joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40595e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x40596d
pop dword [ebp - 0x20]
mov eax, 0x777435cf
add eax, 0x88cc239e
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x3f6d1e70
sub dword [ebp - 0x30], 0xf11ad925
mov dword [ebp - 0x2c], 0x7e3cd695
add dword [ebp - 0x2c], 0xb3f675b0
mov dword [ebp - 0x28], 0xf35489c1
sub dword [ebp - 0x28], 0xa7084593
mov dword [ebp - 0x24], 0x737ea912
add dword [ebp - 0x24], 0x8c8156ee
lea eax, [ebp - 0x30]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xb9929b40
sub dword [ebp - 0x30], 0x452031ea
mov dword [ebp - 0x2c], 0xd481c155
sub dword [ebp - 0x2c], 0x93155fe0
mov dword [ebp - 0x28], 0xf1137d6e
add dword [ebp - 0x28], 0x725beefe
mov dword [ebp - 0x24], 0x520645f7
sub dword [ebp - 0x24], 0x520645f7
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0xf620336b
sub eax, 0xf5dfc26b
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x340c3
push 0
call eax
mov ecx, 0x3d53
mov ebx, eax
mov edi, 0xff91241d
add edi, 0xafdbe3
add edi, dword [ebp - 0x20]
mov edx, 0x20719a4
sub edx, 0x53660fb4
sub dword [ebp - 8], ecx
mov esi, dword [edi]
sub dword [ebp - 0x18], 0x84377153
xor esi, edx
add dword [ebp - 4], eax
mov dword [ebx], esi
add dword [ebp - 4], edi
add ebx, 4
add edi, 4
loop 0x405a84
add eax, 0xc631f358
sub eax, 0xc6310b39
xor ebx, ebx
add ebx, eax
add eax, 0x7a17590
add eax, 0xf85e8a75
mov ecx, 0xa1e90547
add ecx, 0x5e56fab9
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x1000660f
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1000664e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000664e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000664e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1000664e
cmp dword [ecx + 0x74], 0xe
jbe 0x1000664e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10008fe9
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10009086
push ebx
push esi
call fcn.10008fb2
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10008f46
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10009033
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10009085
push edi
push eax
call fcn.100078e7
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10009053
call fcn.10007935
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10009084
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10008f46
add esp, 0x20
test eax, eax
jne 0x10009072
push edi
call fcn.10007935
jmp 0x1000907a
push ebx
call fcn.10007935
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x100092f3
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10010b08
push 0x10010b00
push str.FlsAlloc
push 0x1f
call fcn.1000920f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10009327
push dword [ebp + 8]
mov ecx, esi
call dword [0x1000f13c]
call esi
jmp 0x1000932d
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10009371
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10010b18
push 0x10010b10
push str.FlsGetValue
push 0x21
call fcn.1000920f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100093a8
push dword [ebp + 8]
mov ecx, esi
call dword [0x1000f13c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x100093b0
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10010b20
push 0x10010b18
push str.FlsSetValue
push 0x22
call fcn.1000920f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100093ea
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1000f13c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1000e900
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000e92d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000e92d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x402331
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov dword [0x42c230], 1
cmp dword [0x42cc58], 0
jne 0x40235e
push 2
call dword [sym.imp.MSVCRT20.dll_raise]
add esp, 4
jmp 0x40238f
mov dword [0x42b3fc], 1
push 0
push 2
call dword [sym.imp.MSVCRT20.dll_signal]
add esp, 8
push 0x42f8e8
push 3
call fcn.004093aa
add esp, 8
push 0xb
call dword [sym.imp.MSVCRT20.dll_exit]
add esp, 4
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4023d0
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
call sub.MSVCRT20.dll__kbhit
mov dword [0x42cc58], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCRT20.dll_system]
add esp, 4
mov dword [0x42cc58], 1
cmp dword [0x42c230], 0
je 0x402413
push 0
call fcn.00402331
add esp, 4
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4081d7
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
call dword [sym.imp.MSVCRT20.dll__errno]
cmp dword [eax], 0
je 0x40824c
mov eax, dword [ebp + 8]
push eax
call fcn.00408160
add esp, 4
test eax, eax
je 0x40824c
push 0x4326d0
push 0
call fcn.004093aa
add esp, 8
call dword [sym.imp.MSVCRT20.dll__errno]
mov eax, dword [eax]
push eax
call dword [sym.imp.MSVCRT20.dll_strerror]
add esp, 4
push eax
call dword [sym.imp.MSVCRT20.dll__errno]
mov eax, dword [eax]
push eax
push 0x4300e0
push 0x44
call fcn.004093aa
add esp, 0x10
push 0x4326d0
push 0x44
call fcn.004093aa
add esp, 8
cmp dword [0x42c1ec], 2
jne 0x408276
call dword [sym.imp.MSVCRT20.dll___p__iob]
add eax, 0x20
push eax
push 0x42f094
push 0x4326ec
call dword [sym.imp.MSVCRT20.dll_freopen]
add esp, 0xc
push 1
call dword [sym.imp.MSVCRT20.dll___p__iob]
add eax, 0x20
push eax
call fcn.0042127e
add esp, 8
call fcn.004173be
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
push 0x44
call fcn.00408b17
add esp, 0xc
mov dword [ebp - 4], 0
call fcn.004173be
cmp dword [0x42b454], 0
jne 0x4082d1
mov eax, dword [ebp + 8]
push eax
call fcn.0041ec8c
add esp, 4
mov dword [0x42b454], eax
cmp dword [0x42b454], 8
jne 0x4082e3
call fcn.004203c7
mov dword [0x42b3fc], 1
mov eax, dword [0x42b454]
push eax
call dword [sym.imp.MSVCRT20.dll_exit]
add esp, 4
xor eax, eax
jmp 0x408303
pop edi
pop esi
pop ebx
leave
ret
Function at 0x410e45
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [0x42d100], 0xffffffff
push 0x42f098
mov eax, dword [ebp + 8]
push eax
call fcn.0042045e
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x410eda
push 0x1000
call fcn.0041a3d0
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
push eax
push 0x1000
push 1
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.MSVCRT20.dll_fread]
add esp, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x410ec0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
call fcn.00418da1
add esp, 8
jmp 0x410e86
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.MSVCRT20.dll_free]
add esp, 4
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.MSVCRT20.dll_fclose]
add esp, 4
mov eax, dword [0x42d100]
not eax
jmp 0x410ee6
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4166d5
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
push 1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCRT20.dll_fread]
add esp, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jle 0x41671b
mov eax, dword [ebp - 4]
add dword [0x42b544], eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.004093f4
add esp, 8
mov eax, dword [ebp - 4]
jmp 0x416723
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41677a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
cmp dword [0x42c144], 0
je 0x4167a9
push 0x63
mov eax, dword [0x42c3a8]
push eax
call dword [sym.imp.MSVCRT20.dll_strchr]
add esp, 8
test eax, eax
jne 0x4167b9
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.004093f4
add esp, 8
cmp dword [0x42c368], 0
jne 0x41681f
mov eax, dword [ebp + 0xc]
cmp dword [0x42b43c], eax
jae 0x4167e2
push 0x42f7a0
call fcn.004081d7
add esp, 4
xor eax, eax
sub eax, dword [ebp + 0xc]
neg eax
sub dword [0x42b43c], eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [0x42c348]
push eax
call dword [sym.imp.MSVCRT20.dll_memmove]
add esp, 0xc
mov eax, dword [ebp + 0xc]
add dword [0x42c348], eax
mov eax, dword [ebp + 0xc]
add dword [0x42b448], eax
xor eax, eax
jmp 0x416957
cmp dword [ebp + 0x10], 1
je 0x416847
cmp dword [ebp + 0x10], 2
je 0x416847
cmp dword [ebp + 0x10], 3
je 0x416847
cmp dword [ebp + 0x10], 5
jne 0x416860
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0x10]
push eax
call fcn.00418500
add esp, 0xc
jmp 0x416957
cmp dword [0x432fa8], 0
jne 0x416874
xor eax, eax
jmp 0x416957
cmp dword [0x42c160], 1
jne 0x4168ff
xor eax, eax
mov al, byte [0x42c0b0]
cmp eax, 0xb
je 0x4168ff
cmp dword [0x42b538], 1
je 0x4168ff
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
dec dword [ebp + 0xc]
cmp dword [ebp - 0x10], 0
jle 0x4168fa
mov eax, dword [ebp - 0xc]
mov al, byte [eax]
mov byte [ebp - 4], al
inc dword [ebp - 0xc]
movsx eax, byte [ebp - 4]
and al, 0x7f
mov byte [ebp - 4], al
mov eax, dword [0x432fa8]
push eax
movsx eax, byte [ebp - 4]
push eax
call dword [sym.imp.MSVCRT20.dll_fputc]
add esp, 8
cmp eax, 0xffffffff
jne 0x4168f5
push 0x42fa18
call fcn.004081d7
add esp, 4
jmp 0x4168a4
jmp 0x416950
mov eax, dword [0x432fa8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push 1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCRT20.dll_fwrite]
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [0x432fa8]
push eax
call fcn.00420bee
add esp, 4
test eax, eax
je 0x416937
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
cmp dword [ebp - 8], eax
je 0x416950
push 0x42fa18
call fcn.004081d7
add esp, 4
xor eax, eax
jmp 0x416957
pop edi
pop esi
pop ebx
leave
ret
Function at 0x418da1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push dword [ecx]
push ebx
dec eax
xchg esi, eax
mov edi, eax
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.00416bd5
and dword [esi - 0x2c], esp
push esi
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x418dc2
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x418dc2
call fcn.00416bd5
test byte [esp + edi*2 + 0x17], cl
mov ebx, dword [edx + 0x24]
add ebx, edi
mov cx, word [ebx + ecx*2]
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi

Function at 0x41b033
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x6c00
call fcn.0041a3d0
add esp, 4
mov dword [ebp - 8], eax
push 0
push 0
mov eax, dword [0x42c3b4]
push eax
call dword [sym.imp.MSVCRT20.dll_fseek]
add esp, 0xc
cmp dword [ebp + 8], 0
jbe 0x41b0ec
mov eax, dword [ebp + 8]
cmp eax, 0x6c00
jb 0x41b07c
mov eax, 0x6c00
mov dword [ebp - 4], eax
mov eax, dword [0x42c3b4]
push eax
mov eax, dword [ebp - 4]
push eax
push 1
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.MSVCRT20.dll_fread]
add esp, 0x10
cmp eax, dword [ebp - 4]
je 0x41b0ae
push 0x42f988
call fcn.004081d7
add esp, 4
mov eax, dword [0x42b180]
push eax
mov eax, dword [ebp - 4]
push eax
push 1
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.MSVCRT20.dll_fwrite]
add esp, 0x10
cmp eax, dword [ebp - 4]
je 0x41b0dd
push 0x42fa18
call fcn.004081d7
add esp, 4
xor eax, eax
sub eax, dword [ebp - 4]
neg eax
sub dword [ebp + 8], eax
jmp 0x41b05f
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.MSVCRT20.dll_free]
add esp, 4
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41ef6d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
cmp dword [ebp + 0x10], 1
jne 0x41efda
cmp dword [ebp + 0xc], 0
jl 0x41efda
cmp dword [ebp + 0xc], 0x1000
jg 0x41efda
push 0x1000
call fcn.0041a3d0
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0
jle 0x41efc8
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push 1
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.MSVCRT20.dll_fread]
add esp, 0x10
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.MSVCRT20.dll_free]
add esp, 4
jmp 0x41efef
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCRT20.dll_fseek]
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41f203
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.MSVCRT20.dll_fseek]
add esp, 0xc
cmp dword [ebp + 8], 0
jbe 0x41f2d6
cmp dword [0x42c160], 0
jne 0x41f24c
push 0
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.MSVCRT20.dll_fseek]
add esp, 0xc
jmp 0x41f2d6
push 0x6c00
call fcn.0041a3d0
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp + 8], 0
jbe 0x41f2b8
mov eax, dword [ebp + 8]
cmp eax, 0x6c00
jb 0x41f279
mov eax, 0x6c00
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push 1
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.MSVCRT20.dll_fread]
add esp, 0x10
cmp eax, dword [ebp - 4]
je 0x41f2a9
push 0x430088
call fcn.004081d7
add esp, 4
xor eax, eax
sub eax, dword [ebp - 4]
neg eax
sub dword [ebp + 8], eax
jmp 0x41f25c
push 1
push 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.MSVCRT20.dll_fseek]
add esp, 0xc
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.MSVCRT20.dll_free]
add esp, 4
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41fb6f
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x20], 0x20
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 4]
cmp eax, 0x7fffffff
ja 0x41fb9c
mov eax, 0x7fffffff
jmp 0x41fba1
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41fe38
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
cmp dword [ebp + 0xc], 0
jne 0x41fe7e
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x41fe71
mov eax, 0xffffffff
jmp 0x41fea5
mov eax, dword [ebp - 4]
jmp 0x41fea5
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x41fe9e
mov eax, 1
jmp 0x41fea0
xor eax, eax
jmp 0x41fea5
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42069b
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
movsx eax, byte [eax]
cmp eax, 0x20
jne 0x4206c2
inc dword [ebp + 8]
jmp 0x4206ab
mov eax, dword [ebp + 8]
movsx eax, byte [eax + 1]
cmp eax, 0x3a
jne 0x4206f7
lea eax, [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
movsx eax, byte [eax]
push eax
call dword [sym.imp.MSVCRT20.dll_toupper]
add esp, 4
mov byte [ebp - 0x18], al
mov byte [ebp - 0x17], 0x3a
mov byte [ebp - 0x16], 0x5c
mov byte [ebp - 0x15], 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
jne 0x420728
mov eax, 0x7fffffff
jmp 0x42075b
mov ecx, dword [ebp - 0x14]
imul ecx, dword [ebp - 8]
mov eax, 0x7fffffff
sub edx, edx
div ecx
cmp eax, dword [ebp - 4]
jb 0x420751
mov eax, dword [ebp - 4]
imul eax, dword [ebp - 0x14]
imul eax, dword [ebp - 8]
jmp 0x420756
mov eax, 0x7fffffff
jmp 0x42075b
pop edi
pop esi
pop ebx
leave
ret

Function at 0x420c29
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCRT20.dll__mkdir]
add esp, 4
jmp 0x420c41
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42108d
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0
push 0x2000000
push 3
push 0
push 3
push 0x80000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4210c9
mov eax, 0xffffffff
jmp 0x421116
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileTime]
mov eax, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.0041ff20
add esp, 8
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x421116
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42111b
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0
push 0x2000000
push 3
push 0
push 3
push 0x80000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x421157
mov eax, 0xffffffff
jmp 0x4211a4
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileTime]
mov eax, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0041ff20
add esp, 8
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4211a4
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4211a9
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0
push 0x2000000
push 3
push 0
push 3
push 0x40000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4211e5
mov eax, 0xffffffff
jmp 0x421232
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileTime]
mov eax, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0041ff20
add esp, 8
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x421232
pop edi
pop esi
pop ebx
leave
ret
Function at 0x423eb0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCRT20.dll_ftell]
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
push 0x100
push 1
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.MSVCRT20.dll_fread]
add esp, 0x10
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jg 0x423f07
push 0x42f988
call fcn.004081d7
add esp, 4
lea eax, [ebp - 0x110]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x10], eax
jge 0x423f77
mov eax, dword [ebp - 0xc]
movsx eax, byte [eax]
cmp eax, 0x41
jne 0x423f6c
push str.RJ_SFX
mov eax, dword [ebp - 0xc]
inc eax
push eax
call sub.MSVCRT20.dll_strcmp
add esp, 8
test eax, eax
jne 0x423f6c
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
cmp dword [eax + 8], ecx
jne 0x423f6c
jmp 0x423f9d
inc dword [ebp - 0x10]
inc dword [ebp - 0xc]
jmp 0x423f17
cmp dword [ebp - 0x114], 0x100
jne 0x423f98
push 1
push 0xfffffffffffffff0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCRT20.dll_fseek]
add esp, 0xc
jmp 0x423ebc
mov eax, dword [ebp - 0x10]
add eax, 0xc
add dword [ebp - 4], eax
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCRT20.dll_fseek]
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret

Function at 0x423fbe
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0x10]
push eax
push 1
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.MSVCRT20.dll_fwrite]
add esp, 0x10
cmp eax, dword [ebp + 0x10]
je 0x423ff1
push 0x42fa18
call fcn.004081d7
add esp, 4
pop edi
pop esi
pop ebx
leave
ret