joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100054ab
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
mov dword [ebp - 0xc], edi
mov ebx, esi
mov eax, dword [edi + 0xc]
cmp eax, dword [edi + 8]
jne 0x1000561c
push 0x802
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x1000562a
push 0x802
push esi
push ebx
call sub.VCRUNTIME140.dll_memset
mov edx, dword [edi + 0x20]
lea ecx, [edi + 8]
add esp, 0xc
test edx, edx
jne 0x10005515
push esi
push ecx
push 0x800
push ebx
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1000561f
jmp 0x1000552a
mov eax, dword [edx]
push ecx
push 0x800
push ebx
push edx
call dword [eax + 0xc]
test eax, eax
js 0x1000561f
lea eax, [edi + 8]
mov edx, dword [eax]
test edx, edx
je 0x1000561f
cmp dword [edi + 0x14], esi
jne 0x10005582
mov cl, byte [ebx]
cmp cl, 0xff
jne 0x10005549
cmp byte [ebx + 1], 0xfe
je 0x10005554
cmp cl, 0x3c
jne 0x1000555c
cmp byte [ebx + 1], 0
jne 0x1000555c
xor ecx, ecx
inc ecx
mov dword [edi + 0x18], ecx
jmp 0x1000557c
cmp cl, 0xfe
jne 0x10005567
cmp byte [ebx + 1], 0xff
je 0x10005571
test cl, cl
jne 0x10005579
cmp byte [ebx + 1], 0x3c
jne 0x10005579
xor ecx, ecx
inc ecx
mov dword [edi + 0x1c], ecx
jmp 0x10005557
xor ecx, ecx
inc ecx
mov dword [ebp - 4], ecx
mov dword [edi + 0x14], ecx
cmp dword [edi + 0x18], esi
je 0x1000558b
shr edx, 1
mov dword [eax], edx
cmp dword [edi + 0x1c], esi
je 0x100055b9
mov eax, dword [eax]
mov edx, esi
lea eax, [eax*2 - 2]
test eax, eax
je 0x100055b9
mov edi, eax
mov cl, byte [edx + ebx]
mov al, byte [edx + ebx + 1]
mov byte [edx + ebx], al
mov byte [edx + ebx + 1], cl
add edx, 2
cmp edx, edi
jb 0x100055a1
mov edi, dword [ebp - 0xc]
cmp dword [edi + 0x18], esi
je 0x100055d3
cmp dword [edi + 0x10], esi
je 0x100055cc
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [edi + 0x10], ebx
mov ebx, esi
jmp 0x1000560c
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1000b944]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1000ba4c]
cmp eax, dword [ecx + 4]
jg 0x10005631
push 0x800
push dword [edi + 0x10]
push dword [edi + 8]
push ebx
push esi
push dword [0x1000ba50]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [edi + 8], eax
test eax, eax
je 0x1000561f
cmp dword [ebp - 4], esi
je 0x10005619
cmp dword [edi + 0x18], esi
je 0x10005619
xor esi, esi
inc esi
mov dword [edi + 0xc], esi
xor esi, esi
inc esi
test ebx, ebx
je 0x1000562a
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
push 0x1000ba4c
call fcn.10006e41
cmp dword [0x1000ba4c], 0xffffffff
pop ecx
jne 0x100055ec
call dword [sym.imp.KERNEL32.dll_GetACP]
push 0x1000ba4c
mov dword [0x1000ba50], eax
call fcn.10006dfd
pop ecx
jmp 0x100055ec
Function at 0x1000629c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 4]
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
push edi
push esi
push eax
push ebx
push edx
push ecx
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
js 0x10006306
mov eax, dword [ebp - 4]
test edi, edi
jne 0x100062e1
test esi, esi
je 0x100062fd
mov ecx, 0x8000ffff
jmp 0x10006306
test esi, esi
je 0x100062fd
cmp eax, 1
je 0x100062ef
cmp eax, 2
jne 0x100062fd
mov edx, dword [edi]
cmp edx, 2
jb 0x100062da
cmp word [edx + esi - 2], bx
jmp 0x100062d8
mov edx, dword [ebp + 8]
test edx, edx
je 0x10006306
mov dword [edx], eax
pop edi
pop esi
mov eax, ecx
pop ebx
leave
ret 0xc
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x40288e
pop dword [ebp - 0x40]
mov eax, 0x2710effb
