joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425250
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
mov ecx, 0x502661
call fcn.004b99c5
cmp dword [edi + 0x38], 0
je 0x425287
push dword [ebp + 0x10]
mov ecx, edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004262a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], eax
test eax, eax
je 0x4252a9
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x4252ab
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test ebx, ebx
jl 0x42534a
jg 0x4252c8
test esi, esi
je 0x42534a
test ecx, ecx
jl 0x425315
jg 0x4252d2
test eax, eax
je 0x425315
cmp ebx, ecx
jg 0x4252e6
jl 0x4252dc
cmp esi, eax
jae 0x4252e6
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
push eax
push dword [esp + 0x18]
push dword [ebp + 8]
call fcn.0044af00
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [edi + 0x2c]
add edx, ecx
sub esi, ecx
mov dword [esp + 0xc], edx
sbb ebx, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x42531c
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
test ebx, ebx
jl 0x42534a
jg 0x425326
test esi, esi
je 0x42534a
cmp dword [edi + 0x4c], 0
je 0x42534a
mov ecx, edi
call fcn.00427060
push dword [edi + 0x4c]
push esi
push 1
push dword [esp + 0x18]
call fcn.00469b8e
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
pop edi
pop esi
sbb edx, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x425700
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x30
mov eax, dword [0x4fe280]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
push esi
mov esi, ecx
mov ecx, 0x502661
call fcn.004b99c5
mov ebx, dword [esp + 0x3c]
cmp ebx, 0xffffffff
jne 0x42573a
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.00448da0
add esp, 0x30
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x425777
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x425777
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.00448da0
add esp, 0x30
ret 4
cmp dword [esi + 0x4c], 0
je 0x425867
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x42579f
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4257d3
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.00468a1a
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.00448da0
add esp, 0x30
ret 4
lea eax, [esp + 0xc]
mov byte [esp + 0x17], bl
mov edx, dword [ecx]
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x2b]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x425867
cmp eax, 1
jle 0x425836
cmp eax, 3
jne 0x425867
mov edx, dword [esi + 0x4c]
mov cl, byte [esp + 0x17]
call fcn.00423f20
or ecx, 0xffffffff
test al, al
pop edi
cmovne ecx, ebx
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.00448da0
add esp, 0x30
ret 4
mov edi, dword [esp + 0xc]
lea eax, [esp + 0x18]
sub edi, eax
je 0x425855
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0046953e
add esp, 0x10
cmp edi, eax
jne 0x425867
lea eax, [esp + 0x17]
mov byte [esi + 0x3d], 1
cmp dword [esp + 0x10], eax
jne 0x425761
mov ecx, dword [esp + 0x38]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00448da0
add esp, 0x30
ret 4
Function at 0x4270d0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x28
mov eax, dword [0x4fe280]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
mov esi, ecx
mov ecx, 0x502661
push edi
call fcn.004b99c5
cmp dword [esi + 0x38], 0
je 0x427186
cmp byte [esi + 0x3d], 0
je 0x427186
mov eax, dword [esi]
mov ecx, esi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x427138
mov ecx, dword [esi + 0x38]
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x30]
push eax
mov edx, dword [ecx]
lea eax, [esp + 0x14]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x42714b
sub eax, 1
je 0x42714f
sub eax, 2
je 0x427186
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.00448da0
add esp, 0x28
ret
mov byte [esi + 0x3d], 0
mov edi, dword [esp + 8]
lea eax, [esp + 0xc]
sub edi, eax
je 0x42716e
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0046953e
add esp, 0x10
cmp edi, eax
jne 0x427138
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.00448da0
add esp, 0x28
ret
mov ecx, dword [esp + 0x2c]
mov al, 1
pop edi
pop esi
xor ecx, esp
call fcn.00448da0
add esp, 0x28
ret
Function at 0x42c020
Capabilities:
Get disk information

Disassembly:
push ebp
lea ebp, [esp - 0x804]
sub esp, 0x804
push 0xffffffffffffffff
push 0x4c3cf0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x4fe280]
xor eax, ebp
mov dword [ebp + 0x800], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov ecx, 0x5030e3
call fcn.004b99c5
lea eax, [ebp]
push eax
push 0x3fe
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov edi, eax
mov dword [ebp - 0x14], edi
test edi, edi
je 0x42c0f0
lea ecx, [ebp]
mov dword [ebp - 0x18], 0
xor esi, esi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], esi
cmp edi, 0x3fe
jbe 0x42c115
xor ecx, ecx
lea eax, [edi + 2]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004497e2
add esp, 4
mov dword [ebp - 0x10], eax
mov esi, eax
mov dword [ebp - 0x18], esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x42c0da
cmp eax, edi
ja 0x42c0da
mov ecx, esi
mov dword [ebp - 0x14], eax
xor edx, edx
mov dword [ecx + eax*2], edx
jmp 0x42c141
mov dword [ebp - 4], 0xffffffff
mov eax, esi
test eax, eax
je 0x42c0f0
push eax
call fcn.004494c5
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x800]
xor ecx, ebp
call fcn.00448da0
lea esp, [ebp + 0x804]
pop ebp
ret
add edi, edi
cmp edi, 0x800
jae 0x42c1e0
xor eax, eax
mov word [ebp + edi], ax
add edi, 2
cmp edi, 0x800
jae 0x42c1e0
mov word [ebp + edi], ax
mov eax, dword [ebp - 0x14]
xor edx, edx
xor edi, edi
test eax, eax
je 0x42c1c5
mov ecx, dword [ebp - 0x14]
mov eax, 2
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
cmp word [esi + eax - 2], 0
jne 0x42c1b7
cmp edx, edi
je 0x42c1b7
lea eax, [esi + edx*2]
push eax
lea ecx, [ebp - 0x34]
call fcn.00404530
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34]
mov eax, dword [ebx + 4]
push ecx
cmp dword [ebx + 8], eax
je 0x42c18c
mov ecx, eax
call fcn.00409b80
add dword [ebx + 4], 0x18
jmp 0x42c194
push eax
mov ecx, ebx
call fcn.00410470
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x34]
call fcn.004048c0
mov byte [ebp - 4], 0
lea eax, [ebp - 0x34]
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 0
lea edx, [edi + 1]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
inc edi
add eax, 2
mov dword [ebp - 0x1c], eax
cmp edi, ecx
jb 0x42c157
mov esi, dword [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x42c1d9
push esi
call fcn.004494c5
add esp, 4
mov al, 1
jmp 0x42c0f2
call fcn.004495f4
int3
Function at 0x42cde0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c40f8
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x4fe280]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, 0x5030e3
call fcn.004b99c5
cmp dword [esi + 8], 0
jne 0x42ce24
xor al, al
jmp 0x42cf05
push 4
lea ecx, [ebp - 0x14]
call fcn.004075f0
mov eax, dword [esi + 8]
add eax, 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], eax
je 0x42ce4d
mov eax, dword [eax]
test eax, eax
je 0x42ce4d
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 1
mov eax, dword [esi + 8]
cmp dword [eax + 4], 0
je 0x42ced8
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
lea edi, [esi + 4]
push 1
push edi
call ebx
mov eax, dword [esi + 8]
add eax, 0xc
push eax
push 4
push esi
push 0x42c5e0
push 0
push 0
call fcn.0046b1bf
mov ecx, dword [esi + 8]
add esp, 0x18
mov dword [ecx + 0x10], eax
mov eax, dword [esi + 8]
cmp dword [eax + 0x10], 0
je 0x42cebf
mov byte [eax + 8], 1
mov eax, dword [esi + 8]
mov ecx, dword [eax + 0x24]
test ecx, ecx
je 0x42cead
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [esi + 8]
push dword [eax + 0x10]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x42cebf
mov bl, 1
jmp 0x42ceda
push 0xffffffffffffffff
push edi
call ebx
sub eax, 1
jne 0x42ced0
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [esi + 8]
call fcn.0042c7b0
xor bl, bl
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x42cefc
mov eax, dword [eax]
test eax, eax
je 0x42cef5
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0xffffffff
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00448da0
mov esp, ebp
pop ebp
ret

Function at 0x42eb50
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, ecx
mov ecx, 0x5030e3
push edi
call fcn.004b99c5
mov ecx, dword [esi]
test ecx, ecx
je 0x42eb96
mov eax, dword [esp + 0xc]
test eax, eax
je 0x42eb96
mov ecx, dword [ecx]
cmp ecx, 0xffffffff
je 0x42eb96
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
push 0
push esi
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x42eb96
cmp edi, dword [esi]
jne 0x42eb96
pop edi
mov al, 1
pop esi
ret 0xc
pop edi
xor al, al
pop esi
ret 0xc
Function at 0x42ebe0
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x4fe280]
xor eax, esp
mov dword [esp + 4], eax
push esi
mov esi, ecx
mov ecx, 0x5030e3
push edi
mov edi, dword [esp + 0x14]
call fcn.004b99c5
mov eax, dword [esi]
test eax, eax
je 0x42ec4f
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x42ec4f
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x42ec2a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x42ec4f
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, esi
mov dword [edi], ecx
adc eax, 0
mov dword [edi + 4], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.00448da0
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.00448da0
add esp, 8
ret 4

Function at 0x432db0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x4fe280]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
mov ebp, ecx
mov dword [esp + 0xc], eax
push edi
mov edi, dword [esp + 0x20]
mov ecx, 0x5030e3
call fcn.004b99c5
mov esi, dword [esp + 0x24]
xor ebx, ebx
cmp dword [ebp + 0x10], 0xffffffff
je 0x432e32
mov ecx, 0x100000
nop dword [eax + eax]
cmp esi, 0x100000
mov dword [esp + 0x14], 0
push 0
mov eax, esi
cmova eax, ecx
lea ecx, [esp + 0x18]
push ecx
push eax
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x14]
add ebx, ecx
test eax, eax
je 0x432e32
test ecx, ecx
je 0x432e2e
add edi, ecx
sub esi, ecx
mov ecx, 0x100000
jne 0x432df0
xor eax, eax
jmp 0x432e37
mov eax, 1
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x432e41
mov dword [ecx], ebx
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00448da0
add esp, 0xc
ret 0xc
Function at 0x434c20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c6818
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4fe280]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, 0x5030e3
call fcn.004b99c5
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x434c60
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x434cf7
lea eax, [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 3
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], 4
lea edx, [ebp - 0x28]
mov ecx, edi
call fcn.004351b0
test al, al
je 0x434cd4
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
mov dword [ebp - 4], 5
lea ecx, [ebp - 0x28]
call fcn.004048c0
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00448da0
mov esp, ebp
pop ebp
ret
Function at 0x434d20
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c68d0
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x4fe280]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
mov ecx, 0x5030e3
call fcn.004b99c5
cmp dword [edi + 0x14], 8
mov ecx, edi
jb 0x434d63
mov ecx, dword [edi]
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x434d6d
mov eax, dword [esi]
mov ebx, dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0
push ecx
push eax
call ebx
test eax, eax
je 0x434d84
mov al, 1
jmp 0x434e8e
lea eax, [ebp - 0x40]
mov byte [ebp - 0x41], 0
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 4], 3
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
mov dword [ebp - 4], 4
lea edx, [ebp - 0x40]
mov ecx, esi
call fcn.004351b0
movzx ecx, byte [ebp - 0x41]
test al, al
mov edx, 1
lea eax, [ebp - 0x28]
cmovne ecx, edx
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x4c], eax
mov byte [ebp - 4], 5
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov byte [ebp - 4], 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 9
lea edx, [ebp - 0x28]
mov ecx, edi
call fcn.004351b0
test al, al
jne 0x434e2d
cmp byte [ebp - 0x48], al
je 0x434e51
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
push 0
cmovae ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
push ecx
cmovae eax, dword [ebp - 0x40]
push eax
call ebx
test eax, eax
je 0x434e51
mov bl, 1
jmp 0x434e53
xor bl, bl
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x28]
call fcn.004048c0
mov byte [ebp - 4], 4
lea eax, [ebp - 0x28]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 4], 0x16
lea ecx, [ebp - 0x40]
call fcn.004048c0
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x40]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 4], 0xffffffff
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00448da0
mov esp, ebp
pop ebp
ret
Function at 0x4356e0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c6bee
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x4fe280]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov ecx, 0x5030cf
call fcn.004b99c5
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [ebp - 4], 3
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov dword [ebp - 4], 4
lea eax, [esi + 0x18]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 5
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov byte [ebp - 4], 8
xor ecx, ecx
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 9
lea eax, [esi + 0x30]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 0xa
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov byte [ebp - 4], 0xd
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 0xe
mov dword [esi + 0x48], ecx
mov dword [esi + 0x4c], ecx
mov dword [esi + 0x50], ecx
mov dword [esi + 0x54], ecx
mov dword [esi + 0x58], ecx
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], ecx
mov byte [esi + 0x64], cl
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4372d0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c7288
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x4fe280]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ecx, 0x5030e3
mov edi, dword [ebp + 0xc]
call fcn.004b99c5
push esi
lea eax, [ebp - 0x30]
push eax
call fcn.00437a10
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
mov byte [ebp - 4], 1
mov dword [ebp - 0x18], 0
mov word [ebp - 0x14], 0
mov byte [ebp - 4], 2
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x18]
call fcn.00420d10
xorps xmm0, xmm0
movlpd qword [ebp - 0x3c], xmm0
mov byte [ebp - 4], 3
lea eax, [ebp - 0x18]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x18]
mov byte [ebp - 0x38], 0
test eax, eax
jne 0x437366
xor bl, bl
jmp 0x437384
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x43737e
cmp eax, 0x80
je 0x43737e
xor bl, bl
jmp 0x437384
mov byte [ebp - 0x14], 1
mov bl, 1
mov byte [ebp - 0x38], bl
mov byte [ebp - 4], 4
lea eax, [ebp - 0x31]
push eax
push edi
push esi
mov byte [ebp - 0x31], 0
call fcn.00437440
test al, al
jne 0x4373b2
cmp byte [ebp - 0x31], al
je 0x4373b2
cmp dword [esi + 0x14], 8
jb 0x4373ab
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], 5
test bl, bl
je 0x4373cc
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x4373c8
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [ebp - 0x14], 0
mov dword [ebp - 0x3c], 0
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x4373ec
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x18], 0
mov word [ebp - 0x14], 0
mov dword [ebp - 4], 7
lea ecx, [ebp - 0x30]
call fcn.004048c0
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00448da0
mov esp, ebp
pop ebp
ret 8
Function at 0x43b9d0
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x4fe280]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
mov esi, ecx
mov ecx, 0x5030e3
call fcn.004b99c5
push 0x110
lea eax, [esp + 0xc]
mov dword [esi + 4], 0
push 0
push eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov byte [esi], 0
mov dword [esp + 0x10], 0x114
call fcn.0044ba00
add esp, 0xc
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, esi
je 0x43ba71
cmp dword [esp + 8], 6
jb 0x43ba71
mov byte [esi], 1
mov ecx, dword [esp + 0x118]
pop esi
xor ecx, esp
call fcn.00448da0
add esp, 0x118
ret

Function at 0x43bad0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c81d0
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push esi
push edi
mov eax, dword [0x4fe280]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, 0x5030e3
call fcn.004b99c5
push str.wintrust.dll
lea ecx, [ebp - 0x2c]
call fcn.00404530
mov dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
push eax
call fcn.004305e0
mov ecx, eax
call fcn.004306d0
mov ebx, eax
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.004048c0
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
push str.crypt32.dll
call fcn.00404530
mov dword [ebp - 4], 5
lea eax, [ebp - 0x44]
push eax
call fcn.004305e0
mov ecx, eax
call fcn.004306d0
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x44]
call fcn.004048c0
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x44]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0xffffffff
test ebx, ebx
je 0x43bc17
test esi, esi
je 0x43bc17
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CryptCATAdminCalcHashFromFileHandle
push ebx
call esi
push str.CryptCATAdminAcquireContext
push ebx
mov dword [edi + 4], eax
call esi
push str.CryptCATAdminEnumCatalogFromHash
push ebx
mov dword [edi + 8], eax
call esi
push str.CryptCATCatalogInfoFromContext
push ebx
mov dword [edi + 0xc], eax
call esi
push str.CryptCATAdminReleaseCatalogContext
push ebx
mov dword [edi + 0x10], eax
call esi
push str.CryptCATAdminReleaseContext
push ebx
mov dword [edi + 0x14], eax
call esi
push str.WTHelperProvDataFromStateData
push ebx
mov dword [edi + 0x18], eax
call esi
push str.WTHelperGetProvSignerFromChain
push ebx
mov dword [edi + 0x1c], eax
call esi
push str.WinVerifyTrust
push ebx
mov dword [edi + 0x20], eax
call esi
push str.CertNameToStrW
push dword [ebp - 0x10]
mov dword [edi + 0x24], eax
call esi
mov dword [edi + 0x28], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43d350
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x4fe280]
xor eax, esp
mov dword [esp + 4], eax
push esi
mov esi, ecx
mov ecx, 0x5030e3
push edi
mov edi, dword [esp + 0x14]
call fcn.004b99c5
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x43d3c1
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x43d39c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x43d3c1
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, esi
mov dword [edi], ecx
adc eax, 0
mov dword [edi + 4], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.00448da0
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.00448da0
add esp, 8
ret 4