joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408da0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], ebx
mov ebx, 1
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], 0
push 1
push 0x6d9150
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x408e2c
mov eax, 0x51eb851f
mov ecx, ebx
imul ebx
sar edx, 5
mov eax, ebx
sar ecx, 0x1f
sub edx, ecx
imul esi, edx, 0x64
sub eax, esi
jne 0x408e2c
cmp ebx, 0x15f90
jl 0x408e23
cmp ebx, 0x1d4c0
jge 0x408e00
mov eax, 0x32
jmp 0x408e25
cmp ebx, 0x2bf20
jge 0x408e0f
mov eax, 0x64
jmp 0x408e25
mov eax, 0x1482
cmp ebx, 0x57d78
jl 0x408e25
mov eax, 0xfa
jmp 0x408e25
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 4]
test eax, eax
je 0x408e40
inc ebx
cmp ebx, 0x57e40
jl 0x408db8
mov eax, dword [ebp - 4]
test eax, eax
je 0x408e5a
mov dword [ebp - 0x14], 0x98
lea eax, [ebp - 0x14]
push eax
call fcn.00425070
add esp, 4
mov eax, dword [0x6d9154]
test eax, eax
jne 0x408e90
cmp dword [0x4f8660], 1
je 0x408f14
xor ebx, ebx
xor esi, esi
cmp dword [0x6d914c], 0
je 0x408ed4
mov dword [0x6d9154], 1
cmp dword [0x4f8660], 1
je 0x408ebf
mov dword [0x6d9150], 0
push dword [0x6d9148]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x408f32
mov edx, dword [ebp + 8]
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov dword [edx], eax
xor eax, eax
mov esp, ebp
pop ebp
ret
push esi
push 2
call fcn.00466870
push ebx
push 0x16
call fcn.00466870
add esp, 0x10
jmp 0x408e90
mov dword [0x6d914c], 1
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x6d9148], eax
cmp eax, 0xffffffff
jne 0x408ef8
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x408e7d
push 0x408d30
call fcn.00467290
push 0x408cf0
call fcn.00467290
add esp, 8
jmp 0x408e7d
push 1
push 2
call fcn.00466870
mov esi, eax
push 1
push 0x16
call fcn.00466870
add esp, 0x10
mov ebx, eax
jmp 0x408e74
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x70
call fcn.004250b0
add esp, 0xc
test eax, eax
je 0x408f5c
mov edx, dword [ebp + 8]
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov dword [edx], 0
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov edx, 0x70
mov ecx, dword [edx + 0x4f85bc]
mov dword [eax + edx - 4], ecx
mov ebx, dword [edx + 0x4f85b8]
mov dword [eax + edx - 8], ebx
mov esi, dword [edx + 0x4f85b4]
mov dword [eax + edx - 0xc], esi
mov ecx, dword [edx + 0x4f85b0]
mov dword [eax + edx - 0x10], ecx
sub edx, 0x10
jne 0x408f64
push dword [ebp - 0x10]
push dword [0x6d9148]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [ebp - 0x10]
jmp 0x408eae
Function at 0x408fb0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], ebx
mov ebx, 1
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], 0
push 1
push 0x6d9150
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x40903c
mov eax, 0x51eb851f
mov ecx, ebx
imul ebx
sar edx, 5
mov eax, ebx
sar ecx, 0x1f
sub edx, ecx
imul esi, edx, 0x64
sub eax, esi
jne 0x40903c
cmp ebx, 0x15f90
jl 0x409033
cmp ebx, 0x1d4c0
jge 0x409010
mov eax, 0x32
jmp 0x409035
cmp ebx, 0x2bf20
jge 0x40901f
mov eax, 0x64
jmp 0x409035
mov eax, 0x1482
cmp ebx, 0x57d78
jl 0x409035
