joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406cd7
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
push edi
push 0x10
lea eax, [ebp - 0x2c]
push 0
push eax
or esi, 0xffffffff
call fcn.00428300
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x406d8d
mov edi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push ebx
mov dword [ebp - 4], 0xa
lea eax, [ebp - 0x14]
push eax
call edi
mov eax, 0x80000000
mov bx, 0xfa0
bsf ecx, eax
dec bx
jne 0x406d21
lea eax, [ebp - 0xc]
push eax
call edi
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
cmp eax, esi
jae 0x406d3a
mov esi, eax
dec dword [ebp - 4]
jne 0x406d12
mov ecx, dword [ebp - 0x1c]
push 0xa
mov eax, ecx
xor edx, edx
pop edi
imul esi, esi, 0x186a0
div edi
xor edx, edx
pop ebx
mov edi, eax
mov eax, esi
div edi
xor edx, edx
mov esi, eax
div ecx
shr ecx, 1
cmp edx, ecx
jbe 0x406d67
inc esi
mov edi, dword [ebp + 0xc]
xor edx, edx
mov eax, edi
div esi
xor edx, edx
mov ecx, eax
mov eax, edi
div esi
mov eax, esi
mov dword [ebp - 0x24], ecx
shr eax, 1
cmp edx, eax
jbe 0x406d84
inc ecx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x2c]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
leave
ret

Function at 0x406d9d
Capabilities:
Check for time delay via gettickcount
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42c620
push 0x428ce0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ebx, eax
mov dword [ebp - 0x30], ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [ebp - 0x24], eax
push 0xf
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_SetThreadPriority]
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov dword [ebp - 0x20], eax
call esi
sub eax, dword [ebp - 0x20]
je 0x406dee
call esi
mov dword [ebp - 0x20], eax
and dword [ebp - 4], 0
rdtsc
mov dword [ebp - 0x1c], eax
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x24]
push ebx
call edi
push 0x3c
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xf
push ebx
call edi
call esi
mov dword [ebp - 0x2c], eax
call esi
sub eax, dword [ebp - 0x2c]
je 0x406e1f
call esi
mov esi, eax
rdtsc
mov dword [ebp - 0x34], eax
push dword [ebp - 0x24]
push ebx
call edi
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x1c]
sub esi, dword [ebp - 0x20]
xor edx, edx
div esi
mov esi, eax
xor edx, edx
mov ecx, 0x3e8
div ecx
mov ecx, eax
mov eax, esi
xor edx, edx
push 0x64
pop esi
div esi
lea edx, [ecx + ecx*4]
shl edx, 1
sub eax, edx
cmp eax, 5
jb 0x406e65
inc ecx
mov eax, ecx
jmp 0x406e82
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40c459
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
lea eax, [ebp - 8]
push edi
mov edi, ecx
push eax
push 0xa
push dword [edi + 4]
call fcn.00420e9b
mov ecx, dword [ebp + 8]
add esp, 0xc
push dword [ebp - 8]
call fcn.0041f0d8
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
xor ebx, ebx
mov dword [esi], eax
cmp byte [eax], bl
jne 0x40c49d
mov edi, dword [edi + 4]
push ebx
push ebx
mov ecx, 0x483110
jmp 0x40c66f
push eax
call fcn.00428770
cmp eax, 2
pop ecx
jb 0x40c665
mov ecx, dword [ebp - 8]
mov byte [ebp + 0xb], bl
mov al, byte [ecx]
mov byte [ebp - 3], 0x3a
mov byte [ebp - 4], al
mov eax, dword [esi]
mov byte [ebp - 2], 0x5c
mov byte [ebp - 1], bl
cmp byte [eax], 0x5c
jne 0x40c561
cmp byte [eax + 1], 0x5c
jne 0x40c561
mov byte [ebp + 0xb], 1
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov cl, byte [ebp + 0xb]
neg cl
sbb ecx, ecx
and ecx, 2
cmp ecx, eax
jge 0x40c5ec
mov esi, dword [ebp - 8]
mov dl, byte [ecx + esi]
cmp dl, 0x3a
jne 0x40c509
cmp ecx, 1
jne 0x40c5dd
cmp dl, 0x7c
je 0x40c5dd
cmp dl, 0x2a
je 0x40c5dd
cmp dl, 0x2f
je 0x40c5dd
cmp dl, 0x3e
je 0x40c5dd
cmp dl, 0x3c
je 0x40c5dd
cmp dl, 0x3f
je 0x40c5dd
cmp dl, 0x22
je 0x40c5dd
cmp ecx, ebx
jle 0x40c557
cmp dl, 0x5c
jne 0x40c557
cmp byte [ecx + esi - 1], dl
je 0x40c5ce
inc ecx
cmp ecx, eax
jl 0x40c4f8
jmp 0x40c5ec
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov ecx, dword [ebp - 8]
cmp byte [ecx + 1], 0x3a
jne 0x40c665
mov dl, byte [ecx + 2]
cmp dl, 0x5c
je 0x40c588
cmp dl, bl
jne 0x40c665
cmp eax, 1
jne 0x40c59c
mov edi, dword [edi + 4]
push ebx
push ebx
mov ecx, 0x483128
jmp 0x40c66f
cmp eax, 3
je 0x40c4dc
cmp eax, 4
je 0x40c4dc
cmp eax, 2
je 0x40c4dc
cmp eax, ebx
je 0x40c4dc
mov edi, dword [edi + 4]
push ebx
push ebx
mov ecx, 0x483134
jmp 0x40c66f
mov edi, dword [edi + 4]
push ebx
push ebx
mov ecx, 0x483140
jmp 0x40c66f
mov edi, dword [edi + 4]
push ebx
push ebx
mov ecx, 0x48314c
jmp 0x40c66f
cmp byte [ebp + 0xb], bl
jne 0x40c661
lea eax, [ebp - 4]
push 1
push eax
call fcn.0040f179
cmp edx, dword [0x482b14]
pop ecx
pop ecx
mov dword [0x482b08], eax
mov dword [0x482b0c], edx
ja 0x40c661
jb 0x40c61b
cmp eax, dword [0x482b10]
jae 0x40c661
lea ecx, [ebp - 0x14]
call fcn.0041ef35
lea eax, [ebp - 4]
mov ecx, 0x483158
push eax
call fcn.0041ff07
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0041f62d
mov edi, dword [edi + 4]
add esp, 0xc
lea ecx, [ebp - 0x14]
push ebx
push ebx
call fcn.0041ff07
push eax
push edi
mov ecx, 0x482408
call fcn.0041e217
lea ecx, [ebp - 0x14]
call fcn.0041f06b
jmp 0x40c680
mov al, 1
jmp 0x40c682
mov edi, dword [edi + 4]
push ebx
push ebx
mov ecx, 0x48311c
call fcn.0041ff07
push eax
push edi
mov ecx, 0x482408
call fcn.0041e217
xor al, al
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x40c689
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x144]
push eax
call fcn.0041ff07
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp + 0xc], eax
je 0x40c757
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push edi
xor ebx, ebx
test byte [ebp - 0x144], 0x10
je 0x40c73c
cmp byte [ebp - 0x118], 0x2e
je 0x40c73c
cmp byte [ebp - 0x118], bl
je 0x40c73c
push ebx
push ebx
push 0x18b
push 0xb
push dword [ebp + 8]
call esi
xor edi, edi
cmp eax, ebx
mov dword [ebp - 4], eax
jle 0x40c728
lea eax, [ebp - 0x248]
mov byte [ebp - 0x248], bl
push eax
push edi
push 0x189
push 0xb
push dword [ebp + 8]
call esi
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x40c73c
inc edi
cmp edi, dword [ebp - 4]
jl 0x40c6f0
lea eax, [ebp - 0x118]
push eax
push ebx
push 0x180
push 0xb
push dword [ebp + 8]
call esi
lea eax, [ebp - 0x144]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40c6bf
pop edi
pop esi
pop ebx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindClose]
leave
ret 8
Function at 0x40eb0a
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
and byte [ebp - 0x104], 0
push edi
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x104]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
pop edi
jne 0x40eb5f
lea eax, [ebp - 0x104]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
leave
ret

Function at 0x40eb61
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push esi
call edi
cmp eax, 0xffffffff
je 0x40eb7f
and al, 0xfe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call edi
inc eax
pop edi
neg eax
sbb eax, eax
pop esi
inc eax
ret

Function at 0x40eb92
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 8]
push esi
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
jne 0x40ebb0
or eax, 0xffffffff
jmp 0x40ec23
push edi
push esi
call fcn.00428bd9
mov edi, eax
pop ecx
test edi, edi
jne 0x40ebcf
mov ecx, 0x482e04
call fcn.0041ff07
push eax
call fcn.00420bbf
pop ecx
push edi
push esi
push dword [ebp - 8]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x40ebe4
push 0xfffffffffffffffd
jmp 0x40ec18
and dword [ebp - 4], 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x42fb94
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x40ec03
push 0xfffffffffffffffc
jmp 0x40ec18
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
push 1
mov ecx, dword [eax + 8]
mov dword [edx], ecx
mov ecx, dword [ebp + 0x10]
mov eax, dword [eax + 0xc]
mov dword [ecx], eax
pop esi
push edi
call fcn.00428bce
pop ecx
mov eax, esi
pop edi
pop esi
leave
ret
Function at 0x40ec26
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
lea eax, [ebp - 0x10]
push edi
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
xor edi, edi
cmp esi, edi
jne 0x40ec4a
or eax, 0xffffffff
jmp 0x40edc5
push ebx
push esi
call fcn.00428bd9
mov ebx, eax
pop ecx
cmp ebx, edi
mov dword [ebp - 0xc], ebx
jne 0x40ec6c
mov ecx, 0x482e04
call fcn.0041ff07
push eax
call fcn.00420bbf
pop ecx
push ebx
push esi
push dword [ebp - 0x10]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x40ec84
push 0xfffffffffffffffd
jmp 0x40edb8
lea eax, [ebp - 8]
mov dword [ebp - 8], edi
push eax
lea eax, [ebp - 4]
push eax
push str.VarFileInfoTranslation
push ebx
call sub.VERSION.dll_VerQueryValueA
mov eax, dword [ebp - 8]
mov bl, 3
test bl, al
jne 0x40edb6
cmp eax, edi
je 0x40edb6
shr eax, 2
test eax, eax
jle 0x40ed9c
mov eax, dword [ebp + 0xc]
cmp eax, edi
je 0x40ecc8
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dword [eax], ecx
lea ecx, [ebp - 0x1c]
call fcn.0041ef35
mov eax, dword [ebp - 4]
mov esi, 0x42fccc
movzx eax, word [eax]
push eax
lea eax, [ebp - 0x1c]
push esi
push eax
call fcn.0041f62d
add esp, 0xc
test byte [ebp - 0x1c], bl
je 0x40ecfb
push edi
push 0x30
lea ecx, [ebp - 0x1c]
call fcn.0041fbc7
jmp 0x40ece9
push str.StringFileInfo_
lea ecx, [ebp - 0x28]
call fcn.0041efa5
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x28]
push eax
call fcn.0041f28b
push 0x432518
lea ecx, [ebp - 0x1c]
call fcn.0041f0d8
mov eax, dword [ebp - 4]
movzx eax, word [eax + 2]
push eax
lea eax, [ebp - 0x1c]
push esi
push eax
call fcn.0041f62d
add esp, 0xc
test byte [ebp - 0x1c], bl
je 0x40ed48
push edi
push 0x30
lea ecx, [ebp - 0x1c]
call fcn.0041fbc7
jmp 0x40ed36
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x28]
push eax
call fcn.0041f28b
push edi
push str.FileDescription
lea ecx, [ebp - 0x28]
call fcn.0041f20d
lea eax, [ebp - 8]
lea ecx, [ebp - 0x28]
push eax
lea eax, [ebp + 8]
push eax
call fcn.0041ff07
push eax
push dword [ebp - 0xc]
call sub.VERSION.dll_VerQueryValueA
mov ecx, dword [ebp + 0x10]
cmp ecx, edi
je 0x40ed8a
push dword [ebp + 8]
call fcn.0041f0d8
lea ecx, [ebp - 0x28]
call fcn.0041f06b
lea ecx, [ebp - 0x1c]
call fcn.0041f06b
jmp 0x40edb2
mov eax, dword [ebp + 0xc]
mov word [ebp + 8], di
cmp eax, edi
mov word [ebp + 0xa], 0x4b0
je 0x40edb2
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
push 1
jmp 0x40edb8
push 0xfffffffffffffffc
pop esi
push dword [ebp - 0xc]
call fcn.00428bce
pop ecx
mov eax, esi
pop ebx
pop edi
pop esi
leave
ret
Function at 0x40f6db
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
push edi
je 0x40f8a6
cmp dword [ebp + 0xc], ebx
je 0x40f8a6
cmp dword [ebp + 0x14], ebx
je 0x40f8a6
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
call esi
add eax, 4
push eax
call fcn.00428bd9
mov edi, eax
pop ecx
cmp edi, ebx
jne 0x40f730
mov ecx, 0x482e04
call fcn.0041ff07
push eax
call fcn.00420bbf
pop ecx
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x42feec
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x148]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push edi
mov dword [ebp - 4], eax
call fcn.00428bce
cmp dword [ebp - 4], 0xffffffff
pop ecx
jne 0x40f76b
push 0xfffffffffffffffd
jmp 0x40f889
mov ebx, dword [sym.imp.KERNEL32.dll_FindClose]
test byte [ebp - 0x148], 0x10
je 0x40f818
cmp byte [ebp - 0x11c], 0x2e
je 0x40f82c
push dword [ebp + 8]
call fcn.00428770
mov edi, eax
pop ecx
lea eax, [ebp - 0x11c]
push eax
call esi
lea eax, [edi + eax + 2]
push eax
call fcn.00428bd9
mov edi, eax
pop ecx
test edi, edi
jne 0x40f7c6
push dword [ebp - 4]
call ebx
mov ecx, 0x482e04
call fcn.0041ff07
push eax
call fcn.00420bbf
pop ecx
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x11c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
call esi
cmp byte [eax + edi - 1], 0x5c
je 0x40f7f5
push 0x42fb94
push edi
call fcn.00429090
pop ecx
pop ecx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.0040f6db
push edi
mov dword [ebp - 8], eax
call fcn.00428bce
add esp, 0x14
cmp dword [ebp - 8], 0
jg 0x40f845
jmp 0x40f82c
push dword [ebp + 0xc]
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x40f84f
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x40f88c
jmp 0x40f771
push dword [ebp - 4]
call ebx
mov eax, dword [ebp - 8]
jmp 0x40f8a9
push dword [ebp - 4]
call ebx
push dword [ebp + 8]
call esi
inc eax
push eax
call fcn.00428bd9
mov esi, eax
pop ecx
test esi, esi
jne 0x40f878
mov ecx, 0x482e04
call fcn.0041ff07
push eax
call fcn.00420bbf
pop ecx
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp + 0x14]
push 1
mov dword [eax], esi
pop eax
jmp 0x40f8a9
push dword [ebp - 4]
call ebx
mov esi, 0x482408
mov ecx, esi
call fcn.0041d06a
cmp eax, 1
je 0x40f896
xor eax, eax
jmp 0x40f8a9
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40f8ae
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
push edi
je 0x40f955
mov eax, dword [ebp + 0x10]
cmp eax, ebx
je 0x40f955
mov esi, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
push ebx
push ebx
mov dword [eax], ebx
call esi
mov edi, eax
cmp edi, ebx
jne 0x40f8e2
push 0xfffffffffffffffe
pop eax
jmp 0x40f958
push edi
call fcn.00428bd9
cmp eax, ebx
pop ecx
mov dword [ebp - 4], eax
jne 0x40f901
mov ecx, 0x482e04
call fcn.0041ff07
push eax
call fcn.00420bbf
pop ecx
push dword [ebp - 4]
push edi
call esi
test eax, eax
jne 0x40f91b
push 0xfffffffffffffffc
pop edi
push dword [ebp - 4]
call fcn.00428bce
pop ecx
mov eax, edi
jmp 0x40f958
mov esi, dword [ebp - 4]
xor edi, edi
cmp byte [esi], bl
je 0x40f90e
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x40f948
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call fcn.0040f6db
mov edi, eax
add esp, 0x10
cmp edi, ebx
jg 0x40f90e
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esi + eax + 1]
jmp 0x40f920
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40ffb5
Capabilities:
Enumerate pe sections

Disassembly:
and al, 8
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x40ffee
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x40ffd5
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x40ffe6
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x40fff0
inc edi
add eax, 0x28
cmp edi, esi
jb 0x40ffcb
xor eax, eax
pop edi
pop esi
ret
Function at 0x4105bf
Capabilities:
Inspect section memory permissions

Disassembly:
push dword [esi]
out dx, eax
rcl byte [esi + 0xa0878b], cl
add byte [eax], al
cmp eax, ebx
je 0x410627
add eax, esi
cmp dword [eax], ebx
je 0x410627
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x410622
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x41060c
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x410614
cmp edx, ebx
jne 0x410762
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x4105e3
add eax, dword [eax + 4]
jmp 0x4105d0
mov dword [ebp + 0xc], ebx
jmp 0x410632
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x41064a
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x410668
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x4106c6
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x4106ad
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x4106b6
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x4106c0
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x4106a2
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x41062c
mov dword [ebp + 8], esi
xor edi, edi
Function at 0x412273
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
push esi
push edi
je 0x4122e1
cmp dword [ebp + 0xc], ebx
je 0x4122e1
cmp byte [0x42ff04], bl
mov ecx, 0x482bc0
jne 0x41229a
mov ecx, 0x482b90
call fcn.0041ff07
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, 0x80
push ebx
push edi
push 3
push ebx
push 1
push 0x80000000
push eax
call esi
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x4122e1
lea ecx, [ebp - 0x14]
push ebx
push ecx
mov dword [ebp - 0x14], ebx
push dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x4122ea
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0x10
push ebx
push edi
push 2
push ebx
push 1
push 0xc0000000
push dword [ebp + 8]
call esi
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x4122e1
mov edi, 0x8000
push edi
call fcn.00428bd9
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, ebx
pop ecx
mov dword [ebp + 0xc], eax
jne 0x412337
push dword [ebp - 4]
call esi
push dword [ebp + 8]
call esi
mov ecx, 0x482e04
call fcn.0041ff07
push eax
call fcn.00420bbf
pop ecx
mov dword [ebp - 8], ebx
cmp byte [ebp + 0x14], bl
je 0x412355
lea eax, [ebp - 0x10]
push eax
push edi
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
call fcn.00412ee7
add esp, 0x10
jmp 0x412380
mov ecx, dword [ebp - 8]
mov eax, edi
lea edx, [ecx + 0x8000]
cmp edx, dword [ebp + 0x10]
jbe 0x41236a
mov eax, dword [ebp + 0x10]
sub eax, ecx
lea ecx, [ebp - 0x10]
push ebx
push ecx
push eax
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4123b4
lea eax, [ebp - 0xc]
push ebx
push eax
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4123b4
mov eax, dword [ebp - 0xc]
add dword [ebp - 8], eax
cmp byte [ebp + 0x14], bl
je 0x4123aa
push eax
call fcn.0041742a
pop ecx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x10]
jae 0x4123cc
jmp 0x41233a
push dword [ebp + 0xc]
call fcn.00428bce
pop ecx
push dword [ebp - 4]
call esi
push dword [ebp + 8]
call esi
jmp 0x4122e1
push dword [ebp + 0xc]
call fcn.00428bce
pop ecx
push dword [ebp - 4]
call esi
push dword [ebp + 8]
call esi
mov ecx, dword [ebp - 0xc]
xor eax, eax
cmp ecx, dword [ebp - 0x10]
sete al
jmp 0x4122e3
Function at 0x4126b9
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x48261c], ebx
jne 0x4126d8
push dword [ebp + 8]
call fcn.0040eb61
pop ecx
jmp 0x412799
and byte [ebp - 0x10], 0
push esi
push edi
xor eax, eax
lea edi, [ebp - 0xf]
push 0xa
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x10]
mov dword [ebp - 4], ebx
push eax
push ebx
call fcn.0042b8b6
mov esi, dword [ebp + 0xc]
add esp, 0xc
mov ecx, esi
push dword [ebp + 8]
call fcn.0041f0d8
push ebx
push str..old
mov ecx, esi
call fcn.0041f20d
lea eax, [ebp - 0x10]
push ebx
push eax
mov ecx, esi
call fcn.0041f20d
mov ecx, esi
call fcn.0041ff07
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push eax
call ebx
cmp eax, 0xffffffff
je 0x412786
and byte [ebp - 0x10], 0
xor eax, eax
lea edi, [ebp - 0xf]
inc dword [ebp - 4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x10]
push 0xa
push eax
push dword [ebp - 4]
call fcn.0042b8b6
add esp, 0xc
mov ecx, esi
push dword [ebp + 8]
call fcn.0041f0d8
push 0
push str..old
mov ecx, esi
call fcn.0041f20d
lea eax, [ebp - 0x10]
push 0
push eax
mov ecx, esi
call fcn.0041f20d
mov ecx, esi
call fcn.0041ff07
push eax
jmp 0x41272e
mov ecx, esi
call fcn.0041ff07
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileA]
pop edi
pop esi
pop ebx
leave
ret