joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438ca4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x218], ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x438e29
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
xor edx, edx
call fcn.00406d80
lea eax, [ebp - 4]
push eax
call sub.shell32.dll_SHGetMalloc
test eax, eax
jne 0x438dfd
lea eax, [ebp - 8]
push eax
push esi
push 0xffffffffffffffff
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x438dfd
cmp dword [0x726d14], 0
jne 0x438d26
push 0x438e38
push 0x438e64
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.0040a5cc
mov dword [0x726d14], eax
cmp dword [0x726d14], 0
je 0x438d58
lea eax, [ebp - 0x212]
push eax
mov eax, dword [ebp - 8]
push eax
call dword [0x726d14]
test eax, eax
je 0x438d58
mov eax, edi
lea edx, [ebp - 0x212]
mov ecx, 0x105
call fcn.00406f90
jmp 0x438d8f
lea eax, [ebp - 0x212]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
test eax, eax
je 0x438d8f
lea eax, [ebp - 0x218]
lea edx, [ebp - 0x212]
mov ecx, 0
call fcn.00405e7c
mov edx, dword [ebp - 0x218]
mov eax, edi
call fcn.00406fac
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
cmp dword [edi], 0
jne 0x438dbb
lea edx, [ebp - 0x21c]
xor eax, eax
call fcn.0043662c
mov eax, dword [ebp - 0x21c]
mov edx, edi
call fcn.004102e8
cmp dword [edi], 0
je 0x438dfd
mov eax, dword [edi]
call fcn.00407100
mov edx, dword [edi]
cmp word [edx + eax*2 - 2], 0x5c
sete al
cmp bl, al
je 0x438dfd
test bl, bl
je 0x438de8
mov eax, edi
mov edx, 0x438e88
call fcn.004071a4
jmp 0x438dfd
mov eax, dword [edi]
call fcn.00407100
mov edx, eax
mov eax, edi
mov ecx, 1
call fcn.0040760c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x438e30
lea eax, [ebp - 0x21c]
call fcn.00406d70
lea eax, [ebp - 0x218]
call fcn.00405b98
lea eax, [ebp - 4]
call fcn.00409294
ret
Function at 0x4398d4
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406d68
xor eax, eax
push ebp
push 0x43998a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x439908
call sub.user32.dll_EmptyClipboard
call sub.user32.dll_CloseClipboard
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x439974
lea eax, [ebp - 4]
call fcn.00405d94
call fcn.00407100
add eax, eax
add eax, 2
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov ebx, eax
push ebx
call sub.kernel32.dll_GlobalLock
mov esi, eax
test esi, esi
je 0x43996f
lea eax, [ebp - 4]
call fcn.00405d94
call fcn.00407100
add eax, eax
add eax, 2
push eax
mov eax, dword [ebp - 4]
call fcn.00406e0c
mov edx, esi
pop ecx
call fcn.0040331c
push ebx
call sub.kernel32.dll_GlobalUnlock
push ebx
push 0xd
call sub.user32.dll_SetClipboardData
call sub.user32.dll_CloseClipboard
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x439991
lea eax, [ebp - 4]
call fcn.00406d70
ret
Function at 0x43bb28
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], eax
xor eax, eax
push ebp
push 0x43bcdc
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
call fcn.0043ba5c
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x43bcba
push dword fs:[edx]
mov dword fs:[edx], esp
cmp dword [0x701eec], 0
jne 0x43bc8e
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x14]
call fcn.004373e0
lea eax, [ebp - 0x30]
push eax
call sub.kernel32.dll_GetCurrentProcessId
mov cl, 0x30
mov edx, 1
call fcn.0040e4bc
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
mov edx, 0x43bcfc
call fcn.00406058
mov eax, dword [ebp - 0x2c]
call fcn.00406358
push eax
push 0
push 6
call sub.kernel32.dll_OpenFileMappingA
mov edi, eax
test edi, edi
sete bl
test bl, bl
je 0x43bc02
lea eax, [ebp - 0x38]
push eax
call sub.kernel32.dll_GetCurrentProcessId
mov cl, 0x30
mov edx, 1
call fcn.0040e4bc
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x34]
mov edx, 0x43bcfc
call fcn.00406058
mov eax, dword [ebp - 0x34]
call fcn.00406358
push eax
push 4
push 0
push 4
lea eax, [ebp - 0x14]
push eax
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov edi, eax
test edi, edi
jne 0x43bc1d
xor esi, esi
push 0
push 0x43bd14
push 0x43bd20
push 0
call sub.user32.dll_MessageBoxA_1
jmp 0x43bc7d
test bl, bl
je 0x43bc64
push 0
push 0
push 0
push 0xf001f
push edi
call sub.kernel32.dll_MapViewOfFile
mov esi, eax
push 4
push 0x1000
push 0x28
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov ebx, eax
mov dword [esi], ebx
mov eax, ebx
mov edx, 0x28
call fcn.0040b570
mov eax, dword [esi]
mov dword [eax + 4], edi
add eax, 8
push eax
call sub.kernel32.dll_InitializeCriticalSection
jmp 0x43bc7d
push 0
push 0
push 0
push 0xf001f
push edi
call sub.kernel32.dll_MapViewOfFile
mov esi, eax
push edi
call sub.kernel32.dll_CloseHandle_1
test esi, esi
je 0x43bc8e
mov eax, esi
call fcn.00469ff0
mov dword [0x701eec], esi
cmp dword [0x701eec], 0
je 0x43bca4
mov eax, dword [0x701eec]
mov eax, dword [eax]
inc dword [eax]
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43bcc1
mov eax, dword [ebp - 8]
call fcn.0043bb14
ret

Function at 0x43fd30
Capabilities:
Create thread
Resume thread

Disassembly:
cmp dword [0x701f18], 0
jne 0x43fdc3
xor eax, eax
call fcn.0041ad24
mov dword [0x701f18], eax
cmp dword [0x701f18], 0
je 0x43fdc3
mov eax, 0x43fb94
xor ecx, ecx
xor edx, edx
call fcn.0041b228
mov dword [0x701f1c], eax
push 0
push 0
push 0xffffffffffffffff
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x701f2c], eax
push 0x701f10
push 4
push 0
push 0x43fbdc
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x701f14], eax
cmp dword [0x701f14], 0
je 0x43fdc3
mov edx, 0x43fdd0
mov eax, dword [0x701f10]
call fcn.0043803c
push 2
mov eax, dword [0x701f14]
push eax
call sub.kernel32.dll_SetThreadPriority
mov eax, dword [0x701f14]
push eax
call sub.kernel32.dll_ResumeThread
ret
Function at 0x43fe0c
Capabilities:
Terminate thread

Disassembly:
push ebx
cmp dword [0x701f18], 0
je 0x43fedd
mov ebx, dword [0x701f2c]
xor eax, eax
mov dword [0x701f2c], eax
push ebx
call sub.kernel32.dll_SetEvent
push ebx
call sub.kernel32.dll_CloseHandle_1
cmp dword [0x701f28], 0
je 0x43fe55
mov ebx, dword [0x701f28]
xor eax, eax
mov dword [0x701f28], eax
push ebx
call sub.kernel32.dll_SetEvent
push ebx
call sub.kernel32.dll_CloseHandle_1
mov dword [0x701f24], 0xffffffff
mov eax, 0x43fb94
xor ecx, ecx
xor edx, edx
call fcn.0041b454
push 0x1f4
mov eax, dword [0x701f14]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
je 0x43fea2
push 0
mov eax, dword [0x701f14]
push eax
call sub.kernel32.dll_TerminateThread
cmp dword [0x701f30], 0
je 0x43fea2
mov eax, dword [0x701f30]
push eax
call sub.kernel32.dll_LocalFree
xor eax, eax
mov dword [0x701f30], eax
mov eax, dword [0x701f14]
push eax
call sub.kernel32.dll_CloseHandle_1
push 0
push 0
push 0
xor ecx, ecx
xor edx, edx
mov eax, dword [0x701f10]
call fcn.00437db0
xor eax, eax
mov dword [0x701f14], eax
xor eax, eax
mov dword [0x701f10], eax
xor eax, eax
mov dword [0x701f18], eax
pop ebx
ret
Function at 0x447e44
Capabilities:
Resolve dns

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, esi
call fcn.00406358
mov edi, eax
push edi
call sub.wsock32.dll_inet_addr
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x447e70
push edi
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x447e70
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ebx, dword [eax]
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x449a6c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
or dword [ebp + 0xc], 0xc11c
cmp byte [0x7015b4], 0
je 0x449a92
or dword [ebp + 0xc], 0x80000
push 1
xor eax, eax
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x2c]
push eax
push 1
xor eax, eax
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x34]
push eax
push 1
mov dword [ebp - 0x3c], 2
mov dword [ebp - 0x38], 0x11
lea eax, [ebp - 0x3c]
push eax
push 1
lea ecx, [ebp - 0x24]
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00449a04
push 0
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0
mov eax, dword [ebp + 8]
push eax
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push esi
lea eax, [ebx + 0x44]
push eax
mov eax, dword [ebx + 8]
call dword [eax + 0x18]
mov esi, eax
mov eax, esi
call fcn.00435684
test al, al
jne 0x449b12
cmp esi, 0x80090318
jne 0x449b1a
test edi, edi
je 0x449b1a
mov byte [ebx + 0x5c], 1
mov edi, dword [ebp - 0x1c]
test edi, edi
je 0x449b4a
cmp dword [ebp - 0x24], 0
je 0x449b4a
push 0
mov eax, dword [ebp - 0x24]
push eax
push edi
mov eax, dword [ebx + 0x50]
push eax
call sub.wsock32.dll_send
test eax, eax
jg 0x449b40
mov esi, 0x80090304
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebx + 8]
call dword [eax + 0x40]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x449b5e
cmp dword [ebp - 0x18], 0
je 0x449b5e
push eax
mov eax, dword [ebx + 8]
call dword [eax + 0x40]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x449b6c
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffeac
mov edi, edx
mov ebx, eax
mov byte [esp], 0
xor esi, esi
xor eax, eax
mov dword [esp + 8], eax
test edi, edi
je 0x449bf1
mov dword [esp + 0x38], 1
mov eax, dword [ebx + 0x50]
mov dword [esp + 0x3c], eax
mov eax, dword [0x7015d4]
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
lea eax, [esp + 0x44]
push eax
push 0
call sub.wsock32.dll_select
test eax, eax
jle 0x449d2b
push 0
mov eax, dword [ebx + 0x74]
sub eax, esi
push eax
mov eax, dword [ebx + 0x78]
add eax, esi
push eax
mov eax, dword [ebx + 0x50]
push eax
call sub.wsock32.dll_recv
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
jle 0x449d2b
mov eax, dword [esp + 4]
add esi, eax
test esi, esi
sete al
neg al
sbb edi, edi
push 1
mov eax, dword [ebx + 0x78]
mov dword [esp + 0x140], eax
xor eax, eax
mov dword [esp + 0x144], eax
lea eax, [esp + 0x140]
push eax
push 1
mov dword [esp + 0x150], esi
xor eax, eax
mov dword [esp + 0x154], eax
lea eax, [esp + 0x150]
push eax
push 1
mov dword [esp + 0x160], 2
xor eax, eax
mov dword [esp + 0x164], eax
lea eax, [esp + 0x160]
push eax
push 1
lea ecx, [esp + 0x3c]
lea edx, [esp + 0x30]
mov eax, ebx
call fcn.00449a04
push 0
mov eax, dword [esp + 0xc]
push eax
lea eax, [esp + 0x1c]
push eax
lea edx, [ebx + 0x54]
xor ecx, ecx
mov eax, ebx
call fcn.00449a6c
mov ebp, eax
sub ebp, 0x80090318
je 0x449d23
sub ebp, 0x7ff6fce8
je 0x449ca0
sub ebp, 0x90312
je 0x449ce8
sub ebp, 0xe
je 0x449d14
jmp 0x449d2b
cmp dword [esp + 0x30], 5
jne 0x449ce2
mov eax, dword [esp + 0x2c]
push eax
push 0x40
call sub.kernel32.dll_LocalAlloc_1
mov dword [ebx + 0x84], eax
mov edx, dword [ebx + 0x84]
mov eax, dword [ebx + 0x78]
add eax, esi
sub eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x2c]
call fcn.0040331c
mov eax, dword [esp + 0x2c]
mov dword [ebx + 0x7c], eax
mov dword [ebx + 0x80], 2
mov byte [esp], 1
jmp 0x449d2b
cmp dword [esp + 0x30], 5
jne 0x449d0d
mov edx, dword [ebx + 0x78]
mov eax, dword [ebx + 0x78]
add eax, esi
sub eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x2c]
call fcn.0040331c
mov esi, dword [esp + 0x2c]
jmp 0x449b86
xor esi, esi
jmp 0x449b86
or dword [esp + 8], 0x80
xor edi, edi
jmp 0x449b86
or edi, 0xffffffff
jmp 0x449b86
movzx eax, byte [esp]
add esp, 0x154
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x449d3c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff84
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00406348
xor eax, eax
push ebp
push 0x449eb9
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 1
mov eax, dword [ebp - 4]
call fcn.00406358
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
xor edx, edx
call fcn.00405dc4
call fcn.00405f5c
mov edi, eax
mov dword [ebp - 0x10], 0x400
cmp dword [ebx + 8], 0
je 0x449e95
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebx + 0x68]
jbe 0x449e95
mov eax, dword [ebx + 0x68]
mov dword [ebp - 0x10], eax
jmp 0x449e95
cmp edi, dword [ebp - 0x10]
jbe 0x449db2
mov esi, dword [ebp - 0x10]
jmp 0x449db4
mov esi, edi
cmp dword [ebx + 8], 0
je 0x449e7a
mov edx, dword [ebx + 0x78]
add edx, dword [ebx + 0x60]
mov eax, dword [ebp - 0xc]
mov ecx, esi
call fcn.0040331c
push 3
mov eax, dword [ebx + 0x78]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebx + 0x78]
add eax, dword [ebx + 0x60]
mov dword [ebp - 0x58], eax
mov eax, dword [ebx + 0x78]
add eax, dword [ebx + 0x60]
add eax, esi
mov dword [ebp - 0x54], eax
xor eax, eax
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x5c]
push eax
push 3
mov eax, dword [ebx + 0x60]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], esi
mov eax, dword [ebx + 0x64]
mov dword [ebp - 0x64], eax
xor eax, eax
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x6c]
push eax
push 3
mov dword [ebp - 0x7c], 7
mov dword [ebp - 0x78], 1
mov dword [ebp - 0x74], 6
xor eax, eax
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x7c]
push eax
push 3
lea ecx, [ebp - 0x4c]
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.00449a04
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
lea eax, [ebx + 0x54]
push eax
mov eax, dword [ebx + 8]
call dword [eax + 0x64]
test eax, eax
jne 0x449e6f
push 0
mov eax, dword [ebp - 0x4c]
add eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x34]
push eax
mov eax, dword [ebx + 0x78]
push eax
mov eax, dword [ebx + 0x50]
push eax
call sub.wsock32.dll_send
test eax, eax
jg 0x449e73
xor eax, eax
jmp 0x449e75
mov al, 1
mov byte [ebp - 5], al
jmp 0x449e90
push 0
push esi
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebx + 0x50]
push eax
call sub.wsock32.dll_send
test eax, eax
setg byte [ebp - 5]
add dword [ebp - 0xc], esi
sub edi, esi
cmp byte [ebp - 5], 0
je 0x449ea3
test edi, edi
ja 0x449da8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x449ec0
lea eax, [ebp - 4]
call fcn.00405b98
ret
Function at 0x44ac2c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdcc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x234], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov edi, eax
mov ebx, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x44ae93
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetFilePointer_1
movzx eax, byte [edi + 0x8f]
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x44ae4f
cmp byte [0x7015bc], 0
jne 0x44acb7
mov eax, ebx
call fcn.00437ab4
test al, al
je 0x44acf4
push 0x44aeb4
lea edx, [ebp - 0x220]
mov eax, ebx
call fcn.0040ffd8
mov eax, dword [ebp - 0x220]
lea edx, [ebp - 0x21c]
call fcn.0041d0a0
push dword [ebp - 0x21c]
push 0x44aecc
lea eax, [ebp - 4]
mov edx, 3
call fcn.00406148
jmp 0x44ad03
lea eax, [ebp - 4]
mov edx, ebx
mov ecx, 0
call fcn.00406fd4
push 0x44aedc
lea eax, [ebp - 0x228]
mov edx, dword [0x701fa0]
mov ecx, 0
call fcn.00405e7c
push dword [ebp - 0x228]
push 0x44aeec
push 0x44aefc
lea edx, [ebp - 0x230]
mov eax, ebx
call fcn.0044888c
mov edx, dword [ebp - 0x230]
lea eax, [ebp - 0x22c]
mov ecx, 0
call fcn.00406fd4
push dword [ebp - 0x22c]
push 0x44af18
push dword [ebp - 4]
push 0x44af30
push 0x44aeec
push 0x44af40
push 0x44aeec
push 0x44af70
push dword [ebp - 4]
push 0x44af30
push 0x44aeec
push 0x44aeec
lea eax, [ebp - 0x224]
mov edx, 0x10
call fcn.00406148
mov edx, dword [ebp - 0x224]
mov eax, edi
call fcn.00449d3c
mov esi, dword [ebp - 0xc]
test esi, esi
jbe 0x44ae4f
cmp esi, 0xff
jbe 0x44adc1
mov ebx, 0xff
jmp 0x44adc3
mov ebx, esi
push 0
lea eax, [ebp - 0x14]
push eax
push ebx
lea eax, [ebp - 0x215]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x44ade3
cmp ebx, dword [ebp - 0x14]
je 0x44adf5
mov edx, 0x44aeec
mov eax, edi
call fcn.00449d3c
mov byte [ebp - 0xd], 0
jmp 0x44ae4f
lea ecx, [ebp - 0x234]
lea eax, [ebp - 0x215]
mov edx, ebx
call fcn.0041cf68
lea eax, [ebp - 0x234]
mov edx, 0x44aeec
call fcn.00405f90
mov edx, dword [ebp - 0x234]
mov eax, edi
call fcn.00449d3c
sub esi, ebx
cmp dword [ebp + 8], 0
je 0x44ae47
mov eax, dword [ebp - 0xc]
sub eax, esi
imul eax, eax, 0x3e8
xor edx, edx
div dword [ebp - 0xc]
mov edx, eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
call dword [ecx + 0x18]
test esi, esi
ja 0x44adb2
mov eax, dword [ebp + 8]
mov edx, dword [eax]
call dword [edx + 0x24]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44ae9a
lea eax, [ebp - 0x234]
call fcn.00405b98
lea eax, [ebp - 0x230]
call fcn.00406d70
lea eax, [ebp - 0x22c]
mov edx, 5
call fcn.00405bbc
lea eax, [ebp - 4]
call fcn.00405b98
ret
Function at 0x44d058
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x44d17f
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
push 0
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetFilePointer_1
mov esi, dword [ebp - 0xc]
cmp byte [ebp + 8], 0
je 0x44d0a2
mov dword [ebp - 0x10], 0x600
jmp 0x44d0a9
mov dword [ebp - 0x10], 0x800
lea eax, [ebp - 4]
xor ecx, ecx
mov edx, dword [ebp - 0x10]
call fcn.004064f8
test esi, esi
jbe 0x44d161
cmp esi, dword [ebp - 0x10]
jae 0x44d0cf
lea eax, [ebp - 4]
xor ecx, ecx
mov edx, esi
call fcn.004064f8
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
xor edx, edx
call fcn.00405dc4
call fcn.00405f5c
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x44d10a
lea eax, [ebp - 4]
xor edx, edx
call fcn.00405dc4
call fcn.00405f5c
cmp eax, dword [ebp - 0x14]
je 0x44d10e
xor ebx, ebx
jmp 0x44d161
cmp byte [ebp + 8], 0
je 0x44d12d
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.0041d0a0
mov edx, dword [ebp - 0x18]
mov eax, edi
call fcn.0044c39c
mov ebx, eax
jmp 0x44d139
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.0044c39c
mov ebx, eax
test bl, bl
je 0x44d161
sub esi, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
sub eax, esi
imul eax, eax, 0x3e8
xor edx, edx
div dword [ebp - 0xc]
mov edx, eax
mov eax, edi
call fcn.0044c930
test esi, esi
ja 0x44d0be
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44d186
lea eax, [ebp - 0x18]
call fcn.00405b98
lea eax, [ebp - 4]
call fcn.00405b98
ret
Function at 0x45297c
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406d68
xor eax, eax
push ebp
push 0x452ad0
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004102e8
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.00406dd4
cmp dword [ebp - 4], 0
je 0x452aa6
lea eax, [ebp - 4]
call fcn.00405d94
call fcn.00407100
mov ebx, eax
lea eax, [ebp - 4]
call fcn.00405d94
cmp word [eax + ebx*2 - 2], 0x5c
jne 0x4529fa
lea eax, [ebp - 4]
call fcn.00405d94
call fcn.00407100
mov edx, eax
lea eax, [ebp - 4]
mov ecx, 1
call fcn.0040760c
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x452a46
mov eax, dword [ebp - 4]
call fcn.00406e0c
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
jne 0x452a42
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0045297c
pop ecx
test al, al
je 0x452a3e
push 0
mov eax, dword [ebp - 4]
call fcn.00406e0c
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x452a42
xor ebx, ebx
jmp 0x452aa8
mov bl, 1
jmp 0x452aa8
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.00406fd4
mov eax, dword [ebp - 0xc]
call fcn.00406358
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x452aa2
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0045297c
pop ecx
test al, al
je 0x452a9e
push 0
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.00406fd4
mov eax, dword [ebp - 0x10]
call fcn.00406358
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x452aa2
xor ebx, ebx
jmp 0x452aa8
mov bl, 1
jmp 0x452aa8
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452ad7
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00405bbc
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406d78
ret
Function at 0x455548
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended
Get common file path
Read file via mapping
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd6c
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x290], ecx
mov dword [ebp - 0x294], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov byte [ebp - 9], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x455762
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x70]
mov edx, 0x44
call fcn.0040b570
mov dword [ebp - 0x70], 0x44
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x4555fb
test ebx, ebx
jne 0x4555af
call sub.kernel32.dll_GetCommandLineW_1
mov edx, eax
lea eax, [ebp - 4]
call fcn.00406f3c
jmp 0x4555b9
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00406dd4
lea eax, [ebp - 0x28a]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryW_1
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x28a]
push eax
push 0
push 4
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00406e0c
push eax
push 0
call sub.kernel32.dll_CreateProcessW
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x455664
test ebx, ebx
jne 0x455615
call sub.kernel32.dll_GetCommandLineA
mov edx, eax
lea eax, [ebp - 8]
mov ecx, 0
call fcn.00405e7c
jmp 0x455624
lea eax, [ebp - 8]
mov edx, ebx
mov ecx, 0
call fcn.00406fd4
lea eax, [ebp - 0x28a]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryA
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x28a]
push eax
push 0
push 4
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00406358
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x455715
lea edx, [ebp - 0x2c]
lea eax, [ebp - 0x18]
call fcn.004373e0
lea eax, [ebp - 0x294]
push eax
mov cl, 0x30
mov edx, 1
mov eax, dword [ebp - 0x78]
call fcn.0040e4bc
mov ecx, dword [ebp - 0x294]
lea eax, [ebp - 0x290]
mov edx, 0x45577c
call fcn.00406058
mov eax, dword [ebp - 0x290]
call fcn.00406358
push eax
push 0x58
push 0
push 4
lea eax, [ebp - 0x18]
push eax
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov esi, eax
push 0
push 0
push 0
push 0xf001f
push esi
call sub.kernel32.dll_MapViewOfFile
mov ebx, eax
test ebx, ebx
je 0x45570c
call sub.kernel32.dll_GetCurrentProcessId
mov dword [ebx], eax
push 2
push 0
push 0
lea eax, [ebx + 4]
push eax
mov eax, dword [ebp - 0x80]
push eax
push esi
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_DuplicateHandle
lea edx, [ebx + 8]
mov eax, 0x70170c
mov ecx, 0x50
call fcn.0040331c
mov eax, dword [ebp - 0x7c]
push eax
call sub.kernel32.dll_ResumeThread
cmp byte [ebp - 9], 0
je 0x45572a
push 2
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
jmp 0x455734
mov eax, 2
call fcn.00405aac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x455769
lea eax, [ebp - 0x294]
mov edx, 2
call fcn.00405bbc
lea eax, [ebp - 8]
call fcn.00405b98
lea eax, [ebp - 4]
call fcn.00406d70
ret