add eax, 0xd92f3893
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xb80cf03d
add dword [ebp - 0x50], 0x9645550e
mov dword [ebp - 0x4c], 0x63ea292
add dword [ebp - 0x4c], 0x2bf4a9b3
mov dword [ebp - 0x48], 0x52426128
sub dword [ebp - 0x48], 0x5f61cfa
mov dword [ebp - 0x44], 0x2fd71a87
sub dword [ebp - 0x44], 0x2fd71a87
lea eax, [ebp - 0x50]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xf232f3c0
add dword [ebp - 0x50], 0x823f7596
mov dword [ebp - 0x4c], 0xe82271ed
sub dword [ebp - 0x4c], 0xa6b61078
mov dword [ebp - 0x48], 0x622ba09e
add dword [ebp - 0x48], 0x143cbce
mov dword [ebp - 0x44], 0xb2a390dc
add dword [ebp - 0x44], 0x4d5c6f24
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0xecef7d0c
add eax, 0x135103c8
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x33532
push 0
call eax
mov ecx, 0x429f9cf3
add ecx, 0xbd609df7
xor ebx, ebx
add ebx, eax
mov esi, 0x411000
add esi, dword [ebp - 0x40]
mov edi, 0x26fe4b77
sub edi, 0x456f0eef
xor dword [ebp - 0x38], 0xdf82a706
mov edx, dword [esi]
sub dword [ebp - 0x20], edi
add edx, edi
mov dword [ebx], edx
add ebx, 0xdeda46c7
sub ebx, 0xdeda46c3
add esi, 0xd27b88ef
add esi, 0x2d847715
loop 0x4029a7
add eax, 0x4b8f50a6
sub eax, 0x4b8e722b
mov ebx, eax
add eax, 5
mov ecx, 0x89edace8
add ecx, 0x76525318
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x402c00
pop dword [ebp - 0x1c]
mov eax, 0xacc35df3
add eax, 0x537cce0d
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xd3a5298e
add dword [ebp - 0x2c], 0x7aad1bbd
mov dword [ebp - 0x28], 0xd0bee482
add dword [ebp - 0x28], 0x617467c3
mov dword [ebp - 0x24], 0x2d2d0869
add dword [ebp - 0x24], 0x1f1f3bc5
mov dword [ebp - 0x20], 0x21311082
sub dword [ebp - 0x20], 0x21311082
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x224c54e
sub eax, 0x1e444c2
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x9caf0ae3
add dword [ebp - 0x2c], 0xd7c35e73
mov dword [ebp - 0x28], 0x348efe88
sub dword [ebp - 0x28], 0xf3229d13
mov dword [ebp - 0x24], 0x629585f2
add dword [ebp - 0x24], 0xd9e67a
mov dword [ebp - 0x20], 0xff49d5c1
add dword [ebp - 0x20], 0xb62a3f
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0xdea89ad8
sub eax, 0xde681a04
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x3bf62
push 0
call eax
mov ecx, 0xcf56839b
add ecx, 0x30a9d97c
mov ebx, eax
mov edi, 0xed85de96
sub edi, 0xed44ce96
add edi, dword [ebp - 0x1c]
mov edx, 0x9e6ea1b6
sub edx, 0xee99a8ad
add dword [ebp - 0x14], ebx
mov esi, dword [edi]
add dword [ebp - 8], 0xa29dc7a1
xor esi, edx
sub dword [ebp - 0xc], 0x7d631dd3
mov dword [ebx], esi
xor dword [ebp - 0x10], 0x42bd781d
add ebx, 0x1777be46
add ebx, 0xe88841be
add edi, 4
loop 0x402d22
add eax, 0x8b55cd61
add eax, 0x74ab99ce
mov ebx, eax
add eax, 5
mov ecx, 0x3544823c
sub ecx, 0x3504823c
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x403400
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x484e45
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x499100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, edx
cmp dword [edx + 0x14], 8
mov eax, dword [edx + 0x10]
jb 0x40343a
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add eax, eax
je 0x40345b
mov edx, eax
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x403447
mov edx, dword [ebp + 0xc]
push esi
push edx
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.004029f0
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x40348c
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x7ffffff
je 0x4035de
lea eax, [ebx + 4]
mov dword [ebp - 0x1c], eax
push 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
call fcn.0046a987
add esp, 4
mov edi, eax
mov dword [ebp - 0x18], edi
push dword [ebp + 0xc]
lea ecx, [edi + 8]
call fcn.004037e0
mov eax, dword [ebx + 8]
inc eax
movss xmm3, dword [ebx]
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x489070]
mov eax, dword [ebx + 0x1c]
cvtpd2ps xmm2, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x489070]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x403580
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x14], xmm0
fld qword [ebp - 0x14]
fstp qword [esp]
call fcn.00472340
fstp qword [ebp - 0x14]
movsd xmm0, qword [ebp - 0x14]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.0046ae60
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x403564
cmp eax, 0x200
jae 0x403562
shl eax, 3
cmp eax, ecx
jae 0x403564
mov eax, ecx
push eax
mov ecx, ebx
call fcn.0040dfd0
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.004029f0
mov edx, dword [eax]
jmp 0x403583
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov dword [edi + 4], eax
mov dword [edi], edx
mov dword [eax], edi
mov dword [edx + 4], edi
mov ecx, dword [ebx + 0xc]
mov dword [ebp + 0xc], eax
mov eax, dword [ebx + 0x18]
and eax, esi
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x4035ab
mov dword [ecx + eax*8], edi
jmp 0x4035bd
cmp esi, edx
jne 0x4035b4
mov dword [ecx + eax*8], edi
jmp 0x4035c1
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x4035c1
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.00469c9f
int3
Function at 0x405360
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
xor eax, eax
mov dword [ebp - 0x54], 0x44
mov word [ebp - 0x12], ax
xorps xmm0, xmm0
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
movlpd qword [ebp - 0x50], xmm0
push eax
push 0
push 0
push 0x10
push 0
push 0
push 0
push dword [ebp + 8]
movlpd qword [ebp - 0x48], xmm0
push 0
movlpd qword [ebp - 0x40], xmm0
movlpd qword [ebp - 0x38], xmm0
movlpd qword [ebp - 0x30], xmm0
movlpd qword [ebp - 0x22], xmm0
movlpd qword [ebp - 0x1a], xmm0
mov dword [ebp - 0x28], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4053e4
push 0xffffffffffffffff
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret 4
Function at 0x406f30
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x49b604]
push ebx
push esi
mov esi, dword [0x49b600]
mov dword [ebp - 4], eax
push edi
cmp esi, eax
je 0x406ff2
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esi, 0x2c
mov ecx, eax
nop dword [eax + eax]
mov eax, dword [esi + 0xa4]
cmp eax, 5
je 0x406f77
cmp eax, 6
je 0x406f77
cmp eax, 3
jne 0x406fe1
jmp 0x406fd0
cmp dword [esi + 0x2c], 0
lea edi, [esi - 0x14]
mov ecx, dword [esi]
je 0x406fbd
mov eax, edi
cmp ecx, 8
jb 0x406f8b
mov eax, dword [edi]
push eax
call ebx
cmp dword [esi], 8
jb 0x406f95
mov edi, dword [edi]
cmp dword [esi + 0x30], 8
lea ebx, [esi + 0x1c]
mov eax, ebx
jb 0x406fa2
mov eax, dword [ebx]
push edi
push eax
call fcn.00407eb0
add esp, 8
cmp dword [esi + 0x30], 8
jb 0x406fb4
mov ebx, dword [ebx]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x406fc5
cmp ecx, 8
jb 0x406fc4
mov edi, dword [edi]
push edi
call ebx
cmp dword [esi + 0xa4], 5
jne 0x406fde
cmp dword [esi + 0x18], 8
lea eax, [esi + 4]
jb 0x406fdb
mov eax, dword [eax]
push eax
call ebx
mov ecx, dword [ebp - 4]
add esi, 0xd8
lea eax, [esi - 0x2c]
cmp eax, ecx
jne 0x406f60
mov edi, dword [0x49b654]
mov esi, dword [0x49b650]
cmp esi, edi
je 0x407039
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileW]
add esi, 0x28
nop dword [eax + eax]
cmp dword [esi], 0
je 0x40702f
cmp dword [esi - 0x14], 8
lea eax, [esi - 0x28]
jb 0x407020
mov eax, dword [eax]
cmp dword [esi + 4], 8
lea ecx, [esi - 0x10]
jb 0x40702b
mov ecx, dword [ecx]
push eax
push ecx
call ebx
add esi, 0x30
lea eax, [esi - 0x28]
cmp eax, edi
jne 0x407010
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407d20
Capabilities:
Create process on windows
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6a0
mov eax, dword [0x499100]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea ecx, [ebp - 0x20c]
mov esi, 0x49b870
mov eax, ecx
mov edx, 0x104
sub esi, eax
nop dword [eax + eax]
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x407d6e
movzx eax, word [esi + ecx]
test ax, ax
je 0x407d6e
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x407d50
lea eax, [ecx - 2]
test edx, edx
push str._bin64bit
cmovne eax, ecx
xor ecx, ecx
push 0x208
mov word [eax], cx
lea eax, [ebp - 0x20c]
push eax
call fcn.00408e70
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea ecx, [ebp - 0x414]
mov edx, 0x104
lea esi, [ebp - 0x20c]
mov eax, ecx
sub esi, eax
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x407dd1
movzx eax, word [esi + ecx]
test ax, ax
je 0x407dd1
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x407db3
lea eax, [ecx - 2]
test edx, edx
push str.obs64.exe
cmovne eax, ecx
xor ecx, ecx
push 0x208
mov word [eax], cx
lea eax, [ebp - 0x20c]
push eax
call fcn.00408e70
lea eax, [ebp - 0x664]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
pop esi
cmp eax, 0xffffffff
je 0x407e98
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x694], 0
mov dword [ebp - 0x690], eax
xor ecx, ecx
cmp byte [ebp + 8], cl
lea eax, [ebp - 0x414]
mov dword [ebp - 0x688], eax
xorps xmm0, xmm0
mov eax, str.__portable
movlpd qword [ebp - 0x69c], xmm0
cmove eax, ecx
movlpd qword [ebp - 0x680], xmm0
mov dword [ebp - 0x68c], eax
lea eax, [ebp - 0x6a0]
push eax
movlpd qword [ebp - 0x678], xmm0
movlpd qword [ebp - 0x670], xmm0
mov dword [ebp - 0x668], ecx
mov dword [ebp - 0x6a0], 0x3c
mov dword [ebp - 0x684], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046ae1f
mov esp, ebp
pop ebp
ret
Function at 0x407eb0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4852ab
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1002c
call fcn.0046ae30
mov eax, dword [0x499100]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, dword [ebp + 0xc]
or edi, 0xffffffff
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10024], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x1001c], edi
or esi, edi
mov dword [ebp - 0x10028], esi
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0x8000000
push 3
push 0
push 1
push 0x80000000
push eax
mov byte [ebp - 4], 2
call ebx
cmp eax, edi
je 0x407f3d
mov edi, eax
mov dword [ebp - 0x1001c], edi
test eax, eax
je 0x407f3d
mov al, 1
jmp 0x407f3f
xor al, al
test al, al
je 0x408061
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push dword [ebp - 0x10024]
call ebx
cmp eax, 0xffffffff
je 0x407f73
mov esi, eax
mov dword [ebp - 0x10028], esi
test eax, eax
je 0x407f73
mov al, 1
jmp 0x407f75
xor al, al
test al, al
je 0x40807d
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea eax, [ebp - 0x10018]
push eax
push 0x10000
lea eax, [ebp - 0x10014]
push eax
push edi
call ebx
test eax, eax
je 0x408099
mov eax, dword [ebp - 0x10018]
test eax, eax
jne 0x407fd7
test esi, esi
je 0x407fc1
cmp esi, 0xffffffff
je 0x407fc1
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
jmp 0x407fc7
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x407fd3
cmp edi, 0xffffffff
je 0x407fd3
push edi
call esi
mov al, 1
jmp 0x408045
push 0
lea ecx, [ebp - 0x10038]
push ecx
push eax
lea eax, [ebp - 0x10014]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4080b5
jmp 0x40800b
mov eax, dword [ebp - 0x10038]
cmp eax, dword [ebp - 0x10018]
je 0x407f83
test esi, esi
je 0x408031
cmp esi, 0xffffffff
je 0x408031
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
jmp 0x408037
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x408043
cmp edi, 0xffffffff
je 0x408043
push edi
call esi
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0046ae1f
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x10020]
call fcn.00403920
push 0x495e70
lea eax, [ebp - 0x10020]
push eax
call fcn.0046c260
lea ecx, [ebp - 0x1002c]
call fcn.00403920
push 0x495e70
lea eax, [ebp - 0x1002c]
push eax
call fcn.0046c260
lea ecx, [ebp - 0x10030]
call fcn.00403920
push 0x495e70
lea eax, [ebp - 0x10030]
push eax
call fcn.0046c260
lea ecx, [ebp - 0x10034]
call fcn.00403920
push 0x495e70
lea eax, [ebp - 0x10034]
push eax
call fcn.0046c260
int3
Function at 0x4080e0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4852f5
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x499100]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xorps xmm0, xmm0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], edi
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
push 0
push 0
push 3
push 0
push 0
push 0x80000000
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x3c], esi
mov byte [ebp - 4], 1
test esi, esi
je 0x408274
cmp esi, 0xffffffff
je 0x408274
lea eax, [ebp - 0x34]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x4081ef
xorps xmm0, xmm0
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x4081d2
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4081c8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4082db
push ecx
push edx
call fcn.0046a9b7
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046ae1f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
ja 0x40820d
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], ecx
cmovae eax, dword [ebp - 0x28]
mov byte [ecx + eax], 0
jmp 0x40821a
sub ecx, eax
push 0
push ecx
lea ecx, [ebp - 0x28]
call fcn.0040fa60
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x2c]
push 0
push ecx
push dword [ebp - 0x18]
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x408172
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp eax, dword [ebp - 0x34]
jne 0x40825d
cmp ecx, dword [ebp - 0x30]
jne 0x40825d
lea eax, [ebp - 0x28]
mov ecx, edi
push eax
call fcn.00403680
jmp 0x408197
xorps xmm0, xmm0
movups xmmword [edi], xmm0
mov dword [edi + 0x10], ecx
mov dword [edi + 0x14], 0xf
mov byte [edi], cl
jmp 0x408197
xorps xmm0, xmm0
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
test esi, esi
je 0x4082a9
cmp esi, 0xffffffff
je 0x4082a9
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x4081d2
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4081c8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4081c8
call fcn.0046e58f
int3