joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411bb0
Capabilities:
Get file size
Get system information on windows
Read file via mapping

Disassembly:
sub esp, 0x38
push ebx
push ebp
push esi
push edi
xor edi, edi
cmp eax, edi
je 0x411c34
push edi
push 0x10000080
push 3
push edi
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [esp + 0x14], ebx
je 0x411c34
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 0x40]
xor edx, edx
mov eax, 0x8000000
div ecx
mov esi, eax
imul esi, ecx
lea ecx, [esp + 0x18]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push ebp
push ebp
push ebp
push 2
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebx, eax
test ebx, ebx
mov dword [esp + 0x10], ebx
jne 0x411c3e
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret
call fcn.004112f0
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jl 0x411cf0
mov eax, dword [esp + 0x18]
jg 0x411c68
test eax, eax
jbe 0x411cf0
jmp 0x411c68
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x10]
xor edx, edx
cmp ecx, edx
jl 0x411ca5
jg 0x411c74
cmp eax, esi
jbe 0x411ca5
push esi
push ebp
push edi
push 4
mov eax, edi
push ebx
sar eax, 0x1f
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
push ebx
mov eax, esi
call fcn.00411330
add esp, 4
add ebp, esi
mov eax, 0
adc edi, eax
sub dword [esp + 0x18], esi
sbb dword [esp + 0x1c], eax
jmp 0x411ccf
push eax
push ebp
push edi
push 4
mov ecx, edi
push ebx
sar ecx, 0x1f
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
mov eax, dword [esp + 0x18]
push ebx
call fcn.00411330
add esp, 4
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jg 0x411c60
jl 0x411cec
mov eax, dword [esp + 0x18]
test eax, eax
ja 0x411c64
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x4c]
call fcn.004113f0
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call esi
mov edx, dword [esp + 0x14]
push edx
call esi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x38
ret

Function at 0x411db0
Capabilities:
Hash data with md5

Disassembly:
mov eax, 0x487778
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x411db8
sub eax, edx
push 0x487778
mov dword [0x486f14], 0
mov dword [0x486f10], 0
mov dword [0x486f00], 0x67452301
mov dword [0x486f04], 0xefcdab89
mov dword [0x486f08], 0x98badcfe
mov dword [0x486f0c], 0x10325476
call fcn.00411330
mov ecx, dword [esp + 8]
add esp, 4
call fcn.004113f0
mov eax, 1
ret

Function at 0x411e20
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov dword [0x486f14], eax
mov dword [0x486f10], eax
mov eax, dword [esp + 4]
push eax
mov eax, dword [esp + 0xc]
mov dword [0x486f00], 0x67452301
mov dword [0x486f04], 0xefcdab89
mov dword [0x486f08], 0x98badcfe
mov dword [0x486f0c], 0x10325476
call fcn.00411330
mov ecx, dword [esp + 0x10]
add esp, 4
call fcn.004113f0
mov eax, 1
ret
Function at 0x412640
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x45863e
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x4727f0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, dword [esp + 0x20]
xor ebx, ebx
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], ebx
mov dword [esp + 0x18], ebx
lea ecx, [esi + 0x14]
mov dword [esi], vtable.XmlAttribute.0
mov eax, 0xf
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x14], ebx
mov byte [ecx + 4], bl
lea edi, [esi + 0x30]
mov dword [edi + 0x18], eax
mov dword [edi + 0x14], ebx
mov byte [edi + 4], bl
mov eax, dword [esp + 0x24]
push 0xffffffffffffffff
push ebx
push eax
mov byte [esp + 0x24], 2
call fcn.00402910
mov ecx, dword [esp + 0x28]
push 0xffffffffffffffff
push ebx
push ecx
mov ecx, edi
call fcn.00402910
mov dword [esi + 0x10], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x4c], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 0xc
Function at 0x4187b0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x458598
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x4727f0]
xor eax, esp
mov dword [esp + 0x3c], eax
push esi
push edi
mov eax, dword [0x4727f0]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
xor esi, esi
mov eax, ebx
mov edi, ecx
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], esi
mov word [esp + 0x30], si
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x418800
sub eax, edx
sar eax, 1
push eax
push ebx
lea esi, [esp + 0x34]
call fcn.0040d6e0
lea eax, [edi + 0x1c]
push eax
mov dword [esp + 0x5c], 0
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [esp + 0x24]
push eax
lea esi, [edi + 4]
push esi
lea eax, [esp + 0x34]
call fcn.00419c10
mov edi, dword [eax]
test edi, edi
mov eax, dword [eax + 4]
mov ecx, dword [esi + 4]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], ecx
je 0x41885a
cmp edi, esi
je 0x418863
call fcn.0043dbb7
mov eax, dword [esp + 0x18]
cmp eax, dword [esp + 0x20]
jne 0x41889a
push ebx
push str.Couldnt_find___s__in_var_container
call fcn.004059c0
mov edx, dword [esp + 0x18]
add esp, 8
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [esp + 0x44], 8
jb 0x418896
mov eax, dword [esp + 0x30]
push eax
call fcn.0041a866
add esp, 4
xor eax, eax
jmp 0x4188e7
test edi, edi
jne 0x4188a7
call fcn.0043dbb7
mov eax, dword [esp + 0x18]
cmp eax, dword [edi + 4]
jne 0x4188b5
call fcn.0043dbb7
mov eax, dword [esp + 0x18]
mov edi, 8
cmp dword [eax + 0x40], edi
jb 0x4188c4
mov esi, dword [eax + 0x2c]
jmp 0x4188c7
lea esi, [eax + 0x2c]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [esp + 0x44], edi
jb 0x4188e5
mov edx, dword [esp + 0x30]
push edx
call fcn.0041a866
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.0043d963
mov esp, ebp
pop ebp
ret
Function at 0x418910
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4587f8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4727f0]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push esi
push edi
mov eax, dword [0x4727f0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebx, edx
call fcn.004187b0
mov ecx, eax
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], 0
mov word [esp + 0x14], 0
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x418964
sub ecx, esi
sar ecx, 1
push ecx
push eax
lea esi, [esp + 0x18]
call fcn.0040d6e0
push 1
mov eax, esi
mov dword [esp + 0x3c], 0
call fcn.0040e550
cmp eax, 0xffffffff
je 0x4189c9
push 1
mov eax, esi
call fcn.0040e550
mov esi, 1
mov edi, 1
lea ebx, [esp + 0x10]
sub esi, eax
call fcn.0040e5e0
add esi, eax
push esi
push edi
mov eax, ebx
call fcn.0040e550
push eax
mov eax, ebx
mov ecx, ebx
call fcn.0040d7a0
jmp 0x4189d2
lea edi, [esp + 0x10]
call fcn.0040e230
mov eax, dword [esp + 0x14]
mov edi, 8
cmp dword [esp + 0x28], edi
jae 0x4189e5
lea eax, [esp + 0x14]
push 0xa
push 0
push eax
call fcn.00440bb9
add esp, 0xc
cmp dword [esp + 0x28], edi
mov esi, eax
jb 0x418a07
mov eax, dword [esp + 0x14]
push eax
call fcn.0041a866
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0043d963
add esp, 0x2c
ret
Function at 0x41a560
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x458b38
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push edi
mov eax, dword [0x4727f0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [esp + 0x38]
xor edi, edi
push 0xffffffffffffffff
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], edi
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], edi
mov word [esp + 0x18], di
call fcn.0040d7a0
mov eax, 0x4651bc
mov dword [esp + 0x30], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x41a5b7
sub eax, edx
sar eax, 1
push eax
push 0x4651bc
lea ecx, [esp + 0x14]
call fcn.0040e100
push 0xffffffffffffffff
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push edi
mov ecx, esi
mov word [esi + 4], di
call fcn.0040d7a0
cmp dword [esp + 0x24], 8
jb 0x41a601
mov eax, dword [esp + 0x10]
push eax
call fcn.0041a866
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x2c
ret

Function at 0x41e716
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x41e74f
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0041e6af
push eax
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0041d2cb
pop esi
ret 4
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
pop esi
jmp dword [eax + 0x8c]

Function at 0x420470
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x4204b3
call fcn.004243c3
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4204b3
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4204ce
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.0042002a
test ebx, ebx
mov esi, eax
je 0x4204cc
test edi, edi
je 0x4204cc
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x420c5b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x24
mov eax, 0x456d89
call fcn.0044109a
mov esi, ecx
mov dword [ebp - 0x20], esi
mov eax, dword [esi + 0x60]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x5c]
mov dword [ebp - 0x18], eax
call fcn.004243c3
mov edi, dword [eax + 0xc]
xor ebx, ebx
cmp dword [esi + 0x58], ebx
je 0x420ca6
call fcn.004243c3
mov edi, dword [eax + 0xc]
push 5
push dword [esi + 0x58]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
je 0x420cb7
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jne 0x420cc4
or eax, 0xffffffff
jmp 0x420e20
mov ecx, esi
call fcn.004207a2
mov dword [ebp - 0x14], eax
call fcn.0041d47a
and dword [ebp - 0x28], ebx
cmp dword [ebp - 0x14], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
je 0x420d42
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp dword [ebp - 0x14], eax
je 0x420d42
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x420d42
push 0
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x2c], 1
call fcn.0041bc9e
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x24], ebx
je 0x420d42
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x120]
test eax, eax
je 0x420d42
mov ecx, ebx
call fcn.00421273
test eax, eax
je 0x420d42
push 0
mov ecx, ebx
call fcn.0042128e
mov dword [ebp - 0x28], 1
and dword [ebp - 4], 0
push esi
call fcn.0041f1f3
push dword [ebp - 0x14]
call fcn.0041d3d2
push edi
push eax
push dword [ebp - 0x1c]
mov ecx, esi
call fcn.00420a63
xor edi, edi
cmp eax, edi
je 0x420d9f
test byte [esi + 0x3c], 0x10
je 0x420d89
push 4
pop edi
mov ecx, esi
call fcn.0042110d
test ax, 0x100
je 0x420d7f
push 5
pop edi
push edi
mov ecx, esi
call fcn.0041cf43
xor edi, edi
cmp dword [esi + 0x20], edi
je 0x420d9f
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.00421461
or dword [ebp - 4], 0xffffffff
jmp 0x420dca
cmp dword [ebp - 0x28], edi
je 0x420dd8
push 1
mov ecx, ebx
call fcn.0042128e
cmp dword [ebp - 0x2c], edi
je 0x420de8
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x420e01
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x20]
jne 0x420e01
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x60]
mov ecx, esi
call fcn.004207dc
cmp dword [esi + 0x58], edi
je 0x420e1d
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [esi + 0x44]
call fcn.0044113f
ret
Function at 0x420e51
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.004243c3
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x420e88
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.00420a63
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x422bb7
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x4727f0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0x800
push ebx
push esi
mov esi, ecx
mov ebx, edx
lea eax, [ebp - 0xc]
jne 0x422bf4
push 0x45cf70
push 4
push eax
call fcn.00442e79
push eax
call fcn.00404610
add esp, 0x10
jmp 0x422c06
push 4
push eax
push 3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x422c71
push edi
call fcn.00441458
mov edi, dword [eax]
call fcn.00441458
and dword [eax], 0
lea eax, [ebp - 0xc]
push eax
push ebx
push esi
push 0x111
mov esi, 0x112
lea eax, [ebp - 0x230]
push esi
push eax
call fcn.004413fe
add esp, 0x18
mov ebx, eax
call fcn.00441458
cmp dword [eax], 0
je 0x422c51
call fcn.00441458
push dword [eax]
call fcn.0041a86b
pop ecx
jmp 0x422c58
call fcn.00441458
mov dword [eax], edi
cmp ebx, 0xffffffff
pop edi
je 0x422c71
cmp ebx, esi
jae 0x422c71
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x422c73
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0043d963
leave
ret
Function at 0x42500e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
je 0x425054
call fcn.004243c3
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x425054
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x425097
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
je 0x425080
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x425080
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x425094
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x42ad06
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x42ad34
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x42ad52
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0042ac70
jmp 0x42ad52
mov eax, dword [esi + 0x14]
test eax, eax
je 0x42ad52
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.0042ac70
test edi, edi
mov eax, edi
jne 0x42ad3c
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x475d78]
test ecx, ecx
je 0x42ae15
jmp 0x42ad05
ret 8

Function at 0x43d963
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4727f0]
jne 0x43d96d
repz ret
jmp fcn.00445828
Function at 0x43fbe5
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x43fc22
cmp dword [ebp + 0x14], edi
je 0x43fc22
cmp ecx, edi
jne 0x43fc29
call fcn.00441458
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.0043db93
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x43fc3d
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x43fc5e
cmp ebx, 0xffffffff
je 0x43fc4d
push ebx
push edi
push ecx
call fcn.00440c10
add esp, 0xc
cmp esi, edi
je 0x43fc0a
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x43fc0a
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x43fc7a
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x43fc81
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x43fd72
test word [esi + 0xc], 0x10c
je 0x43fcd5
mov eax, dword [esi + 4]
test eax, eax
je 0x43fcd5
jl 0x43fdd3
cmp ebx, eax
mov edi, ebx
jb 0x43fca6
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x43fd7a
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0043d972
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x43fd6a
cmp ebx, dword [ebp - 0xc]
jb 0x43fd42
cmp dword [ebp - 0xc], 0
je 0x43fcff
mov ecx, SysReAllocString
xor edx, edx
cmp ebx, ecx
jbe 0x43fcf4
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x43fcfb
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x43fd0a
mov eax, SysReAllocString
cmp ebx, eax
ja 0x43fd0a
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x43fda6
push eax
push dword [ebp - 8]
push esi
call fcn.004441ae
pop ecx
push eax
call fcn.0044b3c5
add esp, 0xc
test eax, eax
je 0x43fde5
cmp eax, 0xffffffff
je 0x43fdd3
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x43fd6a
push esi
call fcn.0044ace4
cmp eax, 0xffffffff
pop ecx
je 0x43fdd7
cmp dword [ebp - 4], 0
je 0x43fda6
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x43fc89
mov eax, dword [ebp + 0x14]
jmp 0x43fc24
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x43fd91
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.00440c10
add esp, 0xc
call fcn.00441458
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x43fc1a
cmp dword [ebp + 0xc], 0xffffffff
je 0x43fdbc
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.00440c10
add esp, 0xc
call fcn.00441458
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x43fc1a
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x43fc24
or dword [esi + 0xc], 0x10
jmp 0x43fdd7
Function at 0x44459c
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x472980]
je 0x4445b7
inc edi
cmp edi, 0x17
jb 0x4445a8
cmp edi, 0x17
jae 0x444737
push ebp
push 3
call fcn.00451105
cmp eax, 1
pop ecx
je 0x444703
push 3
call fcn.00451105
test eax, eax
pop ecx
jne 0x4445eb
cmp dword [0x472784], 1
je 0x444703
cmp ebx, 0xfc
je 0x444736
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x4760e0
push ebp
call fcn.00445da0
add esp, 0xc
test eax, eax
je 0x444621
push esi
push esi
push esi
push esi
push esi
call fcn.0043da97
add esp, 0x14
push 0x104
mov esi, 0x4760f9
push esi
push 0
mov byte [0x4761fd], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x444665
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.00445da0
add esp, 0xc
test eax, eax
je 0x444665
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0043da97
add esp, 0x14
push esi
call fcn.00443200
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x4446aa
push esi
call fcn.00443200
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x4763f4
push 0x460dd4
sub ecx, eax
push ecx
push eax
call fcn.00451052
add esp, 0x14
test eax, eax
je 0x4446aa
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.0043da97
add esp, 0x14
jmp 0x4446ac
xor esi, esi
push 0x460dd0
push ebx
push ebp
call fcn.00450fe1
add esp, 0xc
test eax, eax
je 0x4446cc
push esi
push esi
push esi
push esi
push esi
call fcn.0043da97
add esp, 0x14
push dword [edi*8 + 0x472984]
push ebx
push ebp
call fcn.00450fe1
add esp, 0xc
test eax, eax
je 0x4446ee
push esi
push esi
push esi
push esi
push esi
call fcn.0043da97
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.00450e24
add esp, 0xc
jmp 0x444736
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x444736
cmp ebp, 0xffffffff
je 0x444736
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x472984]
push dword [esi]
call fcn.00443200
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret