joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44fa1a
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1060
call fcn.0043fe00
mov eax, dword [0x403b5c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
push 0x1c9181
mov dword [ebp - 0x1054], ebx
call fcn.00456bc8
add ebx, 0xb0
mov eax, dword [ebx]
push ebx
xor edi, edi
mov dword [ebp - 0x105c], ebx
call dword [eax + 0xc]
push 0x824
lea ecx, [ebp - 0x1050]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov esi, eax
test esi, esi
jne 0x44fb40
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x44fbbb
mov ebx, dword [ebp - 0x1054]
add ebx, 0xb0
mov esi, dword [ebx]
push ebx
mov dword [ebp - 0x1058], ebx
call dword [esi + 0x18]
push eax
push ebx
call dword [esi + 0xb8]
mov esi, eax
mov eax, dword [ebx]
push ebx
mov dword [ebp - 0x1060], esi
call dword [eax + 0x18]
push 0x5c
pop ecx
push ecx
push eax
push esi
call fcn.00443758
mov ebx, eax
test ebx, ebx
je 0x44fbbb
xor eax, eax
mov word [ebx], ax
push 0x824
lea eax, [ebp - 0x1050]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov esi, eax
push 0x5c
pop eax
mov word [ebx], ax
lea eax, [esi - 1]
cmp eax, 0x823
ja 0x44fb2b
mov eax, ebx
sub eax, dword [ebp - 0x1060]
sar eax, 1
cmp esi, eax
jbe 0x44fb0b
push 0x1c9183
call fcn.00456bc8
mov eax, 0x825
sub eax, esi
push eax
lea eax, [ebp - 0x1050]
lea eax, [eax + esi*2]
push eax
push ebx
call fcn.0044081b
push ebx
call fcn.004407f3
add esi, eax
mov ecx, dword [ebp - 0x1058]
mov eax, dword [ecx]
push ecx
call dword [eax + 0xbc]
mov ebx, dword [ebp - 0x105c]
lea eax, [esi - 1]
cmp eax, 0x823
ja 0x44fbbb
mov eax, dword [ebx]
push ebx
call dword [eax + 0xc]
push eax
lea eax, [ebp - 0x1050]
push eax
call fcn.0044334a
test eax, eax
je 0x44fbbb
cmp esi, 0x104
ja 0x44fbbb
mov edi, dword [ebp - 0x1054]
push esi
lea ecx, [ebp - 0x1050]
add edi, 0xb0
mov eax, dword [edi]
push ecx
push edi
call dword [eax + 0x28]
test eax, eax
jne 0x44fb8e
mov eax, 0x8007000e
jmp 0x44fbbd
mov eax, dword [ebx]
push ebx
call dword [eax + 0xc]
push dword [ebp + 8]
mov esi, eax
mov eax, dword [edi]
push edi
call dword [eax + 0x18]
mov ebx, dword [ebp - 0x1054]
push eax
push esi
mov ecx, ebx
call fcn.0044eb1a
mov edi, eax
test edi, edi
js 0x44fbbb
mov ecx, ebx
call fcn.0044cac8
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043f894
leave
ret 4
Function at 0x44fbce
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x105c
call fcn.0043fe00
mov eax, dword [0x403b5c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x105c], 0
push ebx
push esi
push edi
mov edi, ecx
lea ebx, [edi + 0xb0]
mov eax, dword [ebx]
push ebx
mov dword [ebp - 0x1058], edi
call dword [eax + 0xc]
add edi, 0xb0
mov esi, eax
mov eax, dword [edi]
push edi
call dword [eax + 0x18]
push eax
push esi
call fcn.0044f268
test eax, eax
je 0x44fd87
push 0x1c9185
call fcn.00456bc8
mov eax, dword [ebx]
push ebx
call dword [eax + 0xc]
push 0x824
lea ecx, [ebp - 0x1050]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
mov ebx, eax
test ebx, ebx
jne 0x44fd08
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x44fd87
mov esi, dword [edi]
push edi
call dword [esi + 0x18]
push eax
push edi
call dword [esi + 0xb8]
mov esi, eax
mov eax, dword [edi]
