joyce8/EMBER2024-capa huggingface dataset:
Function at 0xd33f20
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ecx
push ebp
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebp, eax
test ebp, ebp
mov dword [esp + 4], ebp
je 0xd33fd7
mov eax, dword [esp + 0xc]
push esi
push 0xf01ff
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0xd33fcf
push ebx
push edi
push 0xd57770
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
test eax, eax
je 0xd33fae
push 0x3e8
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
push 0xd57770
push esi
call ebx
test eax, eax
je 0xd33fae
mov ebp, 3
cmp dword [0xd57774], ebp
jne 0xd33faa
push 0x3e8
call edi
push 0xd57770
push esi
call ebx
test eax, eax
jne 0xd33f8f
mov ebp, dword [esp + 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
call ebx
test eax, eax
jne 0xd33fc6
push 0x64
call edi
push esi
call ebx
test eax, eax
je 0xd33fbb
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
pop ebp
pop ecx
ret
Function at 0xd37e00
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0xd4d8f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov ecx, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x24]
lea eax, [esp + 4]
push edi
xor edi, edi
push eax
push 0x20019
push edi
push esi
push ecx
mov dword [esp + 0x1c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
je 0xd37ed2
lea edx, [esp + 0x24]
push eax
push edx
call fcn.00d347a0
add esp, 8
mov eax, dword [esp + 0x24]
mov dword [esp + 0x1c], edi
cmp eax, edi
je 0xd37e61
mov edx, dword [eax]
jmp 0xd37e63
xor edx, edx
xor ecx, ecx
push edi
xor eax, eax
push edx
push ecx
mov ecx, dword [esp + 0x38]
push eax
lea eax, [esp + 0x1c]
mov edx, dword [ecx + 4]
push eax
push esi
push 2
push edx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
call fcn.00d36050
mov eax, dword [esp + 0x44]
add esp, 0x20
cmp eax, edi
mov dword [esp + 0x1c], 0xffffffff
je 0xd37ebf
mov esi, eax
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0xd37ebf
cmp esi, edi
je 0xd37ebf
mov ecx, esi
call fcn.00d2fa00
push esi
call fcn.00d3d1c8
add esp, 4
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
push edi
lea eax, [esp + 0x2c]
push edi
push eax
call fcn.00d34990
add esp, 0xc
mov eax, dword [esp + 0x28]
mov dword [esp + 0x1c], 1
cmp eax, edi
je 0xd37ef5
mov eax, dword [eax]
jmp 0xd37ef7
xor eax, eax
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x2c]
push ebx
push esi
push eax
push ecx
push edx
call fcn.00d33640
add esp, 0x10
mov bl, al
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x2c]
cmp eax, edi
je 0xd37f25
mov eax, dword [eax]
jmp 0xd37f27
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [esp + 0x2c]
mov dword [esp + 0x20], 0xffffffff
cmp esi, edi
je 0xd37f76
lea ecx, [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0xd37f76
cmp esi, edi
je 0xd37f76
mov eax, dword [esi]
cmp eax, edi
je 0xd37f5d
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
cmp eax, edi
je 0xd37f6d
push eax
call fcn.00d3d1c8
add esp, 4
push esi
call fcn.00d3d1c8
add esp, 4
mov ecx, dword [esp + 0x18]
mov al, bl
pop ebx
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0xd37f90
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x208
lea eax, [esp]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push ebp
push esi
push edi
xor edi, edi
push 0x104
push eax
push edi
push SysStringLen
call ebx
mov esi, dword [esp + 0x21c]
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0xd37ffb
mov ecx, dword [esi + 8]
push 0
push ecx
call ebp
test eax, eax
je 0xd38035
lea edx, [esp + 0x10]
push esi
push edx
push SysStringLen
call fcn.00d37e00
add esp, 0xc
lea eax, [esp + 0x10]
inc edi
push 0x104
push eax
push edi
push SysStringLen
call ebx
test eax, eax
je 0xd37fc5
mov edi, 0xd528b0
mov ecx, dword [esi + 8]
push 0
push ecx
call ebp
test eax, eax
je 0xd38035
mov edx, dword [edi]
push esi
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00d37e00
add edi, 4
add esp, 0xc
cmp edi, 0xd528c0
jb 0xd38000
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x208
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x208
ret

Function at 0xd38070
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x250
push esi
push edi
mov edi, dword [esp + 0x25c]
push 0x5c
push edi
call fcn.00d3e082
mov esi, eax
add esp, 8
test esi, esi
je 0xd38107
lea eax, [esp + 8]
mov word [esi], 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0xd38102
push ebx
lea ebx, [esi + 2]
push ebp
lea ecx, [esp + 0x3c]
push ebx
push ecx
call fcn.00d3d946
add esp, 8
test eax, eax
je 0xd380e3
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea edx, [esp + 0x10]
push edx
push edi
call ebp
test eax, eax
je 0xd380e8
lea eax, [esp + 0x3c]
push ebx
push eax
call fcn.00d3d946
add esp, 8
test eax, eax
jne 0xd380c5
mov word [esi], 0x5c
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp word [esi], 0
pop ebp
pop ebx
je 0xd38102
pop edi
mov al, 1
pop esi
add esp, 0x250
ret
mov word [esi], 0x5c
pop edi
xor al, al
pop esi
add esp, 0x250
ret
Function at 0xd38f10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0xd4d9fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0xd39002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.00d3cdff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0xd39002
lea edx, [esp + 0x14]
push edx
push str.Mounting__s_n
call fcn.00d346e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.00d3d20b
push 0x10
call fcn.00d3d1d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0xd38fc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.00d291c0
jmp 0xd38fc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.00d38b80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0xd38ff0
mov ecx, edi
call fcn.00d292c0
push edi
call fcn.00d3d1c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0xd39021
inc ebx
cmp ebx, 0x20
jb 0xd38f3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0xd3a250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xd4e808
push 0xd3e288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0xd3a329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0xd3a329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00d3d1d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0xd3a329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0xd3a329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0xd3a32c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.00d3a351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xd3ad20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xd3ad58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0xd3ad60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xd3ad94
mov eax, dword [esp + 0x14]
test eax, eax
je 0xd3ad94
push eax
push esi
call fcn.00d3d20b
add esp, 8
pop esi
ret 0x10

Function at 0xd3ada0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xd3ae22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0xd3ae15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0xd53320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00d3cdff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0xd3adda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0xd3ae30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xd3aec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0xd3aeb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0xd53320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00d3cdff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0xd3aeab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0xd3ae6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0xd3b000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0xd3b131
push esi
call fcn.00d3e145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00d2d080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0xd3b131
push 0
push ebp
call fcn.00d2d3a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00d2d260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0xd3b08b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.00d2d2f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0xd3b121
push 0xd53918
push edi
call fcn.00d3c3f0
push eax
push ebx
push esi
call fcn.00d3af60
push 0xd538f8
push edi
call fcn.00d3c3f0
push eax
push ebx
push esi
call fcn.00d3af60
push 0xd538d8
push edi
call fcn.00d3c3f0
push eax
push ebx
push esi
call fcn.00d3af60
push 0xd538c0
push edi
call fcn.00d3c3f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00d3af60
push 0xd538a0
push edi
call fcn.00d3c3f0
push eax
push ebx
push esi
call fcn.00d3af60
push 0xd53888
push edi
call fcn.00d3c3f0
push eax
push ebx
push esi
call fcn.00d3af60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0xd3c1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00d3c140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00d3c140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00d3c140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00d3c140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xd3cbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xd3cc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xd4e87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xd3cc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xd3cc52
xor eax, eax
pop esi
leave
ret 4

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x7d253e6e
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x4f0a336b
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x40295b
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x4121c4], 0
jne 0x402969
call fcn.00402931
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
push edi
test esi, esi
jbe 0x402996
test cl, 7
je 0x402996
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x4121c0]
dec esi
inc ecx
jmp 0x402977
cmp esi, 8
jb 0x402a1a
mov edi, esi
shr edi, 3
xor eax, dword [ecx]
add ecx, 8
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4121c0]
sub esi, 8
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4121c0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4121c0]
mov edx, eax
movzx eax, dl
mov eax, dword [eax*4 + 0x4121c0]
xor eax, dword [ecx - 4]
shr edx, 8
xor eax, edx
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4121c0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4121c0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4121c0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4121c0]
dec edi
jne 0x4029a0
xor edx, edx
test esi, esi
jbe 0x402a3a
push ebx
movzx edi, byte [edx + ecx]
movzx ebx, al
xor edi, ebx
shr eax, 8
xor eax, dword [edi*4 + 0x4121c0]
inc edx
cmp edx, esi
jb 0x402a21
pop ebx
pop edi
pop esi
ret 0xc

Function at 0x404091
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x24c0
call fcn.00401200
push ebx
push esi
push edi
lea ecx, [ebp - 0x24c0]
call fcn.00402e5c
mov edi, dword [ebp + 8]
xor ebx, ebx
push ebx
lea eax, [ebp - 0x24c0]
push eax
push dword [ebp + 0xc]
push edi
call fcn.0040553c
test al, al
je 0x40422a
cmp byte [ebp - 0x24c0], bl
je 0x40422a
cmp byte [ebp - 0x1840], bl
je 0x40422a
lea eax, [ebp - 0x1840]
push eax
lea eax, [ebp - 0x24c0]
push eax
call fcn.004068e9
push eax
call fcn.0040b959
test eax, eax
je 0x40422a
lea eax, [ebp - 0x1840]
push eax
push edi
call fcn.004068e9
push eax
call fcn.0040b959
test eax, eax
jne 0x40422a
mov esi, 0x400
push esi
push edi
lea eax, [ebp - 0x400]
push eax
call fcn.0040ba35
push ebx
push str.rtmp_d
lea eax, [ebp - 0x400]
push eax
call fcn.004068e9
push eax
call fcn.00408abc
add esp, 0xc
push 0
lea eax, [ebp - 0x400]
push eax
call fcn.00404c5e
test al, al
je 0x404169
add ebx, 0x7b
cmp ebx, 0x2710
jl 0x404123
push 0
lea eax, [ebp - 0x400]
push eax
call fcn.00404c5e
test al, al
jne 0x40422a
push esi
push edi
lea eax, [ebp - 0x800]
push eax
call fcn.0040ba35
lea eax, [ebp - 0x24c0]
push eax
call fcn.004068e9
push eax
lea eax, [ebp - 0x800]
push eax
call fcn.004068e9
push eax
call fcn.00408923
mov esi, dword [sym.imp.KERNEL32.DLL_MoveFileA]
lea eax, [ebp - 0x400]
push eax
lea eax, [ebp - 0x800]
push eax
call esi
test eax, eax
je 0x40422a
lea ecx, [ebp - 0x1420]
call fcn.0040440b
push 0
push edi
xor bl, bl
call fcn.00404c5e
test al, al
jne 0x4041f1
push 1
push 0
push edi
lea ecx, [ebp - 0x1420]
call fcn.00404720
mov bl, al
lea eax, [ebp - 0x800]
push eax
lea eax, [ebp - 0x400]
push eax
call esi
test bl, bl
je 0x40421b
lea ecx, [ebp - 0x1420]
call fcn.00404476
lea ecx, [ebp - 0x1420]
call fcn.004044f4
lea ecx, [ebp - 0x1420]
call fcn.004045bc
mov al, 1
jmp 0x40422c
xor al, al
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4045df
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esi + 0xc18], ebx
cmp byte [esi + 0x16], bl
je 0x4045f9
mov byte [ebp + 0x10], 1
mov dword [ebp - 4], 0x80000000
cmp byte [ebp + 0x14], bl
je 0x40460c
mov dword [ebp - 4], 0xc0000000
mov dword [ebp + 0x14], 1
cmp byte [ebp + 0x10], bl
je 0x40461f
mov dword [ebp + 0x14], 3
xor eax, eax
cmp byte [esi + 0x15], bl
setne al
dec eax
and eax, 0x8000000
mov edi, eax
call fcn.0040639c
test eax, eax
je 0x404658
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x404658
cmp word [eax], bx
je 0x404658
push ebx
push edi
push 3
push ebx
push dword [ebp + 0x14]
push dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
jmp 0x40466c
push ebx
push edi
push 3
push ebx
push dword [ebp + 0x14]
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x404688
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 2
jne 0x404688
mov dword [esi + 0xc18], 1
cmp edi, 0xffffffff
setne byte [ebp + 0x13]
mov byte [esi + 0x12], bl
mov dword [esi + 0xc], ebx
mov byte [esi + 0x10], bl
cmp byte [ebp + 0x13], bl
je 0x4046ea
mov dword [esi + 4], edi
cmp dword [ebp + 0xc], ebx
je 0x4046b6
push dword [ebp + 0xc]
lea eax, [esi + 0x418]
push eax
call fcn.0040c25e
jmp 0x4046bf
xor eax, eax
mov word [esi + 0x418], ax
lea eax, [esi + 0x17]
cmp dword [ebp + 8], ebx
je 0x4046d2
push dword [ebp + 8]
push eax
call fcn.00408923
jmp 0x4046e0
push 0x1000000
push eax
push dword [ebp + 0xc]
call fcn.0040c06b
push dword [esi + 4]
mov ecx, esi
call fcn.0040444f
mov al, byte [ebp + 0x13]
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x4047e1
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0xc], 1
mov esi, 0x4e20
jne 0x404807
cmp dword [ebp + 0xc], esi
jbe 0x4047fc
mov dword [ebp + 0xc], esi
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
mov dword [edi + 4], eax
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x404857
mov ecx, edi
call fcn.00404599
test al, al
je 0x40483d
cmp dword [ebp + 0xc], esi
jbe 0x40483d
push esi
push dword [ebp + 8]
mov ecx, edi
call fcn.004047e1
jmp 0x40485a
cmp dword [edi + 0xc], 1
jne 0x404852
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x6d
jne 0x404852
xor eax, eax
jmp 0x40485a
or eax, 0xffffffff
jmp 0x40485a
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 8
Function at 0x404a94
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0
push esi
mov esi, ecx
je 0x404b94
mov eax, dword [esi + 0xc]
test eax, eax
je 0x404ac1
dec eax
je 0x404ab6
dec eax
jne 0x404ac1
push 0xfffffffffffffff4
jmp 0x404ab8
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
mov dword [esi + 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_WriteFile]
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [esi + 0xc], edi
je 0x404b10
cmp dword [ebp + 0xc], edi
jbe 0x404b2b
mov ecx, dword [ebp + 0xc]
sub ecx, edi
mov eax, 0x4000
cmp ecx, eax
jae 0x404ae8
mov eax, ecx
push 0
lea ecx, [ebp - 4]
push ecx
push eax
mov eax, dword [ebp + 8]
add eax, edi
push eax
push dword [esi + 4]
call ebx
dec eax
neg eax
sbb al, al
inc al
je 0x404b2b
add edi, 0x4000
cmp edi, dword [ebp + 0xc]
jb 0x404ad8
jmp 0x404b27
push edi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 4]
call ebx
dec eax
neg eax
sbb al, al
inc al
test al, al
jne 0x404b8e
cmp byte [esi + 0x14], 0
je 0x404b8e
cmp dword [esi + 0xc], 0
jne 0x404b8e
push 0
lea eax, [esi + 0x17]
mov edi, 0x412c7c
push eax
mov ecx, edi
call fcn.00402cc4
test al, al
je 0x404b81
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
jae 0x404ac9
test eax, eax
jbe 0x404ac9
push 0
mov ecx, esi
call fcn.00404524
mov ecx, dword [ebp - 4]
xor edi, edi
sub eax, ecx
sbb edx, edi
push edx
push eax
mov ecx, esi
call fcn.004049fc
jmp 0x404ac9
lea eax, [esi + 0x17]
push eax
push 0
mov ecx, edi
call fcn.00402e31
pop edi
mov byte [esi + 8], 1
pop ebx
pop esi
leave
ret 8

Function at 0x404c5e
Capabilities:
Get file attributes

Disassembly:
call fcn.0040639c
test eax, eax
je 0x404c7e
mov eax, dword [esp + 8]
test eax, eax
je 0x404c7e
cmp word [eax], 0
je 0x404c7e
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
jmp 0x404c88
push dword [esp + 4]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
ret 8

Function at 0x404cb2
Capabilities:
Get file attributes

Disassembly:
call fcn.0040639c
test eax, eax
je 0x404cd2
mov eax, dword [esp + 8]
test eax, eax
je 0x404cd2
cmp word [eax], 0
je 0x404cd2
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
jmp 0x404cdc
push dword [esp + 4]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
ret 8

Function at 0x404cdf
Capabilities:
Set file attributes

Disassembly:
call fcn.0040639c
test eax, eax
je 0x404d03
mov eax, dword [esp + 8]
test eax, eax
je 0x404d03
cmp word [eax], 0
je 0x404d03
push dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
jmp 0x404d11
push dword [esp + 0xc]
push dword [esp + 8]
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
test eax, eax
setne al
ret 0xc