joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408890
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x5ddaa8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6ade1c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [esp + 0x18]
xor ebx, ebx
push eax
xor esi, esi
mov dword [esp + 0x18], ebx
call fcn.0040ad10
lea ecx, [esp + 0x18]
mov dword [esp + 0x38], esi
call fcn.0040aed0
mov ecx, dword [edi + 0x5f8]
sub ecx, dword [edi + 0x5f4]
sar ecx, 2
test ecx, ecx
jbe 0x40893f
mov ebp, 0x100000
mov edx, dword [edi + 0x5f8]
sub edx, dword [edi + 0x5f4]
sar edx, 2
cmp esi, edx
jb 0x408908
call fcn.0058f903
mov eax, dword [edi + 0x5f4]
mov eax, dword [eax + esi*4]
test dword [eax + 0x116], ebp
jne 0x408925
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.0040afe0
inc ebx
mov edx, dword [edi + 0x5f8]
sub edx, dword [edi + 0x5f4]
inc esi
sar edx, 2
cmp esi, edx
jb 0x4088f0
mov dword [esp + 0x14], ebx
xor esi, esi
mov ecx, dword [esp + 0x28]
sub ecx, dword [esp + 0x24]
mov eax, 0xdd67c8a7
imul ecx
add edx, ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x4089b8
xor ebp, ebp
lea ebx, [edi + 0x5e4]
cmp esi, eax
jb 0x40896d
call fcn.0058f903
mov eax, dword [esp + 0x24]
lea edi, [eax + ebp]
push edi
mov ecx, ebx
call fcn.00578180
test byte [edi + 0x116], 1
je 0x40898c
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [esp + 0x28]
sub ecx, dword [esp + 0x24]
mov eax, 0xdd67c8a7
imul ecx
add edx, ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
inc esi
add eax, edx
add ebp, 0x128
cmp esi, eax
jb 0x40896d
mov ebx, dword [esp + 0x14]
xor esi, esi
push ebx
push str.removed__d_files_n
call fcn.00568410
mov eax, dword [esp + 0x2c]
add esp, 8
cmp eax, esi
je 0x4089d7
push eax
call fcn.0056a360
add esp, 4
mov ecx, dword [esp + 0x18]
push ecx
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
call fcn.0056a360
add esp, 4
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret

Function at 0x408a10
Capabilities:
Get common file path

Disassembly:
sub esp, 0x61c
mov eax, dword [0x6ade1c]
xor eax, esp
mov dword [esp + 0x614], eax
lea eax, [esp + 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push str.Game.exe
lea ecx, [esp + 0x10c]
push ecx
lea edx, [esp + 8]
push 0x6815d0
push edx
call fcn.00401db0
push str.GHO_Launcher
lea eax, [esp + 0x224]
push str.Allow_network_traffic_for__s
push eax
call fcn.00401dd0
lea ecx, [esp + 0x22c]
add esp, 0x1c
push ecx
lea ecx, [esp + 4]
call fcn.00401a20
mov ecx, dword [esp + 0x618]
add esp, 4
xor ecx, esp
call fcn.0058e447
add esp, 0x61c
ret
Function at 0x408ef0
Capabilities:
Delete file

