joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40481d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x40482c
pop dword [ebp - 0x3c]
mov eax, 0xc06dd9ad
add eax, 0x3fd26e7f
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xb1bae71e
sub dword [ebp - 0x4c], 0x6368a1d3
mov dword [ebp - 0x48], 0xad00445c
sub dword [ebp - 0x48], 0x7accf817
mov dword [ebp - 0x44], 0xb38e9295
sub dword [ebp - 0x44], 0x67424e67
mov dword [ebp - 0x40], 0x7ac42136
add dword [ebp - 0x40], 0x853bdeca
lea eax, [ebp - 0x4c]
push eax
mov eax, 0xb3241d3b
add eax, 0x4d1e1339
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x23db2934
sub dword [ebp - 0x4c], 0xaf68bfde
mov dword [ebp - 0x48], 0xb497ddb1
add dword [ebp - 0x48], 0x8cd483c4
mov dword [ebp - 0x44], 0xa7e6f3a1
sub dword [ebp - 0x44], 0x44778735
mov dword [ebp - 0x40], 0x388e14a8
add dword [ebp - 0x40], 0xc771eb58
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0x55ed0335
add eax, 0xaa552def
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3caed
push 0
call eax
mov ecx, 0xc39b28c5
sub ecx, 0xc39ae4f2
xor edi, edi
add edi, eax
mov esi, 0x3f0eee13
add esi, 0xc13455ed
add esi, dword [ebp - 0x3c]
mov ebx, 0xf5e6a72f
mov edx, dword [esi]
mov dword [ebp - 0x34], 0xfbf36502
add edx, ebx
xor dword [ebp - 0x28], ecx
mov dword [edi], edx
xor dword [ebp - 0x2c], 0xcc565a37
add edi, 0x5015fdf0
add edi, 0xafea0214
add esi, 0x5b07856
add esi, 0xfa4f87ae
loop 0x40494a
add eax, 0x1021f
xor ebx, ebx
add ebx, eax
add eax, 0x5c7236ba
add eax, 0xa38dc94b
mov ecx, 0x400000
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c
Function at 0x401200
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50040e
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x5522c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 2
mov eax, dword [esi + 0x44]
push eax
xor ebx, ebx
push ebx
lea ecx, [esi + 0x3c]
mov dword [esi + 0x3c], vtable.CBaseRecordVector.0
call dword [0x519870]
mov eax, dword [esi + 0x48]
push eax
call fcn.004e4db0
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov byte [ebp - 4], 1
mov ecx, dword [esi + 0x30]
add esp, 4
push ecx
push ebx
lea ecx, [esi + 0x28]
mov dword [esi + 0x28], vtable.CBaseRecordVector.0
call dword [0x519870]
mov eax, dword [esi + 0x34]
push eax
call fcn.004e4db0
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov byte [ebp - 4], bl
mov edx, dword [esi + 0x1c]
add esp, 4
push edx
push ebx
lea ecx, [esi + 0x14]
mov dword [esi + 0x14], vtable.CBaseRecordVector.0
call dword [0x519870]
mov eax, dword [esi + 0x20]
push eax
call fcn.004e4db0
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [esi + 8]
add esp, 4
push eax
push ebx
mov ecx, esi
mov dword [esi], vtable.CBaseRecordVector.0
call dword [0x519870]
mov ecx, dword [esi + 0xc]
push ecx
call fcn.004e4db0
add esp, 4
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x403d90
Capabilities:
Delete file
Set file attributes

Disassembly:
cmp byte [edi], 0
je 0x403dcf
push esi
mov esi, dword [edi + 4]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x403dbb
mov ecx, dword [edi + 4]
xor al, al
test al, al
sete al
pop esi
push ecx
mov byte [edi], al
call fcn.004e4db0
pop ecx
ret
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
test al, al
sete al
mov byte [edi], al
pop esi
mov ecx, dword [edi + 4]
push ecx
call fcn.004e4db0
pop ecx
ret

Function at 0x403e80
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x502505
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5522c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], 4
mov dword [edi], vtable.CObjectVector_struct_NArchive::N7z::CMethodFull_.0
mov dword [ebp - 4], eax
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], eax
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], 0x10
mov dword [edi + 0x14], vtable.CRecordVector_struct_NArchive::N7z::CBind_.0
mov ecx, 1
mov byte [ebp - 4], cl
lea esi, [edi + 0x30]
mov dword [edi + 0x28], ecx
mov byte [edi + 0x2c], al
call fcn.004060f0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x405710
