joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c3e1
Capabilities:
Delete file

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
xor ebx, ebx
mov eax, dword [edi + 0xc]
push dword [edi + 8]
mov dword [esp + 0x20], eax
call fcn.0049b690
push dword [edi + 0x28]
mov ebp, eax
mov dword [esp + 0x14], ebp
call fcn.0049b690
mov dword [esp + 0x14], eax
call fcn.00476830
mov esi, eax
test esi, esi
je 0x41c512
push ebx
push pe_nt_image_headers32
push 2
push ebx
push 1
push 0xc0000000
push dword [esp + 0x34]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x41c507
test byte [edi + 0x1c], 2
mov dword [edi + 0x10], ebp
jne 0x41c458
push 1
push 0x34
push esi
call fcn.004768c0
add esp, 0xc
mov eax, dword [0x4fd720]
test eax, eax
je 0x41c470
push eax
push 0x2714
push esi
call fcn.004768c0
add esp, 0xc
mov eax, dword [0x4fd724]
test eax, eax
je 0x41c4a1
cmp dword [0x4fd728], ebx
je 0x41c4a1
push eax
push 0x27bf
push esi
call fcn.004768c0
push dword [0x4fd728]
push 0x27c0
push esi
call fcn.004768c0
add esp, 0x18
push dword [esp + 0x10]
push 0x2712
push esi
call fcn.004768c0
push dword [esp + 0x20]
push 0x2722
push esi
call fcn.004768c0
push 0x41c54c
push 0x4e2b
push esi
call fcn.004768c0
push edi
push 0x2711
push esi
call fcn.004768c0
push esi
call fcn.004768b0
add esp, 0x34
test eax, eax
jne 0x41c4f2
xor ebx, ebx
mov dword [edi + 4], 0xfffffffe
inc ebx
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x41c507
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call fcn.00476810
mov ebp, dword [esp + 0x14]
pop ecx
cmp dword [edi + 4], 0xfffffffe
je 0x41c525
cmp dword [edi + 4], 0xfffffffc
je 0x41c525
mov dword [edi + 4], 0xfffffffd
push ebp
call fcn.0049b680
push dword [esp + 0x14]
call fcn.0049b680
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
pop ecx
pop ecx
ret

Function at 0x41c673
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
push edi
xor edi, edi
inc edi
cmp dword [0x4fd738], 0
jne 0x41c69f
push 0x41c5c2
push 0x10
push 0x2c
mov dword [0x4fd738], edi
call fcn.0042d165
mov dword [0x4fd734], eax
cmp word [0x4fd72c], 0
jne 0x41c73b
lea eax, [esp + 4]
push eax
push 0x101
call dword [sym.imp.WSOCK32.DLL_WSAStartup]
test eax, eax
jne 0x41c6ca
mov word [0x4fd72c], di
jmp 0x41c6d2
xor eax, eax
mov word [0x4fd72c], ax
push str.ws2_32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x4fd748], eax
test eax, eax
je 0x41c73b
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4a3768
push eax
call esi
push 0x4a3774
push dword [0x4fd748]
mov dword [0x4fd73c], eax
call esi
push str.getnameinfo
push dword [0x4fd748]
mov dword [0x4fd740], eax
call esi
cmp dword [0x4fd73c], 0
mov dword [0x4fd744], eax
pop esi
je 0x41c73b
cmp dword [0x4fd740], 0
je 0x41c73b
test eax, eax
je 0x41c73b
mov dword [0x4fd730], edi
movsx eax, word [0x4fd72c]
pop edi
add esp, 0x190
ret
Function at 0x420ce6
Capabilities:
Get graphical window text

Disassembly:
push ebx
push dword [esp + 8]
push dword [0x4fe73c]
call fcn.0042d092
mov ebx, eax
test ebx, ebx
je 0x420d4a
mov ecx, dword [ebx + 4]
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x420d0f
push dword [esp + 0xc]
push ebx
call eax
jmp 0x420d4a
push esi
push edi
push dword [ebx]
call dword [sym.imp.USER32.DLL_GetWindowTextLengthW]
push dword [esp + 0x14]
mov edi, eax
push edi
call fcn.0042dd20
mov esi, eax
lea ecx, [edi + 1]
push ecx
xor eax, eax
push esi
mov word [esi], ax
push dword [ebx]
call dword [sym.imp.USER32.DLL_GetWindowTextW]
push esi
call sub.MSVCRT.dll_wcslen
pop ecx
sub edi, eax
push edi
call fcn.0042ddf0
pop edi
pop esi
pop ebx
ret 8

Function at 0x421c37
Capabilities:
Check os version

Disassembly:
sub esp, 0x34c
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x114
push eax
mov esi, 0xc8
xor ebx, ebx
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x421d8f
mov eax, dword [esp + 0x20]
dec eax
je 0x421d72
dec eax
jne 0x421d8f
lea eax, [esp + 0x124]
xor ebp, ebp
push eax
call fcn.00421bf0
pop ecx
test eax, eax
je 0x421ca3
mov ebx, dword [esp + 0x128]
mov edi, dword [esp + 0x12c]
cmp byte [esp + 0x23e], 1
jmp 0x421cd0
lea eax, [esp + 0x240]
mov dword [esp + 0x240], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x421cd5
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
cmp byte [esp + 0x35a], 1
jne 0x421cd5
xor ebp, ebp
inc ebp
sub ebx, 3
je 0x421d6e
dec ebx
je 0x421d6a
dec ebx
je 0x421d49
dec ebx
je 0x421d03
sub ebx, 4
jne 0x421d8f
test edi, edi
jne 0x421d8f
push 0x6e
jmp 0x421d8e
sub edi, 0
je 0x421d3b
dec edi
je 0x421d2d
dec edi
je 0x421d1f
dec edi
jne 0x421d8f
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x69
jmp 0x421d8f
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x5f
jmp 0x421d8f
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x55
jmp 0x421d8f
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x4b
jmp 0x421d8f
sub edi, 0
je 0x421d66
dec edi
je 0x421d62
dec edi
jne 0x421d8f
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x41
jmp 0x421d8f
push 0x3c
jmp 0x421d8e
push 0x32
jmp 0x421d8e
push 0x14
jmp 0x421d8e
push 5
jmp 0x421d8e
mov eax, dword [esp + 0x18]
test eax, eax
je 0x421d8c
cmp eax, 0xa
je 0x421d88
cmp eax, 0x5a
jne 0x421d8f
push 0x28
jmp 0x421d8e
push 0x1e
jmp 0x421d8e
push 0xa
pop esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x34c
ret
Function at 0x423067
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
call dword [sym.imp.USER32.DLL_GetFocus]
mov esi, dword [sym.imp.USER32.DLL_GetKeyState]
mov ebx, eax
test ebx, ebx
je 0x4230e1
push 9
call esi
test al, al
jns 0x4230e1
push 0x11
call esi
test al, al
js 0x4230e1
push 0x10
call esi
test al, al
js 0x4230e1
push 0x12
call esi
test al, al
js 0x4230e1
push 5
lea eax, [ebp - 0x10]
push eax
push ebx
call dword [sym.imp.USER32.DLL_GetClassNameW]
push 4
lea eax, [ebp - 0x10]
push str.Rich
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
jne 0x4230e1
push eax
push eax
push 0x44e
push ebx
call dword [sym.imp.USER32.DLL_SendMessageW]
test eax, 0x800
jne 0x4230e1
xor eax, eax
jmp 0x423162
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x423109
push 0x11
call esi
test al, al
js 0x423101
push 0x10
call esi
test al, al
js 0x423101
push 0x12
call esi
test al, al
jns 0x423109
push 1
push edi
call fcn.0042316a
mov esi, dword [sym.imp.USER32.DLL_GetPropW]
test ebx, ebx
je 0x42311f
push str.PB_Hotkey
push ebx
call esi
test eax, eax
jne 0x42315f
push str.PB_WindowID
push edi
call esi
mov esi, eax
test esi, esi
je 0x42315f
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.USER32.DLL_GetWindowThreadProcessId]
test eax, eax
je 0x42315f
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 4], eax
jne 0x42315f
lea eax, [esi - 1]
push eax
push dword [0x4fe74c]
call fcn.0042d092
test eax, eax
je 0x42315f
mov eax, dword [eax + 8]
jmp 0x423161
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4232fb
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
cmp dword [ebp + 8], 0
je 0x423373
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [ebp - 4], ax
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_wcslen
lea ecx, [ebp - 0x20c]
add esp, 0x10
lea eax, [ecx + eax*2]
jmp 0x423354
movzx ecx, word [eax - 2]
cmp ecx, 0x20
je 0x423351
cmp ecx, 0x5c
je 0x423351
cmp ecx, 0x2f
jne 0x42335e
add eax, 0xfffffffe
lea ecx, [ebp - 0x20c]
cmp eax, ecx
ja 0x42333e
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x423375
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x42337b
Capabilities:
Delete file
Set file attributes

Disassembly:
cmp dword [esp + 4], 0
je 0x4233a4
test byte [esp + 8], 2
je 0x423398
push pe_nt_image_headers32
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x4233a6
xor eax, eax
ret 8
Function at 0x4237b2
Capabilities:
Copy file

Disassembly:
cmp dword [esp + 4], 0
je 0x4237d2
cmp dword [esp + 8], 0
je 0x4237d2
push 0
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
jmp 0x4237d4
xor eax, eax
ret 8

Function at 0x4237e7
Capabilities:
Get disk information
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x45c
push esi
or esi, 0xffffffff
push edi
mov edi, esi
test eax, eax
je 0x423922
push ebp
xor ebp, ebp
cmp word [eax], bp
je 0x423921
push 0x104
push eax
lea eax, [esp + 0x14]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [esp + 0x220], ax
lea eax, [esp + 0x18]
push eax
call sub.MSVCRT.dll_wcslen
mov ecx, eax
add esp, 0x10
lea eax, [esp + ecx*2 + 0xa]
cmp ecx, 2
je 0x423843
cmp ecx, 3
jne 0x42387d
cmp word [esp + 0xe], 0x3a
jne 0x42387d
cmp ecx, 2
jne 0x423861
lea eax, [esp + 0xc]
push 0x4a3cc8
push eax
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x423921
push 0xfffffffffffffffe
pop edi
jmp 0x423921
push ebx
push 0x5c
pop ebx
movzx ecx, word [eax]
cmp cx, bx
je 0x42388e
cmp ecx, 0x2f
jne 0x423898
xor ecx, ecx
mov word [eax], cx
sub eax, 2
jmp 0x423881
lea eax, [esp + 0x21c]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, esi
je 0x4238d9
test byte [esp + 0x21c], 0x10
je 0x4238be
push 0xfffffffffffffffe
pop edi
jmp 0x4238d0
mov esi, dword [esp + 0x238]
xor edi, edi
or edi, dword [esp + 0x23c]
or esi, ebp
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x423920
cmp word [esp + 0x10], bx
jne 0x4238e7
cmp word [esp + 0x12], bx
je 0x4238f8
push 0x2e
pop eax
cmp word [esp + 0x10], ax
jne 0x423920
cmp word [esp + 0x12], ax
jne 0x423920
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, esi
je 0x42390d
test al, 0x10
je 0x423920
jmp 0x42391d
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x423920
push 0xfffffffffffffffe
pop edi
pop ebx
pop ebp
mov eax, edi
mov edx, esi
pop edi
pop esi
add esp, 0x45c
ret 4

Function at 0x423a10
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [esi + 0x14], 0
jne 0x423a4c
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 4
xor eax, eax
pop esi
pop ecx
ret 4
Function at 0x423e70
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
mov dword [esp + 4], 0
test esi, esi
je 0x423ed5
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x423ecd
push dword [esp + 0x10]
push dword [0x4fe760]
call fcn.0042d092
test eax, eax
je 0x423ec3
cmp dword [eax + 4], 0
je 0x423eb2
push edi
push esi
push eax
call fcn.00424180
pop edi
pop esi
pop ecx
ret 0xc
push 0
lea ecx, [esp + 0xc]
push ecx
push edi
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
pop edi
xor eax, eax
pop esi
pop ecx
ret 0xc
xor eax, eax
pop esi
pop ecx
ret 0xc

Function at 0x424030
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push esi
push dword [esp + 0x10]
mov dword [esp + 8], 0
push dword [0x4fe760]
call fcn.0042d092
mov esi, eax
test esi, esi
je 0x4240af
cmp dword [esi + 4], 0
je 0x424080
push 1
lea eax, [esp + 8]
push eax
push esi
call fcn.00424840
test eax, eax
je 0x424074
inc dword [esi + 0xc]
xor eax, eax
pop esi
add esp, 8
ret 4
mov eax, 1
pop esi
add esp, 8
ret 4
push 0
lea eax, [esp + 0xc]
push eax
push 1
lea eax, [esp + 0x1c]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4240ba
cmp dword [esp + 8], 0
je 0x4240ba
push 1
push 0
push 0xffffffffffffffff
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 4]
pop esi
add esp, 8
ret 4
or eax, 0xffffffff
pop esi
add esp, 8
ret 4

Function at 0x424120
Capabilities:
Read file on windows

Disassembly:
push ecx
push dword [esp + 8]
mov dword [esp + 4], 0
push dword [0x4fe760]
call fcn.0042d092
test eax, eax
je 0x42416c
cmp dword [eax + 4], 0
je 0x424156
push 4
lea ecx, [esp + 4]
push ecx
push eax
call fcn.00424840
mov eax, dword [esp]
pop ecx
ret 4
push 0
lea ecx, [esp + 0xc]
push ecx
push 4
lea ecx, [esp + 0xc]
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp]
pop ecx
ret 4
Function at 0x424180
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
mov dword [esp + 4], 0
cmp dword [esi + 0x1c], 0
jne 0x424287
cmp dword [esi + 0x14], 1
jne 0x4241cb
mov eax, dword [esi + 0xc]
lea ecx, [esp + 0xc]
push 1
neg eax
cdq
push ecx
push eax
push dword [esi]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esi + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
push edi
mov edi, dword [esp + 0x20]
cmp eax, edi
jle 0x424248
mov ecx, dword [esi + 8]
add ecx, dword [esi + 4]
sub ecx, eax
mov eax, edi
dec eax
je 0x424233
dec eax
je 0x42421c
sub eax, 2
je 0x424207
push edi
push dword [esp + 0x20]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov ax, word [eax]
mov word [ecx], ax
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov al, byte [eax]
mov byte [ecx], al
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
push esi
call fcn.00423a10
mov eax, dword [esi + 8]
cmp edi, eax
jl 0x424275
push 0
lea eax, [esp + 0xc]
push eax
push edi
push dword [esp + 0x28]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
add esp, 0xc
ret 0xc
mov ecx, dword [esi + 4]
sub ecx, dword [esi + 0xc]
push edi
push dword [esp + 0x20]
add ecx, eax
jmp 0x4241f1
xor eax, eax
pop esi
add esp, 0xc
ret 0xc
Function at 0x424290
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push 0x1000
push 0
push dword [0x4fc9ec]
mov dword [esp + 0x14], 0x1000
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esp + 0x10], edx
test edx, edx
je 0x424414
mov cl, byte [esp + 3]
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x28]
push esi
push edi
mov esi, edx
mov edi, edi
cmp ebp, 0xffffffff
je 0x4242de
test ebp, ebp
je 0x424380
dec ebp
cmp dword [ebx + 4], 0
je 0x4242f7
push 1
lea eax, [esp + 0x17]
push eax
push ebx
call fcn.00424840
mov dword [esp + 0x14], eax
jmp 0x424311
push 0
lea eax, [esp + 0x18]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
mov cl, byte [esp + 0x13]
cmp eax, 1
jne 0x424380
test cl, cl
je 0x424325
mov byte [esi], cl
inc esi
mov cl, byte [esp + 0x13]
mov eax, dword [esp + 0x18]
mov edi, esi
mov edx, dword [esp + 0x20]
dec eax
sub edi, edx
cmp edi, eax
jle 0x424360
mov eax, dword [esp + 0x18]
add eax, 0x1000
push eax
push edx
push 8
push dword [0x4fc9ec]
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov cl, byte [esp + 0x13]
mov edx, eax
mov dword [esp + 0x20], edx
lea esi, [edi + edx]
test cl, cl
je 0x424380
cmp dword [esp + 0x2c], 0
jne 0x4242d0
cmp cl, 0xd
je 0x424387
cmp cl, 0xa
jne 0x4242d0
dec esi
jmp 0x4243f7
cmp dword [esp + 0x2c], 0
jne 0x4243f7
cmp cl, 0xa
jne 0x42438f
dec esi
jmp 0x4243f7
cmp cl, 0xd
jne 0x4243f7
dec esi
cmp dword [ebx + 4], 0
je 0x4243ae
push 1
lea eax, [esp + 0x17]
push eax
push ebx
call fcn.00424840
mov dword [esp + 0x14], eax
jmp 0x4243c4
push 0
lea eax, [esp + 0x18]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [esp + 0x13], 0xa
je 0x4243f7
cmp dword [ebx + 4], 0
je 0x4243d6
inc dword [ebx + 0xc]
jmp 0x4243f7
push 1
lea eax, [esp + 0x20]
mov dword [esp + 0x1c], 0xffffffff
push eax
push 0xffffffffffffffff
push dword [ebx]
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x34]
mov ecx, esi
sub ecx, dword [esp + 0x20]
pop edi
mov dword [eax], ecx
mov eax, dword [esp + 0x1c]
mov byte [esi], 0
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x10
xor eax, eax
add esp, 0x14
ret 0x10
Function at 0x424420
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
push 0x1000
push 0
push dword [0x4fc9ec]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
mov dword [esp + 8], ecx
test ecx, ecx
je 0x4245cd
mov ax, word [esp]
push ebx
mov ebx, dword [esp + 0x20]
push ebp
mov ebp, dword [esp + 0x2c]
push esi
push edi
mov edi, ecx
mov dword [esp + 0x20], 0x1000
mov dword [esp + 0x1c], 0x7ff
cmp ebp, 0xffffffff
je 0x424474
test ebp, ebp
je 0x42452d
dec ebp
cmp dword [ebx + 4], 0
je 0x42448d
push 2
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.00424840
mov dword [esp + 0x14], eax
jmp 0x4244a7
push 0
lea eax, [esp + 0x18]
push eax
push 2
lea eax, [esp + 0x1c]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
cmp eax, 2
mov ax, word [esp + 0x10]
jne 0x42452d
test ax, ax
je 0x4244c1
mov word [edi], ax
add edi, 2
mov ax, word [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov esi, edi
mov edx, dword [esp + 0x1c]
sub esi, ecx
sar esi, 1
cmp esi, edx
jle 0x424508
mov eax, dword [esp + 0x20]
add edx, 0x800
add eax, 0x1000
mov dword [esp + 0x1c], edx
push eax
push ecx
push 8
push dword [0x4fc9ec]
mov dword [esp + 0x30], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, eax
mov ax, word [esp + 0x10]
mov dword [esp + 0x18], ecx
lea edi, [ecx + esi*2]
test ax, ax
je 0x42452d
cmp dword [esp + 0x30], 0
jne 0x424466
cmp ax, 0xd
je 0x424534
cmp ax, 0xa
jne 0x424466
sub edi, 2
jmp 0x4245ac
cmp dword [esp + 0x30], 0
jne 0x4245ac
cmp ax, 0xa
jne 0x42453f
sub edi, 2
jmp 0x4245ac
cmp ax, 0xd
jne 0x4245ac
sub edi, 2
cmp dword [ebx + 4], 0
je 0x424561
push 2
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.00424840
mov dword [esp + 0x14], eax
jmp 0x424577
push 0
lea eax, [esp + 0x18]
push eax
push 2
lea eax, [esp + 0x1c]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp word [esp + 0x10], 0xa
je 0x4245ac
cmp dword [ebx + 4], 0
je 0x42458b
add dword [ebx + 0xc], 2
jmp 0x4245ac
push 1
lea eax, [esp + 0x28]
mov dword [esp + 0x24], 0xfffffffe
push eax
push 0xfffffffffffffffe
push dword [ebx]
mov dword [esp + 0x34], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x38]
mov ecx, edi
sub ecx, dword [esp + 0x18]
sar ecx, 1
mov dword [eax], ecx
xor eax, eax
mov word [edi], ax
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x10
xor eax, eax
add esp, 0x18
ret 0x10
Function at 0x4245e0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push 0x1000
push 0
push dword [0x4fc9ec]
mov dword [esp + 0x10], 0x1000
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esp + 0xc], edx
test edx, edx
je 0x424730
mov eax, dword [esp + 0x1c]
mov cl, byte [esp + 3]
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
push edi
mov edi, dword [esp + 0x30]
mov esi, edx
cmp edi, 0xffffffff
je 0x42462c
test edi, edi
je 0x42469d
dec edi
push esi
push ebp
call fcn.00424960
mov dword [esp + 0x20], eax
test eax, eax
jne 0x42463f
xor cl, cl
jmp 0x424641
mov cl, byte [esi]
mov edx, dword [esp + 0x1c]
add esi, eax
mov eax, dword [esp + 0x14]
mov ebx, esi
sub ebx, edx
mov byte [esp + 0x13], cl
add eax, 0xfffffffb
cmp ebx, eax
jle 0x424684
mov eax, dword [esp + 0x14]
add eax, 0x1000
push eax
push edx
push 8
push dword [0x4fc9ec]
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov cl, byte [esp + 0x13]
mov edx, eax
mov dword [esp + 0x1c], edx
lea esi, [ebx + edx]
mov eax, dword [esp + 0x2c]
test cl, cl
je 0x42469d
test eax, eax
jne 0x424622
cmp cl, 0xd
je 0x4246a1
cmp cl, 0xa
jne 0x424622
dec esi
jmp 0x424713
test eax, eax
jne 0x424713
cmp cl, 0xa
jne 0x4246a9
dec esi
jmp 0x424713
cmp cl, 0xd
jne 0x424713
dec esi
cmp dword [ebp + 4], 0
je 0x4246c8
push 1
lea eax, [esp + 0x17]
push eax
push ebp
call fcn.00424840
mov dword [esp + 0x20], eax
jmp 0x4246df
push 0
lea eax, [esp + 0x24]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [ebp]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [esp + 0x13], 0xa
je 0x424713
cmp dword [ebp + 4], 0
je 0x4246f1
inc dword [ebp + 0xc]
jmp 0x424713
push 1
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 0xffffffff
push eax
push 0xffffffffffffffff
push dword [ebp]
mov dword [esp + 0x28], 0xffffffff
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x34]
mov ecx, esi
sub ecx, dword [esp + 0x1c]
pop edi
mov dword [eax], ecx
mov eax, dword [esp + 0x18]
mov byte [esi], 0
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x10
xor eax, eax
add esp, 0x14
ret 0x10
Function at 0x424740
Capabilities:
Write file on windows

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
mov dword [esp], 0
test edx, edx
je 0x424834
cmp word [edx], 0
je 0x424834
mov ecx, dword [esp + 0x10]
push esi
cmp ecx, 0x19
jne 0x4247cd
mov esi, dword [esp + 0xc]
mov ecx, edx
push edi
cmp dword [esi + 4], 0
lea edi, [ecx + 2]
je 0x4247a0
jmp 0x424780
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x424780
sub ecx, edi
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push edx
push esi
call fcn.00424180
pop edi
pop esi
pop ecx
ret 0xc
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4247a0
sub ecx, edi
lea eax, [esp + 8]
push 0
sar ecx, 1
push eax
lea eax, [ecx + ecx]
push eax
push edx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
xor eax, eax
cmp ecx, 2
lea ecx, [esp + 0x10]
setne al
push ecx
dec eax
and eax, 0xfde9
push edx
push eax
call fcn.00424a70
mov esi, eax
test esi, esi
je 0x42482b
mov eax, dword [esp + 0xc]
cmp dword [eax + 4], 0
je 0x424808
push dword [esp + 0x10]
push esi
push eax
call fcn.00424180
mov dword [esp + 4], eax
jmp 0x42481c
push 0
lea ecx, [esp + 8]
push ecx
push dword [esp + 0x18]
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
push 0
push dword [0x4fc9ec]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 0xc
xor eax, eax
pop ecx
ret 0xc