joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cfdd0
Capabilities:
Copy file
Delete file
Move file

Disassembly:
push 0xffffffffffffffff
push 0x5a0968
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x5f13cc]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov esi, ecx
xor ecx, ecx
test esi, esi
mov dword [esp + 0x14], ecx
je 0x4cfe1f
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call fcn.00404460
mov edx, dword [eax]
cmp dword [edx - 0xc], 0
mov ecx, 1
je 0x4cfe1f
xor bl, bl
jmp 0x4cfe21
mov bl, 1
test cl, 1
je 0x4cfe46
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4cfe46
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x4cfe62
mov eax, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x34
ret
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.00404460
mov dword [esp + 0x40], 0
mov edx, dword [esp + 0x10]
mov ecx, dword [edx - 0xc]
lea eax, [ecx - 1]
test eax, eax
jl 0x4cff66
cmp eax, ecx
jg 0x4cff66
movzx eax, word [edx + eax*2]
cmp ax, 0x5c
je 0x4cfea5
push 0x5c
lea edi, [esp + 0x14]
call fcn.00404400
push 2
push 0x5c77ac
lea edx, [esp + 0x18]
push edx
call fcn.00403fc0
mov eax, dword [esp + 0x10]
mov eax, dword [eax - 0xc]
push 0
lea ebx, [eax - 1]
lea edi, [esp + 0x14]
call fcn.0049f070
mov ecx, dword [esp + 0x10]
xor eax, eax
lea edx, [esp + 0x18]
mov dword [esp + 0x30], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov word [esp + 0x34], ax
push edx
mov word [esp + 0x2c], 0x414
mov dword [esp + 0x32], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x36], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], eax
mov dword [esp + 0x20], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov esi, eax
neg esi
sbb esi, esi
mov dword [esp + 0x40], 0xffffffff
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
add esi, 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4cff51
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x34
ret
push 0x80070057
call fcn.00404550
int3
Function at 0x4d0300
Capabilities:
Get file size

Disassembly:
sub esp, 0x10
push edi
mov edi, eax
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0xc]
push 0
push eax
push ecx
push 2
push 0
push edi
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test eax, eax
mov dword [esi + 8], eax
jne 0x4d033a
call fcn.004129d0
pop edi
add esp, 0x10
ret
mov ecx, dword [esp + 8]
push 0
push ecx
mov dword [esi + 0x10], 0
mov edx, dword [esi + 0x10]
push edx
mov dword [esi + 4], ecx
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x14]
push ecx
push 4
push eax
mov dword [esi + 0x18], 4
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
test eax, eax
mov dword [esi], eax
jne 0x4d0398
call fcn.004129d0
mov edi, eax
test edi, edi
jl 0x4d0380
mov edi, 0x80004005
mov edx, dword [esi + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0
mov eax, edi
pop edi
add esp, 0x10
ret
xor eax, eax
pop edi
add esp, 0x10
ret
Function at 0x4d0980
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
mov esi, edx
push esi
push 0
push eax
push 0xc0000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x4d0afc
call fcn.004129d0
test eax, eax
jl 0x4d0af3
mov ebx, dword [ebp + 8]
cmp edi, 0xffffffff
jne 0x4d0a72
cmp esi, 4
jne 0x4d0b06
xor edi, edi
lea esi, [esp + 0x10]
mov ecx, ebx
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
call fcn.0041ae70
xor eax, eax
cmp dword [esp + 0x14], eax
ja 0x4d09f7
cmp dword [esp + 0x10], 2
jb 0x4d0a72
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], eax
mov eax, dword [ebx]
lea esi, [esp + 0x18]
call fcn.0047bcf0
test eax, eax
mov esi, dword [esp + 0x18]
jl 0x4d0a3b
test esi, esi
je 0x4d0a3b
movzx eax, word [esi]
cmp eax, 0xfeff
je 0x4d0a36
cmp eax, 0xfffe
je 0x4d0a36
mov ebx, dword [esp + 0x1c]
mov ecx, esi
call fcn.004d0820
test eax, eax
je 0x4d0a3b
mov edi, 1
xor ebx, ebx
test esi, esi
je 0x4d0a53
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test eax, eax
jne 0x4d0a53
call fcn.004129d0
mov ebx, eax
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4d0a6f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x4d0a6f
test ebx, ebx
jl 0x4d0a6f
call fcn.004129d0
mov ebx, dword [ebp + 8]
cmp edi, 1
mov dword [ebx + 4], edi
jne 0x4d0acc
mov eax, dword [ebx]
lea edx, [esp + 0x14]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x4d0a9e
call fcn.004129d0
test eax, eax
jl 0x4d0aa4
mov eax, dword [esp + 0x10]
or eax, dword [esp + 0x14]
jne 0x4d0acc
mov eax, dword [ebx]
push 0
lea ecx, [esp + 0x14]
push ecx
push 2
lea edx, [esp + 0x18]
push edx
push eax
mov dword [esp + 0x20], 0xfeff
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4d0acc
call fcn.004129d0
mov edx, dword [ebx]
push 2
xor eax, eax
lea ecx, [esp + 0x18]
push ecx
push eax
push edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x4d0af1
call fcn.004129d0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
jmp 0x4d09c1
mov edi, 1
jmp 0x4d0a72
Function at 0x4d0b10
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5a0938
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push edi
mov eax, dword [0x5f13cc]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [esp + 0x20]
cmp dword [esi + 4], 0
jne 0x4d0bb5
push eax
lea eax, [esp + 0x24]
push eax
call fcn.004d2800
push 2
push 0x5bce38
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0x24], 0
call fcn.00408a10
mov eax, dword [esp + 0x20]
mov ecx, dword [eax - 0xc]
push 0
lea edx, [esp + 0x10]
push edx
push ecx
push eax
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4d0b89
call fcn.004129d0
mov edi, eax
jmp 0x4d0b8b
xor edi, edi
mov dword [esp + 0x18], 0xffffffff
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4d0bfd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x4d0bfd
push 0
lea ecx, [esp + 0x24]
push ecx
lea edx, [ebx + ebx]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push edx
push eax
mov eax, dword [esi]
push eax
call ebx
test eax, eax
jne 0x4d0bdb
call fcn.004129d0
mov edi, eax
test edi, edi
jl 0x4d0bfd
mov edx, dword [esi]
push 0
lea ecx, [esp + 0x10]
push ecx
push 4
push 0x5bdf38
push edx
call ebx
test eax, eax
jne 0x4d0bfb
call fcn.004129d0
mov edi, eax
jmp 0x4d0bfd
xor edi, edi
xor eax, eax
test edi, edi
setge al
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x10
ret 4

Function at 0x4d0c20
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, edx
cmp dword [esi + 4], 0
mov ebx, ecx
jne 0x4d0c8f
push eax
lea eax, [esp + 0xc]
push eax
call fcn.004d2800
mov eax, dword [esp + 8]
mov ecx, dword [eax - 0xc]
push 0
lea edx, [esp + 0x10]
push edx
push ecx
push eax
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4d0c60
call fcn.004129d0
mov esi, eax
jmp 0x4d0c62
xor esi, esi
mov eax, dword [esp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4d0cbe
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
test esi, esi
pop esi
setge al
pop ebx
add esp, 8
ret
push 0
lea ecx, [esp + 0x10]
push ecx
lea edx, [ebx + ebx]
push edx
push eax
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4d0cbc
call fcn.004129d0
mov esi, eax
xor eax, eax
test esi, esi
pop esi
setge al
pop ebx
add esp, 8
ret
xor esi, esi
xor eax, eax
test esi, esi
pop esi
setge al
pop ebx
add esp, 8
ret
Function at 0x4d0f20
Capabilities:
Get file size
Write file on windows

Disassembly:
sub esp, 0x14
cmp dword [esi + 4], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
push edi
jne 0x4d0f5d
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
jle 0x4d0f5d
push 0
push 0x80
push 4
push 0
push 7
push closesocket
push eax
call ebx
cmp eax, 0xffffffff
jne 0x4d0f5a
call fcn.004129d0
jmp 0x4d0f5d
mov dword [esi + 4], eax
mov eax, dword [esi + 4]
test eax, eax
je 0x4d0fe2
lea ecx, [esp + 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x4d0f86
call fcn.004129d0
test eax, eax
jl 0x4d0f8c
mov eax, dword [esp + 0x10]
or eax, dword [esp + 0x14]
jne 0x4d0fe2
mov eax, dword [esi]
xor edi, edi
push edi
push 0x80
push 4
push edi
push 7
push 0x40000000
push eax
call ebx
cmp eax, 0xffffffff
jne 0x4d0fe8
call fcn.004129d0
test eax, eax
jl 0x4d0fe2
push 0
lea edx, [esp + 0x14]
push edx
push 2
lea eax, [esp + 0x18]
push eax
push edi
mov dword [esp + 0x20], 0xfeff
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4d0fd7
call fcn.004129d0
test edi, edi
je 0x4d0fe2
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
add esp, 0x14
ret
mov edi, eax
jmp 0x4d0fb1
Function at 0x4d1070
Capabilities:
Get file size
Read .ini file
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x59dc28
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push ebp
push esi
mov eax, dword [0x5f13cc]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [edi]
push eax
call fcn.00578327
xor esi, esi
xor ebp, ebp
add esp, 4
mov dword [edi], esi
mov dword [edi + 4], esi
mov dword [edi + 8], esi
mov dword [esp + 0x18], ebp
mov eax, dword [esp + 0x38]
push esi
push 0x80
push 3
push esi
push 7
mov dword [esp + 0x44], esi
mov eax, dword [eax]
push closesocket
push eax
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x4d1169
call fcn.004129d0
test eax, eax
jl 0x4d1152
push 0
lea ecx, [esp + 0x20]
push ecx
push 2
lea edx, [esp + 0x20]
push edx
push ebp
mov dword [esp + 0x30], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4d1108
call fcn.004129d0
lea eax, [esp + 0x20]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esp + 0x1c], eax
jne 0x4d112a
call fcn.004129d0
test eax, eax
jl 0x4d1130
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
mov ebx, eax
test ebp, ebp
je 0x4d1141
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebp, ebp
mov dword [esp + 0x18], ebp
mov ecx, ebx
or ecx, esi
jne 0x4d1174
test ebp, ebp
je 0x4d1152
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 8
mov ebp, eax
mov dword [esp + 0x18], ebp
jmp 0x4d10e6
cmp word [esp + 0x14], 0xfeff
jne 0x4d1183
shrd ebx, esi, 1
shr esi, 1
mov esi, ebx
add esi, 9
and esi, 0xfffffff8
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0057740a
mov ebx, eax
add esp, 4
lea eax, [esi + esi]
push eax
push 0
push ebx
call fcn.00580260
add esp, 0xc
test ebx, ebx
je 0x4d1147
mov ecx, dword [esp + 0x38]
mov eax, dword [ecx]
push eax
mov eax, dword [esp + 0x40]
lea edx, [esi - 2]
push edx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
cmp eax, esi
sbb esi, esi
neg esi
je 0x4d11e4
mov dword [edi], ebx
mov dword [edi + 4], eax
mov dword [edi + 8], ebx
jmp 0x4d11ed
push ebx
call fcn.0057832c
add esp, 4
test ebp, ebp
je 0x4d11f8
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 8
Function at 0x4d1210
Capabilities:
Get file size
Read .ini file
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x59dbf8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push edi
mov eax, dword [0x5f13cc]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov eax, dword [esi]
push eax
call fcn.00578327
xor edi, edi
add esp, 4
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esp + 0x18], edi
mov eax, dword [esp + 0x3c]
push edi
push 0x80
push 3
push edi
push 7
mov dword [esp + 0x48], edi
mov eax, dword [eax]
push closesocket
push eax
xor ebp, ebp
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x4d1309
call fcn.004129d0
test eax, eax
jl 0x4d12f2
push 0
lea ecx, [esp + 0x20]
push ecx
push 2
lea edx, [esp + 0x20]
push edx
push edi
mov dword [esp + 0x30], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4d12a8
call fcn.004129d0
lea eax, [esp + 0x20]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esp + 0x1c], eax
jne 0x4d12ca
call fcn.004129d0
test eax, eax
jl 0x4d12d0
mov eax, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
mov ebp, eax
test edi, edi
je 0x4d12e1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov dword [esp + 0x18], edi
mov ecx, ebp
or ecx, ebx
jne 0x4d1314
test edi, edi
je 0x4d12f2
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
add esp, 0x28
ret 4
mov edi, eax
mov dword [esp + 0x18], edi
jmp 0x4d1286
cmp word [esp + 0x14], 0xfeff
jne 0x4d1323
shrd ebp, ebx, 1
shr ebx, 1
xor ecx, ecx
mov eax, ebp
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0057740a
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4d12e7
mov eax, dword [esp + 0x3c]
mov eax, dword [eax]
push eax
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
cmp eax, ebp
sbb ebp, ebp
neg ebp
je 0x4d1365
mov dword [esi], ebx
mov dword [esi + 4], eax
mov dword [esi + 8], ebx
jmp 0x4d136e
push ebx
call fcn.0057832c
add esp, 4
test edi, edi
je 0x4d1379
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebp
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
add esp, 0x28
ret 4
Function at 0x4d1390
Capabilities:
Read .ini file

Disassembly:
push edi
mov edi, dword [eax]
mov eax, dword [esi]
mov edx, dword [eax - 8]
sub eax, 0x10
mov ecx, 1
sub ecx, dword [eax + 0xc]
sub edx, 0x402
or ecx, edx
jge 0x4d13b9
mov ecx, 0x402
mov eax, esi
call fcn.00403d50
mov eax, dword [esi]
mov ecx, dword [esp + 8]
push edi
mov edi, 0x400
push edi
push eax
push 0
push ecx
push str.UserDict
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, dword [esi]
cmp dword [eax - 8], edi
jl 0x4d1427
mov dword [eax - 0xc], edi
mov edx, dword [esi]
mov word [edx + 0x800], 0
mov edx, dword [esi]
test edx, edx
jne 0x4d13f4
xor eax, eax
jmp 0x4d1411
mov eax, edx
lea edi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4d1400
sub eax, edi
sar eax, 1
js 0x4d1427
cmp eax, dword [edx - 8]
jg 0x4d1427
mov dword [edx - 0xc], eax
mov ecx, dword [esi]
mov word [ecx + eax*2], 0
mov eax, esi
pop edi
ret 4
push 0x80070057
call fcn.00404550
int3

Function at 0x4d1580
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5a404e
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x5f13cc]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov eax, dword [0x5fcd20]
mov edx, dword [eax + 0xc]
mov ecx, 0x5fcd20
call edx
add eax, 0x10
mov dword [esi], eax
xor eax, eax
mov dword [esp + 0x14], eax
mov ecx, 0xa
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ecx
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], ecx
cmp edi, eax
mov byte [esp + 0x14], 2
mov byte [esi + 0x34], al
mov byte [esi + 0x35], al
je 0x4d1611
mov ecx, edi
lea ebx, [ecx + 2]
lea ecx, [ecx]
mov dx, word [ecx]
add ecx, 2
cmp dx, ax
jne 0x4d1600
sub ecx, ebx
sar ecx, 1
mov eax, ecx
mov ebx, eax
push edi
mov eax, esi
call fcn.00404050
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
jle 0x4d162c
mov ecx, edi
mov edx, esi
call fcn.004d1700
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x4d1cc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x59eb68
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x5f13cc]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [0x5fcd20]
mov edx, dword [eax + 0xc]
mov ecx, 0x5fcd20
call edx
add eax, 0x10
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 0x10]
push eax
push ecx
mov ecx, dword [esp + 0x30]
xor esi, esi
mov dword [esp + 0x28], esi
call fcn.004d1b90
cmp eax, esi
mov edi, dword [esp + 0x10]
je 0x4d1d2e
push 0xa
lea edx, [esp + 0x18]
push edx
push edi
call fcn.00578c22
add esp, 0xc
mov esi, eax
lea eax, [edi - 0x10]
mov dword [esp + 0x20], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4d1d52
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret 8
Function at 0x4d4730
Capabilities:
Get file size

Disassembly:
push 0xffffffffffffffff
push 0x59db48
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x5f13cc]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
xor edi, edi
mov dword [esp + 0xc], edi
mov eax, dword [esp + 0x28]
push edi
push 0x80
push 3
push edi
push 1
push closesocket
push eax
mov dword [esp + 0x3c], edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x4d4804
call fcn.004129d0
test eax, eax
jl 0x4d47f0
lea ecx, [esp + 0x14]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x10], esi
jne 0x4d47b0
call fcn.004129d0
test eax, eax
jl 0x4d47e5
mov esi, dword [esp + 0x10]
cmp esi, 0x5c
jb 0x4d47e5
push esi
call fcn.0057740a
add esp, 4
mov ecx, eax
lea edx, [esp + 0xc]
mov dword [ebx], eax
call fcn.0041ae30
mov ecx, dword [ebx]
push esi
call fcn.004d50d0
add esp, 4
test eax, eax
jne 0x4d480c
mov edx, dword [ebx]
push edx
call fcn.0057832c
add esp, 4
test edi, edi
je 0x4d47f0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret
mov edi, eax
mov dword [esp + 0xc], edi
jmp 0x4d478c
test edi, edi
je 0x4d4817
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret
Function at 0x4db650
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x54
mov eax, dword [0x5f13cc]
xor eax, esp
mov dword [esp + 0x4c], eax
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x2c]
xor ebp, ebp
cmp eax, ebp
je 0x4db68b
push 0xffffffffffffffff
push eax
mov byte [edi + 0x30], 1
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [edi + 0x2c]
cmp eax, ebp
je 0x4db68b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x2c], ebp
mov esi, dword [edi + 8]
cmp esi, ebp
je 0x4db697
call fcn.004d9df0
mov ebx, dword [edi + 0x28]
cmp ebx, ebp
lea esi, [edi + 0x28]
je 0x4db72f
push 0x3c
lea eax, [esp + 0x20]
push ebp
push eax
call fcn.00580260
mov edi, dword [edi + 8]
mov dword [esp + 0x24], 0x51554432
mov word [esp + 0x28], 3
mov word [esp + 0x2a], bp
mov ecx, dword [edi + 0x14]
mov dword [esp + 0x2c], ecx
mov edx, dword [edi + 0x18]
add esp, 0xc
mov dword [esp + 0x24], edx
mov eax, dword [edi + 0x1c]
push ebp
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x30], eax
mov ecx, dword [edi + 0x20]
push ebp
push ebx
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x4db708
call fcn.004129d0
mov edx, dword [esi]
push ebp
lea eax, [esp + 0x14]
push eax
push 0x40
lea ecx, [esp + 0x24]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4db727
call fcn.004129d0
push ebp
push 0x40
call fcn.00497690
mov ecx, dword [esp + 0x5c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005787fd
add esp, 0x54
ret

Function at 0x4dbf90
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push esi
mov esi, eax
mov eax, dword [esi]
test eax, eax
je 0x4dbfa6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
test edi, edi
jne 0x4dbfb8
add esi, 4
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
pop esi
ret
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4dbfd4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x4dbfd4
pop esi
jmp 0x4dbff0
push edi
add esi, 4
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x4dbfb4
pop esi
jmp fcn.004129d0
test eax, eax
jle 0x4dbffe
and eax, 0xffff
or eax, 0x80070000
ret
Function at 0x4dc000
Capabilities:
Get common file path

Disassembly:
sub esp, 0x420
mov eax, dword [0x5f13cc]
xor eax, esp
mov dword [esp + 0x41c], eax
mov eax, dword [esp + 0x424]
test eax, eax
jne 0x4dc072
lea eax, [esp + 0xc]
push eax
push 0x100
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x4dc04f
call fcn.004129d0
mov ecx, dword [esp + 0x41c]
xor ecx, esp
call fcn.005787fd
add esp, 0x420
ret 4
cmp eax, 0x100
jbe 0x4dc092
mov eax, 0x80020013
mov ecx, dword [esp + 0x41c]
xor ecx, esp
call fcn.005787fd
add esp, 0x420
ret 4
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x14]
push 0x104
push ecx
call fcn.00579003
push eax
call fcn.00404360
add esp, 0x14
cmp eax, 0x50
je 0x4dc056
lea edx, [esp + 0x214]
push edx
push 0
push 0x5ca2c0
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x4dc033
push esi
push 0xffffffffffffffff
lea ecx, [esp + 0x21c]
push ecx
lea esi, [edi + 4]
push 0x101
push esi
mov word [esp + 0x42e], 0
call fcn.00579003
push eax
call fcn.00404360
add esp, 0x14
push 0
push 0x2100
push 2
lea edx, [esp + 0x10]
push edx
push 0
push 0x40000000
push esi
mov dword [esp + 0x20], 0xc
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 1
mov dword [edi + 0x208], 0x40000000
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
pop esi
je 0x4dc033
mov ecx, dword [esp + 0x41c]
mov dword [edi], eax
xor ecx, esp
xor eax, eax
call fcn.005787fd
add esp, 0x420
ret 4