push edi
mov dword [ebp - 0x1054], esi
call dword [eax + 0x18]
push 0x5c
pop ecx
push ecx
push eax
push esi
call fcn.00443758
mov esi, eax
test esi, esi
je 0x44fcff
xor eax, eax
mov word [esi], ax
push 0x824
lea eax, [ebp - 0x1050]
push eax
push dword [ebp - 0x1054]
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
mov ebx, eax
push 0x5c
pop eax
mov word [esi], ax
lea eax, [ebx - 1]
cmp eax, 0x823
ja 0x44fcff
mov eax, dword [edi]
push edi
call dword [eax + 0x18]
mov ecx, eax
mov eax, esi
sub eax, dword [ebp - 0x1054]
sar eax, 1
sub ecx, eax
lea eax, [ecx + ebx]
mov dword [ebp - 0x1054], eax
cmp eax, 0x824
ja 0x44fcfd
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x1050]
lea eax, [eax + ebx*2]
push esi
push eax
call sub.MSVCR100.dll_memcpy
mov eax, dword [ebp - 0x1054]
add esp, 0xc
mov ebx, eax
mov eax, dword [edi]
push edi
call dword [eax + 0xbc]
lea eax, [ebx - 1]
cmp eax, 0x823
ja 0x44fd87
mov esi, dword [ebp - 0x1058]
add esi, 0xb0
mov eax, dword [esi]
push esi
call dword [eax + 0xc]
push eax
lea eax, [ebp - 0x1050]
push eax
call fcn.0044334a
test eax, eax
je 0x44fd87
cmp ebx, 0x104
ja 0x44fd87
mov eax, dword [edi]
push ebx
lea ecx, [ebp - 0x1050]
push ecx
push edi
call dword [eax + 0x28]
test eax, eax
jne 0x44fd56
mov eax, 0x8007000e
jmp 0x44fd8d
mov eax, dword [esi]
push esi
call dword [eax + 0xc]
push dword [ebp + 8]
mov esi, eax
mov eax, dword [edi]
push edi
call dword [eax + 0x18]
mov ebx, dword [ebp - 0x1058]
push eax
push esi
mov ecx, ebx
call fcn.0044eb1a
mov dword [ebp - 0x105c], eax
test eax, eax
js 0x44fd8d
mov ecx, ebx
call fcn.0044cac8
mov eax, dword [ebp - 0x105c]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043f894
leave
ret 4
Function at 0x454033
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x718
mov eax, dword [0x403b5c]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ecx + 0x24]
mov eax, dword [ebp + 8]
push esi
cmp edx, 0xffffffff
jne 0x454084
push 0x41ace8
push 0x15
lea ecx, [ebp - 0x714]
call fcn.00454511
mov esi, eax
push 0x4a66d0
lea eax, [ebp - 0x38c]
mov ecx, 0xe2
lea edi, [ebp - 0x38c]
push eax
rep movsd dword es:[edi], dword [esi]
call sub.MSVCR100.dll__CxxThrowException
and dword [ebp - 0x718], 0
cmp dword [eax + 0x14], 0x10
jb 0x454095
mov ecx, dword [eax]
jmp 0x454097
mov ecx, eax
push 0
lea esi, [ebp - 0x718]
push esi
push dword [eax + 0x10]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4540d3
cmp byte [ebp + 0xc], al
je 0x4540cf
push 0x41acbc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xf
lea ecx, [ebp - 0x714]
call fcn.0043e526
jmp 0x454064
xor al, al
jmp 0x4540d5
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0043f894
leave
ret 8

Function at 0x454205
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x714
mov eax, dword [0x403b5c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x14], 8
push edi
jb 0x454227
mov eax, dword [esi]
jmp 0x454229
mov eax, esi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call edi
test eax, eax
jne 0x4542af
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x4542af
cmp eax, 5
jne 0x45426d
push dword [ebp + 0xc]
push 0x80
push esi
call fcn.004542c1
cmp dword [esi + 0x14], 8
jb 0x45425e
mov eax, dword [esi]
