joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43bee0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [esp + 0x4c]
mov esi, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
mov edi, dword [esp + 0x3c]
mov ebx, 0xfffffffe
nop
nop
nop
nop
cmp word [edi + ebx + 2], 0
lea ebx, [ebx + 2]
jne 0x43bf00
sar ebx, 1
mov ecx, ebx
and ecx, 2
mov ebp, ebx
or ebx, 2
imul ebx, ecx
xor ecx, 2
and ebp, 0xfffd
imul ebp, ecx
lea ecx, [ebx + ebp]
mov word [esp + 8], cx
lea ecx, [ebx + ebp]
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 0x40
lea eax, [esp + 8]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0xdcdddedf
mov byte [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xd0
xor cl, byte [esp + eax]
add cl, 0xf0
mov byte [esp + eax], cl
inc eax
cmp eax, 5
jne 0x43bf80
mov eax, dword [esp]
mov edi, dword [0x448588]
test edi, edi
je 0x43bfe5
xor ebx, ebx
mov ebp, dword [0x44858c]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp + ebx*8], 0x2df48de6
je 0x43bfc1
inc ebx
cmp edi, ebx
jne 0x43bfb0
jmp 0x43bfe5
mov edi, dword [ebp + ebx*8 + 4]
cmp edi, eax
je 0x43bfe5
lea eax, [esp + 0x10]
push esi
push eax
push edx
push dword [esp + 0x4c]
push 4
push edi
push dword [0x448590]
call fcn.00437d80
add esp, 0x1c
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402c80
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00403bb0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00403bb0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x402ce0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x408cb0]
test esi, esi
jle 0x402e00
mov eax, dword [0x408cb4]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x402d14
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x402d97
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x402d00
mov dword [esp], ebx
call fcn.00403640
mov edi, eax
test eax, eax
je 0x402e27
mov eax, dword [0x408cb4]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00403780
mov edx, dword [0x408cb4]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x402e07
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x402d90
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x402da0
add dword [0x408cb0], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x408cb4]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x402d90
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00402c80
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x402d1e
mov eax, dword [0x408cb4]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00402c80
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00402c80
lea esi, [esi]
nop
Function at 0x4032c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x408ccc
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x408cc4]
sub esp, 4
test ebx, ebx
je 0x403315
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40330e
test esi, esi
je 0x40330e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4032f0
mov dword [esp], 0x408ccc
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x403640
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x403665
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x403670
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x403665
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test esi, esi
je 0x4036b8
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x4036ae
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x4036ba
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x4036a0
xor eax, eax
pop ebx
pop esi
ret

Function at 0x43b65e
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], 0x43b3c1
pop edi
sub edx, eax
or edx, eax
call fcn.0043b6a6
add eax, edx
dec eax
push 0x7296e782
mov eax, dword [esp]
add esp, 4
xor dword [ebx], edi
or eax, edx
and eax, edx
sub eax, edx
inc ebx
push eax
pop edx
cmp ebx, ecx
jne fcn.0043b65e
mov edx, 0xe21e9579
mov eax, edx
mov eax, 0x1fe05c01
ret
Function at 0x437d50
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x8c], 1
jne 0x437ddd
xor eax, eax
cmp dword [edi + 0x60], 8
mov word [ebp - 4], ax
mov dword [ebp + 8], eax
lea eax, [edi + 0x4c]
jb 0x437d79
mov eax, dword [eax]
push str.rb__ccsUTF_8
push eax
lea eax, [ebp + 8]
push eax
call fcn.005c60fb
mov eax, dword [ebp + 8]
add esp, 0xc
test eax, eax
je 0x437ddd
push eax
push 2
lea eax, [ebp - 4]
push 1
push eax
call fcn.005c65d0
push dword [ebp + 8]
call fcn.005c61db
mov cl, byte [ebp - 4]
add esp, 0x14
mov al, byte [ebp - 3]
cmp cl, 0xff
jne 0x437dba
cmp al, 0xfe
je 0x437ddd
cmp al, 0xff
jne 0x437dc3
cmp cl, 0xfe
je 0x437ddd
mov eax, dword [ebx]
test eax, eax
je 0x437dd6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx], 0
mov ecx, edi
call fcn.00439340
cmp dword [edi + 0x60], 8
lea esi, [edi + 0x4c]
jb 0x437dea
mov eax, dword [esi]
jmp 0x437dec
mov eax, esi
push 0
push 0x80
push 3
push 0
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebx], eax
cmp eax, 0xffffffff
jne 0x437e84
cmp dword [esi + 0x14], 8
jb 0x437e14
mov esi, dword [esi]
push 0
push 0x80
push 1
push 0
push 3
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebx], eax
cmp eax, 0xffffffff
jne 0x437e3f
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [edi + 0x8c], 1
lea ecx, [ebp - 4]
push 0
push ecx
jne 0x437e6d
push 2
lea ecx, [ebp + 8]
mov dword [ebp + 8], 0xfeff
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
push 3
lea ecx, [ebp + 8]
mov word [ebp + 8], 0xbbef
push ecx
push eax
mov byte [ebp + 0xa], 0xbf
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x438430
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
lea ecx, [esi + 2]
nop
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x438440
push 2
push 0
push 0
push dword [ebx + 0x68]
sub esi, ecx
sar esi, 1
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
add esi, esi
push esi
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebx + 0x68]
call esi
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 4
push 0x6be048
push dword [ebx + 0x68]
call esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4384a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x4384b0
push 2
push 0
push 0
push dword [ebx + 0x68]
sub esi, ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push esi
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebx + 0x68]
call esi
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 2
push 0x6be050
push dword [ebx + 0x68]
call esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x43dcd0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x632c40
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x6f8b74]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.005b5266
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.005a2c0f
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x440fe0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, ecx
xor bl, bl
cmp dword [edi + 0x60], 8
lea esi, [edi + 0x4c]
mov dword [ebp - 0x10], edi
jb 0x440ffd
mov eax, dword [esi]
jmp 0x440fff
mov eax, esi
push 0
push 0x80
push 3
push 0
push 3
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
jne 0x44102b
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x44104a
mov eax, dword [ebp - 0x18]
mov bl, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
jmp 0x441056
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x4410ca
cmp dword [ebp - 4], 0
jl 0x4410ca
jg 0x441074
cmp dword [ebp - 8], 0xa00000
jb 0x4410ca
mov eax, dword [edi + 0x68]
add edi, 0x68
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x441087
push eax
call ebx
cmp dword [esi + 0x14], 8
jb 0x44108f
mov esi, dword [esi]
push 0
push 0x80
push 5
push 0
push 3
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [edi], eax
test eax, eax
je 0x4410b7
push eax
call ebx
mov dword [edi], 0
mov ecx, dword [ebp - 0x10]
push edi
mov eax, dword [ecx]
mov eax, dword [eax]
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x441ba0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
test esi, esi
je 0x441c03
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x441c03
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x441bd2
pop edi
shr eax, 4
pop esi
and al, 1
pop ebx
pop ebp
ret 4
push esi
call fcn.005d48cd
mov edi, eax
push 0x5c
push edi
call fcn.00631db2
add esp, 0xc
test eax, eax
je 0x441c21
xor ecx, ecx
mov word [eax], cx
mov ecx, ebx
push edi
call fcn.00441ba0
push edi
test al, al
jne 0x441c0c
call fcn.005c11be
add esp, 4
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 4
call fcn.005c11be
add esp, 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x441c03
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret 4
Function at 0x446db0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x633338
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x6f8b74]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
cmp dword [ebp + 0x20], 0x10
lea edx, [ebp + 0xc]
mov ebx, dword [ebp + 0x1c]
lea edi, [ebp + 0xc]
cmovae edx, dword [ebp + 0xc]
lea ecx, [ebp - 0x28]
add ebx, edx
mov dword [ebp - 4], 0
cmp dword [ebp + 0x20], 0x10
mov dword [ebp - 0x18], 0
cmovae edi, dword [ebp + 0xc]
xor eax, eax
mov word [ebp - 0x28], ax
mov eax, ebx
sub eax, edi
mov dword [ebp - 0x14], 7
push eax
call fcn.0043ea30
push dword [ebp - 0x30]
lea ecx, [ebp - 0x28]
push ebx
push edi
call fcn.004457c0
cmp dword [ebp - 0x14], 8
lea edx, [ebp - 0x28]
mov dword [ebp - 0x2c], 0
cmovae edx, dword [ebp - 0x28]
mov eax, edx
lea esi, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x446e50
sub eax, esi
lea ecx, [ebp - 0x2c]
push 0
sar eax, 1
push ecx
add eax, eax
push eax
push edx
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x446e9d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.IPC_Server_:_Failed_to_send_data.__d
push 0
push 2
push str.IPCXMLUtilityLog
push dword [0x703e30]
call fcn.004515c0
add esp, 0x18
xor bl, bl
jmp 0x446e9f
mov bl, 1
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x446ed5
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x446ecb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x446f37
push edx
push ecx
call fcn.005b5296
add esp, 8
mov edx, dword [ebp + 0x20]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 0x10
jb 0x446f19
mov ecx, dword [ebp + 0xc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x446f0f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x446f37
push edx
push ecx
call fcn.005b5296
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005b56fe
mov esp, ebp
pop ebp
ret
call fcn.005c116d
int3
Function at 0x4477f0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x6f8b74]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
lea ecx, [ebp - 0x88]
mov byte [ebp - 0x81], 1
push ecx
lea ecx, [ebp - 0x81]
mov dword [ebp - 0x70], 0
push ecx
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x6c], 0xf
push ecx
lea ecx, [ebp - 0x80]
mov byte [ebp - 0x80], 0
push ecx
push eax
push dword [ebp - 8]
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0xf
mov byte [ebp - 0x68], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0xf
mov byte [ebp - 0x50], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], 0
mov byte [ebp - 0x88], 1
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0xf
mov byte [ebp - 0x20], 0
call fcn.00447550
add esp, 0x18
mov byte [ebp - 0x8c], al
cmp byte [ebp - 0x81], 0
je 0x447912
push dword [ebp - 0x88]
lea eax, [ebp - 0x20]
sub esp, 0x18
mov ecx, esp
push eax
call fcn.0043a2e0
sub esp, 0x60
lea eax, [ebp - 0x80]
mov esi, esp
mov ecx, esi
push eax
call fcn.0043a2e0
lea eax, [ebp - 0x68]
push eax
lea ecx, [esi + 0x18]
call fcn.0043a2e0
lea eax, [ebp - 0x50]
push eax
lea ecx, [esi + 0x30]
call fcn.0043a2e0
lea eax, [ebp - 0x38]
push eax
lea ecx, [esi + 0x48]
call fcn.0043a2e0
push dword [ebp - 0x8c]
call fcn.00447400
mov ecx, eax
call fcn.004470d0
call fcn.00447400
call fcn.00447080
mov edx, dword [ebp - 0xc]
cmp edx, 0x10
jb 0x447942
mov ecx, dword [ebp - 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x447938
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44796f
push edx
push ecx
call fcn.005b5296
add esp, 8
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0xf
mov byte [ebp - 0x20], 0
call fcn.00446f40
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.005b56fe
mov esp, ebp
pop ebp
ret 0x10
call fcn.005c116d
int3
Function at 0x44bcb0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6346b9
