joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43b9b0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov al, byte [0x805a6a]
sub esp, 8
test al, al
push esi
mov esi, dword [sym.imp.kernel32.dll_QueryPerformanceCounter]
jne 0x43ba07
push 0x805610
call esi
cmp eax, 1
jne 0x43b9f9
push 0x805588
call dword [sym.imp.kernel32.dll_QueryPerformanceFrequency]
mov eax, dword [0x805610]
mov ecx, dword [0x805614]
mov dword [0x805648], eax
mov dword [0x80564c], ecx
mov byte [0x805a6b], 1
jmp 0x43ba00
mov byte [0x805a6b], 0
mov byte [0x805a6a], 1
mov al, byte [0x805a6b]
test al, al
je 0x43ba4b
push 0x805610
call esi
mov edx, dword [0x805610]
mov esi, dword [0x805648]
mov eax, dword [0x805614]
mov ecx, dword [0x80564c]
sub edx, esi
pop esi
sbb eax, ecx
mov dword [esp], edx
mov dword [esp + 4], eax
fild qword [esp]
fild qword [0x805588]
fdivp st(1)
add esp, 8
ret
call dword [sym.imp.winmm.dll_timeGetTime]
mov dword [esp + 4], eax
mov dword [esp + 8], 0
fild qword [esp + 4]
pop esi
add esp, 8
ret

Function at 0x444970
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x73d850
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov esi, dword [esp + 0x34]
push edi
mov edi, ecx
mov al, byte [esi]
push 0
lea ecx, [esp + 0xc]
mov byte [esp + 0xc], al
call fcn.00404760
mov ecx, dword [0x76560c]
push ecx
push 0
push esi
lea ecx, [esp + 0x14]
call fcn.00404560
mov eax, dword [esp + 0x10]
mov dword [esp + 0x30], 0
test eax, eax
je 0x4449e7
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4449db
lea ecx, [esp + 8]
call fcn.0040ac20
mov eax, dword [esp + 0xc]
jmp 0x4449e0
mov eax, 0x765608
push eax
call dword [sym.imp.user32.dll_CharLowerA]
mov eax, dword [0x80563c]
mov ecx, dword [0x805640]
test eax, eax
jne 0x4449fb
mov eax, 0x765608
push ecx
push 0
push eax
lea ecx, [esp + 0x14]
call fcn.00427160
test eax, eax
jl 0x444a6a
mov edx, dword [0x76560c]
mov eax, dword [0x805640]
push edx
push eax
lea eax, [esp + 0x20]
lea ecx, [esp + 0x10]
push eax
call fcn.0040aa70
mov ecx, dword [0x76560c]
mov byte [esp + 0x30], 1
push ecx
push 0
push eax
lea ecx, [edi + 0x18]
call fcn.00404560
mov eax, dword [esp + 0x1c]
mov byte [esp + 0x30], 0
test eax, eax
je 0x444a80
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x444a5f
cmp al, 0xff
je 0x444a5f
dec al
mov byte [ecx], al
jmp 0x444a80
push ecx
call fcn.00726ea6
add esp, 4
jmp 0x444a80
mov edx, dword [0x76560c]
lea eax, [esp + 8]
push edx
push 0
push eax
lea ecx, [edi + 0x18]
call fcn.00404560
mov ecx, dword [esp + 0xc]
pop edi
test ecx, ecx
mov dword [esp + 0x2c], 0xffffffff
pop esi
je 0x444abd
mov al, byte [ecx - 1]
test al, al
je 0x444ab3
cmp al, 0xff
je 0x444ab3
dec al
mov byte [ecx - 1], al
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
dec ecx
push ecx
call fcn.00726ea6
add esp, 4
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
Function at 0x444ad0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x73d868
push eax
mov dword fs:[0], esp
sub esp, 0x18
xor eax, eax
push ebx
push ebp
push esi
push edi
lea ebp, [ecx + 8]
mov edi, 0x7c4d88
or ecx, 0xffffffff
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
mov ecx, ebp
push ebx
call fcn.00401450
test al, al
je 0x444b31
mov edi, dword [ebp + 4]
mov ecx, ebx
mov eax, ecx
mov esi, 0x7c4d88
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 4]
mov dword [ebp + 8], ebx
add eax, ebx
mov byte [eax], 0
mov eax, dword [esp + 0x38]
xor edi, edi
lea ecx, [esp + 0x14]
push edi
push ecx
lea edx, [esp + 0x18]
push 4
push edx
push eax
mov dword [esp + 0x28], edi
mov dword [esp + 0x24], edi
call dword [sym.imp.kernel32.dll_ReadFile]
mov eax, dword [esp + 0x10]
cmp eax, edi
jle 0x444c0c
mov cl, byte [esp + 0x38]
lea esi, [eax + 1]
cmp esi, edi
mov byte [esp + 0x18], cl
mov eax, esi
jge 0x444b72
xor eax, eax
push eax
call fcn.00726f70
add esp, 4
mov ebx, eax
cmp esi, edi
mov dword [esp + 0x1c], ebx
jbe 0x444b92
mov ecx, esi
cmp eax, edi
je 0x444b8e
mov byte [eax], 0
inc eax
dec ecx
jne 0x444b87
lea eax, [ebx + esi]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x38]
lea edx, [esp + 0x14]
push edi
push edx
push eax
push ebx
push ecx
mov dword [esp + 0x44], edi
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
mov ecx, ebp
push esi
mov dword [esp + 0x40], esi
call fcn.00401450
test al, al
je 0x444bfb
mov edi, dword [ebp + 4]
mov ecx, esi
mov edx, ecx
mov esi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], eax
mov ebp, dword [ebp + 4]
add ebp, eax
mov byte [ebp], 0
push ebx
mov dword [esp + 0x34], 0xffffffff
call fcn.00726ea6
add esp, 4
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 4
Function at 0x44a680
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x2c]
mov esi, ecx
push edi
call fcn.00444ad0
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x1c]
push 0x14
push ecx
push edi
mov dword [esp + 0x24], 0
call dword [sym.imp.kernel32.dll_ReadFile]
cmp byte [esp + 0x14], 0x4e
jne 0x44a6cc
cmp byte [esp + 0x15], 0x54
jne 0x44a6cc
cmp byte [esp + 0x16], 0x46
jne 0x44a6cc
cmp byte [esp + 0x17], 3
je 0x44a6e6
mov esi, dword [esi + 0x1c]
test esi, esi
jne 0x44a6d8
mov esi, 0x765608
push esi
push 0x7a4388
call fcn.00455190
add esp, 8
mov ebp, dword [esp + 0x20]
cmp ebp, 0x31545844
je 0x44a7df
cmp ebp, 0x32545844
je 0x44a7df
cmp ebp, 0x33545844
je 0x44a7df
cmp ebp, 0x34545844
je 0x44a7df
cmp ebp, 0x35545844
je 0x44a7df
xor edi, edi
cmp ebp, 0x19
je 0x44a74f
cmp ebp, 0x1a
je 0x44a74f
cmp ebp, 0x14
jne 0x44a73e
mov edi, 3
jmp 0x44a754
cmp ebp, 0x15
je 0x44a748
cmp ebp, 0x16
jne 0x44a754
mov edi, 4
jmp 0x44a754
mov edi, 2
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
xor ebx, ebx
test eax, eax
je 0x44a7ad
cmp ecx, 4
jl 0x44a7c3
cmp esi, 4
jl 0x44a7c3
mov edx, esi
mov eax, ecx
imul edx, ecx
imul edx, edi
add ebx, edx
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
mov eax, esi
cdq
sub eax, edx
sar eax, 1
cmp ecx, 4
mov esi, eax
jge 0x44a76b
mov eax, dword [esp + 0x2c]
push 1
push 0
push ebx
push eax
call dword [sym.imp.kernel32.dll_SetFilePointer]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x18
ret 4
imul edi, esi
imul edi, ecx
cmp ecx, 0x200
mov ebx, edi
jl 0x44a7c3
add ebx, 0x20000
mov eax, dword [esp + 0x2c]
push 1
push 0
push ebx
push eax
call dword [sym.imp.kernel32.dll_SetFilePointer]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x18
ret 4
mov eax, dword [esp + 0x24]
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
xor edi, edi
test eax, eax
mov ecx, ebx
je 0x44a870
cmp ebx, 4
jl 0x44a831
cmp esi, 4
jl 0x44a831
cmp ebp, 0x31545844
jne 0x44a813
mov eax, esi
imul eax, ecx
cdq
sub eax, edx
sar eax, 1
add edi, eax
jmp 0x44a81a
mov edx, esi
imul edx, ecx
add edi, edx
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
mov eax, esi
cdq
sub eax, edx
sar eax, 1
cmp ecx, 4
mov esi, eax
jge 0x44a7f8
mov eax, ebx
cdq
sub eax, edx
mov ecx, eax
mov eax, dword [esp + 0x1c]
cdq
sub eax, edx
mov esi, eax
sar ecx, 1
sar esi, 1
cmp ecx, 4
jl 0x44a89d
cmp esi, 4
jl 0x44a89d
mov eax, esi
imul eax, ecx
lea edi, [edi + eax*2]
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
mov eax, esi
cdq
sub eax, edx
sar eax, 1
cmp ecx, 4
mov esi, eax
jge 0x44a84a
jmp 0x44a89d
cmp ebp, 0x31545844
mov ecx, esi
jne 0x44a886
imul ecx, ebx
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
jmp 0x44a88c
imul ecx, ebx
lea eax, [ecx + ecx]
cmp ebx, 0x400
lea edi, [eax + ecx*2]
jl 0x44a89d
add edi, 0x20000
mov ecx, dword [esp + 0x2c]
push 1
push 0
push edi
push ecx
call dword [sym.imp.kernel32.dll_SetFilePointer]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x18
ret 4
Function at 0x44aba0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x30
push ebx
mov ebx, dword [esp + 0x38]
push ebp
push esi
mov eax, dword [ebx + 8]
push edi
test eax, eax
mov esi, ecx
jbe 0x44ad2c
mov eax, dword [esi + 0x48]
test eax, eax
je 0x44ad2c
mov eax, dword [ebx + 4]
mov dword [esp + 0x44], 0
test eax, eax
jne 0x44abd7
mov eax, 0x765608
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x44ad2c
mov eax, dword [ebx + 8]
mov ebp, dword [sym.imp.kernel32.dll_WriteFile]
lea ecx, [esp + 0x44]
push 0
push ecx
lea edx, [esp + 0x18]
push 4
push edx
push edi
mov dword [esp + 0x24], eax
call ebp
mov ecx, dword [esp + 0x10]
test ecx, ecx
jle 0x44ac3b
mov ebx, dword [ebx + 4]
mov eax, 0x765608
test ebx, ebx
je 0x44ac2f
mov eax, ebx
lea edx, [esp + 0x44]
push 0
push edx
push ecx
push eax
push edi
call ebp
mov eax, dword [esi + 0x48]
lea edx, [esp + 0x20]
push edx
push 0
mov ecx, dword [eax]
push eax
call dword [ecx + 0x38]
mov eax, dword [esp + 0x20]
mov edx, 0x19
cmp eax, edx
jne 0x44ad25
mov eax, dword [esp + 0x3c]
mov ecx, 0x20
cmp eax, ecx
jne 0x44ad25
cmp dword [esp + 0x38], ecx
jne 0x44ad25
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], ecx
xor ebx, ebx
lea ecx, [esp + 0x44]
push ebx
lea eax, [esi + 0x2c]
push ecx
push 0x14
push eax
push edi
mov byte [eax], 0x4e
mov byte [esi + 0x2d], 0x54
mov byte [esi + 0x2e], 0x46
mov byte [esi + 0x2f], 4
mov dword [esi + 0x38], edx
mov dword [esi + 0x3c], ebx
call ebp
lea edx, [esp + 0x44]
push ebx
push edx
lea eax, [esi + 0x40]
push 8
push eax
push edi
call ebp
mov eax, dword [esi + 0x48]
lea edx, [esp + 0x20]
push edx
push ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x38]
mov eax, dword [esi + 0x48]
push ebx
lea edx, [esp + 0x1c]
push ebx
mov ecx, dword [eax]
push edx
push ebx
push eax
call dword [ecx + 0x40]
mov eax, dword [esp + 0x3c]
test eax, eax
mov dword [esp + 0x14], eax
jle 0x44ad07
lea eax, [esp + 0x44]
mov ecx, dword [esp + 0x38]
push 0
push eax
mov eax, dword [esp + 0x20]
lea edx, [ecx + ecx]
imul eax, ebx
push edx
mov edx, dword [esp + 0x28]
add eax, edx
push eax
push edi
call ebp
mov eax, dword [esp + 0x14]
inc ebx
cmp ebx, eax
jl 0x44acde
mov esi, dword [esi + 0x48]
push 0
push esi
mov ecx, dword [esi]
call dword [ecx + 0x44]
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x30
ret 4
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x30
ret 4
Function at 0x44d210
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x73dd44
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.004446e0
mov al, byte [esp + 0xf]
xor ebp, ebp
mov dword [esp + 0x2c], ebp
mov byte [esi + 0xe8], al
mov dword [esi + 0xec], ebp
mov dword [esi + 0xf0], ebp
mov dword [esi + 0xf4], ebp
lea ecx, [esi + 0xf8]
mov byte [esp + 0x2c], 1
call fcn.0044c470
mov eax, dword [esi + 4]
mov byte [esp + 0x2c], 2
or ah, 8
mov dword [esi], 0x7661c4
mov dword [esi + 4], eax
mov eax, 0x3f800000
mov dword [esi + 0x2c], ebp
mov dword [esi + 0x30], ebp
mov dword [esi + 0x34], ebp
lea edx, [esi + 0x7c]
mov dword [esi + 0x74], eax
mov dword [esi + 0x60], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x38], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esi + 0x70], ebp
mov dword [esi + 0x6c], ebp
mov dword [esi + 0x68], ebp
mov dword [esi + 0x64], ebp
mov dword [esi + 0x5c], ebp
mov dword [esi + 0x58], ebp
mov dword [esi + 0x54], ebp
mov dword [esi + 0x50], ebp
mov dword [esi + 0x48], ebp
mov dword [esi + 0x44], ebp
mov dword [esi + 0x40], ebp
mov dword [esi + 0x3c], ebp
mov ecx, 0x17
xor eax, eax
mov edi, edx
mov dword [esi + 0x78], 1
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x14]
mov ecx, edx
mov dword [edx + 0x44], 4
mov dword [edx + 0x48], ebp
mov dword [ecx], eax
mov eax, dword [esp + 0x18]
mov dword [edx + 0x4c], 2
mov dword [edx + 0x50], ebp
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [edx + 0x54], 5
mov dword [edx + 0x58], 6
mov dword [ecx + 8], eax
mov eax, dword [esp + 0x20]
mov dword [ecx + 0xc], eax
mov ecx, dword [edx + 0xc]
fld dword [edx]
fmul dword [0x765810]
mov dword [edx + 0x1c], ecx
fstp dword [edx + 0x10]
fld dword [edx + 4]
fmul dword [0x765810]
fstp dword [edx + 0x14]
fld dword [edx + 8]
fmul dword [0x765810]
fstp dword [edx + 0x18]
mov dword [esi + 0xd8], 0x41200000
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x124], ebp
mov dword [esi + 0xdc], ebp
mov dword [esi + 0xe4], ebp
mov dword [esi + 0xe0], ebp
mov eax, esi
pop edi
mov dword [esp + 0x28], 0xffffffff
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x454f90
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
mov eax, dword [0x8b5a84]
sub esp, 0x418
test eax, eax
jne 0x454fa4
mov eax, 0x765608
push esi
push edi
mov edi, dword [sym.imp.kernel32.dll_CreateFileA]
push 0
push 0x80
push 3
push 0
push 0
push 0x40000000
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x454ff6
mov eax, dword [0x8b5a84]
test eax, eax
jne 0x454fd6
mov eax, 0x765608
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x45517e
test esi, esi
je 0x45517e
push ebx
push ebp
push 2
push 0
push 0
push esi
call dword [sym.imp.kernel32.dll_SetFilePointer]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.kernel32.dll_GetLocalTime]
mov ecx, dword [esp + 0x22]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1e]
and ecx, 0xffff
push ecx
mov ecx, dword [esp + 0x1e]
and edx, 0xffff
and eax, 0xffff
push edx
and ecx, 0xffff
push eax
push ecx
lea edx, [esp + 0x38]
push 0x7a453c
push edx
mov dword [esp + 0x2c], 0
call fcn.00727335
add esp, 0x18
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.kernel32.dll_lstrlenA]
xor edi, edi
mov dword [esp + 0x10], eax
test eax, eax
mov ebx, 0x816
jle 0x4550a3
mov cl, byte [esp + edi + 0x28]
xor edx, edx
mov dl, bh
xor dl, cl
xor cx, cx
mov cl, dl
mov byte [esp + edi + 0x28], dl
add ecx, ebx
lea ebx, [ecx + ecx*2]
shl ebx, 6
add ebx, ecx
shl ebx, 7
inc edi
cmp edi, eax
lea ebx, [ebx + ecx + 0x1608]
jl 0x455077
mov ebp, dword [sym.imp.kernel32.dll_WriteFile]
lea ecx, [esp + 0x14]
push 0
push ecx
lea edx, [esp + 0x18]
push 4
push edx
push esi
call ebp
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push 0
push eax
lea edx, [esp + 0x30]
push ecx
push edx
push esi
call ebp
mov eax, dword [esp + 0x22]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1e]
and eax, 0xffff
push eax
mov eax, dword [esp + 0x1e]
and ecx, 0xffff
and edx, 0xffff
push ecx
and eax, 0xffff
