joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433afa
Capabilities:
Get hostname

Disassembly:
cmp dword [0x495e28], 0
jne 0x433b08
call fcn.00433304
push esi
call sym.ruby187c.exc_rb_w32_enter_critical
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.WS2_32.dll_gethostname]
mov esi, eax
cmp esi, 0xffffffff
jne 0x433b3c
push edi
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call sym.ruby187c.exc_rb_w32_map_errno
pop ecx
mov edi, eax
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], edi
pop edi
call sym.ruby187c.exc_rb_w32_leave_critical
mov eax, esi
pop esi
ret

Function at 0x434007
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp esi, edi
mov dword [ebp - 4], edi
jg 0x43402e
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 0x16
or eax, 0xffffffff
jmp 0x434150
call sym.ruby187c.exc_rb_w32_osid
push 1
pop ebx
cmp eax, ebx
jne 0x43403c
neg esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp esi, eax
mov eax, dword [ebp + 0xc]
jne 0x434073
cmp eax, edi
je 0x434073
cmp eax, 9
je 0x434073
push eax
call dword [sym.imp.MSVCRT.dll_raise]
mov esi, eax
pop ecx
cmp esi, edi
je 0x43406c
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 0x16
mov eax, esi
jmp 0x434150
sub eax, edi
je 0x43411e
dec eax
dec eax
je 0x4340ec
sub eax, 7
je 0x434099
call dword [sym.imp.MSVCRT.dll__errno]
or dword [ebp - 4], 0xffffffff
mov dword [eax], 0x16
jmp 0x43414d
call sym.ruby187c.exc_rb_w32_enter_critical
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, edi
je 0x4340d3
cmp esi, 0xffffffff
je 0x4340d3
push edi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x4340ca
call dword [sym.imp.MSVCRT.dll__errno]
or dword [ebp - 4], 0xffffffff
mov dword [eax], ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x434148
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x43413c
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 3
jmp 0x434144
call sym.ruby187c.exc_rb_w32_enter_critical
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
test eax, eax
jne 0x434148
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x43413c
call esi
push eax
call sym.ruby187c.exc_rb_w32_map_errno
pop ecx
mov esi, eax
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], esi
jmp 0x434144
call sym.ruby187c.exc_rb_w32_enter_critical
push esi
push edi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, edi
je 0x4340d3
cmp eax, 0xffffffff
je 0x4340d3
push eax
jmp 0x4340cb
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], ebx
or dword [ebp - 4], 0xffffffff
call sym.ruby187c.exc_rb_w32_leave_critical
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x434204
Capabilities:
Query environment variable

Disassembly:
push esi
push edi
push dword [esp + 0xc]
call sub.MSVCRT.dll_strlen
mov edi, eax
mov eax, dword [0x495df8]
test eax, eax
pop ecx
je 0x434222
push eax
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
test eax, eax
mov dword [0x495df8], eax
jne 0x434243
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.ruby187c.exc_rb_w32_map_errno
pop ecx
xor eax, eax
pop edi
pop esi
ret
cmp byte [eax], 0
mov esi, eax
je 0x43423e
push edi
push dword [esp + 0x10]
push esi
call dword [sym.imp.MSVCRT.dll__strnicmp]
add esp, 0xc
test eax, eax
jne 0x434263
cmp byte [esi + edi], 0x3d
je 0x434277
push esi
call sub.MSVCRT.dll_strlen
cmp byte [esi + eax + 1], 0
lea esi, [esi + eax + 1]
pop ecx
jne 0x43424a
jmp 0x43423e
lea eax, [esi + edi + 1]
jmp 0x434240

Function at 0x43427d
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
push ecx
and dword [esp], 0
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push edi
push ebp
call esi
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x18], eax
push edi
call esi
or esi, 0xffffffff
mov ebx, eax
cmp dword [esp + 0x18], esi
jne 0x4342c5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.ruby187c.exc_rb_w32_map_errno
pop ecx
mov edi, eax
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], edi
mov eax, esi
jmp 0x434333
call sym.ruby187c.exc_rb_w32_enter_critical
cmp ebx, esi
je 0x4342de
test bl, 1
je 0x4342de
and ebx, 0xfffffffe
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileA]
push edi
push ebp
call ebx
test eax, eax
jne 0x43431f
mov dword [esp + 0x10], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
sub eax, 0x50
je 0x434302
sub eax, 0x67
jne 0x434355
call sym.ruby187c.exc_rb_w32_osid
cmp eax, 2
jne 0x434339
push 1
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x434355
and dword [esp + 0x10], 0
push dword [esp + 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call sym.ruby187c.exc_rb_w32_leave_critical
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x43434b
call esi
cmp eax, 2
jne 0x434355
push edi
push ebp
call ebx
test eax, eax
je 0x434339
jmp 0x43431a
call esi
push eax
call sym.ruby187c.exc_rb_w32_map_errno
pop ecx
mov esi, eax
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], esi
jmp 0x43432a
Function at 0x4344d1
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0x24
push 0
push esi
call sub.MSVCRT.dll_memset
mov edi, dword [ebp + 8]
push 0x484f60
push edi
mov word [esi + 8], 1
call sub.MSVCRT.dll__mbspbrk
add esp, 0x14
test eax, eax
je 0x434516
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 2
jmp 0x4345b2
lea eax, [ebp - 0x140]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x43457b
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
push dword [ebp - 0x140]
call fcn.0043463f
mov word [esi + 6], ax
lea eax, [ebp - 0x134]
push eax
call fcn.00434622
mov dword [esi + 0x18], eax
lea eax, [ebp - 0x12c]
push eax
call fcn.00434622
mov dword [esi + 0x1c], eax
lea eax, [ebp - 0x13c]
push eax
call fcn.00434622
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x120]
add esp, 0x14
mov dword [esi + 0x14], eax
jmp 0x4345c4
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4345a2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.ruby187c.exc_rb_w32_map_errno
pop ecx
mov esi, eax
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], esi
jmp 0x4345b2
test bl, 0x10
je 0x4345b7
push edi
call fcn.004346ec
test eax, eax
pop ecx
je 0x4345b7
or eax, 0xffffffff
jmp 0x43461d
push edi
push ebx
call fcn.0043463f
pop ecx
mov word [esi + 6], ax
pop ecx
mov eax, dword [sym.imp.MSVCRT.dll___mb_cur_max]
cmp dword [eax], 1
jle 0x4345e1
movsx eax, byte [edi]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__isctype]
pop ecx
pop ecx
jmp 0x4345f5
mov ecx, dword [sym.imp.MSVCRT.dll__pctype]
movsx eax, byte [edi]
mov ecx, dword [ecx]
mov ax, word [ecx + eax*2]
and eax, 0x103
test eax, eax
je 0x43460f
cmp byte [edi + 1], 0x3a
jne 0x43460f
movsx eax, byte [edi]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
sub eax, 0x41
jmp 0x434616
call dword [sym.imp.MSVCRT.dll__getdrive]
dec eax
mov dword [esi + 0x10], eax
mov dword [esi], eax
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x43481b
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
call sym.ruby187c.exc_rb_w32_osid
cmp eax, 2
jne 0x434832
call fcn.00434891
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
ret
cmp dword [0x484c90], 0xffffffff
jne 0x434846
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x484c90], eax
push ebx
push esi
push edi
push dword [0x484c90]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov esi, 0x484c8c
mov ebx, eax
push esi
call edi
test eax, eax
jle 0x43487f
test ebx, ebx
jne 0x43487f
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
jmp 0x434863
inc ebx
push ebx
push dword [0x484c90]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
pop esi
pop ebx
ret
Function at 0x4348b5
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
call sym.ruby187c.exc_rb_w32_osid
cmp eax, 2
jne 0x4348cc
call fcn.00434891
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
ret
push 0x484c8c
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
push dword [0x484c90]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
dec eax
push eax
push dword [0x484c90]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
ret

Function at 0x4348ff
Capabilities:
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5b4
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov esi, dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push eax
mov dword [ebp - 4], eax
call esi
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [0x495534]
jne 0x434933
xor eax, eax
jmp 0x434a8d
push ebx
push edi
call sym.ruby187c.exc_rb_w32_interrupted
call sym.ruby187c.exc_rb_w32_enter_critical
push dword [0x495530]
mov ebx, dword [sym.imp.KERNEL32.dll_SuspendThread]
call ebx
push dword [0x495530]
call esi
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0x2cc
lea eax, [ebp - 0x2e8]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x2e8]
mov dword [ebp - 0x2e8], 0x1000f
push eax
push dword [0x495530]
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov eax, dword [0x495e38]
mov ecx, 0xb3
lea esi, [ebp - 0x2e8]
lea edi, [ebp - 0x5b4]
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
cmp eax, ecx
jne 0x4349c1
push ecx
push ecx
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x495e38], eax
jmp 0x4349c8
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push dword [0x495e38]
lea eax, [ebp - 0x1c]
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call fcn.00434a90
push eax
lea eax, [ebp - 0x2e8]
push eax
call fcn.00434ab1
mov esi, dword [sym.imp.KERNEL32.dll_SetThreadContext]
add esp, 0x18
lea eax, [ebp - 0x2e8]
mov dword [ebp - 0x2e8], 0x10001
push eax
push dword [0x495530]
call esi
push dword [0x495530]
mov edi, dword [sym.imp.KERNEL32.dll_ResumeThread]
call edi
call sym.ruby187c.exc_rb_w32_leave_critical
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xffffffffffffffff
push dword [0x495e38]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebp - 0x14], 0
jne 0x434a7c
call sym.ruby187c.exc_rb_w32_enter_critical
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x10], 0
je 0x434a40
push dword [0x495530]
call ebx
lea eax, [ebp - 0x5b4]
mov dword [ebp - 0x5b4], 0x1000f
push eax
push dword [0x495530]
call esi
push dword [0x495530]
call edi
call sym.ruby187c.exc_rb_w32_leave_critical
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 1
pop eax
pop edi
pop ebx
pop esi
leave
ret
Function at 0x434c82
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
xor esi, esi
mov dword [ebp - 4], esi
call sym.ruby187c.exc_rb_w32_enter_critical
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x20]
push esi
push eax
push 0x434dd2
push esi
push esi
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
cmp ebx, esi
je 0x434d69
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call edi
cmp dword [ebp - 0x20], esi
je 0x434cd9
push 0xffffffffffffffff
push ebx
call fcn.004347d0
pop ecx
test eax, eax
pop ecx
je 0x434d07
push dword [ebp + 0x18]
mov dword [ebp - 4], 1
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x434d07
push esi
call edi
lea eax, [ebp - 8]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], esi
pop edi
je 0x434d5e
push 0x1c
lea eax, [ebp - 0x3c]
push esi
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x3c]
push 0x1c
push eax
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x434d50
push 0x8000
push esi
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 4
jmp 0x434d69
call dword [sym.imp.MSVCRT.dll__errno]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
call sym.ruby187c.exc_rb_w32_leave_critical
cmp ebx, esi
jne 0x434d83
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.failed_to_launch_waiter_thread:_d
call sym.ruby187c.exc_rb_fatal
cmp dword [ebp - 4], esi
je 0x434dcb
cmp dword [sym.ruby187c.exc_rb_prohibit_interrupt], esi
jne 0x434dbe
cmp dword [sym.ruby187c.exc_rb_thread_critical], esi
jne 0x434dbe
cmp dword [sym.ruby187c.exc_rb_thread_pending], esi
jne 0x434daf
mov eax, dword [sym.ruby187c.exc_rb_thread_tick]
dec dword [sym.ruby187c.exc_rb_thread_tick]
test eax, eax
jg 0x434dbe
mov dword [sym.ruby187c.exc_rb_thread_tick], 0x1f4
call sym.ruby187c.exc_rb_thread_schedule
cmp dword [sym.ruby187c.exc_rb_trap_pending], esi
je 0x434dcb
call sym.ruby187c.exc_rb_trap_exec
mov eax, dword [ebp - 8]
pop esi
pop ebx
leave
ret
Function at 0x434e01
Capabilities:
Query environment variable

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov esi, eax
xor ebx, ebx
mov edi, esi
mov al, byte [esi]
test al, al
je 0x434e2c
cmp al, 0x3d
je 0x434e1d
inc ebx
push edi
call sub.MSVCRT.dll_strlen
lea edi, [edi + eax + 1]
pop ecx
mov al, byte [edi]
jmp 0x434e14
lea eax, [ebx*4 + 4]
mov ebx, dword [sym.imp.MSVCRT.dll_malloc]
push eax
call ebx
cmp byte [esi], 0
mov ebp, eax
pop ecx
mov dword [esp + 0x10], ebp
mov edi, esi
je 0x434e80
cmp byte [edi], 0x3d
je 0x434e6e
push edi
call sub.MSVCRT.dll_strlen
inc eax
push eax
call ebx
pop ecx
mov dword [ebp], eax
test eax, eax
pop ecx
je 0x434e80
push edi
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
add ebp, 4
pop ecx
push edi
call sub.MSVCRT.dll_strlen
cmp byte [edi + eax + 1], 0
lea edi, [edi + eax + 1]
pop ecx
jne 0x434e4a
and dword [ebp], 0
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x435015
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll__get_osfhandle]
push eax
call fcn.004330ec
pop ecx
test eax, eax
pop ecx
jne 0x435041
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll__read]
add esp, 0xc
pop ebp
ret
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call sym.ruby187c.exc_rb_w32_recv
add esp, 0x10
pop ebp
ret
Function at 0x435097
Capabilities:
Check if file exists
Get file attributes
Set file attributes
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push esi
lea eax, [ebp - 0x34]
push edi
push eax
push dword [ebp + 8]
xor edi, edi
call sym.ruby187c.exc_rb_w32_stat
pop ecx
test eax, eax
pop ecx
jne 0x4350dd
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 8]
cmp esi, edi
push eax
je 0x4350e5
push dword [esi]
call fcn.004351b9
pop ecx
test eax, eax
pop ecx
jne 0x4350dd
lea eax, [ebp - 0x10]
push eax
push dword [esi + 4]
call fcn.004351b9
pop ecx
test eax, eax
pop ecx
je 0x4350f7
or eax, 0xffffffff
jmp 0x4351b5
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
push ebx
call sym.ruby187c.exc_rb_w32_enter_critical
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x43511e
test bl, 1
je 0x43511e
and al, 0xfe
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
call sym.ruby187c.exc_rb_w32_osid
dec eax
neg eax
sbb eax, eax
and eax, 0x2000000
push eax
push 3
push edi
push edi
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x435164
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.ruby187c.exc_rb_w32_map_errno
pop ecx
mov esi, eax
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], esi
or edi, 0xffffffff
jmp 0x435199
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x435192
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.ruby187c.exc_rb_w32_map_errno
pop ecx
mov edi, eax
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], edi
or edi, 0xffffffff
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 0xffffffff
je 0x4351ad
test bl, 1
je 0x4351ad
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call sym.ruby187c.exc_rb_w32_leave_critical
mov eax, edi
pop ebx
pop edi
pop esi
leave
ret

Function at 0x435295
Capabilities:
Create directory
Delete directory

Disassembly:
push esi
or esi, 0xffffffff
call sym.ruby187c.exc_rb_w32_enter_critical
push 0
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x4352c6
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.MSVCRT.dll__chmod]
pop ecx
cmp eax, esi
pop ecx
je 0x4352e1
xor esi, esi
jmp 0x4352eb
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.ruby187c.exc_rb_w32_map_errno
pop ecx
mov edi, eax
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], edi
pop edi
jmp 0x4352eb
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
call sym.ruby187c.exc_rb_w32_leave_critical
mov eax, esi
pop esi
ret
Function at 0x4352f4
Capabilities:
Check if file exists
Delete directory
Get file attributes
Set file attributes

Disassembly:
push ebx
push ebp
push esi
push edi
xor ebp, ebp
call sym.ruby187c.exc_rb_w32_enter_critical
mov esi, dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x435322
test bl, 1
je 0x435322
and al, 0xfe
push eax
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x435354
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.ruby187c.exc_rb_w32_map_errno
pop ecx
mov ebp, eax
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], ebp
or ebp, 0xffffffff
cmp ebx, ebp
je 0x435354
test bl, 1
je 0x435354
push ebx
push esi
call edi
call sym.ruby187c.exc_rb_w32_leave_critical
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
ret

Function at 0x435360
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebx
push ebp
push esi
push edi
xor ebp, ebp
call sym.ruby187c.exc_rb_w32_enter_critical
mov esi, dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x43538e
test bl, 1
je 0x43538e
and al, 0xfe
push eax
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4353c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.ruby187c.exc_rb_w32_map_errno
pop ecx
mov ebp, eax
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], ebp
or ebp, 0xffffffff
cmp ebx, ebp
je 0x4353c0
test bl, 1
je 0x4353c0
push ebx
push esi
call edi
call sym.ruby187c.exc_rb_w32_leave_critical
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
ret
Function at 0x435d0d
Capabilities:
Read file on windows

