joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43f6a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea edx, [ebp - 4]
mov dword [ebp - 4], 0
call fcn.00440aa0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x43f810
cmp dword [0x514580], eax
je 0x43f7ba
push esi
push 0x52f720
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea edx, [ebp - 4]
call fcn.00440aa0
mov esi, dword [ebp - 4]
test esi, esi
jne 0x43f7a8
push 0x2014
call fcn.004894ff
add esp, 4
mov dword [ebp - 4], eax
mov ecx, eax
call fcn.0043f5a0
cmp dword [0x514580], 0
mov esi, eax
je 0x43f7a8
push ebx
push dword [0x514588]
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call ebx
test eax, eax
je 0x43f7a7
cmp dword [eax], 0xd
jbe 0x43f7a7
mov eax, dword [eax + 8]
push edi
mov edi, dword [eax + 0x34]
test edi, edi
jne 0x43f770
push 8
call fcn.004894ff
mov edi, eax
add esp, 4
mov dword [ebp - 4], edi
mov dword [edi], vtable.t_visualDataItemPtr_class_t_perfManager_.0
mov dword [edi + 4], esi
cmp dword [0x514580], 0
je 0x43f7a6
push dword [0x514588]
call ebx
test eax, eax
je 0x43f7a6
cmp dword [eax], 0xd
jbe 0x43f7a6
mov eax, dword [eax + 8]
mov dword [eax + 0x34], edi
jmp 0x43f7a6
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
cmp eax, vtable.t_visualDataItemPtr_class_t_perfManager_.0
jne 0x43f814
mov ebx, dword [edi + 4]
test ebx, ebx
je 0x43f7a3
mov ecx, ebx
mov dword [edi + 4], 0
call fcn.0043f5f0
push 0x2014
push ebx
call fcn.0048952f
add esp, 8
mov dword [edi + 4], esi
pop edi
pop ebx
push 0x52f720
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [0x52fbd8]
test eax, eax
jne 0x43f810
push 0x52f720
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x531128]
test al, 1
jne 0x43f7f6
or eax, 1
mov ecx, 0x531130
mov dword [0x531128], eax
call fcn.0043f5a0
push 0x4e6b20
call fcn.0048992b
add esp, 4
push 0x52f720
mov dword [0x52fbd8], 0x531130
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x52fbd8]
mov esp, ebp
pop ebp
ret
push esi
mov ecx, edi
call edx
jmp 0x43f7a6

Function at 0x440aa0
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x514580], 0
push esi
mov esi, edx
je 0x440aff
push dword [0x514588]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x440aff
cmp dword [eax], 0xd
jbe 0x440aff
mov eax, dword [eax + 8]
mov eax, dword [eax + 0x34]
test eax, eax
je 0x440aff
push 0
push 0x515fb8
push 0x515ff0
push 0
push eax
call fcn.004def21
add esp, 0x14
test eax, eax
je 0x440aff
mov edx, dword [eax]
cmp edx, vtable.t_visualDataItemPtr_class_t_perfManager_.0
jne 0x440b03
mov eax, dword [eax + 4]
mov dword [esi], eax
mov al, 1
pop esi
ret
mov dword [esi], eax
mov al, 1
pop esi
ret
xor al, al
pop esi
ret
mov ecx, eax
call dword [edx + 8]
jmp 0x440af9
Function at 0x441a20
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e2bab
mov eax, dword fs:[0]
push eax
sub esp, 0x35c
mov eax, dword [0x513200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x368]
call fcn.00430730
mov dword [ebp - method.t_fileWrite.virtual_0], vtable.t_fileWrite.0
mov dword [ebp - 0x14], vtable.t_fileWrite.1.0
mov dword [ebp - 4], 0
lea eax, [edi + 0xc]
cmp byte [edi + 0x11c], 0
jne 0x441a89
mov eax, dword [edi + 8]
push 0x80
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 1
push edi
push ebx
lea ecx, [ebp - 0x368]
call fcn.004308d0
test al, al
je 0x441b01
push 2
push 0x4ffabc
push ebx
lea ecx, [ebp - 0x14]
call fcn.00442c90
test al, al
je 0x441b01
push dword [esi + 0xc]
lea ecx, [ebp - 0x14]
push dword [esi + 4]
push ebx
call fcn.00442c90
test al, al
je 0x441b01
lea ecx, [ebp - 0x368]
call fcn.00430cb0
push dword [esi + 4]
call fcn.00496f41
add esp, 4
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov bl, 1
mov dword [esi + 0xc], 0
jmp 0x441b03
xor bl, bl
lea ecx, [ebp - 0x368]
mov dword [ebp - method.t_fileWrite.virtual_0], vtable.t_fileWrite.0
mov dword [ebp - 0x14], vtable.t_byteStreamWrite.0
call fcn.00430810
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00489940
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4421d0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e2c0b
mov eax, dword fs:[0]
push eax
sub esp, 0x36c
mov eax, dword [0x513200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
test eax, eax
je 0x442229
push eax
call fcn.00496f41
add esp, 4
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
push ecx
lea ecx, [ebp - 0x370]
call fcn.00430730
mov dword [ebp - method.t_fileRead.1.virtual_0], vtable.t_fileRead.1.0
mov dword [ebp - 0x1c], vtable.t_fileRead.0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
push 0
push esi
push ebx
lea ecx, [ebp - 0x370]
mov dword [ebp - 4], 0
call fcn.004308d0
test al, al
je 0x4423b0
lea eax, [ebp - 0x374]
mov dword [ebp - 0x374], 0
push eax
push dword [ebp - 0x36c]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x378], eax
cmp eax, 0xffffffff
jne 0x4422ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4422a8
xor eax, eax
jmp 0x4422ae
mov eax, dword [ebp - 0x378]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x378]
push eax
push dword [ebp - 0x36c]
mov dword [ebp - 0x378], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x374], eax
cmp eax, 0xffffffff
jne 0x4422f3
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4422ed
xor eax, eax
mov dword [ebp - 0x374], eax
jmp 0x4422f3
mov eax, dword [ebp - 0x374]
add eax, 4
push eax
call fcn.004a9943
add esp, 4
mov dword [ebp - 0x378], eax
test eax, eax
jne 0x44232c
mov dword [edi + 0x24], 2
cmp byte [esi + 0x11c], al
je 0x442322
add esi, 0xc
push 0x502d2c
jmp 0x44235d
mov esi, dword [esi + 8]
push 0x502d2c
jmp 0x44235d
push dword [ebp - 0x374]
lea ecx, [ebp - 0x1c]
push eax
push ebx
call fcn.00442ec0
test al, al
jne 0x442378
mov dword [edi + 0x24], 3
cmp byte [esi + 0x11c], 0
je 0x442355
add esi, 0xc
jmp 0x442358
mov esi, dword [esi + 8]
push 0x4ffe64
mov ecx, ebx
call fcn.004058b0
lea ecx, [esi + 4]
push ecx
push 0x4fc47c
push eax
call fcn.004048f0
add esp, 0xc
jmp 0x4423b7
lea ecx, [ebp - 0x370]
call fcn.00430cb0
mov ecx, dword [ebp - 0x378]
xor edx, edx
mov eax, dword [ebp - 0x374]
push ecx
push eax
push ecx
mov dword [ecx + eax], edx
mov ecx, edi
push ebx
call fcn.004426d0
test al, al
jne 0x4423ac
mov dword [edi + 0x24], 4
jmp 0x442347
mov bl, 1
jmp 0x4423b9
mov dword [edi + 0x24], 1
xor bl, bl
lea ecx, [ebp - 0x370]
mov dword [ebp - method.t_fileRead.1.virtual_0], vtable.t_fileRead.1.0
mov dword [ebp - 0x1c], vtable.t_byteStreamRead.0
call fcn.00430810
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00489940
mov esp, ebp
pop ebp
ret 0x10
Function at 0x442c50
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x442c69
mov eax, dword [esi + 8]
push 0x80
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 1
push esi
push dword [ebp + 8]
mov ecx, edi
call fcn.004308d0
test al, al
pop edi
setne al
pop esi
pop ebp
ret 0xc

Function at 0x442c90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push 0
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 4], 0
