joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43a940
Capabilities:
Delete file
Write file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
push esi
lea ecx, [esp + 4]
push eax
push ecx
mov dword [esp + 0xc], 0
call fcn.00439930
lea edx, [esp + 0xc]
push str.writetest.dat
push edx
call fcn.00439b10
mov eax, dword [esp + 0x14]
add esp, 0x10
push 0
push 0
push 2
push 0
push 2
push 0x40000000
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x43a993
xor al, al
pop esi
pop ecx
ret 4
mov edx, dword [esp + 4]
push ebx
lea ecx, [esp + 0x10]
push 0
push ecx
push 1
push edx
push esi
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
push esi
setne bl
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
lea ecx, [esp + 8]
push ecx
call fcn.00439990
add esp, 4
mov al, bl
pop ebx
pop esi
pop ecx
ret 4

Function at 0x43a9e0
Capabilities:
Check os version

Disassembly:
sub esp, 0x9c
push esi
mov esi, dword [sym.imp.kernel32.dll_GetVersionExA]
push edi
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
mov dword [esp + 8], 0x9c
push eax
call esi
test eax, eax
jne 0x43aa2c
lea ecx, [esp + 8]
mov dword [esp + 8], 0x94
push ecx
call esi
test eax, eax
jne 0x43aa2c
pop edi
xor al, al
pop esi
add esp, 0x9c
ret
mov eax, dword [esp + 0xc]
pop edi
cmp eax, 6
pop esi
setae al
add esp, 0x9c
ret

Function at 0x43aa40
Capabilities:
Create directory

Disassembly:
sub esp, 0x804
push esi
push edi
push str.shell32.dll
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov esi, eax
push str.SHGetFolderPathA
push esi
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov edi, eax
test edi, edi
jne 0x43aa72
pop edi
pop esi
add esp, 0x804
ret 8
push esi
call dword [sym.imp.kernel32.dll_FreeLibrary]
mov ecx, dword [esp + 0x810]
lea eax, [esp + 0xc]
push eax
push 0
or ch, 0x80
push 0
push ecx
push 0
mov dword [esp + 0x1c], 0
call edi
test eax, eax
jne 0x43aabe
lea edx, [esp + 0xc]
lea eax, [esp + 8]
push edx
push eax
call fcn.00439930
lea ecx, [esp + 0x10]
push 0x4902e4
push ecx
call fcn.00439b10
add esp, 0x10
lea edx, [esp + 8]
push str.Enkord_
push edx
call fcn.00439b10
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.kernel32.dll_CreateDirectoryA]
add esp, 8
push 0
push eax
call esi
lea ecx, [esp + 8]
push str.Armada_Tanks_
push ecx
call fcn.00439b10
mov edx, dword [esp + 0x10]
add esp, 8
push 0
push edx
call esi
mov eax, dword [esp + 8]
pop edi
pop esi
add esp, 0x804
ret 8
Function at 0x43c530
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
push esi
mov esi, ecx
mov al, byte [esi + 0xc]
test al, al
je 0x43c545
call fcn.0043e630
pop esi
pop ecx
ret 4
mov eax, dword [esi + 0x53d24]
push 1
push 1
push 0
mov ecx, dword [eax]
push eax
call dword [ecx + 0xfc]
mov eax, dword [esi + 0x53d24]
push 1
push 1
push 1
mov edx, dword [eax]
push eax
call dword [edx + 0xfc]
mov eax, dword [esi + 0x53d24]
push 1
push 1
push 2
mov ecx, dword [eax]
push eax
call dword [ecx + 0xfc]
mov eax, dword [esi + 0x53d24]
push 1
push 1
push 3
mov edx, dword [eax]
push eax
call dword [edx + 0xfc]
mov eax, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp byte [eax], 0
jbe 0x43c6b5
push ebx
push ebp
push edi
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
and ebx, 0xffff
mov eax, dword [esi + 0x53d24]
mov bp, word [ecx + ebx*2 + 6]
mov ecx, dword [esi]
mov edi, ebp
mov edx, dword [eax]
mov ecx, dword [ecx + 0x54e14]
and edi, 0xffff
lea edi, [edi + edi*2]
shl edi, 5
mov ecx, dword [ecx + edi + 0x10]
push ecx
push 1
push ebx
push eax
call dword [edx + 0xfc]
mov ecx, dword [esi]
mov eax, dword [esi + 0x53d24]
mov ecx, dword [ecx + 0x54e14]
mov edx, dword [eax]
mov ecx, dword [ecx + edi + 0x14]
push ecx
push 2
push ebx
push eax
call dword [edx + 0xfc]
mov ecx, dword [esi]
mov eax, dword [esi + 0x53d24]
mov ecx, dword [ecx + 0x54e14]
mov edx, dword [eax]
mov ecx, dword [ecx + edi + 0x18]
push ecx
push 3
push ebx
push eax
call dword [edx + 0xfc]
mov edx, dword [esi]
mov eax, dword [edx + 0x54e14]
mov eax, dword [eax + edi + 0x1c]
test eax, eax
je 0x43c651
mov ecx, dword [esi + 0x53d24]
push eax
push 0x13
push ecx
mov edx, dword [ecx]
call dword [edx + 0xc8]
mov eax, dword [esi]
mov ecx, dword [eax + 0x54e14]
mov edi, dword [ecx + edi + 0x20]
test edi, edi
je 0x43c673
mov eax, dword [esi + 0x53d24]
push edi
push 0x14
push eax
mov edx, dword [eax]
call dword [edx + 0xc8]
mov eax, dword [esi + 0x53d24]
mov ecx, dword [esi]
push ebp
add ecx, 0x54e08
mov edi, dword [eax]
call fcn.0044a060
mov ecx, dword [esi + 0x53d24]
push eax
push ebx
push ecx
call dword [edi + 0xf4]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
inc eax
movzx cx, byte [edx]
cmp ax, cx
mov dword [esp + 0x10], eax
jb 0x43c5b1
pop edi
pop ebp
pop ebx
pop esi
pop ecx
ret 4

Function at 0x43e870
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [ecx + 0x53d7c]
push esi
xor eax, eax
mov esi, eax
and esi, 0xffff
cmp dword [edx + esi*4], 0
je 0x43e8a4
inc eax
cmp ax, 0x300
jb 0x43e879
mov ecx, dword [ecx]
pop esi
mov dword [esp + 4], str.___WARNING_CRITICAL:_NUM_ENTITY_IN_LIST_is_full_n
add ecx, 0x5a8
jmp fcn.00445d20
mov ecx, dword [esp + 8]
and eax, 0xffff
pop esi
mov dword [edx + eax*4], ecx
ret 4
Function at 0x440640
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
mov edi, dword [ecx + 0x40b4]
test edi, edi
je 0x440767
mov esi, dword [esp + 0x14]
xor edx, edx
mov dx, word [ecx + 8]
mov eax, esi
mov ebx, dword [esp + 0x10]
and eax, 0xffff
imul eax, edx
mov edx, ebx
and edx, 0xffff
add eax, edx
xor edx, edx
mov dx, word [ecx + 0x40b8]
cmp eax, edx
jge 0x440767
mov edx, dword [esp + 0x18]
push ebp
movzx bp, dl
mov word [edi + eax*2], bp
mov ax, word [ecx + 8]
imul ax, si
mov edi, dword [ecx + 0x40ec]
add eax, ebx
xor ebx, ebx
pop ebp
mov bx, word [ecx + 4]
lea esi, [eax + eax*2]
mov ax, word [ecx + 6]
mov dword [esp + 0x14], ebx
fild dword [esp + 0x14]
mov ecx, eax
mov eax, edx
and eax, 0xff
and ecx, 0xffff
fdivr dword [0x4851d8]
cdq
mov dword [esp + 0x14], ecx
add esi, esi
idiv ecx
and esi, 0xffff
fild dword [esp + 0x14]
fdivr dword [0x4851d8]
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], eax
lea eax, [esi + esi*2]
lea eax, [edi + eax*8]
fstp dword [esp + 0x14]
fild dword [esp + 0x10]
fmul dword [esp + 0x14]
fild dword [esp + 0x18]
fmul st(2)
fstp dword [esp + 0x10]
fld dword [0x4855d4]
fadd st(1)
fst dword [eax + 0x10]
fld dword [esp + 0x10]
fadd dword [0x4855d4]
fst dword [eax + 0x14]
fld st(2)
fadd dword [esp + 0x14]
fst dword [eax + 0x28]
fld st(1)
fstp dword [eax + 0x2c]
fld st(2)
fstp dword [eax + 0x40]
fld dword [esp + 0x10]
fadd st(5)
fst dword [esp + 0x14]
fst dword [eax + 0x44]
fxch st(3)
fstp dword [eax + 0x58]
fxch st(2)
fstp dword [eax + 0x5c]
fxch st(1)
fstp dword [eax + 0x70]
mov ecx, dword [esp + 0x14]
fstp dword [eax + 0x74]
mov dword [eax + 0x8c], ecx
fadd st(1)
fstp dword [eax + 0x88]
fstp st(0)
pop edi
pop esi
pop ebx
ret 0xc

Function at 0x4459b0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push eax
mov esi, ecx
call dword [sym.imp.kernel32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 0x208], eax
jne 0x4459de
xor al, al
pop esi
ret 4
push 0
push eax
call dword [sym.imp.kernel32.dll_GetFileSize]
mov dword [esi + 0x210], eax
mov eax, dword [esi]
test eax, eax
je 0x445a02
push eax
call fcn.00479ef5
add esp, 4
mov dword [esi], 0
mov ecx, dword [esi + 0x210]
push ecx
call fcn.004799d9
add esp, 4
mov dword [esi], eax
test eax, eax
jne 0x445a1d
xor al, al
pop esi
ret 4
mov edx, dword [esi + 0x210]
push edi
lea edi, [esi + 0x20c]
push 0
push edi
push edx
push eax
mov eax, dword [esi + 0x208]
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
mov ecx, dword [esi + 0x210]
mov eax, dword [edi]
cmp ecx, eax
pop edi
je 0x445a4f
xor al, al
pop esi
ret 4
mov edx, dword [esi + 0x208]
push edx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov al, 1
pop esi
ret 4
Function at 0x445d20
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x445ddd
push 0
push 0
push 4
push 0
push 2
push 0x40000000
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi], eax
je 0x445ddd
push edi
xor edi, edi
cmp word [esi + 8], di
mov dword [esp + 8], 0
jle 0x445d7c
lea eax, [esp + 8]
push 0x491d80
push eax
call fcn.00439b10
add esp, 8
inc edi
cmp di, word [esi + 8]
jl 0x445d63
mov ecx, dword [esp + 0x14]
lea edx, [esp + 8]
push ecx
push edx
call fcn.00439b10
mov eax, dword [esp + 0x10]
push eax
call fcn.00439900
mov ecx, dword [esi]
add esp, 0xc
mov edi, eax
push 2
push 0
push 0
push ecx
call dword [sym.imp.kernel32.dll_SetFilePointer]
mov ecx, dword [esp + 8]
lea edx, [esp + 0xc]
movsx eax, di
push 0
push edx
mov edx, dword [esi]
push eax
push ecx
push edx
call dword [sym.imp.kernel32.dll_WriteFile]
mov eax, dword [esi]
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [esp + 8]
pop edi
test eax, eax
je 0x445ddd
push eax
call fcn.00479ef5
add esp, 4
pop esi
add esp, 8
ret 4

Function at 0x445df0
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x445ecb
push 0
push 0
push 4
push 0
push 2
push 0x40000000
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi], eax
je 0x445ecb
push edi
xor edi, edi
cmp word [esi + 8], di
mov dword [esp + 8], 0
jle 0x445e4c
lea eax, [esp + 8]
push 0x491d80
push eax
call fcn.00439b10
add esp, 8
inc edi
cmp di, word [esi + 8]
jl 0x445e33
mov ecx, dword [esp + 0x14]
lea edx, [esp + 8]
push ecx
push edx
call fcn.00439b10
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x10]
push eax
push ecx
call fcn.00439b10
lea edx, [esp + 0x18]
push 0x48e5f4
push edx
call fcn.00439b10
mov eax, dword [esp + 0x20]
push eax
call fcn.00439900
mov ecx, dword [esi]
add esp, 0x1c
mov edi, eax
push 2
push 0
push 0
push ecx
call dword [sym.imp.kernel32.dll_SetFilePointer]
mov ecx, dword [esp + 8]
lea edx, [esp + 0xc]
movsx eax, di
push 0
push edx
mov edx, dword [esi]
push eax
push ecx
push edx
call dword [sym.imp.kernel32.dll_WriteFile]
mov eax, dword [esi]
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [esp + 8]
pop edi
test eax, eax
je 0x445ecb
push eax
call fcn.00479ef5
add esp, 4
pop esi
add esp, 8
ret 8

Function at 0x445ee0
Capabilities:
Write file on windows

Disassembly:
mov al, byte [esp + 8]
mov dword [esp + 8], str.TRUE
test al, al
jne 0x445ef8
mov dword [esp + 8], str.FALSE
jmp fcn.00445df0
Function at 0x445f00
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x44600e
push 0
push 0
push 4
push 0
push 2
push 0x40000000
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi], eax
je 0x44600e
mov ecx, dword [esp + 0x18]
lea eax, [esp + 8]
push edi
push eax
push ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call fcn.00439d40
xor edi, edi
add esp, 8
cmp word [esi + 8], di
jle 0x445f76
lea edx, [esp + 8]
push 0x491d80
push edx
call fcn.00439b10
add esp, 8
inc edi
cmp di, word [esi + 8]
jl 0x445f5d
mov eax, dword [esp + 0x18]
lea ecx, [esp + 8]
push eax
push ecx
call fcn.00439b10
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push edx
push eax
call fcn.00439b10
lea ecx, [esp + 0x18]
push 0x48e5f4
push ecx
call fcn.00439b10
mov edx, dword [esp + 0x20]
push edx
call fcn.00439900
add esp, 0x1c
mov edi, eax
mov eax, dword [esi]
push 2
push 0
push 0
push eax
call dword [sym.imp.kernel32.dll_SetFilePointer]
mov eax, dword [esp + 8]
lea ecx, [esp + 0x10]
movsx edx, di
push 0
push ecx
mov ecx, dword [esi]
push edx
push eax
push ecx
call dword [sym.imp.kernel32.dll_WriteFile]
mov edx, dword [esi]
push edx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [esp + 8]
pop edi
test eax, eax
je 0x445ffd
push eax
call fcn.00479ef5
add esp, 4
mov dword [esp + 4], 0
mov eax, dword [esp + 8]
test eax, eax
je 0x44600e
push eax
call fcn.00479ef5
add esp, 4
pop esi
add esp, 0xc
ret 8

Function at 0x446020
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x44612e
push 0
push 0
push 4
push 0
push 2
push 0x40000000
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi], eax
je 0x44612e
mov ecx, dword [esp + 0x18]
lea eax, [esp + 8]
push edi
push eax
push ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call fcn.00439e00
xor edi, edi
add esp, 8
cmp word [esi + 8], di
jle 0x446096
lea edx, [esp + 8]
push 0x491d80
push edx
call fcn.00439b10
add esp, 8
inc edi
cmp di, word [esi + 8]
jl 0x44607d
mov eax, dword [esp + 0x18]
lea ecx, [esp + 8]
push eax
push ecx
call fcn.00439b10
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push edx
push eax
call fcn.00439b10
lea ecx, [esp + 0x18]
push 0x48e5f4
push ecx
call fcn.00439b10
mov edx, dword [esp + 0x20]
push edx
call fcn.00439900
add esp, 0x1c
mov edi, eax
mov eax, dword [esi]
push 2
push 0
push 0
push eax
call dword [sym.imp.kernel32.dll_SetFilePointer]
mov eax, dword [esp + 8]
lea ecx, [esp + 0x10]
movsx edx, di
push 0
push ecx
mov ecx, dword [esi]
push edx
push eax
push ecx
call dword [sym.imp.kernel32.dll_WriteFile]
mov edx, dword [esi]
push edx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [esp + 8]
pop edi
test eax, eax
je 0x44611d
push eax
call fcn.00479ef5
add esp, 4
mov dword [esp + 4], 0
mov eax, dword [esp + 8]
test eax, eax
je 0x44612e
push eax
call fcn.00479ef5
add esp, 4
pop esi
add esp, 0xc
ret 8
Function at 0x446140
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x446253
push 0
push 0
push 4
push 0
push 2
push 0x40000000
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi], eax
je 0x446253
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
lea eax, [esp + 8]
push edi
push eax
push ecx
push edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call fcn.00439ec0
xor edi, edi
add esp, 0xc
cmp word [esi + 8], di
jle 0x4461bb
lea eax, [esp + 8]
push 0x491d80
push eax
call fcn.00439b10
add esp, 8
inc edi
cmp di, word [esi + 8]
jl 0x4461a2
mov ecx, dword [esp + 0x18]
lea edx, [esp + 8]
push ecx
push edx
call fcn.00439b10
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x10]
push eax
push ecx
call fcn.00439b10
lea edx, [esp + 0x18]
push 0x48e5f4
push edx
call fcn.00439b10
mov eax, dword [esp + 0x20]
push eax
call fcn.00439900
mov ecx, dword [esi]
add esp, 0x1c
mov edi, eax
push 2
push 0
push 0
push ecx
call dword [sym.imp.kernel32.dll_SetFilePointer]
mov ecx, dword [esp + 8]
lea edx, [esp + 0x10]
movsx eax, di
push 0
push edx
mov edx, dword [esi]
push eax
push ecx
push edx
call dword [sym.imp.kernel32.dll_WriteFile]
mov eax, dword [esi]
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [esp + 8]
pop edi
test eax, eax
je 0x446242
push eax
call fcn.00479ef5
add esp, 4
mov dword [esp + 4], 0
mov eax, dword [esp + 8]
test eax, eax
je 0x446253
push eax
call fcn.00479ef5
add esp, 4
pop esi
add esp, 0xc
ret 0xc
Function at 0x446260
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x4463f9
push 0
push 0
push 4
push 0
push 2
push 0x40000000
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi], eax
je 0x4463f9
lea eax, [esp + 0xc]
push edi
push eax
call dword [sym.imp.kernel32.dll_GetLocalTime]
mov ecx, dword [esp + 0x28]
lea edx, [esp + 8]
push ecx
push edx
mov dword [esp + 0x10], 0
call fcn.00439930
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x10]
and eax, 0xffff
push eax
push ecx
call fcn.00439a70
lea edx, [esp + 0x18]
push 0x491d98
push edx
call fcn.00439b10
mov eax, dword [esp + 0x32]
lea ecx, [esp + 0x20]
and eax, 0xffff
push eax
push ecx
call fcn.00439a70
lea edx, [esp + 0x28]
push 0x491d98
push edx
call fcn.00439b10
mov eax, dword [esp + 0x44]
lea ecx, [esp + 0x30]
and eax, 0xffff
push eax
push ecx
call fcn.00439a70
lea edx, [esp + 0x38]
push 0x491d98
push edx
call fcn.00439b10
mov eax, dword [esp + 0x56]
lea ecx, [esp + 0x40]
and eax, 0xffff
push eax
push ecx
call fcn.00439a70
add esp, 0x40
lea edx, [esp + 8]
push 0x491d94
push edx
call fcn.00439b10
mov eax, dword [esp + 0x22]
mov ecx, dword [esp + 0x20]
and eax, 0xffff
and ecx, 0xffff
add eax, ecx
mov ecx, dword [esp + 0x26]
and ecx, 0xffff
lea eax, [eax + eax*2]
lea edx, [eax + eax*4]
mov eax, dword [esp + 0x24]
and eax, 0xffff
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
lea edi, [eax + edx*4]
lea eax, [esp + 0x10]
add edi, ecx
mov ecx, dword [esi + 0xc]
mov edx, edi
sub edx, ecx
push edx
push eax
call fcn.00439a70
lea ecx, [esp + 0x18]
push 0x48db9c
push ecx
call fcn.00439b10
mov edx, dword [esp + 0x20]
mov dword [esi + 0xc], edi
push edx
call fcn.00439900
add esp, 0x1c
mov edi, eax
mov eax, dword [esi]
push 2
push 0
push 0
push eax
call dword [sym.imp.kernel32.dll_SetFilePointer]
mov eax, dword [esp + 8]
lea ecx, [esp + 0xc]
movsx edx, di
push 0
push ecx
mov ecx, dword [esi]
push edx
push eax
push ecx
call dword [sym.imp.kernel32.dll_WriteFile]
mov edx, dword [esi]
push edx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [esp + 8]
pop edi
test eax, eax
je 0x4463f9
push eax
call fcn.00479ef5
add esp, 4
pop esi
add esp, 0x1c
ret 4
Function at 0x446400
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x446538
push 0
push 0
push 4
push 0
push 2
push 0x40000000
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi], eax
je 0x446538
push edi
xor edi, edi
cmp word [esi + 8], di
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
jle 0x446464
lea eax, [esp + 8]
push 0x491d80
push eax
call fcn.00439b10
add esp, 8
inc edi
cmp di, word [esi + 8]
jl 0x44644b
mov ecx, dword [esp + 0x18]
lea edx, [esp + 8]
push ecx
push edx
call fcn.00439b10
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x14]
push eax
push ecx
call fcn.00439e00
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x18]
push edx
push eax
call fcn.00439b10
lea ecx, [esp + 0x20]
push 0x48b784
push ecx
call fcn.00439b10
mov eax, dword [esp + 0x40]
lea edx, [esp + 0x2c]
push edx
push eax
call fcn.00439e00
mov ecx, dword [esp + 0x34]
lea edx, [esp + 0x30]
push ecx
push edx
call fcn.00439b10
lea eax, [esp + 0x38]
push 0x48e5f4
push eax
call fcn.00439b10
mov ecx, dword [esp + 0x40]
push ecx
call fcn.00439900
mov edx, dword [esi]
add esp, 0x3c
mov edi, eax
push 2
push 0
push 0
push edx
call dword [sym.imp.kernel32.dll_SetFilePointer]
mov edx, dword [esp + 8]
lea eax, [esp + 0x10]
movsx ecx, di
push 0
push eax
mov eax, dword [esi]
push ecx
push edx
push eax
call dword [sym.imp.kernel32.dll_WriteFile]
mov ecx, dword [esi]
push ecx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [esp + 8]
pop edi
test eax, eax
je 0x446527
push eax
call fcn.00479ef5
add esp, 4
mov dword [esp + 4], 0
mov eax, dword [esp + 8]
test eax, eax
je 0x446538
push eax
call fcn.00479ef5
add esp, 4
pop esi
add esp, 0xc
ret 0xc
Function at 0x446540
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x44664e
push 0
push 0
push 4
push 0
push 2
push 0x40000000
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi], eax
je 0x44664e
mov ecx, dword [esp + 0x18]
lea eax, [esp + 8]
push edi
push eax
push ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call fcn.00439fa0
xor edi, edi
add esp, 8
cmp word [esi + 8], di
jle 0x4465b6
lea edx, [esp + 8]
push 0x491d80
push edx
call fcn.00439b10
add esp, 8
inc edi
cmp di, word [esi + 8]
jl 0x44659d
mov eax, dword [esp + 0x18]
lea ecx, [esp + 8]
push eax
push ecx
call fcn.00439b10
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push edx
push eax
call fcn.00439b10
lea ecx, [esp + 0x18]
push 0x48e5f4
push ecx
call fcn.00439b10
mov edx, dword [esp + 0x20]
push edx
call fcn.00439900
add esp, 0x1c
mov edi, eax
mov eax, dword [esi]
push 2
push 0
push 0
push eax
call dword [sym.imp.kernel32.dll_SetFilePointer]
mov eax, dword [esp + 8]
lea ecx, [esp + 0x10]
movsx edx, di
push 0
push ecx
mov ecx, dword [esi]
push edx
push eax
push ecx
call dword [sym.imp.kernel32.dll_WriteFile]
mov edx, dword [esi]
push edx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [esp + 8]
pop edi
test eax, eax
je 0x44663d
push eax
call fcn.00479ef5
add esp, 4
mov dword [esp + 4], 0
mov eax, dword [esp + 8]
test eax, eax
je 0x44664e
push eax
call fcn.00479ef5
add esp, 4
pop esi
add esp, 0xc
ret 8
Function at 0x448e70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
push ebp
push edi
mov edi, ecx
call fcn.004490a0
mov bp, word [edi + 0x54]
cmp bp, word [edi + 0x52]
ja 0x449010
push ebx
push esi
mov ebx, ebp
and ebx, 0xffff
lea eax, [ebx*8]
sub eax, ebx
lea eax, [eax + eax*2]
cmp word [edi + eax*4 + 0xa4], 0
lea esi, [edi + eax*4]
je 0x449003
fld dword [esi + 0x58]
fadd dword [esi + 0x7c]
fstp dword [esi + 0x58]
fld dword [esi + 0x5c]
fadd dword [esi + 0x80]
fstp dword [esi + 0x5c]
fld dword [esi + 0x60]
fadd dword [esi + 0x84]
fstp dword [esi + 0x60]
fld dword [esi + 0x64]
fadd dword [esi + 0x7c]
fstp dword [esi + 0x7c]
fld dword [esi + 0x68]
fadd dword [esi + 0x80]
fstp dword [esi + 0x80]
fld dword [esi + 0x6c]
fadd dword [esi + 0x84]
fstp dword [esi + 0x84]
call fcn.004798e5
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
fmul dword [0x4851e0]
fsub dword [0x4851d4]
fmul dword [esi + 0x70]
fadd dword [esi + 0x7c]
fstp dword [esi + 0x7c]
call fcn.004798e5
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
fmul dword [0x4851e0]
fsub dword [0x4851d4]
fmul dword [esi + 0x74]
fadd dword [esi + 0x80]
fstp dword [esi + 0x80]
call fcn.004798e5
mov dword [esp + 0x10], eax
dec word [esi + 0xa2]
fild dword [esp + 0x10]
cmp word [esi + 0xa2], 0
fmul dword [0x4851e0]
fsub dword [0x4851d4]
fmul dword [esi + 0x78]
fadd dword [esi + 0x84]
fstp dword [esi + 0x84]
fld dword [esi + 0x98]
fmul dword [esi + 0x8c]
fstp dword [esi + 0x8c]
fld dword [esi + 0x94]
fmul dword [esi + 0x90]
fstp dword [esi + 0x90]
jne 0x448fc4
mov word [esi + 0xa4], 0
mov ax, word [edi + 0x52]
cmp ax, bp
jne 0x448fb6
dec eax
mov word [edi + 0x52], ax
mov ax, word [edi + 0x54]
cmp ax, bp
jne 0x448fc4
inc eax
mov word [edi + 0x54], ax
lea ecx, [ebx + 2]
lea eax, [ecx*8]
sub eax, ecx
lea ecx, [eax + eax*2]
dec word [edi + ecx*4]
cmp word [edi + ecx*4], 0
lea eax, [edi + ecx*4]
jne 0x449003
mov dx, word [esi + 0xa0]
mov word [eax], dx
mov ax, word [esi + 0xa6]
cmp ax, word [esi + 0x9e]
jae 0x449003
inc eax
mov word [esi + 0xa6], ax
inc ebp
cmp bp, word [edi + 0x52]
jbe 0x448e8a
pop esi
pop ebx
mov ecx, edi
pop edi
pop ebp
add esp, 4
jmp fcn.004490a0

Function at 0x449510
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov eax, dword [esp + 4]
push esi
mov dx, ax
mov esi, ecx
shl edx, 0x10
mov dx, ax
push edi
mov word [esi + 0x42], ax
lea edi, [esi + 0x20]
mov ecx, 8
mov eax, edx
rep stosd dword es:[edi], eax
lea eax, [esi + 0x10]
mov word [esi + 0x40], 0
push eax
call dword [sym.imp.kernel32.dll_QueryPerformanceFrequency]
mov edi, dword [sym.imp.kernel32.dll_QueryPerformanceCounter]
push esi
call edi
lea ecx, [esi + 8]
push ecx
call edi
add esi, 0x18
push esi
call edi
pop edi
pop esi
ret 4