call fcn.00462416
add esp, 4
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x443410
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push ebx
mov eax, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
lea eax, [esp + 8]
push eax
xor ebx, ebx
push 0xf003f
push ebx
push 0x406744
push 0x80000001
mov byte [esp + 0x18], bl
mov byte [esp + 0x19], bl
mov byte [esp + 0x1a], bl
mov byte [esp + 0x1b], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x443459
xor eax, eax
pop ebx
add esp, 0x10
ret
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x1c]
push eax
push ebx
push 0x406738
push ecx
call esi
test eax, eax
je 0x443488
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
mov dl, byte [esp + 8]
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0xc]
push ecx
mov byte [0x470aec], dl
lea edx, [esp + 0x1c]
push edx
push ebx
push 0x40672c
push eax
call esi
test eax, eax
jne 0x443480
mov cl, byte [esp + 8]
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
mov byte [0x470bfc], cl
lea ecx, [esp + 0x1c]
push ecx
push ebx
push 0x406724
push edx
call esi
test eax, eax
jne 0x443480
mov al, byte [esp + 8]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0xc]
push edx
mov byte [0x470f1c], al
lea eax, [esp + 0x1c]
push eax
push ebx
push 0x406714
push ecx
call esi
test eax, eax
jne 0x443480
mov dl, byte [esp + 8]
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0xc]
push ecx
mov byte [0x470db1], dl
lea edx, [esp + 0x1c]
push edx
push ebx
push 0x406704
push eax
call esi
test eax, eax
jne 0x443480
mov cl, byte [esp + 8]
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
mov byte [0x470970], cl
lea ecx, [esp + 0x1c]
push ecx
push ebx
push 0x4066f8
push edx
call esi
test eax, eax
jne 0x443480
mov al, byte [esp + 8]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0xc]
push edx
mov byte [0x4707c4], al
lea eax, [esp + 0x1c]
push eax
push ebx
push 0x4066e4
push ecx
call esi
test eax, eax
jne 0x443480
mov dl, byte [esp + 8]
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0xc]
push ecx
mov byte [0x470938], dl
lea edx, [esp + 0x1c]
push edx
push ebx
push 0x4066dc
push eax
call esi
test eax, eax
jne 0x443480
mov cl, byte [esp + 8]
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
mov byte [0x470db0], cl
lea ecx, [esp + 0x1c]
push ecx
push ebx
push 0x4066d4
push edx
call esi
test eax, eax
jne 0x443480
mov ecx, dword [esp + 0xc]
mov al, byte [esp + 8]
push ecx
mov byte [0x470e0c], al
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov eax, 1
pop ebx
add esp, 0x10
ret
Function at 0x444330
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x46c7cb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x138
push ebp
or ebp, 0xffffffff
push esi
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov esi, dword [esp + 0x160]
push 1
push esi
lea ecx, [esp + 0x10]
mov dword [esp + 0x150], 0
call fcn.004408a0
test al, al
je 0x4443a6
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
push ecx
lea ecx, [esp + 0x28]
call fcn.004533c0
test al, al
jne 0x4443cd
lea ecx, [esp + 8]
call fcn.00440850
lea ecx, [esp + 8]
mov dword [esp + 0x148], ebp
call fcn.00440850
pop esi
pop ebp
mov ecx, dword [esp + 0x138]
mov dword fs:[0], ecx
add esp, 0x144
ret
lea edx, [esp + 0x3c]
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4443d5
mov eax, dword [esp + 0x15c]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4443e8
push edi
lea edi, [esp + 0x40]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4443f7
mov edx, dword [esp + 0x158]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push edx
lea ecx, [esp + 0x28]
call fcn.00453380
push 0
push 0x80
push 4
push 0
push 3
mov edi, eax
push 0xc0000000
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, ebp
jne 0x444466
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x15c]
push 0x10
push 0x406330
push 0x4068fc
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4444b9
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x154]
push 0
lea edx, [esp + 0x24]
push edx
push edi
add eax, ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
push esi
jne 0x4444aa
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x15c]
push 0x10
push 0x406330
push 0x4068e4
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4444b9
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0xc]
call fcn.00440850
lea ecx, [esp + 0xc]
mov dword [esp + 0x14c], ebp
call fcn.00440850
mov ecx, dword [esp + 0x144]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x144
ret
Function at 0x4468d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x160
push ebx
push ebp
mov ebp, dword [0x471b1c]
push esi
push edi
xor eax, eax
test ebp, ebp
mov byte [esp + 0x68], 0
mov ecx, 0x41
lea edi, [esp + 0x69]
rep stosd dword es:[edi], eax
mov dword [esp + 0x14], ebp
stosw word es:[edi], ax
je 0x446b18
xor eax, eax
mov ecx, 0x13
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov ecx, dword [0x470e14]
lea edx, [esp + 0x18]
lea eax, [esp + 0x68]
push edx
mov dword [esp + 0x1c], 0x4c
mov dword [esp + 0x3c], 0x104
mov dword [esp + 0x38], eax
mov dword [esp + 0x28], 0x406ad4
mov dword [esp + 0x4c], 0x406ac8
mov dword [esp + 0x48], 0x406470
mov dword [esp + 0x34], 1
mov dword [esp + 0x50], 4
mov dword [esp + 0x20], ecx
call dword [sym.imp.comdlg32.dll_GetSaveFileNameA]
test eax, eax
je 0x446b18
lea eax, [esp + 0x68]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x446977
sub eax, edx
cmp dword [esp + eax + 0x65], 0x7478742e
je 0x4469a8
lea edi, [esp + 0x68]
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x446990
mov eax, dword [0x406ac0]
mov cl, byte [0x406ac4]
mov dword [edi], eax
mov byte [edi + 4], cl
push 0
push 0x80
push 4
push 0
push 3
push 0xc0000000
lea edx, [esp + 0x80]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4469f2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10
push 0x406330
push 0x4068fc
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
xor ebx, ebx
test ebp, ebp
jle 0x446af5
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x401e4c
push 0
push ebx
mov ecx, 0x471b18
call fcn.00441fe0
mov ebp, dword [0x401e64]
cmp ebp, 0x10
mov eax, dword [0x401e50]
jae 0x446a29
mov eax, 0x401e50
lea ecx, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x446a30
sub eax, ecx
cmp ebp, 0x10
mov ecx, dword [0x401e50]
jae 0x446a49
mov ecx, 0x401e50
push 0
lea edx, [esp + 0x14]
push edx
push eax
push ecx
push esi
call edi
push 0
lea eax, [esp + 0x14]
push eax
push 4
push 0x406ab8
push esi
call edi
push 0
push 0x406423
mov ecx, 0x401e4c
call fcn.00436410
push 0x401e4c
push 1
push ebx
mov ecx, 0x471b18
call fcn.00441fe0
mov ebp, dword [0x401e64]
cmp ebp, 0x10
mov eax, dword [0x401e50]
jae 0x446a9e
mov eax, 0x401e50
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x446aa1
sub eax, ecx
cmp ebp, 0x10
mov ecx, dword [0x401e50]
jae 0x446aba
mov ecx, 0x401e50
push 0
lea edx, [esp + 0x14]
push edx
push eax
push ecx
push esi
call edi
push 0
lea eax, [esp + 0x14]
push eax
push 2
push 0x406ab4
push esi
call edi
push 0
push 0x406423
mov ecx, 0x401e4c
call fcn.00436410
mov eax, dword [esp + 0x14]
inc ebx
cmp ebx, eax
jl 0x446a02
mov edx, dword [0x470e14]
push 0x40000
push 0x406aa8
lea ecx, [esp + 0x70]
push ecx
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4483a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46c9d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
push ebx
xor ebx, ebx
push esi
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
mov dword [esp + 0x64], ebx
mov dword [esp + 0x20], 0xf
mov dword [esp + 0x1c], ebx
mov byte [esp + 0xc], bl
mov eax, dword [esp + 0x6c]
mov ecx, dword [0x470d28]
add ecx, eax
push ecx
lea edx, [esp + 0x44]
push edx
mov byte [esp + 0x6c], 1
call fcn.00446600
add esp, 8
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x70], 2
call fcn.00436320
mov eax, dword [esp + 0x58]
mov esi, 0x10
cmp eax, esi
mov byte [esp + 0x64], 1
jb 0x448430
mov eax, dword [esp + 0x44]
push eax
call fcn.00461b2d
add esp, 4
mov ecx, dword [esp + 0x70]
mov edx, dword [0x470d28]
add edx, ecx
push edx
lea eax, [esp + 0x44]
push eax
call fcn.00446600
add esp, 8
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x70], 3
call fcn.00436320
cmp dword [esp + 0x58], esi
mov byte [esp + 0x64], 1
jb 0x448474
mov ecx, dword [esp + 0x44]
push ecx
call fcn.00461b2d
add esp, 4
cmp dword [esp + 0x3c], esi
mov eax, dword [esp + 0x28]
jae 0x448482
lea eax, [esp + 0x28]
mov edx, dword [esp + 0x38]
push edx
push eax
mov eax, dword [esp + 0x24]
push eax
push ebx
lea ecx, [esp + 0x18]
call fcn.00443d70
test eax, eax
mov eax, dword [esp + 0x20]
setl byte [esp + 0x6c]
cmp eax, esi
jb 0x4484b3
mov ecx, dword [esp + 0xc]
push ecx
call fcn.00461b2d
add esp, 4
cmp dword [esp + 0x3c], esi
pop esi
mov dword [esp + 0x18], ebx
mov byte [esp + 8], bl
mov dword [esp + 0x1c], 0xf
pop ebx
jb 0x4484d8
mov edx, dword [esp + 0x20]
push edx
call fcn.00461b2d
add esp, 4
mov ecx, dword [esp + 0x54]
mov al, byte [esp + 0x64]
mov dword fs:[0], ecx
add esp, 0x60
ret 8