jmp 0x454260
mov eax, esi
push eax
call edi
test eax, eax
jne 0x4542af
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4542af
cmp byte [ebp + 0xc], 0
je 0x4542ab
push esi
push 0x41adf4
push eax
push 0xf
lea ecx, [ebp - 0x714]
call fcn.0045446d
mov esi, eax
push 0x4a66d0
lea eax, [ebp - 0x38c]
mov ecx, 0xe2
lea edi, [ebp - 0x38c]
push eax
rep movsd dword es:[edi], dword [esi]
call sub.MSVCR100.dll__CxxThrowException
xor al, al
jmp 0x4542b1
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0043f894
leave
ret 8

Function at 0x4542c1
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x714
mov eax, dword [0x403b5c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x14], 8
jb 0x4542e2
mov eax, dword [esi]
jmp 0x4542e4
mov eax, esi
push dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x454335
cmp byte [ebp + 0x10], al
je 0x454335
lea eax, [ebp + 0xc]
push eax
push esi
push 0x41ae28
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xf
lea ecx, [ebp - 0x714]
call fcn.00454596
mov esi, eax
push 0x4a66d0
lea eax, [ebp - 0x38c]
mov ecx, 0xe2
lea edi, [ebp - 0x38c]
push eax
rep movsd dword es:[edi], dword [esi]
call sub.MSVCR100.dll__CxxThrowException
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0043f894
leave
ret 0xc
Function at 0x456537
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a4
mov eax, dword [0x403b5c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x29c], eax
mov eax, dword [0x4b4b90]
push ebx
mov ebx, dword [ebp + 8]
cmp eax, 0xffffffff
je 0x456712
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov dword [ebp - 0x2a0], edi
test edi, edi
je 0x456711
push esi
xor esi, esi
cmp dword [edi], esi
jne 0x456710
mov dword [edi], 1
cmp ebx, 0x7e
ja 0x45670e
mov ebx, dword [edi + ebx*4 + 4]
mov dword [ebp - 0x2a4], ebx
test ebx, ebx
je 0x45670e
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push esi
push eax
call sub.MSVCR100.dll_memset
mov eax, dword [ebp + 0x14]
and eax, 3
add esp, 0xc
mov dword [ebp - 0x290], esi
mov dword [ebp - 0x298], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push ebx
mov dword [ebp - 0x294], eax
call fcn.0045683a
cmp eax, dword [ebx + 0x24]
jg 0x456633
mov ecx, dword [ebx + 0x48]
cmp ecx, dword [ebx + 0x44]
jae 0x456633
test byte [ebx + 4], 1
jne 0x456633
test dword [ebx + 4], 0x400
jne 0x456633
test byte [ebp + 0x14], 0x10
jne 0x456633
cmp dword [0x4f2594], esi
je 0x456633
push esi
lea eax, [ebp - 0x28c]
push eax
push 0x20
push 1
call dword [sym.imp.KERNEL32.dll_RtlCaptureStackBackTrace]
movzx eax, ax
mov dword [ebp - 0x290], eax
jmp 0x456635
mov eax, esi
mov edi, dword [ebp - 0x298]
mov esi, ebx
mov ebx, dword [ebp - 0x29c]
push ebx
push eax
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x294]
push dword [ebp + 0xc]
push edi
call fcn.0045692f
test byte [esi + 4], 2
jne 0x456674
mov esi, dword [esi]
mov eax, dword [ebp - 0x290]
test esi, esi
jne 0x456643
mov ebx, dword [ebp - 0x2a4]
test edi, edi
mov edi, dword [ebp - 0x2a0]
jne 0x4566bb
test byte [0x4f2580], 2
je 0x4566bb
push dword [ebp - 0x29c]
push dword [ebp - 0x294]
push dword [ebp + 0xc]
push dword [ebx + 8]
push dword [ebx + 0x38]
push dword [ebx + 0x34]
push 0x41aa30
push dword [0x4f258c]