push edx
push eax
lea ecx, [esp + 0x38]
push 0x7a44ec
push ecx
call fcn.00727335
add esp, 0x18
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.kernel32.dll_lstrlenA]
xor edi, edi
mov dword [esp + 0x10], eax
test eax, eax
mov ebx, 0x816
jle 0x455150
mov cl, byte [esp + edi + 0x28]
xor edx, edx
mov dl, bh
xor dl, cl
xor cx, cx
mov cl, dl
mov byte [esp + edi + 0x28], dl
add ecx, ebx
lea ebx, [ecx + ecx*2]
shl ebx, 6
add ebx, ecx
shl ebx, 7
inc edi
cmp edi, eax
lea ebx, [ebx + ecx + 0x1608]
jl 0x455124
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esp + 0x18]
push 4
push ecx
push esi
call ebp
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [esp + 0x30]
push eax
push ecx
push esi
call ebp
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x418
ret
Function at 0x455190
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
mov eax, dword [0x8b5a88]
sub esp, 8
test eax, eax
push esi
push edi
je 0x45532a
mov eax, dword [esp + 0x14]
test eax, eax
je 0x45532a
push 0x8b5e90
call dword [sym.imp.kernel32.dll_GetLocalTime]
mov eax, dword [0x8b5e9c]
mov edx, dword [0x8b5e98]
xor ecx, ecx
and eax, 0xffff
mov cx, word [0x8b5e9a]
push eax
and edx, 0xffff
push ecx
push edx
push 0x7a4570
push 0x8b5a90
mov byte [0x8b5a90], 0
mov dword [esp + 0x20], 0
call fcn.00727335
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x2c]
push eax
push ecx
push 0x8b5ea0
mov byte [0x8b5ea0], 0
call fcn.00727ad8
mov esi, dword [sym.imp.kernel32.dll_lstrcatA]
add esp, 0x20
push 0x8b5ea0
push 0x8b5a90
call esi
push 0x7a456c
push 0x8b5a90
call esi
push 0x8b5a90
call dword [sym.imp.kernel32.dll_lstrlenA]
mov dword [esp + 8], eax
mov eax, dword [0x8b5a84]
test eax, eax
jne 0x455252
mov eax, 0x765608
mov edi, dword [sym.imp.kernel32.dll_CreateFileA]
push 0
push 0x80
push 3
push 0
push 0
push 0x40000000
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x4552a2
mov eax, dword [0x8b5a84]
test eax, eax
jne 0x455282
mov eax, 0x765608
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x45532a
test esi, esi
je 0x45532a
push ebp
push 2
push 0
push 0
push esi
call dword [sym.imp.kernel32.dll_SetFilePointer]
mov ebp, dword [esp + 0xc]
xor edi, edi
test ebp, ebp
mov edx, 0x816
jle 0x4552f7
mov al, byte [edi + 0x8b5a90]
xor ecx, ecx
mov cl, dh
xor cl, al
xor ax, ax
mov al, cl
mov byte [edi + 0x8b5a90], cl
add eax, edx
lea edx, [eax + eax*2]
shl edx, 6
add edx, eax
shl edx, 7
inc edi
cmp edi, ebp
lea edx, [edx + eax + 0x1608]
jl 0x4552c7
mov edi, dword [sym.imp.kernel32.dll_WriteFile]
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x14]
push 4
push ecx
push esi
call edi
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x10]
push 0
push edx
push eax
push 0x8b5a90
push esi
call edi
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop ebp
pop edi
pop esi
add esp, 8
ret
Function at 0x4575f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x73dfd3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
mov dword [esp + 8], esi
call fcn.004446e0
mov cl, byte [esp + 7]
xor eax, eax
mov dword [esp + 0x14], eax
mov byte [esi + 0x2c], cl
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov eax, dword [esi + 4]
mov ecx, dword [esp + 0xc]
or eax, 0x20000
mov byte [esp + 0x14], 1
mov dword [esi], 0x7662dc
mov dword [esi + 4], eax
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x457b10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x73e05f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov al, byte [esp + 3]
push ebx
push esi
mov esi, ecx
push edi
xor ebx, ebx
lea edi, [esi + 4]
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
mov byte [edi + 4], al
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
mov dl, byte [esp + 0xf]
mov al, byte [esp + 0xf]
lea ecx, [edi + 0x14]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x18], ecx
mov byte [ecx], dl
mov byte [ecx + 1], al
mov byte [ecx + 8], bl
call fcn.00459030
mov byte [esp + 0x24], 2
mov dword [edi], 0x7662fc
mov cl, byte [esp + 0xf]
mov dword [esp + 0x24], 3
push 0xc
mov byte [esi + 0x2c], cl
call fcn.00726f70
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], ebx
mov dl, byte [esp + 0x13]
mov byte [esp + 0x28], 4
push 0xc
mov byte [esi + 0x38], dl
call fcn.00726f70
mov dword [eax], eax
mov dword [eax + 4], eax
add esp, 8
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], ebx
mov ecx, dword [esp + 0x1c]
mov al, 1
mov byte [esp + 0x24], 5
mov byte [esi + 0x2a], al
mov byte [esi + 0x29], al
mov dword [esi], 0x7662f8
mov byte [esi + 0x28], bl
mov byte [esi + 0x2b], bl
mov eax, esi
pop edi
mov dword [esp + 0x20], 0xffffffff
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x459e70
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
dec eax
push esi
cmp eax, 8
push edi
ja case.default.0x459e82
jmp dword [eax*4 + 0x45a078]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 1
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 2
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 4
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov eax, dword [esp + 0x14]
push ebp
lea ecx, [esp + 0x1c]
push 0
push ecx
lea edx, [esp + 0x18]
push 4
push edx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, 0x7c4d88
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
mov ebp, ecx
mov ecx, ebx
push ebp
call fcn.00401450
test al, al
je 0x459f5f
mov edi, dword [ebx + 4]
mov ecx, ebp
mov edx, ecx
mov esi, 0x7c4d88
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 4]
mov dword [ebx + 8], ebp
mov byte [eax + ebp], 0
mov esi, dword [esp + 0x10]
pop ebp
test esi, esi
jle 0x45a060
cmp esi, 0xffffffff
jne 0x459f76
call fcn.007373b0
mov ecx, ebx
call fcn.00404990
cmp eax, esi
jae 0x459f86
call fcn.007373b0
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x459fab
mov al, byte [ecx - 1]
test al, al
je 0x459fab
cmp al, 0xff
je 0x459fab
test esi, esi
jne 0x459fcf
dec al
push esi
mov byte [ecx - 1], al
mov ecx, ebx
call fcn.00404760
jmp 0x459ff9
test esi, esi
jne 0x459fba
push 1
mov ecx, ebx
call fcn.00404760
jmp 0x459ff9
mov eax, dword [ebx + 0xc]
cmp eax, 0x1f
ja 0x459fc6
cmp eax, esi
jae 0x459fd7
push 1
mov ecx, ebx
call fcn.00404760
push esi
mov ecx, ebx
call fcn.00401570
mov edi, dword [ebx + 4]
mov ecx, esi
mov edx, ecx
mov eax, 0x20202020
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebx + 4]
mov dword [ebx + 8], esi
mov byte [eax + esi], 0
mov eax, dword [ebx + 4]
test eax, eax
je 0x45a028
mov al, byte [eax - 1]
test al, al
je 0x45a018
cmp al, 0xff
je 0x45a018
mov ecx, dword [ebx + 8]
push 0
push ecx
mov ecx, ebx
call fcn.00401450
mov eax, dword [ebx + 4]
test eax, eax
je 0x45a023
mov byte [eax - 1], 0xff
mov ebx, dword [ebx + 4]
jmp 0x45a02d
mov ebx, 0x765608
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x18]
push 0
push edx
push eax
push ebx
jmp 0x45a055
lea edx, [esp + 0x18]
push 0
push edx
push 4
jmp 0x45a050
lea edx, [esp + 0x18]
push 0
push edx
push 8
mov eax, dword [esp + 0x28]
push eax
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0xc