joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48e040
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push 0
push 0x80
push 3
push 0
mov ebx, ecx
push 1
push 0xc0000000
lea eax, [ebx + 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x48e07b
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x48e0a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 8]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
jne 0x48e0c2
push dword [ebp - 8]
mov edi, 0x54f
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
push edi
push dword [ebp - 8]
mov dword [ebx + 4], edi
mov dword [ebx + 0x434], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x48e104
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jne 0x48e18c
jmp 0x48e12f
cmp dword [ebp - 4], esi
je 0x48e120
push dword [ebp - 8]
mov edi, 0x1e
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
mov edx, edi
mov ecx, edi
call fcn.0048c650
add esp, 4
xor edi, edi
mov edx, dword [ebx + 4]
test edx, edx
je 0x48e18c
mov ecx, esi
mov eax, edx
shr ecx, 1
mov dword [ebp - 4], ecx
je 0x48e14f
cmp word [eax], 0
je 0x48e14f
add eax, 2
sub ecx, 1
jne 0x48e141
sub dword [ebp - 4], ecx
xor edx, edx
test ecx, ecx
mov eax, edi
mov dword [ebp - 0xc], eax
cmovne edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov edx, dword [ebx + 4]
je 0x48e18c
mov ecx, dword [ebp - 4]
add ecx, ecx
add ecx, 2
lea eax, [ecx + 4]
cmp eax, esi
ja 0x48e18c
mov eax, dword [edx + ecx]
sub esi, ecx
mov dword [ebx + 0x14], eax
lea eax, [ecx + 4]
add eax, edx
sub esi, 4
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], esi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48e630
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4ff080]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x48e72d
test edi, edi
je 0x48e719
mov ecx, 0x104
mov eax, edi
cmp word [eax], 0
je 0x48e673
add eax, 2
sub ecx, 1
jne 0x48e665
test ecx, ecx
je 0x48e719
mov eax, 0x104
sub eax, ecx
add eax, eax
neg ecx
sbb ecx, ecx
and ecx, eax
shr ecx, 1
je 0x48e719
push esi
lea esi, [edi + ecx*2]
cmp word [esi], 0x5c
je 0x48e6b9
sub esi, 2
sub ecx, 1
jne 0x48e696
pop esi
mov eax, 3
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a9b96
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x48e6a4
push ecx
push 0x511d08
push ecx
mov edx, 0x104
lea ecx, [ebp - 0x20c]
call fcn.0048c600
push esi
lea ecx, [ebp - 0x20c]
call fcn.0048c5a0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x48e6a4
push ecx
lea eax, [ebp - 0x20c]
mov edx, 0x104
push eax
push ecx
mov ecx, edi
call fcn.0048c600
pop esi
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a9b96
mov esp, ebp
pop ebp
ret
mov eax, 3
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a9b96
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop edi
call fcn.004a9b96
mov esp, ebp
pop ebp
ret
Function at 0x490fd0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x4ff080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [esi + 0x24], 0
je 0x491009
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a9b96
mov esp, ebp
pop ebp
ret 0xc
cmp edi, 2
jne 0x491032
mov eax, dword [0x4ffbe0]
inc eax
mov dword [esi + 0xc], 0
mov dword [esi + 8], edi
mov dword [esi + 0x10], 0
mov dword [esi + 0x1c], ebx
mov dword [0x4ffbe0], eax
mov dword [esi + 0x18], eax
jmp 0x4910a7
push 0x110
lea eax, [ebp - 0x114]
push 0
push eax
call fcn.004abe70
add esp, 0xc
mov dword [ebp - 0x118], 0x114
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x491071
cmp dword [ebp - 0x114], 6
mov eax, 0x185
jae 0x491076
mov eax, 0x85
mov dword [esi + 0xc], eax
mov dword [esi + 8], edi
mov dword [esi + 0x10], 0
mov dword [esi + 0x1c], ebx
cmp edi, 4
je 0x4910a0
cmp edi, 1
je 0x4910a0
mov eax, dword [0x4ffbe0]
inc eax
mov dword [0x4ffbe0], eax
mov dword [esi + 0x18], eax
jmp 0x4910a7
mov dword [esi + 0x18], 0
lea eax, [esi + 4]
push eax
push dword [esi + 0x20]
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov ecx, dword [ebp - 4]
test eax, eax
pop edi
setne al
xor ecx, ebp
pop esi
pop ebx
call fcn.004a9b96
mov esp, ebp
pop ebp
ret 0xc
Function at 0x493810
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cf6ed
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x4ff080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x24]
test eax, eax
jne 0x4939a5
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
call fcn.00456f30
mov ecx, eax
test ecx, ecx
je 0x493a09
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 0x28], eax
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x28]
mov esi, dword [ebp + 0x14]
push esi
call fcn.00460f10
test al, al
jne 0x4938a9
test esi, esi
jne 0x493884
xor ecx, ecx
jmp 0x49389f
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x493890
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp + 0x28]
call fcn.00461270
mov byte [ebp - 4], 2
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp + 0x28]
cmp edi, dword [ebp - 0x10]
je 0x4938d6
lea eax, [esi - 0x10]
mov dword [ebp + 0x18], edi
push eax
call fcn.00461190
add eax, 0x10
add esp, 4
mov dword [edi], eax
mov byte [ebp - 4], 2
add dword [ebp - 0x14], 4
jmp 0x4938e3
lea eax, [ebp + 0x28]
push eax
push edi
lea ecx, [ebp - 0x18]
call fcn.0047cb50
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4938ff
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov dl, 1
lea ecx, [ebp - 0x18]
call fcn.004809a0
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x18]
test esi, esi
je 0x4939f4
mov edi, dword [ebp - 0x14]
mov dword [ebp + 0x28], esi
cmp esi, edi
je 0x49395e
nop word [eax + eax]
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [esi]
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x493951
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 4
mov dword [ebp + 0x28], esi
cmp esi, edi
jne 0x493930
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
mov eax, esi
sub ecx, esi
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x493984
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x493a13
push ecx
push esi
call fcn.004aa25b
add esp, 8
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
jmp 0x4939f4
cmp eax, 1
jne 0x4939bb
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x4939f4
push 0x67
push ecx
lea ecx, [ebp + 0x20]
call fcn.00479280
mov dword [ebp - 4], 6
push dword [0x511ce4]
mov eax, dword [eax + 8]
call eax
mov dword [ebp - 4], 0xffffffff
mov dword [ebp + 0x20], 0
mov dword [ebp + 0x24], 0
mov dword [ebp + 0x28], 0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x24
push 0x80004005
call fcn.00456c80
call fcn.004b35c4
int3
Function at 0x4942b0
Capabilities:
Create thread
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cfb8c
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x4ff080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x39
lea eax, [ebp - 0x10]
push eax
call fcn.0048bc00
mov dword [ebp - 4], 0
push dword [0x512004]
push 1
push dword [ebp - 0x10]
push 0x4ead28
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x494322
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
sub esp, 8
mov dword [0x4ffb90], esi
lea ecx, [ebp - 0x1c]
call fcn.004820d0
mov dword [ebp - 4], 2
mov eax, dword [eax + 8]
push 0
push 0
push 1
push 0
call eax
mov dword [0x511ce4], eax
mov dword [ebp - 4], 0xffffffff
sub esp, 8
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call fcn.004820d0
mov dword [ebp - 4], 3
mov eax, dword [eax + 8]
push 0
push 0
push 1
push 0
call eax
mov dword [ebp - 4], 0xffffffff
sub esp, 8
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call fcn.004820d0
mov dword [ebp - 4], 4
mov eax, dword [eax + 8]
push 0
push 1
push 0
push 0
call eax
mov dword [0x511ce8], eax
mov dword [ebp - 4], 0xffffffff
push 0
push 0
push 0
push 0x480e40
push 0
push 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call fcn.004b3c5d
add esp, 0x18
call fcn.004886a0
push 0
push 0
push 0x512020
push 0x465010
push 0
push 0
call fcn.004b3c5d
push 0
push 0
push 0x512020
push 0x465030
push 0
push 0
mov dword [0x511cd0], eax
call fcn.004b3c5d
push 4
call fcn.004a9ec5
mov esi, eax
add esp, 0x34
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 5
mov dword [esi], 0
push esi
push str.S_1_5_80_956008885_3418522649_1831038044_1853292631_2271478464
call dword [sym.imp.ADVAPI32.dll_ConvertStringSidToSidW]
mov dword [ebp - 4], 0xffffffff
mov dword [0x511ccc], esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x495000
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cfe0d
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4ff080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov edi, ecx
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
call fcn.00456f30
mov ecx, eax
test ecx, ecx
je 0x495157
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0
push 0xc
mov dword [ebp - 0x10], 1
call fcn.004a9ec5
mov esi, eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 2
push 0x800
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 1
call fcn.004b3cee
mov edx, dword [esi + 4]
add esp, 0xc
mov dword [esi], eax
cmp edx, 0x400
jae 0x4950bf
mov ecx, 0x400
lea eax, [eax + edx*2]
sub ecx, edx
add ecx, ecx
push ecx
push 0
push eax
call fcn.004abe70
add esp, 0xc
mov dword [esi + 4], 0x400
mov byte [ebp - 4], 0
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 3
push 1
push ebx
push dword [esi]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x49510c
mov edx, dword [esi]
test edx, edx
jne 0x4950ef
xor ecx, ecx
jmp 0x495103
mov ecx, edx
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4950f4
sub ecx, ebx
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.00461270
mov byte [ebp - 4], 0
add dword [esi + 8], 0xffffffff
jne 0x495143
cmp dword [esi + 4], 0
je 0x495131
push 0
push dword [esi]
call fcn.004b3cee
add esp, 8
mov dword [esi], eax
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.004aa25b
add esp, 8
mov dword [ebp - 0x14], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00456c80
int3
Function at 0x496530
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d02dc
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4ff080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x18], 0
call fcn.00456f30
mov ecx, eax
test ecx, ecx
je 0x49673a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x10]
push 0x4e88e8
call fcn.00460f10
test al, al
jne 0x4965a2
push 0
push 0x4e88e8
lea ecx, [ebp - 0x10]
call fcn.00461270
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [edi + 0x25c]
call fcn.004608e0
mov dword [ebp - 4], 0
or eax, 0xffffffff
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4965da
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea esi, [edi + 0xc]
nop dword [eax]
cmp byte [edi + 8], 0
mov dword [ebp - 0x14], esi
jne 0x49662b
lea ebx, [edi + 0xc]
mov byte [edi + 8], 1
push ebx
push dword [edi]
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, dword [edi + 0x260]
mov esi, eax
cmp esi, ecx
je 0x496614
cmp ecx, 0xffffffff
je 0x496614
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [edi + 0x260], esi
cmp esi, 0xffffffff
je 0x4966dd
lea ebx, [edi + 0xc]
mov dword [ebp - 0x14], ebx
jmp 0x496655
mov eax, dword [edi + 0x260]
mov ebx, esi
mov dword [ebp - 0x10], ebx
cmp eax, 0xffffffff
je 0x4966dd
push esi
push eax
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x4966dd
mov ebx, dword [ebp - 0x14]
lea edx, [edi + 0x38]
mov ecx, 0x4ea6e4
mov eax, edx
nop
mov si, word [eax]
cmp si, word [ecx]
jne 0x496686
test si, si
je 0x496682
mov si, word [eax + 2]
cmp si, word [ecx + 2]
jne 0x496686
add eax, 4
add ecx, 4
test si, si
jne 0x496660
xor eax, eax
jmp 0x49668b
sbb eax, eax
or eax, 1
test eax, eax
je 0x496732
mov eax, 0x4ea6e8
mov cx, word [edx]
cmp cx, word [eax]
jne 0x4966be
test cx, cx
je 0x4966ba
mov cx, word [edx + 2]
cmp cx, word [eax + 2]
jne 0x4966be
add edx, 4
add eax, 4
test cx, cx
jne 0x496698
xor eax, eax
jmp 0x4966c3
sbb eax, eax
or eax, 1
test eax, eax
je 0x4965da
lea eax, [edi + 4]
mov dword [ebp - 0x10], ebx
push eax
lea ecx, [edi + 0x25c]
call fcn.004608e0
mov esi, ebx
mov ecx, 0x94
mov ebx, dword [ebp + 8]
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
lea esi, [ebx + 0x250]
mov dword [ebp - 0x14], esi
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x250]
sub eax, 0x10
push eax
call fcn.00461190
add esp, 4
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 1
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov esi, dword [ebp - 0x14]
jmp 0x4965e0
push 0x80004005
call fcn.00456c80
int3
Function at 0x496750
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d032d
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4ff080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov dword [ebp - 0x1c], ebx
mov esi, ecx
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 0
push 0xc
mov dword [ebp - 0x18], 0
call fcn.004a9ec5
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 1
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 1
mov byte [ebp - 4], 0
mov dword [esi], eax
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push 0
push eax
push 0
xorps xmm0, xmm0
mov dword [ebp - 0x18], 1
push ebx
movlpd qword [ebp - 0x2c], xmm0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x496858
mov ebx, dword [esi]
mov edi, dword [ebp + 0x10]
cmp edi, dword [ebx + 4]
je 0x49681b
push edi
push dword [ebx]
call fcn.004b3cee
mov edx, dword [ebx + 4]
add esp, 8
mov dword [ebx], eax
cmp edi, edx
jbe 0x496818
mov ecx, edi
add eax, edx
sub ecx, edx
push ecx
push 0
push eax
call fcn.004abe70
add esp, 0xc
mov dword [ebx + 4], edi
mov eax, dword [esi]
lea ecx, [ebp - 0x14]
push 0
push ecx
push edi
mov dword [ebp - 0x14], edi
push dword [eax]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x49683b
cmp dword [ebp - 0x14], edi
je 0x496858
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x496858
push 0
push dword [edi]
call fcn.004b3cee
add esp, 8
mov dword [edi], eax
mov dword [edi + 4], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x496870
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d035d
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x4ff080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], edx
push 0
push 0
push 2
push 0
push 1
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
cmp edi, 0xffffffff
je 0x496963
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
mov edx, dword [ebp + 8]
movlpd qword [ebp - 0x18], xmm0
test eax, eax
jb 0x49693e
ja 0x4968de
test edx, edx
je 0x49693e
mov ebx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
mov ecx, edx
sub ecx, esi
sbb eax, ebx
test eax, eax
ja 0x4968fe
jb 0x4968f8
cmp ecx, 0x10000
jae 0x4968fe
mov edi, edx
sub edi, esi
jmp 0x496903
mov edi, 0x10000
push 0
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], edi
push ecx
mov eax, esi
add eax, dword [ebp - 0x1c]
push edi
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp + 8]
test eax, eax
je 0x496946
mov eax, dword [ebp - 0x14]
cmp eax, edi
jne 0x496946
add esi, eax
mov eax, dword [ebp + 0xc]
adc ebx, 0
cmp ebx, eax
jb 0x4968e4
ja 0x496949
cmp esi, edx
jb 0x4968e4
jmp 0x496949
mov ebx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
jmp 0x49694c
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp - 0x10]
cmp esi, edx
jne 0x496963
cmp ebx, eax
jne 0x496963
or esi, ebx
je 0x49695f
push edi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov bl, 1
jmp 0x496965
xor bl, bl
mov dword [ebp - 4], 0xffffffff
cmp edi, 0xffffffff
je 0x496978
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x496d80
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d045d
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x4ff080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov ebx, ecx
mov dword [ebp - 0x24], ebx
push 0xc
mov dword [ebp - 0x10], 0
call fcn.004a9ec5
mov edi, eax
add esp, 4
mov dword [ebp - 0x20], edi
mov dword [ebp - 4], 1
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 1
mov byte [ebp - 4], 0
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], 2
push 0
push 0
push 3
push 0
push 7
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x18], esi
mov byte [ebp - 4], 3
cmp esi, 0xffffffff
je 0x496f2e
mov byte [ebp - 4], 4
push 0xc
call fcn.004a9ec5
add esp, 4
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 5
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 1
mov byte [ebp - 4], 4
mov dword [ebx], eax
lea eax, [ebp - 0x30]
push eax
push esi
mov dword [ebp - 0x10], 2
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x496f08
mov ecx, dword [ebp - 0x30]
mov eax, ecx
and eax, dword [ebp - 0x2c]
cmp eax, 0xffffffff
je 0x496f08
push ecx
sub esp, 8
lea ecx, [ebp - 0x14]
mov edx, esi
call fcn.00496750
add esp, 0xc
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 6
mov esi, dword [ebx]
add dword [esi + 8], 0xffffffff
jne 0x496ec2
cmp dword [esi + 4], 0
je 0x496ec2
push 0
push dword [esi]
call fcn.004b3cee
mov dword [esi], eax
add esp, 8
mov eax, dword [ebp - 0x20]
mov dword [esi + 4], 0
mov eax, dword [eax]
inc dword [eax + 8]
mov dword [ebx], eax
mov byte [ebp - 4], 4
mov esi, dword [ebp - 0x14]
add dword [esi + 8], 0xffffffff
jne 0x496f05
cmp dword [esi + 4], 0
je 0x496ef1
push 0
push dword [esi]
call fcn.004b3cee
add esp, 8
mov dword [esi], eax
mov dword [esi + 4], 0
push 0xc
push dword [ebp - 0x14]
call fcn.004aa25b
add esp, 8
mov dword [ebp - 0x14], 0
mov esi, dword [ebp - 0x18]
mov eax, 2
mov dword [ebp - 0x10], eax
and eax, 0xfffffffd
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 3
or eax, 1
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 2
test esi, esi
je 0x496f46
push esi
jmp 0x496f40
inc dword [edi + 8]
mov dword [ebx], edi
mov dword [ebp - 0x10], 1
mov byte [ebp - 4], 2
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 0
add dword [edi + 8], 0xffffffff
jne 0x496f7d
cmp dword [edi + 4], 0
je 0x496f6b
push 0
push dword [edi]
call fcn.004b3cee
mov dword [edi + 4], 0
add esp, 8
mov dword [edi], eax
push 0xc
push edi
call fcn.004aa25b
mov dword [ebp - 0x1c], 0
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret