joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44be10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57a440
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5f6ea4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.005371e6
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.005340c2
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x44bfb0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57a440
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5f6ea4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.005371e6
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.005340c2
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44f140
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57aaa8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x5f6ea4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov al, byte [esi + 0xc0]
test al, al
je 0x44f2b6
cmp al, 2
jne 0x44f1d9
mov eax, dword [esi + 0xa0]
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0xa0]
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 0xa4]
mov edi, eax
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x10]
test ecx, ecx
jl 0x44f1b2
jg 0x44f1ab
cmp eax, 0x800000
jbe 0x44f1b2
mov eax, 0x800000
xor ecx, ecx
push 0
add edx, eax
lea eax, [ebp - 0x2c]
push eax
push 0
push 0
push 0x10
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], edx
push eax
push 0x980c8
push dword [esi]
adc edi, ecx
mov dword [ebp - 0x14], edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push 0
push 0
push dword [esi + 0xa4]
push dword [esi + 0xa0]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x44f2ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [ebp - 0x44]
call fcn.0044e430
push eax
mov edx, str.Cannot_set_file_pointer_4_._Code
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.004549c0
add esp, 4
lea ecx, [esi + 0x30]
push eax
call fcn.004499a0
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x44f260
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44f256
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44f2d5
push edx
push ecx
call fcn.00537216
add esp, 8
mov edx, dword [ebp - 0x30]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x44f2aa
mov ecx, dword [ebp - 0x44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44f2a0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44f2da
push edx
push ecx
call fcn.00537216
add esp, 8
xor al, al
jmp 0x44f2b8
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00536fd5
mov esp, ebp
pop ebp
ret 8
call fcn.00552cb1
call fcn.00552cb1
int3
Function at 0x4538d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x4539bb
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x4539aa
jg 0x453910
test edx, edx
je 0x4539aa
nop dword [eax]
call fcn.0044bbd0
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x453967
jg 0x453927
test esi, esi
je 0x453967
cmp ebx, eax
jg 0x453937
jl 0x453931
cmp edi, esi
jae 0x453937
mov esi, edi
mov dword [esp + 0x14], ebx
mov eax, dword [esp + 0xc]
push esi
mov eax, dword [eax + 0x1c]
push dword [eax]
push dword [esp + 0x18]
call fcn.0054eaf0
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x2c]
sub dword [eax], esi
mov eax, dword [ecx + 0x1c]
add dword [eax], esi
mov eax, dword [esp + 0x10]
jmp 0x45398c
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov ecx, eax
cmp ecx, 0xffffffff
je 0x4539a4
mov eax, dword [esp + 0x10]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
mov byte [eax], cl
mov ecx, dword [esp + 0xc]
add eax, esi
mov dword [esp + 0x10], eax
test ebx, ebx
jg 0x453910
jl 0x4539a4
test edi, edi
jne 0x453910
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x1c]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x4539dd
mov eax, dword [ecx + 0x2c]
mov eax, dword [eax]
jmp 0x4539df
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x453a95
jg 0x4539fa
test esi, esi
je 0x453a95
test eax, eax
jl 0x453a43
jg 0x453a04
test ebx, ebx
je 0x453a43
cmp edi, eax
jg 0x453a14
jl 0x453a0e
cmp esi, ebx
jae 0x453a14
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [esp + 0x14]
push dword [ebp + 8]
call fcn.0054eaf0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
add edx, ebx
sub esi, ebx
mov dword [esp + 0x10], edx
mov eax, dword [ecx + 0x2c]
sbb edi, dword [esp + 0x14]
sub dword [eax], ebx
mov eax, dword [ecx + 0x1c]
add dword [eax], ebx
jmp 0x453a4a
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test edi, edi
jl 0x453a95
jg 0x453a54
test esi, esi
je 0x453a95
mov edx, dword [ecx + 0x4c]
test edx, edx
je 0x453a95
mov ebx, dword [ecx + 0xc]
lea eax, [ecx + 0x3c]
cmp dword [ebx], eax
jne 0x453a80
mov edx, dword [ecx + 0x54]
mov ecx, dword [ecx + 0x50]
sub edx, ecx
mov dword [ebx], ecx
mov ebx, dword [esp + 0xc]
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov edx, dword [ebx + 0x4c]
push edx
push esi
push 1
push dword [esp + 0x1c]
call fcn.00553f8f
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4582d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57b650
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x5f6ea4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
cmp byte [0x5fd929], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
jne 0x45832d
lea eax, [ebp - 0x18]
xor ecx, ecx
push eax
lea edx, [ebp - 0x1c]
call fcn.00457e70
add esp, 4
mov bl, al
jmp 0x458392
mov byte [ebp - 0x14], 0
lea ecx, [ebp - 0x34]
push dword [ebp - 0x14]
call fcn.0045bf60
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 1
push eax
lea edx, [ebp - 0x1c]
lea ecx, [ebp - 0x34]
call fcn.004580e0
mov byte [ebp - 4], 0
add esp, 8
mov edx, dword [ebp - 0x20]
mov bl, al
cmp edx, 8
jb 0x458392
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x458388
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45846d
push edx
push ecx
call fcn.00537216
add esp, 8
test bl, bl
je 0x458472
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push 0
cmovae eax, dword [ebp + 8]
push 0
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x45841a
push 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp + 0x1c]
cmp edx, 8
jb 0x458416
mov ecx, dword [ebp + 8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x45840c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45848d
push edx
push ecx
call fcn.00537216
add esp, 8
mov al, 1
jmp 0x458452
mov edx, dword [ebp + 0x1c]
cmp edx, 8
jb 0x458450
mov ecx, dword [ebp + 8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x458446
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x458492
push edx
push ecx
call fcn.00537216
add esp, 8
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00536fd5
mov esp, ebp
pop ebp
ret
call fcn.00552cb1
push str.Cannot_read_tail
lea ecx, [ebp - 0x28]
call fcn.00447f50
push 0x5f3024
lea eax, [ebp - 0x28]
push eax
call fcn.0054fcdd
call fcn.00552cb1
call fcn.00552cb1
int3
Function at 0x45bfd0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57b930
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x5f6ea4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], ecx
mov edi, dword [ebp + 0xc]
mov esi, edi
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], eax
cmp dword [edi + 0x14], 8
mov eax, dword [edi + 0x10]
mov dword [ebp - 0x28], ecx
jb 0x45c021
mov esi, dword [edi]
lea ebx, [eax + eax]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x45c041
nop
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x45c030
mov ebx, dword [ebp - 0x1c]
mov ecx, dword [ebx + 0x18]
mov eax, dword [ebx + 0xc]
and ecx, edx
mov esi, dword [ebx + 4]
mov dword [ebp - 0x24], ecx
lea eax, [eax + ecx*8]
mov dword [ebp - 0x1c], eax
cmp esi, dword [eax]
je 0x45c0c1
mov esi, dword [eax + 4]
mov esi, dword [esi]
cmp esi, dword [eax]
je 0x45c0c1
mov esi, dword [esi + 4]
cmp dword [esi + 0x1c], 8
lea edx, [esi + 8]
mov eax, dword [edx + 0x10]
jb 0x45c076
mov edx, dword [edx]
cmp dword [edi + 0x14], 8
mov ecx, edi
jb 0x45c080
mov ecx, dword [edi]
cmp dword [edi + 0x10], eax
mov eax, dword [ebp - 0x1c]
jne 0x45c061
push dword [edi + 0x10]
call fcn.004546f0
add esp, 4
test eax, eax
mov eax, dword [ebp - 0x1c]
jne 0x45c061
mov eax, dword [ebp - 0x20]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00536fd5
mov esp, ebp
pop ebp
ret 0xc
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebx + 4]
push edi
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax + 4]
push ecx
push eax
mov dword [ebp - 0x18], ecx
call fcn.0044ccb0
mov edx, eax
mov ecx, 0x7fffffe
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x45c17c
inc eax
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x18]
mov dword [eax], edx
mov edi, dword [ebx + 4]
mov edi, dword [edi]
mov dword [ebp - 0x18], edi
mov eax, dword [edi]
cmp esi, eax
je 0x45c131
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
push dword [ebp - 0x24]
mov ecx, ebx
push esi
push edi
call fcn.0045c440
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.0045c3a0
mov eax, dword [ebp - 0x20]
mov dword [eax], edi
mov byte [eax + 4], 1
jmp 0x45c0a3
push str.list_T__too_long
call fcn.0053442e
int3
Function at 0x45c4c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x5f6ea4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
cmp dword [edi + 0x1c], 8
lea edx, [edi + 8]
mov ebx, dword [edx + 0x10]
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
jb 0x45c4ed
mov edx, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add ebx, ebx
je 0x45c509
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x45c4f8
mov ebx, dword [ebp - 8]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, esi
lea edx, [eax*8]
mov eax, dword [ecx + edx]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x45c542
cmp eax, edi
jne 0x45c53a
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x45c54a
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x45c54a
cmp eax, edi
jne 0x45c54d
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov ecx, dword [edi + 4]
mov esi, dword [edi]
push edi
mov dword [ecx], esi
mov edx, dword [edi]
mov ecx, dword [edi + 4]
mov dword [edx + 4], ecx
dec dword [ebx + 8]
call fcn.0044c150
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov dword [eax], esi
pop esi
pop ebx
call fcn.00536fd5
mov esp, ebp
pop ebp
ret 8
Function at 0x45c640
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57b9d0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x5f6ea4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, ecx
mov dword [ebp - 0x1c], eax
mov edi, dword [ebp + 0xc]
mov esi, edi
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [ebp - 0x28], eax
cmp dword [edi + 0x14], 8
mov ebx, dword [edi + 0x10]
mov dword [ebp - 0x20], ecx
jb 0x45c693
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
add ebx, ebx
je 0x45c6b4
nop
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x45c6a0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0x18]
mov eax, dword [eax + 0xc]
and ecx, edx
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 0x24], ecx
lea eax, [eax + ecx*8]
mov esi, dword [esi + 4]
mov dword [ebp - 0x18], eax
cmp dword [eax], esi
je 0x45c6d4
mov esi, dword [eax + 4]
mov esi, dword [esi]
mov ebx, dword [edi + 0x10]
cmp esi, dword [eax]
je 0x45c752
mov esi, dword [esi + 4]
cmp dword [esi + 0x1c], 8
lea edx, [esi + 8]
mov eax, dword [edx + 0x10]
jb 0x45c6ec
mov edx, dword [edx]
cmp dword [edi + 0x14], 8
mov ecx, edi
jb 0x45c6f6
mov ecx, dword [edi]
cmp ebx, eax
mov eax, dword [ebp - 0x18]
jne 0x45c6d7
push ebx
call fcn.004546f0
add esp, 4
test eax, eax
mov eax, dword [ebp - 0x18]
jne 0x45c6d7
mov edi, dword [ebp + 0x10]
push edi
mov ecx, dword [edi + 4]
mov eax, dword [edi]
mov dword [ecx], eax
mov edx, dword [edi]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [edi + 4]
mov dword [edx + 4], ecx
dec dword [eax + 8]
call fcn.0044c150
mov eax, dword [ebp - 0x20]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00536fd5
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x18], edi
mov eax, dword [edi]
cmp esi, eax
je 0x45c77f
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
push dword [ebp - 0x24]
mov ebx, dword [ebp - 0x1c]
mov ecx, ebx
push esi
push edi
call fcn.0045c440
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.0045c3a0
mov eax, dword [ebp - 0x20]
mov dword [eax], edi
mov byte [eax + 4], 1
jmp 0x45c734
Function at 0x45c930
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
mov eax, dword [0x5f6ea4]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
push edi
push 0
push 0
push 3
push 0
push 1
push SysReAllocString
push ecx
mov dword [esp + 0x3c], edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [esp + 0x24], edi
cmp edi, 0xffffffff
je 0x45cb48
lea eax, [esp + 0x28]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x45cb41
mov esi, dword [esp + 0x28]
mov eax, esi
or eax, dword [esp + 0x2c]
je 0x45cb41
push esi
call fcn.0055a8aa
mov ebx, eax
add esp, 4
mov dword [esp + 0x1c], ebx
test ebx, ebx
je 0x45cb41
push esi
push 0
push ebx
call fcn.0054f070
add esp, 0xc
mov dword [esp + 0x38], 0
lea eax, [esp + 0x38]
push 0
push eax
push dword [esp + 0x30]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x45cb41
mov ecx, dword [esp + 0x28]
xor edx, edx
cmp dword [esp + 0x38], ecx
jne 0x45cb41
mov eax, dword [esp + 0x2c]
cmp edx, eax
jne 0x45cb41
mov dword [esp + 0x14], edx
mov edi, ebx
test eax, eax
jl 0x45ca14
jg 0x45ca07
cmp ecx, 2
jbe 0x45ca14
mov eax, 0xfeff
cmp word [ebx], ax
jne 0x45ca14
lea edi, [ebx + 2]
push 0x5e222c
push edi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
mov ecx, eax
mov dword [esp + 0x18], ecx
test ecx, ecx
jne 0x45ca4e
push eax
push 2
push dword [esp + 0x34]
mov dword [esp + 0x20], 1
push dword [esp + 0x34]
call fcn.00579f70
mov ecx, dword [esp + 0x18]
add eax, eax
sub eax, edi
add eax, ebx
jmp 0x45ca52
mov eax, ecx
sub eax, edi
sar eax, 1
lea esi, [eax + eax]
test esi, esi
je 0x45cb07
cmp esi, 0x4000
ja 0x45cb07
lea ecx, [esi + 2]
call fcn.0045c900
mov ebx, eax
test ebx, ebx
je 0x45cb14
mov dword [esp + 0x10], 0
cmp dword [esp + 0x10], esi
jae 0x45caad
nop dword [eax + eax]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov al, byte [edx + edi]
mov byte [ecx + ebx], al
mov eax, dword [esp + 0x10]
inc eax
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], esi
jb 0x45ca90
shr esi, 1
xor eax, eax
cmp word [ebx + esi*2 - 2], 0xd
jne 0x45cac0
mov word [ebx + esi*2 - 2], ax
jmp 0x45cac4
mov word [ebx + esi*2], ax
push 0x10000
call fcn.005371e6
add esp, 4
mov dword [esp + 0x34], eax
lea ecx, [esi + 1]
push ecx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x34]
push eax
call fcn.0045cf70
push ebx
call fcn.0055297a
add esp, 4
cmp dword [esp + 0x14], 0
jne 0x45cb14
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
mov edi, ecx
add edi, 2
test ecx, ecx
jne 0x45ca14
push dword [esp + 0x1c]
call fcn.0055297a
add esp, 4
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00536fd5
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x3c]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00536fd5
mov esp, ebp
pop ebp
ret
Function at 0x45d060
Capabilities:
Enumerate disk volumes
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57ba0b
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x5f6ea4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x23c], ecx
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x21c], 0
nop dword [eax]
nop dword [eax + eax]
push 0x248
push 8
push dword [0x5ffb1c]
call edi
mov esi, eax
test esi, esi
je 0x45d0b0
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov dword [ebp - 0x240], eax
mov ebx, eax
nop dword [eax]
xor eax, eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x21c]
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
test eax, eax
je 0x45d114
cmp dword [ebp - 0x21c], 1
ja 0x45d210
xor eax, eax
mov dword [ebp - 0x224], 0
mov word [ebp - 0x234], ax
mov eax, esi
mov dword [ebp - 0x220], 7
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x45d136
sub eax, edx
lea ecx, [ebp - 0x234]
sar eax, 1
push eax
push esi
call fcn.0044b750
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x234]
cmp dword [ebp - 0x220], 8
mov edx, 3
cmovae ecx, dword [ebp - 0x234]
call fcn.0045e480
mov dword [ebp - 0x238], eax
mov byte [eax + 0x240], 1
mov eax, dword [ebp - 0x23c]
mov edi, dword [eax]
lea eax, [ebp - 0x238]
push eax
mov ebx, dword [edi + 4]
push ebx
push edi
call fcn.0045d040
mov ecx, dword [ebp - 0x23c]
mov edx, dword [ecx + 4]
mov ecx, 0x15555554
sub ecx, edx
cmp ecx, 1
jb 0x45d257
lea ecx, [edx + 1]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x23c]
mov dword [edx + 4], ecx
mov edx, dword [ebp - 0x220]
mov dword [edi + 4], eax
mov dword [ebx], eax
cmp edx, 8
jb 0x45d20a
mov ecx, dword [ebp - 0x234]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x45d200
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45d261
push edx
push ecx
call fcn.00537216
add esp, 8
mov ebx, dword [ebp - 0x240]
push 0x104
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
test eax, eax
jne 0x45d0e0
push ebx
call dword [sym.imp.KERNEL32.dll_FindVolumeClose]
push esi
push 0
push dword [0x5ffb1c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00536fd5
mov esp, ebp
pop ebp
ret
push str.list_T__too_long
call fcn.0053442e
call fcn.00552cb1
int3