joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412dca
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0xc]
mov ebx, dword [eax]
sub edx, 4
je 0x412e26
dec edx
je 0x412e0c
dec edx
je 0x412de9
push str.tftp_tx:_internal_error
jmp 0x412efb
inc dword [edi + 0x14]
push dword [edi + 0x14]
push str.Timeout_waiting_for_block__d_ACK.__Retries___d_n
push ebx
call fcn.004017c3
mov eax, dword [edi + 0x14]
add esp, 0xc
cmp eax, dword [edi + 0x1c]
jle 0x412e17
mov dword [edi + 8], 8
mov dword [edi], 3
jmp 0x412f09
push dword [edi + 0x58]
lea eax, [edi + 0x48]
push eax
mov eax, dword [edi + 0x60]
jmp 0x412ed3
movzx eax, word [edi + 0x66]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
movzx edx, word [edi + 0x30]
movzx eax, ax
mov ecx, edx
cmp eax, ecx
je 0x412e7a
push ecx
push eax
push str.Received_ACK_for_block__d__expecting__d_n
push ebx
call fcn.004017c3
add esp, 0x10
inc dword [edi + 0x14]
mov eax, dword [edi + 0x14]
cmp eax, dword [edi + 0x1c]
jle 0x412f21
movzx eax, word [edi + 0x30]
push eax
push str.tftp_tx:_giving_up_waiting_for_block__d_ack
push 0x556244
push ebx
call fcn.00401832
add esp, 0x10
jmp 0x412f21
and dword [edi + 0x14], 0
lea eax, [edx + 1]
mov esi, dword [sym.imp.WS2_32.dll_htons]
push 3
mov word [edi + 0x30], ax
call esi
mov word [edi + 0x268], ax
movzx eax, word [edi + 0x30]
push eax
call esi
cmp word [edi + 0x30], 1
mov edx, 0x200
mov word [edi + 0x26a], ax
jbe 0x412ebd
cmp dword [edi + 0x60], edx
jge 0x412ebd
mov dword [edi], 3
jmp 0x412f21
mov ecx, dword [edi + 0xc]
lea esi, [edi + 0x60]
push esi
call fcn.004072b8
pop ecx
push dword [edi + 0x58]
lea eax, [edi + 0x48]
push eax
mov eax, dword [esi]
push 0
add eax, 4
push eax
lea eax, [edi + 0x268]
push eax
push dword [edi + 0x10]
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
jns 0x412f09
call fcn.004f9cd5
push dword [eax]
call fcn.004f95c8
pop ecx
push eax
push 0x556244
push ebx
call fcn.00401832
add esp, 0xc
movzx eax, word [edi + 0x30]
cdq
shld edx, eax, 9
shl eax, 9
mov dword [ebx + 0x200], eax
mov dword [ebx + 0x204], edx
pop edi
pop esi
pop ebx
ret
Function at 0x4140bf
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, ecx
push esi
push edi
push 0x5c
mov eax, dword [ebx + 0x16c]
mov dword [ebp - 8], ebx
mov dword [ebp - 4], eax
push dword [eax]
call fcn.004f7f10
mov ebx, dword [ebx]
xorps xmm0, xmm0
mov dword [ebp - 0x18], eax
pop ecx
pop ecx
lea eax, [ebx + 0x2f4]
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], eax
movlpd qword [ebp - 0x10], xmm0
call fcn.0040ab70
mov ecx, dword [ebx + 0x80]
mov edi, edx
mov edx, dword [ebp - 8]
mov esi, eax
mov dword [edx + 0x200], ecx
mov eax, dword [ebx + 0x28]
mov dword [edx + 0x204], eax
lea eax, [ebx + 0x2f4]
mov dword [edx + 0x1fc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x414136
push 0x25
pop eax
jmp 0x414230
cmp byte [eax + 1], 0
je 0x41412e
mov eax, dword [ebp - 4]
push 0x5596b0
push dword [eax]
call fcn.004f6da5
mov dword [ebp - 0x18], eax
pop ecx
pop ecx
test eax, eax
jne 0x41416b
mov eax, dword [ebp - 4]
push dword [eax]
push str.Cant_open__s_for_writing
push ebx
call fcn.00401832
add esp, 0xc
push 0x17
jmp 0x414130
mov ecx, dword [ebx + 0xa8]
mov eax, dword [ebx + 0xac]
cmp ecx, 0xffffffff
jne 0x414180
cmp eax, ecx
je 0x41418c
push eax
push ecx
mov ecx, ebx
call fcn.0041368e
add esp, 8
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
push eax
mov edx, 0x4000
call fcn.004072b8
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x414225
cmp dword [ebp - 4], eax
jbe 0x414215
push dword [ebp - 0x18]
push dword [ebp - 4]
push 1
push dword [ebp - 0x1c]
call fcn.004f892c
add esp, 0x10
cmp eax, dword [ebp - 4]
jne 0x414210
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
adc eax, ebx
mov dword [ebp - 0xc], ecx
mov ebx, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
mov dword [ebx + 0x200], ecx
mov ecx, dword [ebp - 8]
mov dword [ebx + 0x204], eax
call fcn.004136bf
test eax, eax
jne 0x41420c
push edi
push esi
mov ecx, ebx
call fcn.00414ddd
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x414198
jmp 0x414225
push 0x2a
jmp 0x414212
push 0x37
pop ebx
jmp 0x414225
mov ecx, dword [ebp - 8]
call fcn.004136bf
push 0x2a
test eax, eax
pop ecx
cmovne ebx, ecx
push dword [ebp - 0x18]
call fcn.004f6c1e
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x415b53
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x581d10]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x54], 0
and dword [ebp - 0x58], 0
push esi
push edi
mov esi, edx
mov dword [ebp - 0x68], 0x67452301
push esi
mov edi, ecx
mov dword [ebp - 0x64], 0xefcdab89
mov dword [ebp - 0x60], 0x98badcfe
mov dword [ebp - 0x5c], 0x10325476
call fcn.004f9020
push eax
mov edx, esi
lea ecx, [ebp - 0x68]
call fcn.00415374
push 8
lea edx, [ebp - 0x58]
lea ecx, [ebp - 0xc]
call fcn.00415b1d
mov edx, dword [ebp - 0x58]
push 0x38
pop ecx
shr edx, 3
and edx, 0x3f
push 0x78
sub ecx, edx
pop eax
sub eax, edx
cmp edx, 0x38
mov edx, 0x54f720
cmovb eax, ecx
lea ecx, [ebp - 0x68]
push eax
call fcn.00415374
push 8
lea edx, [ebp - 0xc]
lea ecx, [ebp - 0x68]
call fcn.00415374
push 0x10
lea edx, [ebp - 0x68]
mov ecx, edi
call fcn.00415b1d
push 0x58
lea eax, [ebp - 0x68]
push 0
push eax
call fcn.004f28b0
mov ecx, dword [ebp - 4]
add esp, 0x24
xor ecx, ebp
pop edi
pop esi
call fcn.004f1cdb
mov esp, ebp
pop ebp
ret
Function at 0x416442
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
mov edi, edx
cmp dword [esi + 8], 0
jne 0x41646e
mov eax, dword [esi]
push 0x559b30
push dword [eax + 8]
call fcn.004f6da5
mov dword [esi + 8], eax
pop ecx
pop ecx
test eax, eax
jne 0x41646e
or eax, 0xffffffff
jmp 0x41649b
push dword [esi + 8]
push dword [ebp + 8]
push 1
push edi
call fcn.004f7192
mov edi, eax
add esp, 0x10
cmp edi, dword [ebp + 8]
je 0x416499
push dword [esi + 8]
call fcn.004f6c1e
and dword [esi + 8], 0
pop ecx
mov ecx, dword [esi]
mov ecx, dword [ecx]
mov dword [esi], ecx
mov eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x416ed0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1010
call fcn.004f5710
mov eax, dword [0x581d10]
xor eax, esp
mov dword [esp + 0x100c], eax
mov eax, dword [ebp + 8]
lea edx, [esp]
push esi
push edi
mov edi, dword [ebp + 0xc]
push edx
lea edx, [esp + 0x14]
mov dword [esp + 0xc], 0
push edx
lea edx, [esp + 0x14]
mov dword [esp + 0x14], 1
push edx
push 0
push eax
push dword [ecx]
mov dword [esp + 0x20], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x417017
mov ecx, dword [esp + 0xc]
cmp ecx, 1
jne 0x416fa4
cmp word [esp + 0x10], ax
jne 0x416f68
xor ecx, ecx
lea eax, [esp + 0x10]
push ecx
push eax
mov ecx, edi
call fcn.00417b50
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x100c]
xor ecx, esp
call fcn.004f1cdb
mov esp, ebp
pop ebp
ret 8
lea ecx, [esp + 0x10]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x416f70
sub ecx, edx
lea eax, [esp + 0x10]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.00417b50
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x100c]
xor ecx, esp
call fcn.004f1cdb
mov esp, ebp
pop ebp
ret 8
cmp ecx, 2
jne 0x417012
push 0x400
lea eax, [esp + 0x814]
push eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [esp + 8], eax
test eax, eax
je 0x416ff7
cmp eax, 0x400
ja 0x416ff7
lea eax, [esp + 0x810]
mov ecx, edi
push eax
call fcn.00417390
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x100c]
xor ecx, esp
call fcn.004f1cdb
mov esp, ebp
pop ebp
ret 8
mov eax, 0xea
pop edi
pop esi
mov ecx, dword [esp + 0x100c]
xor ecx, esp
call fcn.004f1cdb
mov esp, ebp
pop ebp
ret 8
mov eax, 0x3f4
mov ecx, dword [esp + 0x1014]
pop edi
pop esi
xor ecx, esp
call fcn.004f1cdb
mov esp, ebp
pop ebp
ret 8

Function at 0x417060
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
mov edx, dword [ebp + 0xc]
mov eax, edx
push esi
push edi
mov esi, ecx
mov dword [esp + 0xc], 0
lea edi, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x417080
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push 1
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x41b8d0
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x260
mov eax, dword [0x581d10]
xor eax, esp
mov dword [esp + 0x25c], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
cmp eax, 0x104
jb 0x41b90f
xor al, al
pop esi
pop ebx
mov ecx, dword [esp + 0x25c]
xor ecx, esp
call fcn.004f1cdb
mov esp, ebp
pop ebp
ret
test eax, eax
jne 0x41b929
mov al, 1
pop esi
pop ebx
mov ecx, dword [esp + 0x25c]
xor ecx, esp
call fcn.004f1cdb
mov esp, ebp
pop ebp
ret
mov bl, byte [ebp + 0xc]
test bl, bl
jne 0x41b98b
lea ecx, [esp + 0x28]
call fcn.0042b890
mov edx, ecx
mov ecx, esi
call fcn.0041bd70
test al, al
je 0x41b974
cmp byte [esp + 0x30], bl
je 0x41b974
cmp dword [esi + 0x14], 8
jb 0x41b954
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
pop esi
pop ebx
mov ecx, dword [esp + 0x25c]
xor ecx, esp
call fcn.004f1cdb
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x14], 8
jb 0x41b97e
mov eax, dword [esi]
jmp 0x41b980
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x41b913
xor eax, eax
push 0x208
push eax
mov word [esp + 0x58], ax
lea eax, [esp + 0x5a]
push eax
call fcn.004f28b0
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x41b9ad
mov esi, dword [esi]
lea ecx, [esp + 0x50]
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x41b9b1
mov word [esp + 0x24], ax
xorps xmm0, xmm0
mov dword [esp + 8], 0
lea eax, [esp + 0x50]
movq qword [esp + 0x1c], xmm0
movdqu xmmword [esp + 0xc], xmm0
mov dword [esp + 0x10], eax
mov eax, 0x414
mov dword [esp + 0xc], 3
mov word [esp + 0x18], ax
test bl, bl
jne 0x41ba06
mov eax, 0x1494
mov word [esp + 0x18], ax
lea eax, [esp + 8]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
cmp dword [esp + 0x1a], 0
jne 0x41b8f9
test eax, eax
je 0x41ba47
cmp eax, 2
je 0x41ba47
cmp eax, 0x402
je 0x41ba47
cmp eax, 0x7c
je 0x41ba47
xor eax, eax
pop esi
pop ebx
mov ecx, dword [esp + 0x25c]
xor ecx, esp
call fcn.004f1cdb
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x264]
mov eax, 1
pop esi
pop ebx
xor ecx, esp
call fcn.004f1cdb
mov esp, ebp
pop ebp
ret

Function at 0x41ba60
Capabilities:
Move file

Disassembly:
push esi
mov esi, edx
push edi
mov edi, ecx
cmp dword [esi + 0x14], 8
jb 0x41ba70
mov eax, dword [esi]
jmp 0x41ba72
mov eax, esi
cmp dword [edi + 0x14], 8
jb 0x41ba7a
mov ecx, dword [edi]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x41ba8b
mov al, 1
pop edi
pop esi
ret
cmp dword [edi + 0x14], 8
jb 0x41ba93
mov edi, dword [edi]
cmp dword [esi + 0x14], 8
jb 0x41ba9b
mov esi, dword [esi]
push 0
push 0
push 2
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReplaceFileW]
test eax, eax
pop edi
setne al
pop esi
ret

Function at 0x41bac0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x41bace
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne al
pop ebp
ret
Function at 0x41bae0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x41baee
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41bb02
shr eax, 4
and eax, 1
pop ebp
ret
xor al, al
pop ebp
ret

Function at 0x41bb10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x248
mov eax, dword [0x581d10]
xor eax, esp
mov dword [esp + 0x244], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [esp + 0x34]
push edi
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x102
ja 0x41bc1d
sub esp, 8
lea eax, [esp + 0x40]
mov edx, esp
mov dword [edx], eax
cmp word [esp + 0x40], 0
jne 0x41bb62
xor ecx, ecx
jmp 0x41bb7f
lea ecx, [esp + 0x40]
lea edi, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41bb70
sub ecx, edi
sar ecx, 1
mov dword [edx + 4], ecx
lea ecx, [esp + 0x28]
call fcn.004195a0
sub esp, 8
mov edx, esp
cmp dword [eax + 0x14], 8
jb 0x41bb9a
mov ecx, dword [eax]
jmp 0x41bb9c
mov ecx, eax
mov dword [edx], ecx
lea ecx, [esp + 0x10]
mov eax, dword [eax + 0x10]
mov dword [edx + 4], eax
call fcn.004195a0
lea ecx, [esp + 8]
call fcn.00419fa0
lea eax, [esp + 8]
cmp esi, eax
je 0x41bbca
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.00417a30
cmp dword [esp + 0x1c], 8
jb 0x41bbdd
push dword [esp + 8]
call fcn.004b1ca1
add esp, 4
xor eax, eax
mov dword [esp + 0x1c], 7
cmp dword [esp + 0x34], 8
mov dword [esp + 0x18], 0
mov word [esp + 8], ax
jb 0x41bc07
push dword [esp + 0x20]
call fcn.004b1ca1
add esp, 4
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x244]
xor ecx, esp
call fcn.004f1cdb
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x24c]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.004f1cdb
mov esp, ebp
pop ebp
ret
Function at 0x41bc40
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x581d10]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], 0
mov esi, edx
cmp dword [edi + 0x14], 8
jb 0x41bc6d
mov ebx, dword [edi]
jmp 0x41bc6f
mov ebx, edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41bcb1
test al, 0x10
je 0x41bc93
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004f1cdb
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x41bc9d
mov dword [esi], 0xfffffff7
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004f1cdb
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x14]
mov ecx, edi
push eax
call fcn.00419a40
cmp dword [edi + 0x14], 8
jb 0x41bcc7
mov eax, dword [edi]
jmp 0x41bcc9
mov eax, edi
push dword [edi + 0x10]
lea ecx, [esp + 0x18]
push eax
push dword [esp + 0x2c]
push 0
call fcn.0041b210
test eax, eax
jne 0x41bcee
test esi, esi
je 0x41bd38
mov dword [esi], 0xfffffffc
xor bl, bl
jmp 0x41bd3e
mov edx, esi
lea ecx, [esp + 0x14]
call fcn.0041bc40
test al, al
jne 0x41bd01
xor bl, bl
jmp 0x41bd3e
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x41bd3c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 0xb7
jne 0x41bd2b
push edi
call fcn.0041bae0
add esp, 4
test al, al
jne 0x41bd3c
test esi, esi
je 0x41bd38
mov ecx, ebx
call fcn.0042b8d0
mov dword [esi], eax
xor bl, bl
jmp 0x41bd3e
mov bl, 1
cmp dword [esp + 0x28], 8
jb 0x41bd51
push dword [esp + 0x14]
call fcn.004b1ca1
add esp, 4
mov ecx, dword [esp + 0x2c]
mov al, bl
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004f1cdb
mov esp, ebp
pop ebp
ret

Function at 0x41bf40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov dword [esp + 0x10], 0
cmp dword [eax + 0x14], 8
push edi
mov edi, dword [ebp + 0x10]
jb 0x41bf65
mov eax, dword [eax]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [esp + 0x10], 0
test esi, esi
je 0x41bffc
lea ecx, [esp + 0x10]
call fcn.00417470
cmp esi, 0xffffffff
je 0x41bfd3
mov dword [esp + 0x10], esi
call fcn.0042a570
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 4]
mov ecx, dword [0x5afd18]
mov dword [esp + 0x1c], eax
test ecx, ecx
jne 0x41bfc0
call fcn.0042a5d0
mov ecx, dword [0x5afd18]
push dword [esp + 0x18]
mov eax, dword [ecx]
lea edx, [esp + 0x14]
push dword [esp + 0x20]
push edx
push esi
call dword [eax + 4]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x41bffc
cmp eax, 0xffffffff
je 0x41bffc
push 0
lea ecx, [esp + 0x18]
push ecx
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x41bffc
mov esi, dword [esp + 0x14]
cmp esi, edi
je 0x41bfff
or esi, 0xffffffff
lea ecx, [esp + 0x10]
call fcn.00417470
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41c020
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
push ecx
push esi
push edi
mov esi, edx
mov edi, ecx
call fcn.00419e10
test al, al
jne 0x41c08c
mov ecx, esi
call fcn.00419e10
test al, al
jne 0x41c08c
cmp dword [edi + 0x10], 0x104
jae 0x41c08c
cmp dword [esi + 0x10], 0x104
jae 0x41c08c
cmp dword [esi + 0x14], 8
jb 0x41c055
mov esi, dword [esi]
cmp dword [edi + 0x14], 8
jb 0x41c05d
mov edi, dword [edi]
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x41c08c
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41c08c
test al, 1
je 0x41c086
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov al, 1
pop edi
pop esi
pop ecx
ret
pop edi
xor al, al
pop esi
pop ecx
ret
Function at 0x421580
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov ebx, edx
mov esi, ecx
push edi
test ebx, ebx
je 0x4215a7
cmp dword [ebx + 0x14], 0x10
mov dword [ebx + 0x10], 0
jb 0x4215a2
mov eax, dword [ebx]
jmp 0x4215a4
mov eax, ebx
mov byte [eax], 0
call fcn.00419e10
test al, al
je 0x4215b9
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, esi
call fcn.0041bea0
mov edi, eax
mov dword [ebp - 0xc], edi
test edi, edi
je 0x4215b0
push 0x10000
call fcn.004f046c
add esp, 4
mov dword [ebp - 8], 0
mov esi, eax
push edi
push 0x10000
push 1
push esi
call fcn.004f7192
mov edi, eax
add esp, 0x10
mov dword [ebp - 0x10], edi
test edi, edi
je 0x42164f
mov eax, dword [ebp + 8]
lea esp, [esp]
test ebx, ebx
je 0x421622
sub eax, dword [ebp - 8]
lea edx, [ebp - 0x10]
cmp eax, edi
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x14]
cmovae ecx, edx
push dword [ecx]
mov ecx, ebx
push esi
call fcn.004176b0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
sub eax, ecx
cmp eax, edi
jb 0x421665
push dword [ebp - 0xc]
add ecx, edi
push 0x10000
push 1
push esi
mov dword [ebp - 8], ecx
call fcn.004f7192
mov edi, eax
add esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], edi
test edi, edi
jne 0x421600
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.004f6cbb
add esp, 4
test eax, eax
jne 0x421668
mov byte [ebp - 1], 1
jmp 0x42166c
mov ebx, dword [ebp - 0xc]
mov byte [ebp - 1], 0
push ebx
call fcn.004f6c1e
add esp, 4
test esi, esi
je 0x421682
push esi
call fcn.004f2acf
add esp, 4
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4216b0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.0041bc40
Function at 0x422aa0
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x43c
mov eax, dword [0x581d10]
xor eax, esp
mov dword [esp + 0x438], eax
push ebx
mov ebx, ecx
push esi
push edi
lea edi, [ebx + 8]
push edi
call fcn.00423140
add esp, 4
lea eax, [esp + 0x10]
lea esi, [ebx + 0xc]
mov ecx, esi
push eax
call fcn.0041b6b0
mov eax, dword [0x5afcec]
test eax, eax
je 0x422b09
lea ecx, [esp + 0x10]
push ecx
push dword [ebx + 0xa0]
push dword [ebx + 0xa8]
push dword [ebx + 0xa4]
push dword [ebx]
call eax
add esp, 0x14
test al, al
jne 0x422c8b
test byte [0x5a8910], 2
je 0x422b29
cmp dword [esp + 0x24], 0x10
lea eax, [esp + 0x10]
cmovae eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x422b2e
cmp dword [ebx], 2
jl 0x422b69
cmp dword [esp + 0x24], 0x10
lea edi, [esp + 0x10]
mov esi, dword [esp + 0x20]
cmovae edi, dword [esp + 0x10]
call fcn.004f9145
add eax, 0x40
push eax
push 1
push esi
push edi
call fcn.004f892c
call fcn.004f9145
add eax, 0x40
push eax
call fcn.004fa30f
lea edi, [ebx + 8]
add esp, 0x14
lea esi, [ebx + 0xc]
test byte [0x5a8910], 1
je 0x422c08
xor edx, edx
xor ecx, ecx
call fcn.00422540
cmp dword [0x5afce4], 0
jne 0x422b98
push 0xffffffffffffffff
push dword [0x5afcd8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x422ba4
push dword [0x5afcdc]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call fcn.004226b0
test al, al
je 0x422be5
push 2
push 0
push 0
push dword [0x5afcf0]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [esp + 0x24], 0x10
lea ecx, [esp + 0xc]
push 0
push ecx
push dword [esp + 0x28]
lea eax, [esp + 0x1c]
cmovae eax, dword [esp + 0x1c]
push eax
push dword [0x5afcf0]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [0x5afce4], 0
jne 0x422bfc
push dword [0x5afcd8]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x422c08
push dword [0x5afcdc]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebx], 3
jne 0x422c8b
mov ecx, 0x400
lea eax, [esp + 0x10]
cmp dword [esp + 0x20], ecx
cmovb ecx, dword [esp + 0x20]
cmp dword [esp + 0x24], 0x10
cmovae eax, dword [esp + 0x10]
test ecx, ecx
je 0x422c3c
push ecx
push eax
lea eax, [esp + 0x48]
push eax
call fcn.004f2260
add esp, 0xc
lea eax, [esp + 0x40]
push eax
call fcn.0042ebe0
add esp, 4
cmp dword [0x5afce8], 0
je 0x422c81
lea eax, [esp + 0x28]
mov ecx, esi
push eax
call fcn.0041b6b0
lea eax, [esp + 0x28]
push eax
call dword [0x5afce8]
add esp, 4
cmp dword [esp + 0x3c], 0x10
jb 0x422c8b
push dword [esp + 0x28]
call fcn.004b1ca1
add esp, 4
jmp 0x422c8b
cmp byte [0x5afd70], 0
jne 0x422cd8
int3
cmp dword [esp + 0x24], 0x10
jb 0x422c9e
push dword [esp + 0x10]
call fcn.004b1ca1
add esp, 4
push dword [ebx + 0xac]
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea esi, [edi + 0x50]
mov ecx, esi
call fcn.0041a690
push esi
mov dword [esi], vtable.std::ios_base.0
call fcn.004f0b93
mov ecx, dword [esp + 0x448]
add esp, 4
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004f1cdb
mov esp, ebp
pop ebp
ret
push 1
call fcn.004fc384
int3