joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415cbc
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.KERNEL32.DLL_GetVersionExA
test eax, eax
jne 0x415cd7
xor eax, eax
jmp 0x415d33
cmp dword [esp + 4], 5
jb 0x415d31
cmp dword [esp + 4], 5
jne 0x415cf0
cmp dword [esp + 8], 0
jne 0x415cf0
xor eax, eax
jmp 0x415d33
cmp dword [esp + 4], 5
jne 0x415d2a
cmp dword [esp + 8], 1
jne 0x415d2a
push str.Service_Pack
lea edx, [esp + 0x18]
push edx
call fcn.004fe9d0
add esp, 8
push str.Service_Pack_1
push eax
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
jl 0x415d26
mov eax, 1
jmp 0x415d33
xor eax, eax
jmp 0x415d33
mov eax, 1
jmp 0x415d33
xor eax, eax
add esp, 0x94
ret

Function at 0x42116c
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, 0x597938
mov edi, str.Gdiplus.dll
mov ebx, edi
push esi
push edi
mov esi, 0x597940
lea edi, [esp + 8]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
cmp dword [esi], 0
jne 0x42119f
push ebx
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [esi], eax
mov ebx, dword [esi]
test ebx, ebx
jne 0x4211af
mov eax, 0x12
jmp 0x42128f
lea edx, [edi + 0xc]
push edx
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x59791c], eax
test eax, eax
jne 0x4211cc
mov eax, 6
jmp 0x42128f
lea edx, [edi + 0x1b]
push edx
mov ecx, dword [esi]
push ecx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x597920], eax
test eax, eax
jne 0x4211eb
mov eax, 6
jmp 0x42128f
lea edx, [edi + 0x2b]
push edx
mov ecx, dword [esi]
push ecx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x597924], eax
test eax, eax
jne 0x42120a
mov eax, 6
jmp 0x42128f
lea edx, [edi + 0x44]
push edx
mov ecx, dword [esi]
push ecx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x597928], eax
test eax, eax
jne 0x421226
mov eax, 6
jmp 0x42128f
lea edx, [edi + 0x61]
push edx
mov ecx, dword [esi]
push ecx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x59792c], eax
test eax, eax
jne 0x421242
mov eax, 6
jmp 0x42128f
lea edx, [edi + 0x7c]
push edx
mov ecx, dword [esi]
push ecx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x597930], eax
test eax, eax
jne 0x42125e
mov eax, 6
jmp 0x42128f
lea edx, [edi + 0x98]
push edx
mov ecx, dword [esi]
push ecx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x597934], eax
test eax, eax
jne 0x42127d
mov eax, 6
jmp 0x42128f
push 0
lea edx, [esp + 4]
push edx
push 0x59793c
call dword [0x59791c]
add esp, 0x10
pop edi
pop esi
pop ebx
ret

Function at 0x42aa64
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
xor ecx, ecx
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], edx
mov dword [eax + 0x14], ecx
pop ebp
ret
Function at 0x42b9e4
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor ebx, ebx
mov esi, dword [ebp + 8]
xor ecx, ecx
lea eax, [esi + 2]
mov byte [eax], cl
inc ecx
inc eax
cmp ecx, 0x100
jb 0x42b9fa
xor ecx, ecx
lea edi, [ebp - 0x108]
mov eax, ecx
xor edx, edx
div dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
inc ecx
mov dl, byte [eax + edx]
mov byte [edi], dl
inc edi
cmp ecx, 0x100
jb 0x42ba0e
xor ecx, ecx
lea eax, [ebp - 0x108]
mov dword [ebp - 8], eax
lea eax, [esi + 2]
xor edx, edx
mov dl, byte [eax]
add ebx, edx
mov edx, dword [ebp - 8]
movzx edx, byte [edx]
add ebx, edx
and ebx, 0xff
mov dl, byte [eax]
mov byte [ebp - 1], dl
mov dl, byte [esi + ebx + 2]
mov byte [eax], dl
mov dl, byte [ebp - 1]
mov byte [esi + ebx + 2], dl
inc ecx
inc dword [ebp - 8]
inc eax
cmp ecx, 0x100
jb 0x42ba35
mov byte [esi], 0
mov byte [esi + 1], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42ba78
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
xor esi, esi
mov edx, dword [ebp + 0x10]
mov ecx, edx
mov edx, dword [ebp + 0xc]
cmp esi, dword [ebp + 0x14]
jae 0x42bb36
xor ebx, ebx
mov bl, byte [eax]
inc ebx
and ebx, 0x800000ff
jns 0x42baaa
dec ebx
or ebx, 0xffffff00
inc ebx
mov byte [eax], bl
xor ebx, ebx
movzx edi, byte [eax]
mov bl, byte [eax + 1]
movzx edi, byte [eax + edi + 2]
add ebx, edi
and ebx, 0x800000ff
jns 0x42bacb
dec ebx
or ebx, 0xffffff00
inc ebx
mov byte [eax + 1], bl
xor ebx, ebx
mov bl, byte [eax]
mov bl, byte [eax + ebx + 2]
mov byte [ebp - 2], bl
xor ebx, ebx
movzx edi, byte [eax]
mov bl, byte [eax + 1]
mov bl, byte [eax + ebx + 2]
mov byte [eax + edi + 2], bl
xor ebx, ebx
mov bl, byte [eax + 1]
lea edi, [eax + ebx + 2]
mov bl, byte [ebp - 2]
mov byte [edi], bl
xor ebx, ebx
mov bl, byte [eax]
movzx edi, byte [eax + ebx + 2]
xor ebx, ebx
mov bl, byte [eax + 1]
movzx ebx, byte [eax + ebx + 2]
add edi, ebx
and edi, 0x800000ff
jns 0x42bb1c
dec edi
or edi, 0xffffff00
inc edi
mov bl, byte [eax + edi + 2]
mov byte [ebp - 1], bl
mov bl, byte [edx]
xor bl, byte [ebp - 1]
mov byte [ecx], bl
inc esi
inc ecx
inc edx
cmp esi, dword [ebp + 0x14]
jb 0x42ba95
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x45d270
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, 0x5b3a50
test edx, edx
jne 0x45d28e
xor eax, eax
jmp 0x45d376
xor eax, 0xffffffff
cmp ebx, 8
jb 0x45d356
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
sub ebx, 8
shr eax, 8
mov esi, dword [ecx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ecx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ecx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ecx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ecx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ecx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ecx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ecx + esi*4]
xor esi, eax
cmp ebx, 8
mov eax, esi
jae 0x45d29a
test ebx, ebx
je 0x45d373
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ecx + esi*4]
xor esi, eax
dec ebx
mov eax, esi
jne 0x45d35a
xor eax, 0xffffffff
pop esi
pop ebx
pop ebp
ret

Function at 0x46480c
Capabilities:
Generate random numbers via winapi

Disassembly:
add esp, 0xffffffe0
cmp dword [0x5b8ae4], 0
jne 0x464842
push 0xf0000040
push 1
push 0
push 0
push 0x5cca18
call sub.ADVAPI32.DLL_CryptAcquireContextW
test eax, eax
jne 0x464842
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x80090016
je 0x464842
or eax, 0xffffffff
jmp 0x464886
mov dword [0x5b8ae4], 1
push esp
push 0x20
mov edx, dword [0x5cca18]
push edx
call sub.ADVAPI32.DLL_CryptGenRandom
test eax, eax
jne 0x464864
or eax, 0xffffffff
jmp 0x464886
push 0x20
lea edx, [esp + 4]
push edx
call fcn.004647b0
add esp, 8
push 0x20
push 0
lea ecx, [esp + 8]
push ecx
call fcn.004fe6dc
add esp, 0xc
xor eax, eax
add esp, 0x20
ret

Function at 0x464821
Capabilities:
Generate random numbers via winapi

Disassembly:
add esp, 0xffffffe0
cmp dword [0x5b8ae4], 0
jne 0x464842
push 0xf0000040
push 1
push 0
push 0
push 0x5cca18
call sub.ADVAPI32.DLL_CryptAcquireContextW
test eax, eax
jne 0x464842
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x80090016
je 0x464842
or eax, 0xffffffff
jmp 0x464886
mov dword [0x5b8ae4], 1
push esp
push 0x20
mov edx, dword [0x5cca18]
push edx
call sub.ADVAPI32.DLL_CryptGenRandom
test eax, eax
jne 0x464864
or eax, 0xffffffff
jmp 0x464886
push 0x20
lea edx, [esp + 4]
push edx
call fcn.004647b0
add esp, 8
push 0x20
push 0
lea ecx, [esp + 8]
push ecx
call fcn.004fe6dc
add esp, 0xc
xor eax, eax
add esp, 0x20
ret
Function at 0x47166c
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf0
mov ebx, esp
xor esi, esi
mov ebp, 0x108
push ebx
push ebp
call sub.KERNEL32.DLL_GetCurrentDirectoryW
mov edi, eax
cmp ebp, edi
jae 0x4716a4
mov ebp, edi
mov eax, ebp
add eax, eax
push eax
call fcn.004aa5dc
pop ecx
mov ebx, eax
push ebx
push ebp
call sub.KERNEL32.DLL_GetCurrentDirectoryW
mov edi, eax
push 0
test edi, edi
setne al
and eax, 1
push eax
call fcn.00473ce8
add esp, 8
cmp edi, 2
jb 0x4716f2
cmp ebp, edi
jbe 0x4716f2
cmp word [ebx + 2], 0x3a
jne 0x4716f2
mov ax, word [ebx]
cmp ax, 0x61
jb 0x4716de
cmp ax, 0x7a
ja 0x4716de
movzx esi, word [ebx]
add esi, 0xffffffe0
jmp 0x4716e1
movzx esi, word [ebx]
cmp esi, 0x41
jl 0x4716f0
cmp esi, 0x5a
jg 0x4716f0
sub esi, 0x41
jmp 0x4716f2
xor esi, esi
mov eax, esp
cmp ebx, eax
je 0x4716ff
push ebx
call fcn.004aa6ac
pop ecx
mov eax, esi
add esp, 0x210
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x47170c
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov eax, dword [ebp + 8]
test eax, eax
jl 0x47175f
cmp eax, 0x19
jg 0x47175f
add ax, 0x41
mov word [ebp - 8], ax
mov word [ebp - 6], 0x3a
mov word [ebp - 4], 0
push 1
call sub.KERNEL32.DLL_SetErrorMode
mov esi, eax
lea eax, [ebp - 8]
push eax
call sub.KERNEL32.DLL_SetCurrentDirectoryW
test eax, eax
push esi
setne bl
and ebx, 1
call sub.KERNEL32.DLL_SetErrorMode
push 0
push ebx
call fcn.00473ce8
add esp, 8
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x471b1c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.0048c448
mov eax, dword [ebp + 8]
push eax
call fcn.004718e0
mov edi, eax
pop ecx
xor eax, eax
lea edx, [ebp - 4]
mov dword [ebp - 4], eax
push 0
push 0
push 0
push 0
push 0
push edx
push edi
call sub.KERNEL32.DLL_GetNamedPipeHandleStateW
test eax, eax
je 0x471c2e
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004f1600
add esp, 8
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
xor esi, esi
test byte [ebp - 4], 1
jne 0x471b8a
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x10]
or eax, 1
mov dword [ebp - 0x10], eax
push 0
push 0
push edx
push edi
call sub.KERNEL32.DLL_SetNamedPipeHandleState
xor ebx, ebx
test esi, esi
je 0x471b95
call fcn.0047ee10
mov esi, dword [ebp + 0x10]
sub esi, ebx
cmp esi, 0x1000
jbe 0x471ba7
mov esi, 0x1000
push 0
lea eax, [ebp - 0x14]
push eax
push esi
mov edx, dword [ebp + 0xc]
add edx, ebx
push edx
push edi
call sub.KERNEL32.DLL_WriteFile
test eax, eax
setne cl
and ecx, 1
mov esi, ecx
test esi, esi
je 0x471bcd
add ebx, dword [ebp - 0x14]
jmp 0x471bd4
test ebx, ebx
jne 0x471bd4
or ebx, 0xffffffff
push 0
push esi
call fcn.00473ce8
add esp, 8
test esi, esi
je 0x471c18
cmp ebx, dword [ebp + 0x10]
jae 0x471c18
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004f1620
add esp, 0xc
mov dword [ebp + 0x14], eax
mov dword [ebp + 0x18], edx
cmp edx, 0
jne 0x471c08
cmp eax, 0
je 0x471c18
call fcn.004966cc
test ax, ax
je 0x471b8c
test byte [ebp - 4], 1
jne 0x471c3d
push 0
lea ecx, [ebp - 4]
push 0
push ecx
push edi
call sub.KERNEL32.DLL_SetNamedPipeHandleState
jmp 0x471c3d
push 0
push 0
call fcn.00473ce8
add esp, 8
or ebx, 0xffffffff
call fcn.0048c444
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x472010
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
call fcn.0048c448
mov eax, dword [ebp + 0xc]
xor edx, edx
mov dword [eax], edx
xor ebx, ebx
mov eax, dword [ebp + 8]
push eax
call fcn.00473714
pop ecx
mov esi, eax
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
mov edi, eax
cmp edi, 0xffffffff
je 0x47204e
push edi
call fcn.004f16ac
pop ecx
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov ebx, 1
push 0
push ebx
call fcn.00473ce8
add esp, 8
test esi, esi
je 0x472064
push esi
call fcn.004aa6ac
pop ecx
call fcn.0048c444
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x472070
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
lea eax, [ebp - 0xc]
lea edx, [ebp - 8]
lea ecx, [ebp - 4]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push eax
push edx
push ecx
push edi
call fcn.004f001c
add esp, 0x10
lea eax, [ebp - 0x1c]
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x14]
push eax
push edx
push ecx
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp + 0x10]
push edx
call fcn.004f05ec
add esp, 0x14
call fcn.0048c448
push 0x42
mov ecx, dword [ebp + 8]
push ecx
call fcn.00471c8c
add esp, 8
mov esi, eax
cmp esi, 0xffffffff
setne bl
and ebx, 1
test ebx, ebx
je 0x47218d
test edi, edi
jle 0x4720dd
cmp dword [ebp + 0x10], 0
jge 0x4720e8
lea eax, [ebp - 0x3c]
push eax
call sub.KERNEL32.DLL_GetLocalTime
jmp 0x4720f8
push 0x10
push 0
lea edx, [ebp - 0x3c]
push edx
call fcn.004fe6dc
add esp, 0xc
test edi, edi
jle 0x472114
mov cx, word [ebp - 4]
mov word [ebp - 0x3c], cx
mov ax, word [ebp - 8]
mov word [ebp - 0x3a], ax
mov dx, word [ebp - 0xc]
mov word [ebp - 0x36], dx
cmp dword [ebp + 0x10], 0
jl 0x47213a
mov cx, word [ebp - 0x10]
mov word [ebp - 0x34], cx
mov ax, word [ebp - 0x14]
mov word [ebp - 0x32], ax
mov dx, word [ebp - 0x18]
mov word [ebp - 0x30], dx
mov cx, word [ebp - 0x1c]
mov word [ebp - 0x2e], cx
lea eax, [ebp - 0x24]
push eax
lea edx, [ebp - 0x3c]
push edx
call sub.KERNEL32.DLL_SystemTimeToFileTime
test eax, eax
je 0x472179
lea ecx, [ebp - 0x2c]
push ecx
lea eax, [ebp - 0x24]
push eax
call sub.KERNEL32.DLL_LocalFileTimeToFileTime
lea edx, [ebp - 0x2c]
push edx
lea ecx, [ebp - 0x2c]
push ecx
push 0
push esi
call fcn.00471768
pop ecx
push eax
call sub.KERNEL32.DLL_SetFileTime
test eax, eax
setne bl
and ebx, 1
jmp 0x47217b
xor ebx, ebx
push 0
push ebx
call fcn.00473ce8
add esp, 8
push esi
call fcn.00471d4c
pop ecx
call fcn.0048c444
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x47219c
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
call fcn.0048c448
xor ebx, ebx
mov eax, dword [ebp + 8]
push eax
call fcn.00473714
pop ecx
mov dword [ebp - 4], eax
test esi, 1
mov edi, eax
je 0x4721c7
or ebx, 1
test esi, 2
je 0x4721d2
or ebx, 2
test esi, 4
je 0x4721dd
or ebx, 4
test esi, 0x20
je 0x4721e8
or ebx, 0x20
test ebx, ebx
jne 0x4721f1
mov ebx, 0x80
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_SetFileAttributesW
test eax, eax
setne dl
and edx, 1
mov ebx, edx
push 0
push ebx
call fcn.00473ce8
add esp, 8
test edi, edi
je 0x47221b
push edi
call fcn.004aa6ac
pop ecx
call fcn.0048c444
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x472280
Capabilities:
Clear file content
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
xor ebx, ebx
call fcn.0048c448
test di, di
je 0x4722c7
movzx ecx, di
xor eax, eax
lea edx, [ebp - 4]
mov dword [ebp - 4], eax
push 0
push edx
push ecx
mov eax, dword [ebp + 0xc]
push eax
push esi
call fcn.00471768
pop ecx
push eax
call sub.KERNEL32.DLL_WriteFile
test eax, eax
je 0x4722c3
mov bx, word [ebp - 4]
jmp 0x4722d4
xor ebx, ebx
jmp 0x4722d4
push esi
call fcn.00471768
pop ecx
push eax
call sub.KERNEL32.DLL_SetEndOfFile
push 0
test eax, eax
setne al
and eax, 1
push eax
call fcn.00473ce8
add esp, 8
call fcn.0048c444
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4722f4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
call fcn.0048c448
push 0
lea eax, [ebp - 4]
push eax
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
mov eax, dword [ebp + 8]
push eax
call fcn.00471768
pop ecx
push eax
call sub.KERNEL32.DLL_ReadFile
test eax, eax
je 0x472325
mov ebx, dword [ebp - 4]
jmp 0x472327
xor ebx, ebx
push 0
test eax, eax
setne al
and eax, 1
push eax
call fcn.00473ce8
add esp, 8
call fcn.0048c444
mov eax, ebx
pop ebx
pop ecx
pop ebp
ret

Function at 0x472348
Capabilities:
Clear file content
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
xor ebx, ebx
call fcn.0048c448
test edi, edi
je 0x472394
push 0
lea eax, [ebp - 4]
push eax
push edi
mov edx, dword [ebp + 0xc]
push edx
push esi
call fcn.00471768
pop ecx
push eax
call sub.KERNEL32.DLL_WriteFile
test eax, eax
je 0x47237f
mov ebx, dword [ebp - 4]
push 0
test eax, eax
setne al
and eax, 1
push eax
call fcn.00473ce8
add esp, 8
jmp 0x4723b4
push 0
push esi
call fcn.00471768
pop ecx
push eax
call sub.KERNEL32.DLL_SetEndOfFile
test eax, eax
setne dl
and edx, 1
push edx
call fcn.00473ce8
add esp, 8
call fcn.0048c444
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4723c4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
call fcn.0048c448
call fcn.004f5b80
test eax, eax
je 0x47243c
xor eax, eax
mov dword [ebp - 4], eax
push 0x14
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.004fe6dc
mov eax, dword [ebp + 0x14]
add esp, 0xc
and eax, 0xffffffff
lea ecx, [ebp - 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov edx, eax
mov dword [ebp - 0x14], eax
sar edx, 0x1f
push 0
lea edx, [ebp - 0x20]
push edx
push ecx
mov eax, dword [ebp + 0x10]
push eax
push edi
push esi
call fcn.00471768
pop ecx
push eax
call sub.KERNEL32.DLL_ReadFile
test eax, eax
setne dl
and edx, 1
push edx
call fcn.00473ce8
add esp, 8
mov ebx, dword [ebp - 4]
jmp 0x4724b6
mov eax, dword [ebp + 0x14]
mov ebx, eax
mov eax, dword [ebp + 0x18]
and ebx, 0xffffffff
mov edx, eax
sar edx, 0x1f
mov dword [ebp - 8], eax
lea edx, [ebp - 8]
push 0
push edx
push ebx
push esi
call fcn.00471768
pop ecx
push eax
call sub.KERNEL32.DLL_SetFilePointer
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x472483
call sub.KERNEL32.DLL_GetLastError
test eax, eax
je 0x472483
push 0
push 0
call fcn.00473ce8
add esp, 8
xor ebx, ebx
jmp 0x4724b6
xor eax, eax
lea edx, [ebp - 0xc]
mov dword [ebp - 0xc], eax
push 0
push 0
push edx
mov ecx, dword [ebp + 0x10]
push ecx
push edi
push esi
call fcn.00471768
pop ecx
push eax
call sub.KERNEL32.DLL_ReadFile
test eax, eax
setne al
and eax, 1
push eax
call fcn.00473ce8
add esp, 8
mov ebx, dword [ebp - 0xc]
call fcn.0048c444
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4724c4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
call fcn.0048c448
call fcn.004f5b80
test eax, eax
je 0x47253c
xor eax, eax
mov dword [ebp - 4], eax
push 0x14
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.004fe6dc
mov eax, dword [ebp + 0x14]
add esp, 0xc
and eax, 0xffffffff
lea ecx, [ebp - 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov edx, eax
mov dword [ebp - 0x14], eax
sar edx, 0x1f
push 0
lea edx, [ebp - 0x20]
push edx
push ecx
mov eax, dword [ebp + 0x10]
push eax
push edi
push esi
call fcn.00471768
pop ecx
push eax
call sub.KERNEL32.DLL_WriteFile
test eax, eax
setne dl
and edx, 1
push edx
call fcn.00473ce8
add esp, 8
mov ebx, dword [ebp - 4]
jmp 0x4725b6
mov eax, dword [ebp + 0x14]
mov ebx, eax
mov eax, dword [ebp + 0x18]
and ebx, 0xffffffff
mov edx, eax
sar edx, 0x1f
mov dword [ebp - 8], eax
lea edx, [ebp - 8]
push 0
push edx
push ebx
push esi
call fcn.00471768
pop ecx
push eax
call sub.KERNEL32.DLL_SetFilePointer
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x472583
call sub.KERNEL32.DLL_GetLastError
test eax, eax
je 0x472583
push 0
push 0
call fcn.00473ce8
add esp, 8
xor ebx, ebx
jmp 0x4725b6
xor eax, eax
lea edx, [ebp - 0xc]
mov dword [ebp - 0xc], eax
push 0
push 0
push edx
mov ecx, dword [ebp + 0x10]
push ecx
push edi
push esi
call fcn.00471768
pop ecx
push eax
call sub.KERNEL32.DLL_WriteFile
test eax, eax
setne al
and eax, 1
push eax
call fcn.00473ce8
add esp, 8
mov ebx, dword [ebp - 0xc]
call fcn.0048c444
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x472b60
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor eax, eax
lea edx, [ebp - 4]
mov dword [ebp - 4], eax
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.00471768
pop ecx
push eax
call sub.KERNEL32.DLL_GetFileSize
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x472b93
call sub.KERNEL32.DLL_GetLastError
test eax, eax
je 0x472b93
xor esi, esi
jmp 0x472b98
mov esi, 1
push 0
push esi
call fcn.00473ce8
add esp, 8
test esi, esi
je 0x472bc2
mov eax, dword [ebp - 4]
xor edx, edx
mov edx, eax
xor eax, eax
push edx
push eax
mov eax, ebx
xor edx, edx
or eax, dword [esp]
or edx, dword [esp + 4]
add esp, 8
jmp 0x472bc6
xor eax, eax
xor edx, edx
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x472bcc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [ebp + 8]
push eax
call fcn.00473714
pop ecx
mov esi, eax
mov ebx, eax
call fcn.0048c448
push ebx
call sub.KERNEL32.DLL_DeleteFileW
test eax, eax
setne al
and eax, 1
mov ebx, eax
push 0
push ebx
call fcn.00473ce8
add esp, 8
call fcn.0048c444
test esi, esi
je 0x472c0f
push esi
call fcn.004aa6ac
pop ecx
mov eax, ebx
pop esi
pop ebx
pop ebp
ret
Function at 0x472c18
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
push eax
call fcn.00473714
pop ecx
mov esi, eax
mov ebx, eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.00473714
pop ecx
mov edi, eax
mov dword [ebp - 4], eax
call fcn.0048c448
mov edx, dword [ebp - 4]
push edx
push ebx
call sub.KERNEL32.DLL_MoveFileW
test eax, eax
setne cl
and ecx, 1
mov ebx, ecx
push 0
push ebx
call fcn.00473ce8
add esp, 8
call fcn.0048c444
test esi, esi
je 0x472c70
push esi
call fcn.004aa6ac
pop ecx
test edi, edi
je 0x472c7b
push edi
call fcn.004aa6ac
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x472c84
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [ebp + 8]
push eax
call fcn.00473714
pop ecx
mov esi, eax
mov ebx, eax
call fcn.0048c448
push 0
push ebx
call sub.KERNEL32.DLL_CreateDirectoryW
test eax, eax
setne al
and eax, 1
mov ebx, eax
push 0
push ebx
call fcn.00473ce8
add esp, 8
call fcn.0048c444
test esi, esi
je 0x472cc9
push esi
call fcn.004aa6ac
pop ecx
mov eax, ebx
pop esi
pop ebx
pop ebp
ret

Function at 0x472cd0
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
push eax
call fcn.00473714
pop ecx
mov esi, eax
mov ebx, eax
call fcn.0048c448
push 1
call sub.KERNEL32.DLL_SetErrorMode
mov edi, eax
push ebx
call sub.KERNEL32.DLL_SetCurrentDirectoryW
test eax, eax
push edi
setne al
and eax, 1
mov ebx, eax
call sub.KERNEL32.DLL_SetErrorMode
push 0
push ebx
call fcn.00473ce8
add esp, 8
call fcn.0048c444
test esi, esi
je 0x472d23
push esi
call fcn.004aa6ac
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x472d2c
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [ebp + 8]
push eax
call fcn.00473714
pop ecx
mov esi, eax
mov ebx, eax
call fcn.0048c448
push ebx
call sub.KERNEL32.DLL_RemoveDirectoryW
test eax, eax
setne al
and eax, 1
mov ebx, eax
push 0
push ebx
call fcn.00473ce8
add esp, 8
call fcn.0048c444
test esi, esi
je 0x472d6f
push esi
call fcn.004aa6ac
pop ecx
mov eax, ebx
pop esi
pop ebx
pop ebp
ret