push dword [esi - 0x350]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x442d10
lea edi, [esi - 0x33c]
cmp byte [esi - 0x22c], al
jne 0x442cd9
mov edi, dword [esi - 0x340]
mov ecx, dword [ebp + 8]
call fcn.00427350
push 0x4ffec4
mov esi, eax
push 0x4fc47c
push esi
call fcn.004048f0
lea ecx, [edi + 4]
push ecx
push 0x4fc47c
push esi
call fcn.004048f0
add esp, 0x18
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp - 4]
cmp edi, ebx
je 0x442da6
cmp byte [esi - 0x22c], 0
lea ebx, [esi - 0x33c]
jne 0x442d30
mov ebx, dword [esi - 0x340]
mov ecx, dword [ebp + 8]
push 0x502e3c
call fcn.004058b0
push 0x502e4c
mov esi, eax
push 0x4fc47c
push esi
call fcn.004048f0
push dword [ebp + 0x10]
push 0x4fc45c
push esi
call fcn.004048f0
push 0x502e58
push 0x4fc47c
push esi
call fcn.004048f0
push edi
push 0x4fc45c
push esi
call fcn.004048f0
push 0x502e68
push 0x4fc47c
push esi
call fcn.004048f0
lea eax, [ebx + 4]
push eax
push 0x4fc47c
push esi
call fcn.004048f0
add esp, 0x48
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x442ec0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x442fc3
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push edi
push dword [ebp + 0xc]
push dword [esi - 0x350]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x442f46
lea edi, [esi - 0x33c]
cmp byte [esi - 0x22c], al
jne 0x442f10
mov edi, dword [esi - 0x340]
mov ecx, dword [ebp + 8]
call fcn.00427350
push 0x4ffe94
mov esi, eax
push 0x4fc47c
push esi
call fcn.004048f0
lea ecx, [edi + 4]
push ecx
push 0x4fc47c
push esi
call fcn.004048f0
add esp, 0x18
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
test ecx, ecx
jne 0x442f8c
cmp byte [esi - 0x22c], cl
je 0x442f5d
add esi, 0xfffffcc4
jmp 0x442f63
mov esi, dword [esi - 0x340]
mov ecx, dword [ebp + 8]
push 0x4ffea4
call fcn.004058b0
lea ecx, [esi + 4]
push ecx
push 0x4fc47c
push eax
call fcn.004048f0
add esp, 0xc
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
cmp ecx, edi
je 0x442fc3
cmp byte [esi - 0x22c], 0
lea eax, [esi - 0x33c]
jne 0x442fa5
mov eax, dword [esi - 0x340]
add eax, 4
push eax
push ecx
push edi
push str.penc_rN
push dword [ebp + 8]
call fcn.00426380
add esp, 0x14
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
add dword [esi + 8], edi
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x443750
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e2c87
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x513200]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
lea edx, [esi + 0x20]
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], fcn.004a9943
mov dword [esi + 0x18], fcn.004dc3df
mov dword [esi + 0x1c], fcn.00496f41
mov dword [edx + 4], fcn.004a9943
mov dword [edx + 8], fcn.004dc3df
mov dword [edx + 0xc], fcn.00496f41
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0x1fff8
mov dword [edx], vtable.t_heap.0
mov dword [esi + 0x3c], fcn.004a9943
mov dword [esi + 0x40], fcn.004dc3df
mov dword [esi + 0x44], fcn.00496f41
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0x8000
mov dword [esi + 0x38], vtable.t_heap.0
mov dword [esi + 0x50], 0
mov byte [esi + 0x54], 1
mov dword [ebp - 4], 0
lea eax, [esi + 0x58]
mov dword [esi], vtable.t_configSignatureFile.0
mov dword [ebp - 0x14], eax
mov byte [eax + 4], 0
mov dword [eax + 8], 0x4ff478
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], fcn.004a9943
mov dword [eax + 0x20], fcn.004dc3df
mov dword [eax + 0x24], fcn.00496f41
mov dword [eax + 0x28], edx
mov dword [eax], vtable.t_configSignatureFile::t_setting.0
mov byte [eax + 0x30], 0
mov dword [eax + 0x34], str.exeCnt
mov dword [eax + 0x38], 0
mov dword [eax + 0x3c], 0
mov dword [eax + 0x2c], vtable.n_config::t_int.0
mov byte [eax + 0x44], 0
mov dword [eax + 0x48], str.dllCnt
mov dword [eax + 0x4c], 0
mov dword [eax + 0x50], 0
mov dword [eax + 0x40], vtable.n_config::t_int.0
lea ecx, [esi + 0xac]
mov dword [ebp - 0x14], ecx
mov byte [ecx + 4], 0
mov dword [ecx + 8], 0x4fdb88
mov dword [ecx + 0xc], edx
mov dword [ecx + 0x10], 0
lea eax, [esi + 0x84]
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x20], fcn.004a9943
mov dword [ecx + 0x24], fcn.004dc3df
mov dword [ecx + 0x28], fcn.00496f41
mov dword [ecx], vtable.n_config::t_arraySection_class_t_configSignatureFile::t_signature_.0
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], eax
lea ecx, [esi + 0xe0]
mov dword [ebp - 0x14], ecx
mov byte [ecx + 4], 0
mov dword [ecx + 8], 0x502ef8
mov dword [ecx + 0xc], edx
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x20], fcn.004a9943
mov dword [ecx + 0x24], fcn.004dc3df
mov dword [ecx + 0x28], fcn.00496f41
lea eax, [esi + 0x98]
mov dword [ecx], vtable.n_config::t_arraySection_class_t_configSignatureFile::t_signature_.0
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], eax
mov ecx, esi
mov byte [ebp - 4], 6
call fcn.00443980
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x445d00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e2f07
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x513200]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov al, byte [ebp + 8]
lea edx, [esi + 0x20]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], fcn.004a9943
mov dword [esi + 0x18], fcn.004dc3df
mov dword [esi + 0x1c], fcn.00496f41
mov dword [edx + 4], fcn.004a9943
mov dword [edx + 8], fcn.004dc3df
mov dword [edx + 0xc], fcn.00496f41
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0x1fff8
mov dword [edx], vtable.t_heap.0
mov dword [esi + 0x3c], fcn.004a9943
mov dword [esi + 0x40], fcn.004dc3df
mov dword [esi + 0x44], fcn.00496f41
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0x8000
mov dword [esi + 0x38], vtable.t_heap.0
mov dword [esi + 0x50], 0
mov byte [esi + 0x54], al
mov dword [ebp - 4], 0
lea eax, [esi + 0x58]
mov dword [esi], vtable.t_hookConfigFile.0
mov dword [ebp + 8], eax
mov byte [eax + 4], 0
mov dword [eax + 8], 0x4ff478
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], fcn.004a9943
mov dword [eax + 0x20], fcn.004dc3df
mov dword [eax + 0x24], fcn.00496f41
mov dword [eax + 0x28], edx
mov dword [eax], vtable.t_hookConfigFile::t_setting.0
mov byte [eax + 0x30], 0
mov dword [eax + 0x34], str.cfwcnt
mov dword [eax + 0x38], 0
mov dword [eax + 0x3c], 0
mov dword [eax + 0x2c], vtable.n_config::t_int.0
mov byte [eax + 0x44], 0
mov dword [eax + 0x48], str.gmfnwcnt
mov dword [eax + 0x4c], 0
mov dword [eax + 0x50], 0
mov dword [eax + 0x40], vtable.n_config::t_int.0
mov byte [eax + 0x58], 0
mov dword [eax + 0x5c], str.version
mov dword [eax + 0x60], 0x4f6060
mov dword [eax + 0x64], 0x4f6060
mov dword [eax + 0x54], vtable.n_config::t_str.0
mov dword [eax + 0x68], 0
lea ecx, [esi + 0xc4]
mov dword [ebp + 8], ecx
mov byte [ecx + 4], 0
mov dword [ecx + 8], 0x502fe8
mov dword [ecx + 0xc], edx
mov dword [ecx + 0x10], 0
lea eax, [esi + 0x84]
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x20], fcn.004a9943
mov dword [ecx + 0x24], fcn.004dc3df
mov dword [ecx + 0x28], fcn.00496f41