mov eax, 0xfa
jmp 0x409035
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 4]
test eax, eax
je 0x409050
inc ebx
cmp ebx, 0x57e40
jl 0x408fc8
mov eax, dword [ebp - 4]
test eax, eax
je 0x40906a
mov dword [ebp - 0x14], 0x98
lea eax, [ebp - 0x14]
push eax
call fcn.00425070
add esp, 4
mov eax, dword [0x6d9154]
test eax, eax
jne 0x4090a0
cmp dword [0x4f8660], 1
je 0x409139
xor ebx, ebx
xor esi, esi
cmp dword [0x6d914c], 0
je 0x4090f6
mov dword [0x6d9154], 1
cmp dword [0x4f8660], 1
je 0x4090e1
mov dword [0x6d9150], 0
push dword [0x6d9148]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
test ebx, ebx
je 0x409177
mov eax, dword [ebp + 8]
mov dword [eax], ebx
cmp dword [0x4f8660], 1
je 0x409157
xor eax, eax
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
push esi
push 2
call fcn.00466870
push ebx
push 0x16
call fcn.00466870
add esp, 0x10
jmp 0x4090a0
mov dword [0x6d914c], 1
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x6d9148], eax
cmp eax, 0xffffffff
jne 0x40911d
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x40908d
push 0x408d30
call fcn.00467290
push 0x408cf0
call fcn.00467290
add esp, 8
jmp 0x40908d
push 1
push 2
call fcn.00466870
mov esi, eax
push 1
push 0x16
call fcn.00466870
add esp, 0x10
mov ebx, eax
jmp 0x409084
push 1
push 2
call fcn.00466870
push 1
push 0x16
mov dword [ebx + 0x64], eax
call fcn.00466870
add esp, 0x10
mov dword [ebx + 0x68], eax
jmp 0x4090d5
lea eax, [ebp - 0x10]
push eax
push 0
push 0x70
call fcn.004250b0
add esp, 0xc
test eax, eax
je 0x40919e
mov edx, dword [ebp + 8]
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov dword [edx], 0
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov edx, 0x70
mov ecx, dword [edx + 0x4f85bc]
mov dword [eax + edx - 4], ecx
mov ebx, dword [edx + 0x4f85b8]
mov dword [eax + edx - 8], ebx
mov esi, dword [edx + 0x4f85b4]
mov dword [eax + edx - 0xc], esi
mov ecx, dword [edx + 0x4f85b0]
mov dword [eax + edx - 0x10], ecx
sub edx, 0x10
jne 0x4091a6
push dword [ebp - 0x10]
push dword [0x6d9148]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ebx, dword [ebp - 0x10]
jmp 0x4090c3
Function at 0x40e990
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], ebx
mov ebx, eax
mov dword [ebp - 0x10], edi
mov edx, dword [ebx + 0x13c]
test edx, edx
mov ecx, edx
mov eax, dword [ebx + 0x38]
mov edi, dword [ebx + 0x40]
jne 0x40e9b5
mov ecx, 0x20000
sub edi, eax
cmp edi, ecx
ja 0x40e9e3
push 0
lea edx, [ebp - 8]
push edx
push edi
push eax
push dword [ebx + 0xe4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0xffffffff
test eax, eax
je 0x40ea58
mov ecx, 1
jmp 0x40ea58
test edx, edx
mov ecx, edi
mov dword [ebp - 0x18], edi
mov edi, eax
jne 0x40e9f3
mov edx, 0x20000
mov dword [ebp - 4], edx
mov dword [ebp - 0x14], esi
mov esi, ecx
push 0
lea edx, [ebp - 8]
push edx
push dword [ebp - 4]
push edi
push dword [ebx + 0xe4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40ea22
mov edi, dword [ebp - 0x18]
mov ecx, 0xffffffff
mov esi, dword [ebp - 0x14]
jmp 0x40ea58
mov edx, dword [ebx + 0x13c]
test edx, edx
mov eax, dword [ebp - 8]
jne 0x40ea34
mov edx, 0x20000
sub esi, eax
add edi, eax
cmp esi, edx
jae 0x40ea45
mov dword [ebp - 4], esi
test esi, esi
jne 0x40ea49
jmp 0x40ea4d
test esi, esi
je 0x40ea4d
test eax, eax
ja 0x40e9fb
mov edi, dword [ebp - 0x18]
mov ecx, 1
mov esi, dword [ebp - 0x14]
mov edx, dword [ebx + 0x38]
mov eax, dword [ebx + 0xf8]
mov dword [ebx + 0x40], edx
add edx, eax
xor eax, eax
mov dword [ebx + 0xa8], eax
mov dword [ebx + 0xac], eax
mov eax, edi
mov dword [ebx + 0x44], edx
cdq
mov eax, dword [ebx + 0xc0]
add edi, eax
mov dword [ebx + 0xc0], edi
adc edx, dword [ebx + 0xc4]
and byte [ebx + 0x16d], 0xfb
mov dword [ebx + 0xc4], edx
cmp ecx, 0xffffffff
mov dword [ebx + 0xb8], edi
mov dword [ebx + 0xbc], edx
je 0x40eab8
xor eax, eax
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + 0xe8], eax
mov eax, 0x26
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x414730
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], ebx
mov ebx, eax
mov dword [ebp - 0x10], edi
mov edx, dword [ebx + 0x13c]
test edx, edx
mov ecx, edx
mov eax, dword [ebx + 0x38]
mov edi, dword [ebx + 0x40]
jne 0x414755
mov ecx, 0x20000
sub edi, eax
cmp edi, ecx
ja 0x414783
push 0
lea edx, [ebp - 8]
push edx
push edi
push eax
push dword [ebx + 0xe4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0xffffffff
test eax, eax
je 0x4147f8
mov ecx, 1
jmp 0x4147f8
test edx, edx
mov ecx, edi
mov dword [ebp - 0x18], edi
mov edi, eax
jne 0x414793
mov edx, 0x20000
mov dword [ebp - 4], edx
mov dword [ebp - 0x14], esi
mov esi, ecx
push 0
lea edx, [ebp - 8]
push edx
push dword [ebp - 4]
push edi
push dword [ebx + 0xe4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4147c2
mov edi, dword [ebp - 0x18]
mov ecx, 0xffffffff
mov esi, dword [ebp - 0x14]
jmp 0x4147f8
mov edx, dword [ebx + 0x13c]
test edx, edx
mov eax, dword [ebp - 8]
jne 0x4147d4
mov edx, 0x20000
sub esi, eax
add edi, eax
cmp esi, edx
jae 0x4147e5
mov dword [ebp - 4], esi
test esi, esi
jne 0x4147e9
jmp 0x4147ed
test esi, esi
je 0x4147ed
test eax, eax
ja 0x41479b
mov edi, dword [ebp - 0x18]
mov ecx, 1
mov esi, dword [ebp - 0x14]
mov edx, dword [ebx + 0x38]
mov eax, dword [ebx + 0xf8]
mov dword [ebx + 0x40], edx
add edx, eax
xor eax, eax
mov dword [ebx + 0xa8], eax
mov dword [ebx + 0xac], eax
mov eax, edi
mov dword [ebx + 0x44], edx
cdq
mov eax, dword [ebx + 0xc0]
add edi, eax
mov dword [ebx + 0xc0], edi
adc edx, dword [ebx + 0xc4]
and byte [ebx + 0x16d], 0xfb
mov dword [ebx + 0xc4], edx
cmp ecx, 0xffffffff
mov dword [ebx + 0xb8], edi
mov dword [ebx + 0xbc], edx
je 0x414858
xor eax, eax
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + 0xe8], eax
mov eax, 0x26
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x417480
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], ebx
mov ebx, eax
mov dword [ebp - 0x10], edi
mov edx, dword [ebx + 0x13c]
test edx, edx
mov ecx, edx
mov eax, dword [ebx + 0x38]
mov edi, dword [ebx + 0x40]
jne 0x4174a5
mov ecx, 0x20000
sub edi, eax
cmp edi, ecx
ja 0x4174d3
push 0
lea edx, [ebp - 8]
push edx
push edi
push eax
push dword [ebx + 0xe4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0xffffffff
test eax, eax
je 0x417548
mov ecx, 1
jmp 0x417548
test edx, edx
mov ecx, edi
mov dword [ebp - 0x18], edi
mov edi, eax
jne 0x4174e3
mov edx, 0x20000
mov dword [ebp - 4], edx
mov dword [ebp - 0x14], esi
mov esi, ecx
push 0
lea edx, [ebp - 8]
push edx
push dword [ebp - 4]
push edi
push dword [ebx + 0xe4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x417512
mov edi, dword [ebp - 0x18]
mov ecx, 0xffffffff
mov esi, dword [ebp - 0x14]
jmp 0x417548
mov edx, dword [ebx + 0x13c]
test edx, edx
mov eax, dword [ebp - 8]
jne 0x417524
mov edx, 0x20000
sub esi, eax
add edi, eax
cmp esi, edx
jae 0x417535
mov dword [ebp - 4], esi
test esi, esi
jne 0x417539
jmp 0x41753d
test esi, esi
je 0x41753d
test eax, eax
ja 0x4174eb
mov edi, dword [ebp - 0x18]
mov ecx, 1
mov esi, dword [ebp - 0x14]
mov edx, dword [ebx + 0x38]
mov eax, dword [ebx + 0xf8]
mov dword [ebx + 0x40], edx
add edx, eax
xor eax, eax
mov dword [ebx + 0xa8], eax
mov dword [ebx + 0xac], eax
mov eax, edi
mov dword [ebx + 0x44], edx
cdq
mov eax, dword [ebx + 0xc0]
add edi, eax
mov dword [ebx + 0xc0], edi
adc edx, dword [ebx + 0xc4]
and byte [ebx + 0x16d], 0xfb
mov dword [ebx + 0xc4], edx
cmp ecx, 0xffffffff
mov dword [ebx + 0xb8], edi
mov dword [ebx + 0xbc], edx
je 0x4175a8
xor eax, eax
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + 0xe8], eax
mov eax, 0x26
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x41f9e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], ebx
mov ebx, eax
mov dword [ebp - 0x10], edi
mov edx, dword [ebx + 0x13c]
test edx, edx
mov ecx, edx
mov eax, dword [ebx + 0x38]
mov edi, dword [ebx + 0x40]
jne 0x41fa05
mov ecx, 0x20000
sub edi, eax
cmp edi, ecx
ja 0x41fa33
push 0
lea edx, [ebp - 8]
push edx
push edi
push eax
push dword [ebx + 0xe4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0xffffffff
test eax, eax
je 0x41faa8
mov ecx, 1
jmp 0x41faa8
test edx, edx
mov ecx, edi
mov dword [ebp - 0x18], edi
mov edi, eax
jne 0x41fa43
mov edx, 0x20000
mov dword [ebp - 4], edx
mov dword [ebp - 0x14], esi
mov esi, ecx
push 0
lea edx, [ebp - 8]
push edx
push dword [ebp - 4]
push edi
push dword [ebx + 0xe4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x41fa72
mov edi, dword [ebp - 0x18]
mov ecx, 0xffffffff
mov esi, dword [ebp - 0x14]
jmp 0x41faa8
mov edx, dword [ebx + 0x13c]
test edx, edx
mov eax, dword [ebp - 8]
jne 0x41fa84
mov edx, 0x20000
sub esi, eax
add edi, eax
cmp esi, edx
jae 0x41fa95
mov dword [ebp - 4], esi
test esi, esi
jne 0x41fa99
jmp 0x41fa9d
test esi, esi
je 0x41fa9d
test eax, eax
ja 0x41fa4b
mov edi, dword [ebp - 0x18]
mov ecx, 1
mov esi, dword [ebp - 0x14]
mov edx, dword [ebx + 0x38]
mov eax, dword [ebx + 0xf8]
mov dword [ebx + 0x40], edx
add edx, eax
xor eax, eax
mov dword [ebx + 0xa8], eax
mov dword [ebx + 0xac], eax
mov eax, edi
mov dword [ebx + 0x44], edx
cdq
mov eax, dword [ebx + 0xc0]
add edi, eax
mov dword [ebx + 0xc0], edi
adc edx, dword [ebx + 0xc4]
and byte [ebx + 0x16d], 0xfb
mov dword [ebx + 0xc4], edx
cmp ecx, 0xffffffff
mov dword [ebx + 0xb8], edi
mov dword [ebx + 0xbc], edx
je 0x41fb08
xor eax, eax
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + 0xe8], eax
mov eax, 0x26
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x421ea0
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
Function at 0x424ea0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 8], esi
mov dword [ebp - 4], ebx
mov esi, dword [eax + 0x7c]
test esi, esi
mov dword [ebp - 0xc], edi
je 0x42505c
mov edx, dword [0x4f8660]
mov edi, dword [esi + 0x14]
lea eax, [edi*4]
shl edi, 5
sub edi, eax
cmp edx, 2
lea ebx, [edi + 0x6ddca8]
jge 0x424eef
mov eax, dword [ebx]
test eax, eax
jne 0x424f30
mov dword [edi + 0x6ddca8], 1
jmp 0x424f30
push ebx
call fcn.00409240
add esp, 4
test eax, eax
jne 0x424f2a
cmp dword [edi + 0x6ddca4], 0
je 0x42503c
mov dword [edi + 0x6ddca8], 0
push 0xffffffffffffffff
push dword [edi + 0x6ddca4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call fcn.00409240
add esp, 4
mov edx, dword [0x4f8660]
cmp edx, 1
je 0x425028
mov eax, dword [esi + 0x18]
dec eax
mov dword [esi + 0x18], eax
test eax, eax
jle 0x424f9f
mov eax, dword [0x4f8660]
cmp eax, 1
je 0x424f84
cmp eax, 2
jge 0x424f5f
mov dword [edi + 0x6ddca8], 0
jmp 0x424f75
mov dword [edi + 0x6ddca8], 0
push dword [edi + 0x6ddca4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor eax, eax
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
push dword [edi + 0x6ddcb8]
push dword [edi + 0x6ddcb4]
call fcn.00409220
add esp, 8
mov eax, dword [0x4f8660]
jmp 0x424f4e
mov edx, dword [esi]
test edx, edx
je 0x424fab
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 4]
test eax, eax
je 0x424fb6
mov dword [eax], edx
jmp 0x424fbc
mov dword [edi + 0x6ddca0], edx
mov eax, dword [ebp + 8]
mov dword [eax + 0x7c], 0
mov eax, dword [0x4f8660]
cmp eax, 1
je 0x42500d
cmp eax, 2
jge 0x424fe1
mov dword [edi + 0x6ddca8], 0
jmp 0x424ff7
mov dword [edi + 0x6ddca8], 0
push dword [edi + 0x6ddca4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [esi + 8]
call fcn.00425170
push esi
call fcn.00425170
add esp, 8
jmp 0x424f75
push dword [edi + 0x6ddcb8]
push dword [edi + 0x6ddcb4]
call fcn.00409220
add esp, 8
mov eax, dword [0x4f8660]
jmp 0x424fd0
lea eax, [edi + 0x6ddcb4]
push eax
call fcn.004091f0
add esp, 4
jmp 0x424f39
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [edi + 0x6ddca4], eax
mov dword [edi + 0x6ddca8], 0
jmp 0x424f13
xor eax, eax
mov esi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x425070
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
call fcn.00431e50
mov ebx, dword [ebp + 8]
cmp dword [0x6e39a0], 0
jne 0x425097
test ebx, ebx
je 0x42508c
mov eax, dword [ebx]
jmp 0x42508e
xor eax, eax
push eax
call fcn.00468c10
add esp, 4
test ebx, ebx
je 0x42509f
mov eax, dword [ebx]
jmp 0x4250a1
xor eax, eax
push eax
call fcn.004bdc50
add esp, 4
jmp 0x425084
Function at 0x42e320
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
Function at 0x435b80
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]

Function at 0x435b8c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], esi
mov esi, ecx
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 8], ebx
mov ebx, edx
mov dword [ebp - 4], edi
mov edx, eax
mov dword [ecx], 0
cmp dword [0x6e39a0], 0
je 0x435c63
cmp dword [ebp + 0x20], 2
je 0x435bc3
cmp dword [ebp + 0x20], 1
jne 0x435bd2
mov eax, 0xffffffff
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0x18], 0
je 0x435be2
cmp dword [ebp + 0x20], 0xfffffffa
je 0x435d28
cmp dword [ebp + 0x20], 0
je 0x435d34
xor ecx, ecx
xor edi, edi
cmp dword [ebp + 0x18], 0
je 0x435c17
cmp dword [ebp + 0x1c], 0
je 0x435c17
push edi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], edx
call fcn.004bda00
push edi
call fcn.004bdb70
mov edx, dword [ebp - 0x10]
add esp, 8
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x435c63
push edi
push esi
push ebx
call fcn.004bdaa0
add esp, 0xc
mov esi, eax
mov eax, dword [ebp + 0x14]
cmp esi, 0xffffffff
mov dword [eax], esi
je 0x435d58
push 0
push edi
push 2
push 0x4d683c
call fcn.004bda60
add esp, 0x10
mov edx, dword [ebp + 0x14]
mov eax, 1
mov byte [esi + ebx], 0xa
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
inc dword [edx]
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x10], edx
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x24]
test ecx, ecx
mov edx, dword [ebp - 0x10]
mov dword [edi], 0
je 0x435c8b
mov edi, dword [ecx + 0x13c]
test edi, edi
jne 0x435c90
mov edi, 0x20000
cmp esi, edi
jbe 0x435d04
cmp dword [ebp + 0x20], 0
je 0x435d04
test ecx, ecx
je 0x435ca8
mov edi, dword [ecx + 0x13c]
test edi, edi
jne 0x435cad
mov edi, 0x20000
mov dword [ebp - 0x10], edx
push 0
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x18]
push eax
push edi
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x435cf2
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x18]
add ebx, edx
sub esi, edx
add dword [ecx], edx
cmp dword [ebp + 0x24], 0
je 0x435ce7
mov edx, dword [ebp + 0x24]
mov edx, dword [edx + 0x13c]
test edx, edx
jne 0x435cec
mov edx, 0x20000
cmp esi, edx
ja 0x435cf2
mov edi, esi
test esi, esi
je 0x435d1b
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0x18]
jne 0x435d1b
test eax, eax
jne 0x435cb0
jmp 0x435d1b
push 0
lea ecx, [ebp - 0x18]
push ecx
push esi
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x18]
mov dword [ecx], edx
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov edi, edx
mov ecx, 1
jmp 0x435bf6
mov dword [ebp - 0x10], edx
call fcn.004bdc90
mov edx, dword [ebp - 0x10]
mov edi, eax
cmp dword [0x6e39a0], 0
je 0x435c1b
mov ecx, 1
jmp 0x435bf0
xor eax, eax
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x447420
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], ebx
mov ebx, eax
mov dword [ebp - 0x10], edi
mov edx, dword [ebx + 0x13c]
test edx, edx
mov ecx, edx
mov eax, dword [ebx + 0x38]
mov edi, dword [ebx + 0x40]
jne 0x447445
mov ecx, 0x20000
sub edi, eax
cmp edi, ecx
ja 0x447473
push 0
lea edx, [ebp - 8]
push edx
push edi
push eax
push dword [ebx + 0xe4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0xffffffff
test eax, eax
je 0x4474e8
mov ecx, 1
jmp 0x4474e8
test edx, edx
mov ecx, edi
mov dword [ebp - 0x18], edi
mov edi, eax
jne 0x447483
mov edx, 0x20000
mov dword [ebp - 4], edx
mov dword [ebp - 0x14], esi
mov esi, ecx
push 0
lea edx, [ebp - 8]
push edx
push dword [ebp - 4]
push edi
push dword [ebx + 0xe4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4474b2
mov edi, dword [ebp - 0x18]
mov ecx, 0xffffffff
mov esi, dword [ebp - 0x14]
jmp 0x4474e8
mov edx, dword [ebx + 0x13c]
test edx, edx
mov eax, dword [ebp - 8]
jne 0x4474c4
mov edx, 0x20000
sub esi, eax
add edi, eax
cmp esi, edx
jae 0x4474d5
mov dword [ebp - 4], esi
test esi, esi
jne 0x4474d9
jmp 0x4474dd
test esi, esi
je 0x4474dd
test eax, eax
ja 0x44748b
mov edi, dword [ebp - 0x18]
mov ecx, 1
mov esi, dword [ebp - 0x14]
mov edx, dword [ebx + 0x38]
mov eax, dword [ebx + 0xf8]
mov dword [ebx + 0x40], edx
add edx, eax
xor eax, eax
mov dword [ebx + 0xa8], eax
mov dword [ebx + 0xac], eax
mov eax, edi
mov dword [ebx + 0x44], edx
cdq
mov eax, dword [ebx + 0xc0]
add edi, eax
mov dword [ebx + 0xc0], edi
adc edx, dword [ebx + 0xc4]
and byte [ebx + 0x16d], 0xfb
mov dword [ebx + 0xc4], edx
cmp ecx, 0xffffffff
mov dword [ebx + 0xb8], edi
mov dword [ebx + 0xbc], edx
je 0x447548
xor eax, eax
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + 0xe8], eax
mov eax, 0x26
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x484490
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
xor eax, eax
cmp dword [ebp + 8], 0
setne al
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4844c8
push str._path___NULL_
push 0
push 0x50
push str.f:dd_vctoolscrt_bld_self_x86crt_src_access.c
push 2
call fcn.00475fa0
add esp, 0x14
cmp eax, 1
jne 0x4844c8
int3
cmp dword [ebp - 8], 0
jne 0x484509
call fcn.0046f320
mov dword [eax], 0
call fcn.0046f2f0
mov dword [eax], 0x16
push 0
push 0x50
push str.f:dd_vctoolscrt_bld_self_x86crt_src_access.c
push str._access_s
push str._path___NULL_
call fcn.004759d0
add esp, 0x14
mov eax, 0x16
jmp 0x4845e1
mov edx, dword [ebp + 0xc]
and edx, 0xfffffff9
neg edx
sbb edx, edx
add edx, 1
mov dword [ebp - 0xc], edx
jne 0x484539
push str.__amode___6____0_
push 0
push 0x51
push str.f:dd_vctoolscrt_bld_self_x86crt_src_access.c
push 2
call fcn.00475fa0
add esp, 0x14
cmp eax, 1
jne 0x484539
int3
cmp dword [ebp - 0xc], 0
jne 0x484577
call fcn.0046f320
mov dword [eax], 0
call fcn.0046f2f0
mov dword [eax], 0x16
push 0
push 0x51
push str.f:dd_vctoolscrt_bld_self_x86crt_src_access.c
push str._access_s
push str.__amode___6____0_
call fcn.004759d0
add esp, 0x14
mov eax, 0x16
jmp 0x4845e1
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4845a2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0046f0e0
add esp, 4
call fcn.0046f2f0
mov eax, dword [eax]
jmp 0x4845e1
mov edx, dword [ebp - 4]
and edx, 0x10
je 0x4845ae
xor eax, eax
jmp 0x4845e1
mov eax, dword [ebp - 4]
and eax, 1
je 0x4845df
mov ecx, dword [ebp + 0xc]
and ecx, 2
je 0x4845df
call fcn.0046f320
mov dword [eax], 5
call fcn.0046f2f0
mov dword [eax], 0xd
call fcn.0046f2f0
mov eax, dword [eax]
jmp 0x4845e1
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x485220
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4fa4a0]
jne 0x48522a
repz ret
jmp fcn.00499590