push dword [0x4f2588]
call fcn.00456721
mov esi, dword [ebx + 0xc]
cmp esi, 0xffffffff
je 0x456709
mov esi, dword [edi + esi*4 + 4]
test esi, esi
je 0x456709
mov edi, dword [ebp - 0x298]
mov ebx, dword [ebp - 0x290]
push 0
push ebx
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x294]
push dword [ebp + 0xc]
push edi
call fcn.0045692f
test byte [esi + 4], 2
jne 0x456703
mov esi, dword [esi]
test esi, esi
jne 0x4566d7
mov edi, dword [ebp - 0x2a0]
and dword [edi], 0
jmp 0x456710
mov dword [edi], esi
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0043f894
leave
ret 0x10
Function at 0x457d15
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x403b5c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x240], eax
mov esi, 0x104
lea eax, [ebp - 0x22c]
push esi
push eax
call fcn.0045a868
pop ecx
pop ecx
test eax, eax
jne 0x457d52
or eax, 0xffffffff
jmp 0x457ef8
push ebx
xor eax, eax
lea ebx, [ebp - 0x22c]
push edi
mov dword [ebp - 0x234], ebx
cmp word [ebp - 0x22c], ax
je 0x457d79
add ebx, 2
cmp word [ebx], ax
jne 0x457d6b
mov dword [ebp - 0x234], ebx
push 1
call fcn.0045a80e
pop ecx
push dword [0x4b4714]
call fcn.00445163
mov edi, eax
mov dword [ebp - 0x230], edi
cmp edi, 0x64
jbe 0x457d9c
xor edi, edi
inc edi
lea eax, [ebp - 0x22c]
sub ebx, eax
sar ebx, 1
push edi
push 0x41b400
lea eax, [ebp - 0x24]
push 0xffffffffffffffff
push eax
call fcn.00458d17
add esp, 0x10
test ebx, ebx
js 0x457e4d
cmp ebx, esi
ja 0x457e4d
lea ecx, [ebp - 0x23c]
mov eax, esi
sub eax, ebx
push ecx
push eax
call fcn.00459ad1
pop ecx
pop ecx
push dword [ebp - 0x23c]
lea eax, [ebp - 0x24]
push dword [ebp - 0x234]
push eax
call fcn.00444120
push 1
push 0
push 0x80
push 1
push 0
push 1
push 0xc0000000
lea eax, [ebp - 0x22c]
push eax
call fcn.00497d73
mov dword [ebp - 0x238], eax
cmp eax, 0xffffffff
jne 0x457eb0
cmp edi, 0x64
jb 0x457e28
xor edi, edi
inc edi
cmp edi, dword [ebp - 0x230]
jne 0x457da6
push edi
push 0x41b400
lea eax, [ebp - 0x24]
push 0xffffffffffffffff
push eax
call fcn.00458d17
add esp, 0x10
test ebx, ebx
jns 0x457e53
call dword [sym.imp.MSVCR100.dll__invalid_parameter_noinfo_noreturn]
cmp ebx, esi
ja 0x457e4d
lea eax, [ebp - 0x230]
push eax
sub esi, ebx
push esi
call fcn.00459ad1
pop ecx
pop ecx
push dword [ebp - 0x230]
lea eax, [ebp - 0x24]
push dword [ebp - 0x234]
push eax
call fcn.00444120
mov ebx, 0x80
push ebx
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 1
push 0
push ebx
push 2
push 0
push 1
push 0xc0000000
lea eax, [ebp - 0x22c]
push eax
call fcn.00497d73
mov esi, eax
jmp 0x457eb6
mov esi, dword [ebp - 0x238]
cmp edi, 0x64
jb 0x457ebd
xor edi, edi
cmp byte [ebp + 0x10], 0
je 0x457ed2
lea eax, [edi + 1]
push eax
push dword [0x4b4714]
call fcn.0044518b
call fcn.00457ba9
mov eax, dword [ebp - 0x240]
pop edi
pop ebx
test eax, eax
je 0x457ef6
push dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x22c]
push eax
call fcn.00456f22
add esp, 0xc
mov eax, esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0043f894
leave
ret
Function at 0x457fca
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 8], 0xffffffff
jne 0x457fd9
xor eax, eax
leave
ret
and dword [ebp - 4], 0
push ebx
push esi
lea eax, [ebp - 4]
push edi
xor esi, esi
push eax
inc esi
call fcn.00458d6c
mov ebx, eax
push ebx
call fcn.0043c574
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4580fd
push 0x4f25b8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0
call fcn.00457772
pop ecx
test eax, eax
jne 0x45801e
xor esi, esi
jmp 0x4580e7
cmp byte [0x4f2847], 0
je 0x458031
push 0x72766c72
call fcn.00456bc8
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
mov byte [0x4f2847], 1
call fcn.00458d6c
pop ecx
cmp eax, ebx
jne 0x458052
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
je 0x45807e
push edi
call fcn.0043c581
lea eax, [ebp - 4]
push eax
call fcn.00458d6c
mov ebx, eax
push ebx
call fcn.0043c574
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x45807e
push 0x72766c73
call fcn.00456bc8
xor esi, esi
cmp dword [ebp + 0x14], 0
jne 0x45808c
cmp ebx, 0xea60
ja 0x458017
test esi, esi
je 0x4580a2
push dword [ebp + 0xc]
push dword [ebp - 4]
push ebx
push edi
call fcn.00458f25
add esp, 0x10
mov esi, eax
mov byte [0x4f2847], 0
test esi, esi
je 0x4580dd
push 0
lea eax, [ebp - 8]
push eax
push ebx
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4580cc
cmp dword [ebp - 8], ebx
jne 0x4580cc
xor esi, esi
inc esi
jmp 0x4580ce
xor esi, esi
push ebx
push edi
push dword [ebp + 0x10]
call fcn.004591f5
add esp, 0xc
jmp 0x4580e7
push 0x74697970
call fcn.00456bc8
push 0x4f25b8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
je 0x4580fd
push edi
call fcn.0043c581
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x4591f5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x45923d
push esi
push 1
push 0
push 0x80
push 2
push 0
push 1
push 0xc0000000
push dword [ebp + 8]
call fcn.00497d73
mov esi, eax
cmp esi, 0xffffffff
je 0x45923c
push 0
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebp
ret
Function at 0x45923f
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x403b5c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
test dword [0x4f25e4], 0x2000
je 0x45926b
call fcn.0045a793
jmp 0x459300
push ebx
mov ebx, 0x104
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.0045a868
pop ecx
pop ecx
test eax, eax
je 0x4592ff
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x41b410
call fcn.004436e9
call fcn.00457cd0
test al, al
je 0x4592fd
push edi
call fcn.00457f05
push 1
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.00457d15
mov edi, eax
add esp, 0xc
cmp edi, 0xffffffff
je 0x4592fc
push esi
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
call fcn.00457fca
add esp, 0x10
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x414]
test esi, esi
jne 0x4592ed
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x4592fc
push ebx
push 0x4f2634
push eax
call fcn.00456f22
add esp, 0xc
pop edi
mov eax, esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0043f894
leave
ret
Function at 0x459cc3
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x403b5c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
push edi
mov edi, dword [ebp + 0xc]
mov byte [eax], bl
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x218], ebx
mov esi, ebx
mov byte [edi], 1
call fcn.0045a6ea
mov dword [ebp - 0x220], eax
cmp eax, 3
je 0x459edd
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00459c98
