joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52cf44
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x118], edx
mov dword [ebp - 0x11c], edx
mov dword [ebp - 0x120], edx
mov dword [ebp - 0x114], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x52d104
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [ebx + 0x105]
mov byte [ebx + 0x106], al
mov byte [ebx + 0x105], 0
call sub.user32.dll_GetForegroundWindow
mov esi, eax
test esi, esi
je 0x52d043
lea eax, [ebp - 0x10]
push eax
push esi
call sub.user32.dll_GetWindowRect
test eax, eax
je 0x52d030
mov eax, dword [0x536584]
mov eax, dword [eax]
call fcn.00472ae0
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x10]
cmp eax, edx
jne 0x52cfda
mov eax, dword [0x536584]
mov eax, dword [eax]
call fcn.00472ad4
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0xc]
cmp eax, edx
je 0x52cfde
xor eax, eax
jmp 0x52cfe0
mov al, 1
mov byte [ebx + 0x105], al
cmp byte [ebx + 0x105], 0
je 0x52d030
push pe_nt_image_headers32
lea eax, [ebp - 0x110]
push eax
push esi
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 0x114]
lea edx, [ebp - 0x110]
mov ecx, pe_nt_image_headers32
call fcn.00404d6c
mov eax, dword [ebp - 0x114]
mov edx, 0x52d11c
call fcn.00404f08
jne 0x52d030
mov byte [ebx + 0x105], 0
mov edi, dword [ebx + 0x108]
lea eax, [ebx + 0x108]
push eax
push esi
call sub.user32.dll_GetWindowThreadProcessId
cmp edi, dword [ebx + 0x108]
setne al
mov byte [ebx + 0x107], al
mov al, byte [ebx + 0x105]
cmp al, byte [ebx + 0x106]
je 0x52d0df
push 0x52d134
mov eax, dword [ebx + 0x108]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x11c]
call fcn.0040b1dc
push dword [ebp - 0x11c]
push 0x52d150
lea eax, [ebp - 0x120]
lea edx, [ebp - 0x110]
mov ecx, pe_nt_image_headers32
call fcn.00404d6c
push dword [ebp - 0x120]
push 0x52d15c
lea eax, [ebp - 0x118]
mov edx, 5
call fcn.00404e7c
mov eax, dword [ebp - 0x118]
call fcn.005238ec
mov byte [ebx + 0x106], 1
cmp byte [ebx + 0x105], 0
je 0x52d0e6
mov eax, dword [ebx + 0x108]
mov dword [ebx + 0x10c], eax
jmp 0x52d0e6
mov byte [ebx + 0x106], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52d10b
lea eax, [ebp - 0x120]
mov edx, 4
call fcn.00404b20
ret
Function at 0x52d160
Capabilities:
Get memory capacity

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
lea eax, [ebx + 8]
push eax
call sub.kernel32.dll_GlobalMemoryStatusEx
lea esi, [ebx + 8]
mov eax, dword [esi + 8]
mov dword [ebx + 0x88], eax
mov eax, dword [esi + 0xc]
mov dword [ebx + 0x8c], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x90], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x94], eax
mov eax, dword [esi + 8]
mov edx, dword [esi + 0xc]
sub eax, dword [esi + 0x10]
sbb edx, dword [esi + 0x14]
mov dword [ebx + 0x98], eax
mov dword [ebx + 0x9c], edx
push 0
push 0x400
push 0
push 0x400
mov eax, dword [ebx + 0x98]
mov edx, dword [ebx + 0x9c]
call fcn.00405c18
call fcn.00405c18
cmp edx, dword [ebx + 0xa4]
jne 0x52d1e5
cmp eax, dword [ebx + 0xa0]
jbe 0x52d217
jmp 0x52d1e7
jle 0x52d217
push 0
push 0x400
push 0
push 0x400
mov eax, dword [ebx + 0x98]
mov edx, dword [ebx + 0x9c]
call fcn.00405c18
call fcn.00405c18
mov dword [ebx + 0xa0], eax
mov dword [ebx + 0xa4], edx
cmp dword [ebx + 0x8c], 0
jne 0x52d22b
cmp dword [ebx + 0x88], 0
jbe 0x52d26a
jmp 0x52d22d
jle 0x52d26a
mov eax, dword [ebx + 0x88]
mov edx, dword [ebx + 0x8c]
sub eax, dword [ebx + 0x90]
sbb edx, dword [ebx + 0x94]
mov dword [esp], eax
mov dword [esp + 4], edx
fild qword [esp]
fild qword [ebx + 0x88]
fdivp st(1)
fmul dword [0x52d2c0]
call fcn.004033b8
mov byte [ebx + 0xa8], al
jmp 0x52d271
mov byte [ebx + 0xa8], 0
mov eax, dword [esi + 0x18]
mov dword [ebx + 0xb0], eax
mov eax, dword [esi + 0x1c]
mov dword [ebx + 0xb4], eax
mov eax, dword [esi + 0x20]
mov dword [ebx + 0xb8], eax
mov eax, dword [esi + 0x24]
mov dword [ebx + 0xbc], eax
mov eax, dword [ebx + 0xb0]
mov edx, dword [ebx + 0xb4]
sub eax, dword [ebx + 0xb8]
sbb edx, dword [ebx + 0xbc]
mov dword [ebx + 0xc0], eax
mov dword [ebx + 0xc4], edx
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x52d2ec
Capabilities:
Get system information on windows

Disassembly:
push ebx
push ecx
mov ebx, eax
push esp
mov eax, dword [ebx + 0x78]
push eax
mov eax, dword [ebx + 0x48]
push eax
push 0x12
call sub.ntdll.dll_NtQuerySystemInformation
cmp eax, 0xc0000004
jne 0x52d330
add dword [ebx + 0x78], 0x2000
lea eax, [ebx + 0x48]
mov edx, dword [ebx + 0x78]
call fcn.00402e8c
push esp
mov eax, dword [ebx + 0x78]
push eax
mov eax, dword [ebx + 0x48]
push eax
push 0x12
call sub.ntdll.dll_NtQuerySystemInformation
cmp eax, 0xc0000004
je 0x52d307
test eax, eax
jne 0x52d37f
mov eax, dword [ebx + 0x48]
mov dword [ebx + 0x4c], eax
xor eax, eax
mov dword [ebx + 0xfc], eax
xor eax, eax
mov dword [ebx + 0x100], eax
mov eax, dword [ebx + 0x4c]
mov eax, dword [eax + 8]
shl eax, 2
shl eax, 0xa
add dword [ebx + 0xfc], eax
mov eax, dword [ebx + 0x4c]
mov eax, dword [eax + 4]
shl eax, 2
shl eax, 0xa
add dword [ebx + 0x100], eax
mov eax, dword [ebx + 0x4c]
mov eax, dword [eax]
test eax, eax
je 0x52d37f
add eax, dword [ebx + 0x4c]
mov dword [ebx + 0x4c], eax
jmp 0x52d34a
pop edx
pop ebx
ret
Function at 0x52d49c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
test dl, dl
je 0x52d4b0
add esp, 0xfffffff0
call fcn.0040406c
mov ebx, edx
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.00403cb0
mov dword [esi + 8], 0x40
xor eax, eax
mov dword [esi + 0xe8], eax
mov dword [esi + 0xf4], 1
xor eax, eax
mov dword [esi + 0xec], eax
xor eax, eax
mov dword [esi + 0xf0], eax
xor eax, eax
mov dword [esi + 0xf8], eax
xor eax, eax
mov dword [esi + 0xfc], eax
xor eax, eax
mov dword [esi + 0x100], eax
mov dword [esi + 0x128], 0xffffffff
mov dword [esi + 0x150], 0x3e8
xor eax, eax
mov dword [esi + 0x80], eax
mov byte [esi + 0x105], 0
mov byte [esi + 0x118], 0
xor eax, eax
mov dword [esi + 0x84], eax
mov dword [esi + 0x78], 0x800
mov dword [esi + 0x7c], 0x19000
mov eax, dword [esi + 0x78]
call fcn.0040ab80
mov dword [esi + 0x48], eax
lea eax, [esi + 0x50]
mov edx, 0x28
call fcn.00408124
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GetSystemInfo
mov al, byte [ebp - 0x10]
mov byte [esi + 0x124], al
cmp al, 1
jae 0x52d573
mov byte [esi + 0x124], 1
mov eax, esi
test bl, bl
je 0x52d588
call fcn.004040c4
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001296
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x2c8
push 0x1001c50
call fcn.01001770
mov eax, dword [ebp + 0xc]
xor esi, esi
mov dword [ebp - 0x2c4], esi
or dword [ebp - 0x2c0], 0xffffffff
cmp dword [ebp + 8], 2
jne 0x100140e
mov eax, dword [eax + 4]
mov dword [ebp - 0x2c4], eax
cmp eax, esi
je 0x100140e
push esi
push esi
push esi
push 6
push esi
push 0x1001164
push esi
call dword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsExW]
mov dword [ebp - 0x2c0], eax
cmp eax, 0xffffffff
je 0x1001408
mov dword [ebp - 0x2cc], esi
push 6
pop ecx
xor eax, eax
lea edi, [ebp - 0x2b8]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2bc]
push eax
push esi
mov ebx, dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
jmp 0x10013d2
push 0x20019
push 1
push esi
push 1
lea eax, [ebp - 0x2bc]
push eax
push dword [ebp - 0x2c0]
call dword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
mov edi, eax
cmp edi, 0xffffffff
je 0x10013b2
xor eax, eax
mov word [ebp - 0x98], ax
push 0x7a
push esi
lea eax, [ebp - 0x96]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x2d0], 0x7c
lea eax, [ebp - 0x2d0]
push eax
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0x2d8]
push eax
push esi
push 0x100113c
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x2d4], eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x2d4], esi
jne 0x10013b2
lea eax, [ebp - 0x98]
push eax
push dword [ebp - 0x2c4]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x10013ee
inc dword [ebp - 0x2cc]
push 6
pop ecx
xor eax, eax
lea edi, [ebp - 0x2b8]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2bc]
push eax
push dword [ebp - 0x2cc]
push dword [ebp - 0x2c0]
mov dword [ebp - 0x2bc], 0x1c
call ebx
cmp eax, esi
jne 0x1001319
jmp 0x1001408
push esi
push esi
lea eax, [ebp - 0x2bc]
push eax
push dword [ebp - 0x2c0]
push 0xffffffffffffffff
call sub.newdev.dll_DiUninstallDevice
cmp eax, esi
jne 0x100140e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x2c0], 0xffffffff
je 0x1001423
push dword [ebp - 0x2c0]
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
cmp dword [ebp - 0x2c4], esi
je 0x10014a9
xor eax, eax
mov word [ebp - 0x2a0], ax
push 0x206
push esi
lea eax, [ebp - 0x29e]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x2c8], esi
mov dword [ebp - 4], esi
push dword [ebp - 0x2c4]
push 0x10010fc
push 0x208
lea eax, [ebp - 0x2a0]
push eax
call fcn.01001236
add esp, 0x10
cmp eax, esi
jl 0x100149d
lea eax, [ebp - 0x2a0]
push eax
push esi
push 2
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [ebp - 0x2c8], eax
cmp eax, esi
jne 0x1001496
call fcn.01001224
jmp 0x100149d
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [ebp - 4], 0xfffffffe
call fcn.010014b3
xor eax, eax
call fcn.010017b8
ret
Function at 0x1001761
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x1001c70
call fcn.01001984
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x1003378
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1001576
cmp eax, esi
jne 0x1001569
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x1001579
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1001550
xor esi, esi
inc esi
mov eax, dword [0x1003374]
cmp eax, esi
jne 0x100158c
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x10015c7
mov eax, dword [0x1003374]
test eax, eax
jne 0x10015c1
mov dword [0x1003374], esi
push 0x10010d0
push 0x10010c4
call fcn.010014cd
pop ecx
pop ecx
test eax, eax
je 0x10015c7
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x1001691
mov dword [0x1003038], esi
mov eax, dword [0x1003374]
cmp eax, esi
jne 0x10015eb
push 0x10010c0
push 0x10010b8
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1003374], 2
cmp dword [ebp - 0x1c], ebx
jne 0x10015f8
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x100337c], ebx
je 0x1001619
push 0x100337c
call fcn.010018f9
pop ecx
test eax, eax
je 0x1001619
push ebx
push 2
push ebx
call dword [0x100337c]
push dword [0x1003020]
push dword [0x1003024]
push dword [0x100301c]
call fcn.01001296
add esp, 0xc
mov dword [0x1003034], eax
cmp dword [0x1003028], ebx
jne 0x1001677
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x1003038], ebx
jne 0x1001685
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1003034]
call fcn.010019c9
ret
call fcn.01001aa7
jmp 0x100152e
Function at 0x10036ca
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x1003bd0
call fcn.01003884
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x1005390
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x10034df
cmp eax, esi
jne 0x10034d2
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x10034e2
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10034b9
xor esi, esi
inc esi
mov eax, dword [0x100538c]
cmp eax, esi
jne 0x10034f5
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1003530
mov eax, dword [0x100538c]
test eax, eax
jne 0x100352a
mov dword [0x100538c], esi
push 0x10011e0
push 0x10011d4
call fcn.01003436
pop ecx
pop ecx
test eax, eax
je 0x1003530
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x10035fa
mov dword [0x1005050], esi
mov eax, dword [0x100538c]
cmp eax, esi
jne 0x1003554
push 0x10011d0
push 0x10011c8
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x100538c], 2
cmp dword [ebp - 0x1c], ebx
jne 0x1003561
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1005394], ebx
je 0x1003582
push 0x1005394
call fcn.010037f9
pop ecx
test eax, eax
je 0x1003582
push ebx
push 2
push ebx
call dword [0x1005394]
push dword [0x1005038]
push dword [0x100503c]
push dword [0x1005034]
call fcn.0100339f
add esp, 0xc
mov dword [0x100504c], eax
cmp dword [0x1005040], ebx
jne 0x10035e0
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x1005050], ebx
jne 0x10035ee
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x100504c]
call fcn.010038c9
ret
call fcn.010039d1
jmp 0x1003497

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x409300
Capabilities:
Move file

Disassembly:
mov eax, 0x4313ba
call fcn.0041d8c4
mov eax, 0x5024
call fcn.0041d9c0
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x4030]
push edi
mov ebx, 0x800
push ebx
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_GetLongPathNameW]
test eax, eax
je 0x4094bf
cmp eax, ebx
jae 0x4094bf
push ebx
lea eax, [ebp - 0x5030]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_GetShortPathNameW]
test eax, eax
je 0x4094bf
cmp eax, ebx
jae 0x4094bf
lea eax, [ebp - 0x4030]
push eax
call fcn.0040b9e0
mov dword [ebp + 8], eax
lea eax, [ebp - 0x5030]
push eax
call fcn.0040b9e0
mov edi, eax
xor ebx, ebx
cmp word [edi], bx
je 0x4094bf
push edi
push dword [ebp + 8]
call fcn.00411438
test eax, eax
je 0x4094bf
push edi
push esi
call fcn.0040b9e0
push eax
call fcn.00411438
test eax, eax
jne 0x4094bf
mov word [ebp - 0x100c], ax
mov edi, ebx
test ax, ax
jne 0x409421
push 0x800
push esi
lea eax, [ebp - 0x100c]
push eax
call fcn.0040fae7
push edi
push str.rtmp_d
push 0x800
lea eax, [ebp - 0x100c]
push eax
call fcn.0040b9e0
push eax
call fcn.00403f53
add esp, 0x10
lea eax, [ebp - 0x100c]
push eax
call fcn.00409f0f
test al, al
je 0x409406
xor eax, eax
mov word [ebp - 0x100c], ax
jmp 0x40940d
mov ax, word [ebp - 0x100c]
add edi, 0x7b
cmp edi, 0x2710
jl 0x4093b4
test ax, ax
je 0x4094bf
mov edi, 0x800
lea eax, [ebp - 0x3030]
push edi
push esi
push eax
call fcn.0040fae7
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x3030]
push eax
call fcn.0040ba56
mov edi, dword [sym.imp.KERNEL32.DLL_MoveFileW]
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0x3030]
push eax
call edi
test eax, eax
je 0x4094bf
lea ecx, [ebp - 0x2030]
call fcn.004094d4
push esi
mov dword [ebp - 4], ebx
call fcn.00409f0f
test al, al
jne 0x409486
push 0x12
push esi
lea ecx, [ebp - 0x2030]
call fcn.004095c0
mov bl, al
lea eax, [ebp - 0x3030]
push eax
lea eax, [ebp - 0x100c]
push eax
call edi
test bl, bl
je 0x4094b0
lea ecx, [ebp - 0x2030]
call fcn.00409572
lea ecx, [ebp - 0x2030]
call fcn.004096b9
lea ecx, [ebp - 0x2030]
call fcn.00409506
mov al, 1
jmp 0x4094c1
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4096e2
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0xc], 1
jne 0x4096fb
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
mov dword [esi + 4], eax
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x40976e
mov ecx, esi
call fcn.004097e9
test al, al
je 0x409736
mov eax, 0x4e20
cmp dword [ebp + 0xc], eax
jbe 0x409736
push eax
push dword [ebp + 8]
mov ecx, esi
call fcn.004096e2
jmp 0x409771
cmp dword [esi + 0xc], 1
jne 0x40974b
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x6d
jne 0x40974b
xor eax, eax
jmp 0x409771
cmp dword [esi + 0xc], 0
jne 0x409769
mov ebx, 0x8000
cmp dword [ebp + 0xc], ebx
jbe 0x409769
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x21
jne 0x409769
push ebx
jmp 0x40972a
or eax, 0xffffffff
jmp 0x409771
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x40980c
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x1054
call fcn.0041d9c0
push ebx
mov ebx, dword [esp + 0x1060]
push ebp
push edi
mov edi, ecx
and dword [edi + 0x1020], 0
cmp byte [edi + 0x1d], 0
jne 0x409838
test bl, 4
jne 0x409838
xor cl, cl
jmp 0x40983a
mov cl, 1
mov eax, ebx
shr eax, 1
push esi
and al, 1
movzx esi, al
neg esi
sbb esi, esi
and esi, 0xc0000000
add esi, 0x80000000
test bl, 1
je 0x40985f
or esi, 0x40000000
shr ebx, 3
not ebx
and ebx, 1
test cl, cl
je 0x40986e
or ebx, 2
xor eax, eax
lea ecx, [esp + 0x1c]
cmp byte [edi + 0x15], al
setne al
dec eax
and eax, 0x8000000
mov dword [esp + 0x10], eax
call fcn.00406fec
cmp byte [edi + 0x1c], 0
je 0x409895
or esi, 0x100
push 0
push dword [esp + 0x14]
push 3
push 0
push ebx
push esi
push dword [esp + 0x1080]
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x409917
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x1c]
push 0x800
push eax
push dword [esp + 0x1070]
call fcn.0040b3c9
test al, al
je 0x409906
push 0
push dword [esp + 0x14]
lea eax, [esp + 0x24]
push 3
push 0
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov ebp, eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 2
jne 0x409901
mov dword [esp + 0x14], eax
cmp ebp, 0xffffffff
jne 0x409917
cmp dword [esp + 0x14], 2
jne 0x409917
mov dword [edi + 0x1020], 1
cmp byte [edi + 0x1c], 0
pop esi
je 0x40993d
cmp ebp, 0xffffffff
je 0x40993d
or dword [esp + 0x10], 0xffffffff
lea eax, [esp + 0x10]
or dword [esp + 0x14], 0xffffffff
push 0
push eax
push 0
push ebp
call dword [sym.imp.KERNEL32.DLL_SetFileTime]
xor eax, eax
cmp ebp, 0xffffffff
mov byte [edi + 0x12], al
setne bl
mov dword [edi + 0xc], eax
mov byte [edi + 0x10], al
cmp ebp, 0xffffffff
je 0x40996b
push 0x800
push dword [esp + 0x1068]
lea ecx, [edi + 0x1e]
mov dword [edi + 4], ebp
push ecx
call fcn.0040fae7
pop edi
pop ebp
mov al, bl
pop ebx
add esp, 0x1054
ret 8
Function at 0x409cd8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
push edi
mov edi, ecx
test ebp, ebp
jne 0x409ceb
mov al, 1
jmp 0x409dd9
cmp dword [edi + 0xc], 1
jne 0x409cfc
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
mov dword [edi + 4], eax
push ebx
push esi
and dword [esp + 0x18], 0
xor bl, bl
cmp dword [edi + 0xc], 0
je 0x409d51
xor esi, esi
test ebp, ebp
je 0x409d73
mov eax, ebp
sub eax, esi
cmp eax, 0x4000
jb 0x409d21
mov eax, 0x4000
push 0
lea ecx, [esp + 0x1c]
push ecx
push eax
mov eax, dword [esp + 0x20]
add eax, esi
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
lea ebx, [eax - 1]
neg ebx
sbb bl, bl
add bl, 1
je 0x409d73
add esi, 0x4000
cmp esi, ebp
jb 0x409d11
jmp 0x409d6f
push 0
lea eax, [esp + 0x1c]
push eax
push ebp
push dword [esp + 0x20]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
dec eax
neg eax
sbb al, al
inc al
mov bl, al
test bl, bl
jne 0x409dd1
cmp byte [edi + 0x14], 0
je 0x409dd1
cmp dword [edi + 0xc], 0
jne 0x409dd1
push 0
lea esi, [edi + 0x1e]
mov ecx, 0x4400e0
push esi
call fcn.00406d6f
test al, al
je 0x409dc4
cmp dword [esp + 0x18], ebp
jae 0x409cfe
cmp dword [esp + 0x18], 0
jbe 0x409cfe
mov esi, dword [edi]
mov ecx, edi
push 0
call dword [esi + 0x14]
sub eax, dword [esp + 0x1c]
mov ecx, edi
sbb edx, 0
push edx
push eax
call dword [esi + 0x10]
jmp 0x409cfe
push esi
push 0
mov ecx, 0x4400e0
call fcn.00406fb0
pop esi
mov al, bl
mov byte [edi + 8], 1
pop ebx
pop edi
pop ebp
ret 8

Function at 0x409f23
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.0041d9c0
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x409f68
push 0x800
lea eax, [ebp - 0x1000]
push eax
push dword [ebp + 8]
call fcn.0040b3c9
test al, al
je 0x409f68
lea eax, [ebp - 0x1000]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
mov esi, eax
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x409f96
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.0041d9c0
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.0040b9c4
movzx eax, word [eax]
cmp eax, 0x2e
je 0x409fc7
cmp eax, 0x20
je 0x409fc7
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
jne 0x409ffa
push esi
call fcn.00409f0f
test al, al
jne 0x40a00d
push 0x800
lea eax, [ebp - 0x1000]
push eax
push esi
call fcn.0040b3c9
test al, al
je 0x40a00d
push 0
lea eax, [ebp - 0x1000]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
je 0x40a00d
cmp byte [ebp + 0xc], 0
je 0x40a009
push dword [ebp + 0x10]
push esi
call fcn.0040a1d3
xor eax, eax
jmp 0x40a025
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 2
je 0x40a022
cmp eax, 3
je 0x40a022
xor eax, eax
inc eax
jmp 0x40a025
push 2
pop eax
pop esi
mov esp, ebp
pop ebp
ret 0xc