joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419f30
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x479afc
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x51484c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
lea ecx, [ebp - 0x134]
call fcn.00408110
push edi
lea ecx, [ebp - 0x134]
mov dword [ebp - 4], 0
call fcn.00409370
push 0x5c
push 0x2f
lea ecx, [ebp - 0x134]
call fcn.00408f60
lea ecx, [ebp - 0xa8]
call fcn.00422e30
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 1
call fcn.00422e60
lea ecx, [ebp - 0x134]
test al, al
je 0x419fc8
call fcn.00408920
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jmp 0x41a0e0
call fcn.00409120
cmp eax, 0x104
jle 0x41a080
lea ecx, [ebp - 0x244]
call fcn.00408110
lea eax, [ebp - 0x244]
push eax
lea ecx, [ebp - 0x134]
push ecx
mov byte [ebp - 4], 2
call fcn.00419a20
add esp, 8
lea ecx, [ebp - 0x1bc]
call fcn.00408110
push 0x4b391c
lea ecx, [ebp - 0x1bc]
mov byte [ebp - 4], 3
call fcn.004092a0
lea ecx, [ebp - 0x244]
call fcn.00408ba0
push eax
lea ecx, [ebp - 0x1bc]
call fcn.004092a0
lea ecx, [ebp - 0x1bc]
call fcn.004091d0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, eax
test esi, esi
jne 0x41a05d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x41a05b
mov esi, 1
test esi, esi
lea ecx, [ebp - 0x1bc]
setne bl
mov byte [ebp - 4], 2
call fcn.004081c0
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 1
call fcn.004081c0
jmp 0x41a0e3
lea ecx, [ebp - 0x134]
call fcn.004091d0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0xac], eax
test eax, eax
jne 0x41a0d9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test esi, esi
je 0x41a0ca
push edi
mov ecx, esi
call fcn.004208c0
mov ebx, dword [esi]
lea ecx, [ebp - 0x134]
call fcn.00408ba0
mov edx, dword [ebx + 0x28]
push eax
push str.failedToDeleteFilepath
mov ecx, esi
call edx
cmp edi, 2
jne 0x41a0d9
mov dword [ebp - 0xac], 1
cmp dword [ebp - 0xac], 0
setne bl
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 0
call fcn.00422e50
lea ecx, [ebp - 0x134]
mov dword [ebp - 4], 0xffffffff
call fcn.004081c0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00462878
mov esp, ebp
pop ebp
ret
Function at 0x41ac20
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x479c36
mov eax, dword fs:[0]
push eax
sub esp, 0x124
mov eax, dword [0x51484c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0xa8]
call fcn.00422e30
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], 0
call fcn.00422e60
test al, al
je 0x41ac83
mov eax, dword [ebp + 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
setne bl
jmp 0x41acc8
lea ecx, [ebp - 0x130]
call fcn.00408110
push esi
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], 1
call fcn.004083b0
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x130]
call fcn.004091d0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
lea ecx, [ebp - 0x130]
setne bl
mov byte [ebp - 4], 0
call fcn.004081c0
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], 0xffffffff
call fcn.00422e50
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00462878
mov esp, ebp
pop ebp
ret

Function at 0x41ad00
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x479c76
mov eax, dword fs:[0]
push eax
sub esp, 0x124
mov eax, dword [0x51484c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0xa8]
call fcn.00422e30
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], 0
call fcn.00422e60
test al, al
je 0x41ad5b
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
jmp 0x41ad99
lea ecx, [ebp - 0x130]
call fcn.00408110
push esi
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], 1
call fcn.004083b0
lea ecx, [ebp - 0x130]
call fcn.004091d0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea ecx, [ebp - 0x130]
mov esi, eax
mov byte [ebp - 4], 0
call fcn.004081c0
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], 0xffffffff
call fcn.00422e50
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00462878
mov esp, ebp
pop ebp
ret
Function at 0x41aea0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x479cd7
mov eax, dword fs:[0]
push eax
sub esp, 0x2c0
mov eax, dword [0x51484c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
lea ecx, [ebp - 0x134]
mov dword [ebp - 0xac], eax
call fcn.00408110
lea ecx, [ebp - 0x1bc]
mov dword [ebp - 4], 0
call fcn.00408110
push esi
lea ecx, [ebp - 0x134]
mov byte [ebp - 4], 1
call fcn.00409370
push edi
lea ecx, [ebp - 0x1bc]
call fcn.00409370
push 0x5c
push 0x2f
lea ecx, [ebp - 0x134]
call fcn.00408f60
push 0x5c
push 0x2f
lea ecx, [ebp - 0x1bc]
call fcn.00408f60
lea ecx, [ebp - 0xa8]
call fcn.00422e30
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 2
call fcn.00422e60
test al, al
je 0x41af7a
lea ecx, [ebp - 0x1bc]
call fcn.00408920
push eax
lea ecx, [ebp - 0x134]
call fcn.00408920
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
setne bl
jmp 0x41b048
lea ecx, [ebp - 0x134]
call fcn.00409120
test eax, eax
jg 0x41afc0
lea ecx, [ebp - 0x1bc]
call fcn.00409120
test eax, eax
jg 0x41afc0
lea ecx, [ebp - 0x1bc]
call fcn.004091d0
push eax
lea ecx, [ebp - 0x134]
call fcn.004091d0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne bl
jmp 0x41b048
lea ecx, [ebp - 0x244]
call fcn.00408110
lea ecx, [ebp - 0x2cc]
mov byte [ebp - 4], 3
call fcn.00408110
lea ecx, [ebp - 0x244]
push ecx
lea edx, [ebp - 0x134]
push edx
mov byte [ebp - 4], 4
call fcn.00419e50
lea eax, [ebp - 0x2cc]
push eax
lea ecx, [ebp - 0x1bc]
push ecx
call fcn.00419e50
add esp, 0x10
lea ecx, [ebp - 0x2cc]
call fcn.004091d0
push eax
lea ecx, [ebp - 0x244]
call fcn.004091d0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
lea ecx, [ebp - 0x2cc]
setne bl
mov byte [ebp - 4], 3
call fcn.004081c0
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 2
call fcn.004081c0
test bl, bl
jne 0x41b05b
mov ecx, dword [ebp - 0xac]
test ecx, ecx
je 0x41b05b
call fcn.00420820
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 1
call fcn.00422e50
lea ecx, [ebp - 0x1bc]
mov byte [ebp - 4], 0
call fcn.004081c0
lea ecx, [ebp - 0x134]
mov dword [ebp - 4], 0xffffffff
call fcn.004081c0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00462878
mov esp, ebp
pop ebp
ret

Function at 0x41b0b0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00419d00

Function at 0x41b0c0
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00419f30
Function at 0x41b0d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x479d21
mov eax, dword fs:[0]
push eax
sub esp, 0x1b0
mov eax, dword [0x51484c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x14]
mov dword [eax], 0
mov ecx, edi
mov dword [ebp - 0xac], eax
mov dword [esi], 0xffffffff
call fcn.00409120
test eax, eax
jne 0x41b140
test ebx, ebx
je 0x41b139
mov eax, dword [ebx]
mov edx, dword [eax + 0x10]
push str.GetAttributes:_filename_is_empty
mov ecx, ebx
call edx
xor al, al
jmp 0x41b266
lea ecx, [ebp - 0x134]
call fcn.00408110
push edi
lea ecx, [ebp - 0x134]
mov dword [ebp - 4], 0
call fcn.00409370
push 0x5c
push 0x2f
lea ecx, [ebp - 0x134]
call fcn.00408f60
lea ecx, [ebp - 0x134]
call fcn.00409120
lea ecx, [ebp - 0xa8]
mov edi, eax
call fcn.00422e30
mov bl, 1
mov byte [ebp - 4], bl
cmp edi, 0x104
jge 0x41b1c9
lea ecx, [ebp - 0x134]
call fcn.00408700
test al, al
jne 0x41b1b0
lea ecx, [ebp - 0xa8]
call fcn.00422e60
test al, al
je 0x41b1c9
lea ecx, [ebp - 0x134]
call fcn.00408920
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [esi], eax
cmp eax, 0xffffffff
jmp 0x41b22d
test edi, edi
jle 0x41b216
lea ecx, [ebp - 0x1bc]
call fcn.00408110
lea edx, [ebp - 0x1bc]
push edx
lea eax, [ebp - 0x134]
push eax
mov byte [ebp - 4], 2
call fcn.00419e50
add esp, 8
lea ecx, [ebp - 0x1bc]
call fcn.00408590
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea ecx, [ebp - 0x1bc]
mov dword [esi], eax
mov byte [ebp - 4], bl
call fcn.004081c0
jmp 0x41b22a
lea ecx, [ebp - 0x134]
call fcn.00408590
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [esi], eax
cmp dword [esi], 0xffffffff
jne 0x41b23d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0xac]
mov dword [ecx], eax
cmp dword [esi], 0xffffffff
lea ecx, [ebp - 0xa8]
setne bl
mov byte [ebp - 4], 0
call fcn.00422e50
lea ecx, [ebp - 0x134]
mov dword [ebp - 4], 0xffffffff
call fcn.004081c0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00462878
mov esp, ebp
pop ebp
ret
Function at 0x41b290
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x479d7c
mov eax, dword fs:[0]
push eax
sub esp, 0x1d4
mov eax, dword [0x51484c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
lea ecx, [ebp - 0x158]
call fcn.00408110
push esi
lea ecx, [ebp - 0x158]
mov dword [ebp - 4], 0
call fcn.00409370
push 0x5c
push 0x2f
lea ecx, [ebp - 0x158]
call fcn.00408f60
lea ecx, [ebp - 0xa8]
call fcn.00422e30
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 1
call fcn.00422e60
lea ecx, [ebp - 0x158]
test al, al
je 0x41b325
call fcn.00408920
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x41b38e
call fcn.00409120
test eax, eax
jle 0x41b37a
lea ecx, [ebp - 0x1e0]
call fcn.00408110
lea eax, [ebp - 0x1e0]
push eax
lea ecx, [ebp - 0x158]
push ecx
mov byte [ebp - 4], 2
call fcn.00419e50
add esp, 8
push 0
lea ecx, [ebp - 0x1e0]
call fcn.004091d0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [ebp - 0x1e0]
mov esi, eax
mov byte [ebp - 4], 1
call fcn.004081c0
jmp 0x41b390
push 0
lea ecx, [ebp - 0x158]
call fcn.004091d0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
test esi, esi
jne 0x41b3dd
test edi, edi
je 0x41b3db
lea ecx, [ebp - 0xd0]
call fcn.004065d0
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 3
call fcn.00407f40
mov ebx, dword [edi]
lea ecx, [ebp - 0xd0]
call fcn.00405cf0
mov edx, dword [ebx + 0x28]
push eax
push str.errorMsg
mov ecx, edi
call edx
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 1
call fcn.004067f0
test esi, esi
lea ecx, [ebp - 0xa8]
setne bl
mov byte [ebp - 4], 0
call fcn.00422e50
lea ecx, [ebp - 0x158]
mov dword [ebp - 4], 0xffffffff
call fcn.004081c0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00462878
mov esp, ebp
pop ebp
ret
Function at 0x41bd90
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041aea0

Function at 0x41e8b0
Capabilities:
Hash data with md5

Disassembly:
mov eax, ecx
xor ecx, ecx
mov dword [eax], vtable.Md5.0
mov dword [eax + 0x18], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 4], 0x67452301
mov dword [eax + 8], 0xefcdab89
mov dword [eax + 0xc], 0x98badcfe
mov dword [eax + 0x10], 0x10325476
ret

Function at 0x41eab0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, edi
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], eax
mov dword [esi + 4], 0x67452301
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
call fcn.00409600
push eax
mov ecx, edi
call fcn.00405cf0
push eax
mov ecx, esi
call fcn.0041e8f0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, esi
call fcn.0041e9e0
pop edi
pop esi
pop ebp
ret 8

Function at 0x41eb10
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, edi
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], eax
mov dword [esi + 4], 0x67452301
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
call fcn.0045f660
push eax
mov ecx, edi
call fcn.00405cf0
push eax
mov ecx, esi
call fcn.0041e8f0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, esi
call fcn.0041e9e0
pop edi
pop esi
pop ebp
ret 8
Function at 0x41f010
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x51484c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x11c], edi
test esi, esi
je 0x41f208
test eax, eax
je 0x41f208
lea ecx, [esi + esi*4 + 0xa]
mov eax, 0x55555556
imul ecx
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea eax, [ecx + ecx]
cdq
idiv esi
push 0x3f0
lea ecx, [ecx + eax + 3]
push ecx
mov ecx, edi
call fcn.004060f0
mov eax, 0x55555556
imul dword [ebp + 0xc]
mov eax, edx
shr eax, 0x1f
add eax, edx
xor esi, esi
xor ecx, ecx
mov dword [ebp - 0x120], eax
test eax, eax
jle 0x41f162
mov dword [ebp - 0x118], eax
mov edi, edi
mov edx, dword [ebp - 0x110]
movzx eax, byte [edx + esi]
movzx edi, byte [edx + esi + 1]
movzx edx, byte [edx + esi + 2]
mov dword [ebp - 0x114], edx
mov edx, eax
sar edx, 2
and edx, 0x3f
movzx edx, byte [edx + ebx]
mov byte [ebp + ecx - 0x10c], dl
mov edx, edi
sar edx, 4
and eax, 3
and edx, 0xf
shl eax, 4
or edx, eax
movzx eax, byte [edx + ebx]
mov byte [ebp + ecx - 0x10b], al
mov eax, dword [ebp - 0x114]
and edi, 0xf
mov edx, eax
sar edx, 6
add edi, edi
and edx, 3
add edi, edi
or edx, edi
movzx edx, byte [edx + ebx]
mov edi, dword [ebp - 0x11c]
and eax, 0x3f
movzx eax, byte [eax + ebx]
mov byte [ebp + ecx - 0x10a], dl
mov byte [ebp + ecx - 0x109], al
add ecx, 4
add esi, 3
cmp ecx, 0x100
jl 0x41f13d
push ecx
lea ecx, [ebp - 0x10c]
push ecx
mov ecx, edi
call fcn.004063d0
xor ecx, ecx
dec dword [ebp - 0x118]
jne 0x41f0a0
test ecx, ecx
je 0x41f15c
push ecx
lea edx, [ebp - 0x10c]
push edx
mov ecx, edi
call fcn.004063d0
mov eax, dword [ebp - 0x120]
lea ecx, [eax + eax*2]
mov eax, dword [ebp + 0xc]
sub eax, ecx
dec eax
je 0x41f1c7
dec eax
jne 0x41f208
mov ecx, dword [ebp - 0x110]
movzx eax, byte [ecx + esi]
movzx esi, byte [ecx + esi + 1]
mov dword [ebp - 0x114], eax
sar eax, 2
and eax, 0x3f
movzx edx, byte [eax + ebx]
push edx
mov ecx, edi
call fcn.00405f00
mov eax, dword [ebp - 0x114]
mov ecx, esi
sar ecx, 4
and eax, 3
and ecx, 0xf
shl eax, 4
or ecx, eax
movzx edx, byte [ecx + ebx]
push edx
mov ecx, edi
call fcn.00405f00
and esi, 0xf
movzx eax, byte [ebx + esi*4]
push eax
jmp 0x41f1f8
mov ecx, dword [ebp - 0x110]
movzx esi, byte [ecx + esi]
mov edx, esi
sar edx, 2
and edx, 0x3f
movzx eax, byte [edx + ebx]
push eax
mov ecx, edi
call fcn.00405f00
and esi, 3
add esi, esi
movzx ecx, byte [ebx + esi*8]
push ecx
mov ecx, edi
call fcn.00405f00
push 0x3d
mov ecx, edi
call fcn.00405f00
push 0x3d
mov ecx, edi
call fcn.00405f00
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00462878
mov esp, ebp
pop ebp
ret
Function at 0x41ff80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov byte [eax], 0
mov ebx, ecx
mov dword [edi], 0
test esi, esi
je 0x420033
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x420033
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
je 0x41fffa
push 0
push edi
push esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41ffe6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
je 0x420024
mov ecx, dword [ebp + 0x18]
test ecx, ecx
je 0x420046
push eax
call fcn.004208c0
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 0x14
cmp dword [edi], 0
jne 0x41fff1
mov edx, dword [ebp + 0x14]
mov byte [edx], 1
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret 0x14
mov eax, dword [ebx + 8]
test eax, eax
je 0x420046
push eax
push esi
push 1
push ecx
call fcn.00466459
add esp, 0x10
mov dword [edi], eax
cmp eax, esi
je 0x42002a
mov eax, dword [ebx + 8]
push eax
call fcn.004661e7
add esp, 4
test eax, eax
jne 0x420046
mov ecx, dword [ebp + 0x14]
mov byte [ecx], 1
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret 0x14
mov ecx, dword [ebp + 0x18]
test ecx, ecx
je 0x420046
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
push str.NULL_buf_or_bufSize
call eax
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 0x14
Function at 0x420050
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47a148
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x51484c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
cmp dword [ecx + 4], 0xffffffff
jne 0x4200b0
cmp dword [ecx + 8], 0
jne 0x4200b0
mov ecx, dword [ebp + 0x18]
test ecx, ecx
je 0x42009a
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
push str.Failed_to_write_because_file_is_not_open.
call edx
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov edi, dword [ebp + 0x14]
mov ebx, dword [ebp + 8]
test edi, edi
je 0x4200c7
mov dword [edi], 0
mov dword [edi + 4], 0
mov edx, dword [ebp + 0xc]
mov eax, edx
or eax, dword [ebp + 0x10]
je 0x4201b7
cmp dword [ebp + 0x10], 0
jl 0x4200ec
jg 0x4200e5
cmp edx, 0x989680
jbe 0x4200ec
mov esi, 0x989680
jmp 0x4200ee
mov esi, edx
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
je 0x42016f
push 0
lea ecx, [ebp + 8]
push ecx
push esi
push ebx
push eax
mov dword [ebp + 8], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x420115
cmp dword [ebp + 8], esi
je 0x42018b
mov edi, dword [ebp + 0x18]
test edi, edi
je 0x420159
lea ecx, [ebp - 0x38]
call fcn.004065d0
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0
call fcn.00407f40
mov esi, dword [edi]
lea ecx, [ebp - 0x38]
call fcn.00405cf0
mov edx, dword [esi + 0x28]
push eax
push str.WriteFileError
mov ecx, edi
call edx
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0xffffffff
call fcn.004067f0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ecx + 8]
test eax, eax
je 0x420191
push eax
push 1
push esi
push ebx
call fcn.004665cd
add esp, 0x10
cmp eax, 1
jne 0x4201cd
mov dword [ebp + 8], esi
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
add ebx, esi
sub edx, esi
mov eax, 0
sbb dword [ebp + 0x10], eax
mov dword [ebp + 0xc], edx
cmp edi, eax
je 0x4201ac
mov esi, dword [ebp + 8]
add dword [edi], esi
adc dword [edi + 4], eax
mov eax, edx
or eax, dword [ebp + 0x10]
jne 0x4200d5
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov ecx, dword [ebp + 0x18]
test ecx, ecx
je 0x4201e0
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
push str.fwrite_failed.
call edx
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x420200
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47b558
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x51484c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
je 0x42029f
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x420289
mov esi, dword [ebp + 8]
test esi, esi
je 0x420289
lea ecx, [ebp - 0x34]
call fcn.004065d0
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 0
call fcn.00407f40
mov edi, dword [esi]
lea ecx, [ebp - 0x34]
call fcn.00405cf0
push eax
mov eax, dword [edi + 0x10]
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x10]
push str.Failed_to_get_file_size__32_
mov ecx, esi
call eax
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], ebx
call fcn.004067f0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ecx + 8]
test ecx, ecx
je 0x4202c9
push ecx
call fcn.004701f0
push eax
call fcn.00466647
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4202e0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47a178
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push esi
push edi
mov eax, dword [0x51484c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
je 0x4203a9
lea ecx, [ebp - 0x10]
push ecx
xor edi, edi
push eax
mov dword [ebp - 0x10], edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
jne 0x420389
mov esi, dword [ebp + 8]
cmp esi, edi
je 0x420371
lea ecx, [ebp - 0x38]
call fcn.004065d0
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], edi
call fcn.00407f40
mov edi, dword [esi]
lea ecx, [ebp - 0x38]
call fcn.00405cf0
mov edx, dword [edi + 0x10]
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
push str.Failed_to_get_file_size__64_
mov ecx, esi
call edx
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0xffffffff
call fcn.004067f0
or eax, 0xffffffff
or edx, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0x10]
push ecx
push eax
call fcn.0041eba0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ecx + 8]
test ecx, ecx
je 0x420371
push ecx
call fcn.004701f0
push eax
call fcn.0046673d
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x430920
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ecx + 0x20]
movzx eax, word [ecx + 0x14]
push ebx
push esi
push edi
movzx edi, word [ecx + 6]
xor esi, esi
lea eax, [eax + ecx + 0x18]
test edi, edi
je 0x43095f
mov ebx, dword [ebp + 8]
mov edi, edi
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x43094a
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x430957
add edx, ecx
cmp ebx, edx
jb 0x430961
inc esi
add eax, 0x28
cmp esi, edi
jb 0x430940
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4