joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42941c
Capabilities:
Download url
Receive data

Disassembly:
push 0x22c
push 0x5c0bb8
call fcn.0052a9ec
mov esi, dword [ebp + 8]
xor ebx, ebx
mov byte [ebp - 0x128], bl
mov edi, 0x103
push edi
push ebx
lea eax, [ebp - 0x127]
push eax
call fcn.005117f0
add esp, 0xc
mov byte [ebp - 0x230], bl
push edi
push ebx
lea eax, [ebp - 0x22f]
push eax
call fcn.005117f0
add esp, 0xc
mov dword [ebp - 0x234], 1
mov dword [ebp - 4], ebx
cmp esi, ebx
jne 0x429485
mov dword [ebp - 4], 0xfffffffe
mov eax, 0x80070057
jmp 0x429590
mov edx, dword [esi]
call fcn.004c3b34
test eax, eax
jne 0x429474
mov eax, dword [esi]
mov dword [ebp - 0x23c], eax
mov edi, dword [esi + 4]
mov dword [ebp - 0x238], edi
push eax
mov esi, 0x104
mov ecx, esi
lea eax, [ebp - 0x128]
call fcn.004c3b66
pop ecx
mov dword [ebp - 0x23c], eax
cmp edi, ebx
je 0x4294d6
push edi
mov ecx, esi
lea eax, [ebp - 0x230]
call fcn.004c3b66
pop ecx
mov edi, eax
mov dword [ebp - 0x238], edi
mov eax, dword [0x5dfefc]
lea ecx, [eax + 0xf]
mov eax, dword [0x5dfef8]
cmp eax, ecx
jle 0x4294f9
mov dword [0x5dfefc], eax
push eax
push str.:8:URLDownloadToFileTimeOut_Helper___has_determined_that_over__d_helper_threads_may_be_stuck_
call fcn.00426c01
pop ecx
pop ecx
inc dword [0x5dfef8]
call fcn.0042ad00
test eax, eax
je 0x42950f
mov eax, edi
call fcn.0042a76b
lea eax, [ebp - 0x128]
push eax
mov esi, dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
call esi
push ebx
push ebx
push edi
lea eax, [ebp - 0x128]
push eax
push ebx
call sub.urlmon.dll_URLDownloadToFileA
mov dword [ebp - 0x234], eax
lea eax, [ebp - 0x128]
push eax
call esi
dec dword [0x5dfef8]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x5dfef4], eax
call fcn.0042ad00
test eax, eax
je 0x429565
push ebx
mov ecx, edi
call fcn.0042b397
pop ecx
cmp eax, 5
jae 0x429583
mov dword [ebp - 0x234], 0x80004005
jmp 0x429583
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x234]
call fcn.0052aa34
ret 4
Function at 0x429b8e
Capabilities:
Move file

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x5c4e68]
xor eax, ebp
mov dword [ebp + 0x190], eax
mov eax, dword [ebp + 0x19c]
push ebx
push esi
push edi
mov esi, 0x103
xor ebx, ebx
push esi
mov dword [ebp - 0x80], eax
lea eax, [ebp + 0x8d]
mov edi, ecx
push ebx
push eax
mov dword [ebp - 0x7c], edi
mov byte [ebp + 0x8c], bl
call fcn.005117f0
push esi
lea eax, [ebp - 0x77]
push ebx
push eax
mov byte [ebp - 0x78], bl
call fcn.005117f0
add esp, 0x18
mov edx, edi
call fcn.004c3b34
test eax, eax
jne 0x429cbc
mov edx, dword [ebp - 0x80]
call fcn.004c3b34
test eax, eax
jne 0x429cbc
push dword [ebp - 0x80]
lea edi, [esi + 1]
mov ecx, edi
lea eax, [ebp + 0x8c]
call fcn.004c3b66
mov edx, eax
call fcn.004c470f
mov esi, edx
call fcn.004c47b0
mov eax, esi
push eax
call fcn.005120b0
pop ecx
pop ecx
jmp 0x429c40
lea ecx, [ebp + eax + 0x8c]
cmp byte [ecx], 0x5c
jne 0x429c45
mov byte [ecx], bl
dec eax
cmp eax, ebx
jg 0x429c32
lea esi, [ebp + 0x8c]
call fcn.004c3e68
push dword [ebp - 0x7c]
mov ecx, edi
lea eax, [ebp - 0x78]
call fcn.004c3b66
mov edx, eax
call fcn.004c470f
mov esi, edx
call fcn.004c47b0
mov eax, esi
push eax
call fcn.005120b0
pop ecx
pop ecx
jmp 0x429c82
lea ecx, [ebp + eax - 0x78]
cmp byte [ecx], 0x5c
jne 0x429c87
mov byte [ecx], bl
dec eax
cmp eax, ebx
jg 0x429c77
lea eax, [ebp - 0x78]
call fcn.004c3eab
mov edx, eax
lea ecx, [ebp + 0x8c]
call fcn.004c40f5
cmp dword [ebp + 0x1a0], ebx
lea eax, [ebp + 0x8c]
je 0x429cb8
push 0xb
push eax
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
jmp 0x429cbe
push 0xa
jmp 0x429cac
xor eax, eax
mov ecx, dword [ebp + 0x190]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051291c
add ebp, 0x194
leave
ret
Function at 0x429cd6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x118
mov eax, dword [0x5c4e68]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
push edi
push 0x103
lea eax, [esp + 0x15]
mov edi, ecx
push 0
push eax
mov dword [esp + 0x14], edi
mov byte [esp + 0x1c], 0
call fcn.005117f0
add esp, 0xc
push edi
mov ecx, 0x104
lea eax, [esp + 0x14]
call fcn.004c3b66
pop ecx
mov esi, eax
call fcn.004c47b0
push 0
push 0x5c
call fcn.004c485b
pop ecx
pop ecx
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x429d9c
test al, 0x10
je 0x429d9c
mov eax, esi
push 1
push eax
call fcn.00429dfa
mov eax, esi
push 1
push eax
call fcn.00429e16
add esp, 0x10
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
mov dword [esp + 0xc], eax
jne 0x429d96
lea edi, [esp + 0x10]
call fcn.0042ad00
test eax, eax
je 0x429d96
push dword [esp + 0xc]
mov eax, edi
push str._GetLastError_
push eax
push dword [esp + 0x14]
push str.:3:DeleteDirectory___s___FAILED:_DeleteFiles___s___1__0__FAILED:__s_ld
call fcn.004265da
add esp, 0x14
push dword [esp + 0xc]
jmp 0x429dc6
xor esi, esi
cmp eax, 0xffffffff
je 0x429dc4
call fcn.0042ad00
test eax, eax
je 0x429dc4
push edi
call fcn.0042adad
test eax, eax
pop ecx
jne 0x429dc4
push edi
push str.:3:DeleteDirectory___s___FAILED:_The_given_file_is_not_a_directory_
call fcn.004265da
pop ecx
pop ecx
push 2
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x11c]
pop edi
mov eax, esi
pop esi
xor ecx, esp
call fcn.0051291c
mov esp, ebp
pop ebp
ret
Function at 0x42a0fd
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
xor ebx, ebx
xor eax, eax
lea edi, [ebp - 0x1c]
mov dword [ebp - 0x20], ebx
stosd dword es:[edi], eax
lea edi, [ebp - 0xc]
mov dword [ebp - 0x10], ebx
stosd dword es:[edi], eax
lea edi, [ebp - 0x14]
mov dword [ebp - 0x18], ebx
stosd dword es:[edi], eax
call fcn.004c3b34
test eax, eax
jne 0x42a232
mov edx, dword [ebp + 0xc]
call fcn.004c3b34
test eax, eax
jne 0x42a232
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push ebx
push 0x20
push 3
push ebx
push 7
push 0x80
push dword [ebp + 8]
mov dword [ebp - 8], ebx
call esi
mov edi, eax
cmp edi, 0xffffffff
je 0x42a1af
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x42a181
mov dword [ebp - 8], 1
jmp 0x42a1aa
cmp dword [0x5d46a8], ebx
je 0x42a1aa
push str._GetLastError_
push dword [ebp + 0x10]
mov dword [0x5d46a8], ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.:6:CopyFileWithDates___s_____s____d__encountered_a_problem:_GetFileTime___FAILED:__s
call fcn.004265da
add esp, 0x14
call fcn.0042dbeb
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0042a5f2
add esp, 0xc
test eax, eax
je 0x42a232
cmp dword [ebp - 8], ebx
jne 0x42a1ce
xor eax, eax
inc eax
jmp 0x42a234
push ebx
push SQLGetDiagRec
push 3
push ebx
push 7
push 0x100
push dword [ebp + 0xc]
call esi
mov edi, eax
cmp edi, 0xffffffff
je 0x42a1c9
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x42a22b
inc dword [0x5e01c4]
cmp dword [0x5e01c4], 0xa
jge 0x42a22b
push str._GetLastError_
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.:6:_1_of_10:_CopyFileWithDates___s_____s____d__encountered_a_problem:_SetFileTime___FAILED:__s
call fcn.004265da
add esp, 0x14
call fcn.0042dbeb
jmp 0x42a1c9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42a5f2
Capabilities:
Copy file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x5c4e68]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov edx, ebx
mov dword [ebp - 0x114], ebx
call fcn.004c3b34
test eax, eax
jne 0x42a75a
mov edx, edi
call fcn.004c3b34
test eax, eax
jne 0x42a75a
push ebx
call fcn.005120b0
mov esi, 0x104
cmp eax, esi
pop ecx
jae 0x42a70f
push edi
call fcn.005120b0
cmp eax, esi
pop ecx
jae 0x42a70f
push dword [ebp + 0x10]
push edi
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CopyFileA]
call ebx
test eax, eax
jne 0x42a70a
push edi
call fcn.0042adad
test eax, eax
pop ecx
je 0x42a6d8
push 0x103
lea eax, [ebp - 0x10f]
push 0
push eax
mov byte [ebp - 0x110], 0
call fcn.005117f0
add esp, 0xc
push dword [ebp - 0x114]
mov ecx, esi
lea eax, [ebp - 0x110]
call fcn.004c3b66
pop ecx
mov esi, eax
call fcn.004c3e68
mov edx, esi
call fcn.004c3b34
test eax, eax
jne 0x42a75a
mov edx, edi
mov ecx, esi
call fcn.004c40f5
push dword [ebp + 0x10]
mov eax, esi
push eax
push dword [ebp - 0x114]
call ebx
jmp 0x42a75c
cmp dword [ebp + 0x10], 0
jne 0x42a75a
call fcn.0042ad00
test eax, eax
je 0x42a75a
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 3
je 0x42a75a
and eax, 0xfffffffc
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push edi
jmp 0x42a6cb
xor eax, eax
inc eax
jmp 0x42a75c
mov eax, ebx
call fcn.004c692f
mov esi, eax
mov eax, edi
call fcn.004c692f
test esi, esi
mov edi, eax
je 0x42a74f
test edi, edi
je 0x42a748
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push esi
mov ebx, eax
call fcn.00511758
pop ecx
push edi
call fcn.00511758
pop ecx
mov eax, ebx
jmp 0x42a75c
push esi
call fcn.00511758
pop ecx
test edi, edi
je 0x42a75a
push edi
call fcn.00511758
pop ecx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051291c
leave
ret

Function at 0x42a76b
Capabilities:
Delete file

Disassembly:
push ecx
push esi
push edi
mov edi, eax
mov edx, edi
call fcn.004c3b34
test eax, eax
je 0x42a77f
xor eax, eax
jmp 0x42a7bb
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
call esi
test eax, eax
jne 0x42a7b8
call fcn.0042ad00
test eax, eax
je 0x42a7b8
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 3
je 0x42a77b
and eax, 0xfffffffc
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call esi
jmp 0x42a7bb
xor eax, eax
inc eax
pop edi
pop esi
pop ecx
ret
Function at 0x42adad
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x42adc4
test al, 0x10
je 0x42adc4
xor eax, eax
inc eax
ret
xor eax, eax
ret

Function at 0x42af53
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x35c
mov eax, dword [0x5c4e68]
xor eax, esp
mov dword [esp + 0x358], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x103
xor ebx, ebx
push esi
lea eax, [esp + 0x25d]
push ebx
push eax
mov byte [esp + 0x264], bl
call fcn.005117f0
push esi
lea eax, [esp + 0x161]
push ebx
push eax
mov byte [esp + 0x168], bl
call fcn.005117f0
push 0x13c
lea eax, [esp + 0x30]
push ebx
push eax
mov dword [esp + 0x34], ebx
call fcn.005117f0
add esp, 0x24
cmp edi, ebx
je 0x42b0a5
cmp byte [edi], bl
je 0x42b0a5
push edi
lea ecx, [esi + 1]
lea eax, [esp + 0x25c]
call fcn.004c3b66
push eax
lea eax, [esp + 0x158]
push eax
call fcn.005123e0
add esp, 0xc
lea esi, [esp + 0x150]
call fcn.004c3e68
mov eax, dword [0x5dfefc]
lea ecx, [eax + 0xf]
mov eax, dword [0x5dfef8]
cmp eax, ecx
jle 0x42b01d
push eax
push str.:8:DoesFileExist_Helper___has_determined_that_over__d_helper_threads_may_be_stuck_
mov dword [0x5dfefc], eax
call fcn.00426c01
pop ecx
pop ecx
inc dword [0x5dfef8]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x25c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
dec dword [0x5dfef8]
mov esi, eax
cmp esi, 0xffffffff
je 0x42b0a5
cmp byte [esp + 0x3c], 0x2e
je 0x42b08e
lea edx, [esp + 0x3c]
call fcn.004c3b34
test eax, eax
jne 0x42b08e
cmp byte [esp + 0x150], 0x2a
jne 0x42b0be
cmp byte [esp + 0x152], 0x2a
jne 0x42b0be
cmp byte [esp + 0x151], 0x3f
je 0x42b0be
movsx eax, byte [esp + 0x151]
push eax
lea eax, [esp + 0x40]
push eax
call fcn.005124f0
test eax, eax
pop ecx
pop ecx
jne 0x42b0be
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x42b043
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
mov ecx, dword [esp + 0x364]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0051291c
mov esp, ebp
pop ebp
ret 4
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
inc eax
jmp 0x42b0a7
Function at 0x42b0ca
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x11c
mov eax, dword [0x5c4e68]
xor eax, esp
mov dword [esp + 0x118], eax
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp edi, ebx
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], ebx
je 0x42b272
cmp byte [edi], 0x30
je 0x42b272
mov esi, 0x104
push esi
lea eax, [esp + 0x1c]
push ebx
push eax
call fcn.005117f0
add esp, 0xc
push edi
mov ecx, esi
lea eax, [esp + 0x1c]
call fcn.004c3b66
pop ecx
push 0x22
mov edi, eax
call fcn.004c4594
cmp dword [ebp + 8], ebx
pop ecx
jbe 0x42b155
push 0xf7b
push str..File.c
mov eax, edi
push eax
push 0x42b2bf
push ebx
mov ecx, str.CreateDirectorySuper
call fcn.0042da43
mov edi, eax
jmp 0x42b157
xor edi, edi
cmp edi, ebx
jne 0x42b1b5
cmp dword [ebp + 8], ebx
jbe 0x42b17e
push str._GetLastError_
push ecx
call fcn.004110c5
pop ecx
push eax
push dword [esp + 0x18]
push str.:8:CreateDirectorySuper___FAILED_to_create_thread_to_create_directory___s_._NumThreads_d:__s
call fcn.004265da
add esp, 0x10
push ebx
push dword [esp + 0x14]
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExA]
cmp eax, ebx
je 0x42b1ad
cmp eax, 0x50
je 0x42b1ad
cmp eax, 0xb7
je 0x42b1ad
cmp eax, 0x4c7
je 0x42b1ad
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x42b272
xor eax, eax
inc eax
jmp 0x42b274
call fcn.004f16be
mov esi, dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], ebx
jmp 0x42b1ea
cmp dword [esp + 0xc], 0x103
jne 0x42b221
call fcn.004f16be
sub eax, dword [esp + 0x14]
cmp eax, dword [ebp + 8]
ja 0x42b1f8
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0xc]
push eax
push edi
call esi
test eax, eax
jne 0x42b1ca
jmp 0x42b221
push dword [esp + 0x10]
call fcn.004f16be
sub eax, dword [esp + 0x18]
push eax
push str.:5:CreateDirectorySuper___timed_out_after__ldms_while_creating___s_
call fcn.00426c01
add esp, 0xc
mov dword [esp + 0xc], ebx
mov dword [0x5dfef4], 0x5b4
call fcn.0042dbeb
push dword [0x5dfef4]
mov esi, dword [sym.imp.KERNEL32.dll_SetLastError]
call esi
cmp dword [esp + 0xc], ebx
jne 0x42b1ad
mov eax, dword [esp + 0x10]
call fcn.0042b289
test eax, eax
jne 0x42b26a
push dword [0x5dfef4]
push str._GetLastError_
push dword [ebp + 8]
push dword [esp + 0x1c]
push str.:3:FYI:_CreateDirectorySuper__s___lu___FAILED:__s_ld
call fcn.00426c01
add esp, 0x14
push dword [0x5dfef4]
call esi
xor eax, eax
mov ecx, dword [esp + 0x124]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0051291c
mov esp, ebp
pop ebp
ret
Function at 0x42b397
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x94
mov eax, dword [0x5c4e68]
xor eax, esp
mov dword [esp + 0x90], eax
push ebx
push esi
push edi
mov edi, ecx
mov edx, edi
mov dword [esp + 0x14], edi
call fcn.004c3b34
test eax, eax
je 0x42b3dc
xor eax, eax
mov ecx, dword [esp + 0x9c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0051291c
mov esp, ebp
pop ebp
ret
call fcn.004f16be
xor ebx, ebx
push ebx
push dword [ebp + 8]
mov esi, 0x80
push esi
push 3
push closesocket
push edi
mov dword [esp + 0x24], eax
call fcn.00428fd2
mov edi, eax
add esp, 0x18
cmp edi, 0xffffffff
jne 0x42b4a2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp + 8], ebx
mov dword [esp + 0x10], eax
je 0x42b42f
call fcn.004f16be
sub eax, dword [esp + 0xc]
cmp eax, dword [ebp + 8]
jb 0x42b42f
push dword [esp + 0x10]
jmp 0x42b497
push ebx
push dword [ebp + 8]
push esi
push 3
push 0x2000000
push dword [esp + 0x28]
call fcn.00428fd2
mov edi, eax
add esp, 0x18
cmp edi, 0xffffffff
jne 0x42b4a2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp + 8], ebx
mov esi, eax
je 0x42b469
call fcn.004f16be
sub eax, dword [esp + 0xc]
cmp eax, dword [ebp + 8]
jae 0x42b496
push dword [ebp + 8]
mov ecx, dword [esp + 0x18]
call fcn.0042adc7
test eax, eax
pop ecx
je 0x42b496
push esi
push str._GetLastError_
push esi
push dword [esp + 0x1c]
push dword [esp + 0x24]
push str.:8:GetFileSizeTimeOut___Seems_to_have_failed_because_of_an_access_rights_problem_:___s_:__u:_u:__s_ld
call fcn.004265da
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x42b3c5
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x42b4d7
push str._GetLastError_
push ebx
push dword [ebp + 8]
push dword [esp + 0x20]
push str.:7:GetFileSizeTimeOut___s____ld___d__FAILED:__s
call fcn.00426c01
add esp, 0x14
call fcn.0042dbeb
jmp 0x42b3c5
cmp eax, ebx
jbe 0x42b529
push ebx
lea eax, [esp + 0x10]
push eax
push esi
lea eax, [esp + 0x24]
push eax
push edi
mov dword [esp + 0x20], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42b4fc
cmp dword [esp + 0xc], ebx
jne 0x42b529
push str._GetLastError_
push dword [esp + 0x10]
push dword [esp + 0x18]
push dword [ebp + 8]
push dword [esp + 0x24]
push str.:7:GetFileSizeTimeOut___s____ld__FAILED:_GetFileSize___returned__ld_but_ReadFile_____ldBytesRead__FAILED:__s
call fcn.004265da
add esp, 0x18
call fcn.0042dbeb
mov eax, ebx
jmp 0x42b3c7
mov ebx, dword [esp + 0x10]
jmp 0x42b51d
Function at 0x42bf02
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov edx, edi
call fcn.004c3b34
test eax, eax
je 0x42bf21
xor eax, eax
jmp 0x42bfcb
push 0
mov ecx, edi
call fcn.0042b397
mov esi, eax
test esi, esi
pop ecx
je 0x42bf1a
push 0x1385
push str..File.c
mov edx, 0x530488
mov ecx, edi
call fcn.0042d2c6
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
mov dword [esp + 0xc], ebx
jne 0x42bf62
push edi
push str.:6:LoadFileToMemory___s___FAILED:_fopen___failed_even_after_GetFileSizeTimeOut___succeeded___
call fcn.004265da
pop ecx
pop ecx
jmp 0x42bf1a
lea eax, [esi + 0xe]
push eax
call fcn.00513703
mov edi, eax
test edi, edi
pop ecx
jne 0x42bf8c
push esi
push dword [ebp + 8]
push str.:5:LoadFileToMemory___s___FAILED:_malloc___failed_to_allocate_over__u_bytes:_OUT_OF_MEMORY.
call fcn.004265da
add esp, 0xc
mov ecx, ebx
call fcn.0042d70e
jmp 0x42bf1a
push ebx
push esi
lea eax, [edi + 4]
push 1
push eax
call fcn.00511c63
mov ebx, eax
add esp, 0x10
cmp ebx, esi
jae 0x42bfb2
push dword [esp + 0xc]
call fcn.0051313a
test eax, eax
pop ecx
jne 0x42bfb2
xor ebx, ebx
mov ecx, dword [esp + 0xc]
call fcn.0042d70e
test ebx, ebx
jne 0x42bfc7
push edi
call fcn.00511758
jmp 0x42bf5f
mov dword [edi], ebx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42c074
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x5c4e68]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x103
lea eax, [ebp - 0x10f]
mov esi, edx
push 0
push eax
mov edi, ecx
mov dword [ebp - 0x114], esi
mov byte [ebp - 0x110], 0
call fcn.005117f0
add esp, 0xc
test esi, esi
je 0x42c155
mov edx, edi
call fcn.004c3b34
test eax, eax
jne 0x42c155
push edi
mov ecx, 0x104
lea eax, [ebp - 0x110]
call fcn.004c3b66
mov esi, eax
call fcn.004c3e68
mov eax, esi
push edi
push eax
call fcn.005122c0
add esp, 0xc
test eax, eax
jne 0x42c111
push edi
push eax
push eax
call fcn.0048a119
pop ecx
pop ecx
push eax
push 0x533dd4
mov eax, esi
push 0x104
push eax
call fcn.004c53b7
add esp, 0x14
mov edi, esi
push 0x14c4
push str..File.c
mov edx, 0x530488
mov ecx, edi
call fcn.0042d2c6
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x42c155
push edi
push 1
push 0x64
push dword [ebp - 0x114]
call fcn.00511c63
mov esi, eax
add esp, 0x10
neg esi
sbb esi, esi
mov ecx, edi
neg esi
call fcn.0042d70e
mov eax, esi
jmp 0x42c157
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0051291c
leave
ret
Function at 0x42c165
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x5c4e68]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
push 0x103
mov dword [ebp - 0x114], eax
lea eax, [ebp - 0x10f]
push 0
push eax
mov edi, ecx
mov byte [ebp - 0x110], 0
call fcn.005117f0
add esp, 0xc
mov edx, edi
call fcn.004c3b34
test eax, eax
je 0x42c1b4
xor eax, eax
jmp 0x42c254
push edi
mov ecx, 0x104
lea eax, [ebp - 0x110]
call fcn.004c3b66
pop ecx
mov esi, eax
call fcn.004c3e68
mov eax, esi
push edi
push eax
call fcn.005122c0
test eax, eax
pop ecx
pop ecx
jne 0x42c1fe
push edi
push eax
push eax
call fcn.0048a119
pop ecx
pop ecx
push eax
push 0x533dd4
mov eax, esi
push 0x104
push eax
call fcn.004c53b7
add esp, 0x14
mov edi, esi
cmp dword [ebp - 0x114], 0
je 0x42c249
push 0x14e4
push str..File.c
mov edx, 0x530484
mov ecx, edi
call fcn.0042d2c6
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x42c1ad
push edi
push 1
push 0x64
push dword [ebp - 0x114]
call fcn.005110f1
mov esi, eax
add esp, 0x10
neg esi
sbb esi, esi
mov ecx, edi
neg esi
call fcn.0042d70e
jmp 0x42c252
mov eax, edi
call fcn.0042a76b
mov esi, eax
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0051291c
leave
ret

Function at 0x42c27f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x5c4e68]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x10f]
mov esi, ecx
push ebx
push eax
mov dword [ebp - 0x114], esi
mov edi, edx
mov dword [ebp - 0x118], ebx
mov byte [ebp - 0x110], bl
call fcn.005117f0
add esp, 0xc
cmp edi, ebx
jne 0x42c2cc
lea edi, [ebp - 0x118]
mov edx, esi
call fcn.004c3b34
test eax, eax
je 0x42c2e0
mov dword [edi], ebx
xor eax, eax
jmp 0x42c37b
push esi
mov ecx, 0x104
lea eax, [ebp - 0x110]
call fcn.004c3b66
mov esi, eax
call fcn.004c3e68
push dword [ebp - 0x114]
mov eax, esi
push eax
call fcn.005122c0
add esp, 0xc
test eax, eax
jne 0x42c33a
push dword [ebp - 0x114]
push ebx
push ebx
call fcn.0048a119
pop ecx
pop ecx
push eax
push 0x533dd4
mov eax, esi
push 0x104
push eax
call fcn.004c53b7
mov eax, esi
add esp, 0x14
mov dword [ebp - 0x114], eax
mov ecx, dword [ebp - 0x114]
push 0x151c
push str..File.c
mov edx, 0x530488
call fcn.0042d2c6
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
mov dword [edi], ebx
je 0x42c2d9
push esi
push 1
push 4
push edi
call fcn.00511c63
add esp, 0x10
mov ecx, esi
mov edi, eax
call fcn.0042d70e
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051291c
leave
ret
Function at 0x42c38a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x5c4e68]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x103
lea eax, [ebp - 0x10f]
push 0
push eax
mov edi, ecx
mov byte [ebp - 0x110], 0
call fcn.005117f0
add esp, 0xc
mov edx, edi
call fcn.004c3b34
test eax, eax
je 0x42c3d0
xor eax, eax
jmp 0x42c454
push edi
mov ecx, 0x104
lea eax, [ebp - 0x110]
call fcn.004c3b66
mov esi, eax
call fcn.004c3e68
mov eax, esi
push edi
push eax
call fcn.005122c0
add esp, 0xc
test eax, eax
jne 0x42c41a
push edi
push eax
push eax
call fcn.0048a119
pop ecx
pop ecx
push eax
push 0x533dd4
mov eax, esi
push 0x104
push eax
call fcn.004c53b7
add esp, 0x14
mov edi, esi
push 0x1542
push str..File.c
mov edx, 0x530484
mov ecx, edi
call fcn.0042d2c6
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x42c3c9
push esi
push 1
lea eax, [ebp + 8]
push 4
push eax
call fcn.005110f1
add esp, 0x10
mov ecx, esi
mov edi, eax
call fcn.0042d70e
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0051291c
leave
ret