joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f462
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 7
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx*4 + 0x42d1f4]
push eax
call dword [sym.imp.KERNEL32.dll_ClearCommError]
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp - 0x14]
jae 0x40f498
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x24], edx
jmp 0x40f49e
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
jbe 0x40f56f
mov edx, dword [ebp - 4]
imul edx, edx, 0x14
add edx, 0x42d028
push edx
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax*4 + 0x42d1f4]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x40f56f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x40f54f
push 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 4]
imul eax, eax, 0x14
add eax, 0x42d028
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx*4 + 0x42d1f4]
push edx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x40f54d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x3e4
jne 0x40f52d
jmp 0x40f4f2
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx*4 + 0x42d1f4]
push eax
call dword [sym.imp.KERNEL32.dll_ClearCommError]
mov dword [ebp - 8], 0
jmp 0x40f56f
mov dword [ebp - 8], 0
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax*4 + 0x42d1f4]
push ecx
call dword [sym.imp.KERNEL32.dll_ClearCommError]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x40f576
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 8
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx*4 + 0x42d1f4]
push eax
call dword [sym.imp.KERNEL32.dll_ClearCommError]
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp - 0x14]
jae 0x40f5ac
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x24], edx
jmp 0x40f5b2
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
jbe 0x40f683
mov edx, dword [ebp - 4]
imul edx, edx, 0x14
add edx, 0x42d028
push edx
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax*4 + 0x42d1f4]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x40f683
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x40f663
push 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 4]
imul eax, eax, 0x14
add eax, 0x42d028
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx*4 + 0x42d1f4]
push edx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x40f661
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x3e4
jne 0x40f641
jmp 0x40f606
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx*4 + 0x42d1f4]
push eax
call dword [sym.imp.KERNEL32.dll_ClearCommError]
mov dword [ebp - 8], 0
jmp 0x40f683
mov dword [ebp - 8], 0
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax*4 + 0x42d1f4]
push ecx
call dword [sym.imp.KERNEL32.dll_ClearCommError]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x40f68a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 9
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx*4 + 0x42d1f4]
push eax
call dword [sym.imp.KERNEL32.dll_ClearCommError]
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp - 0x14]
jae 0x40f6c0
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x24], edx
jmp 0x40f6c6
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
jbe 0x40f797
mov edx, dword [ebp - 4]
imul edx, edx, 0x14
add edx, 0x42d028
push edx
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax*4 + 0x42d1f4]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x40f797
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x40f777
push 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 4]
imul eax, eax, 0x14
add eax, 0x42d028
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx*4 + 0x42d1f4]
push edx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x40f775
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x3e4
jne 0x40f755
jmp 0x40f71a
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx*4 + 0x42d1f4]
push eax
call dword [sym.imp.KERNEL32.dll_ClearCommError]
mov dword [ebp - 8], 0
jmp 0x40f797
mov dword [ebp - 8], 0
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax*4 + 0x42d1f4]
push ecx
call dword [sym.imp.KERNEL32.dll_ClearCommError]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x40f79e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
cmp dword [0x42d230], 0
je 0x40f7c9
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [0x42d230]
add esp, 0xc
mov eax, dword [ebp + 8]
imul eax, eax, 0x14
add eax, 0x42d100
push eax
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx*4 + 0x42d1f4]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40f889
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x40f86c
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp + 8]
imul ecx, ecx, 0x14
add ecx, 0x42d100
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx*4 + 0x42d1f4]
push eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x40f86a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x3e4
jne 0x40f851
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x20]
mov dword [ebp - 4], ecx
jmp 0x40f80c
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx*4 + 0x42d1f4]
push edx
call dword [sym.imp.KERNEL32.dll_ClearCommError]
jmp 0x40f889
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx*4 + 0x42d1f4]
push eax
call dword [sym.imp.KERNEL32.dll_ClearCommError]
xor eax, eax
jmp 0x40f88e
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x40f892
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
cmp dword [0x42d230], 0
je 0x40f8bd
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [0x42d230]
add esp, 0xc
mov eax, dword [ebp + 8]
imul eax, eax, 0x14
add eax, 0x42d100
push eax
