joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426c90
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x739911
mov eax, dword fs:[0]
push eax
mov eax, 0x1354
call fcn.0070bba0
mov eax, dword [0x899944]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
lea ecx, [ebp - 0x112c]
call fcn.00403e00
push edi
lea ecx, [ebp - 0x112c]
mov dword [ebp - 4], 0
call fcn.00407700
push 0x5c
push 0x2f
lea ecx, [ebp - 0x112c]
call fcn.004078c0
lea ecx, [ebp - 0x112c]
call fcn.00406240
cmp eax, 0x104
jle 0x426df1
lea ecx, [ebp - 0x1244]
call fcn.00403e00
lea ecx, [ebp - 0x1244]
mov byte [ebp - 4], 1
call fcn.004040a0
lea eax, [ebp - 0x1360]
push eax
lea ecx, [ebp - 0x1014]
push ecx
push 0x800
lea ecx, [ebp - 0x112c]
call fcn.00406500
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
je 0x426d57
lea edx, [ebp - 0x1014]
push edx
jmp 0x426d63
lea ecx, [ebp - 0x112c]
call fcn.00406500
push eax
lea ecx, [ebp - 0x1244]
call fcn.00407100
lea ecx, [ebp - 0x135c]
call fcn.00403e00
push 0x79c808
lea ecx, [ebp - 0x135c]
mov byte [ebp - 4], 2
call fcn.00406e60
lea ecx, [ebp - 0x1244]
call fcn.00405670
push eax
lea ecx, [ebp - 0x135c]
call fcn.00406e60
lea ecx, [ebp - 0x135c]
call fcn.00406500
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, eax
test esi, esi
jne 0x426dce
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x426dcc
mov esi, 1
test esi, esi
lea ecx, [ebp - 0x135c]
setne bl
mov byte [ebp - 4], 1
call fcn.00403e90
lea ecx, [ebp - 0x1244]
mov byte [ebp - 4], 0
call fcn.00403e90
jmp 0x426e3f
lea ecx, [ebp - 0x112c]
call fcn.00406500
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, eax
test ebx, ebx
jne 0x426e3c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test esi, esi
je 0x426e30
push edi
mov ecx, esi
call fcn.00474e00
lea eax, [ebp - 0x112c]
push eax
push str.failedToDeleteFilepath
mov ecx, esi
call fcn.00474840
cmp edi, 2
jne 0x426e3a
mov ebx, 1
test ebx, ebx
setne bl
lea ecx, [ebp - 0x112c]
mov dword [ebp - 4], 0xffffffff
call fcn.00403e90
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0070bb4c
mov esp, ebp
pop ebp
ret
Function at 0x4276c0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7399c6
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x899944]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x14]
mov dword [eax], 0
mov ecx, edi
mov dword [ebp - 0x244], eax
mov dword [esi], 0xffffffff
call fcn.00405c50
test al, al
je 0x427730
test ebx, ebx
je 0x427729
mov eax, dword [ebx]
mov edx, dword [eax + 0x14]
push str.GetAttributes:_filename_is_empty
mov ecx, ebx
call edx
xor al, al
jmp 0x4277f7
lea ecx, [ebp - 0x128]
call fcn.00403e00
push edi
lea ecx, [ebp - 0x128]
mov dword [ebp - 4], 0
call fcn.00407700
push 0x5c
push 0x2f
lea ecx, [ebp - 0x128]
call fcn.004078c0
lea ecx, [ebp - 0x128]
call fcn.00406240
test eax, eax
jle 0x4277b6
lea ecx, [ebp - 0x240]
call fcn.00403e00
lea eax, [ebp - 0x240]
push eax
lea ecx, [ebp - 0x128]
push ecx
mov byte [ebp - 4], 1
call fcn.00426b20
add esp, 8
lea ecx, [ebp - 0x240]
call fcn.00406500
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea ecx, [ebp - 0x240]
mov dword [esi], eax
mov byte [ebp - 4], 0
call fcn.00403e90
jmp 0x4277ca
lea ecx, [ebp - 0x128]
call fcn.00406500
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [esi], eax
cmp dword [esi], 0xffffffff
jne 0x4277e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp - 0x244]
mov dword [edx], eax
cmp dword [esi], 0xffffffff
lea ecx, [ebp - 0x128]
setne bl
mov dword [ebp - 4], 0xffffffff
call fcn.00403e90
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0070bb4c
mov esp, ebp
pop ebp
ret
Function at 0x427b30
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x739a46
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x899944]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
lea ecx, [ebp - 0x128]
call fcn.00403e00
xor ebx, ebx
push edi
lea ecx, [ebp - 0x128]
mov dword [ebp - 4], ebx
call fcn.00407700
push 0x5c
push 0x2f
lea ecx, [ebp - 0x128]
call fcn.004078c0
lea ecx, [ebp - 0x128]
call fcn.00406240
test eax, eax
jle 0x427be8
lea ecx, [ebp - 0x240]
call fcn.00403e00
lea eax, [ebp - 0x240]
push eax
lea ecx, [ebp - 0x128]
push ecx
mov byte [ebp - 4], 1
call fcn.00426b20
add esp, 8
push ebx
lea ecx, [ebp - 0x240]
call fcn.00406500
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [ebp - 0x240]
mov edi, eax
mov byte [ebp - 4], bl
call fcn.00403e90
jmp 0x427bfd
push ebx
lea ecx, [ebp - 0x128]
call fcn.00406500
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edi, eax
cmp edi, ebx
jne 0x427c27
cmp esi, ebx
je 0x427c25
mov edx, dword [esi]
mov eax, dword [edx + 0x24]
push 1
push str.createDirWin32
mov ecx, esi
call eax
mov ecx, esi
call fcn.00474d10
mov edx, dword [esi]
mov eax, dword [edx + 0x28]
mov ecx, esi
call eax
cmp edi, ebx
lea ecx, [ebp - 0x128]
setne bl
mov dword [ebp - 4], 0xffffffff
call fcn.00403e90
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0070bb4c
mov esp, ebp
pop ebp
ret

Function at 0x427d40
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x739a86
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x899944]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x128]
call fcn.00403e00
xor ebx, ebx
push esi
lea ecx, [ebp - 0x128]
mov dword [ebp - 4], ebx
call fcn.00407700
push 0x5c
push 0x2f
lea ecx, [ebp - 0x128]
call fcn.004078c0
push ebx
lea eax, [ebp - 0x128]
push 1
push eax
call fcn.00426e70
add esp, 0xc
lea ecx, [ebp - 0x128]
call fcn.00405c50
test al, al
jne 0x427e09
lea ecx, [ebp - 0x240]
call fcn.00403e00
lea ecx, [ebp - 0x240]
push ecx
lea edx, [ebp - 0x128]
push edx
mov byte [ebp - 4], 1
call fcn.00426b20
mov eax, dword [ebp + 0xc]
add esp, 8
push eax
lea ecx, [ebp - 0x240]
call fcn.00406500
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [ebp - 0x240]
mov esi, eax
mov byte [ebp - 4], bl
call fcn.00403e90
jmp 0x427e21
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x128]
call fcn.00406500
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov esi, eax
cmp esi, ebx
lea ecx, [ebp - 0x128]
setne bl
mov dword [ebp - 4], 0xffffffff
call fcn.00403e90
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0070bb4c
mov esp, ebp
pop ebp
ret
Function at 0x4289f0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x73947b
mov eax, dword fs:[0]
push eax
sub esp, 0x11c
mov eax, dword [0x899944]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x128]
call fcn.00403e00
push esi
lea ecx, [ebp - 0x128]
mov dword [ebp - 4], 0
call fcn.004042e0
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x128]
call fcn.00406500
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
lea ecx, [ebp - 0x128]
setne bl
mov dword [ebp - 4], 0xffffffff
call fcn.00403e90
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0070bb4c
mov esp, ebp
pop ebp
ret

Function at 0x428a90
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x739bbb
mov eax, dword fs:[0]
push eax
sub esp, 0x11c
mov eax, dword [0x899944]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x128]
call fcn.00403e00
push esi
lea ecx, [ebp - 0x128]
mov dword [ebp - 4], 0
call fcn.004042e0
lea ecx, [ebp - 0x128]
call fcn.00406500
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea ecx, [ebp - 0x128]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
call fcn.00403e90
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0070bb4c
mov esp, ebp
pop ebp
ret

Function at 0x428d80
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00426a10
Function at 0x4343a0
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp eax, 5
jne 0x4343b2
mov eax, str.SSH_FXP_READ
pop ebp
ret
cmp eax, 6
jne 0x4343be
mov eax, str.SSH_FXP_WRITE
pop ebp
ret
cmp eax, 0x65
jne 0x4343ca
mov eax, str.SSH_FXP_STATUS
pop ebp
ret
cmp eax, 0x66
jne 0x4343d6
mov eax, str.SSH_FXP_HANDLE
pop ebp
ret
cmp eax, 0x67
jne 0x4343e2
mov eax, str.SSH_FXP_DATA
pop ebp
ret
cmp eax, 0x68
jne 0x4343ee
mov eax, str.SSH_FXP_NAME
pop ebp
ret
cmp eax, 0x69
jne 0x4343fa
mov eax, str.SSH_FXP_ATTRS
pop ebp
ret
cmp eax, 0xc8
jne 0x434408
mov eax, str.SSH_FXP_EXTENDED
pop ebp
ret
cmp eax, 0xc9
jne 0x434416
mov eax, str.SSH_FXP_EXTENDED_REPLY
pop ebp
ret
cmp eax, 1
jne 0x434422
mov eax, str.SSH_FXP_INIT
pop ebp
ret
cmp eax, 2
jne 0x43442e
mov eax, str.SSH_FXP_VERSION
pop ebp
ret
cmp eax, 3
jne 0x43443a
mov eax, str.SSH_FXP_OPEN
pop ebp
ret
cmp eax, 4
jne 0x434446
mov eax, str.SSH_FXP_CLOSE
pop ebp
ret
cmp eax, 7
jne 0x434452
mov eax, str.SSH_FXP_LSTAT
pop ebp
ret
cmp eax, 8
jne 0x43445e
mov eax, str.SSH_FXP_FSTAT
pop ebp
ret
cmp eax, 9
jne 0x43446a
mov eax, str.SSH_FXP_SETSTAT
pop ebp
ret
cmp eax, 0xa
jne 0x434476
mov eax, str.SSH_FXP_FSETSTAT
pop ebp
ret
cmp eax, 0xb
jne 0x434482
mov eax, str.SSH_FXP_OPENDIR
pop ebp
ret
cmp eax, 0xc
jne 0x43448e
mov eax, str.SSH_FXP_READDIR
pop ebp
ret
cmp eax, 0xd
jne 0x43449a
mov eax, str.SSH_FXP_REMOVE
pop ebp
ret
cmp eax, 0xe
jne 0x4344a6
mov eax, str.SSH_FXP_MKDIR
pop ebp
ret
cmp eax, 0xf
jne 0x4344b2
mov eax, str.SSH_FXP_RMDIR
pop ebp
ret
cmp eax, 0x10
jne 0x4344be
mov eax, str.SSH_FXP_REALPATH
pop ebp
ret
cmp eax, 0x11
jne 0x4344ca
mov eax, str.SSH_FXP_STAT
pop ebp
ret
cmp eax, 0x12
jne 0x4344d6
mov eax, str.SSH_FXP_RENAME
pop ebp
ret
cmp eax, 0x13
jne 0x4344e2
mov eax, str.SSH_FXP_READLINK
pop ebp
ret
cmp eax, 0x15
jne 0x4344ee
mov eax, str.SSH_FXP_LINK
pop ebp
ret
cmp eax, 0x16
jne 0x4344fa
mov eax, str.SSH_FXP_BLOCK
pop ebp
ret
cmp eax, 0x17
mov eax, str.SSH_FXP_UNBLOCK
je 0x434509
mov eax, str.UNKNOWN
pop ebp
ret
Function at 0x470100
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x899944]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
je 0x4702b7
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x4702b7
xor edx, edx
mov dword [ebp - 0x68], edx
xor eax, eax
xor ecx, ecx
mov edx, 0x23
mov dword [ebp - 0x6c], 0x250024
mov dword [ebp - 0x64], 0x270026
mov dword [ebp - 0x60], 0x290028
mov dword [ebp - 0x5c], 0x10000
mov dword [ebp - 0x58], 0x30002
mov dword [ebp - 0x54], 0x50004
mov dword [ebp - 0x50], 0x70006
mov dword [ebp - 0x4c], 0x90008
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], 0x2a0000
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], 0xa0000
mov dword [ebp - 0x38], 0xc000b
mov dword [ebp - 0x34], 0xe000d
mov dword [ebp - 0x30], 0x10000f
mov dword [ebp - 0x2c], 0x120011
mov dword [ebp - 0x28], 0x140013
mov dword [ebp - 0x24], 0x160015
mov dword [ebp - 0x20], 0x180017
mov dword [ebp - 0x1c], 0x1a0019
mov dword [ebp - 0x18], 0x1c001b
mov dword [ebp - 0x14], 0x1e001d
mov dword [ebp - 0x10], 0x20001f
mov dword [ebp - 0xc], 0x220021
mov word [ebp - 8], dx
cmp edi, 2
jb 0x4702b7
movzx eax, byte [esi]
cmp edi, 3
jb 0x47025d
cmp eax, 0x28
jb 0x4701f9
cmp eax, 0x5a
jbe 0x4701fe
mov eax, 0x28
add eax, 0xffffffd8
movzx ecx, ax
movzx eax, word [ebp + ecx*2 - 0x6c]
movzx ecx, byte [esi + 1]
cmp ecx, 0x28
jb 0x470217
cmp ecx, 0x5a
jbe 0x47021c
mov ecx, 0x28
add ecx, 0xffffffd8
movzx ecx, cx
movzx edx, word [ebp + ecx*2 - 0x6c]
movzx ecx, byte [esi + 2]
cmp ecx, 0x28
jb 0x470235
cmp ecx, 0x5a
jbe 0x47023a
mov ecx, 0x28
imul eax, eax, 0x2b
add eax, edx
imul eax, eax, 0x2b
add ecx, 0xffffffd8
movzx ecx, cx
add ax, word [ebp + ecx*2 - 0x6c]
mov ecx, ebx
movzx edx, ax
push edx
add esi, 3
call fcn.00413bf0
jmp 0x4702a6
cmp eax, 0x28
jb 0x470267
cmp eax, 0x5a
jbe 0x47026c
mov eax, 0x28
add eax, 0xffffffd8
movzx ecx, ax
movzx eax, word [ebp + ecx*2 - 0x6c]
movzx ecx, byte [esi + 1]
cmp ecx, 0x28
jb 0x470285
cmp ecx, 0x5a
jbe 0x47028a
mov ecx, 0x28
mov dl, 0x2b
imul dl
add ecx, 0xffffffd8
movzx ecx, cx
add al, byte [ebp + ecx*2 - 0x6c]
mov ecx, ebx
movzx eax, al
push eax
add esi, 2
call fcn.00410ec0
cmp edi, 3
jbe 0x4702b7
sub edi, 3
cmp edi, 2
jae 0x4701e7
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.0070bb4c
mov esp, ebp
pop ebp
ret
Function at 0x471240
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
sub esp, 0xc
test ecx, ecx
jne 0x471255
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
push ebx
mov dword [ecx], 0
test eax, eax
je 0x4713ef
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x4713ef
lea edx, [eax + eax*4]
mov eax, 0xaaaaaaab
mul edx
shr edx, 1
lea eax, [edx + 4]
push esi
push eax
mov dword [ecx], eax
call fcn.00408f70
mov esi, eax
add esp, 4
test esi, esi
jne 0x47129b
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, 0xaaaaaaab
mul dword [ebp + 0xc]
push edi
xor edi, edi
xor ecx, ecx
shr edx, 1
mov dword [ebp - 0xc], edx
je 0x47133a
mov dword [ebp - 4], edx
jmp 0x4712c0
movzx eax, byte [edi + ebx]
movzx edx, byte [edi + ebx + 1]
movzx ebx, byte [edi + ebx + 2]
mov dword [ebp - 8], ebx
mov ebx, eax
sar ebx, 2
and ebx, 0x3f
mov bl, byte [ebx + 0x7a7d38]
mov byte [ecx + esi], bl
mov ebx, edx
sar ebx, 4
and eax, 3
and ebx, 0xf
shl eax, 4
or ebx, eax
movzx eax, byte [ebx + 0x7a7d38]
mov byte [ecx + esi + 1], al
mov eax, dword [ebp - 8]
and edx, 0xf
mov ebx, eax
sar ebx, 6
add edx, edx
and ebx, 3
add edx, edx
or ebx, edx
mov dl, byte [ebx + 0x7a7d38]
mov ebx, dword [ebp + 8]
mov byte [ecx + esi + 2], dl
and eax, 0x3f
movzx eax, byte [eax + 0x7a7d38]
mov byte [ecx + esi + 3], al
add edi, 3
add ecx, 4
dec dword [ebp - 4]
jne 0x4712c0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 0xc]
lea edx, [edx + edx*2]
sub eax, edx
dec eax
je 0x4713ac
dec eax
jne 0x4713db
movzx eax, byte [edi + ebx]
movzx edi, byte [edi + ebx + 1]
mov edx, eax
sar edx, 2
and edx, 0x3f
movzx edx, byte [edx + 0x7a7d38]
mov byte [ecx + esi], dl
mov edx, edi
sar edx, 4
and eax, 3
and edx, 0xf
shl eax, 4
or edx, eax
mov al, byte [edx + 0x7a7d38]
mov byte [ecx + esi + 1], al
and edi, 0xf
movzx edx, byte [edi*4 + 0x7a7d38]
mov byte [ecx + esi + 2], dl
mov edx, dword [ebp + 0x10]
mov byte [ecx + esi + 3], 0x3d
add ecx, 4
pop edi
mov byte [ecx + esi], 0
mov eax, esi
pop esi
mov dword [edx], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
movzx eax, byte [edi + ebx]
mov edx, eax
sar edx, 2
and edx, 0x3f
mov dl, byte [edx + 0x7a7d38]
and eax, 3
mov byte [ecx + esi], dl
shl eax, 4
mov al, byte [eax + 0x7a7d38]
mov byte [ecx + esi + 1], al
mov word [ecx + esi + 2], 0x3d3d
add ecx, 4
mov edx, dword [ebp + 0x10]
pop edi
mov byte [ecx + esi], 0
mov eax, esi
pop esi
mov dword [edx], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x475940
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ecx + 8], 0xffffffff
mov dword [ebp - 4], ecx
jne 0x47596e
cmp dword [ecx + 4], 0
jne 0x47596e
mov ecx, dword [ebp + 0x18]
test ecx, ecx
je 0x475966
mov eax, dword [ecx]
mov edx, dword [eax + 0x14]
push str.Failed_to_write_because_file_is_not_open.
call edx
xor al, al
mov esp, ebp
pop ebp
ret 0x14
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x475987
mov dword [edi], 0
mov dword [edi + 4], 0
mov edx, dword [ebp + 0xc]
mov eax, edx
or eax, dword [ebp + 0x10]
push esi
je 0x475a50
cmp dword [ebp + 0x10], 0
jl 0x4759ad
jg 0x4759a6
cmp edx, 0x989680
jbe 0x4759ad
mov esi, 0x989680
jmp 0x4759af
mov esi, edx
mov eax, dword [ecx + 8]
cmp eax, 0xffffffff
je 0x475a08
push 0
lea ecx, [ebp + 8]
push ecx
push esi
push ebx
push eax
mov dword [ebp + 8], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4759d6
cmp dword [ebp + 8], esi
je 0x475a24
mov esi, dword [ebp + 0x18]
test esi, esi
je 0x4759fd
mov edx, dword [esi]
mov eax, dword [edx + 0x24]
push 1
push str.WriteFileError
mov ecx, esi
call eax
mov ecx, esi
call fcn.00474d10
mov edx, dword [esi]
mov eax, dword [edx + 0x28]
mov ecx, esi
call eax
pop esi
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ecx + 4]
test eax, eax
je 0x475a2a
push eax
push 1
push esi
push ebx
call fcn.00711dfc
add esp, 0x10
cmp eax, 1
jne 0x475a5b
mov dword [ebp + 8], esi
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
add ebx, esi
sub edx, esi
mov eax, 0
sbb dword [ebp + 0x10], eax
mov dword [ebp + 0xc], edx
cmp edi, eax
je 0x475a45
mov esi, dword [ebp + 8]
add dword [edi], esi
adc dword [edi + 4], eax
mov eax, edx
or eax, dword [ebp + 0x10]
jne 0x475996
pop esi
pop edi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov ecx, dword [ebp + 0x18]
test ecx, ecx
je 0x475a6e
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
push str.fwrite_failed.
call eax
pop esi
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x475a80
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x73877b
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x899944]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ecx + 8]
mov esi, dword [ebp + 8]
cmp eax, 0xffffffff
je 0x475b70
lea ecx, [ebp - 0x88]
push ecx
push eax
mov dword [ebp - 0x88], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x475b5e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x475b5e
test esi, esi
je 0x475b3c
lea ecx, [ebp - 0x84]
call fcn.0040ac30
lea ecx, [ebp - 0x84]
mov dword [ebp - 4], 0
call fcn.0040f640
mov edi, dword [esi]
lea ecx, [ebp - 0x84]
call fcn.00409d90
mov edx, dword [edi + 0x14]
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x14]
push str.Failed_to_get_file_size__64_
mov ecx, esi
call edx
lea ecx, [ebp - 0x84]
mov dword [ebp - 4], 0xffffffff
call fcn.0040acf0
or eax, 0xffffffff
or edx, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0070bb4c
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0x88]
push eax
push edi
call fcn.00475160
add esp, 8
jmp 0x475b41
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x475b3c
push ecx
call fcn.0071c104
push eax
call fcn.0071caa1
add esp, 8
jmp 0x475b41
Function at 0x475d60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov byte [edx], 0
mov dword [eax], 0
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 4], ecx
mov ebx, eax
test eax, eax
jne 0x475d9c
mov ecx, dword [ebp + 0x18]
test ecx, ecx
je 0x475d93
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
push str.NULL_buf_pointer.
call eax
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp + 0xc]
push esi
mov esi, eax
push edi
mov dword [ebp + 8], esi
test eax, eax
je 0x475eaf
mov edi, dword [ebp + 0x18]
jmp 0x475db6
mov ecx, dword [ebp - 4]
cmp esi, 0x10000
jbe 0x475dc3
mov esi, 0x10000
mov byte [edx], 0
mov dword [ebp + 0x18], 0
test esi, esi
je 0x475e75
test ebx, ebx
je 0x475e75
mov eax, dword [ecx + 8]
cmp eax, 0xffffffff
je 0x475e2b
push 0
lea ecx, [ebp + 0x18]
push ecx
push esi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x475e1b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
jne 0x475e0d
mov edx, dword [ebp + 0x14]
mov byte [edx], 1
mov al, 1
jmp 0x475e89
test edi, edi
je 0x475e87
push eax
mov ecx, edi
call fcn.00474e00
jmp 0x475e87
cmp dword [ebp + 0x18], 0
jne 0x475e27
mov eax, dword [ebp + 0x14]
mov byte [eax], 1
mov al, 1
jmp 0x475e89
mov eax, dword [ecx + 4]
test eax, eax
je 0x475e6a
push eax
push esi
push 1
push ebx
call fcn.007117b0
add esp, 0x10
mov dword [ebp + 0x18], eax
cmp eax, esi
jne 0x475e4a
mov al, 1
jmp 0x475e89
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call fcn.0071c92f
add esp, 4
test eax, eax
je 0x475e21
test edi, edi
je 0x475e87
mov ecx, edi
call fcn.00474d10
jmp 0x475e87
test edi, edi
je 0x475e87
push str.No_file_is_open.
jmp 0x475e7e
test edi, edi
je 0x475e87
push str.NULL_buf_or_bufSize
mov edx, dword [edi]
mov eax, dword [edx + 0x14]
mov ecx, edi
call eax
xor al, al
mov ecx, dword [ebp + 0x18]
mov esi, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
add dword [edx], ecx
sub esi, ecx
add ebx, ecx
mov dword [ebp + 8], esi
test al, al
je 0x475eba
mov edx, dword [ebp + 0x14]
cmp byte [edx], 0
jne 0x475eaf
test esi, esi
jne 0x475db3
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x14
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x4765b0
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 4], 0x67452301
mov dword [ecx + 8], 0xefcdab89
mov dword [ecx + 0xc], 0x98badcfe
mov dword [ecx + 0x10], 0x10325476
ret

Function at 0x4765e0
Capabilities:
Hash data with md5

Disassembly:
mov eax, ecx
xor ecx, ecx
mov dword [eax], vtable._ckMd5.0
mov dword [eax + 0x18], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 4], 0x67452301
mov dword [eax + 8], 0xefcdab89
mov dword [eax + 0xc], 0x98badcfe
mov dword [eax + 0x10], 0x10325476
ret