pop ecx
pop ecx
test eax, eax
je 0x459edd
xor eax, eax
inc eax
push eax
push ebx
push 0x80
push 3
push ebx
push eax
push 0x80000000
lea eax, [ebp - 0x20c]
push eax
call fcn.00497d73
mov dword [ebp - 0x210], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x210]
cmp ecx, 0xffffffff
jne 0x459d7b
cmp eax, 0x20
jne 0x459d71
push 0x1c8016
call fcn.00456bc8
mov eax, ebx
mov byte [edi], al
jmp 0x459edd
cmp eax, 5
je 0x459d68
xor eax, eax
inc eax
jmp 0x459d6a
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi - 0x8c]
cmp eax, 0xf74
ja 0x459ec7
push edi
call fcn.00456e87
mov esi, eax
test esi, esi
je 0x459ec7
push ebx
lea eax, [ebp - 0x218]
push eax
push edi
push esi
push dword [ebp - 0x210]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x459ec7
cmp edi, dword [ebp - 0x218]
jne 0x459ec7
push ebx
push edi
push esi
call fcn.00457bf4
add esp, 0xc
test eax, eax
je 0x459ec7
cmp dword [esi + 0x78], ebx
jne 0x459ec7
mov eax, dword [esi + 0x7c]
push 0xc
xor edx, edx
pop ecx
div ecx
mov ecx, eax
imul ecx, ecx, 0xc
mov dword [ebp - 0x214], eax
cmp dword [esi + 0x7c], ecx
jne 0x459ec7
lea edi, [esi + 0x80]
test eax, eax
jle 0x459e9b
cmp dword [edi], 0x2102
ja 0x459e41
je 0x459e61
cmp dword [edi], 0x10
je 0x459e61
cmp dword [edi], 0x195b
je 0x459e61
cmp dword [edi], 0x19df
jbe 0x459e71
cmp dword [edi], 0x19e2
jbe 0x459e61
jmp 0x459e71
cmp dword [edi], 0x24c8
jb 0x459e71
cmp dword [edi], 0x24cb
jbe 0x459e61
cmp dword [edi], 0x24cd
je 0x459e61
cmp dword [edi], 0x2696
jne 0x459e71
push dword [edi + 4]
push dword [edi]
call fcn.00457034
mov eax, dword [ebp - 0x214]
cmp dword [edi], 0x195b
je 0x459e89
cmp dword [edi], 0x19e1
je 0x459e89
cmp dword [edi], 0x24cd
jne 0x459e8a
inc ebx
add edi, 0xc
dec eax
mov dword [ebp - 0x214], eax
jne 0x459e18
cmp ebx, 3
je 0x459ea9
call fcn.00496baf
test eax, eax
je 0x459eb4
cmp ebx, 2
jl 0x459eb4
mov ecx, dword [ebp - 0x21c]
mov byte [ecx], 1
jmp 0x459ec7
xor eax, eax
inc eax
cmp dword [ebp - 0x220], eax
jne 0x459ec7
mov ecx, dword [ebp - 0x21c]
mov byte [ecx], al
push dword [ebp - 0x210]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x459edd
push esi
call fcn.00456e98
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043f894
leave
ret
Function at 0x45a079
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x403b5c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call fcn.0045ac9e
and dword [ebp - 0x38], 0
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x34]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [ebp - 0x38]
push eax
push 0x11
call fcn.00457034
push dword [ebp - 0x24]
push 0x12
call fcn.00457034
mov edi, 0x80000000
xor ecx, ecx
mov eax, edi
cpuid
lea esi, [ebp - 0x14]
mov dword [esi], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
cmp dword [ebp - 0x14], edi
jbe 0x45a100
xor ecx, ecx
lea eax, [edi + 1]
cpuid
mov dword [esi], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
test dword [ebp - 8], 0x20000000
je 0x45a0fc
push 9
jmp 0x45a105
push 0
jmp 0x45a105
push 0xffff
push 0x2699
call fcn.00457034
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043f894
leave
ret

Function at 0x45a503
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x403b5c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
push 0x118
lea eax, [ebp - 0x11c]
push esi
push eax
mov dword [ebp - 0x124], esi
mov dword [ebp - 0x120], esi
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x128]
push eax
push 1
push esi
push 0x42226c
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x45a5ab
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x134]
push eax
push esi
push 0x422298
push dword [ebp - 0x128]
mov dword [ebp - 0x12c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x45a59d
push dword [ebp - 0x130]
push 0x22df
call fcn.00457034
push dword [ebp - 0x128]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x45a5b5
push 0x1c800b
call fcn.00456bc8
lea eax, [ebp - 0x120]
push eax
call fcn.00496fd4
pop ecx
pop esi
test al, al
je 0x45a636
push dword [ebp - 0x114]
push 0x1a
call fcn.00457034
movzx ecx, word [ebp - 0xc]
movzx eax, word [ebp - 0xa]
shl ecx, 0x10
or ecx, eax
push ecx
push 0x43
call fcn.00457034
movzx eax, word [ebp - 8]
push eax
push 0x3a5
call fcn.00457034
push dword [ebp - 0x11c]
push 0x22e1
call fcn.00457034
push dword [ebp - 0x118]
push 0x22e2
call fcn.00457034
movzx eax, word [ebp - 0xc]
push eax
push 0x22e4
call fcn.00457034
movzx eax, word [ebp - 0xa]
push eax
push 0x22e5
call fcn.00457034
lea eax, [ebp - 0x124]
push eax
movzx eax, word [ebp - 0xa]
push eax
movzx eax, word [ebp - 0xc]
push eax
push dword [ebp - 0x118]
push dword [ebp - 0x11c]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
test eax, eax
je 0x45a66f
push dword [ebp - 0x124]
push 0x1af7
call fcn.00457034
jmp 0x45a685
push 0xffffffffffffffff
push 0x1af7
call fcn.00457034
push 0x1c800c
call fcn.00456bc8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043f894
leave
ret
Function at 0x45a69f
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x403b5c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 0x44], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
add ecx, 0x80000
adc eax, 0
shrd ecx, eax, 0x14
push ecx
push 0xc
shr eax, 0x14
call fcn.00457034
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043f894
leave
ret

Function at 0x45a868
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
call fcn.0049920f
test eax, eax
je 0x45a88b
push dword [ebp + 8]
push dword [ebp + 0xc]
call fcn.00444d6d
pop ecx
pop ecx
xor ecx, ecx
cmp ecx, eax
sbb eax, eax
neg eax
pop ebp
ret
push ebx
push edi
mov edi, dword [ebp + 8]
push 1
push dword [ebp + 0xc]
call fcn.0045abf1
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x45a91b
push edi
call fcn.00456efa
cmp word [edi + eax*2 - 2], 0x5c
pop ecx
je 0x45a8cd
push 0xffffffffffffffff
push 0x4035f0
push dword [ebp + 0xc]
push edi
call dword [sym.imp.MSVCR100.dll_wcsncat_s]
xor ebx, ebx
add esp, 0x10
cmp eax, 0x50
setne bl
test ebx, ebx
je 0x45a91b
push 0xffffffffffffffff
push 0x4222e8
push dword [ebp + 0xc]
push edi
call dword [sym.imp.MSVCR100.dll_wcsncat_s]
xor ebx, ebx
add esp, 0x10
cmp eax, 0x50
setne bl
test ebx, ebx
je 0x45a91b
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x45a91b
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ebx, [eax - 0xb7]
neg ebx
sbb ebx, ebx
inc ebx
jne 0x45a91b
push 0x1cb247
call fcn.00456bc8
pop edi
mov eax, ebx
pop ebx
pop ebp
ret