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x6f8b74]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x703e60
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 5
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
lea ecx, [esi + 0x2c]
mov dword [esi], vtable.TiXmlDeclaration.0
mov dword [ebp - 4], 0
mov dword [ecx], 0x703e60
mov dword [esi + 0x30], 0x703e60
mov dword [esi + 0x34], 0x703e60
mov edi, dword [ebp + 8]
mov edx, edi
mov byte [ebp - 4], 3
lea ebx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x44bd51
sub edx, ebx
push edx
push edi
call fcn.00451770
mov edi, dword [ebp + 0xc]
mov edx, edi
lea ecx, [edx + 1]
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x44bd70
sub edx, ecx
lea ecx, [esi + 0x30]
push edx
push edi
call fcn.00451770
mov edi, dword [ebp + 0x10]
mov edx, edi
lea ecx, [edx + 1]
nop dword [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x44bd90
sub edx, ecx
lea ecx, [esi + 0x34]
push edx
push edi
call fcn.00451770
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x44bdc0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6346f3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x6f8b74]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x703e60
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [ebp - 4], 0
mov dword [ecx], 0x703e60
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
push 0
push 0x663ae1
mov byte [ebp - 4], 1
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], 0
mov byte [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.00451770
mov dword [esi + 0x40], 0
mov eax, esi
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44d1f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x634808
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x6f8b74]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x44d241
push ebx
push ebx
push ebx
push 2
call fcn.00450860
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov esi, dword [edi + 0x18]
test esi, esi
je 0x44d257
mov ecx, esi
mov esi, dword [esi + 0x28]
push 1
mov eax, dword [ecx]
call dword [eax]
test esi, esi
jne 0x44d248
push 2
push 0
push ebx
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 8], 0xffffffff
mov dword [edi + 4], 0xffffffff
call fcn.005c6961
push ebx
call fcn.005c7008
push 0
mov esi, eax
push 0
push ebx
mov dword [ebp - 0x14], esi
call fcn.005c6961
add esp, 0x1c
test esi, esi
jg 0x44d2be
push 0
push 0
push 0
push 0xd
mov ecx, edi
call fcn.00450860
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [ebp - 0x10], 0x703e60
push esi
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0
call fcn.00451850
lea eax, [esi + 1]
push eax
call fcn.005b52a4
push ebx
push 1
mov ebx, eax
mov dword [ebp + 8], eax
push esi
push ebx
mov byte [eax], 0
call fcn.005c65d0
add esp, 0x14
cmp eax, 1
je 0x44d317
push ebx
call fcn.005b52ad
add esp, 4
mov ecx, edi
push 0
push 0
push 0
push 2
call fcn.00450860
xor bl, bl
jmp 0x44d3b5
mov eax, dword [ebp - 0x14]
mov ecx, ebx
mov esi, ebx
mov byte [ebx + eax], 0
mov al, byte [ebx]
test al, al
je 0x44d37f
cmp al, 0xa
jne 0x44d340
mov eax, esi
sub eax, ecx
inc eax
push eax
push ecx
lea ecx, [ebp - 0x10]
call fcn.00451720
inc esi
mov ecx, esi
jmp 0x44d379
cmp al, 0xd
jne 0x44d378
mov eax, esi
sub eax, ecx
test eax, eax
jle 0x44d356
push eax
push ecx
lea ecx, [ebp - 0x10]
call fcn.00451720
push 1
lea eax, [ebp + 8]
mov byte [ebp + 8], 0xa
push eax
lea ecx, [ebp - 0x10]
call fcn.00451720
xor eax, eax
cmp byte [esi + 1], 0xa
sete al
inc eax
add esi, eax
mov ecx, esi
jmp 0x44d379
inc esi
mov al, byte [esi]
test al, al
jne 0x44d328
sub esi, ecx
je 0x44d38d
push esi
push ecx
lea ecx, [ebp - 0x10]
call fcn.00451720
push ebx
call fcn.005b52ad
mov eax, dword [ebp - 0x10]
add esp, 4
mov edx, dword [edi]
add eax, 8
mov ecx, edi
push dword [ebp + 0xc]
push 0
push eax
call dword [edx + 0xc]
cmp byte [edi + 0x2c], 0
je 0x44d3b3
xor bl, bl
jmp 0x44d3b5
mov bl, 1
mov ecx, dword [ebp - 0x10]
cmp ecx, 0x703e60
je 0x44d3c9
push ecx
call fcn.005b52ad
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8