joyce8/EMBER2024-capa huggingface dataset:
Function at 0x90a2d18
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90d3fd3
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x13f0
call fcn.090cde60
mov eax, dword [0x91154f8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x13e8], edi
mov esi, dword [ebx + 8]
push 0
mov dword [ebp - 0x13e4], esi
mov eax, dword [esi + 4]
add eax, 0xa0
push eax
call fcn.09015650
cmp dword [edi], 0
pop ecx
pop ecx
jne 0x90a2d9d
push 0
push 0x9c4
push 0xf424
push dword [esi + 4]
call fcn.09015650
add esp, 0x10
mov dword [edi], eax
mov ecx, esi
mov dword [ebp - 0x13ec], esi
call fcn.09018f87
and dword [ebp - 4], 0
lea edi, [ebp - 0x48]
push 0xc
pop ecx
mov eax, ecx
mov dword [ebp - 0x13dc], 0x18
xor edx, edx
add ecx, 0x8000
div dword [ebp - 0x13dc]
mov word [edi], ax
lea edi, [edi + 2]
cmp ecx, 0xc800c
jb 0x90a2db4
and dword [ebp - 0x13e0], 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x13dc], eax
movzx eax, word [eax]
lea ecx, [ebp - 0x13cc]
xor edx, edx
mov dword [ebp - 0x13d8], eax
mov dword [ebp - 0x13d4], edx
movzx esi, word [ebp + edx*2 - 0x48]
xor edi, edi
mov edx, dword [ebp - 0x13d8]
mov ax, word [ebp + edi*2 - 0x48]
inc edi
mov word [ecx - 2], dx
mov word [ecx], si
mov word [ecx + 2], ax
add ecx, 8
cmp edi, 0x19
jb 0x90a2e10
mov edx, dword [ebp - 0x13d4]
inc edx
mov dword [ebp - 0x13d4], edx
cmp edx, 0x19
jb 0x90a2e03
mov ecx, dword [ebp - 0x13e4]
lea eax, [ebp - 0x13d0]
push 0
push 0x434d594b
push 0x50524742
push 0x271
push eax
push eax
call fcn.09015650
mov eax, dword [ebp - 0x13e8]
lea ecx, [ebp - 0x1400]
mov edi, dword [ebp - 0x13e0]
push 1
push 0x9c4
push edi
push dword [eax]
call fcn.09015650
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 1
call fcn.090067dd
lea esi, [ebp - 0x13d0]
mov dword [ebp - 0x13d8], 0x19
lea edi, [eax + 2]
mov dword [ebp - 0x13d4], 0x19
mov ecx, dword [esi]
mov edx, dword [esi + 4]
add esi, 8
movzx eax, cx
imul eax, eax, 0xff
shr ecx, 0x10
add eax, 0x4000
shr eax, 0xf
mov byte [edi - 2], al
imul eax, ecx, 0xff
mov ecx, 0x4000
add eax, ecx
shr eax, 0xf
mov byte [edi - 1], al
movzx eax, dx
imul eax, eax, 0xff
shr edx, 0x10
add eax, ecx
shr eax, 0xf
mov byte [edi], al
imul eax, edx, 0xff
add eax, ecx
shr eax, 0xf
mov byte [edi + 1], al
add edi, 4
sub dword [ebp - 0x13d4], 1
jne 0x90a2eac
sub dword [ebp - 0x13d8], 1
jne 0x90a2ea2
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 0
call fcn.090068a7
mov edi, dword [ebp - 0x13e0]
mov eax, dword [ebp - 0x13dc]
add edi, 0x9c4
mov esi, dword [ebp - 0x13e4]
add eax, 2
mov dword [ebp - 0x13dc], eax
mov dword [ebp - 0x13e0], edi
cmp edi, 0xf424
jb 0x90a2dec
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.090190fb
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09002290
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x90c4770
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90d4bd2
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xb20
mov eax, dword [0x91154f8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebx + 8]
mov esi, dword [ebx + 0x18]
push eax
mov dword [ebp - 0xb2c], eax
call fcn.09015650
add esp, 4
lea ecx, [ebp - 0xb24]
push eax
call fcn.09015650
push 0
push 0
push 0
push 1
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
push dword [ebp - 0xb24]
mov dword [ebp - 4], 0
push esi
call fcn.09009307
add esp, 0x3c
lea ecx, [ebp - 0xb20]
push eax
call fcn.09015650
mov byte [ebp - 4], 1
xor eax, eax
nop dword [eax]
nop dword [eax + eax]
mov byte [ebp + eax - 0x118], al
inc eax
cmp eax, 0x100
jb 0x90c4820
mov ecx, dword [ebp - 0xb20]
lea eax, [ebp - 0x918]
push 0
push 0x5058595a
push 0x67386b30
push 0x100
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.09015650
movzx ecx, word [ebp - 0x11c]
movzx edi, word [ebp - 0x914]
mov dword [ebp - 0xb28], ecx
cmp ecx, edi
jbe 0x90c499a
mov edx, ecx
sub edx, edi
xor esi, esi
mov dword [ebp - 0xb1c], edx
movzx eax, word [ebp + esi*8 - 0x914]
cmp eax, edi
ja 0x90c4891
xor eax, eax
jmp 0x90c48be
cmp eax, ecx
jb 0x90c489c
mov eax, 0x8000
jmp 0x90c48be
sub eax, edi
mov ecx, edx
shl eax, 0xf
xor edx, edx
shr ecx, 1
add eax, ecx
mov ecx, dword [ebp - 0xb28]
div dword [ebp - 0xb1c]
mov edx, dword [ebp - 0xb1c]
movzx eax, ax
mov word [ebp + esi*2 - 0xb18], ax
inc esi
cmp esi, 0x100
jb 0x90c4881
lea ecx, [ebp - 0xb20]
mov byte [ebp - 4], 0
call fcn.090198a7
lea ecx, [ebp - 0xb24]
mov dword [ebp - 4], 0xffffffff
call fcn.0901e58a
mov esi, dword [ebp - 0xb2c]
lea eax, [esi + 8]
push eax
push 0x280
mov dword [ebp - 0xb2c], eax
call fcn.09015650
add esp, 8
mov dword [ebp - 0xb28], eax
mov dword [ebp - 4], 2
test eax, eax
je 0x90c492a
push esi
mov ecx, eax
call fcn.09015650
mov edx, eax
jmp 0x90c492c
xor edx, edx
movsd xmm1, qword [ebx + 0x10]
xorps xmm0, xmm0
mov eax, dword [ebx + 0xc]
mulsd xmm1, qword [0x90e7a70]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
comisd xmm0, xmm1
mov dword [edx + 0x70], ecx
mov dword [edx + 0x74], eax
jbe 0x90c495a
subsd xmm1, qword [0x90dd3d8]
jmp 0x90c4962
addsd xmm1, qword [0x90dd3d8]
cvttsd2si eax, xmm1
lea edi, [edx + 0x7a]
mov ecx, 0x80
lea esi, [ebp - 0xb18]
rep movsd dword es:[edi], dword [esi]
mov word [edx + 0x78], ax
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09002290
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 0x6250726f
call fcn.09015650
int3
Function at 0x4037d5
Capabilities:
Check http status code
Create http request
Download and write a file
Get http content length
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4024
call fcn.0043dca0
mov eax, dword [0x4e01d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
push 0x32
pop edi
push ebx
push ebx
mov dword [ebp - 0x401c], eax
xor eax, eax
push ebx
inc eax
push ebx
push str.SpotifyInstaller_1.0
mov dword [ebp - 0x4018], eax
mov byte [0x4e6138], al
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x4024], eax
test eax, eax
jne 0x403832
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4039a4
push ebx
push 0x80000200
push ebx
push ebx
push esi
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov ebx, eax
test ebx, ebx
jne 0x403856
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x34
pop edi
jmp 0x403998
and dword [ebp - 0x4010], 0
lea eax, [ebp - 0x4008]
mov esi, dword [sym.imp.WININET.dll_HttpQueryInfoW]
push 0
push eax
lea eax, [ebp - 0x4010]
mov dword [ebp - 0x4008], 4
push eax
push 0x20000005
push ebx
call esi
and dword [ebp - 0x4014], 0
lea eax, [ebp - 0x4008]
push 0
push eax
lea eax, [ebp - 0x4014]
mov dword [ebp - 0x4008], 4
push eax
push 0x20000013
push ebx
call esi
cmp dword [ebp - 0x4014], 0xc8
je 0x4038c1
push 0x33
jmp 0x403990
mov eax, dword [ebp - 0x4010]
xor esi, esi
mov dword [0x4e6134], eax
mov dword [0x4e6130], 0
jmp 0x403981
push 0x4e6118
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x4e6118
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea eax, [ebp - 0x400c]
push eax
push 0x4000
lea eax, [ebp - 0x4004]
push eax
push ebx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x4039d3
cmp byte [ebp - 0x4018], 0
mov eax, dword [ebp - 0x400c]
je 0x403942
mov byte [ebp - 0x4018], 0
cmp eax, 2
jb 0x403942
cmp byte [ebp - 0x4004], 0x4d
jne 0x4039b5
cmp byte [ebp - 0x4003], 0x5a
jne 0x4039b5
test eax, eax
je 0x4039c3
push 0
lea ecx, [ebp - 0x4020]
push ecx
push eax
lea eax, [ebp - 0x4004]
push eax
push dword [ebp - 0x401c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4039b9
mov eax, dword [ebp - 0x400c]
cmp dword [ebp - 0x4020], eax
jne 0x4039bf
add dword [0x4e6130], eax
add esi, dword [ebp - 0x400c]
cmp byte [0x4e6114], 0
je 0x4038dd
push 0x13
pop edi
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push dword [ebp - 0x4024]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043db84
leave
ret
push 0x36
jmp 0x403990
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xb
jmp 0x403990
xor eax, eax
cmp esi, dword [ebp - 0x4010]
push 0x36
pop edi
cmove edi, eax
jmp 0x403991
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x403991
Function at 0x403b3c
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
test esi, esi
je 0x403b6b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x403b6b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x403b76
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x403b74
mov dword [eax], esi
mov al, 1
pop esi
pop ebp
ret

Function at 0x405abe
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov al, byte [ebp + 8]
push esi
xor esi, esi
xor al, 1
push esi
push esi
push 1
push esi
mov byte [0x4e6140], al
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x4e6148], eax
lea eax, [ebp + 8]
push eax
push esi
push esi
push 0x406355
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop esi
pop ebp
ret
Function at 0x41391e
Capabilities:
Read file via mapping

Disassembly:
push 0x34
mov eax, 0x467ae2
call fcn.0043dbf7
mov esi, ecx
mov edi, dword [ebp + 8]
test edi, edi
jne 0x413937
xor al, al
jmp 0x4139ae
push str.SpotifyWindowHandle
lea ecx, [ebp - 0x40]
call fcn.004024ee
push esi
lea eax, [ebp - 0x40]
xor ebx, ebx
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 4], ebx
push eax
call fcn.00413818
add esp, 0xc
lea ecx, [ebp - 0x40]
call fcn.00405250
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push ebx
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov esi, eax
test esi, esi
je 0x4139a4
push 4
push ebx
push ebx
push 4
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
test ecx, ecx
je 0x41399d
mov eax, dword [ecx]
push ecx
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x28]
call fcn.00405250
mov al, bl
call fcn.0043dba6
ret 4

Function at 0x413c6b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4e01d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov eax, dword [eax]
xor ebx, ebx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], edi
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
mov eax, dword [eax]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [eax]
push 0x100000
push edi
mov dword [ebp - 0x1c], eax
call fcn.0041428d
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x413d00
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 0xc]
push 1
push ebx
push ebx
push dword [ebp - 0x1c]
push edi
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
test eax, eax
jne 0x413ce6
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x413d00
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x413d52
mov edi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 4]
add eax, 4
mov dword [ebp - 0x18], eax
cmp eax, ecx
jne 0x413cac
push 1
push edi
call fcn.0041428d
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x413d41
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, eax
neg ebx
push esi
sbb bl, bl
inc bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043db84
leave
ret
mov al, 1
jmp 0x413d43
Function at 0x415f1f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4e01d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x20c]
push 0x104
push ecx
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x415f59
xor al, al
jmp 0x415f6c
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043db84
leave
ret

Function at 0x41603e
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4e01d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x20c]
push ebx
mov ebx, dword [ebp + 0xc]
push edi
push 0x104
push ecx
push 0xffffffffffffffff
push eax
xor edi, edi
push edi
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x41607f
push 0xa
pop eax
jmp 0x4160f9
push esi
push edi
push 0x80
push 2
push edi
push 1
push 0xc0000000
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4160b6
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0x20
neg eax
sbb eax, eax
add eax, 0xe
jmp 0x4160f8
push edi
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0x210]
push eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4160e1
cmp dword [ebp - 0x210], edi
jne 0x4160e1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4160f8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0xc
pop eax
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0043db84
leave
ret
Function at 0x41ab1b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x14]
sub esp, 0xc
mov eax, dword [ebp + 0xc]
mov edx, dword [edx]
push esi
xor esi, esi
and edx, 7
cmp eax, 5
jae 0x41ab3b
xor eax, eax
jmp 0x41ac92
add dword [ebp + 0x10], 5
or ecx, 0xffffffff
push ebx
push edi
mov edi, dword [ebp + 8]
lea ebx, [edi - 4]
add ebx, eax
mov dword [ebp - 0xc], ebx
add edi, esi
mov dword [ebp + 0xc], edi
cmp edi, ebx
jae 0x41ab68
mov al, byte [edi]
and al, 0xfe
cmp al, 0xe8
je 0x41ab65
inc edi
cmp edi, ebx
jb 0x41ab58
mov dword [ebp + 0xc], edi
mov esi, edi
sub esi, dword [ebp + 8]
mov eax, esi
sub eax, ecx
cmp edi, ebx
jae 0x41ac79
cmp eax, 3
jbe 0x41aba0
xor edx, edx
mov al, byte [edi + 4]
mov ecx, esi
mov dword [ebp - 8], ecx
test al, al
je 0x41abdc
cmp al, 0xff
je 0x41abdc
and edx, 3
xor eax, eax
add edx, edx
or edx, 1
inc eax
jmp 0x41ac72
lea ecx, [eax - 1]
shl edx, cl
and edx, 7
je 0x41ab80
cmp byte [edx + 0x4c93e4], 0
je 0x41abc9
movzx eax, byte [edx + 0x4c93ec]
mov ecx, edi
sub ecx, eax
mov al, byte [ecx + 4]
test al, al
je 0x41abc9
cmp al, 0xff
jne 0x41ab80
and edx, 3
mov ecx, esi
add edx, edx
or edx, 1
inc esi
mov edi, dword [ebp + 8]
jmp 0x41ab4f
movzx ecx, al
movzx eax, byte [edi + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 1]
mov edi, dword [ebp + 0x10]
shl ecx, 8
or ecx, eax
cmp dword [ebp + 0x18], 0
je 0x41ac0a
lea ebx, [ecx + esi]
add ebx, edi
jmp 0x41ac10
mov ebx, ecx
sub ebx, esi
sub ebx, edi
test edx, edx
je 0x41ac47
movzx eax, byte [edx + 0x4c93ec]
shl eax, 3
push 0x18
pop ecx
sub ecx, eax
mov dword [ebp - 4], eax
mov eax, ebx
shr eax, cl
test al, al
je 0x41ac32
cmp al, 0xff
jne 0x41ac47
xor eax, eax
push 0x20
pop ecx
sub ecx, dword [ebp - 4]
inc eax
shl eax, cl
mov ecx, eax
mov dword [ebp - 4], eax
dec ecx
xor ecx, ebx
jmp 0x41abfd
mov edi, dword [ebp + 0xc]
mov eax, ebx
mov ecx, dword [ebp - 8]
shr eax, 0x18
and al, 1
neg al
mov byte [edi + 1], bl
mov byte [edi + 4], al
mov eax, ebx
shr eax, 0x10
mov byte [edi + 3], al
mov eax, ebx
mov ebx, dword [ebp - 0xc]
shr eax, 8
push 5
mov byte [edi + 2], al
pop eax
add esi, eax
jmp 0x41abd4
lea ecx, [eax - 1]
shl edx, cl
xor ecx, ecx
and edx, 7
cmp eax, 3
mov eax, dword [ebp + 0x14]
cmova edx, ecx
pop edi
pop ebx
mov dword [eax], edx
mov eax, esi
pop esi
leave
ret
Function at 0x41fc8c
Capabilities:
Check if file exists

Disassembly:
push 0x28c
mov eax, 0x468962
call fcn.0043dbf7
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
mov edi, dword [ebp + 0x18]
mov ebx, dword [ebp + 0x1c]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x294], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x298], ecx
lea ecx, [ebp - 0x28]
push eax
call fcn.00402578
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x41fd0d
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 2], 0x5c
je 0x41fd06
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 2], 0x2f
je 0x41fd06
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 2], 0x3a
jne 0x41fd0d
mov eax, 0x4c8f98
jmp 0x41fd12
mov eax, 0x4c9744
push eax
lea ecx, [ebp - 0x28]
call fcn.0040a98a
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x290]
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, dword [ebp - 0x294]
mov dword [ecx], eax
cmp eax, 0xffffffff
jne 0x41fd65
and dword [ecx], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x41fd54
cmp eax, 0x12
jne 0x41fd56
xor eax, eax
push 0x4e00a0
push eax
mov ecx, esi
call fcn.0041d819
jmp 0x41fdda
mov ecx, dword [ebp - 0x298]
lea eax, [ebp - 0x264]
push eax
call fcn.0041fb8a
mov eax, dword [ebp - 0x290]
test eax, 0x400
je 0x41fd8c
xor eax, eax
mov dword [edi], eax
mov dword [ebx], eax
jmp 0x41fdd2
and eax, 0x10
lea ecx, [ebp - 0x40]
or eax, 0x20
shr eax, 4
mov dword [edi], eax
mov dword [ebx], eax
lea eax, [ebp - 0x264]
push 0
push eax
call fcn.0040188d
push dword [ebp - 0x290]
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
call fcn.0042077a
pop ecx
pop ecx
lea ecx, [ebp - 0x40]
mov dword [edi + 4], eax
call fcn.00405276
mov eax, dword [edi + 4]
mov dword [ebx + 4], eax
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
lea ecx, [ebp - 0x28]
call fcn.00405276
mov eax, esi
call fcn.0043dba6
ret
Function at 0x42106d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x5c
mov eax, 0x468b7f
call fcn.0043dbf7
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x60], eax
test eax, eax
je 0x4210a2
mov edi, eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x14], ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x64]
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x4210ac
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4210cc
push dword [ebp - 0x60]
push edi
push ebx
call fcn.00420fc4
add esp, 0xc
jmp 0x4211aa
push esi
push edi
call fcn.0042077a
pop ecx
pop ecx
mov ecx, eax
mov dword [ebp - 0x64], ecx
test esi, 0x400
je 0x421187
push edi
call fcn.00420ef3
pop ecx
test al, al
jne 0x421102
mov eax, dword [ebp - 0x64]
mov dword [ebx], 9
mov dword [ebx + 4], eax
jmp 0x4211aa
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x42110c
mov eax, dword [edi]
push eax
lea ecx, [ebp - 0x28]
call fcn.004025ae
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
xor ecx, ecx
push ecx
push 0x2000000
push 3
push ecx
push 7
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x68], esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00405276
cmp esi, 0xffffffff
je 0x4210ba
lea eax, [ebp - 0x5c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x421174
push dword [ebp - 0x60]
push edi
push ebx
call fcn.00420fc4
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4211aa
mov eax, dword [ebp - 0x5c]
push esi
mov dword [ebp - 0x60], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x64]
and esi, 0x10
je 0x421191
mov edx, dword [ebp - 0x68]
jmp 0x421196
mov edx, ecx
mov ecx, dword [ebp - 0x68]
xor eax, eax
test esi, esi
setne al
add eax, 2
test esi, esi
mov dword [ebx], eax
cmove ecx, edx
mov dword [ebx + 4], ecx
mov eax, ebx
call fcn.0043dba6
ret
Function at 0x4250fd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x4e01d4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp word [0x4e656c], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
jne 0x42513a
lea eax, [ebp - 0x1c]
push eax
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
mov ax, word [ebp - 0x14]
mov word [0x4e656c], ax
movzx esi, word [0x4e656c]
xor eax, eax
and dword [ebp - 0x2c], eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], eax
cmp byte [edi], 1
mov ebx, edi
jbe 0x4251f2
inc ebx
cmp byte [ebx], 1
ja 0x425157
mov dword [ebp - 0x38], ebx
cmp ebx, edi
je 0x4251f2
test eax, eax
jne 0x425188
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x24], eax
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
cmp word [0x4e6568], si
je 0x4251a0
push esi
push eax
mov word [0x4e6568], si
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov eax, ebx
sub eax, edi
je 0x4251f2
mov esi, dword [ebp - 0x24]
mov ebx, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], eax
mov ecx, 0x2000
cmp eax, ecx
lea eax, [ebp - 0x34]
push 0
push eax
cmovg ebx, ecx
cmp dword [ebp - 0x2c], 0
push ebx
push edi
push esi
je 0x4251d5
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
mov eax, dword [ebp - 0x30]
jmp 0x4251de
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x28]
add edi, ebx
sub eax, ebx
mov ebx, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], eax
jne 0x4251b1
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x38]
cmp byte [ebx], 0
je 0x425244
movzx eax, byte [ebx + 1]
sub eax, 1
js 0x425244
cmp eax, 0x20
jge 0x425218
and esi, 0xfff0
or si, word [eax*2 + 0x4c9a9c]
movzx esi, si
jmp 0x425236
cmp eax, 0x40
jge 0x42522d
and esi, 0xff0f
or si, word [eax*2 + 0x4c9abc]
jmp 0x425213
jne 0x425239
movzx esi, word [0x4e656c]
mov dword [ebp - 0x20], esi
mov eax, dword [ebp - 0x24]
lea edi, [ebx + 2]
jmp 0x42514c
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043db84
leave
ret