Disassembly:
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx + 4]
test eax, eax
jg 0x435d1b
xor eax, eax
ret
cmp eax, dword [esp + 8]
jle 0x435d25
mov eax, dword [esp + 8]
push ecx
push eax
push 1
push dword [esp + 0x10]
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
ret
Function at 0x43721f
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x404
push ebx
push ebp
push esi
mov esi, dword [eax]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov ebx, sym.ruby187c.exc_rb_trap_immediate
mov eax, dword [esi + 4]
test eax, eax
jle 0x437294
mov ecx, dword [esi]
mov edx, 0x400
cmp eax, edx
jbe 0x43724e
mov eax, edx
movsx edx, byte [ecx]
cmp edx, dword [esp + 0x41c]
jne 0x437353
lea edx, [eax - 1]
test edx, edx
je 0x437276
movsx ebp, byte [ecx + 1]
inc ecx
cmp ebp, dword [esp + 0x41c]
jne 0x437276
dec edx
jne 0x437265
sub eax, edx
push esi
push eax
lea eax, [esp + 0x1c]
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
test eax, eax
je 0x43733a
jmp 0x43723a
push esi
call dword [sym.imp.MSVCRT.dll__fileno]
push eax
call sym.ruby187c.exc_rb_thread_wait_fd
push dword [esp + 0x420]
call sym.ruby187c.exc_rb_io_check_closed
push esi
call dword [sym.imp.MSVCRT.dll_clearerr]
add esp, 0x10
push 1
push ebx
call edi
push esi
mov ebp, eax
call sym.ruby187c.exc_rb_w32_getc
pop ecx
mov dword [esp + 0x10], eax
push ebp
push ebx
call edi
call dword [sym.imp.MSVCRT.dll__errno]
mov ebp, dword [eax]
xor eax, eax
cmp dword [sym.ruby187c.exc_rb_prohibit_interrupt], eax
jne 0x43730d
cmp dword [sym.ruby187c.exc_rb_thread_critical], eax
jne 0x43730d
cmp dword [sym.ruby187c.exc_rb_thread_pending], eax
jne 0x4372fe
mov eax, dword [sym.ruby187c.exc_rb_thread_tick]
dec dword [sym.ruby187c.exc_rb_thread_tick]
test eax, eax
jg 0x43730d
mov dword [sym.ruby187c.exc_rb_thread_tick], 0x1f4
call sym.ruby187c.exc_rb_thread_schedule
cmp dword [sym.ruby187c.exc_rb_trap_pending], 0
je 0x43731b
call sym.ruby187c.exc_rb_trap_exec
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], ebp
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x41c]
jne 0x437349
cmp eax, 0xffffffff
je 0x437358
jmp 0x43723a
mov eax, dword [esp + 0x418]
push dword [eax + 0x14]
call sym.ruby187c.exc_rb_sys_fail
push esi
push eax
call dword [sym.imp.MSVCRT.dll_ungetc]
pop ecx
pop ecx
push 2
pop eax
jmp 0x43735a
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x404
ret

Function at 0x445cce
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [sym.ruby187c.exc_rb_curr_thread]
push esi
push edi
mov edi, dword [0x495e98]
test edi, edi
je 0x445d17
mov eax, dword [ecx + 0x84]
mov edx, 0x4000
mov esi, eax
and esi, edx
je 0x445cfa
cmp dword [sym.ruby187c.exc_ruby_safe_level], 4
jl 0x445d17
test esi, esi
je 0x445d04
push edi
call sym.ruby187c.exc_rb_exc_jump
or eax, edx
mov dword [ecx + 0x84], eax
push dword [0x495e98]
call sym.ruby187c.exc_rb_exc_raise
mov eax, dword [sym.imp.MSVCRT.dll__iob]
push str._FATAL__failed_to_allocate_memory_n
add eax, 0x40
push eax
call dword [sym.imp.MSVCRT.dll_fprintf]
pop ecx
pop ecx
push 1
call dword [sym.imp.MSVCRT.dll_exit]