joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428f34
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov esi, dword [0x4448c8]
lea edi, [ebp - 4]
xor eax, eax
push ebp
push 0x429149
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [esi + 0x50]
mov edx, dword [0x420c8c]
call fcn.0040b244
cmp byte [esi + 0xa4], 0
je 0x428fa8
push 0x42915c
push dword [esi + 0x90]
push 0x429190
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00408da4
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
call fcn.00408fd8
mov eax, dword [ebp - 0x14]
mov dl, 1
call fcn.0042838c
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
mov edx, dword [esi + 0x90]
lea eax, [ebp - 0x1c]
mov ecx, 0x429190
call fcn.00408d28
mov eax, dword [ebp - 0x1c]
call fcn.00408ca0
push eax
call sub.kernel32.dll_CreateFileW
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x429007
cmp byte [esi + 0xa4], 0
je 0x429124
mov dl, 1
mov eax, 0x4291c4
call fcn.0042838c
xor eax, eax
call fcn.0042858c
jmp 0x429124
cmp byte [esi + 0xa4], 0
je 0x42901c
mov dl, 1
mov eax, 0x42920c
call fcn.0042838c
lea eax, [ebp - 0x10]
push eax
push ebx
call sub.kernel32.dll_GetFileSizeEx
test al, al
jne 0x429051
cmp byte [esi + 0xa4], 0
je 0x429046
mov dl, 1
mov eax, 0x429248
call fcn.0042838c
xor eax, eax
call fcn.0042858c
push ebx
call sub.kernel32.dll_CloseHandle
jmp 0x429124
mov eax, dword [ebp - 0x10]
push eax
lea eax, [esi + 0x50]
mov ecx, 1
mov edx, dword [0x420c8c]
call fcn.0040b120
add esp, 4
xor eax, eax
mov dword [edi], eax
jmp 0x4290fe
xor eax, eax
mov dword [edi], eax
push 0
push 0
push 0
push 0
push ebx
call sub.kernel32.dll_SetFilePointerEx
test eax, eax
jne 0x4290a8
cmp byte [esi + 0xa4], 0
je 0x4290fe
mov dl, 1
mov eax, 0x429298
call fcn.0042838c
xor eax, eax
call fcn.0042858c
jmp 0x4290fe
push 0
push edi
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [esi + 0x50]
push eax
push ebx
call sub.kernel32.dll_ReadFile
test eax, eax
jne 0x4290db
cmp byte [esi + 0xa4], 0
je 0x4290fe
mov dl, 1
mov eax, 0x429304
call fcn.0042838c
xor eax, eax
call fcn.0042858c
jmp 0x4290fe
mov eax, dword [ebp - 0x10]
cmp eax, dword [edi]
je 0x4290fe
cmp byte [esi + 0xa4], 0
je 0x4290fe
mov dl, 1
mov eax, 0x429360
call fcn.0042838c
xor eax, eax
call fcn.0042858c
mov eax, dword [ebp - 0x10]
cmp eax, dword [edi]
jne 0x429074
push ebx
call sub.kernel32.dll_CloseHandle
cmp byte [esi + 0xa4], 0
je 0x429124
mov dl, 1
mov eax, 0x4293cc
call fcn.0042838c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x429150
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00408298
lea eax, [ebp - 0x14]
call fcn.004081c8
pop eax
jmp eax
Function at 0x429874
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.004082dc
xor eax, eax
push ebp
push 0x429a9f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4448c8]
cmp byte [eax + 0xa4], 0
je 0x4298e6
push 0x429ab4
mov eax, dword [0x4448c8]
push dword [eax + 0x90]
push 0x429afc
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00408da4
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
call fcn.00408fd8
mov eax, dword [ebp - 0x1c]
mov dl, 1
call fcn.0042838c
push 0
push 0x80
push 1
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x24]
mov ecx, 0x429afc
mov edx, dword [ebp - 4]
call fcn.00408d28
mov eax, dword [ebp - 0x24]
call fcn.00408ca0
push eax
call sub.kernel32.dll_CreateFileW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x429949
mov eax, dword [0x4448c8]
cmp byte [eax + 0xa4], 0
je 0x429a72
mov dl, 1
mov eax, 0x429b30
call fcn.0042838c
xor eax, eax
call fcn.0042858c
jmp 0x429a72
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x429a2d
xor eax, eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetFilePointerEx
test eax, eax
jne 0x429997
mov eax, dword [0x4448c8]
cmp byte [eax + 0xa4], 0
je 0x429a2d
mov dl, 1
mov eax, 0x429b8c
call fcn.0042838c
xor eax, eax
call fcn.0042858c
jmp 0x429a2d
mov eax, dword [0x4448c8]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x14], eax
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x4299ae
sub esi, 4
mov esi, dword [esi]
push 0
lea eax, [ebp - 0xc]
push eax
push esi
mov eax, dword [0x4448c8]
mov eax, dword [eax + 0x50]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_WriteFile
test eax, eax
jne 0x4299ee
mov eax, dword [0x4448c8]
cmp byte [eax + 0xa4], 0
je 0x429a2d
mov dl, 1
mov eax, 0x429bf8
call fcn.0042838c
xor eax, eax
call fcn.0042858c
jmp 0x429a2d
mov eax, dword [0x4448c8]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x18], eax
mov edi, dword [ebp - 0x18]
test edi, edi
je 0x429a05
sub edi, 4
mov edi, dword [edi]
mov eax, dword [ebp - 0xc]
cmp eax, edi
je 0x429a2d
mov eax, dword [0x4448c8]
cmp byte [eax + 0xa4], 0
je 0x429a2d
mov dl, 1
mov eax, 0x429c50
call fcn.0042838c
xor eax, eax
call fcn.0042858c
mov eax, dword [0x4448c8]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x429a44
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [ebp - 0xc]
cmp eax, ebx
jne 0x429953
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [0x4448c8]
cmp byte [eax + 0xa4], 0
je 0x429a72
mov dl, 1
mov eax, 0x429cbc
call fcn.0042838c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x429aa6
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00408298
lea eax, [ebp - 0x1c]
call fcn.004081c8
lea eax, [ebp - 4]
call fcn.00408210
pop eax
jmp eax
Function at 0x42d3f4
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
xor edx, edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x148], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42d698
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x42d6b0
call fcn.00408640
lea eax, [ebp - 0x140]
push eax
call sub.kernel32.dll_GetSystemInfo
mov dword [ebp - 0x11c], 0x11c
lea eax, [ebp - 0x11c]
push eax
call sub.kernel32.dll_GetVersionExW
cmp eax, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x42d64f
mov eax, dword [ebp - 0x118]
sub eax, 5
je 0x42d478
dec eax
je 0x42d517
sub eax, 4
je 0x42d5c3
jmp 0x42d611
mov eax, dword [ebp - 0x114]
sub eax, 1
jb 0x42d48a
je 0x42d49b
dec eax
je 0x42d4ac
jmp 0x42d4c9
mov eax, ebx
mov edx, 0x42d6c4
call fcn.00408640
jmp 0x42d611
mov eax, ebx
mov edx, 0x42d6e0
call fcn.00408640
jmp 0x42d611
cmp word [ebp - 4], 0x8000
jne 0x42d611
mov eax, ebx
mov edx, 0x42d6f8
call fcn.00408640
jmp 0x42d611
cmp byte [ebp - 2], 1
jne 0x42d4ea
cmp word [ebp - 0x140], 9
jne 0x42d4ea
mov eax, ebx
mov edx, 0x42d710
call fcn.00408640
jmp 0x42d611
push 0x59
call sub.user32.dll_GetSystemMetrics
test eax, eax
je 0x42d506
mov eax, ebx
mov edx, 0x42d738
call fcn.00408640
jmp 0x42d611
mov eax, ebx
mov edx, 0x42d75c
call fcn.00408640
jmp 0x42d611
mov eax, dword [ebp - 0x114]
sub eax, 1
jb 0x42d52f
je 0x42d557
dec eax
je 0x42d57f
dec eax
je 0x42d5a1
jmp 0x42d611
cmp byte [ebp - 2], 1
jne 0x42d546
mov eax, ebx
mov edx, 0x42d77c
call fcn.00408640
jmp 0x42d611
mov eax, ebx
mov edx, 0x42d798
call fcn.00408640
jmp 0x42d611
cmp byte [ebp - 2], 1
jne 0x42d56e
mov eax, ebx
mov edx, 0x42d7b8
call fcn.00408640
jmp 0x42d611
mov eax, ebx
mov edx, 0x42d7d0
call fcn.00408640
jmp 0x42d611
cmp byte [ebp - 2], 1
jne 0x42d593
mov eax, ebx
mov edx, 0x42d7f4
call fcn.00408640
jmp 0x42d611
mov eax, ebx
mov edx, 0x42d80c
call fcn.00408640
jmp 0x42d611
cmp byte [ebp - 2], 1
jne 0x42d5b5
mov eax, ebx
mov edx, 0x42d82c
call fcn.00408640
jmp 0x42d611
mov eax, ebx
mov edx, 0x42d844
call fcn.00408640
jmp 0x42d611
cmp dword [ebp - 0x110], 0x55f0
jae 0x42d5f1
cmp byte [ebp - 2], 1
jne 0x42d5e3
mov eax, ebx
mov edx, 0x42d868
call fcn.00408640
jmp 0x42d611
mov eax, ebx
mov edx, 0x42d880
call fcn.00408640
jmp 0x42d611
cmp byte [ebp - 2], 1
jne 0x42d605
mov eax, ebx
mov edx, 0x42d8a8
call fcn.00408640
jmp 0x42d611
mov eax, ebx
mov edx, 0x42d8c0
call fcn.00408640
push dword [ebx]
push 0x42d8e0
lea edx, [ebp - 0x148]
movzx eax, word [ebp - 8]
call fcn.00418c24
mov edx, dword [ebp - 0x148]
lea eax, [ebp - 0x144]
mov ecx, 0
call fcn.00408ba8
push dword [ebp - 0x144]
mov eax, ebx
mov edx, 3
call fcn.00408928
call fcn.0042d358
test al, al
je 0x42d666
mov eax, ebx
mov edx, 0x42d8f0
call fcn.0040884c
jmp 0x42d672
mov eax, ebx
mov edx, 0x42d904
call fcn.0040884c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42d69f
lea eax, [ebp - 0x148]
call fcn.004081c8
lea eax, [ebp - 0x144]
call fcn.004081ec
pop eax
jmp eax
Function at 0x42dc84
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
add esp, 0xfffffc00
mov esi, edx
mov ebx, eax
call fcn.0041e820
cmp eax, 2
jne 0x42dcbf
push 0x200
lea eax, [esp + 0x204]
push eax
push 2
push ebx
call sub.kernel32.dll_GetLocaleInfoW
mov edx, esi
lea eax, [esp + 0x200]
call fcn.0040a968
jmp 0x42dcdf
push 0x200
lea eax, [esp + 4]
push eax
push 2
push ebx
call sub.kernel32.dll_GetLocaleInfoW
mov eax, esi
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.00408f9c
add esp, 0x400
pop esi
pop ebx
ret

Function at 0x42dce8
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x42de1c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, 0x42de30
call fcn.00408610
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
push 0
call sub.user32.dll_GetKeyboardLayoutList
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x42ddd2
mov eax, dword [ebp - 8]
add eax, eax
add eax, eax
call fcn.00404594
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x42ddcb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_GetKeyboardLayoutList
mov eax, dword [ebp - 4]
call fcn.00408210
mov ebx, dword [ebp - 8]
dec ebx
test ebx, ebx
jb 0x42ddac
inc ebx
xor esi, esi
mov eax, dword [ebp - 0xc]
movzx edi, word [eax + esi*4]
lea edx, [ebp - 0x14]
mov eax, edi
call fcn.0042dc84
lea eax, [ebp - 0x14]
mov edx, 0x42de54
call fcn.00409088
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
call fcn.00408fec
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00408cb4
mov eax, dword [ebp - 4]
inc esi
dec ebx
jne 0x42dd71
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42ddd2
mov edx, dword [ebp - 8]
add edx, edx
add edx, edx
mov eax, dword [ebp - 0xc]
call fcn.004045b0
pop eax
jmp eax
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
test ebx, ebx
je 0x42dde4
sub ebx, 4
mov eax, dword [ebx]
shr eax, 1
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, ebx
sub ecx, 4
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, 1
call fcn.00408e78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42de23
lea eax, [ebp - 0x14]
call fcn.004081c8
lea eax, [ebp - 0x10]
call fcn.00408210
pop eax
jmp eax
Function at 0x42df08
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42df84
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xff
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00408ec4
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00408ca0
push eax
call sub.advapi32.dll_GetUserNameW
test eax, eax
je 0x42df60
push ebx
mov ecx, dword [ebp - 8]
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00408e78
jmp 0x42df6c
mov eax, ebx
mov edx, 0x42df94
call fcn.00408610
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42df8b
lea eax, [ebp - 4]
call fcn.00408210
pop eax
jmp eax

Function at 0x42fb90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42fc31
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, dword [0x420c8c]
call fcn.0040b244
push esi
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x420c8c]
call fcn.0040b120
add esp, 4
xor eax, eax
mov dword [ebp - 8], eax
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_SetFilePointerEx
test al, al
je 0x42fc02
push 0
lea eax, [ebp - 8]
push eax
push esi
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_WriteFile
mov ebx, dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, dword [0x420c8c]
call fcn.0040b244
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42fc38
lea eax, [ebp - 4]
mov edx, dword [0x420c8c]
call fcn.0040b244
pop eax
jmp eax
Function at 0x430310
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov esi, eax
lea eax, [ebp - 4]
call fcn.004082dc
xor eax, eax
push ebp
push 0x43040d
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 1
mov bl, 1
cmp dword [esi], 0xffffffff
jne 0x43037c
push 0x64
call sub.kernel32.dll_Sleep
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00421434
mov eax, dword [ebp - 0xc]
call fcn.00408ca0
push eax
call sub.kernel32.dll_CreateFileW
mov dword [esi], eax
jmp 0x4303da
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
mov eax, dword [esi]
push eax
call sub.kernel32.dll_SetFilePointerEx
test al, al
je 0x43039e
mov eax, dword [esi]
push eax
call sub.kernel32.dll_SetEndOfFile
test eax, eax
jne 0x4303e8
mov eax, dword [esi]
push eax
call sub.kernel32.dll_CloseHandle
push 0x64
call sub.kernel32.dll_Sleep
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00421434
mov eax, dword [ebp - 0x10]
call fcn.00408ca0
push eax
call sub.kernel32.dll_CreateFileW
mov dword [esi], eax
inc ebx
cmp bl, 0xb
jne 0x430341
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x430414
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00408298
lea eax, [ebp - 4]
call fcn.00408210
pop eax
jmp eax

Function at 0x4304a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x43058b
push dword fs:[eax]
mov dword fs:[eax], esp
inc dword [ebx]
lea edx, [ebp - 4]
mov eax, dword [ebx]
call fcn.00422198
mov eax, 1
mov edx, dword [esi]
movzx edx, byte [edx]
mov ecx, dword [esi]
xor byte [ecx + eax], dl
inc eax
cmp eax, 0x10
jne 0x4304ca
xor eax, eax
mov edx, dword [esi]
movzx edx, byte [edx + eax]
shl edx, 4
movzx edx, dl
shr edx, 4
movzx ecx, dl
mov ebx, dword [esi]
movzx ecx, byte [ebx + ecx]
movzx edx, dl
mov ebx, dword [esi]
add ebx, edx
mov edx, dword [esi]
movzx edx, byte [edx + eax]
mov byte [ebx], dl
mov edx, dword [esi]
mov byte [edx + eax], cl
inc eax
cmp eax, 0x10
jne 0x4304dc
xor eax, eax
mov edx, dword [esi]
movzx edx, byte [edx + 0xf]
mov ecx, dword [esi]
xor byte [ecx + eax], dl
inc eax
cmp eax, 0xf
jne 0x430510
mov eax, dword [ebp - 4]
movzx edx, byte [eax + 3]
shl edx, 6
movzx eax, dl
shr eax, 6
mov edx, eax
xor eax, eax
movzx ecx, dl
mov ebx, dword [ebp - 4]
movzx ecx, byte [ebx + ecx]
mov ebx, dword [esi]
xor byte [ebx + eax], cl
inc eax
cmp eax, 0x10
jne 0x430535
xor eax, eax
mov edx, eax
and edx, 0x80000003
jns 0x43055b
dec edx
or edx, 0xfffffffc
inc edx
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + edx]
mov ecx, dword [esi]
xor byte [ecx + eax], dl
inc eax
cmp eax, 0x10
jne 0x43054c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x430592
lea eax, [ebp - 4]
mov edx, dword [0x420c8c]
call fcn.0040b244
pop eax
jmp eax
Function at 0x430a40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
lea eax, [ebp + 8]
call fcn.004082dc
xor eax, eax
push ebp
push 0x430b57
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 1
mov bl, 1
cmp dword [esi], 0xffffffff
jne 0x430aaf
push 0x64
call sub.kernel32.dll_Sleep
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
lea edx, [ebp - 0x10]
mov eax, dword [ebp + 8]
call fcn.00421434
mov eax, dword [ebp - 0x10]
call fcn.00408ca0
push eax
call sub.kernel32.dll_CreateFileW
mov dword [esi], eax
jmp 0x430b24
xor eax, eax
mov dword [ebp - 0xc], eax
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
mov eax, dword [esi]
push eax
call sub.kernel32.dll_SetFilePointerEx
test al, al
je 0x430ae8
push 0
lea eax, [ebp - 0xc]
push eax
push edi
mov eax, dword [ebp - 4]
mov eax, dword [eax]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_WriteFile
test eax, eax
je 0x430ae8
cmp edi, dword [ebp - 0xc]
je 0x430b32
mov eax, dword [esi]
push eax
call sub.kernel32.dll_CloseHandle
push 0x64
call sub.kernel32.dll_Sleep
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
lea edx, [ebp - 0x14]
mov eax, dword [ebp + 8]
call fcn.00421434
mov eax, dword [ebp - 0x14]
call fcn.00408ca0
push eax
call sub.kernel32.dll_CreateFileW
mov dword [esi], eax
inc ebx
cmp bl, 0xb
jne 0x430a74
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x430b5e
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00408298
lea eax, [ebp + 8]
call fcn.00408210
pop eax
jmp eax
Function at 0x430ce0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
lea eax, [ebp + 8]
call fcn.004082dc
xor eax, eax
push ebp
push 0x430df7
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 1
mov bl, 1
cmp dword [esi], 0xffffffff
jne 0x430d4f
push 0x64
call sub.kernel32.dll_Sleep
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
lea edx, [ebp - 0x10]
mov eax, dword [ebp + 8]
call fcn.00421434
mov eax, dword [ebp - 0x10]
call fcn.00408ca0
push eax
call sub.kernel32.dll_CreateFileW
mov dword [esi], eax
jmp 0x430dc4
xor eax, eax
mov dword [ebp - 0xc], eax
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
mov eax, dword [esi]
push eax
call sub.kernel32.dll_SetFilePointerEx
test al, al
je 0x430d88
push 0
lea eax, [ebp - 0xc]
push eax
push edi
mov eax, dword [ebp - 4]
mov eax, dword [eax]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x430d88
cmp edi, dword [ebp - 0xc]
je 0x430dd2
mov eax, dword [esi]
push eax
call sub.kernel32.dll_CloseHandle
push 0x64
call sub.kernel32.dll_Sleep
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
lea edx, [ebp - 0x14]
mov eax, dword [ebp + 8]
call fcn.00421434
mov eax, dword [ebp - 0x14]
call fcn.00408ca0
push eax
call sub.kernel32.dll_CreateFileW
mov dword [esi], eax
inc ebx
cmp bl, 0xb
jne 0x430d14
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x430dfe
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00408298
lea eax, [ebp + 8]
call fcn.00408210
pop eax
jmp eax
Function at 0x4310a0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4310a9
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
call fcn.004082dc
lea eax, [ebp - 8]
call fcn.004082dc
xor eax, eax
push ebp
push 0x4311fb
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
cmp edi, 0xffffffff
jne 0x43111a
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00408d28
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00421434
mov eax, dword [ebp - 0xc]
call fcn.00408ca0
push eax
call sub.kernel32.dll_GetFileAttributesW
mov edi, eax
cmp edi, 0xffffffff
jne 0x43111a
mov edi, 0x80
mov eax, 1
and eax, edi
cmp eax, 1
jne 0x43119c
and edi, 0xfffffffe
test edi, edi
jne 0x431132
mov edi, 0x80
push edi
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00408d28
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00421434
mov eax, dword [ebp - 0x14]
call fcn.00408ca0
push eax
call sub.kernel32.dll_SetFileAttributesW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x20]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00408d28
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.00421434
mov eax, dword [ebp - 0x1c]
call fcn.00408ca0
push eax
call sub.kernel32.dll_CreateFileW
mov dword [esi], eax
cmp dword [esi], 0xffffffff
jne 0x4311de
jmp 0x4311dc
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00408d28
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.00421434
mov eax, dword [ebp - 0x24]
call fcn.00408ca0
push eax
call sub.kernel32.dll_CreateFileW
mov dword [esi], eax
cmp dword [esi], 0xffffffff
jne 0x4311de
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x431202
lea eax, [ebp - 0x28]
mov edx, 0xa
call fcn.00408298
pop eax
jmp eax