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x500352
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x5522c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [esi + 0x30]
push eax
call fcn.004e4db0
mov eax, dword [esi + 0x1c]
add esp, 4
push eax
push ebx
lea ecx, [esi + 0x14]
mov dword [esi + 0x14], vtable.CBaseRecordVector.0
call dword [0x519870]
mov eax, dword [esi + 0x20]
push eax
call fcn.004e4db0
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
add esp, 4
mov dword [esi], vtable.CObjectVector_struct_NArchive::N7z::CMethodFull_.0
mov dword [ebp - 4], 1
mov ecx, dword [esi + 8]
push ecx
push ebx
mov ecx, esi
call dword [0x5199e8]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [esi + 8]
push edx
push ebx
mov ecx, esi
mov dword [esi], vtable.CBaseRecordVector.0
call dword [0x519870]
mov eax, dword [esi + 0xc]
push eax
call fcn.004e4db0
add esp, 4
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4091d0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
xor ebx, ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], 4
mov dword [esi + 8], vtable.CObjectVector_struct_NArchive::COneMethodInfo_.0
lea eax, [ebp - 0x24]
push eax
mov byte [esi + 0x1c], bl
mov dword [esi + 0x32], 1
mov word [esi + 0x36], 0x100
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x10]
or eax, 0xffffffff
mov byte [esi + 0x40], bl
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov word [esi + 0x30], bx
mov dword [esi], ecx
mov dword [esi + 0x3c], 5
mov byte [esi + 0x38], 1
mov dword [esi + 4], 4
mov eax, esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40ba80
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x502208
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x5522c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 2
mov eax, dword [esi + 0x44]
push eax
xor ebx, ebx
push ebx
lea ecx, [esi + 0x3c]
mov dword [esi + 0x3c], vtable.CBaseRecordVector.0
call dword [0x519870]
mov eax, dword [esi + 0x48]
push eax
call fcn.004e4db0
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov byte [ebp - 4], 1
mov ecx, dword [esi + 0x30]
add esp, 4
push ecx
push ebx
lea ecx, [esi + 0x28]
mov dword [esi + 0x28], vtable.CBaseRecordVector.0
call dword [0x519870]
mov eax, dword [esi + 0x34]
push eax
call fcn.004e4db0
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov byte [ebp - 4], bl
mov edx, dword [esi + 0x1c]
add esp, 4
push edx
push ebx
lea ecx, [esi + 0x14]
mov dword [esi + 0x14], vtable.CBaseRecordVector.0
call dword [0x519870]
mov eax, dword [esi + 0x20]
push eax
call fcn.004e4db0
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
add esp, 4
mov dword [esi], vtable.CObjectVector_struct_NArchive::N7z::CCoderInfo_.0
mov dword [ebp - 4], 3
mov eax, dword [esi + 8]
push eax
push ebx
mov ecx, esi
call dword [0x519a0c]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [esi + 8]
push ecx
push ebx
mov ecx, esi
mov dword [esi], vtable.CBaseRecordVector.0
call dword [0x519870]
mov edx, dword [esi + 0xc]
push edx
call fcn.004e4db0
add esp, 4
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41acc0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50200f
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x5522c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebx], eax
mov dword [ebp - 4], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], ecx
lea esi, [ebx + 0x10]
mov dword [ebx + 0xc], edx
mov ecx, 8
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ecx
mov dword [esi], vtable.CRecordVector_unsigned_long_long_unsigned___int64__.0
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x34], ecx
mov dword [ebx + 0x24], vtable.CRecordVector_unsigned_long_long_unsigned___int64__.0
mov ecx, 4
mov dword [ebx + 0x3c], eax
mov dword [ebx + 0x40], eax
mov dword [ebx + 0x44], eax
mov dword [ebx + 0x48], ecx
mov dword [ebx + 0x38], vtable.CRecordVector_unsigned_long_long_unsigned___int64__const__.0
mov dword [ebx + 0x50], eax
mov dword [ebx + 0x54], eax
mov dword [ebx + 0x58], eax
mov dword [ebx + 0x5c], ecx
mov dword [ebx + 0x4c], vtable.CRecordVector_unsigned_long_long_unsigned___int64__const__.0
mov byte [ebp - 4], 5
mov edi, dword [ebx + 8]
call fcn.00447050
mov edi, dword [ebx + 8]
lea esi, [ebx + 0x38]
call fcn.00447050
mov edi, dword [ebx + 0xc]
lea esi, [ebx + 0x24]
call fcn.00447050
mov edi, dword [ebx + 0xc]
lea esi, [ebx + 0x4c]
call fcn.00447050
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41fa30
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x500040
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5522c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 1
mov eax, dword [edi + 0x34]
push eax
xor ebx, ebx
push ebx
lea ecx, [edi + 0x2c]
mov dword [edi + 0x2c], vtable.CBaseRecordVector.0
call dword [0x519870]
mov eax, dword [edi + 0x38]
push eax
call fcn.004e4db0
lea esi, [edi + 0x18]
mov dword [edi + 0x30], ebx
mov dword [edi + 0x34], ebx
mov dword [edi + 0x38], ebx
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.CObjectVector_class_CMyComPtr_struct_IInStream__.0
mov byte [ebp - 4], 2
mov ecx, dword [esi + 8]
push ecx
push ebx
mov ecx, esi
call dword [0x51a444]
mov byte [ebp - 4], bl
mov edx, dword [esi + 8]
push edx
push ebx
mov ecx, esi
mov dword [esi], vtable.CBaseRecordVector.0
call dword [0x519870]
mov eax, dword [esi + 0xc]
push eax
call fcn.004e4db0
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [edi + 0xc]
push ecx
call fcn.004e4db0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x424670
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
cmp eax, 0x400000
jbe 0x424682
mov eax, 0x400000
mov edx, dword [ebp + 0xc]
push 0
lea ecx, [ebp + 0x10]
push ecx
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
push edx
push ecx
mov dword [ebp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 0x14]
test eax, eax
setne al
test ecx, ecx
je 0x4246b2
mov edx, dword [ebp + 0x10]
mov dword [ecx], edx
test al, al
je 0x4246bc
xor eax, eax
pop ebp
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4246cf
mov eax, 0x80004005
pop ebp
ret 0x10
jle 0x4246db
and eax, 0xffff
or eax, 0x80070000
pop ebp
ret 0x10

Function at 0x424810
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
push esi
push edi
lea eax, [ebp + 8]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x424839
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
jne 0x424854
mov edx, dword [ebp + 8]
xor eax, eax
xor ecx, ecx
add ecx, esi
adc edx, eax
mov eax, dword [ebp + 0xc]
pop edi
mov dword [eax], ecx
mov dword [eax + 4], edx
xor eax, eax
pop esi
pop ebp
ret 8
call edi
test eax, eax
jne 0x424865
pop edi
mov eax, 0x80004005
pop esi
pop ebp
ret 8
jle 0x424871
and eax, 0xffff
or eax, 0x80070000
pop edi
pop esi
pop ebp
ret 8
Function at 0x4248c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
cmp eax, 0x400000
jbe 0x4248d2
mov eax, 0x400000
mov edx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push 0
lea ecx, [ebp + 0x10]
push ecx
push eax
mov eax, dword [esi + 8]
push edx
push eax
mov dword [ebp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 0x14]
test eax, eax
mov eax, dword [ebp + 0x10]
setne dl
add dword [esi + 0x10], eax
adc dword [esi + 0x14], 0
pop esi
test ecx, ecx
je 0x42490b
mov dword [ecx], eax
test dl, dl
je 0x424915
xor eax, eax
pop ebp
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x424928
mov eax, 0x80004005
pop ebp
ret 0x10
jle 0x424934
and eax, 0xffff
or eax, 0x80070000
pop ebp
ret 0x10

Function at 0x424a90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x424aa1
mov dword [esi], 0
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x424ada
mov eax, 0x8000
cmp ecx, eax
jae 0x424ab3
mov eax, ecx
mov edx, dword [ebp + 0xc]
push 0
lea ecx, [ebp + 0x14]
push ecx
push eax
push edx
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test esi, esi
je 0x424ad6
mov ecx, dword [ebp + 0x14]
add dword [esi], ecx
test eax, eax
je 0x424ae1
xor eax, eax
pop esi
pop ebp
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x424af5
mov eax, 0x80004005
pop esi
pop ebp
ret 0x10
jle 0x424b01
and eax, 0xffff
or eax, 0x80070000
pop esi
pop ebp
ret 0x10
Function at 0x424e40
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x501d08
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5522c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [esi + 4], vtable.ICompressSetInStream.0
mov dword [esi + 8], vtable.ISequentialInStream.0
mov dword [esi + 0xc], vtable.ICompressSetOutStream.0
mov dword [esi + 0x10], vtable.ISequentialOutStream.0
mov dword [esi + 0x14], vtable.IOutStreamFlush.0
mov dword [esi + 0x18], vtable.ICryptoSetPassword.0
mov dword [esi + 0x1c], vtable.ICompressSetCoderProperties.0
mov dword [esi + 0x20], vtable.ICompressWriteCoderProperties.0
mov dword [esi + 0x24], vtable.ICryptoResetInitVector.0
mov dword [esi + 0x28], vtable.ICompressSetDecoderProperties2.0
xor edi, edi
mov dword [esi + 0x2c], edi
mov dword [esi], vtable.CFilterCoder.0
mov dword [esi + 4], vtable.CFilterCoder.1.0
mov dword [esi + 8], vtable.CFilterCoder.2.0
mov dword [esi + 0xc], vtable.CFilterCoder.3.0
mov dword [esi + 0x10], vtable.CFilterCoder.4.0
mov dword [esi + 0x14], vtable.CFilterCoder.5.0
mov dword [esi + 0x18], vtable.CFilterCoder.6.0
mov dword [esi + 0x1c], vtable.CFilterCoder.7.0
mov dword [esi + 0x20], vtable.CFilterCoder.8.0
mov dword [esi + 0x24], vtable.CFilterCoder.9.0
mov dword [esi + 0x28], vtable.CFilterCoder.10.0
mov dword [esi + 0x34], edi
mov dword [ebp - 4], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
push 4
push 0x1000
push 0x20000
push edi
mov byte [ebp - 4], 7
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [esi + 0x30], eax
cmp eax, edi
jne 0x424f4d
push 0x536fa0
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], 1
call fcn.004eab2f
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x424f70
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fffc8
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x5522c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [esi], vtable.CFilterCoder.0
mov dword [esi + 4], vtable.CFilterCoder.1.0
mov dword [esi + 8], vtable.CFilterCoder.2.0
mov dword [esi + 0xc], vtable.CFilterCoder.3.0
mov dword [esi + 0x10], vtable.CFilterCoder.4.0
mov dword [esi + 0x14], vtable.CFilterCoder.5.0
mov dword [esi + 0x18], vtable.CFilterCoder.6.0
mov dword [esi + 0x1c], vtable.CFilterCoder.7.0
mov dword [esi + 0x20], vtable.CFilterCoder.8.0
mov dword [esi + 0x24], vtable.CFilterCoder.9.0
mov dword [esi + 0x28], vtable.CFilterCoder.10.0
mov dword [ebp - 4], 7
mov eax, dword [esi + 0x30]
test eax, eax
je 0x424ffe
push 0x8000
push 0
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov byte [ebp - 4], 6
mov eax, dword [esi + 0x74]
test eax, eax
je 0x425011
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [ebp - 4], 5
mov eax, dword [esi + 0x70]
test eax, eax
je 0x425024
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [ebp - 4], 4
mov eax, dword [esi + 0x6c]
test eax, eax
je 0x425037
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [ebp - 4], 3
mov eax, dword [esi + 0x68]
test eax, eax
je 0x42504a
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [ebp - 4], 2
mov eax, dword [esi + 0x64]
test eax, eax
je 0x42505d
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [ebp - 4], 1
mov eax, dword [esi + 0x60]
test eax, eax
je 0x425070
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [ebp - 4], 0
mov eax, dword [esi + 0x38]
test eax, eax
je 0x425083
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [ebp - 4], 0xffffffff
mov esi, dword [esi + 0x34]
test esi, esi
je 0x425099
mov eax, dword [esi]
mov ecx, dword [eax + 8]
push esi
call ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x425a50
Capabilities:
Delete file
Set file attributes

Disassembly:
mov eax, dword [esi + 0x14]
push eax
call fcn.004e4db0
mov ecx, dword [esi + 0x1c]
push ecx
call fcn.004e4db0
mov eax, dword [esi + 0x10]
add esp, 8
cmp eax, 0xffffffff
je 0x425a7f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x425a7f
mov dword [esi + 0x10], 0xffffffff
cmp byte [esi], 0
je 0x425abe
push edi
mov edi, dword [esi + 4]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x425aaa
xor al, al
test al, al
mov eax, dword [esi + 4]
sete dl
pop edi
push eax
mov byte [esi], dl
call fcn.004e4db0
pop ecx
ret
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
test al, al
sete dl
mov byte [esi], dl
pop edi
mov eax, dword [esi + 4]
push eax
call fcn.004e4db0
pop ecx
ret
Function at 0x425c80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x503848
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
mov eax, dword [0x5522c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [edi + 0x10]
or esi, 0xffffffff
cmp eax, esi
je 0x425cbf
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x425d37
mov dword [edi + 0x10], esi
mov eax, dword [edi + 0x18]
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], esi
cmp eax, ecx
jbe 0x425d04
mov ecx, dword [edi + 0x14]
mov ebx, dword [ebp + 8]
call fcn.00426d10
test eax, eax
jne 0x425d3c
mov eax, dword [edi + 0x18]
mov edx, dword [edi + 0x14]
push 0x55cb00
push eax
mov ecx, esi
call dword [0x559ce8]
mov dword [ebp - 0x14], eax
mov eax, dword [edi + 0x18]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0
cmp byte [edi + 0x28], 0
je 0x425de5
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov eax, dword [edi + 0x1c]
push eax
lea esi, [ebp - 0x10]
call fcn.00449fb0
test al, al
jne 0x425d4f
mov eax, dword [ebp - 0x10]
cmp eax, 0xffffffff
je 0x425d37
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x80004005
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [edi + 0x34]
ja 0x425dd6
jb 0x425d61
mov edx, dword [ebp - 0x20]
cmp edx, dword [edi + 0x30]
jae 0x425dd6
mov eax, dword [edi + 0x14]
mov edx, dword [ebp - 0x10]
push 0
lea ecx, [ebp - 0x18]
push ecx
push 0x100000
push eax
push edx
mov dword [ebp - 0x18], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x425e1e
mov esi, dword [ebp - 0x18]
test esi, esi
je 0x425dd6
mov ecx, dword [edi + 0x14]
mov ebx, dword [ebp + 8]
mov eax, esi
call fcn.00426d10
mov ebx, eax
test ebx, ebx
jne 0x425e2b
mov edx, dword [edi + 0x14]
mov ecx, dword [ebp - 0x14]
push 0x55cb00
push esi
call dword [0x559ce8]
add dword [ebp - 0x20], esi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x1c]
adc eax, ebx
mov dword [ebp - 0x1c], eax
cmp eax, dword [edi + 0x34]
jb 0x425d61
ja 0x425dd6
mov eax, dword [ebp - 0x20]
cmp eax, dword [edi + 0x30]
jb 0x425d61
mov eax, dword [ebp - 0x10]
cmp eax, 0xffffffff
je 0x425de5
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x14]
cmp dword [edi + 0x38], ecx
jne 0x425d37
mov edx, dword [ebp - 0x20]
cmp edx, dword [edi + 0x30]
jne 0x425d37
mov eax, dword [ebp - 0x1c]
cmp eax, dword [edi + 0x34]
jne 0x425d37
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea esi, [ebp - 0x10]
call fcn.00407030
jmp 0x425d37
lea esi, [ebp - 0x10]
call fcn.00407030
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x426d70
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0
push ecx
push edx
push 0
push 0
call fcn.004e6038
mov ecx, dword [ebp + 8]
add esp, 0x18
mov dword [ecx], eax
test eax, eax
je 0x426d99
xor eax, eax
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x426da8
mov eax, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x42b810
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5019ef
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5522c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, edi
call fcn.004060f0
lea esi, [edi + 0xc]
mov dword [ebp - 4], 0
call fcn.004060f0
lea esi, [edi + 0x18]
mov byte [ebp - 4], 1
call fcn.004060f0
lea esi, [edi + 0x24]
mov byte [ebp - 4], 2
call fcn.004060f0
lea esi, [edi + 0x30]
mov byte [ebp - 4], 3
call fcn.004060f0
mov byte [ebp - 4], 4
lea esi, [edi + 0x40]
mov byte [edi + 0x3c], 0
call fcn.004060f0
lea esi, [edi + 0x4c]
mov byte [ebp - 4], 5
call fcn.004060f0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4