joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409280
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4eb82f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
xor ebx, ebx
push 0x52cb30
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], ebx
call fcn.0044fec0
lea ecx, [esp + 0x18]
mov dword [esp + 0x34], 1
call fcn.0045ccf0
push 0x20019
push str.SoftwareMicrosoftWindowsCurrentVersionApp_PathsIEXPLORE.EXE
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x24]
mov byte [esp + 0x40], 2
call fcn.0045ce50
test eax, eax
je 0x409315
lea eax, [esp + 0xc]
push ebx
push eax
lea ecx, [esp + 0x20]
call fcn.0045d460
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x38], 3
call fcn.004507f0
lea ecx, [esp + 0xc]
mov byte [esp + 0x34], 2
call fcn.00450660
lea ecx, [esp + 0x18]
call fcn.0045cea0
lea ecx, [esp + 0x18]
mov byte [esp + 0x34], 1
call fcn.0045cdd0
mov eax, dword [esp + 8]
cmp dword [eax - 8], ebx
je 0x409405
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4093fc
mov esi, dword [esp + 0x40]
cmp esi, ebx
je 0x409405
lea ecx, [esp + 0x24]
call fcn.0045ccf0
push 0x20019
push str.SOFTWAREMicrosoftInternet_Explorer
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x30]
mov byte [esp + 0x40], 4
call fcn.0045ce50
test eax, eax
je 0x4093ec
lea ecx, [esp + 0xc]
push str.Version
push ecx
lea ecx, [esp + 0x2c]
call fcn.0045d460
lea ecx, [esp + 0x24]
mov byte [esp + 0x34], 5
call fcn.0045cea0
mov eax, dword [esp + 0xc]
cmp dword [eax - 8], ebx
je 0x4093de
lea edx, [esp + 0x10]
lea ecx, [esp + 0x14]
push edx
push ecx
lea edx, [esp + 0x20]
lea ecx, [esp + 0x48]
push edx
push ecx
push str._d._d._d._d
push eax
mov dword [esp + 0x58], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ebx
call fcn.00438170
mov edx, dword [esp + 0x58]
add esp, 0x18
and edx, 0xffff
mov dword [esi], edx
lea ecx, [esp + 0xc]
mov byte [esp + 0x34], 4
call fcn.00450660
lea ecx, [esp + 0x24]
mov byte [esp + 0x34], 1
call fcn.0045cdd0
jmp 0x409405
lea ecx, [esp + 8]
call fcn.004503d0
mov esi, dword [esp + 0x3c]
lea eax, [esp + 8]
push eax
mov ecx, esi
call fcn.0044fc60
mov dword [esp + 0x20], 1
lea ecx, [esp + 8]
mov byte [esp + 0x34], bl
call fcn.00450660
mov ecx, dword [esp + 0x2c]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x30
ret 8
Function at 0x40b960
Capabilities:
Resolve dns

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x10
test edx, edx
je 0x40b9c0
push edi
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
pop edi
je 0x40b9c0
mov dword [esp + 2], eax
push edx
mov dword [esp + 0xa], eax
mov dword [esp + 0xe], eax
mov word [esp + 0x12], ax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x40b9af
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
test eax, eax
je 0x40b9c0
mov eax, dword [eax]
push eax
call dword [sym.imp.WS2_32.dll_ntohl]
add esp, 0x10
ret 4
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.WS2_32.dll_ntohl]
add esp, 0x10
ret 4
xor eax, eax
add esp, 0x10
ret 4

Function at 0x40c4a0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4ebda3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [0x4fab44]
push esi
mov esi, ecx
push edi
mov dword [esp + 0x18], esi
lea edi, [esi + 4]
mov dword [edi], eax
mov dword [esi], 0x4f2fc4
mov eax, dword [0x4fab44]
mov dword [esp + 0x24], 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov byte [esp + 0x24], 4
test eax, eax
je 0x40c512
call fcn.004845b0
push eax
lea ecx, [esp + 0x18]
push str.__lu
push ecx
call fcn.004535e0
add esp, 0xc
mov eax, dword [esp + 0x34]
test eax, eax
je 0x40c533
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea edx, [esp + 0x14]
push str.__lu
push edx
call fcn.004535e0
add esp, 0xc
mov eax, dword [esp + 0x38]
test eax, eax
je 0x40c554
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
lea eax, [esp + 0x10]
push str.__lu
push eax
call fcn.004535e0
add esp, 0xc
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x40c575
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea ecx, [esp + 0xc]
push 0x519cd8
push ecx
call fcn.004535e0
add esp, 0xc
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 0x30]
push edx
call fcn.0044fec0
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x38]
push edx
push eax
push ecx
push str._s_s_s_s_s
push edi
mov byte [esp + 0x40], 5
call fcn.004535e0
add esp, 0x1c
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], 4
call fcn.00450660
lea ecx, [esp + 8]
mov byte [esp + 0x24], 3
call fcn.00450660
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 2
call fcn.00450660
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 1
call fcn.00450660
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], 0
call fcn.00450660
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 0x14
Function at 0x40c65d
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4ebdd8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [0x4fab44]
push esi
mov esi, ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp + 4], eax
mov eax, dword [esp + 0x28]
mov byte [esp + 0x1c], 3
cmp eax, 0xffffffff
je 0x40c699
push eax
lea eax, [esp + 0x14]
push str.__lu
push eax
call fcn.004535e0
add esp, 0xc
mov eax, dword [esp + 0x2c]
cmp eax, 0xffffffff
je 0x40c6b5
push eax
lea ecx, [esp + 0x10]
push str.__lu
push ecx
call fcn.004535e0
add esp, 0xc
mov eax, dword [esp + 0x30]
cmp eax, 0xffffffff
je 0x40c6d1
push eax
lea edx, [esp + 0xc]
push str.__lu
push edx
call fcn.004535e0
add esp, 0xc
mov eax, dword [esp + 0x34]
cmp eax, 0xffffffff
je 0x40c6ed
push eax
lea eax, [esp + 8]
push 0x519cd8
push eax
call fcn.004535e0
add esp, 0xc
mov ecx, dword [esp + 0x24]
push ecx
lea ecx, [esp + 0x2c]
call fcn.0044fec0
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push edx
mov edx, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x30]
push ecx
push edx
push eax
add esi, 4
push str._s_s_s_s_s
push esi
mov byte [esp + 0x38], 4
call fcn.004535e0
add esp, 0x1c
lea ecx, [esp + 0x28]
mov byte [esp + 0x1c], 3
call fcn.00450660
lea ecx, [esp + 4]
mov byte [esp + 0x1c], 2
call fcn.00450660
lea ecx, [esp + 8]
mov byte [esp + 0x1c], 1
call fcn.00450660
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 0
call fcn.00450660
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00450660
mov ecx, dword [esp + 0x14]
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x14

Function at 0x40c820
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4ebe37
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov eax, dword [0x4fab44]
push esi
mov esi, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 0x18], 1
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov byte [esp + 0x18], 2
test eax, eax
je 0x40c86c
push str.Global_
jmp 0x40c871
push str.Local_
lea ecx, [esp + 8]
call fcn.004508e0
mov eax, dword [esi + 4]
mov ecx, dword [esp + 4]
push eax
push ecx
lea edx, [esp + 0x10]
push 0x519d00
push edx
call fcn.004535e0
mov esi, dword [esp + 0x30]
add esp, 0x10
lea eax, [esp + 8]
mov ecx, esi
push eax
call fcn.0044fc60
mov dword [esp + 0xc], 1
lea ecx, [esp + 4]
mov byte [esp + 0x18], 1
call fcn.00450660
lea ecx, [esp + 8]
mov byte [esp + 0x18], 0
call fcn.00450660
mov ecx, dword [esp + 0x10]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret 8
Function at 0x416350
Capabilities:
Get file size

Disassembly:
sub esp, 0x3c
push ebx
push ebp
push esi
xor esi, esi
push esi
call fcn.0041aad0
mov ebx, dword [esp + 0x50]
add esp, 4
cmp ebx, 0xffffffff
je 0x41650b
mov ebp, dword [esp + 0x50]
cmp ebp, 0xffffffff
je 0x41650b
lea eax, [esp + 0xc]
push edi
push eax
push ebx
mov dword [esp + 0x24], esi
mov dword [esp + 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0x10]
mov edi, eax
push ecx
push edi
push ebp
call fcn.00412ac0
add esp, 0xc
test eax, eax
je 0x4164f0
push esi
push esi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
call esi
push 0
push 0
push 0
push ebp
call esi
mov eax, dword [esp + 0x10]
xor ebp, ebp
cmp eax, ebp
mov dword [esp + 0x14], ebp
jne 0x4163d4
cmp edi, ebp
je 0x416497
test eax, eax
mov ebx, 0x10000
jne 0x4163e3
cmp edi, ebx
jae 0x4163e3
mov ebx, edi
push ebx
call fcn.004d2462
add esp, 4
mov esi, eax
mov ecx, ebx
xor eax, eax
mov edx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0x50]
xor edi, edi
lea eax, [esp + 0x18]
push edi
push eax
push ebx
push esi
push ecx
mov dword [esp + 0x2c], edi
call fcn.00428510
add esp, 0x14
test eax, eax
je 0x416455
mov eax, dword [esp + 0x18]
cmp eax, ebx
jae 0x416432
cmp eax, edi
mov ebp, 1
je 0x416475
lea edx, [esp + 0x20]
push edi
push edx
push eax
mov eax, dword [esp + 0x60]
push esi
push eax
mov dword [esp + 0x34], edi
call fcn.00428570
add esp, 0x14
test eax, eax
je 0x41645e
cmp ebp, edi
je 0x4163ee
jmp 0x416475
push 0x1081
push 0xd
jmp 0x416465
push 0x1090
push 0xe
call fcn.0041aab0
add esp, 8
mov dword [esp + 0x14], 1
mov ecx, dword [esp + 0x54]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call fcn.004d248b
add esp, 4
cmp ebp, edi
je 0x4164e4
cmp dword [esp + 0x14], edi
jne 0x4164e4
mov ebx, dword [esp + 0x50]
mov al, byte [esp + 0x58]
mov dword [esp + 0x1c], 1
test al, 2
je 0x4164e4
lea edx, [esp + 0x24]
mov ecx, 9
xor eax, eax
lea edi, [esp + 0x28]
push 0x28
mov dword [esp + 0x28], 0
push edx
push ebx
rep stosd dword es:[edi], eax
call fcn.004281a0
add esp, 0xc
test eax, eax
je 0x4164e4
mov ecx, dword [esp + 0x54]
lea eax, [esp + 0x24]
push 0x28
push eax
push ecx
call fcn.004281e0
add esp, 0xc
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
push 0x1062
push 0x25
call fcn.0041aab0
mov eax, dword [esp + 0x24]
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
push 0x1052
push 1
call fcn.0041aab0
add esp, 8
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
Function at 0x4190b0
Capabilities:
Get file size

Disassembly:
sub esp, 0x4c
push ebx
push ebp
push esi
push edi
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], 0
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x64]
push 0x40
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x20]
push eax
push ecx
call fcn.00418540
push eax
call fcn.00410a20
mov ebp, eax
add esp, 0x10
test ebp, ebp
jne 0x419105
push 0x1848
push 0xc
call fcn.0041aab0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret
mov ebx, dword [esp + 0x6c]
mov eax, dword [ebx + 0x70]
mov edi, dword [ebx + 0x6c]
add eax, edi
lea edx, [eax + eax*4]
mov eax, dword [ebx + 0x74]
lea ecx, [eax + edx*2]
mov edx, dword [ebp]
lea eax, [ecx + ecx + 0x7a]
mov ecx, ebp
push eax
mov dword [esp + 0x68], eax
call dword [edx + 8]
mov edi, eax
push edi
mov dword [esp + 0x14], edi
call fcn.004d2462
mov esi, eax
add esp, 4
test esi, esi
jne 0x419159
push 0x1852
push 0x21
call fcn.0041aab0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret
mov ecx, edi
xor eax, eax
mov edx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x6c], eax
lea eax, [esp + 0x6c]
lea edi, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x68]
push ecx
push esi
push eax
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [ebp]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ebx
push ecx
lea ecx, [esp + 0x34]
push ecx
mov ecx, ebp
call dword [edx + 0x10]
test eax, eax
je 0x419243
mov edi, dword [esp + 0x68]
mov ebp, dword [esp + 0x60]
mov ebx, dword [edi + 0x378]
mov eax, dword [edi + 0x37c]
test ebx, ebx
mov dword [esp + 0x64], eax
jne 0x4191da
test eax, eax
jne 0x4191da
lea edx, [esp + 0x64]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea eax, [esp + 0x64]
push 0
push eax
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [esp + 0x6c]
lea ecx, [esp + 0x18]
push 0
push ecx
push edx
push esi
push ebp
mov dword [esp + 0x2c], 0
call fcn.00428570
add esp, 0x14
test eax, eax
je 0x41924c
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x6c]
push edx
push esi
mov dword [edi + 0x378], ebx
mov dword [edi + 0x37c], eax
mov dword [edi + 0x380], ecx
call fcn.004293a0
add esp, 8
mov dword [edi + 0x384], eax
mov dword [esp + 0x14], 1
jmp 0x41925b
push 0x185e
push 0x11
jmp 0x419253
push 0x186d
push 0xe
call fcn.0041aab0
add esp, 8
push esi
call fcn.004d248b
mov eax, dword [esp + 0x18]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret
Function at 0x41beb0
Capabilities:
Get file size
Write file on windows

Disassembly:
sub esp, 0x4c
push ebx
push ebp
push esi
push edi
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], 0
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x64]
push 0x40
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x20]
push eax
push ecx
call fcn.00418540
push eax
call fcn.00410a20
mov ebp, eax
add esp, 0x10
test ebp, ebp
jne 0x41bf05
push 0x2027
push 0xc
call fcn.0041aab0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret
mov ebx, dword [esp + 0x6c]
mov eax, dword [ebx + 0x70]
mov edi, dword [ebx + 0x6c]
add eax, edi
lea edx, [eax + eax*4]
mov eax, dword [ebx + 0x74]
lea ecx, [eax + edx*2]
mov edx, dword [ebp]
lea eax, [ecx + ecx + 0x7a]
mov ecx, ebp
push eax
mov dword [esp + 0x68], eax
call dword [edx + 8]
mov edi, eax
push edi
mov dword [esp + 0x14], edi
call fcn.004d2462
mov esi, eax
add esp, 4
test esi, esi
jne 0x41bf59
push 0x2031
push 0x21
call fcn.0041aab0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret
mov ecx, edi
xor eax, eax
mov edx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x6c], eax
lea eax, [esp + 0x6c]
lea edi, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x68]
push ecx
push esi
push eax
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [ebp]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ebx
push ecx
lea ecx, [esp + 0x34]
push ecx
mov ecx, ebp
call dword [edx + 0x10]
test eax, eax
je 0x41c041
mov edi, dword [esp + 0x68]
mov ebp, dword [esp + 0x60]
mov ebx, dword [edi + 0x378]
mov eax, dword [edi + 0x37c]
test ebx, ebx
mov dword [esp + 0x64], eax
jne 0x41bfda
test eax, eax
jne 0x41bfda
lea edx, [esp + 0x64]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea eax, [esp + 0x64]
push 0
push eax
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [esp + 0x6c]
lea ecx, [esp + 0x18]
push 0
push ecx
push edx
push esi
push ebp
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x41c04a
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x6c]
push edx
push esi
mov dword [edi + 0x378], ebx
mov dword [edi + 0x37c], eax
mov dword [edi + 0x380], ecx
call fcn.004293a0
add esp, 8
mov dword [edi + 0x384], eax
mov dword [esp + 0x14], 1
jmp 0x41c059
push 0x203d
push 0x11
jmp 0x41c051
push 0x204c
push 0xe
call fcn.0041aab0
add esp, 8
push esi
call fcn.004d248b
mov eax, dword [esp + 0x18]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret
Function at 0x41e270
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x4c
push ebx
push ebp
push esi
push edi
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], 0
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x64]
push 0x40
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x20]
and ecx, 0xffff
push eax
push ecx
call fcn.00418540
push eax
call fcn.00410a20
mov ebp, eax
add esp, 0x10
test ebp, ebp
jne 0x41e2cb
push 0x267c
push 0xc
call fcn.0041aab0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret
mov eax, dword [esp + 0x70]
mov edx, dword [ebp]
push eax
mov ecx, ebp
call dword [edx + 8]
mov ebx, eax
push ebx
call fcn.004d2462
mov esi, eax
add esp, 4
test esi, esi
jne 0x41e302
push 0x2685
push 0x21
call fcn.0041aab0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret
mov ecx, ebx
xor eax, eax
mov edx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0x70]
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x64], eax
lea eax, [esp + 0x64]
lea edi, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x70]
push ebx
push esi
push ecx
push eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [ebp]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x34]
push ecx
mov ecx, ebp
call dword [edx + 0x10]
test eax, eax
je 0x41e3c2
mov ebp, dword [esp + 0x60]
lea edx, [esp + 0x18]
xor ebx, ebx
push 1
push edx
push ebx
push ebp
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, dword [esp + 0x68]
mov edx, dword [esp + 0x64]
lea ecx, [esp + 0x6c]
push ebx
push ecx
mov dword [esp + 0x1c], eax
mov dword [edi], eax
mov eax, dword [esp + 0x20]
push edx
push esi
push ebp
mov dword [edi + 4], eax
mov dword [esp + 0x80], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x41e3cb
mov eax, dword [esp + 0x70]
mov dword [edi + 0x10], eax
mov eax, dword [esp + 0x64]
push eax
push esi
mov dword [edi + 8], eax
call fcn.004293a0
add esp, 8
mov dword [edi + 0xc], eax
mov dword [esp + 0x10], 1
jmp 0x41e3da
push 0x2691
push 0x15
jmp 0x41e3d2
push 0x269d
push 0xe
call fcn.0041aab0
add esp, 8
push esi
call fcn.004d248b
mov eax, dword [esp + 0x14]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret
Function at 0x41e3f0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 0x14]
sub esp, 0x44
mov ecx, dword [eax]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x5c]
cmp ecx, dword [esi + 0x10]
jae 0x41e41d
push 0x26b8
push 1
call fcn.0041aab0
add esp, 8
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0x44
ret
mov edx, dword [esi + 8]
push edx
call fcn.004d2462
mov ebp, eax
xor ebx, ebx
add esp, 4
cmp ebp, ebx
jne 0x41e449
push 0x26bf
push 0x21
call fcn.0041aab0
add esp, 8
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0x44
ret
mov ecx, dword [esi + 8]
push edi
mov edx, ecx
xor eax, eax
mov edi, ebp
push ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov edx, dword [esp + 0x5c]
and ecx, 3
mov dword [esp + 0x14], ebx
rep stosb byte es:[edi], al
mov ecx, dword [esi + 8]
lea eax, [esp + 0x64]
push eax
push ecx
push ebp
push edx
mov dword [esp + 0x74], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41e554
mov eax, dword [esi + 8]
mov ecx, dword [esp + 0x60]
cmp ecx, eax
jb 0x41e554
mov ecx, dword [esi + 0xc]
push ecx
push eax
push ebp
call fcn.00429370
add esp, 0xc
test eax, eax
je 0x41e539
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x5c]
lea edx, [esp + 0x14]
push 0x40
and eax, 0xffff
push edx
push eax
call fcn.00418540
push eax
call fcn.00410a20
mov edx, eax
add esp, 0x10
cmp edx, ebx
je 0x41e542
mov dword [esp + 0x58], ebx
mov ebx, dword [esp + 0x68]
lea ecx, [esp + 0x58]
mov eax, dword [edx]
push ecx
mov ecx, dword [ebx]
push ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x70], eax
lea edi, [esp + 0x1c]
mov ecx, dword [ecx]
xor eax, eax
push ecx
mov ecx, dword [esi + 8]
push ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ebp
push ecx
lea eax, [esp + 0x2c]
mov ecx, edx
mov edx, dword [esp + 0x80]
push eax
call dword [edx + 0x14]
test eax, eax
je 0x41e54b
mov eax, dword [esp + 0x58]
mov dword [esp + 0x10], 1
mov dword [ebx], eax
jmp 0x41e563
push 0x26d4
push 0x1c
jmp 0x41e55b
push 0x26df
push 0xc
jmp 0x41e55b
push 0x26e7
push 0x12
jmp 0x41e55b
push 0x26cd
push 0xd
call fcn.0041aab0
add esp, 8
push ebp
call fcn.004d248b
mov eax, dword [esp + 0x14]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret

Function at 0x41ecb0
Capabilities:
Get file size

Disassembly:
sub esp, 0x388
push esi
push edi
push 0
call fcn.0041aad0
mov ecx, 0xe1
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
rep stosd dword es:[edi], eax
mov esi, dword [esp + 0x398]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0xc]
push eax
push esi
call fcn.0041edb0
add esp, 0xc
test eax, eax
jne 0x41ed05
mov ecx, dword [esp + 0x398]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
pop edi
pop esi
add esp, 0x388
ret
mov eax, dword [esp + 0x398]
test eax, eax
je 0x41ed16
mov edx, dword [esp + 0x24]
mov dword [eax], edx
mov eax, dword [esp + 0x20]
pop edi
pop esi
add esp, 0x388
ret
Function at 0x41f580
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
cmp ebp, 0xffffffff
je 0x41f5f8
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0x41f5f8
mov esi, dword [esp + 0x18]
test esi, esi
je 0x41f5f8
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
jne 0x41f607
mov ecx, esi
push edi
mov edx, ecx
xor eax, eax
mov edi, ebx
push 0
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov dword [esp + 0x18], 0
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 0x18]
push eax
push esi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
pop edi
jne 0x41f5ef
push 0x29ee
push 0xd
call fcn.0041aab0
add esp, 8
xor eax, eax
pop esi
pop ebp
pop ebx
ret
pop esi
pop ebp
mov eax, 1
pop ebx
ret
push 0x29e1
push 1
call fcn.0041aab0
add esp, 8
pop esi
pop ebp
xor eax, eax
pop ebx
ret

Function at 0x41f610
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 4]
cmp edx, 0xffffffff
je 0x41f65f
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x41f65f
mov eax, dword [esp + 0xc]
test eax, eax
je 0x41f65f
push esi
lea esi, [esp + 8]
push 0
push esi
push eax
push ecx
push edx
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
pop esi
jne 0x41f659
push 0x2a00
push 0xe
call fcn.0041aab0
add esp, 8
xor eax, eax
ret
mov eax, 1
ret
push 0x29f9
push 1
call fcn.0041aab0
add esp, 8
xor eax, eax
ret
Function at 0x421150
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x24c
push ebx
push ebp
mov ebp, dword [esp + 0x258]
push esi
xor esi, esi
cmp ebp, esi
je 0x421228
mov ebx, dword [esp + 0x260]
cmp ebx, esi
je 0x421228
push edi
mov ecx, 0x91
xor eax, eax
lea edi, [esp + 0x16]
mov word [esp + 0x14], si
mov dword [esp + 0x10], esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test esi, esi
push ebx
jne 0x4211b2
push ebp
lea eax, [esp + 0x1c]
push str._s.tes_s
push eax
call fcn.004382b4
add esp, 0x10
jmp 0x4211c6
push esi
push ebp
lea ecx, [esp + 0x20]
push str._s._d.tes_s
push ecx
call fcn.004382b4
add esp, 0x14
lea edx, [esp + 0x14]
push edx
call fcn.00437501
add esp, 4
cmp eax, 0x104
jae 0x421219
lea eax, [esp + 0x14]
push eax
call edi
cmp eax, 0xffffffff
je 0x4211e9
inc esi
jmp 0x421198
lea ecx, [esp + 0x14]
push ecx
call fcn.00437501
push eax
mov eax, dword [esp + 0x270]
lea edx, [esp + 0x1c]
push edx
push eax
call fcn.004374c4
add esp, 0x10
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24c
ret
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24c
ret
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24c
ret