Disassembly:
sub esp, 0x40c
mov eax, dword [0x6ade1c]
xor eax, esp
mov dword [esp + 0x408], eax
push ebx
push ebp
push esi
push str.Making_sure_extracted_files_exists_n
call fcn.00568410
add esp, 4
push 1
lea ebx, [edi + 0x4e0]
push 1
mov ecx, ebx
call fcn.005762f0
mov eax, dword [edi + 0x5f8]
sub eax, dword [edi + 0x5f4]
xor ebp, ebp
sar eax, 2
test eax, eax
jbe 0x408fde
mov edi, edi
mov ecx, dword [edi + 0x5f8]
sub ecx, dword [edi + 0x5f4]
sar ecx, 2
cmp ebp, ecx
jb 0x408f58
call fcn.0058f903
mov edx, dword [edi + 0x5f4]
mov esi, dword [edx + ebp*4]
test byte [esi + 0x116], 1
je 0x408fc6
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
push esi
call fcn.00569130
add esp, 0xc
test al, al
je 0x408f99
mov edx, dword [esp + 0x10]
cmp edx, dword [esi + 0x10a]
jne 0x408f99
mov eax, dword [esp + 0xc]
cmp eax, dword [esi + 0x106]
je 0x408fc6
push esi
push str.restoring__s_n
call fcn.00568410
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call dword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
push 0x681750
push esi
mov ecx, ebx
call fcn.00577160
test al, al
je 0x40900a
mov ecx, dword [edi + 0x5f8]
sub ecx, dword [edi + 0x5f4]
inc ebp
sar ecx, 2
cmp ebp, ecx
jb 0x408f40
mov ecx, ebx
call fcn.00576450
push str.Making_sure_extracted_files_exists___finished_n
call fcn.00568410
mov ecx, dword [esp + 0x418]
add esp, 4
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0058e447
add esp, 0x40c
ret
push esi
lea edx, [esp + 0x18]
push str.Cant_extract_file__s_nPlease_delete_this_file_manually
push edx
call fcn.00401dd0
add esp, 0xc
lea eax, [esp + 0x14]
push eax
mov eax, edi
call fcn.00407ac0
int3
Function at 0x569130
Capabilities:
Read file on windows

Disassembly:
cmp dword [esp + 8], 0
jne 0x569150
push 0
push 0x168
push str..SourceFileSystem_r3dFSCompress.cpp
push str.out_crc32
call fcn.00568720
add esp, 0x10
push ebp
mov ebp, dword [esp + 8]
push esi
push 0x6809ac
push ebp
call fcn.0058f010
mov esi, eax
add esp, 8
test esi, esi
jne 0x56916f
pop esi
xor al, al
pop ebp
ret
push ebx
push edi
push 2
push 0
push esi
call fcn.005940b7
push esi
call fcn.005942f1
push 0
push 0
push esi
mov edi, eax
call fcn.005940b7
lea eax, [edi + 1]
push 1
push eax
call fcn.0056a320
push esi
push edi
mov ebx, eax
push 1
push ebx
call fcn.0058f789
add esp, 0x34
cmp eax, edi
je 0x5691cd
push esi
call fcn.0058e8d0
push ebx
call fcn.0056a360
push edi
push ebp
push str.failed_to_read__s__d_n
call fcn.005685e0
add esp, 0x14
pop edi
pop ebx
pop esi
xor al, al
pop ebp
ret
push edi
push ebx
call fcn.00568e10
push ebx
mov ebp, eax
call fcn.0056a360
push esi
call fcn.0058e8d0
mov eax, dword [esp + 0x2c]
add esp, 0x10
test eax, eax
je 0x5691ef
mov dword [eax], edi
mov ecx, dword [esp + 0x18]
pop edi
pop ebx
pop esi
mov dword [ecx], ebp
mov al, 1
pop ebp
ret

Function at 0x5692e0
Capabilities:
Read file on windows

Disassembly:
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi]
test eax, eax
je 0x5692f5
pop edi
mov dword [esp + 0x10], eax
jmp fcn.0058f789
mov ecx, dword [edi + 8]
mov eax, dword [edi + 0x114]
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, ebx
imul esi, dword [esp + 0x18]
lea edx, [ecx + esi]
cmp edx, eax
jb 0x569316
sub eax, ecx
mov esi, eax
test esi, esi
jne 0x569320
pop esi
pop ebx
xor eax, eax
pop edi
ret
mov eax, dword [edi + 4]
add eax, ecx
mov ecx, dword [esp + 0x10]
push esi
push eax
push ecx
call fcn.00591ee0
add dword [edi + 8], esi
add esp, 0xc
mov eax, esi
xor edx, edx
pop esi
div ebx
pop ebx
pop edi
ret

Function at 0x569640
Capabilities:
Set file attributes

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [esp + 0x10]
push eax
push edi
call fcn.0058f010
mov esi, eax
add esp, 8
test esi, esi
jne 0x569684
call fcn.0059555b
mov ecx, dword [eax]
push ecx
call fcn.00569440
push eax
push edi
push str.__warning____cant_open__s_for_writing_nError:__s__d__n
call fcn.005685e0
add esp, 0x10
mov eax, esi
pop edi
pop esi
ret

Function at 0x569690
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
push 0
push 0
push 0x8005
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jl 0x5696fa
mov eax, esi
dec eax
mov edi, edi
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x5696b0
mov ecx, dword [0x65f0f8]
mov dword [eax], ecx
mov edx, dword [0x65f0fc]
mov dword [eax + 4], edx
mov ecx, dword [0x65f100]
mov dword [eax + 8], ecx
mov edx, dword [0x65f104]
mov dword [eax + 0xc], edx
mov ecx, dword [0x65f108]
mov dword [eax + 0x10], ecx
mov edx, dword [0x65f10c]
push esi
mov dword [eax + 0x14], edx
call fcn.005953ce
add esp, 4
mov al, 1
pop esi
ret
xor al, al
pop esi
ret
Function at 0x569790
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x404c
call fcn.00592d30
push esi
mov esi, dword [esp + 0x4054]
push edi
lea eax, [esp + 0x30]
push eax
push esi
call fcn.0059631d
mov edi, dword [esp + 0x4064]
lea ecx, [esp + 0x14]
push ecx
push edi
call fcn.0059631d
mov edx, dword [esp + 0x54]
add esp, 0x10
cmp edx, dword [esp + 0x20]
je 0x5697d8
pop edi
xor eax, eax
pop esi
add esp, 0x404c
ret
push ebx
push ebp
push 0x6809ac
push esi
call fcn.0058f010
push 0x6809ac
push edi
mov ebp, eax
call fcn.0058f010
add esp, 0x10
mov ebx, eax
test ebp, ebp
je 0x5698f1
push ebp
test ebx, ebx
je 0x5698f6
mov dword [esp + 0x14], 1
call fcn.0059435f
add esp, 4
test eax, eax
jne 0x5698d3
push ebp
push 0x2000
lea eax, [esp + 0x2064]
push 1
push eax
call fcn.0058f789
push ebx
push 0x2000
lea ecx, [esp + 0x74]
push 1
push ecx
mov edi, eax
call fcn.0058f789
add esp, 0x20
cmp edi, eax
je 0x569869
push 0
push 0x6a8
push str..Source_r3dFileMan.cpp
push str.read0__read1
call fcn.00568720
add esp, 0x10
mov eax, edi
lea ecx, [esp + 0x5c]
lea esi, [esp + 0x205c]
cmp edi, 4
jb 0x569894
jmp 0x569880
mov edx, dword [esi]
cmp edx, dword [ecx]
jne 0x5698cb
sub eax, 4
add ecx, 4
add esi, 4
cmp eax, 4
jae 0x569880
test eax, eax
je 0x5698b8
mov dl, byte [ecx]
cmp dl, byte [esi]
jne 0x5698cb
cmp eax, 1
jbe 0x5698b8
mov dl, byte [ecx + 1]
cmp dl, byte [esi + 1]
jne 0x5698cb
cmp eax, 2
jbe 0x5698b8
mov al, byte [ecx + 2]
cmp al, byte [esi + 2]
jne 0x5698cb
push ebp
call fcn.0059435f
add esp, 4
test eax, eax
je 0x569820
jmp 0x5698d3
mov dword [esp + 0x10], 0
push ebp
call fcn.0058e8d0
push ebx
call fcn.0058e8d0
mov eax, dword [esp + 0x18]
add esp, 8
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x404c
ret
test ebx, ebx
je 0x5698fe
push ebx
call fcn.0058e8d0
add esp, 4
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x404c
ret
Function at 0x577160
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5dc80b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x110
push esi
push edi
mov esi, ecx
push 0x735f1c
lea ecx, [esp + 0xc]
call fcn.0056b1c0
mov edi, dword [esp + 0x128]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
push edi
mov ecx, esi
mov dword [esp + 0x12c], 0
call fcn.00576910
mov edx, dword [esp + 0x12c]
push edi
push edx
lea eax, [esp + 0x1c]
push 0x682124
push eax
call fcn.00401db0
add esp, 0x10
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
lea edx, [esp + 0x14]
push 0x680784
push edx
call fcn.0058f010
mov esi, eax
add esp, 8
test esi, esi
jne 0x577223
mov eax, dword [esp + 0xc]
push eax
call fcn.0056a360
lea ecx, [esp + 0x18]
push ecx
push str.r3dFS:_unable_to_open__s_for_writing_n
call fcn.00568410
add esp, 0xc
lea ecx, [esp + 8]
mov dword [esp + 0x120], 0xffffffff
call fcn.0056a1e0
xor al, al
jmp 0x57725a
mov edx, dword [esp + 0x10]
mov edi, dword [esp + 0xc]
push esi
push edx
push 1
push edi
call fcn.0058fd3b
push esi
call fcn.0058e8d0
push edi
call fcn.0056a360
add esp, 0x18
lea ecx, [esp + 8]
mov dword [esp + 0x120], 0xffffffff
call fcn.0056a1e0
mov al, 1
mov ecx, dword [esp + 0x118]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x11c
ret 8

Function at 0x5794c0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5dc7eb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x108
push ebx
push esi
mov ebx, ecx
push 0x735f1c
lea ecx, [esp + 0xc]
call fcn.0056b1c0
push 0
lea eax, [esp + 0x10]
push eax
mov ecx, ebx
mov dword [esp + 0x120], 0
call fcn.00576260
lea ecx, [esp + 0xc]
push 0x6809ac
push ecx
call fcn.0058f010
mov esi, eax
add esp, 8
test esi, esi
jne 0x57955d
lea edx, [esp + 0xc]
push edx
push str.r3dFS:_there_is_no_volume_file__s_n
call fcn.00568410
add esp, 8
lea ecx, [esp + 8]
mov dword [esp + 0x118], 0xffffffff
call fcn.0056a1e0
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x108]
mov dword fs:[0], ecx
add esp, 0x114
ret
push ebp
push edi
push 2
push 0
push esi
call fcn.005940b7
push esi
call fcn.005942f1
push 0
push 0
push esi
mov edi, eax
call fcn.005940b7
lea eax, [edi + 1]
push 1
push eax
call fcn.0056a320
push esi
push 1
mov ebp, eax
push edi
push ebp
call fcn.0058f789
push esi
call fcn.0058e8d0
add esp, 0x38
lea ecx, [esp + 0x14]
push ecx
push edi
push ebp
lea ecx, [ebx + 0x104]
call fcn.005791c0
push ebp
mov bl, al
call fcn.0056a360
add esp, 4
lea ecx, [esp + 0x10]
mov dword [esp + 0x120], 0xffffffff
call fcn.0056a1e0
mov ecx, dword [esp + 0x118]
pop edi
pop ebp
pop esi
mov al, bl
pop ebx
mov dword fs:[0], ecx
add esp, 0x114
ret
Function at 0x40181a
Capabilities:
Delete directory
Delete file

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0xc], 0x8004ffff
lea ebx, [esi + 0x10]
je 0x401863
xor edi, edi
cmp dword [esi + 0x14], edi
je 0x401848
push edi
mov ecx, ebx
call fcn.00402576
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
inc edi
cmp edi, dword [esi + 0x14]
jne 0x401832
mov ecx, ebx
call fcn.0040259b
lea edi, [esi + 0x1c]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, edi
call fcn.00402865
jmp 0x401866
lea edi, [esi + 0x1c]
lea ecx, [esi + 0x20]
call fcn.00402b62
mov ecx, edi
call fcn.00402b62
mov ecx, ebx
call fcn.0040259b
lea ecx, [esi + 8]
call fcn.00402b62
pop edi
lea ecx, [esi + 4]
pop esi
pop ebx
jmp fcn.00402b62

Function at 0x401c7b
Capabilities:
Create directory
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push ebx
mov dword [ebp - 4], ecx
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x401ca9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x401ca9
xor al, al
jmp 0x401d1e
lea ecx, [ebp + 8]
call fcn.00402802
or dword [ebp - 8], 0xffffffff
lea eax, [ebp + 8]
push 0x104
mov ecx, eax
mov dword [ebp - 0x10], eax
call fcn.00402829
push eax
push ebx
push 0x41db88
push dword [edi]
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea ecx, [ebp - 0x10]
mov edi, eax
call fcn.00402550
test edi, edi
je 0x401d14
cmp edi, 0x6f
je 0x401d14
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x401d14
mov ecx, dword [ebp - 4]
lea eax, [ebp + 8]
push eax
add ecx, 0x1c
call fcn.004026f2
mov bl, 1
lea ecx, [ebp + 8]
call fcn.00402b62
mov al, bl
pop edi
pop ebx
leave
ret 4

Function at 0x401d24
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push edi
mov edi, ecx
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x401d3e
xor al, al
jmp 0x401df1
push ebx
push esi
lea ecx, [ebp - 8]
call fcn.00402802
or dword [ebp - 0xc], 0xffffffff
lea eax, [ebp - 8]
push 0x104
mov ecx, eax
mov dword [ebp - 0x14], eax
call fcn.00402829
push eax
xor ebx, ebx
mov dword [ebp - 0x10], eax
push ebx
push ebx
push 0x8026
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea ecx, [ebp - 0x14]
mov esi, eax
call fcn.00402550
test esi, esi
js 0x401de5
push dword [ebp - 8]
lea ecx, [ebp - 4]
call fcn.004027a3
push 0x41da80
lea ecx, [ebp - 4]
call fcn.004024f7
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x401db3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401ddd
push str.Temp
lea ecx, [ebp - 4]
call fcn.004024f7
lea eax, [ebp - 4]
mov ecx, edi
push eax
call fcn.00401c7b
test al, al
je 0x401ddd
lea eax, [ebp - 4]
push eax
lea ecx, [edi + 0x20]
call fcn.004026f2
mov bl, 1
lea ecx, [ebp - 4]
call fcn.00402b62
lea ecx, [ebp - 8]
call fcn.00402b62
pop esi
mov al, bl
pop ebx
pop edi
leave
ret
Function at 0x401e6b
Capabilities:
Extract resource via kernel32 functions
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x420018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
xor ebx, ebx
lea eax, [ebp - 0x210]
push ebx
push eax
mov edi, ecx
or esi, 0xffffffff
call fcn.00405d20
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push ebx
push 0x41db9c
push dword [edi + 0x20]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x401f68
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x214]
call fcn.004027a3
lea eax, [ebp - 0x214]
push eax
lea ecx, [edi + 0x10]
call fcn.004025d4
lea ecx, [ebp - 0x214]
call fcn.00402b62
push 0x41da7c
push 0x66
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x401f68
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x401f68
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x401f68
xor eax, eax
push eax
push eax
push 4
push eax
push eax
push 0xc0000000
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x401f68
push esi
push ebx
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, eax
mov ecx, edi
call fcn.004021b0
pop ecx
test eax, eax
jne 0x401f5e
push ebx
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x401f68
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or esi, 0xffffffff
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405812
leave
ret
Function at 0x4021b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [0x420018]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, edx
mov dword [ebp - 0x98], eax
push edi
mov edi, ecx
cmp esi, 0xd
jae 0x4021e0
or eax, 0xffffffff
jmp 0x402386
lea eax, [ebp - 0x90]
mov dword [ebp - 0x90], 0x402194
push eax
xor ebx, ebx
mov dword [ebp - 0x8c], 0x4021a2
push ecx
mov edx, edi
mov dword [ebp - 0x68], ebx
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x6c], ebx
call fcn.00404acb
mov ecx, dword [edi + 5]
xor eax, eax
inc eax
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x30], eax
sub esi, 0xd
mov dword [ebp - 0x2c], eax
mov eax, dword [edi + 9]
add edi, 0xd
push ecx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x84], esi
call fcn.00416b8b
add esp, 0xc
mov dword [ebp - 0x88], ebx
mov esi, eax
lea eax, [ebp - 0x88]
mov edx, esi
mov dword [ebp - 0xa0], esi
push eax
push ecx
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x80]
push edi
push eax
lea ecx, [ebp - 0x7c]
call fcn.0040496d
mov ecx, dword [ebp - 0x8c]
add esp, 0x14
mov edi, eax
push dword [ebp - 0x6c]
cmp ecx, 0x4021a2
jne 0x402293
call fcn.004169a1
jmp 0x40229d
lea eax, [ebp - 0x90]
push eax
call ecx
pop ecx
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x6c], ebx
pop ecx
push dword [ebp - 0x68]
cmp eax, 0x4021a2
jne 0x4022b8
call fcn.004169a1
jmp 0x4022c2
lea ecx, [ebp - 0x90]
push ecx
call eax
pop ecx
mov dword [ebp - 0x68], ebx
pop ecx
test edi, edi
je 0x4022d2
or esi, 0xffffffff
jmp 0x402378
mov edx, dword [esi]
lea ecx, [esi + 4]
mov eax, dword [ecx]
push 4
mov dword [ebp - 0x94], eax
pop eax
add ecx, eax
mov dword [ebp - 0x84], edx
push edx
mov ebx, dword [ecx]
add ecx, eax
mov edi, dword [ecx]
add ecx, eax
mov esi, dword [ecx]
add ecx, eax
mov dword [ebp - 0x80], ecx
call fcn.00416b8b
pop ecx
push dword [ebp - 0x84]
mov ecx, dword [ebp - 0x94]
mov edx, ecx
push eax
push esi
mov dword [ebp - 0x88], eax
lea esi, [edi + ebx]
mov eax, dword [ebp - 0x80]
add esi, ecx
add esi, eax
push esi
lea esi, [ebx + ecx]
push edi
add esi, eax
add eax, ecx
mov ecx, dword [ebp - 0x80]
push esi
push ebx
push eax
call fcn.00404b41
mov edi, dword [ebp - 0x88]
add esp, 0x20
xor esi, esi
test eax, eax
je 0x402346
inc esi
jmp 0x402371
mov ebx, dword [ebp - 0x84]
lea eax, [ebp - 0x9c]
push esi
push eax
push ebx
push edi
push dword [ebp - 0x98]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40236e
cmp dword [ebp - 0x9c], ebx
je 0x402371
or esi, 0xffffffff
push edi
call fcn.004169a1
pop ecx
push dword [ebp - 0xa0]
call fcn.004169a1
pop ecx
mov eax, esi
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405812
leave
ret
Function at 0x402efa
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
mov esi, ecx
call fcn.00402f92
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x402f8a
push edi
push edi
push edi
push 2
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 8], eax
test eax, eax
je 0x402f83
push edi
push edi
push edi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edx, eax
mov dword [esi + 0xc], edx
test edx, edx
je 0x402f7a
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
push 0x1c
lea ecx, [ebp - 0x1c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x402f7a
mov ecx, dword [ebp - 0x10]
mov al, 1
mov dword [esi + 0x10], ecx
jmp 0x402f8c
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, esi
call fcn.00402f92
xor al, al
pop edi
pop esi
leave
ret 4

Function at 0x402fd0
Capabilities:
Delete file

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x10], edi
je 0x402ff3
push edi
lea ecx, [esi + 0xc]
call fcn.00402576
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
inc edi
cmp edi, dword [esi + 0x10]
jne 0x402fdc
lea ecx, [esi + 0xc]
call fcn.0040259b
pop edi
mov ecx, esi
pop esi
pop ebx
jmp fcn.00402b62
Function at 0x403005
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x40228
call fcn.004168e0
mov eax, dword [0x420018]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x40218]
xor ebx, ebx
mov dword [ebp - 0x40214], 1
push ebx
push eax
mov esi, ecx
lea eax, [ebp - 0x4020c]
push 0x200
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x403218
cmp dword [ebp - 0x40218], 0x200
jne 0x403218
push 4
lea eax, [ebp - 0x4010b]
push 0x41dbf4
push eax
call fcn.00416c64
add esp, 0xc
test eax, eax
jne 0x403087
inc eax
mov byte [edi], al
jmp 0x40321a
push 5
lea eax, [ebp - 0x4010b]
push str.ustar
push eax
call fcn.00416c64
add esp, 0xc
test eax, eax
jne 0x403218
mov ecx, dword [esi]
sub ecx, 0x10
call fcn.00402b7d
add eax, 0x10
lea ecx, [ebp - 0x40210]
push 0x41dc28
mov dword [ebp - 0x40210], eax
call fcn.0040322b
lea eax, [ebp - 0x4020c]
push eax
lea ecx, [ebp - 0x40210]
call fcn.0040322b
push ebx
push 0x100
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp - 0x40210]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x40224], eax
cmp eax, 0xffffffff
je 0x403209
push 8
lea eax, [ebp - 0x40190]
push ebx
push eax
call fcn.00417d97
add esp, 0xc
mov dword [ebp - 0x40220], eax
push 1
push ebx
push ebx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [ebp - 0x40220]
mov edi, ecx
neg edi
add eax, ecx
and edi, 0x1ff
add edi, eax
test ecx, ecx
je 0x4031b6
mov eax, 0x40000
mov dword [ebp - 0x4021c], eax
cmp ecx, eax
jae 0x403158
mov eax, ecx
mov dword [ebp - 0x4021c], ecx
push ebx
lea ecx, [ebp - 0x40218]
push ecx
push eax
lea eax, [ebp - 0x4000c]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4031b0
push ebx
lea eax, [ebp - 0x40218]
push eax
push dword [ebp - 0x4021c]
lea eax, [ebp - 0x4000c]
push eax
push dword [ebp - 0x40224]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4031b0
mov ecx, dword [ebp - 0x40220]
sub ecx, dword [ebp - 0x4021c]
mov dword [ebp - 0x40220], ecx
jne 0x403141
jmp 0x4031b6
mov byte [ebp - 0x40214], bl
push dword [ebp - 0x40224]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0x40214], bl
je 0x4031f2
cmp byte [esi + 8], bl
je 0x4031de
lea eax, [ebp - 0x40210]
push eax
lea ecx, [esi + 0xc]
call fcn.004025d4
mov eax, dword [esi + 0x18]
test eax, eax
je 0x4031f2
push dword [ebp - 0x40210]
push dword [esi + 0x1c]
call eax
pop ecx
pop ecx
cmp edi, 0xffffffff
je 0x403203
push ebx
push ebx
push edi
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov bl, byte [ebp - 0x40214]
lea ecx, [ebp - 0x40210]
call fcn.00402b62
mov al, bl
jmp 0x40321a
xor al, al
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405812
leave
ret 4