joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40de85
Capabilities:
Read file on windows

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 0x10], esi
jle 0x40ded9
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x14]
and dword [esp + 0x10], 0
lea eax, [esp + 0x10]
push 0
push eax
mov eax, dword [esp + 0x20]
sub eax, esi
push eax
lea eax, [esi + ebp]
push eax
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40dec7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x40ded3
add esi, dword [esp + 0x10]
cmp esi, dword [esp + 0x18]
jl 0x40de98
jmp 0x40ded7
add esi, dword [esp + 0x10]
pop ebp
pop ebx
mov eax, esi
pop esi
ret 0xc
Function at 0x40eb37
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
push 0x40ea86
push 0x10
push 0x2c
call fcn.00425a6b
push 0
push 0
push 8
mov dword [0x506a18], eax
call fcn.004257c6
cmp word [0x506a10], 0
mov dword [0x508240], eax
jne 0x40ec1c
push edi
lea eax, [esp + 4]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
xor edi, edi
inc edi
test eax, eax
jne 0x40eb8f
mov word [0x506a10], di
jmp 0x40eb97
xor eax, eax
mov word [0x506a10], ax
push str.ws2_32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x506a2c], eax
test eax, eax
je 0x40ec1b
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.getaddrinfo
push eax
call esi
push str.freeaddrinfo
push dword [0x506a2c]
mov dword [0x506a1c], eax
call esi
push str.getnameinfo
push dword [0x506a2c]
mov dword [0x506a20], eax
call esi
push str.WSAStringToAddressA
push dword [0x506a2c]
mov dword [0x506a24], eax
call esi
cmp dword [0x506a1c], 0
mov dword [0x506a28], eax
pop esi
je 0x40ec1b
cmp dword [0x506a20], 0
je 0x40ec1b
cmp dword [0x506a24], 0
je 0x40ec1b
test eax, eax
je 0x40ec1b
mov dword [0x506a14], edi
pop edi
add esp, 0x190
ret

Function at 0x410af0
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x506a38], 0
jne 0x410afe
call fcn.00410a90
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push dword [0x506a3c]
call esi
test eax, eax
jne 0x410b21
call fcn.00410a90
push dword [0x506a3c]
call esi
mov edx, dword [esp + 0x14]
lea esi, [eax + 8]
mov edi, 0x11
lea ecx, [ecx]
imul ecx, edx, 0x53a9b4fb
lea esi, [esi + 4]
mov edx, 1
sub edx, ecx
imul ecx, edx, 0x53a9b4fb
mov dword [esi + 0x40], edx
mov edx, 1
sub edx, ecx
mov dword [esi - 4], edx
dec edi
jne 0x410b30
mov dword [eax], edi
lea ebp, [edi + 0x1f]
mov dword [eax + 4], 0xa
mov ebx, dword [eax]
mov edi, dword [eax + 4]
mov edx, dword [eax + ebx*4 + 8]
mov ecx, dword [eax + ebx*4 + 0x4c]
mov esi, dword [eax + edi*4 + 8]
ror ecx, 0xd
add ecx, dword [eax + edi*4 + 0x4c]
dec edi
ror edx, 5
add edx, esi
mov dword [eax + ebx*4 + 8], ecx
mov dword [eax + ebx*4 + 0x4c], edx
dec ebx
jns 0x410b90
mov ebx, 0x10
test edi, edi
jns 0x410b99
mov edi, 0x10
mov dword [eax], ebx
mov dword [eax + 4], edi
dec ebp
jne 0x410b62
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x411e22
Capabilities:
Get graphical window text

Disassembly:
push ebx
push dword [esp + 8]
push dword [0x5081e0]
call fcn.00425998
mov ebx, eax
test ebx, ebx
je 0x411e86
mov ecx, dword [ebx + 4]
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x411e4b
push dword [esp + 0xc]
push ebx
call eax
jmp 0x411e86
push esi
push edi
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
push dword [esp + 0x14]
mov edi, eax
push edi
call fcn.00426610
mov esi, eax
lea ecx, [edi + 1]
push ecx
xor eax, eax
push esi
mov word [esi], ax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push esi
call sub.MSVCRT.dll_wcslen
pop ecx
sub edi, eax
push edi
call fcn.004266f0
pop edi
pop esi
pop ebx
ret 8
Function at 0x415d4d
Capabilities:
Check os version

Disassembly:
sub esp, 0x114
push ebx
push ebp
push esi
push edi
push dword [0x508260]
call fcn.0042575b
xor ebp, ebp
mov esi, eax
cmp dword [0x507388], ebp
jne 0x415e29
xor ebx, ebx
inc ebx
mov dword [0x507388], ebx
call fcn.0041805c
mov edi, 0xa4
push edi
push ebp
push 0x507390
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [0x507390], 0x13
lea eax, [esp + 0x10]
mov dword [0x507394], edi
mov dword [0x5073a0], 0x415c98
mov dword [0x5073a4], 0x415fe3
push eax
mov dword [0x5073f8], 0x415c73
mov dword [0x5073fc], 0x415f2e
mov dword [0x50739c], 0x415c4e
mov dword [0x507420], 0x415cb3
mov dword [0x507434], ebx
mov dword [esp + 0x14], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x415e29
cmp dword [esp + 0x20], ebx
je 0x415e11
cmp dword [esp + 0x20], 2
jne 0x415e29
cmp dword [esp + 0x14], 5
jae 0x415e19
mov dword [0x507434], ebp
jmp 0x415e29
jne 0x415e29
mov eax, dword [esp + 0x18]
neg eax
sbb eax, eax
and dword [0x507434], eax
lea eax, [esp + 0x138]
push eax
lea eax, [esp + 0x138]
push eax
lea eax, [esp + 0x138]
push eax
lea eax, [esp + 0x138]
push eax
call fcn.0041d21c
mov eax, dword [esp + 0x140]
push ebp
push dword [0x5063e4]
or eax, 0x50010000
push 0xffffffffffffffff
push dword [esi]
push dword [esp + 0x148]
push dword [esp + 0x148]
push dword [esp + 0x148]
push dword [esp + 0x148]
push eax
push ebp
push str.BUTTON
push ebp
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ebx, eax
test ebx, ebx
je 0x415eff
push dword [esp + 0x128]
push dword [0x5081e0]
call fcn.004259d7
mov edi, dword [esp + 0x13c]
mov esi, eax
mov dword [esi + 0x10], edi
test edi, edi
je 0x415ece
push edi
call fcn.00420571
test eax, eax
je 0x415ece
push ebp
push ebp
push edi
call fcn.004201bb
mov dword [esi + 0x18], eax
jmp 0x415ed1
mov dword [esi + 0x18], ebp
push 0x41599d
push 0xfffffffffffffffc
push ebx
mov dword [esi + 0x14], ebp
mov dword [esi + 0x1c], ebp
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0x507390
push ebx
push esi
push dword [esp + 0x134]
mov dword [0x50738c], eax
call fcn.004177c3
mov ebx, eax
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x114
ret 0x1c

Function at 0x4185b7
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4bc
lea eax, [ebp - 0x208]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov eax, dword [ebp + 8]
or eax, 0x4000
push eax
push 0x2b4
lea eax, [ebp - 0x4bc]
push eax
push 0
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov esp, ebp
pop ebp
ret 4
Function at 0x4188b9
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [0x507688], 0
jne 0x41898a
push ebx
push ebp
push esi
xor ebp, ebp
inc ebp
push 0x508280
mov dword [0x507688], ebp
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov eax, 0x640
push eax
push 8
push dword [0x5063e0]
mov dword [0x507b4c], eax
mov dword [0x50768c], 0x1f4
call esi
mov dword [0x507b5c], eax
mov eax, dword [0x50768c]
add eax, eax
push eax
push 8
push dword [0x5063e0]
call esi
xor ebx, ebx
mov dword [0x507b58], eax
push 0x507b68
mov dword [0x507b50], ebx
mov dword [0x507b54], ebp
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebx
push ebx
push ebp
push ebx
call esi
push ebx
push ebx
push ebp
push ebx
mov dword [0x507b80], eax
call esi
mov dword [0x507b84], eax
cmp dword [0x507b80], ebx
je 0x418981
test eax, eax
je 0x418981
lea eax, [esp + 0xc]
mov dword [0x507b60], ebx
push eax
push ebx
push ebx
push 0x4183bc
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x507b64], eax
jmp 0x418987
mov dword [0x507b60], ebp
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x418e95
Capabilities:
Check os version

Disassembly:
sub esp, 0x350
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x114
xor ebx, ebx
mov esi, 0xc8
and dword [esp + 0x10], ebx
xor edi, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x41900b
mov eax, dword [esp + 0x24]
dec eax
je 0x418fee
dec eax
jne 0x41900b
lea eax, [esp + 0x128]
xor ebp, ebp
push eax
call fcn.00418e4e
pop ecx
test eax, eax
je 0x418f4c
mov ebx, dword [esp + 0x12c]
mov edi, dword [esp + 0x130]
mov eax, dword [esp + 0x134]
cmp byte [esp + 0x242], 1
jne 0x418f0f
xor ebp, ebp
inc ebp
sub ebx, 3
je 0x418fea
dec ebx
je 0x418fe6
dec ebx
je 0x418fc5
dec ebx
je 0x418f7f
sub ebx, 4
jne 0x41900b
test edi, edi
jne 0x41900b
cmp eax, 0x55f0
sbb esi, esi
and esi, 0xfffffff6
add esi, 0x78
jmp 0x41900b
lea eax, [esp + 0x244]
mov dword [esp + 0x244], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, dword [esp + 0x10]
je 0x418f0f
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
cmp byte [esp + 0x35e], 1
jmp 0x418f0a
sub edi, 0
je 0x418fb7
dec edi
je 0x418fa9
dec edi
je 0x418f9b
dec edi
jne 0x41900b
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x69
jmp 0x41900b
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x5f
jmp 0x41900b
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x55
jmp 0x41900b
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x4b
jmp 0x41900b
sub edi, 0
je 0x418fe2
dec edi
je 0x418fde
dec edi
jne 0x41900b
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x41
jmp 0x41900b
push 0x3c
jmp 0x41900a
push 0x32
jmp 0x41900a
push 0x14
jmp 0x41900a
push 5
jmp 0x41900a
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x419008
cmp eax, 0xa
je 0x419004
cmp eax, 0x5a
jne 0x41900b
push 0x28
jmp 0x41900a
push 0x1e
jmp 0x41900a
push 0xa
pop esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x350
ret
Function at 0x4191dd
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
push dword [0x5081e4]
call fcn.00425998
mov esi, eax
test esi, esi
je 0x4192b7
cmp dword [ebp + 0xc], 0
je 0x419229
push 4
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
je 0x41921a
cmp dword [esi + 0x1c], 0
jne 0x41921a
push eax
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4192b7
test byte [ebp + 0x10], 3
je 0x419244
push 4
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindow]
push eax
push dword [ebp + 0x10]
push dword [esi]
call fcn.004199d3
cmp dword [esi + 0x3c], 0xffffffff
push ebx
je 0x419269
xor ebx, ebx
cmp dword [esi + 0x3c], 0x1000000
sete bl
xor ecx, ecx
cmp dword [esi + 0x3c], 0x20000000
sete cl
or dword [esi + 0x3c], 0xffffffff
jmp 0x41927d
push dword [esi]
call dword [sym.imp.USER32.dll_IsZoomed]
push dword [esi]
mov ebx, eax
call dword [sym.imp.USER32.dll_IsIconic]
mov ecx, eax
test dword [ebp + 0x10], 0x2000000
je 0x41929a
test ebx, ebx
je 0x41928e
push 8
jmp 0x4192a0
neg ecx
sbb ecx, ecx
and ecx, 3
add ecx, 4
jmp 0x4192ad
test ebx, ebx
je 0x4192a3
push 3
pop ecx
jmp 0x4192ad
xor eax, eax
test ecx, ecx
setne al
lea ecx, [eax + 1]
push ecx
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebx
pop esi
pop ebp
ret 0xc
Function at 0x41a37a
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
push edi
xor edi, edi
call dword [sym.imp.USER32.dll_GetFocus]
mov ebp, dword [esp + 0x3c]
mov ebx, eax
and dword [esp + 0x10], edi
push str.PB_WindowID
push ebp
call dword [sym.imp.USER32.dll_GetPropW]
mov esi, eax
push 9
pop eax
test esi, esi
je 0x41a412
lea eax, [esp + 0x14]
push eax
push ebp
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x41a40f
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esp + 0x14], eax
jne 0x41a40f
lea eax, [esi - 1]
push eax
push dword [0x5081e4]
call fcn.00425998
mov edi, eax
mov dword [esp + 0x10], 1
xor eax, eax
push 9
cmp dword [edi + 0x10], eax
jle 0x41a411
mov edx, dword [edi + 4]
xor ecx, ecx
pop esi
cmp word [ecx + edx + 2], si
jne 0x41a406
mov esi, 0xfa01
push 9
cmp word [ecx + edx + 4], si
je 0x41a4f9
pop esi
inc eax
add ecx, 6
cmp eax, dword [edi + 0x10]
jl 0x41a3ec
push 9
pop eax
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
test ebx, ebx
je 0x41a4b8
push eax
call esi
test al, al
jns 0x41a4b8
push 0x11
call esi
test al, al
js 0x41a4b8
push 0x10
call esi
test al, al
js 0x41a4b8
push 0x12
call esi
test al, al
js 0x41a4b8
push 0x10
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClassNameW]
cmp dword [esp + 0x10], 0
jne 0x41a4b8
push 5
lea eax, [esp + 0x1c]
push str.RichE
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
je 0x41a48c
push 4
lea eax, [esp + 0x1c]
push str.RICHE
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
jne 0x41a4a3
push 0
push 0
push 0x44e
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, 0x800
je 0x41a503
lea eax, [esp + 0x18]
push str.Scintilla
push eax
call sub.MSVCRT.dll_wcscmp
pop ecx
pop ecx
test eax, eax
je 0x41a503
test ebp, ebp
je 0x41a4dc
push 0x11
call esi
test al, al
js 0x41a4d4
push 0x10
call esi
test al, al
js 0x41a4d4
push 0x12
call esi
test al, al
jns 0x41a4dc
push 1
push ebp
call fcn.0041a50f
test ebx, ebx
je 0x41a4f0
push str.PB_Hotkey
push ebx
call dword [sym.imp.USER32.dll_GetPropW]
test eax, eax
jne 0x41a503
test edi, edi
je 0x41a503
mov eax, dword [edi + 8]
jmp 0x41a505
and dword [esp + 0x14], 0
jmp 0x41a411
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4
Function at 0x41a66e
Capabilities:
Get disk information
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x45c
push esi
or esi, 0xffffffff
push edi
mov edi, esi
test eax, eax
je 0x41a7b6
xor ecx, ecx
cmp word [eax], cx
je 0x41a7b6
push 0x104
push eax
lea eax, [esp + 0x10]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [esp + 0x21c], ax
lea eax, [esp + 0x14]
push eax
call sub.MSVCRT.dll_wcslen
add esp, 0x10
lea ecx, [esp + eax*2 + 6]
cmp eax, 2
je 0x41a6c7
cmp eax, 3
jne 0x41a701
cmp word [esp + 0xa], 0x3a
jne 0x41a701
cmp eax, 2
jne 0x41a6e5
lea eax, [esp + 8]
push 0x4681b0
push eax
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x41a7b6
push 0xfffffffffffffffe
pop edi
jmp 0x41a7b6
push ebx
push ebp
push 0x5c
pop ebp
push 0x2f
pop ebx
movzx eax, word [ecx]
cmp ax, bp
je 0x41a716
cmp ax, bx
jne 0x41a720
xor eax, eax
mov word [ecx], ax
sub ecx, 2
jmp 0x41a709
lea eax, [esp + 0x21c]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, esi
je 0x41a75f
test byte [esp + 0x21c], 0x10
je 0x41a746
push 0xfffffffffffffffe
pop edi
jmp 0x41a756
mov esi, dword [esp + 0x238]
xor edi, edi
or edi, dword [esp + 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x41a7b4
cmp word [esp + 0x10], bp
jne 0x41a76d
cmp word [esp + 0x12], bp
je 0x41a78c
cmp word [esp + 0x10], bx
jne 0x41a77b
cmp word [esp + 0x12], bx
je 0x41a78c
push 0x2e
pop eax
cmp word [esp + 0x10], ax
jne 0x41a7b4
cmp word [esp + 0x12], ax
jne 0x41a7b4
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, esi
je 0x41a7a1
test al, 0x10
je 0x41a7b4
jmp 0x41a7b1
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x41a7b4
push 0xfffffffffffffffe
pop edi
pop ebp
pop ebx
mov eax, edi
mov edx, esi
pop edi
pop esi
add esp, 0x45c
ret 4

Function at 0x41a8b7
Capabilities:
Delete file
Set file attributes

Disassembly:
cmp dword [esp + 4], 0
je 0x41a8e0
test byte [esp + 8], 2
je 0x41a8d4
push pe_nt_image_headers32
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x41a8e2
xor eax, eax
ret 8

Function at 0x41a8f3
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [esp + 4], 0
je 0x41a909
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x41a90c
or eax, 0xffffffff
ret 4

Function at 0x41a90f
Capabilities:
Set file attributes

Disassembly:
xor eax, eax
cmp dword [esp + 4], eax
je 0x41a91d
jmp dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
ret 8
Function at 0x41aa46
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
cmp dword [ebp + 8], 0
je 0x41aabe
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [ebp - 4], ax
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_wcslen
lea ecx, [ebp - 0x20c]
add esp, 0x10
lea eax, [ecx + eax*2]
jmp 0x41aa9f
movzx ecx, word [eax - 2]
cmp ecx, 0x20
je 0x41aa9c
cmp ecx, 0x5c
je 0x41aa9c
cmp ecx, 0x2f
jne 0x41aaa9
add eax, 0xfffffffe
lea ecx, [ebp - 0x20c]
cmp eax, ecx
ja 0x41aa89
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x41aac0
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x41aac6
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push edi
xor edi, edi
cmp dword [ebp + 8], edi
je 0x41ab9b
push ebx
push edi
push pe_nt_image_headers32
push 3
push edi
push 3
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x41ab9a
push esi
mov esi, dword [ebp + 0x10]
push esi
call fcn.0041d2ef
push esi
mov word [ebp - 0x20], ax
call fcn.0041d315
push esi
mov word [ebp - 0x1e], ax
call fcn.0041d337
push esi
mov word [ebp - 0x1c], ax
call fcn.0041d358
push esi
mov word [ebp - 0x1a], ax
call fcn.0041d379
push esi
mov word [ebp - 0x18], ax
call fcn.0041d39a
push esi
mov word [ebp - 0x16], ax
call fcn.0041d3bb
mov word [ebp - 0x14], ax
xor eax, eax
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
cmp dword [ebp + 0xc], 1
mov eax, edi
mov ecx, edi
pop esi
jne 0x41ab79
lea eax, [ebp - 8]
jmp 0x41ab87
cmp dword [ebp + 0xc], 2
jne 0x41ab84
lea ecx, [ebp - 8]
jmp 0x41ab87
lea edi, [ebp - 8]
push ecx
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41b1f0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [esi + 0x14], 0
jne 0x41b22c
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 4
xor eax, eax
pop esi
pop ecx
ret 4

Function at 0x41b6c0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push esi
push dword [esp + 0x10]
mov dword [esp + 8], 0
push dword [0x5082ac]
call fcn.00425998
mov esi, eax
test esi, esi
je 0x41b73f
cmp dword [esi + 4], 0
je 0x41b710
push 1
lea eax, [esp + 8]
push eax
push esi
call fcn.0041bcc0
test eax, eax
je 0x41b704
inc dword [esi + 0xc]
xor eax, eax
pop esi
add esp, 8
ret 4
mov eax, 1
pop esi
add esp, 8
ret 4
push 0
lea eax, [esp + 0xc]
push eax
push 1
lea eax, [esp + 0x1c]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41b74a
cmp dword [esp + 8], 0
je 0x41b74a
push 1
push 0
push 0xffffffffffffffff
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 4]
pop esi
add esp, 8
ret 4
or eax, 0xffffffff
pop esi
add esp, 8
ret 4

Function at 0x41b890
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
mov dword [esp + 4], 0
test esi, esi
je 0x41b8f5
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x41b8ed
push dword [esp + 0x10]
push dword [0x5082ac]
call fcn.00425998
test eax, eax
je 0x41b8e3
cmp dword [eax + 4], 0
je 0x41b8d2
push edi
push esi
push eax
call fcn.0041c290
pop edi
pop esi
pop ecx
ret 0xc
push 0
lea ecx, [esp + 0xc]
push ecx
push edi
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
pop edi
xor eax, eax
pop esi
pop ecx
ret 0xc
xor eax, eax
pop esi
pop ecx
ret 0xc
Function at 0x41b950
Capabilities:
Write file on windows

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
mov dword [esp], 0
test edx, edx
je 0x41ba58
cmp word [edx], 0
je 0x41ba58
mov ecx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
test ecx, ecx
jne 0x41b97e
mov ecx, dword [esi + 0x18]
push edi
cmp ecx, 0x19
jne 0x41b9dd
cmp dword [esi + 4], 0
mov ecx, edx
lea edi, [ecx + 2]
je 0x41b9b0
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41b990
sub ecx, edi
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push edx
push esi
call fcn.0041c290
pop edi
pop esi
pop ecx
ret 0xc
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41b9b0
sub ecx, edi
lea eax, [esp + 8]
push 0
sar ecx, 1
push eax
lea eax, [ecx + ecx]
push eax
push edx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
xor eax, eax
cmp ecx, 2
lea ecx, [esp + 0x14]
setne al
push ecx
dec eax
and eax, 0xfde9
push edx
push eax
call fcn.0041c3a0
mov edi, eax
test edi, edi
je 0x41b9d3
cmp dword [esi + 4], 0
je 0x41ba2b
push dword [esp + 0x14]
push edi
push esi
call fcn.0041c290
push edi
push 0
push dword [0x5063e0]
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
push 0
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x1c]
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
push 0
push dword [0x5063e0]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
xor eax, eax
pop ecx
ret 0xc

Function at 0x41ba60
Capabilities:
Write file on windows

Disassembly:
push dword [esp + 4]
push dword [0x5082ac]
call fcn.00425998
test eax, eax
je 0x41ba7c
mov dword [esp + 4], eax
jmp fcn.0041b950
xor eax, eax
ret 0xc
Function at 0x41bcc0
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
cmp dword [esi + 0x14], 0
jne 0x41bce1
push esi
call fcn.0041b1f0
mov dword [esi + 0x14], 1
mov dword [esi + 0xc], 0
mov ebx, dword [esi + 0xc]
mov edi, dword [esp + 0x18]
mov eax, dword [esi + 0x10]
cmp ebx, edi
jl 0x41bd55
add eax, dword [esi + 4]
mov ecx, edi
sub eax, ebx
dec ecx
je 0x41bd42
dec ecx
je 0x41bd2d
sub ecx, 2
je 0x41bd1a
push edi
push eax
push dword [esp + 0x1c]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
mov ecx, dword [eax]
mov eax, dword [esp + 0x14]
mov dword [eax], ecx
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
mov cx, word [eax]
mov eax, dword [esp + 0x14]
mov word [eax], cx
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
mov ecx, dword [esp + 0x14]
mov dl, byte [eax]
mov eax, edi
mov byte [ecx], dl
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
push ebp
mov ebp, dword [esp + 0x18]
sub eax, ebx
add eax, dword [esi + 4]
push ebx
push eax
push ebp
call sub.MSVCRT.dll_memcpy
mov eax, dword [esi + 8]
add esp, 0xc
sub edi, ebx
add ebp, ebx
push 0
cmp edi, eax
jl 0x41bd9a
lea eax, [esp + 0x18]
push eax
push edi
push ebp
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
pop ebp
pop edi
mov dword [esi + 0xc], 0
add eax, ebx
pop esi
pop ebx
ret 0xc
lea ecx, [esp + 0x18]
push ecx
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
cmp edi, eax
jle 0x41bdbb
mov edi, eax
push edi
push dword [esi + 4]
push ebp
call sub.MSVCRT.dll_memcpy
sub dword [esi + 0xc], edi
lea eax, [ebx + edi]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret 0xc