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx*4 + 0x42d1f4]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40f97d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x40f960
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp + 8]
imul ecx, ecx, 0x14
add ecx, 0x42d100
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx*4 + 0x42d1f4]
push eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x40f95e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x3e4
jne 0x40f945
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x20]
mov dword [ebp - 4], ecx
jmp 0x40f900
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx*4 + 0x42d1f4]
push edx
call dword [sym.imp.KERNEL32.dll_ClearCommError]
jmp 0x40f97d
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx*4 + 0x42d1f4]
push eax
call dword [sym.imp.KERNEL32.dll_ClearCommError]
xor eax, eax
jmp 0x40f982
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x40f986
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
cmp dword [0x42d230], 0
je 0x40f9b1
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [0x42d230]
add esp, 0xc
mov eax, dword [ebp + 8]
imul eax, eax, 0x14
add eax, 0x42d100
push eax
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx*4 + 0x42d1f4]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40fa71
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x40fa54
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp + 8]
imul ecx, ecx, 0x14
add ecx, 0x42d100
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx*4 + 0x42d1f4]
push eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x40fa52
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x3e4
jne 0x40fa39
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x20]
mov dword [ebp - 4], ecx
jmp 0x40f9f4
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx*4 + 0x42d1f4]
push edx
call dword [sym.imp.KERNEL32.dll_ClearCommError]
jmp 0x40fa71
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx*4 + 0x42d1f4]
push eax
call dword [sym.imp.KERNEL32.dll_ClearCommError]
xor eax, eax
jmp 0x40fa76
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x40fa7a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
cmp dword [0x42d230], 0
je 0x40faa5
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [0x42d230]
add esp, 0xc
mov eax, dword [ebp + 8]
imul eax, eax, 0x14
add eax, 0x42d100
push eax
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx*4 + 0x42d1f4]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40fb65
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x40fb48
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp + 8]
imul ecx, ecx, 0x14
add ecx, 0x42d100
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx*4 + 0x42d1f4]
push eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x40fb46
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x3e4
jne 0x40fb2d
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x20]
mov dword [ebp - 4], ecx
jmp 0x40fae8
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx*4 + 0x42d1f4]
push edx
call dword [sym.imp.KERNEL32.dll_ClearCommError]
jmp 0x40fb65
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx*4 + 0x42d1f4]
push eax
call dword [sym.imp.KERNEL32.dll_ClearCommError]
xor eax, eax
jmp 0x40fb6a
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x40fb6e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
cmp dword [0x42d230], 0
je 0x40fb99
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [0x42d230]
add esp, 0xc
mov eax, dword [ebp + 8]
imul eax, eax, 0x14
add eax, 0x42d100
push eax
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx*4 + 0x42d1f4]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40fc59
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x40fc3c
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp + 8]
imul ecx, ecx, 0x14
add ecx, 0x42d100
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx*4 + 0x42d1f4]
push eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x40fc3a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x3e4
jne 0x40fc21
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x20]
mov dword [ebp - 4], ecx
jmp 0x40fbdc
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx*4 + 0x42d1f4]
push edx
call dword [sym.imp.KERNEL32.dll_ClearCommError]
jmp 0x40fc59
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx*4 + 0x42d1f4]
push eax
call dword [sym.imp.KERNEL32.dll_ClearCommError]
xor eax, eax
jmp 0x40fc5e
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x40fc62
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
cmp dword [0x42d230], 0
je 0x40fc8d
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [0x42d230]
add esp, 0xc
mov eax, dword [ebp + 8]
imul eax, eax, 0x14
add eax, 0x42d100
push eax
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx*4 + 0x42d1f4]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40fd4d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x40fd30
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp + 8]
imul ecx, ecx, 0x14
add ecx, 0x42d100
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx*4 + 0x42d1f4]
push eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x40fd2e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x3e4
jne 0x40fd15
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x20]
mov dword [ebp - 4], ecx
jmp 0x40fcd0
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx*4 + 0x42d1f4]
push edx
call dword [sym.imp.KERNEL32.dll_ClearCommError]
jmp 0x40fd4d
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx*4 + 0x42d1f4]
push eax
call dword [sym.imp.KERNEL32.dll_ClearCommError]
xor eax, eax
jmp 0x40fd52
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x40fd56
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
cmp dword [0x42d230], 0
je 0x40fd81
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [0x42d230]
add esp, 0xc
mov eax, dword [ebp + 8]
imul eax, eax, 0x14
add eax, 0x42d100
push eax
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx*4 + 0x42d1f4]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40fe41
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x40fe24
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp + 8]
imul ecx, ecx, 0x14
add ecx, 0x42d100
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx*4 + 0x42d1f4]
push eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x40fe22
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x3e4
jne 0x40fe09
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x20]
mov dword [ebp - 4], ecx
jmp 0x40fdc4
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx*4 + 0x42d1f4]
push edx
call dword [sym.imp.KERNEL32.dll_ClearCommError]
jmp 0x40fe41
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx*4 + 0x42d1f4]
push eax
call dword [sym.imp.KERNEL32.dll_ClearCommError]
xor eax, eax
jmp 0x40fe46
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x40fe4a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
cmp dword [0x42d230], 0
je 0x40fe75
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [0x42d230]
add esp, 0xc
mov eax, dword [ebp + 8]
imul eax, eax, 0x14
add eax, 0x42d100
push eax
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx*4 + 0x42d1f4]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40ff35
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x40ff18
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp + 8]
imul ecx, ecx, 0x14
add ecx, 0x42d100
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx*4 + 0x42d1f4]
push eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x40ff16
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x3e4
jne 0x40fefd
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x20]
mov dword [ebp - 4], ecx
jmp 0x40feb8
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx*4 + 0x42d1f4]
push edx
call dword [sym.imp.KERNEL32.dll_ClearCommError]
jmp 0x40ff35
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx*4 + 0x42d1f4]
push eax
call dword [sym.imp.KERNEL32.dll_ClearCommError]
xor eax, eax
jmp 0x40ff3a
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x40ff3e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
cmp dword [0x42d230], 0
je 0x40ff69
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [0x42d230]
add esp, 0xc
mov eax, dword [ebp + 8]
imul eax, eax, 0x14
add eax, 0x42d100
push eax
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx*4 + 0x42d1f4]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x410029
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x41000c
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp + 8]
imul ecx, ecx, 0x14
add ecx, 0x42d100
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx*4 + 0x42d1f4]
push eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x41000a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x3e4
jne 0x40fff1
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x20]
mov dword [ebp - 4], ecx
jmp 0x40ffac
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx*4 + 0x42d1f4]
push edx
call dword [sym.imp.KERNEL32.dll_ClearCommError]
jmp 0x410029
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx*4 + 0x42d1f4]
push eax
call dword [sym.imp.KERNEL32.dll_ClearCommError]
xor eax, eax
jmp 0x41002e
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x410032
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
cmp dword [0x42d230], 0
je 0x41005d
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [0x42d230]
add esp, 0xc
mov eax, dword [ebp + 8]
imul eax, eax, 0x14
add eax, 0x42d100
push eax
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx*4 + 0x42d1f4]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x41011d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x410100
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp + 8]
imul ecx, ecx, 0x14
add ecx, 0x42d100
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx*4 + 0x42d1f4]
push eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x4100fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x3e4
jne 0x4100e5
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x20]
mov dword [ebp - 4], ecx
jmp 0x4100a0
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx*4 + 0x42d1f4]
push edx
call dword [sym.imp.KERNEL32.dll_ClearCommError]
jmp 0x41011d
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx*4 + 0x42d1f4]
push eax
call dword [sym.imp.KERNEL32.dll_ClearCommError]
xor eax, eax
jmp 0x410122
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x401d10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x401d3c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x401d5e
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x401d60
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x401de5
jg 0x401d75
test esi, esi
je 0x401de5
test ecx, ecx
jl 0x401dc8
jg 0x401d7f
test eax, eax
je 0x401dc8
cmp edi, ecx
jg 0x401d93
jl 0x401d89
cmp esi, eax
jae 0x401d93
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov eax, dword [ebx + 0x30]
sub esi, ecx
mov edx, dword [ebp + 8]
sbb edi, dword [esp + 0x10]
add edx, ecx
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
test edi, edi
jl 0x401de5
jg 0x401dcb
test esi, esi
je 0x401de5
jmp 0x401dcb
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x401de5
push eax
push esi
push 1
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc