joyce8/EMBER2024-capa huggingface dataset:
Function at 0x247b5d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x24c2eb8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esp + 8], esi
mov dword [esi + 4], edi
mov dword [esi], edi
mov dword [esi + 8], edi
lea ecx, [esi + 0xc]
mov dword [esp + 0x14], edi
call fcn.024870a0
mov dword [esi + 0x30], 1
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x3c], edi
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x247c826
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x24c2ef8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.0247c720
xor edi, edi
lea ecx, [esi + 4]
mov dword [esp + 0x14], edi
call fcn.024870a0
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi], 0x24cc490
mov dword [esi + 0x38], edi
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x247cd90
Capabilities:
Accept command line arguments

Disassembly:
push ecx
call dword [sym.imp.kernel32.dll_GetCommandLineW]
test eax, eax
mov dword [esp], eax
jne 0x247cda1
pop ecx
ret
cmp word [eax], 0x22
jne 0x247cdcd
add eax, 2
mov edx, 0x22
lea ecx, [esp]
mov dword [esp], eax
call fcn.0247cb30
test eax, eax
jne 0x247cdc2
pop ecx
ret
add dword [esp], 2
mov eax, dword [esp]
pop ecx
ret
lea ecx, [esp]
call fcn.0247cb70
test eax, eax
jne 0x247cddc
pop ecx
ret
lea ecx, [esp]
call fcn.0247cbc0
test eax, eax
jne 0x247cdc7
pop ecx
ret
Function at 0x247d7c0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov edx, dword [esp + 0x3c]
xor eax, eax
push ebx
mov ebx, ecx
mov ecx, dword [esp + 0x3c]
mov dword [ebx + 0x11c], ecx
mov ecx, dword [esp + 0x44]
push esi
mov esi, dword [esp + 0x3c]
cmp esi, eax
mov dword [ebx + 0xc4], eax
mov dword [ebx + 0xc0], eax
mov dword [ebx + 0xc8], eax
mov dword [ebx + 0xcc], eax
mov dword [ebx + 0xd0], 1
mov dword [ebx + 0xdc], eax
mov dword [ebx + 0xe0], eax
mov dword [ebx + 0x120], edx
mov dword [ebx + 0x124], ecx
mov dword [ebx + 0xb4], eax
mov dword [ebx + 0xbc], eax
je 0x247d946
push ebp
push edi
or ecx, 0xffffffff
mov edi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebp, ecx
mov edi, eax
mov eax, dword [ebx + 0xac]
mov edi, ebp
cmp edi, eax
jbe 0x247d850
mov ecx, 0x24daf34
call fcn.0247f7e0
cmp edi, dword [ebx + 0xb0]
jbe 0x247d8a6
mov ecx, dword [ebx + 0xac]
mov edx, dword [ebx + 0xb8]
imul edx, ecx
mov eax, 0x51eb851f
mul edx
shr edx, 5
add edi, edx
cmp edi, ecx
jbe 0x247d879
mov edi, ecx
mov eax, dword [ebx + 0xa8]
push 0x40
push 0x1000
push edi
push eax
call dword [sym.imp.kernel32.dll_VirtualAlloc]
cmp dword [ebx + 0xa8], eax
je 0x247d8a0
mov ecx, 0x24daf0c
call fcn.0247f7e0
mov dword [ebx + 0xb0], edi
mov edi, dword [ebx + 0xb4]
add edi, dword [ebx + 0xa8]
mov ecx, ebp
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [ebx + 0xb4]
mov ecx, dword [ebx + 0xbc]
add edi, ebp
mov eax, edi
sub eax, ebp
cmp eax, ecx
mov dword [ebx + 0xb4], edi
je 0x247d8ea
mov ecx, 0x24dad4c
call fcn.0247f7e0
mov edx, dword [ebx + 0xbc]
add edx, ebp
mov eax, edx
sub eax, ebp
mov ebp, eax
mov eax, edx
cmp ebp, eax
mov dword [ebx + 0xbc], edx
jb 0x247d90e
mov ecx, 0x24dad88
call fcn.0247f7e0
or ecx, 0xffffffff
xor eax, eax
mov edi, esi
repne scasb al, byte es:[edi]
mov edi, dword [ebx + 0xa8]
mov edx, dword [esp + 0x40]
not ecx
dec ecx
mov eax, ecx
add edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x3c]
pop edi
mov dword [ebx + 0xc8], ecx
mov dword [ebx + 0xcc], edx
pop ebp
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x28]
push edx
mov edx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x28]
push edx
mov edx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x28]
push ecx
push edx
push eax
mov ecx, ebx
call fcn.02478420
pop esi
pop ebx
ret 0x40
Function at 0x247d990
Capabilities:
Allocate or change rwx memory

Disassembly:
mov edx, dword [esp + 0x3c]
xor eax, eax
push ebx
mov ebx, ecx
mov ecx, dword [esp + 0x3c]
mov dword [ebx + 0x11c], ecx
mov ecx, dword [esp + 0x44]
push esi
mov esi, dword [esp + 0x3c]
cmp esi, eax
mov dword [ebx + 0xc4], eax
mov dword [ebx + 0xc0], eax
mov dword [ebx + 0xc8], eax
mov dword [ebx + 0xcc], eax
mov dword [ebx + 0xd0], 1
mov dword [ebx + 0xdc], eax
mov dword [ebx + 0xe0], eax
mov dword [ebx + 0x120], edx
mov dword [ebx + 0x124], ecx
mov dword [ebx + 0xb4], eax
mov dword [ebx + 0xbc], eax
je 0x247db16
push ebp
push edi
or ecx, 0xffffffff
mov edi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebp, ecx
mov edi, eax
mov eax, dword [ebx + 0xac]
mov edi, ebp
cmp edi, eax
jbe 0x247da20
mov ecx, 0x24daf34
call fcn.0247f7e0
cmp edi, dword [ebx + 0xb0]
jbe 0x247da76
mov ecx, dword [ebx + 0xac]
mov edx, dword [ebx + 0xb8]
imul edx, ecx
mov eax, 0x51eb851f
mul edx
shr edx, 5
add edi, edx
cmp edi, ecx
jbe 0x247da49
mov edi, ecx
mov eax, dword [ebx + 0xa8]
push 0x40
push 0x1000
push edi
push eax
call dword [sym.imp.kernel32.dll_VirtualAlloc]
cmp dword [ebx + 0xa8], eax
je 0x247da70
mov ecx, 0x24daf0c
call fcn.0247f7e0
mov dword [ebx + 0xb0], edi
mov edi, dword [ebx + 0xb4]
add edi, dword [ebx + 0xa8]
mov ecx, ebp
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [ebx + 0xb4]
mov ecx, dword [ebx + 0xbc]
add edi, ebp
mov eax, edi
sub eax, ebp
cmp eax, ecx
mov dword [ebx + 0xb4], edi
je 0x247daba
mov ecx, 0x24dad4c
call fcn.0247f7e0
mov edx, dword [ebx + 0xbc]
add edx, ebp
mov eax, edx
sub eax, ebp
mov ebp, eax
mov eax, edx
cmp ebp, eax
mov dword [ebx + 0xbc], edx
jb 0x247dade
mov ecx, 0x24dad88
call fcn.0247f7e0
or ecx, 0xffffffff
xor eax, eax
mov edi, esi
repne scasb al, byte es:[edi]
mov edi, dword [ebx + 0xa8]
mov edx, dword [esp + 0x40]
not ecx
dec ecx
mov eax, ecx
add edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x3c]
pop edi
mov dword [ebx + 0xc8], ecx
mov dword [ebx + 0xcc], edx
pop ebp
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x28]
push edx
mov edx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x28]
push edx
mov edx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x28]
push ecx
push edx
push eax
mov ecx, ebx
call fcn.02478550
pop esi
pop ebx
ret 0x40
Function at 0x247fdb0
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x24c2f88
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
mov ebp, ecx
xor ebx, ebx
cmp ebp, ebx
push edi
mov esi, edx
je 0x247ff4e
cmp esi, ebx
je 0x247ff4e
call dword [sym.imp.kernel32.dll_GetVersion]
cmp eax, 0x80000000
push ebp
jae 0x247fea4
call dword [sym.imp.user32.dll_GetWindowTextLengthW]
mov edi, eax
mov eax, dword [esi + 4]
inc edi
test eax, eax
lea ebx, [edi + edi]
mov dword [esi], 0
je 0x247fe1d
push eax
call fcn.024ad03a
add esp, 4
mov dword [esi + 4], 0
test ebx, ebx
je 0x247ff4e
push ebx
call fcn.024acf00
add esp, 4
test eax, eax
mov dword [esi + 4], eax
je 0x247ff4e
mov dword [esi], ebx
mov word [eax], 0
mov eax, dword [esi + 4]
push edi
push eax
push ebp
call dword [sym.imp.user32.dll_GetWindowTextW]
mov ecx, dword [esi]
mov edx, dword [esi + 4]
shr ecx, 1
mov word [edx + ecx*2 - 2], 0
mov eax, dword [esi + 4]
push eax
call fcn.024adc6c
lea edi, [eax + eax + 2]
add esp, 4
test edi, edi
je 0x247ff4e
mov eax, dword [esi + 4]
push edi
push eax
call fcn.024ad835
add esp, 8
test eax, eax
je 0x247ff4e
mov dword [esi], edi
pop edi
mov dword [esi + 4], eax
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
call dword [sym.imp.user32.dll_GetWindowTextLengthA]
mov edi, eax
lea ecx, [esp + 0x10]
inc edi
call fcn.0247c320
mov eax, dword [esp + 0x14]
cmp eax, ebx
mov dword [esp + 0x10], ebx
je 0x247fecf
push eax
call fcn.024ad03a
add esp, 4
mov dword [esp + 0x14], ebx
cmp edi, ebx
je 0x247ff3d
push edi
call fcn.024acf00
add esp, 4
cmp eax, ebx
mov dword [esp + 0x14], eax
je 0x247ff3d
mov dword [esp + 0x10], edi
mov byte [eax], 0
mov ecx, dword [esp + 0x14]
push edi
push ecx
push ebp
call dword [sym.imp.user32.dll_GetWindowTextA]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov byte [edx + eax - 1], 0
mov ecx, dword [esp + 0x14]
mov edx, esi
call fcn.0247fc70
test eax, eax
mov dword [esp + 0x20], 0xffffffff
lea ecx, [esp + 0x10]
je 0x247ff49
call fcn.0247c7c0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov dword [esp + 0x20], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.0247c7c0
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x2480280
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x24c2fc8
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
xor ebx, ebx
cmp ecx, ebx
push esi
push edi
je 0x2480411
mov esi, dword [esp + 0x28]
cmp esi, ebx
je 0x2480411
push edx
push ecx
call dword [sym.imp.user32.dll_GetDlgItem]
mov ebp, eax
cmp ebp, ebx
je 0x2480411
call dword [sym.imp.kernel32.dll_GetVersion]
cmp eax, 0x80000000
push ebp
jae 0x2480378
call dword [sym.imp.user32.dll_GetWindowTextLengthW]
mov edi, eax
mov eax, dword [esi + 4]
inc edi
test eax, eax
lea ebx, [edi + edi]
mov dword [esi], 0
je 0x24802ff
push eax
call fcn.024ad03a
add esp, 4
mov dword [esi + 4], 0
test ebx, ebx
je 0x2480411
push ebx
call fcn.024acf00
add esp, 4
test eax, eax
mov dword [esi + 4], eax
je 0x2480411
mov dword [esi], ebx
mov word [eax], 0
mov eax, dword [esi + 4]
push edi
push eax
push ebp
call dword [sym.imp.user32.dll_GetWindowTextW]
mov ecx, dword [esi]
mov edx, dword [esi + 4]
shr ecx, 1
mov word [edx + ecx*2 - 2], 0
mov eax, dword [esi + 4]
push eax
call fcn.024adc6c
lea edi, [eax + eax + 2]
add esp, 4
test edi, edi
je 0x2480411
mov eax, dword [esi + 4]
push edi
push eax
call fcn.024ad835
add esp, 8
test eax, eax
je 0x2480411
mov dword [esi + 4], eax
mov dword [esi], edi
mov eax, 1
jmp 0x2480413
call dword [sym.imp.user32.dll_GetWindowTextLengthA]
mov edi, eax
lea ecx, [esp + 0x10]
inc edi
call fcn.0247c320
mov eax, dword [esp + 0x14]
cmp eax, ebx
mov dword [esp + 0x10], ebx
je 0x24803a3
push eax
call fcn.024ad03a
add esp, 4
mov dword [esp + 0x14], ebx
cmp edi, ebx
je 0x2480400
push edi
call fcn.024acf00
add esp, 4
cmp eax, ebx
mov dword [esp + 0x14], eax
je 0x2480400
mov dword [esp + 0x10], edi
mov byte [eax], 0
mov ecx, dword [esp + 0x14]
push edi
push ecx
push ebp
call dword [sym.imp.user32.dll_GetWindowTextA]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov byte [edx + eax - 1], 0
mov ecx, dword [esp + 0x14]
mov edx, esi
call fcn.0247fc70
test eax, eax
mov dword [esp + 0x20], 0xffffffff
lea ecx, [esp + 0x10]
je 0x248040c
call fcn.0247c7c0
mov eax, 1
jmp 0x2480413
mov dword [esp + 0x20], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.0247c7c0
xor eax, eax
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 4
Function at 0x2480ec0
Capabilities:
Get hostname

Disassembly:
sub esp, 0x24
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp esi, ebx
jne 0x2480ed5
pop esi
xor eax, eax
pop ebx
add esp, 0x24
ret
call dword [sym.imp.kernel32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x2480f23
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x10]
push ecx
mov word [esp + 0x14], bx
mov dword [esp + 0x10], 0x10
call dword [sym.imp.kernel32.dll_GetComputerNameW]
test eax, eax
jne 0x2480f09
pop esi
pop ebx
add esp, 0x24
ret
lea edx, [esp + 0xc]
mov ecx, esi
mov word [esp + 0x2a], bx
call fcn.0247f900
test eax, eax
jne 0x2480f62
pop esi
pop ebx
add esp, 0x24
ret
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x10]
push eax
mov byte [esp + 0x14], bl
mov dword [esp + 0x10], 0x10
call dword [sym.imp.kernel32.dll_GetComputerNameA]
test eax, eax
jne 0x2480f49
pop esi
pop ebx
add esp, 0x24
ret
mov edx, esi
lea ecx, [esp + 0xc]
mov byte [esp + 0x1b], bl
call fcn.0247fc70
test eax, eax
jne 0x2480f62
pop esi
pop ebx
add esp, 0x24
ret
pop esi
mov eax, 1
pop ebx
add esp, 0x24
ret

Function at 0x2480f70
Capabilities:
Get session user name

Disassembly:
sub esp, 0x208
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp esi, ebx
jne 0x2480f8b
pop esi
xor eax, eax
pop ebx
add esp, 0x208
ret
call dword [sym.imp.kernel32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x2480fe2
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x10]
push ecx
mov word [esp + 0x14], bx
mov dword [esp + 0x10], 0x101
call dword [sym.imp.advapi32.dll_GetUserNameW]
test eax, eax
jne 0x2480fc2
pop esi
pop ebx
add esp, 0x208
ret
lea edx, [esp + 0xc]
mov ecx, esi
mov word [esp + 0x20c], bx
call fcn.0247f900
test eax, eax
jne 0x248102a
pop esi
pop ebx
add esp, 0x208
ret
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x10]
push eax
mov byte [esp + 0x14], bl
mov dword [esp + 0x10], 0x101
call dword [sym.imp.advapi32.dll_GetUserNameA]
test eax, eax
jne 0x248100b
pop esi
pop ebx
add esp, 0x208
ret
mov edx, esi
lea ecx, [esp + 0xc]
mov byte [esp + 0x10c], bl
call fcn.0247fc70
test eax, eax
jne 0x248102a
pop esi
pop ebx
add esp, 0x208
ret
pop esi
mov eax, 1
pop ebx
add esp, 0x208
ret
Function at 0x2481110
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
mov eax, dword [esp + 8]
test eax, eax
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
jne 0x248112b
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 4
test ebx, 0xffff0000
je 0x248113d
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 4
mov eax, ebx
shr eax, 4
push 6
inc eax
push eax
push ebp
call dword [sym.imp.kernel32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x248115b
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
push esi
push ebp
call dword [sym.imp.kernel32.dll_SizeofResource]
mov edi, eax
test edi, edi
jne 0x2481171
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
push esi
push ebp
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
jne 0x2481185
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
push eax
call dword [sym.imp.kernel32.dll_LockResource_1]
mov esi, eax
test esi, esi
jne 0x248119a
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
and ebx, 0xf
mov edx, 0
jbe 0x24811c3
cmp edi, 2
jb 0x24811e8
xor eax, eax
mov ax, word [esi]
sub edi, 2
lea ecx, [eax + eax]
cmp edi, ecx
jb 0x24811e8
sub edi, ecx
inc edx
cmp edx, ebx
lea esi, [esi + eax*2 + 2]
jb 0x24811a4
cmp edi, 2
jae 0x24811d2
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 4
xor ebx, ebx
mov bx, word [esi]
add edi, 0xfffffffe
add esi, 2
lea eax, [ebx + ebx]
cmp edi, eax
mov dword [esp + 0x10], eax
jae 0x24811f2
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 4
mov ebp, dword [esp + 0x18]
mov eax, dword [ebp + 4]
test eax, eax
lea edi, [ebx + ebx + 2]
mov dword [ebp], 0
je 0x2481218
push eax
call fcn.024ad03a
add esp, 4
mov dword [ebp + 4], 0
test edi, edi
je 0x24811e8
push edi
call fcn.024acf00
add esp, 4
test eax, eax
mov dword [ebp + 4], eax
je 0x24811e8
test ebx, ebx
mov dword [ebp], edi
je 0x2481247
mov ecx, dword [esp + 0x10]
mov edx, ecx
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 4]
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov word [eax + ecx], 0
mov eax, 1
pop ebx
pop ecx
ret 4

Function at 0x2481890
Capabilities:
Clear file content
Write file on windows

Disassembly:
push ecx
test ecx, ecx
push ebx
push esi
push edi
mov edi, edx
je 0x2481906
test edi, edi
je 0x2481906
push 0
push 0x80
push 2
push 0
push 0
mov edx, 0x40000000
call fcn.02481ba0
mov esi, eax
cmp esi, 0xffffffff
je 0x2481906
mov ebx, dword [esp + 0x14]
push 0
lea eax, [esp + 0x10]
push eax
push ebx
push edi
push esi
mov dword [esp + 0x20], 0
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
push esi
je 0x2481900
call dword [sym.imp.kernel32.dll_SetEndOfFile]
test eax, eax
push esi
je 0x2481900
call dword [sym.imp.kernel32.dll_CloseHandle]
mov ecx, dword [esp + 0xc]
pop edi
xor eax, eax
cmp ecx, ebx
pop esi
sete al
pop ebx
pop ecx
ret 4
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 4
Function at 0x2481910
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
xor ebp, ebp
cmp ecx, ebp
push edi
mov esi, edx
je 0x24819d0
cmp esi, ebp
je 0x24819d0
push ebp
push 0x80
push 3
push ebp
push 3
mov edx, 0x80000000
call fcn.02481ba0
mov ebx, eax
cmp ebx, 0xffffffff
je 0x24819d0
lea eax, [esp + 0x10]
push eax
push ebx
mov dword [esp + 0x18], ebp
call dword [sym.imp.kernel32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x248196c
call dword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x24819c9
cmp dword [esp + 0x10], ebp
jne 0x24819c9
mov eax, dword [esi + 4]
cmp eax, ebp
mov dword [esi], ebp
je 0x2481987
push eax
call fcn.024ad03a
add esp, 4
mov dword [esi + 4], ebp
cmp edi, ebp
je 0x24819c9
push edi
call fcn.024acf00
add esp, 4
cmp eax, ebp
mov dword [esi + 4], eax
je 0x24819c9
push ebp
lea ecx, [esp + 0x18]
push ecx
push edi
push eax
push ebx
mov dword [esi], edi
mov dword [esp + 0x28], ebp
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x24819da
mov eax, dword [esi + 4]
cmp eax, ebp
mov dword [esi], ebp
je 0x24819c9
push eax
call fcn.024ad03a
add esp, 4
mov dword [esi + 4], ebp
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
cmp dword [esp + 0x14], edi
je 0x2481a06
mov eax, dword [esi + 4]
cmp eax, ebp
mov dword [esi], ebp
je 0x24819d0
push eax
call fcn.024ad03a
add esp, 4
pop edi
mov dword [esi + 4], ebp
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
Function at 0x2481a20
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 8
test ecx, ecx
push ebx
push ebp
push esi
push edi
mov ebp, edx
je 0x2481b4f
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x2481b4f
mov esi, dword [esp + 0x20]
test esi, esi
je 0x2481b4f
push 0
push 0x80
push 3
push 0
push 3
mov edx, 0x80000000
call fcn.02481ba0
mov edi, eax
cmp edi, 0xffffffff
je 0x2481b4f
lea eax, [esp + 0x20]
push eax
push edi
mov dword [esp + 0x28], 0
call dword [sym.imp.kernel32.dll_GetFileSize]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x2481a94
call dword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x2481b48
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x2481b48
cmp ebp, ebx
jae 0x2481b48
cmp dword [esp + 0x1c], ebx
ja 0x2481b48
xor eax, eax
xor edx, edx
mov ecx, ebp
add ecx, dword [esp + 0x1c]
adc eax, edx
cmp eax, edx
ja 0x2481b48
jb 0x2481acc
cmp ecx, ebx
ja 0x2481b48
xor ebx, ebx
push ebx
lea eax, [esp + 0x18]
push eax
push ebp
push edi
mov dword [esp + 0x24], ebx
call dword [sym.imp.kernel32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x2481aef
call dword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x2481b48
mov eax, dword [esi + 4]
cmp eax, ebx
mov dword [esi], ebx
je 0x2481b04
push eax
call fcn.024ad03a
add esp, 4
mov dword [esi + 4], ebx
mov ebx, dword [esp + 0x1c]
push ebx
call fcn.024acf00
xor ebp, ebp
add esp, 4
cmp eax, ebp
mov dword [esi + 4], eax
je 0x2481b48
push ebp
lea ecx, [esp + 0x14]
push ecx
push ebx
push eax
push edi
mov dword [esi], ebx
mov dword [esp + 0x24], ebp
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x2481b5b
mov eax, dword [esi + 4]
cmp eax, ebp
mov dword [esi], ebp
je 0x2481b48
push eax
call fcn.024ad03a
add esp, 4
mov dword [esi + 4], ebp
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 8
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
cmp dword [esp + 0x10], ebx
je 0x2481b89
mov eax, dword [esi + 4]
cmp eax, ebp
mov dword [esi], ebp
je 0x2481b4f
push eax
call fcn.024ad03a
add esp, 4
pop edi
mov dword [esi + 4], ebp
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 8
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret 8
Function at 0x2481d80
Capabilities:
Create directory

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp esi, ebx
push edi
mov edi, edx
je 0x2481e08
call dword [sym.imp.kernel32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x2481dbf
push edi
push esi
call dword [sym.imp.kernel32.dll_CreateDirectoryW]
test eax, eax
jne 0x2481e26
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xb7
je 0x2481e26
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
lea edx, [esp + 0xc]
mov ecx, esi
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
call fcn.0247fbd0
test eax, eax
je 0x2481df3
mov eax, dword [esp + 0x10]
push edi
push eax
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x2481e11
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xb7
je 0x2481e11
mov eax, dword [esp + 0x10]
cmp eax, ebx
mov dword [esp + 0xc], ebx
je 0x2481e08
push eax
call fcn.024ad03a
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x10]
cmp eax, ebx
mov dword [esp + 0xc], ebx
je 0x2481e26
push eax
call fcn.024ad03a
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 8
ret

Function at 0x2481e40
Capabilities:
Delete directory

Disassembly:
sub esp, 8
push esi
push edi
mov esi, ecx
xor edi, edi
cmp esi, edi
je 0x2481eb0
call dword [sym.imp.kernel32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x2481e6b
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
jne 0x2481ec5
pop edi
pop esi
add esp, 8
ret
lea edx, [esp + 8]
mov ecx, esi
mov dword [esp + 8], edi
mov dword [esp + 0xc], edi
call fcn.0247fbd0
test eax, eax
jne 0x2481e8c
mov eax, dword [esp + 0xc]
mov dword [esp + 8], edi
jmp 0x2481ea3
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.kernel32.dll_RemoveDirectoryA]
test eax, eax
mov eax, dword [esp + 0xc]
mov dword [esp + 8], edi
jne 0x2481eb8
cmp eax, edi
je 0x2481eb0
push eax
call fcn.024ad03a
add esp, 4
pop edi
xor eax, eax
pop esi
add esp, 8
ret
cmp eax, edi
je 0x2481ec5
push eax
call fcn.024ad03a
add esp, 4
pop edi
mov eax, 1
pop esi
add esp, 8
ret

Function at 0x2481ed0
Capabilities:
Delete file

Disassembly:
sub esp, 8
push esi
push edi
mov esi, ecx
xor edi, edi
cmp esi, edi
je 0x2481f40
call dword [sym.imp.kernel32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x2481efb
push esi
call dword [sym.imp.kernel32.dll_DeleteFileW]
test eax, eax
jne 0x2481f55
pop edi
pop esi
add esp, 8
ret
lea edx, [esp + 8]
mov ecx, esi
mov dword [esp + 8], edi
mov dword [esp + 0xc], edi
call fcn.0247fbd0
test eax, eax
jne 0x2481f1c
mov eax, dword [esp + 0xc]
mov dword [esp + 8], edi
jmp 0x2481f33
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
test eax, eax
mov eax, dword [esp + 0xc]
mov dword [esp + 8], edi
jne 0x2481f48
cmp eax, edi
je 0x2481f40
push eax
call fcn.024ad03a
add esp, 4
pop edi
xor eax, eax
pop esi
add esp, 8
ret
cmp eax, edi
je 0x2481f55
push eax
call fcn.024ad03a
add esp, 4
pop edi
mov eax, 1
pop esi
add esp, 8
ret