joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4440e3
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push 1
mov ecx, dword [esi + 0x230]
call fcn.0047eb84
push 4
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
pop ecx
xor ecx, ecx
test eax, eax
je 0x444106
mov dword [eax], esi
jmp 0x444108
mov eax, ecx
push ecx
push ecx
push eax
push 0x44736d
push ecx
push ecx
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
pop esi
test eax, eax
je 0x444127
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
ret 8

Function at 0x44452f
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
xor eax, eax
push eax
push 0x2000000
push 3
push eax
push 1
mov esi, ecx
mov dword [ebp - 0x18], edx
push 0x80000000
push esi
call edi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x444600
push str.locale.nls
push esi
lea ecx, [ebp - 0xc]
call fcn.0043c2b8
mov edx, eax
lea ecx, [ebp - 8]
call fcn.0043baed
pop ecx
xor ecx, ecx
push ecx
push 0x2000000
push 3
push ecx
push 1
push 0x80000000
push dword [eax]
call edi
mov ecx, dword [ebp - 8]
mov ebx, eax
lea ecx, [ecx - 0x10]
call fcn.0043d912
mov ecx, dword [ebp - 0xc]
lea ecx, [ecx - 0x10]
call fcn.0043d912
cmp ebx, 0xffffffff
jne 0x444600
push str._system32locale.nls
push esi
lea ecx, [ebp - 0x14]
call fcn.0043c2b8
mov edx, eax
lea ecx, [ebp - 0x10]
call fcn.0043baed
pop ecx
xor ecx, ecx
push ecx
push 0x2000000
push 3
push ecx
push 1
push 0x80000000
push dword [eax]
call edi
mov ecx, dword [ebp - 0x10]
mov ebx, eax
lea ecx, [ecx - 0x10]
call fcn.0043d912
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.0043d912
cmp ebx, 0xffffffff
jne 0x444600
push 0x57
pop eax
jmp 0x44466c
xor edi, edi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 4], eax
add eax, 0x28
push eax
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new___unsigned_int_]
pop ecx
push edi
mov esi, eax
lea ecx, [ebp - 4]
push ecx
push dword [ebp - 4]
lea eax, [esi + 0x28]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x444639
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x444659
mov edx, esi
lea ecx, [esi + 0x28]
call fcn.004441b6
xor ecx, ecx
cmp word [esi + 0xc], cx
ja 0x444665
push 0x57
pop edi
push esi
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov eax, edi
jmp 0x44466c
mov eax, dword [ebp - 0x18]
mov dword [eax], esi
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x44557c
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
xor eax, eax
mov dword [ebp - 8], edx
push esi
mov ebx, ecx
mov dword [ebp - 0xc], eax
push edi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], eax
call fcn.0043d5bb
push eax
lea ecx, [ebp - 0x10]
call fcn.0043bbe8
call fcn.0043d5bb
push eax
lea ecx, [ebp - 0x14]
call fcn.0043bbe8
mov eax, dword [ebx + 0x48]
lea edx, [ebp - 4]
push edx
push 0x2000000
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionTime_Zones
mov ecx, dword [eax]
push 0x80000002
push eax
call dword [ecx + 0xc]
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp - 0x14]
test eax, eax
jne 0x44572a
push ecx
lea ecx, [edi - 0x10]
mov ebx, esp
call fcn.0043cad2
add eax, 0x10
push ecx
mov dword [ebx], eax
lea ecx, [esi - 0x10]
mov ebx, esp
call fcn.0043cad2
mov edx, dword [ebp - 8]
add eax, 0x10
mov dword [ebx], eax
lea eax, [ebp - 0x64]
mov ecx, dword [ebp - 4]
push eax
call fcn.004453a6
test eax, eax
jne 0x44572a
lea ecx, [ebp - 4]
call fcn.0043b8cb
mov ecx, dword [ebp - 0x18]
lea edx, [ebp - 4]
push edx
push 0x2001f
push str.SYSTEMCurrentControlSetControlTimeZoneInformation
mov eax, dword [ecx + 0x48]
push 0x80000002
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
test eax, eax
jne 0x44572a
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x48]
call fcn.0044553d
lea edx, [ebp - 0x38]
lea ecx, [ebp - 0x58]
call fcn.0044553d
mov eax, dword [ebp - 0x64]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push 4
push 0
push str.Bias
push dword [ebp - 4]
call ebx
mov eax, dword [ebp - 0x5c]
push 4
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push 4
push 0
push str.DaylightBias
push dword [ebp - 4]
call ebx
mov ecx, dword [ebp - 4]
mov edx, str.DaylightName
push edi
call fcn.0044ddbc
pop ecx
push 0x10
lea eax, [ebp - 0x28]
push eax
push 3
push 0
push str.DaylightStart
push dword [ebp - 4]
call ebx
mov eax, dword [ebp - 0x60]
push 4
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push 4
push 0
push str.StandardBias
push dword [ebp - 4]
call ebx
mov ecx, dword [ebp - 4]
mov edx, str.StandardName
push esi
call fcn.0044ddbc
pop ecx
push 0x10
lea eax, [ebp - 0x38]
push eax
push 3
push 0
push str.StandardStart
push dword [ebp - 4]
call ebx
push dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, str.TimeZoneKeyName
call fcn.0044ddbc
pop ecx
push 4
lea ecx, [ebp - 0x18]
xor eax, eax
push ecx
push 4
push eax
push str.DynamicDaylightTimeDisabled
push dword [ebp - 4]
mov dword [ebp - 0x18], eax
call ebx
push str.ActiveTimeBias
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x44572d
mov dword [ebp - 0xc], eax
lea ecx, [edi - 0x10]
call fcn.0043d912
lea ecx, [esi - 0x10]
call fcn.0043d912
lea ecx, [ebp - 4]
call fcn.0043b8cb
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4494f6
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x449501
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x4495bd
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x48bc28]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x48bc28]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x48bc28]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x48bc28]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x48bc28]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x48bc28]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x48bc28]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x48bc28]
sub edi, 1
jne 0x449516
pop edi
test esi, esi
je 0x4495d9
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x48bc28]
inc edx
sub esi, 1
jne 0x4495c1
not ecx
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x4495e0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push esi
mov esi, ecx
movsx eax, dl
mov ecx, dword [esi]
xor eax, ecx
movzx eax, al
shr ecx, 8
xor ecx, dword [eax*4 + 0x48bc28]
movzx eax, cl
add eax, dword [esi + 4]
imul eax, eax, 0x8088405
mov dword [esi], ecx
mov ecx, dword [esi + 8]
inc eax
mov dword [esi + 4], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x48bc28]
mov dword [esi + 8], ecx
pop esi
ret
Function at 0x44ae7d
Capabilities:
Allocate or change rwx memory
Encode data using xor

Disassembly:
adc bl, ah
adc esi, dword [ebx]
fdiv st(7)
salc
dec edi
mov ecx, dword [0x4ac2c0]
dec edx
xor edi, dword [0x4acd6f]
xchg eax, eax
xor dword [0x4ad94d], edi
mov eax, esp
xor eax, 0x6c7f596
or esi, edi
sub esi, 0x386c1ffc
xchg esi, edx
salc
or esi, edi
ror edx, 0x13
call fcn.00408811
xchg esi, eax
mov ecx, dword [0x4ac2a0]
mov ecx, 0x2379c8
sub ebx, dword [0x4ac254]
sub dword [0x4ad78a], 0x1376607c
rol esi, 0x17
shr esi, 0xf
inc edx
neg esi
test eax, eax
jo 0x44ae1a
not eax
xor dword [0x4ad7cc], edi
inc eax
mov dword [0x4ad96d], 0x1abbc37
loop 0x44ae60
mov ecx, 0x7259f0
shl esi, 0x10
or dword [0x4ad879], edx
inc esi
shr eax, 0x14
xchg edi, esi
inc esi
or dword [0x4ada6e], ebx
call fcn.00403cde
sti
dec dword [ecx + 0x4ad7f03d]
add byte [ebx], dh
sbb eax, 0x4ac26a
mov dword [0x4adb34], 0x3fcf276
call fcn.0040d327
loop 0x44ae97
add ebx, edx
rol esi, 0x18
mov edi, esi
rol esi, 0x18
neg edx
dec esi
shl eax, 0x12
or esi, edi
xor edx, ecx
call fcn.0040769d
rol ecx, 0xd
shr edx, 0x14
add eax, 0x5bd8df5
push 0x40
add esi, eax
neg ecx
add esi, eax
mov dword [0x4ad927], 0xdd6b6bd
xor edx, edx
neg eax
fdiv dword [ebx]
fld dword [ebx]
invalid
inc edx
xor edi, eax
sub ecx, dword [0x4ac324]
or dword [0x4adafc], ecx
xor ebx, esi
rol eax, 5
xor esi, eax
or dword [0x4ad940], ecx
xor dword [0x4ad824], edi
sub esi, eax
xor ecx, dword [0x4acd44]
xor dword [0x4ad6fa], ecx
push 0x3000
xor esi, eax
invalid

Function at 0x44aeb0
Capabilities:
Allocate or change rwx memory

Disassembly:
sti
dec dword [ecx + 0x4ad7f03d]
add byte [ebx], dh
sbb eax, 0x4ac26a

Function at 0x44ba8d
Capabilities:
Delete file

Disassembly:
invalid
jp 0x44ba7a
sub ecx, esi
add esi, dword [edi - 0x5836b76d]
mov esi, 0x5cc50375
or bh, al
mov esp, 0x35cf4893
fild word [ebp + 0x7893e703]
imul ebx, dword [edi + eax*8], 8
mov edi, 0xfb4093bc
jns 0x44bb20
adc eax, 0x45f4a96f
add edi, dword [edi - 0x7f56bf6d]
jecxz 0x44bafe
xchg ebx, eax
inc eax
test eax, 0x7a3de380
pop edx
jp 0x44bb1d
pop ecx
aad 0xca
enter 0xffffffffffffcceb, 0x7a
jmp 0x44baf7
jl 0x44bb59
mov eax, 0x9e3600b8
mov al, 0xe7
jbe 0x44babd
pushal
jnp 0x44babb
movsb byte es:[edi], byte [esi]
jl 0x44ba84
mov esi, 0xbee232e9
loop 0x44bae0
xor esi, dword [edx - 0x140f4b23]
iretd
cmp byte [ebx - 0x3a5b05fd], 0x79
dec eax
add edi, edx
movsb byte es:[edi], byte [esi]
lds edi, [ecx + 0x48]
cmpsb byte [esi], byte es:[edi]
or dh, dh
xor byte [eax + 0x7c], ah
ja 0x44bb57
in eax, dx
cmp eax, 0x7ea8d7ea
inc edi

Function at 0x44c0bc
Capabilities:
Decode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
mov edi, edx
cmp esi, 0xffffffff
jne 0x44c0d8
mov ecx, dword [ebp + 8]
call fcn.0044ccce
mov esi, eax
push 0
push 0
push edi
push ebx
push 1
push esi
push dword [ebp + 8]
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
test eax, eax
jne 0x44c100
xor ecx, ecx
call fcn.0044cca7
cmp eax, 0xea
jne 0x44c102
mov dword [edi], esi
jmp 0x44c102
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x44c1d1
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
and dword [ebp - 8], 0
lea eax, [ebp - 0xc]
and dword [ebp - 0xc], 0
push esi
push edi
push 0xf0000000
push 0x18
push 0
push 0
push eax
mov edi, edx
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x44c20d
xor ecx, ecx
call fcn.0044cca7
jmp 0x44c2ed
lea eax, [ebp - 8]
push eax
push 0
push 0
push edi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x44c231
xor ecx, ecx
call fcn.0044cca7
mov edi, eax
jmp 0x44c2e0
push 0
push 0x2000000
push 3
push 0
push 1
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x10], esi
cmp esi, 0xffffffff
je 0x44c2c6
push 0xd
pop edi
jmp 0x44c278
cmp dword [ebp - 4], 0
je 0x44c2a6
push 0
push dword [ebp - 4]
lea eax, [ebp - 0x410]
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x44c297
push 0
lea eax, [ebp - 4]
push eax
push 0x400
lea eax, [ebp - 0x410]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x44c259
jmp 0x44c2cf
xor ecx, ecx
call fcn.0044cca7
mov edi, eax
test edi, edi
jne 0x44c2cf
jmp 0x44c2a8
xor edi, edi
mov eax, dword [ebp + 0xc]
push 0
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push 2
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
jne 0x44c2cf
xor ecx, ecx
call fcn.0044cca7
mov edi, eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
lea ecx, [ebp - 0x10]
call fcn.0043bb32
push 0
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x44c2f1
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
push 0xf0000000
xor ebx, ebx
mov dword [ebp - 8], edx
push 0x18
push ebx
push ebx
lea eax, [ebp - 0xc]
mov dword [ebp - 4], ebx
push eax
mov edi, ecx
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x44c326
xor ecx, ecx
call fcn.0044cca7
jmp 0x44c3a5
push esi
lea eax, [ebp - 4]
mov esi, ebx
push eax
push ebx
push ebx
push dword [ebp + 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x44c34a
xor ecx, ecx
call fcn.0044cca7
mov esi, eax
jmp 0x44c398
push ebx
push dword [ebp - 8]
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x44c369
xor ecx, ecx
call fcn.0044cca7
mov esi, eax
test esi, esi
jne 0x44c38f
mov eax, dword [ebp + 0x10]
push ebx
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
push 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
jne 0x44c38f
xor ecx, ecx
call fcn.0044cca7
mov esi, eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push ebx
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, esi
pop esi
pop edi
pop ebx
leave
ret

Function at 0x44c3e8
Capabilities:
Check if file exists
Get file attributes
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, edx
mov dword [ebp - 4], eax
push edi
mov edi, ecx
test eax, eax
jne 0x44c403
mov eax, 0x10da
jmp 0x44c489
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x44c425
test bl, 1
je 0x44c425
mov ecx, ebx
and ecx, 0xfffffffe
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor esi, esi
push esi
push 0x2000080
push 2
push esi
push esi
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x44c46f
push esi
lea ecx, [ebp + 8]
push ecx
push dword [ebp + 8]
push dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x44c464
xor ecx, ecx
call fcn.0044cca7
mov esi, eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x44c478
xor ecx, ecx
call fcn.0044cca7
mov esi, eax
cmp ebx, 0xffffffff
je 0x44c485
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, esi
pop esi
pop ebx
pop edi
leave
ret
Function at 0x44c539
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push ecx
lea ecx, [ebp - 4]
call fcn.0043c2b8
mov esi, dword [ebp - 4]
mov eax, dword [esi - 0xc]
test eax, eax
jne 0x44c558
push 0x57
pop edi
jmp 0x44c5d0
dec eax
lea ecx, [ebp - 4]
push eax
call fcn.0043b8a7
push 0x5c
pop edi
cmp ax, di
je 0x44c58b
push edi
push esi
call dword [sym.imp.msvcrt.dll_wcsrchr]
pop ecx
pop ecx
test eax, eax
jne 0x44c57d
or eax, 0xffffffff
jmp 0x44c581
sub eax, esi
sar eax, 1
inc eax
lea ecx, [ebp - 4]
push eax
call fcn.0043d882
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_PathSkipRootW]
jmp 0x44c5c1
xor eax, eax
push eax
push esi
mov word [ebx], ax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x44c5ba
xor ecx, ecx
call fcn.0044cca7
mov edi, eax
cmp edi, 0xb7
jne 0x44c5d0
push 0x5c
pop edi
mov word [ebx], di
lea eax, [ebx + 2]
push edi
push eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov ebx, eax
test ebx, ebx
jne 0x44c595
xor edi, edi
lea ecx, [esi - 0x10]
call fcn.0043d912
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x44c656
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, edx
mov edi, ecx
xor ebx, ebx
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.0043b514
push 0x540
mov ecx, esi
call fcn.0043b9dd
mov eax, dword [esi]
lea ecx, [ebp - 4]
push ebx
push ecx
mov ecx, esi
push dword [eax - 8]
call fcn.0043bbd1
push eax
push ebx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
jmp 0x44c6c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x44c6e6
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax - 8]
add eax, 0x480
push eax
call fcn.0043b9dd
mov eax, dword [esi]
lea ecx, [ebp - 4]
push 0
push ecx
mov ecx, esi
push dword [eax - 8]
call fcn.0043bbd1
push eax
push 0
push 0
push 0x70050
push edi
call ebx
test eax, eax
je 0x44c695
push dword [ebp - 4]
mov ecx, esi
call fcn.0043b549
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
test eax, eax
jne 0x44c6e1
mov eax, 0x65b
jmp 0x44c6e1
Function at 0x44c9c5
Capabilities:
Access pe header
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor ebx, ebx
mov edi, ecx
push ebx
push ebx
push ebx
push 2
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push ebx
push ebx
push ebx
push 4
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
je 0x44ca64
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
lea edi, [esi + eax]
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov ecx, eax
test ecx, ecx
je 0x44ca58
lea eax, [ecx + 0x18]
cmp eax, edi
jae 0x44ca58
movzx eax, word [ecx + 4]
mov edx, eax
mov dword [ebp - 4], 0x14c
cmp dx, word [ebp - 4]
je 0x44ca45
mov dword [ebp - 4], 0x200
cmp dx, word [ebp - 4]
je 0x44ca3c
mov edx, 0x8664
cmp ax, dx
jne 0x44ca58
push ecx
push dword [ecx + 0x88]
jmp 0x44ca49
push ecx
push dword [ecx + 0x78]
push ecx
mov edx, edi
mov ecx, esi
call fcn.0044c8cd
mov ebx, eax
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test ebx, ebx
setne bl
lea ecx, [ebp - 8]
call fcn.0043bb32
pop edi
pop esi
mov al, bl
pop ebx
leave
ret