mov dword [ecx], vtable.n_config::t_arraySection_class_t_hookConfigFile::t_item_.0
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], eax
lea ecx, [esi + 0xf8]
mov dword [ebp + 8], ecx
mov byte [ecx + 4], 0
mov dword [ecx + 8], str.gmfn
mov dword [ecx + 0xc], edx
mov dword [ecx + 0x10], 0
lea eax, [esi + 0x98]
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x20], fcn.004a9943
mov dword [ecx + 0x24], fcn.004dc3df
mov dword [ecx + 0x28], fcn.00496f41
mov dword [ecx], vtable.n_config::t_arraySection_class_t_hookConfigFile::t_item_.0
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], eax
mov ecx, esi
mov byte [ebp - 4], 6
call fcn.00445ff0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x44c410
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e3328
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x513200]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 0xc]
lea esi, [edi + 0x238]
push ebx
mov ecx, esi
call fcn.0040ecf0
mov eax, dword [edi + 4]
lea ecx, [edi + 4]
push esi
mov esi, dword [ebp + 8]
push esi
mov eax, dword [eax + 0x18]
call eax
test al, al
jne 0x44c4a9
cmp byte [edi + 0x354], al
je 0x44c46f
add edi, 0x244
jmp 0x44c475
mov edi, dword [edi + 0x240]
push 0x4ffe64
mov ecx, esi
call fcn.004058b0
lea ecx, [edi + 4]
push ecx
push 0x4fc47c
push eax
call fcn.004048f0
add esp, 0xc
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [ebp - 0x14], vtable.t_mutex::t_locker.0
mov dword [ebp - 0x10], 0
push ecx
push esi
lea ecx, [edi + 4]
mov dword [ebp - 4], 0
call fcn.00437450
test al, al
je 0x44c5db
lea eax, [edi + 4]
push 0
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp byte [ebx + 0x11c], 0
lea eax, [ebx + 0xc]
jne 0x44c4ed
mov eax, dword [ebx + 8]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x44c53f
shr eax, 4
not al
and al, 1
je 0x44c53f
cmp byte [ebx + 0x11c], 0
lea eax, [ebx + 0xc]
jne 0x44c514
mov eax, dword [ebx + 8]
push 0
push 0x80
push 3
push 0
push 3
push 4
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [edi + 0x234], eax
cmp eax, 0xffffffff
je 0x44c572
mov bl, 1
jmp 0x44c612
cmp byte [ebx + 0x11c], 0
lea eax, [ebx + 0xc]
jne 0x44c54e
mov eax, dword [ebx + 8]
push 0
push 0x80
push 1
push 0
push 3
push 4
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [edi + 0x234], eax
cmp eax, 0xffffffff
jne 0x44c5b6
cmp byte [edi + 0x354], 0
je 0x44c583
add edi, 0x244
jmp 0x44c589
mov edi, dword [edi + 0x240]
mov ecx, esi
call fcn.00427350
push 0x4ffe64
mov esi, eax
push 0x4fc47c
push esi
call fcn.004048f0
lea ecx, [edi + 4]
push ecx
push 0x4fc47c
push esi
call fcn.004048f0
add esp, 0x18
jmp 0x44c610
push 2
push 0x5033b0
push esi
mov ecx, edi
call fcn.0044cb10
test al, al
jne 0x44c538
push 0x4fd0b4
mov ecx, esi
call fcn.004058b0
jmp 0x44c610
cmp byte [edi + 0x354], 0
je 0x44c5ec
add edi, 0x244
jmp 0x44c5f2
mov edi, dword [edi + 0x240]
push 0x4ffe64
mov ecx, esi
call fcn.004058b0
lea ecx, [edi + 4]
push ecx
push 0x4fc47c
push eax
call fcn.004048f0
add esp, 0xc
xor bl, bl
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x44c625
call fcn.00437500
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x44cb10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor ebx, ebx
push edi
mov edi, ecx
test esi, esi
je 0x44cb51
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
mov eax, esi
sub eax, ebx
push eax
mov eax, dword [ebp + 0xc]
add eax, ebx
push eax
push dword [edi + 0x234]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x44cb5c
add ebx, dword [ebp - 4]
cmp ebx, esi
jb 0x44cb22
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp byte [edi + 0x354], 0
lea eax, [edi + 0x244]
jne 0x44cb71
mov eax, dword [edi + 0x240]
mov ecx, dword [ebp + 8]
mov dword [ebp + 0xc], eax
call fcn.00427350
push 0x4ff9ec
mov esi, eax
push 0x4fc47c
push esi
call fcn.004048f0
mov edx, dword [ebp + 0xc]
add edx, 4
push edx
push 0x4fc47c
push esi
call fcn.004048f0
mov ecx, dword [ebp + 8]
add esp, 0x18
push 0x503370
call fcn.004058b0
push dword [ebp + 0x10]
mov esi, eax
push 0x4fc45c
push esi
call fcn.004048f0
push 0x503384
push 0x4fc47c
push esi
call fcn.004048f0
push ebx
push 0x4fc45c
push esi
call fcn.004048f0
push 0x503394
push 0x4fc47c
push esi
call fcn.004048f0
add esp, 0x30
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x44cf40
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call fcn.0044ccd0
add esp, 4
test eax, eax
js 0x44d12c
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [eax + 0xf0]
xor ebx, ebx
shl edi, 2
test edi, edi
jle 0x44cfb4
lea esi, [eax + 8]
add eax, 8
lea esi, [esi + edi*4]
mov edx, dword [eax - 8]
lea eax, [eax + 0x10]
mov ecx, dword [esi - 8]
lea esi, [esi - 0x10]
mov dword [eax - 0x18], ecx
add ebx, 4
mov ecx, dword [esi + 0xc]
sub edi, 4
mov dword [esi + 8], edx
mov edx, dword [eax - 0x14]
mov dword [eax - 0x14], ecx
mov ecx, dword [esi + 0x10]
mov dword [esi + 0xc], edx
mov edx, dword [eax - 0x10]
mov dword [eax - 0x10], ecx
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x10], edx
mov edx, dword [eax - 0xc]
mov dword [eax - 0xc], ecx
mov dword [esi + 0x14], edx
cmp ebx, edi
jl 0x44cf74
mov ebx, dword [ebp + 8]
mov edi, 1
cmp dword [ebx + 0xf0], edi
jle 0x44d127
lea esi, [ebx + 2]
nop dword [eax + eax]
mov edx, dword [esi + 0xe]
lea esi, [esi + 0x10]
mov eax, edx
inc edi
shr eax, 0x18
movzx ecx, byte [eax*4 + str.cc]
movzx eax, byte [esi - 1]
mov ecx, dword [ecx*4 + 0x4fab20]
movzx eax, byte [eax*4 + str.cc]
xor ecx, dword [eax*4 + 0x4fa220]
movzx eax, byte [esi]
movzx eax, byte [eax*4 + str.cc]
xor ecx, dword [eax*4 + 0x4fa620]
movzx eax, dl
mov edx, dword [esi + 2]
movzx eax, byte [eax*4 + str.cc]
xor ecx, dword [eax*4 + 0x4fbb50]
mov eax, edx
shr eax, 0x18
mov dword [esi - 2], ecx
movzx ecx, byte [eax*4 + str.cc]
movzx eax, byte [esi + 3]
mov ecx, dword [ecx*4 + 0x4fab20]
movzx eax, byte [eax*4 + str.cc]
xor ecx, dword [eax*4 + 0x4fa220]
movzx eax, byte [esi + 4]
movzx eax, byte [eax*4 + str.cc]
xor ecx, dword [eax*4 + 0x4fa620]
movzx eax, dl
mov edx, dword [esi + 6]
movzx eax, byte [eax*4 + str.cc]
xor ecx, dword [eax*4 + 0x4fbb50]
mov eax, edx
shr eax, 0x18
mov dword [esi + 2], ecx
movzx ecx, byte [eax*4 + str.cc]
movzx eax, byte [esi + 7]
mov ecx, dword [ecx*4 + 0x4fab20]
movzx eax, byte [eax*4 + str.cc]
xor ecx, dword [eax*4 + 0x4fa220]
movzx eax, byte [esi + 8]
movzx eax, byte [eax*4 + str.cc]
xor ecx, dword [eax*4 + 0x4fa620]
movzx eax, dl
mov edx, dword [esi + 0xa]
movzx eax, byte [eax*4 + str.cc]
xor ecx, dword [eax*4 + 0x4fbb50]
mov eax, edx
shr eax, 0x18
mov dword [esi + 6], ecx
movzx ecx, byte [eax*4 + str.cc]
movzx eax, byte [esi + 0xb]
mov ecx, dword [ecx*4 + 0x4fab20]
movzx eax, byte [eax*4 + str.cc]
xor ecx, dword [eax*4 + 0x4fa220]
movzx eax, byte [esi + 0xc]
movzx eax, byte [eax*4 + str.cc]
xor ecx, dword [eax*4 + 0x4fa620]
movzx eax, dl
movzx eax, byte [eax*4 + str.cc]
xor ecx, dword [eax*4 + 0x4fbb50]
mov dword [esi + 0xa], ecx
cmp edi, dword [ebx + 0xf0]
jl 0x44cfd0
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret