joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4225e8
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x42268f
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0x20006
push 0
push 0
push 0
mov eax, edi
call fcn.00406e8c
push eax
push esi
call sub.advapi32.dll_RegCreateKeyExW
test eax, eax
jne 0x422679
lea eax, [ebp - 4]
mov edx, dword [ebp + 8]
call fcn.00406820
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x422649
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, dword [ebp - 4]
push eax
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.00406e8c
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
sete al
mov ebx, eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x422696
lea eax, [ebp - 4]
call fcn.00406428
ret

Function at 0x4226a4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor ebx, ebx
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x20006
push 0
push 0
push 0
mov eax, edi
call fcn.00406e8c
push eax
push esi
call sub.advapi32.dll_RegCreateKeyExW
test eax, eax
jne 0x42270b
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push 0
mov eax, dword [ebp - 4]
call fcn.00406e8c
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
sete bl
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x42286c
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x422906
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00406428
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
mov eax, ebx
call fcn.00406e8c
push eax
call sub.kernel32.dll_CreateFileW
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4228f0
push 0
push ebx
call sub.kernel32.dll_GetFileSize
mov esi, eax
lea eax, [ebp - 4]
xor ecx, ecx
mov edx, esi
call fcn.00406c70
push 0
lea eax, [ebp - 8]
push eax
push esi
mov eax, dword [ebp - 4]
push eax
push ebx
call sub.kernel32.dll_ReadFile
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00406f3c
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42290d
lea eax, [ebp - 4]
call fcn.0040644c
ret
Function at 0x422914
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4229e2
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4229c5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.004091cc
push eax
call sub.shell32.dll_SHGetMalloc
test eax, eax
jne 0x4229a4
lea eax, [ebp - 8]
push eax
push esi
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
mov eax, ebx
mov edx, 0x104
call fcn.00406f8c
mov eax, dword [ebx]
call fcn.00406e8c
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetPathFromIDListW
test eax, eax
je 0x42299d
mov eax, dword [ebx]
call fcn.00406e8c
push eax
call sub.kernel32.dll_lstrlenW_1
mov edx, eax
mov eax, ebx
call fcn.00406f8c
jmp 0x4229a4
mov eax, ebx
call fcn.00406428
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4229cc
cmp dword [ebp - 8], 0
je 0x4229c4
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
ret
Function at 0x422dbc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x422fb4
push dword fs:[edx]
mov dword fs:[edx], esp
cmp eax, 8
ja case.0x422de4.0
jmp dword [eax*4 + 0x422deb]
push 0x104
lea eax, [ebp - 0x20e]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
test eax, eax
jle 0x422e3b
mov eax, ebx
lea edx, [ebp - 0x20e]
mov ecx, 0x105
call fcn.00406f20
jmp 0x422f9e
mov eax, ebx
call fcn.00406428
jmp 0x422f9e
mov eax, dword [0x443bf8]
cmp dword [eax], 0
jle 0x422e79
mov eax, dword [0x443bf8]
cmp dword [eax], 0x1d
jg 0x422e79
mov eax, ebx
mov edx, dword [0x443bf8]
mov edx, dword [edx]
lea edx, [edx + edx*8]
mov edx, dword [edx*4 + 0x43c6a8]
call fcn.004067d8
jmp 0x422f9e
mov eax, ebx
call fcn.00406428
jmp 0x422f9e
mov eax, dword [0x443bf8]
cmp dword [eax], 0
jle 0x422ebb
mov eax, dword [0x443bf8]
cmp dword [eax], 0x1d
jg 0x422ebb
mov eax, dword [0x443bf8]
mov eax, dword [eax]
lea eax, [eax + eax*8]
mov edx, dword [eax*4 + 0x43c6a8]
mov eax, ebx
mov ecx, 0x422fcc
call fcn.00407064
jmp 0x422f9e
mov eax, ebx
call fcn.00406428
jmp 0x422f9e
mov eax, ebx
mov edx, dword [0x443c08]
mov edx, dword [edx]
call fcn.004067d8
jmp 0x422f9e
lea eax, [ebp - 0x20e]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathW
test eax, eax
jle 0x422f07
mov eax, ebx
lea edx, [ebp - 0x20e]
mov ecx, 0x105
call fcn.00406f20
jmp 0x422f9e
mov eax, ebx
call fcn.00406428
jmp 0x422f9e
push 0x104
lea eax, [ebp - 0x20e]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
test eax, eax
jle 0x422f3c
mov eax, ebx
lea edx, [ebp - 0x20e]
mov ecx, 0x105
call fcn.00406f20
jmp 0x422f9e
mov eax, ebx
call fcn.00406428
jmp 0x422f9e
lea eax, [ebp - 4]
call fcn.004229f0
mov eax, dword [ebp - 4]
test eax, eax
je 0x422f59
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x422f9e
mov ecx, ebx
mov edx, 0x422fe8
mov eax, dword [ebp - 4]
call fcn.00423010
jmp 0x422f9e
lea eax, [ebp - 4]
call fcn.004229f0
mov eax, dword [ebp - 4]
test eax, eax
je 0x422f82
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x422f9e
mov ecx, ebx
mov edx, 0x422ffc
mov eax, dword [ebp - 4]
call fcn.00423010
jmp 0x422f9e
mov eax, ebx
call fcn.00406428
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x422fbb
lea eax, [ebp - 4]
call fcn.00406428
ret
Function at 0x4230b4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov byte [ebp - 9], 0
lea eax, [ebp - 0x10]
push eax
mov eax, esi
call fcn.00406e8c
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x423155
mov eax, ebx
call fcn.004043b4
mov dword [ebp - 0x14], eax
xor edx, edx
push ebp
push 0x42314e
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x14]
push eax
push ebx
push 0
push edi
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x423138
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x423160
mov eax, dword [ebp - 0x14]
push eax
call sub.version.dll_VerQueryValueW
mov eax, dword [ebp - 0x18]
mov edx, dword [eax + 0x10]
mov ecx, dword [ebp - 4]
mov dword [ecx], edx
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x423155
mov eax, dword [ebp - 0x14]
call fcn.004043d0
ret
movzx eax, byte [ebp - 9]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x423168
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd94
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x264], ecx
mov dword [ebp - 0x268], ecx
mov dword [ebp - 0x26c], ecx
mov dword [ebp - 0x25c], ecx
mov dword [ebp - 0x260], ecx
mov dword [ebp - 0x258], ecx
mov byte [ebp - 1], dl
mov edi, eax
xor eax, eax
push ebp
push 0x42333f
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x258]
mov ecx, 0x42335c
mov edx, edi
call fcn.00407064
mov eax, dword [ebp - 0x258]
call fcn.00406e8c
push eax
call sub.kernel32.dll_FindFirstFileW_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4232cf
test dword [ebp - 0x254], 0x10
jbe 0x423241
cmp word [ebp - 0x228], 0x2e
je 0x4232a0
push edi
push 0x423374
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x228]
mov ecx, 0x104
call fcn.00406f20
push dword [ebp - 0x260]
lea eax, [ebp - 0x25c]
mov edx, 3
call fcn.004070ec
mov eax, dword [ebp - 0x25c]
xor edx, edx
call fcn.00423168
or esi, eax
jmp 0x4232a0
push edi
push 0x423384
lea eax, [ebp - 0x26c]
lea edx, [ebp - 0x228]
mov ecx, 0x104
call fcn.00406f20
push dword [ebp - 0x26c]
lea eax, [ebp - 0x268]
mov edx, 3
call fcn.004070ec
mov eax, dword [ebp - 0x268]
call fcn.00406e8c
mov edx, eax
lea eax, [ebp - 0x264]
call fcn.00406ee4
mov eax, dword [ebp - 0x264]
call fcn.00414ef0
test al, al
jne 0x4232a0
or esi, 0x80000002
lea eax, [ebp - 0x254]
push eax
push ebx
call sub.kernel32.dll_FindNextFileW
test eax, eax
je 0x4232ba
cmp ebx, 0xffffffff
jne 0x4231e4
cmp ebx, 0xffffffff
je 0x4232cf
push ebx
call sub.kernel32.dll_FindClose_1
test eax, eax
jne 0x4232cf
or esi, 0x80000004
cmp byte [ebp - 1], 0
jne 0x42331f
lea eax, [ebp - 0x254]
push eax
mov eax, edi
call fcn.00406e8c
push eax
call sub.kernel32.dll_FindFirstFileW_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x423319
mov eax, edi
call fcn.00406e8c
push eax
call sub.kernel32.dll_RemoveDirectoryW
test eax, eax
jne 0x423307
or esi, 0x80000008
push ebx
call sub.kernel32.dll_FindClose_1
test eax, eax
jne 0x42331f
or esi, 0x80000010
jmp 0x42331f
or esi, 0x80000020
mov ebx, esi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x423346
lea eax, [ebp - 0x26c]
mov edx, 6
call fcn.00406488
ret

Function at 0x423388
Capabilities:
Create directory

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf4
mov esi, eax
mov ebx, esi
test ebx, ebx
je 0x42339f
sub ebx, 4
mov ebx, dword [ebx]
mov eax, esi
call fcn.00406e8c
inc ebx
mov ecx, ebx
add ecx, ecx
mov edx, esp
call fcn.00404558
mov ebx, esp
jmp 0x4233b9
add ebx, 2
mov edx, 0x42341c
movzx eax, word [ebx]
call fcn.00414170
test al, al
je 0x4233b6
movzx esi, word [ebx]
mov word [ebx], 0
mov eax, ebx
sub eax, 2
cmp word [eax], 0x3a
je 0x4233fe
push 0
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_CreateDirectoryW
mov ebp, eax
test ebp, ebp
jne 0x4233fe
call sub.kernel32.dll_GetLastError_2
mov ebp, eax
cmp ebp, 0xb7
jne 0x42340f
mov edi, esi
mov word [ebx], di
test di, di
je 0x42340d
add ebx, 2
jmp 0x4233b9
xor ebp, ebp
mov eax, ebp
add esp, 0x20c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x42343c
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebp, edx
push 0x4234e0
push eax
mov eax, dword [0x446c4c]
push eax
call sub.kernel32.dll_FindResourceW
mov ebx, eax
test ebx, ebx
jne 0x423463
call sub.kernel32.dll_GetLastError_2
mov esi, eax
jmp 0x4234d8
push ebx
mov eax, dword [0x446c4c]
push eax
call sub.kernel32.dll_SizeofResource
mov esi, eax
push ebx
mov eax, dword [0x446c4c]
push eax
call sub.kernel32.dll_LoadResource
push eax
call sub.kernel32.dll_LockResource
mov edi, eax
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
mov eax, ebp
call fcn.00406e8c
push eax
call sub.kernel32.dll_CreateFileW
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4234b4
call sub.kernel32.dll_GetLastError_2
mov esi, eax
jmp 0x4234d8
push 0
lea eax, [esp + 4]
push eax
push esi
push edi
push ebx
call sub.kernel32.dll_WriteFile_1
test eax, eax
jne 0x4234d0
call sub.kernel32.dll_GetLastError_2
mov esi, eax
jmp 0x4234d2
xor esi, esi
push ebx
call sub.kernel32.dll_CloseHandle_1
mov eax, esi
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4234ec
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4235cc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, esi
call fcn.00406820
mov eax, ebx
test eax, eax
je 0x423520
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x42353a
push dword [ebp - 4]
push 0x4235e8
push ebx
lea eax, [ebp - 4]
mov edx, 3
call fcn.004070ec
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.004048f4
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 1
mov word [ebp - 0x18], 0
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00406e8c
push eax
push 0
call sub.kernel32.dll_CreateProcessW
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x423597
call sub.kernel32.dll_GetLastError_2
mov ebx, eax
jmp 0x4235b6
push 0xffffffffffffffff
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4235d3
lea eax, [ebp - 4]
call fcn.00406428
ret
Function at 0x429440
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x429629
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x443bf8]
cmp dword [eax], 0
jg 0x429471
xor ebx, ebx
jmp 0x4295f9
mov eax, ebx
call fcn.004292f0
mov edx, dword [0x443bf8]
mov edx, dword [edx]
lea edx, [edx + edx*8]
mov ecx, dword [0x443b18]
lea edx, [ecx + edx*4]
mov eax, dword [edx + eax*4 - 0x14]
push eax
mov eax, ebx
call fcn.004292f8
lea edx, [ebp - 0x1c]
call fcn.00422dbc
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 4]
pop edx
call fcn.00423010
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.00429274
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0xc]
mov ecx, 0
call fcn.00406ce8
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.00406e8c
mov edi, eax
push edi
call sub.kernel32.dll_CreateFileW
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4294f6
xor ebx, ebx
jmp 0x4295f9
push 0
push ebx
call sub.kernel32.dll_GetFileSize
mov esi, eax
test esi, esi
jge 0x42950b
xor ebx, ebx
jmp 0x4295f9
lea eax, [ebp - 0x10]
xor ecx, ecx
mov edx, esi
call fcn.00406c70
push 0
lea eax, [ebp - 0x18]
push eax
push esi
mov eax, dword [ebp - 0x10]
push eax
push ebx
call sub.kernel32.dll_ReadFile
push ebx
call sub.kernel32.dll_CloseHandle_1
push 0
mov eax, dword [ebp - 0x10]
call fcn.00406bac
mov edx, eax
lea eax, [ebp - 0x14]
mov ecx, esi
call fcn.004065d4
mov eax, dword [ebp - 0x14]
call fcn.00406bac
push eax
call sub.user32.dll_CharLowerA
mov esi, dword [ebp - 0xc]
mov ebx, esi
test ebx, ebx
je 0x429560
sub ebx, 4
mov ebx, dword [ebx]
push 0
mov eax, dword [ebp - 0xc]
call fcn.00406bac
mov edx, eax
lea eax, [ebp - 8]
mov ecx, ebx
call fcn.004065d4
mov eax, dword [ebp - 8]
call fcn.00406bac
push eax
call sub.user32.dll_CharLowerA
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
call fcn.0042211c
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jle 0x4295f7
mov eax, esi
test eax, eax
je 0x4295a3
sub eax, 4
mov eax, dword [eax]
lea edx, [ebp - 0x10]
mov ecx, eax
mov eax, dword [ebp - 0x18]
xchg edx, eax
call fcn.00406c24
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push edi
call sub.kernel32.dll_CreateFileW
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4295d4
xor ebx, ebx
jmp 0x4295f9
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4295e0
sub eax, 4
mov eax, dword [eax]
push 0
lea edx, [ebp - 0x18]
push edx
push eax
mov eax, dword [ebp - 0x10]
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
push ebx
call sub.kernel32.dll_CloseHandle_1
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x429630
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00406488
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.004064b8
lea eax, [ebp - 4]
call fcn.00406428
ret
Function at 0x429d9c
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
xor eax, eax
push ebp
push 0x429e21
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 8]
mov eax, dword [0x443c08]
mov eax, dword [eax]
mov edx, 0x429e3c
call fcn.00423010
mov eax, dword [ebp - 8]
call fcn.00406e8c
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
lea ecx, [ebp - 4]
mov eax, dword [0x443c08]
mov eax, dword [eax]
mov edx, 0x429e54
call fcn.00423010
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004234ec
mov ebx, eax
mov eax, dword [0x443c08]
mov eax, dword [eax]
call fcn.00406e8c
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x429e28
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406488
ret
Function at 0x42adec
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42afe8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
mov eax, esi
call fcn.00406e8c
push eax
call sub.kernel32.dll_CreateFileW
mov esi, eax
cmp esi, 0xffffffff
jne 0x42ae3f
mov ebx, 0xfffffffe
jmp 0x42afca
push 0
push esi
call sub.kernel32.dll_GetFileSize
mov edi, eax
mov dword [ebx + 0xc], edi
test edi, edi
jg 0x42ae5a
mov ebx, 0xfffffffd
jmp 0x42afca
mov eax, edi
call fcn.004043b4
mov dword [ebx + 0x10], eax
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx + 0xc]
push eax
mov eax, dword [ebx + 0x10]
push eax
push esi
call sub.kernel32.dll_ReadFile
lea eax, [ebp - 4]
xor ecx, ecx
mov edx, 7
call fcn.00406c70
mov edx, dword [ebp - 4]
mov eax, edx
test eax, eax
je 0x42ae95
sub eax, 4
mov eax, dword [eax]
cmp eax, dword [ebx + 0xc]
jle 0x42aea4
mov ebx, 0xfffffffc
jmp 0x42afca
mov edi, edx
test edi, edi
je 0x42aeaf
sub edi, 4
mov edi, dword [edi]
mov eax, dword [ebp - 4]
call fcn.00406bac
mov edx, eax
mov eax, dword [ebx + 0x10]
mov ecx, edi
call fcn.00404558
lea eax, [ebp - 0x18]
push eax
mov ecx, 5
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00406bc4
mov eax, dword [ebp - 0x18]
mov edx, 0x42b004
call fcn.00406b2c
je 0x42aeec
mov al, 1
jmp 0x42af16
mov eax, dword [ebp - 4]
test eax, eax
je 0x42aef8
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 4]
movzx eax, byte [edx + eax - 2]
mov edx, 0x42b00c
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 0xc]
movzx eax, al
bt dword [edx], eax
setb al
xor al, 1
test al, al
je 0x42af1e
mov al, 1
jmp 0x42af48
mov eax, dword [ebp - 4]
test eax, eax
je 0x42af2a
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 4]
movzx eax, byte [edx + eax - 1]
mov edx, 0x42b00c
mov dword [ebp - 0x10], edx
mov edx, dword [ebp - 0x10]
movzx eax, al
bt dword [edx], eax
setb al
xor al, 1
test al, al
je 0x42af53
mov ebx, 0xfffffffc
jmp 0x42afca
mov eax, dword [ebp - 4]
mov edi, eax
test edi, edi
je 0x42af61
sub edi, 4
mov edi, dword [edi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x42af75
mov eax, dword [ebp - 0x14]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 4]
movzx edx, byte [edx + edi - 2]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x20]
call fcn.004069b4
lea eax, [ebp - 0x24]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
movzx edx, byte [edx + ecx - 1]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x24]
lea eax, [ebp - 0x20]
mov cl, 2
call fcn.004069c0
lea edx, [ebp - 0x20]
lea eax, [ebx + 0x24]
mov ecx, 0
call fcn.00406aa8
push esi
call sub.kernel32.dll_CloseHandle_1
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42afef
lea eax, [ebp - 0x18]
call fcn.0040644c
lea eax, [ebp - 4]
call fcn.0040644c
ret
Function at 0x42b928
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebx, edx
mov ebp, eax
mov eax, ebp
call fcn.0042b604
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
mov eax, ebx
call fcn.00406e8c
push eax
call sub.kernel32.dll_CreateFileW
mov esi, eax
cmp esi, 0xffffffff
je 0x42b9a8
push 0
push esi
call sub.kernel32.dll_GetFileSize
mov ebx, eax
test ebx, ebx
jl 0x42b9a8
lea eax, [ebx + 1]
call fcn.004043b4
mov edi, eax
push 0
lea eax, [esp + 4]
push eax
push ebx
push edi
push esi
call sub.kernel32.dll_ReadFile
lea eax, [ebx + edi]
mov byte [eax], 0
inc ebx
push esi
call sub.kernel32.dll_CloseHandle_1
mov edx, edi
mov eax, ebp
call fcn.0042b888
test ebx, ebx
jle 0x42b9a8
mov edx, ebx
mov eax, edi
call fcn.004043d0
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x42bafc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffff048
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x1fb8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x42bc58
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
mov eax, ebx
call fcn.00406e8c
push eax
call sub.kernel32.dll_CreateFileW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x42bc3f
xor ebx, ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
dec eax
test eax, eax
jl 0x42bc1b
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0xc]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x42bb86
sub eax, 4
mov eax, dword [eax]
mov esi, eax
mov eax, 0x1fa0
sub eax, ebx
lea edx, [esi + 2]
cmp eax, edx
jge 0x42bbaf
push 0
lea eax, [ebp - 0x10]
push eax
push ebx
lea eax, [ebp - 0x1fb4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_WriteFile_1
xor ebx, ebx
lea eax, [ebp - 0x1fb8]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 8]
mov ecx, dword [ebp - 0xc]
mov edx, dword [edx + ecx*4]
mov ecx, 0
call fcn.00406ce8
mov eax, dword [ebp - 0x1fb8]
call fcn.00406bac
lea edx, [ebp + ebx - 0x1fb4]
mov ecx, esi
call fcn.00404558
add ebx, esi
mov eax, dword [0x443a38]
call fcn.004068f4
mov ecx, eax
lea edx, [ebp + ebx - 0x1fb4]
mov eax, dword [0x443a38]
call fcn.00404558
mov eax, dword [0x443a38]
call fcn.004068f4
add ebx, eax
inc dword [ebp - 0xc]
dec dword [ebp - 0x14]
jne 0x42bb71
test ebx, ebx
jle 0x42bc36
push 0
lea eax, [ebp - 0x10]
push eax
push ebx
lea eax, [ebp - 0x1fb4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_WriteFile_1
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42bc5f
lea eax, [ebp - 0x1fb8]
call fcn.0040644c
ret
Function at 0x42bfec
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42c052
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, esi
call fcn.004068bc
mov edx, dword [ebx + 0x1c]
cmp edx, 0xffffffff
je 0x42c03a
mov eax, dword [ebp - 4]
test eax, eax
je 0x42c029
sub eax, 4
mov eax, dword [eax]
push 0
lea ecx, [ebp - 8]
push ecx
push eax
mov eax, dword [ebp - 4]
push eax
push edx
call sub.kernel32.dll_WriteFile_1
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42c059
lea eax, [ebp - 4]
call fcn.0040644c
ret