Function at 0x44ca73
Capabilities:
Access pe header
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
push ebx
push 0x2000000
push 3
push ebx
push 5
push 0x80000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x44caa2
mov esi, 0xffff
jmp 0x44cb20
push edi
push ebx
push ebx
push ebx
push 2
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push ebx
push ebx
push ebx
push 4
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
mov esi, 0xffff
test edi, edi
je 0x44cb17
push edi
mov ebx, esi
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
test eax, eax
je 0x44cadb
movzx ebx, word [eax + 4]
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
movzx eax, bx
sub eax, 0x14c
je 0x44cb15
sub eax, 0x78
je 0x44cb11
sub eax, 0x3c
je 0x44cb0d
sub eax, 0x8464
je 0x44cb08
sub eax, 0x2400
jne 0x44cb17
push 0xc
jmp 0x44cb0a
push 9
pop esi
jmp 0x44cb17
push 6
jmp 0x44cb0a
push 5
jmp 0x44cb0a
xor esi, esi
lea ecx, [ebp - 4]
call fcn.0043bb32
pop edi
lea ecx, [ebp - 8]
call fcn.0043bb32
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x44cd5b
Capabilities:
Get process heap force flags

Disassembly:
mov eax, dword fs:[0x18]
mov ecx, dword [eax + 0x30]
mov eax, dword [ecx + 0xa4]
shl eax, 0x10
or eax, dword [ecx + 0xa8]
ret
Function at 0x44ce4d
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 0x10]
push ebx
push esi
push 0x204020
push 7
push eax
push ecx
push 0x100000
lea eax, [ebp - 8]
mov ebx, edx
push eax
call dword [sym.imp.ntdll.dll_NtOpenFile]
mov esi, eax
test esi, esi
jne 0x44cebb
test ebx, ebx
je 0x44ce94
push 5
push 0x18
push ebx
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov esi, eax
test esi, esi
jne 0x44ceb0
cmp dword [ebp + 8], 0
je 0x44ceb0
push 6
push 8
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov esi, eax
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, esi
pop esi
pop ebx
leave
ret 4

Function at 0x44cec1
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
lea eax, [ebp - 0x14]
push ebx
push esi
push edi
push 0x4021
push 7
push eax
lea eax, [ebp + 8]
push eax
push 0x100001
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ntdll.dll_NtOpenFile]
mov ebx, eax
test ebx, ebx
jne 0x44d007
xor edi, edi
mov dword [ebp - 0xc], eax
push edi
push edi
push 0xff
push 2
push 0x248
lea ecx, [ebp - 0xc]
mov dword [ebp + 0x10], ecx
lea eax, [ebp - 0x21c]
lea ecx, [ebp - 0x260]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push ecx
lea ecx, [ebp - 0x14]
mov dword [ebp + 0xc], eax
push ecx
push edi
push edi
push edi
push eax
jmp 0x44cfee
mov eax, dword [ebp - 0x224]
mov edx, dword [ebp - 0x228]
mov word [ebp - 0xa], ax
mov word [ebp - 0xc], ax
test dl, 0x10
je 0x44cf94
test edx, 0x400
je 0x44cf60
test dword [ebp - 0x220], 0x20000000
jne 0x44cf94
jmp 0x44cf71
mov edx, eax
lea ecx, [ebp - 0x21c]
call fcn.0044cd96
test al, al
jne 0x44cfcf
sub esp, 0x18
lea esi, [ebp + 8]
push 6
pop ecx
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.0044cec1
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x44cfcb
mov edx, dword [ebp - 0x228]
xor edi, edi
test dl, 1
je 0x44cfaa
xor edx, 1
lea ecx, [ebp + 8]
call fcn.0044d440
mov esi, eax
test esi, esi
jne 0x44cfcb
lea ecx, [ebp + 8]
call fcn.0044d2c9
mov esi, eax
test esi, esi
je 0x44cfcf
mov edx, dword [ebp - 0x228]
test dl, 1
je 0x44cfcb
lea ecx, [ebp + 8]
call fcn.0044d440
mov ebx, esi
xor edi, edi
push edi
push edi
push 0xff
push 2
push 0x248
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
push edi
push edi
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_ZwQueryDirectoryFile]
test eax, eax
je 0x44cf31
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret