joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4217ea
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edx, ebx
je 0x4219c0
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0x1f
sar ecx, 5
lea esi, [eax + eax*8]
lea edi, [ecx*4 + 0x467320]
mov eax, dword [edi]
shl esi, 2
add eax, esi
mov cl, byte [eax + 4]
test cl, 2
jne 0x4219c0
test cl, 0x48
je 0x421855
cmp byte [eax + 5], 0xa
je 0x421855
mov eax, dword [edi]
mov al, byte [eax + esi + 5]
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea edx, [ebx + 1]
mov dword [ebp - 8], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push edx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4218a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop esi
cmp eax, esi
jne 0x42188f
call fcn.00423a27
mov dword [eax], 9
call fcn.00423a30
mov dword [eax], esi
jmp 0x42189f
cmp eax, 0x6d
je 0x4219c0
push eax
call fcn.00423a39
pop ecx
or eax, 0xffffffff
jmp 0x4219c2
mov eax, dword [ebp - 0xc]
mov ecx, dword [edi]
add dword [ebp - 8], eax
test byte [ecx + esi + 4], 0x80
je 0x4219bb
test eax, eax
je 0x4218ce
cmp byte [ebx], 0xa
jne 0x4218ce
mov eax, ecx
lea eax, [eax + esi + 4]
or byte [eax], 4
jmp 0x4218d7
mov eax, dword [edi]
lea eax, [eax + esi + 4]
and byte [eax], 0xfb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
add ecx, eax
cmp eax, ecx
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], ecx
jae 0x4219b5
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0x1a
je 0x4219a5
cmp al, 0xd
je 0x421909
mov byte [ebx], al
inc ebx
inc dword [ebp + 0x10]
jmp 0x421997
dec ecx
cmp dword [ebp + 0x10], ecx
jae 0x421923
mov eax, dword [ebp + 0x10]
inc eax
cmp byte [eax], 0xa
jne 0x42191e
add dword [ebp + 0x10], 2
jmp 0x421977
mov dword [ebp + 0x10], eax
jmp 0x421993
inc dword [ebp + 0x10]
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x42194b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x421993
cmp dword [ebp - 0xc], 0
je 0x421993
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x42196c
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x421977
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x421996
cmp ebx, dword [ebp + 0xc]
jne 0x42197c
cmp byte [ebp - 1], 0xa
jne 0x42197c
mov byte [ebx], 0xa
jmp 0x421996
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00421cec
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x421997
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0x10], ecx
jb 0x4218ed
jmp 0x4219b5
mov eax, dword [edi]
test byte [eax + esi + 4], 0x40
jne 0x4219b5
lea esi, [eax + esi + 4]
or byte [esi], 2
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jmp 0x4219c2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x421a72
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3a4]
sub esp, 0x424
mov eax, dword [0x45eb40]
xor ecx, ecx
xor eax, ebp
cmp dword [ebp + 0x3b4], ecx
push edi
mov edi, dword [ebp + 0x3b0]
mov dword [ebp + 0x3a0], eax
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x78], ecx
jne 0x421aae
xor eax, eax
jmp 0x421c18
mov eax, dword [ebp + 0x3ac]
push ebx
mov ebx, dword [ebp + 0x3ac]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x467320]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x421aec
push 2
push ecx
push ecx
push dword [ebp + 0x3ac]
call fcn.00421cec
add esp, 0x10
xor ecx, ecx
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x421b86
cmp dword [ebp + 0x3b4], ecx
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x68], ecx
jbe 0x421be9
jmp 0x421b10
xor ecx, ecx
mov dword [ebp - 0x6c], ecx
mov ecx, dword [ebp - 0x70]
sub ecx, dword [ebp - 0x7c]
lea eax, [ebp - 0x64]
cmp ecx, dword [ebp + 0x3b4]
jae 0x421b4b
mov edx, dword [ebp - 0x70]
inc dword [ebp - 0x70]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x421b3c
inc dword [ebp - 0x78]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 0x6c]
mov byte [eax], dl
inc eax
inc dword [ebp - 0x6c]
cmp dword [ebp - 0x6c], 0x400
jl 0x421b1c
mov edi, eax
lea eax, [ebp - 0x64]
sub edi, eax
push 0
lea eax, [ebp - 0x80]
push eax
push edi
lea eax, [ebp - 0x64]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x421baa
mov eax, dword [ebp - 0x80]
add dword [ebp - 0x74], eax
cmp eax, edi
jl 0x421bb3
mov eax, dword [ebp - 0x70]
sub eax, dword [ebp - 0x7c]
cmp eax, dword [ebp + 0x3b4]
jb 0x421b0e
jmp 0x421bb3
push ecx
lea ecx, [ebp - 0x80]
push ecx
push dword [ebp + 0x3b4]
push edi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x421baa
mov eax, dword [ebp - 0x80]
and dword [ebp - 0x68], 0
mov dword [ebp - 0x74], eax
jmp 0x421bb3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x74]
test eax, eax
jne 0x421c13
cmp dword [ebp - 0x68], eax
je 0x421be6
push 5
pop esi
cmp dword [ebp - 0x68], esi
jne 0x421bdb
call fcn.00423a27
mov dword [eax], 9
call fcn.00423a30
mov dword [eax], esi
jmp 0x421c0e
push dword [ebp - 0x68]
call fcn.00423a39
pop ecx
jmp 0x421c0e
mov edi, dword [ebp - 0x7c]
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x421bfb
cmp byte [edi], 0x1a
jne 0x421bfb
xor eax, eax
jmp 0x421c16
call fcn.00423a27
mov dword [eax], 0x1c
call fcn.00423a30
and dword [eax], 0
or eax, 0xffffffff
jmp 0x421c16
sub eax, dword [ebp - 0x78]
pop esi
pop ebx
mov ecx, dword [ebp + 0x3a0]
xor ecx, ebp
pop edi
call fcn.00422ecb
add ebp, 0x3a4
leave
ret
Function at 0x42228f
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push edi
mov edi, dword [esp + 0xc]
xor ebx, ebx
test edi, edi
jne 0x4222ab
call fcn.00423a27
mov dword [eax], 0x16
or eax, 0xffffffff
jmp 0x42231d
push esi
push 0x8c
push 1
call fcn.00424d9a
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x422303
push esi
call fcn.0042594a
mov eax, dword [esp + 0x1c]
pop ecx
push esi
push 4
push esi
push 0x4221fd
push dword [esp + 0x24]
mov dword [esi + 0x4c], edi
push 0
mov dword [esi + 0x50], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
mov dword [esi + 4], edi
je 0x4222fb
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x42231a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.00423356
test ebx, ebx
pop ecx
je 0x422315
push ebx
call fcn.00423a39
pop ecx
or eax, 0xffffffff
jmp 0x42231c
mov eax, edi
pop esi
pop edi
pop ebx
ret

Function at 0x42260f
Capabilities:
Get common file path
Set current directory
Set environment variable

Disassembly:
push 0x230
push 0x451668
call fcn.004237b4
mov eax, dword [0x45eb40]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
lea edi, [ebp - 0x230]
xor ebx, ebx
mov dword [ebp - 0x238], ebx
or dword [ebp - 0x234], 0xffffffff
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x422720
mov eax, edi
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
mov dword [ebp - 0x23c], esi
cmp esi, 0x104
jle 0x4226d2
mov dword [ebp - 4], ebx
lea eax, [esi + esi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.00421510
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x240], edi
jmp 0x4226bf
or dword [ebp - 4], 0xffffffff
cmp esi, ebx
je 0x422720
push edi
inc esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
cmp esi, ebx
je 0x422720
mov ax, word [edi]
cmp ax, 0x5c
je 0x4226e5
cmp ax, 0x2f
jne 0x4226eb
cmp ax, word [edi + 2]
je 0x42271a
mov word [ebp - 0x24], 0x3d
xor eax, eax
mov ax, word [edi]
push eax
call fcn.0042b0c6
pop ecx
mov word [ebp - 0x22], ax
mov word [ebp - 0x20], 0x3a
mov word [ebp - 0x1e], bx
push edi
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
je 0x422720
mov dword [ebp - 0x234], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00423a39
pop ecx
cmp dword [ebp - 0x238], ebx
je 0x42273c
push edi
call fcn.00423356
pop ecx
mov eax, dword [ebp - 0x234]
lea esp, [ebp - 0x24c]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00422ecb
call fcn.004237ef
ret
Function at 0x422758
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x45eb40]
push esi
mov esi, dword [ebp + 8]
xor eax, ebp
test esi, esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
je 0x4227e0
push esi
call fcn.0042b109
test eax, eax
pop ecx
jne 0x4227a8
call fcn.00423a30
mov dword [eax], 0xf
call fcn.00423a27
mov dword [eax], 0xd
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00422ecb
leave
ret
and word [ebp - 6], 0
lea eax, [ebp - 0x218]
push eax
add esi, 0x40
lea eax, [ebp - 0x214]
push eax
mov word [ebp - 0xc], si
mov esi, 0x104
push esi
lea eax, [ebp - 0xc]
push eax
mov word [ebp - 0xa], 0x3a
mov word [ebp - 8], 0x2e
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
jmp 0x4227f3
lea eax, [ebp - 0x214]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x422798
inc eax
cmp eax, esi
ja 0x422798
test edi, edi
mov ecx, edi
jne 0x422829
cmp eax, dword [ebp + 0x10]
jg 0x42280a
mov eax, dword [ebp + 0x10]
add eax, eax
push eax
call fcn.00423344
pop ecx
mov ecx, eax
test ecx, ecx
jne 0x42283e
call fcn.00423a27
mov dword [eax], 0xc
jmp 0x422798
cmp eax, dword [ebp + 0x10]
jle 0x42283e
call fcn.00423a27
mov dword [eax], 0x22
jmp 0x422798
lea eax, [ebp - 0x214]
push eax
push ecx
call fcn.00420685
pop ecx
pop ecx
jmp 0x42279a

Function at 0x423aac
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.00421510
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x423b47
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x465a5c]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x423b47
cmp eax, 1
je 0x423b68
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x423b47
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x423b14
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x423b43
xor eax, eax
inc eax
jmp 0x423b87
cmp edi, eax
jae 0x423b4b
xor eax, eax
jmp 0x423b87
cmp eax, esi
jae 0x423b52
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x465a5c]
jmp 0x423b6b
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x424e71
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x90]
sub esp, 0x110
mov eax, dword [0x45eb40]
mov ecx, dword [ebp + 0x98]
push ebx
xor eax, ebp
push esi
mov dword [ebp + 0x8c], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x45ecc0]
je 0x424ea8
inc eax
cmp eax, 0x13
jb 0x424e99
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x45ecc0]
jne 0x424fcb
mov eax, dword [0x465a4c]
cmp eax, 1
je 0x424fa6
cmp eax, edx
jne 0x424ed8
cmp dword [0x45eaf0], 1
je 0x424fa6
cmp ecx, 0xfc
je 0x424fcb
push 0x104
lea eax, [ebp - 0x7c]
push eax
push edx
mov byte [ebp + 0x88], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x424f0e
lea eax, [ebp - 0x7c]
push str._program_name_unknown_
push eax
call fcn.0042aa50
pop ecx
pop ecx
lea edi, [ebp - 0x7c]
mov eax, edi
push eax
call fcn.004234a0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x424f42
mov eax, edi
push eax
call fcn.004234a0
mov edi, eax
lea eax, [ebp - 0x7c]
sub eax, 0x3b
push 3
add edi, eax
push 0x451bc0
push edi
call fcn.0042cfd0
add esp, 0x10
push edi
call fcn.004234a0
push dword [esi + 0x45ecc4]
mov ebx, eax
call fcn.004234a0
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.00421510
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.0042aa50
push edi
push ebx
call fcn.0042aa60
push 0x451ba0
push ebx
call fcn.0042aa60
push dword [esi + 0x45ecc4]
push ebx
call fcn.0042aa60
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.0042ced4
add esp, 0x2c
jmp 0x424fcb
push edx
lea eax, [ebp - 0x80]
push eax
lea esi, [esi + 0x45ecc4]
push dword [esi]
call fcn.004234a0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x8c]
xor ecx, ebp
call fcn.00422ecb
add ebp, 0x90
leave
ret
Function at 0x425495
Capabilities:
Query environment variable

Disassembly:
push ecx
push ecx
mov eax, dword [0x465cb4]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push esi
push edi
xor ebx, ebx
xor esi, esi
xor edi, edi
cmp eax, ebx
jne 0x4254de
call ebp
mov esi, eax
cmp esi, ebx
je 0x4254c4
mov dword [0x465cb4], 1
jmp 0x4254e3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x4254d9
push 2
pop eax
mov dword [0x465cb4], eax
jmp 0x4254de
mov eax, dword [0x465cb4]
cmp eax, 1
jne 0x42553b
cmp esi, ebx
jne 0x4254f6
call ebp
mov esi, eax
cmp esi, ebx
jne 0x4254f6
xor eax, eax
jmp 0x4255e2
cmp word [esi], bx
mov eax, esi
je 0x42550b
inc eax
inc eax
cmp word [eax], bx
jne 0x4254fd
inc eax
inc eax
cmp word [eax], bx
jne 0x4254fd
sub eax, esi
inc eax
inc eax
mov ebp, eax
push ebp
call fcn.00423344
mov edi, eax
cmp edi, ebx
pop ecx
jne 0x42552e
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
jmp 0x4255e2
push ebp
push esi
push edi
call fcn.00422f60
add esp, 0xc
jmp 0x425520
cmp eax, 2
je 0x425544
cmp eax, ebx
jne 0x4254ef
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebp, eax
cmp ebp, ebx
je 0x4254ef
cmp byte [ebp], bl
mov esi, ebp
je 0x42557a
push ebx
push ebx
push 0xffffffffffffffff
push esi
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, ebx
je 0x4254ef
push esi
add edi, eax
call fcn.004234a0
lea esi, [esi + eax + 1]
cmp byte [esi], bl
pop ecx
jne 0x425557
inc edi
lea eax, [edi + edi]
push eax
mov dword [esp + 0x18], edi
call fcn.00423344
cmp eax, ebx
pop ecx
mov dword [esp + 0x10], eax
je 0x4255f3
cmp byte [ebp], bl
mov edi, ebp
mov esi, eax
je 0x4255d4
mov ecx, dword [esp + 0x14]
mov eax, esi
sub eax, dword [esp + 0x10]
sar eax, 1
sub ecx, eax
push ecx
push esi
push 0xffffffffffffffff
push edi
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x4255e9
push edi
call fcn.004234a0
push esi
lea edi, [edi + eax + 1]
call fcn.004206a1
cmp byte [edi], bl
pop ecx
pop ecx
lea esi, [esi + eax*2 + 2]
jne 0x42559a
push ebp
mov word [esi], bx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
push dword [esp + 0x10]
call fcn.00423356
pop ecx
push ebp
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
jmp 0x4254ef
Function at 0x4255ff
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword [0x465cb8]
push ebp
xor ebp, ebp
cmp eax, ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jne 0x42563f
call esi
test eax, eax
je 0x425624
mov dword [0x465cb8], 1
jmp 0x425644
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x42563b
mov dword [0x465cb8], 2
jmp 0x42564d
xor eax, eax
jmp 0x42569b
cmp eax, 1
jne 0x425648
call esi
jmp 0x42569b
cmp eax, 2
jne 0x42563b
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ebp
push ebp
push 0xffffffffffffffff
mov ebx, eax
push ebx
push 1
push ebp
call edi
mov esi, eax
cmp esi, ebp
je 0x425693
lea eax, [esi + esi]
push eax
call fcn.00423344
mov ebp, eax
test ebp, ebp
pop ecx
je 0x425693
push esi
push ebp
push 0xffffffffffffffff
push ebx
push 1
push 0
call edi
test eax, eax
jne 0x425697
push ebp
call fcn.00423356
pop ecx
xor eax, eax
jmp 0x425699
mov eax, ebp
pop edi
pop ebx
pop esi
pop ebp
ret

Function at 0x427e15
Capabilities:
Get common file path

Disassembly:
push 0x120
push 0x451d88
call fcn.004237b4
mov eax, dword [0x45eb40]
xor eax, ebp
mov dword [ebp - 0x1c], eax
lea edi, [ebp - 0x124]
and dword [ebp - 0x128], 0
mov eax, edi
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esi, eax
mov dword [ebp - 0x12c], esi
cmp esi, 0x104
jle 0x427ebb
and dword [ebp - 4], 0
lea eax, [esi + 1]
add eax, 3
and eax, 0xfffffffc
call fcn.00421510
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x130], edi
jmp 0x427ea8
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x427ebb
push edi
inc esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esi, eax
xor ebx, ebx
test esi, esi
je 0x427ed6
cmp byte [edi + 1], 0x3a
jne 0x427ed6
movzx eax, byte [edi]
push eax
call fcn.0042e265
pop ecx
mov ebx, eax
sub ebx, 0x40
cmp dword [ebp - 0x128], 0
je 0x427ee6
push edi
call fcn.00423356
pop ecx
mov eax, ebx
lea esp, [ebp - 0x13c]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00422ecb
call fcn.004237ef
ret
Function at 0x42a778
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.00421510
mov eax, dword [0x45eb40]
push ebx
push esi
push 1
xor esi, esi
push esi
push dword [ebp + 8]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.0042a8bd
or ebx, 0xffffffff
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 0x1008], eax
je 0x42a8ad
push 2
push esi
push dword [ebp + 8]
call fcn.0042a8bd
add esp, 0xc
cmp eax, ebx
je 0x42a8ad
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
test edi, edi
jle 0x42a84d
mov ebx, 0x1000
push ebx
lea eax, [ebp - 0x1004]
push esi
push eax
call fcn.00422f00
push 0x8000
push dword [ebp + 8]
call fcn.0042ee79
add esp, 0x14
mov dword [ebp - 0x100c], eax
cmp edi, ebx
mov eax, ebx
jge 0x42a803
mov eax, edi
push eax
lea eax, [ebp - 0x1004]
push eax
push dword [ebp + 8]
call fcn.00421a72
add esp, 0xc
cmp eax, 0xffffffff
je 0x42a823
sub edi, eax
test edi, edi
jg 0x42a7fb
jmp 0x42a83b
call fcn.00423a30
cmp dword [eax], 5
jne 0x42a838
call fcn.00423a27
mov dword [eax], 0xd
or esi, 0xffffffff
push dword [ebp - 0x100c]
push dword [ebp + 8]
call fcn.0042ee79
pop ecx
pop ecx
jmp 0x42a895
jge 0x42a895
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0042a8bd
push dword [ebp + 8]
call fcn.00424140
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, ebx
jne 0x42a895
call fcn.00423a27
mov dword [eax], 0xd
call fcn.00423a30
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
push 0
push dword [ebp - 0x1008]
push dword [ebp + 8]
call fcn.0042a8bd
add esp, 0xc
mov eax, esi
pop edi
jmp 0x42a8af
mov eax, ebx
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00422ecb
leave
ret

Function at 0x42b109
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x42b137
add al, 0x40
mov byte [ebp + 8], al
lea eax, [ebp + 8]
push eax
mov byte [ebp + 9], 0x3a
mov byte [ebp + 0xa], 0x5c
mov byte [ebp + 0xb], 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
test eax, eax
je 0x42b13c
cmp eax, 1
je 0x42b13c
xor eax, eax
inc eax
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x42c7e1
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x42c80f
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x42c816
cmp ebx, dword [eax + 4]
jae 0x42c816
xor eax, eax
jmp 0x42ca06
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x42c827
xor eax, eax
inc eax
jmp 0x42ca05
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x42c83d
cmp ecx, edx
jae 0x42c982
cmp dword [eax + 4], 0
je 0x42c846
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x42c82e
cmp dword [ebp + 8], 0
je 0x42c868
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x42c982
cmp eax, esi
jae 0x42c982
mov eax, dword [0x465f30]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x42c88d
cmp dword [esi*4 + 0x465f38], edi
je 0x42c986
inc esi
cmp esi, eax
jl 0x42c87b
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x42ca02
cmp dword [ebp - 8], 0x1000000
jne 0x42ca02
test byte [ebp - 0xc], 0xcc
je 0x42c90b
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x42ca02
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x42ca02
cmp word [eax + 0x18], 0x10b
jne 0x42ca02
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x42ca02
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x42c90b
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x42c90b
test byte [ecx + 0x27], 0x80
jne 0x42c982
push 1
push 0x465f78
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x42c81f
mov ecx, dword [0x465f30]
test ecx, ecx
mov edx, ecx
jle 0x42c93f
lea eax, [ecx*4 + 0x465f34]
cmp dword [eax], edi
je 0x42c93f
dec edx
sub eax, 4
test edx, edx
jg 0x42c933
test edx, edx
jne 0x42c970
push 0xf
pop ebx
cmp ecx, ebx
jg 0x42c94c
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x42c964
lea eax, [edx*4 + 0x465f38]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x42c952
cmp ecx, 0x10
jge 0x42c970
inc ecx
mov dword [0x465f30], ecx
push 0
push 0x465f78
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x42c81f
xor eax, eax
jmp 0x42ca05
test esi, esi
jle 0x42c81f
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
push 0x465f78
call ebx
test eax, eax
jne 0x42c81f
cmp dword [esi*4 + 0x465f38], edi
je 0x42c9dc
mov eax, dword [0x465f30]
lea esi, [eax - 1]
test esi, esi
jl 0x42c9ca
cmp dword [esi*4 + 0x465f38], edi
je 0x42c9c6
dec esi
jns 0x42c9ba
test esi, esi
jge 0x42c9da
cmp eax, 0x10
jge 0x42c9d5
inc eax
mov dword [0x465f30], eax
lea esi, [eax - 1]
jmp 0x42c9dc
je 0x42c9f4
xor ecx, ecx
test esi, esi
jl 0x42c9f4
lea eax, [ecx*4 + 0x465f38]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x42c9e2
push 0
push 0x465f78
call ebx
jmp 0x42c81f
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret