joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4442b0
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push 0
push 0x80
push 3
push 0
push 1
push 0xc0000000
lea eax, [ebp + 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [esp + 0x10], esi
cmp esi, 0xffffffff
jne 0x4442ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
pop ebp
pop ecx
ret 4
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x44431a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
pop ecx
ret 4
test edi, edi
jne 0x444338
push esi
mov dword [esp + 0x10], 0x54f
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
pop ecx
ret 4
push ebx
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, dword [esp + 0x18]
xor ebx, ebx
push ebx
lea ecx, [esp + 0x14]
push ecx
mov esi, eax
push edi
push esi
push edx
mov dword [ebp + 4], esi
mov dword [ebp + 0x434], esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x444377
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x444399
cmp dword [esp + 0x10], edi
je 0x444384
mov ebx, 0x1e
jmp 0x444399
xor eax, eax
test edi, edi
jbe 0x444399
lea ebx, [ebx]
xor byte [eax + esi], 0x67
inc eax
cmp eax, edi
jb 0x444390
mov dword [esp + 0x10], ebx
test ebx, ebx
jne 0x444413
mov esi, dword [ebp + 4]
mov eax, edi
shr eax, 1
test esi, esi
je 0x4443e9
cmp eax, 0x7fffffff
ja 0x4443e9
mov edx, eax
mov ecx, esi
test eax, eax
je 0x4443d4
jmp 0x4443c0
cmp word [ecx], 0
je 0x4443d0
add ecx, 2
sub edx, 1
jne 0x4443c0
jmp 0x4443d4
test edx, edx
jne 0x4443e5
mov ebx, 0x80070057
xor eax, eax
mov ecx, ebx
test ebx, ebx
jl 0x4443ee
add eax, eax
jmp 0x4443f0
sub eax, edx
jmp 0x4443db
mov ecx, 0x80070057
xor eax, eax
test ecx, ecx
jl 0x444413
add eax, 2
lea ecx, [eax + 4]
cmp ecx, edi
ja 0x444413
mov edx, dword [esi + eax]
sub edi, eax
lea ecx, [esi + eax + 4]
sub edi, 4
mov dword [ebp + 0x14], edx
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x10], edi
mov esi, dword [esp + 0x18]
pop ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
pop ecx
ret 4
Function at 0x4445d0
Capabilities:
Check if file exists
Create directory
Get file attributes
Link many functions at runtime

Disassembly:
push esi
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RtlNtStatusToDosError
push eax
mov dword [0x512d08], eax
call esi
mov dword [0x512d0c], eax
mov eax, dword [0x512d08]
push str.ZwQueryInformationFile
push eax
call esi
mov ecx, dword [0x512d08]
push str.ZwCreateFile
push ecx
mov dword [0x512d1c], eax
call esi
mov edx, dword [0x512d08]
push str.RtlInitUnicodeString
push edx
mov dword [0x512d14], eax
call esi
mov dword [0x512d10], eax
mov eax, dword [0x512d08]
push str.ZwSetInformationFile
push eax
call esi
mov ecx, dword [esp + 8]
mov dword [0x512d18], eax
push ecx
mov eax, SysReAllocString
mov ecx, 0x104
mov edx, 0x512b00
call fcn.00442860
pop esi
test eax, eax
jge 0x444669
xor edx, edx
mov word [0x512b00], dx
lea eax, [edx + 0x57]
ret
push 0x512b00
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x444690
push 0
push 0x512b00
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x444690
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
ret

Function at 0x4448b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x210
mov eax, dword [0x4ff0f4]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push esi
push ebx
xor esi, esi
call ebp
cmp eax, 0xffffffff
jne 0x4449e1
push edi
mov esi, 3
mov dword [esp + 0xc], 0
test ebx, ebx
je 0x444908
lea edi, [esp + 0xc]
mov ecx, 0x104
mov edx, ebx
call fcn.00442820
test eax, eax
jl 0x44490d
mov ecx, dword [esp + 0xc]
add ecx, ecx
jmp 0x44490f
mov eax, 0x80070057
xor ecx, ecx
test eax, eax
jne 0x444923
shr ecx, 1
je 0x444923
cmp word [ebx + ecx*2], 0x5c
je 0x44493d
sub ecx, 1
jne 0x444917
pop edi
mov eax, esi
pop esi
pop ebp
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.004a974c
add esp, 0x210
ret
lea edi, [ebx + ecx*2]
test edi, edi
je 0x444923
lea eax, [esp + 0x10]
mov esi, 0x512b00
mov ecx, eax
mov edx, 0x104
sub esi, ecx
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x444976
movzx ecx, word [esi + eax]
test cx, cx
je 0x444976
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x444956
jmp 0x44497a
test edx, edx
jne 0x44497d
sub eax, 2
xor edx, edx
push edi
lea esi, [esp + 0x14]
mov word [eax], dx
call fcn.004427e0
mov eax, esi
push eax
call ebp
cmp eax, 0xffffffff
je 0x4449c4
mov ecx, esi
push ecx
mov eax, SysReAllocString
mov ecx, 0x104
mov edx, ebx
call fcn.00442860
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.004a974c
add esp, 0x210
ret
pop edi
pop esi
mov eax, 3
pop ebp
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.004a974c
add esp, 0x210
ret
mov ecx, dword [esp + 0x214]
mov eax, esi
pop esi
pop ebp
xor ecx, esp
call fcn.004a974c
add esp, 0x210
ret
Function at 0x445600
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x680
mov eax, dword [0x4ff0f4]
xor eax, esp
mov dword [esp + 0x67c], eax
mov eax, dword [esp + 0x684]
push ebx
push ebp
push esi
mov dword [esp + 0x10], eax
lea eax, [esp + 0x274]
mov esi, 0x512b00
mov ecx, eax
push edi
mov edx, 0x104
sub esi, ecx
jmp 0x445640
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x445660
movzx ecx, word [esi + eax]
test cx, cx
je 0x445660
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x445640
jmp 0x445664
test edx, edx
jne 0x445667
sub eax, 2
xor edx, edx
mov word [eax], dx
lea edi, [esp + 0x10]
mov ecx, 0x104
lea edx, [esp + 0x278]
call fcn.00442820
test eax, eax
jl 0x4456a6
mov eax, dword [esp + 0x10]
mov ecx, 0x104
sub ecx, eax
lea edx, [esp + eax*2 + 0x278]
push str..Q
mov eax, SysReAllocString
call fcn.00442860
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x27c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x445765
mov edi, dword [sym.imp.RPCRT4.dll_UuidFromStringW]
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov ecx, 0x104
lea eax, [esp + 0x54]
lea esp, [esp]
cmp word [eax], 0
je 0x4456f0
add eax, 2
sub ecx, 1
jne 0x4456e0
jmp 0x44574e
test ecx, ecx
je 0x44574e
mov eax, 0x104
sub eax, ecx
add eax, eax
shr eax, 1
sub eax, 4
lea esi, [eax + eax]
push esi
lea edx, [esp + 0x5a]
push edx
lea eax, [esp + 0x488]
push eax
call fcn.004ac5e0
add esp, 0xc
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x484]
xor ecx, ecx
push eax
mov word [esp + esi + 0x488], cx
call edi
test eax, eax
jne 0x44574e
mov ecx, dword [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.004050d0
add esp, 8
test al, al
je 0x445765
lea eax, [esp + 0x28]
push eax
push ebx
call ebp
test eax, eax
jne 0x4456d0
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x68c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.004a974c
add esp, 0x680
ret
Function at 0x445ef0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4cddb4
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4ff0f4]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x34]
mov ebp, dword [esp + 0x30]
xor esi, esi
mov dword [esp + 0x18], esi
cmp dword [ebp], esi
jne 0x445f2f
call fcn.00445960
mov eax, dword [ebp + 4]
cmp eax, esi
jne 0x445f3b
call fcn.00445960
push eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x34], esi
call fcn.0049fd1f
add esp, 4
cmp eax, 6
jne 0x446028
jmp 0x445f60
cmp dword [esp + 0x14], 0x3e8
jg 0x446028
cmp dword [esp + 0x30], 3
jg 0x446028
push esi
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 8
mov edi, eax
call fcn.004aa724
mov esi, eax
add esp, 4
mov dword [esp + 0x1c], esi
mov dword [esp + 0x28], 1
test esi, esi
je 0x445fb6
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [esi], edi
mov dword [esi + 4], eax
jmp 0x445fb8
xor esi, esi
mov byte [esp + 0x28], 0
mov eax, dword [ebp]
push esi
push 0x4457a0
push eax
call fcn.0047b448
add esp, 0xc
nop
push 1
push 0x1388
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
cmp eax, 0xc0
je 0x445fd0
test eax, eax
je 0x445fed
inc dword [esp + 0x30]
mov ecx, dword [ebp]
push 0
push 0
push ecx
call fcn.0047b448
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp + 4]
inc dword [esp + 0x14]
push edx
call fcn.004938fe
mov eax, dword [ebp + 4]
push eax
call fcn.0049fd1f
add esp, 8
xor esi, esi
cmp eax, 6
je 0x445f60
cmp eax, 0x65
jne 0x446070
mov eax, dword [ebp + 4]
mov ecx, dword [ebp]
push eax
mov dword [ebx], ecx
mov dword [ebx + 4], eax
mov byte [ebx + 8], 1
call fcn.0045e238
add esp, 4
mov dword [ebx + 0xc], eax
mov byte [ebx + 0x10], 0
mov dword [esp + 0x28], esi
mov dword [esp + 0x18], 1
mov eax, ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 8
cmp eax, 0x64
mov eax, dword [ebp + 4]
push eax
jne 0x446096
mov edx, dword [ebp]
mov dword [ebx], edx
mov dword [ebx + 4], eax
mov byte [ebx + 8], 0
call fcn.0045e238
add esp, 4
mov dword [ebx + 0xc], eax
mov byte [ebx + 0x10], 0
jmp 0x44604c
call fcn.004938fe
mov ecx, dword [ebp]
push ecx
mov esi, eax
call fcn.00471beb
add esp, 8
push 0x4efe8c
lea edx, [esp + 0x34]
push edx
mov dword [esp + 0x38], esi
call fcn.004ac144
int3
Function at 0x4463d0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4cddb4
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4ff0f4]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
xor eax, eax
mov dword [esp + 0x18], eax
cmp dword [ebp], eax
jne 0x44640b
call fcn.00445960
mov dword [esp + 0x14], eax
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x38]
push eax
mov ebx, ebp
call fcn.004465b0
mov ebx, eax
push ebx
call fcn.0049fd1f
add esp, 4
cmp eax, 6
jne 0x446506
cmp dword [esp + 0x14], 0x3e8
jg 0x446506
cmp dword [esp + 0x30], 3
jg 0x446506
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 8
mov edi, eax
call fcn.004aa724
mov esi, eax
add esp, 4
mov dword [esp + 0x1c], esi
mov dword [esp + 0x28], 1
test esi, esi
je 0x44648c
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [esi], edi
mov dword [esi + 4], eax
jmp 0x44648e
xor esi, esi
mov byte [esp + 0x28], 0
mov ecx, dword [ebp]
push esi
push 0x4457a0
push ecx
call fcn.0047b448
add esp, 0xc
push 1
push 0x1388
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
cmp eax, 0xc0
je 0x4464a5
test eax, eax
je 0x4464c2
inc dword [esp + 0x30]
mov edx, dword [ebp]
push 0
push 0
push edx
call fcn.0047b448
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [esp + 0x14]
push ebx
call fcn.004938b0
mov eax, dword [esp + 0x3c]
add esp, 4
push eax
mov ebx, ebp
call fcn.004465b0
mov ebx, eax
push ebx
call fcn.0049fd1f
add esp, 4
cmp eax, 6
je 0x446433
push ebx
cmp eax, 0x65
jne 0x446553
mov ecx, dword [ebp]
mov esi, dword [esp + 0x38]
mov dword [esi], ecx
mov dword [esi + 4], ebx
mov byte [esi + 8], 1
call fcn.0045e238
add esp, 4
mov dword [esi + 0xc], eax
mov byte [esi + 0x10], 1
mov dword [esp + 0x28], 0
mov dword [esp + 0x18], 1
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0xc
cmp eax, 0x64
jne 0x446589
mov edx, dword [ebp]
mov esi, dword [esp + 0x38]
mov dword [esi], edx
mov dword [esi + 4], ebx
mov byte [esi + 8], 0
call fcn.0045e238
mov dword [esi + 0xc], eax
mov eax, 1
add esp, 4
mov byte [esi + 0x10], al
mov dword [esp + 0x28], 0
mov dword [esp + 0x18], eax
jmp 0x44653b
call fcn.004938b0
mov esi, eax
mov eax, dword [ebp]
push eax
call fcn.00471beb
add esp, 8
push 0x4efe8c
lea ecx, [esp + 0x3c]
push ecx
mov dword [esp + 0x40], esi
call fcn.004ac144
int3
Function at 0x446f90
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4cc10f
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4ff0f4]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea edi, [esi + 0x2c]
mov dword [esi], vtable.ServiceWrapper.0
mov ebp, 7
xor ebx, ebx
xor eax, eax
mov dword [edi + 0x18], ebp
mov dword [edi + 0x14], ebx
mov word [edi + 4], ax
mov dword [esp + 0x1c], ebx
mov eax, dword [esp + 0x2c]
push 0xffffffffffffffff
lea ecx, [esi + 0x48]
push ebx
xor edx, edx
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push eax
mov word [ecx + 4], dx
call fcn.004082a0
mov byte [esp + 0x1c], 1
mov eax, dword [esp + 0x30]
push 0xffffffffffffffff
lea ecx, [esi + 0x64]
push ebx
xor edx, edx
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push eax
mov word [ecx + 4], dx
call fcn.004082a0
mov byte [esp + 0x1c], 2
mov eax, dword [esp + 0x34]
push 0xffffffffffffffff
lea ecx, [esi + 0x80]
push ebx
xor edx, edx
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push eax
mov word [ecx + 4], dx
call fcn.004082a0
mov byte [esp + 0x1c], 3
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [esp + 0x28]
push 0xffffffffffffffff
push ebx
push ecx
mov ecx, edi
mov dword [esi + 0x28], eax
mov byte [esi + 0x24], bl
mov dword [0x512d20], esi
call fcn.004082a0
mov byte [esi + 0x24], bl
mov dword [esp + 0x1c], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x14

Function at 0x4471f0
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x4ff0f4]
xor eax, esp
mov dword [esp + 0x114], eax
cmp byte [esi + 0x24], 0
je 0x447223
mov al, 1
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.004a974c
add esp, 0x118
ret 4
cmp edi, 2
jne 0x447231
mov dword [esi + 0xc], 0
jmp 0x447272
push 0x114
lea eax, [esp + 4]
push 0
push eax
call fcn.004ac3b0
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x44726b
cmp dword [esp + 4], 6
jb 0x44726b
mov dword [esi + 0xc], 0x185
jmp 0x447272
mov dword [esi + 0xc], 0x85
mov edx, dword [esp + 0x11c]
mov dword [esi + 8], edi
mov dword [esi + 0x10], 0
mov dword [esi + 0x1c], edx
cmp edi, 4
je 0x4472a0
cmp edi, 1
je 0x4472a0
mov eax, dword [0x50148c]
inc eax
mov dword [0x50148c], eax
mov dword [esi + 0x18], eax
jmp 0x4472a7
mov dword [esi + 0x18], 0
mov ecx, dword [esi + 0x20]
lea eax, [esi + 4]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov ecx, dword [esp + 0x114]
test eax, eax
setne al
xor ecx, esp
call fcn.004a974c
add esp, 0x118
ret 4
Function at 0x447810
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4c9819
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebp
push esi
push edi
mov eax, dword [0x4ff0f4]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x3c]
xor ebp, ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x18], ebp
call fcn.004175c0
mov dword [esp + 0x34], ebp
push ebp
lea eax, [esp + 0x24]
push eax
push ebp
push ebx
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
mov eax, esi
je 0x4478a5
call fcn.00440b20
mov eax, dword [esi]
push ebp
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x1c], edi
mov eax, dword [eax]
push edi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x44789a
cmp dword [esp + 0x14], edi
je 0x4478a3
xor edi, edi
mov eax, esi
call fcn.00440b20
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x28
ret

Function at 0x4478c0
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push esi
xor esi, esi
xor ebp, ebp
push edi
test ebx, ebx
jb 0x447936
ja 0x4478d9
cmp esi, dword [esp + 0x20]
jae 0x44793a
mov ecx, dword [esp + 0x20]
sub ecx, esi
mov eax, ebx
sbb eax, ebp
test eax, eax
ja 0x4478f5
jb 0x4478f1
cmp ecx, 0x10000
jae 0x4478f5
mov edi, ecx
jmp 0x4478fa
mov edi, 0x10000
mov ecx, dword [esp + 0x1c]
push 0
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x20]
push edi
lea edx, [esi + ecx]
push edx
push eax
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x447936
mov eax, dword [esp + 0x10]
cmp eax, edi
jne 0x447936
add esi, eax
adc ebp, 0
cmp ebp, ebx
jb 0x4478d9
ja 0x447936
cmp esi, dword [esp + 0x20]
jb 0x4478d9
cmp esi, dword [esp + 0x20]
jne 0x447957
cmp ebp, ebx
jne 0x447957
or esi, ebp
je 0x44794f
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret

Function at 0x447a70
Capabilities:
Get file size

Disassembly:
sub esp, 0xc
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
lea eax, [esp]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x447a96
mov eax, dword [esp]
mov edx, dword [esp + 4]
add esp, 0xc
ret
or eax, 0xffffffff
or edx, 0xffffffff
add esp, 0xc
ret
Function at 0x447db0
Capabilities:
Get file size

Disassembly:
push 0xffffffffffffffff
push 0x4ca9e1
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x4ff0f4]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [esp + 0x34]
xor edi, edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x1c], edi
call fcn.004175c0
mov dword [esp + 0x2c], edi
lea eax, [esp + 0x14]
push eax
push ebx
mov dword [esp + 0x24], 1
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x447eae
mov ecx, dword [esp + 0x14]
mov edx, ecx
and edx, dword [esp + 0x18]
cmp edx, 0xffffffff
je 0x447eae
lea eax, [esp + 0x14]
push eax
call fcn.00447810
add esp, 4
mov ebx, eax
mov dword [esp + 0x2c], 1
mov edi, dword [esi]
add dword [edi + 8], 0xffffffff
jne 0x447e61
cmp dword [edi + 4], 0
je 0x447e61
mov eax, dword [edi]
push 0
push eax
call fcn.004aa29f
add esp, 8
mov dword [edi], eax
mov dword [edi + 4], 0
mov eax, dword [ebx]
inc dword [eax + 8]
mov dword [esi], eax
mov byte [esp + 0x2c], 0
mov edi, dword [esp + 0x14]
dec dword [edi + 8]
cmp dword [edi + 8], 0
lea eax, [edi + 8]
jne 0x447eae
cmp dword [edi + 4], 0
je 0x447e99
mov eax, dword [edi]
push 0
push eax
call fcn.004aa29f
add esp, 8
mov dword [edi], eax
mov dword [edi + 4], 0
mov ecx, dword [esp + 0x14]
push ecx
call fcn.004a9741
add esp, 4
mov dword [esp + 0x14], 0
mov eax, esi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x20
ret

Function at 0x449430
Capabilities:
Compare security identifiers

Disassembly:
push 0xffffffffffffffff
push 0x4c8448
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4ff0f4]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, dword [0x512a38]
xor esi, esi
cmp dword [edi], esi
je 0x449500
mov dword [esp + 0x10], esi
mov dword [esp + 0x20], esi
mov eax, dword [esp + 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esp + 0x14], esi
cmp eax, esi
je 0x449487
push eax
call ebx
mov dword [esp + 0x10], esi
mov edx, dword [esp + 0x28]
lea eax, [esp + 0x10]
push eax
push esi
push esi
push esi
lea ecx, [esp + 0x24]
push ecx
push 1
push 1
push edx
call dword [sym.imp.ADVAPI32.dll_GetSecurityInfo]
test eax, eax
jne 0x4494ed
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x4494ed
cmp dword [esp + 0x10], esi
je 0x4494ed
mov ecx, dword [edi]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x4494ed
mov dword [esp + 0x20], 0xffffffff
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x4494d6
push eax
call ebx
mov al, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 4
mov dword [esp + 0x20], 0xffffffff
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x449500
push eax
call ebx
xor al, al
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 4
Function at 0x449530
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4cc021
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4ff0f4]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x18], ebx
mov ecx, dword [esp + 0x2c]
call fcn.00405840
mov dword [esp + 0x24], ebx
lea eax, [esp + 0x14]
mov ebp, 1
push eax
mov edi, 0x400
mov dword [esp + 0x1c], ebp
call fcn.00418ca0
mov dword [esp + 0x24], ebp
mov ecx, dword [esp + 0x30]
mov esi, dword [esp + 0x14]
mov eax, dword [esi]
push ebp
push ecx
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4495de
mov edx, dword [esi]
cmp edx, ebx
jne 0x4495b9
mov ebp, dword [esp + 0x2c]
xor eax, eax
push eax
push edx
mov ecx, ebp
call fcn.004094e0
jmp 0x4495e2
mov eax, edx
lea edi, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4495c0
mov ebp, dword [esp + 0x2c]
sub eax, edi
sar eax, 1
push eax
push edx
mov ecx, ebp
call fcn.004094e0
jmp 0x4495e2
mov ebp, dword [esp + 0x2c]
mov byte [esp + 0x24], bl
add dword [esi + 8], 0xffffffff
jne 0x449600
xor edi, edi
call fcn.0041b910
push esi
call fcn.004a9741
add esp, 4
mov dword [esp + 0x14], ebx
mov eax, ebp
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x449800
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4cdbc2
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4ff0f4]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, ecx
push 0x4eade8
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], 0
call fcn.00405900
mov ebx, 1
mov dword [esp + 0x24], ebx
lea eax, [esp + 0x14]
lea ecx, [edi + 0x25c]
push eax
call fcn.00407dc0
mov byte [esp + 0x24], 0
lea ecx, [esp + 0x14]
call fcn.00405410
mov ebp, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp byte [edi + 8], 0
jne 0x4498a1
mov eax, dword [edi]
lea ecx, [edi + 0xc]
push ecx
push eax
mov byte [edi + 8], bl
call ebp
mov esi, eax
mov eax, dword [edi + 0x260]
cmp esi, eax
je 0x449896
cmp eax, 0xffffffff
je 0x449896
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [edi + 0x260], esi
cmp esi, 0xffffffff
jmp 0x4498b9
mov eax, dword [edi + 0x260]
cmp eax, 0xffffffff
je 0x4498d6
lea edx, [edi + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x4498d6
lea esi, [edi + 0x38]
call fcn.00447aa0
test al, al
jne 0x44986c
lea eax, [edi + 4]
push eax
lea ecx, [edi + 0x25c]
call fcn.00407dc0
mov esi, dword [esp + 0x2c]
add edi, 0xc
push edi
push esi
call fcn.00449910
mov dword [esp + 0x24], 0
mov dword [esp + 0x18], ebx
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4