joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40aba3
Capabilities:
Hide graphical window

Disassembly:
mov byte [0x4760d2], 0
push 0
push dword [0x49ff40]
call sub.user32.dll_ShowWindow
ret

Function at 0x40b210
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
push ebx
cmp byte [0x4c73d0], 0
jne 0x40b220
pop ebx
pop edi
pop esi
ret
lea edi, [0x476100]
mov eax, 0xffffffff
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x4c72d0
call sub.user32.dll_GetKeyboardState
or eax, eax
jne 0x40b23f
pop ebx
pop edi
pop esi
ret
lea esi, [0x4c72d0]
mov al, byte [esi + 0x12]
or al, byte [esi + 0x5b]
or al, byte [esi + 0x5c]
or al, byte [esi + 0xa4]
or al, byte [esi + 0xa5]
shl al, 1
jb 0x40b44d
mov al, byte [0x4c72d8]
shl al, 1
jae 0x40b275
call fcn.0040b460
jmp 0x40b44d
mov al, byte [0x4c738c]
shl al, 1
jae 0x40b288
call fcn.0040b470
jmp 0x40b44d
mov al, byte [0x4c738e]
shl al, 1
jae 0x40b29b
call fcn.0040b480
jmp 0x40b44d
mov al, byte [0x4c738f]
shl al, 1
jae 0x40b2ae
call fcn.0040b4a0
jmp 0x40b44d
mov al, byte [0x4c738a]
shl al, 1
jae 0x40b2c1
call fcn.0040b4b0
jmp 0x40b44d
mov al, byte [0x4c738d]
shl al, 1
jae 0x40b2d4
call fcn.0040b4d0
jmp 0x40b44d
mov al, byte [0x4c738b]
shl al, 1
jae 0x40b2e7
call fcn.0040b4e0
jmp 0x40b44d
mov al, byte [0x4c7390]
shl al, 1
jae 0x40b2fa
call fcn.0040b4f0
jmp 0x40b44d
mov al, byte [0x4c72f5]
shl al, 1
jae 0x40b30d
call fcn.0040b500
jmp 0x40b44d
mov al, byte [0x4c72f7]
shl al, 1
jae 0x40b320
call fcn.0040b510
jmp 0x40b44d
mov al, byte [0x4c72f6]
shl al, 1
jae 0x40b333
call fcn.0040b520
jmp 0x40b44d
mov al, byte [0x4c72f8]
shl al, 1
jae 0x40b346
call fcn.0040b530
jmp 0x40b44d
mov al, byte [0x4c73ae]
shl al, 1
jae 0x40b359
call fcn.0040b540
jmp 0x40b44d
mov al, byte [0x4c733e]
shl al, 1
jae 0x40b36c
call fcn.0040b480
jmp 0x40b44d
mov al, byte [0x4c733b]
shl al, 1
jae 0x40b37f
call fcn.0040b4c0
jmp 0x40b44d
mov al, byte [0x4c733d]
shl al, 1
jae 0x40b392
call fcn.0040b4d0
jmp 0x40b44d
mov al, byte [0x4c733a]
shl al, 1
jae 0x40b3a5
call fcn.0040b490
jmp 0x40b44d
mov al, byte [0x4c733f]
shl al, 1
jae 0x40b3b8
call fcn.0040b4a0
jmp 0x40b44d
mov ebx, 0x30
jmp 0x40b3d3
mov al, byte [ebx + 0x4c72d0]
shl al, 1
jae 0x40b3d2
push ebx
mov al, bl
call fcn.0040b550
pop ebx
inc ebx
cmp ebx, 0x39
jbe 0x40b3bf
mov ebx, 0x41
jmp 0x40b3f3
mov al, byte [ebx + 0x4c72d0]
shl al, 1
jae 0x40b3f2
push ebx
mov al, bl
call fcn.0040b550
pop ebx
inc ebx
cmp ebx, 0x5a
jbe 0x40b3df
mov ebx, 0x60
jmp 0x40b413
mov al, byte [ebx + 0x4c72d0]
shl al, 1
jae 0x40b412
push ebx
mov al, bl
call fcn.0040b550
pop ebx
inc ebx
cmp ebx, 0x69
jbe 0x40b3ff
mov ebx, 0x20
mov al, byte [ebx + 0x4c72d0]
shl al, 1
jae 0x40b430
push ebx
mov al, bl
call fcn.0040b550
pop ebx
mov ebx, 0xd
mov al, byte [ebx + 0x4c72d0]
shl al, 1
jae 0x40b448
push ebx
mov al, bl
call fcn.0040b550
pop ebx
call fcn.0040b580
call fcn.0040b5d0
pop ebx
pop edi
pop esi
ret
Function at 0x40cc64
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push esi
push edi
push ecx
push 0x4fa7f8
call fcn.0043df90
lea edi, [0x4fa7f8]
mov al, byte [edi]
inc edi
or al, al
jne 0x40cc7d
dec edi
lea esi, str.custompalette.pal
mov ecx, 0x12
rep movsb byte es:[edi], byte [esi]
lea esi, [0x476748]
lea edi, [0x4fa778]
mov ecx, 0x40
rep movsb byte es:[edi], byte [esi]
push 0x4fa7f8
call fcn.0043e050
cmp eax, 0x40
jne 0x40ccf7
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push 0x4fa7f8
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x40ccf7
push 0
push 0x49ffb8
push 0x40
push 0x4fa778
push dword [ebp - 4]
call sub.kernel32.dll_ReadFile
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
call fcn.0040ce5a
pop ecx
pop edi
pop esi
leave
ret

Function at 0x40cd01
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push 0x4fa7f8
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x40cd4a
push 0
push 0x49ffbc
push 0x40
push 0x4fa778
push dword [ebp - 4]
call sub.kernel32.dll_WriteFile
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
leave
ret

Function at 0x40df9b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp byte [0x4fb712], 0
je 0x40dfbb
movzx eax, byte [esi + 0x56]
push eax
mov al, byte [0x4fa998]
mov byte [esi + 0x56], al
call 0x40dfbb
pop eax
mov byte [esi + 0x56], al
ret
mov al, byte [0x4fa9a6]
cmp al, 6
je 0x40e08e
cmp byte [esi + 0x5c], 1
jne 0x40e017
or byte [ebp], 0x81
mov byte [esi + 0x53], 1
movzx eax, byte [esi + 0x56]
movzx ecx, byte [esi + 0x55]
shl eax, 0xb
lea eax, [eax + ecx*8]
add eax, dword [esi + 0x40]
lea esp, [esp]
mov edi, edi
push 8
movzx ecx, byte [eax]
mov dl, byte [ecx + 0x4fa8fc]
mov byte [edi], dl
mov byte [edi + 1], dl
add eax, 1
add edi, 2
dec dword [esp]
jne 0x40dff2
add esp, 4
add dword [esi + 0xc], 1
add dword [esi + 0x10], 1
ret
movzx eax, byte [esi + 0x56]
movzx ecx, byte [esi + 0x55]
test eax, 0x80
je 0x40e02c
and eax, 0x7f
xor cl, byte [esi + 0x54]
shl eax, 0xc
shl ecx, 4
lea eax, [ecx + eax]
add eax, dword [esi + 0x44]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
cmp ecx, dword [edi]
je 0x40e04b
mov dword [edi], ecx
mov byte [ebp], 1
mov byte [esi + 0x53], 1
cmp edx, dword [edi + 4]
je 0x40e05b
mov dword [edi + 4], edx
mov byte [ebp], 1
mov byte [esi + 0x53], 1
add edi, 8
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
cmp ecx, dword [edi]
je 0x40e072
mov dword [edi], ecx
mov byte [ebp], 1
mov byte [esi + 0x53], 1
cmp edx, dword [edi + 4]
je 0x40e082
mov dword [edi + 4], edx
mov byte [ebp], 1
mov byte [esi + 0x53], 1
add edi, 8
add dword [esi + 0xc], 1
add dword [esi + 0x10], 1
ret
movzx ecx, byte [esi + 0x55]
movzx eax, byte [0x4fa9a4]
call fcn.0040e0b7
movzx ecx, byte [esi + 0x56]
movzx eax, byte [0x4fa9a4]
call fcn.0040e0b7
sub dword [esi + 0xc], 1
sub dword [esi + 0x10], 1
ret
Function at 0x40dfbb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp byte [0x4fb712], 0
je 0x40dfbb
movzx eax, byte [esi + 0x56]
push eax
mov al, byte [0x4fa998]
mov byte [esi + 0x56], al
call 0x40dfbb
pop eax
mov byte [esi + 0x56], al
ret
mov al, byte [0x4fa9a6]
cmp al, 6
je 0x40e08e
cmp byte [esi + 0x5c], 1
jne 0x40e017
or byte [ebp], 0x81
mov byte [esi + 0x53], 1
movzx eax, byte [esi + 0x56]
movzx ecx, byte [esi + 0x55]
shl eax, 0xb
lea eax, [eax + ecx*8]
add eax, dword [esi + 0x40]
lea esp, [esp]
mov edi, edi
push 8
movzx ecx, byte [eax]
mov dl, byte [ecx + 0x4fa8fc]
mov byte [edi], dl
mov byte [edi + 1], dl
add eax, 1
add edi, 2
dec dword [esp]
jne 0x40dff2
add esp, 4
add dword [esi + 0xc], 1
add dword [esi + 0x10], 1
ret
movzx eax, byte [esi + 0x56]
movzx ecx, byte [esi + 0x55]
test eax, 0x80
je 0x40e02c
and eax, 0x7f
xor cl, byte [esi + 0x54]
shl eax, 0xc
shl ecx, 4
lea eax, [ecx + eax]
add eax, dword [esi + 0x44]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
cmp ecx, dword [edi]
je 0x40e04b
mov dword [edi], ecx
mov byte [ebp], 1
mov byte [esi + 0x53], 1
cmp edx, dword [edi + 4]
je 0x40e05b
mov dword [edi + 4], edx
mov byte [ebp], 1
mov byte [esi + 0x53], 1
add edi, 8
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
cmp ecx, dword [edi]
je 0x40e072
mov dword [edi], ecx
mov byte [ebp], 1
mov byte [esi + 0x53], 1
cmp edx, dword [edi + 4]
je 0x40e082
mov dword [edi + 4], edx
mov byte [ebp], 1
mov byte [esi + 0x53], 1
add edi, 8
add dword [esi + 0xc], 1
add dword [esi + 0x10], 1
ret
movzx ecx, byte [esi + 0x55]
movzx eax, byte [0x4fa9a4]
call fcn.0040e0b7
movzx ecx, byte [esi + 0x56]
movzx eax, byte [0x4fa9a4]
call fcn.0040e0b7
sub dword [esi + 0xc], 1
sub dword [esi + 0x10], 1
ret

Function at 0x40e359
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
mov byte [ebp - 0x154], 0
push 0
push 0x4426bc
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x4c]
push eax
push str.Map_files__.map_
push str.Save_Memory_Map
push dword [0x49ff24]
call fcn.0043a154
or eax, eax
je 0x40e412
lea eax, [ebp - 0x154]
push eax
call fcn.0043f150
push 0x4426bc
lea eax, [ebp - 0x154]
push eax
call fcn.0043f890
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x154]
push eax
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0xffffffff
je 0x40e3fb
push 0
push 0x49ffbc
push 0x10000
push 0x523d10
push dword [ebp - 0x50]
call sub.kernel32.dll_WriteFile
push dword [ebp - 0x50]
call sub.kernel32.dll_CloseHandle
jmp 0x40e412
push 0x10
push 0x442440
push str.Unable_to_write_Map_file
push dword [0x49ff24]
call fcn.0043d57a
leave
ret
Function at 0x419f0b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 0xc]
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x419f51
push 0x10
push 0x442440
push str.Unable_to_open_TZX_file_for_saving
push dword [ebp + 8]
call fcn.0043d57a
pop edi
pop esi
pop ebx
leave
ret 8
mov esi, dword [0x44d018]
mov ebx, dword [0x502398]
sub ebx, 0xa
jae 0x419f71
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
pop edi
pop esi
pop ebx
leave
ret 8
push 0
lea eax, [ebp - 8]
push eax
push 0xa
push esi
push dword [ebp - 4]
call sub.kernel32.dll_WriteFile
add esi, 0xa
cmp ebx, 3
jae 0x419f99
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
pop edi
pop esi
pop ebx
leave
ret 8
cmp byte [esi], 0x32
jne 0x419fba
movzx ecx, word [esi + 1]
add ecx, 3
add esi, ecx
sub ebx, ecx
jae 0x419fba
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
pop edi
pop esi
pop ebx
leave
ret 8
pushal
mov byte [0x4fcc88], 0x32
mov word [0x4fcc89], 0
mov byte [0x4fcc8b], 0
lea edi, [0x4fcc8c]
push 0
push 0x3f4
push dword [ebp + 8]
call fcn.0041a0c5
push 1
push 0x3f6
push dword [ebp + 8]
call fcn.0041a0c5
push 2
push 0x3f8
push dword [ebp + 8]
call fcn.0041a0c5
push 3
push 0x3f9
push dword [ebp + 8]
call fcn.0041a0c5
push 4
push 0x3fb
push dword [ebp + 8]
call fcn.0041a0c5
push 5
push 0x3fe
push dword [ebp + 8]
call fcn.0041a0c5
push 6
push 0x3ff
push dword [ebp + 8]
call fcn.0041a0c5
push 7
push 0x401
push dword [ebp + 8]
call fcn.0041a0c5
push 8
push 0x403
push dword [ebp + 8]
call fcn.0041a0c5
push 0xff
push 0x405
push dword [ebp + 8]
call fcn.0041a0c5
cmp word [0x4fcc89], 0
jbe 0x41a0a0
movzx ecx, word [0x4fcc89]
inc word [0x4fcc89]
add ecx, 4
push 0
lea eax, [ebp - 8]
push eax
push ecx
push 0x4fcc88
push dword [ebp - 4]
call sub.kernel32.dll_WriteFile
popal
cmp ebx, 0
jbe 0x41a0b6
push 0
lea eax, [ebp - 8]
push eax
push ebx
push esi
push dword [ebp - 4]
call sub.kernel32.dll_WriteFile
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x41cbc0
Capabilities:
Packed with generic packer

Disassembly:
mov byte [0x4fb446], 0
mov byte [0x4fb711], 0
call fcn.0043a06d
call fcn.0040b6a0
push 8
push 0x4fbb60
push 0x442a00
call fcn.0043efd0
mov word [0x4fb6fe], 0
call fcn.0040b0f9
call fcn.0040668e
call fcn.0041cfa0
mov dword [0x4fb2d8], 0
mov dword [0x4fb2dc], 0
mov byte [0x4a0c4d], 0
mov byte [0x4a0c4e], 1
mov byte [0x4a0c4f], 0
mov byte [0x4a0c50], 0
mov byte [0x4a0c52], 0
mov byte [0x4a0c53], 0
mov byte [0x4fb2c2], 0
mov dword [0x4a0eb0], 0x40d320
mov byte [0x4a0ed4], 0x18
mov byte [0x4a0ed5], 0xc0
mov byte [0x4a0ed6], 0x18
mov dword [0x4a0ec4], 0x140
mov dword [0x4a0ec8], 0xf0
mov dword [0x4a0ecc], 0x100
mov dword [0x4a0ed0], 0x20
mov dword [0x4a0eb4], 0x32
push dword [0x4fb33c]
pop dword [0x4fa944]
mov byte [0x4a0ee1], 0
mov byte [0x4a0ee0], 1
mov dword [0x4fb6e4], 0
mov byte [0x4a0edb], 1
mov byte [0x4a0edc], 1
mov byte [0x4a0ed7], 1
mov byte [0x4a0ed8], 0
mov byte [0x4a0ed9], 1
mov byte [0x4a0eda], 1
mov byte [0x4a0edd], 1
mov byte [0x4a0ede], 1
mov byte [0x4a0edf], 1
mov byte [0x4a0eba], 0
mov byte [0x4a0ebf], 0
mov byte [0x4fb491], 0
mov byte [0x4fb492], 0
mov eax, 0
mov dword [0x4fb2e8], eax
mov dword [0x4fb2ec], eax
mov dword [0x4fb2f0], eax
mov dword [0x4fb2f4], eax
mov dword [0x4fb2f8], eax
mov dword [0x4fb2fc], eax
mov dword [0x4fb300], eax
mov dword [0x4fb304], eax
movzx eax, byte [0x4c7230]
or eax, eax
jne 0x41cd58
call fcn.0041ba14
jmp 0x41cdb6
cmp eax, 1
jne 0x41cd64
call fcn.0041ba6c
jmp 0x41cdb6
cmp eax, 2
jne 0x41cd70
call fcn.0041bc6e
jmp 0x41cdb6
cmp eax, 3
jne 0x41cd7c
call fcn.0041be86
jmp 0x41cdb6
cmp eax, 4
jne 0x41cd88
call fcn.0041bea0
jmp 0x41cdb6
cmp eax, 5
jne 0x41cd94
call fcn.0041c11b
jmp 0x41cdb6
cmp eax, 6
jne 0x41cda0
call fcn.0041c422
jmp 0x41cdb6
cmp eax, 7
jne 0x41cdac
call fcn.0041c6b2
jmp 0x41cdb6
cmp eax, 8
jne 0x41cdb6
call fcn.0041c9aa
mov eax, dword [0x4c727c]
add dword [0x4a0ea4], eax
pushal
mov ebx, dword [0x4a0ea4]
mov byte [0x5b7561], 0
push 0x47845c
push ebx
call fcn.0043dbc0
push 0x47845c
push 0x478449
push 0x5b7561
push 2
call fcn.0043deb0
add esp, 0x10
push 0x5b7561
call fcn.00404bd0
popal
cmp byte [0x4c7236], 1
jne 0x41ce43
mov byte [0x500d1b], 0
mov byte [0x500d1c], 0xc
push dword [0x4a0bb8]
call dword [0x4c7148]
push 0x41d0b0
push dword [0x4a0bb8]
call dword [0x4c714c]
push 0x41d0d0
push dword [0x4a0bb8]
call dword [0x4c7150]
call fcn.0041cea0
call fcn.0041cf30
call fcn.0040ceff
push 0
push 0x80
push 0x4fb3b0
call fcn.0043edd0
call fcn.004068ec
call fcn.0043db13
ret
Function at 0x428970
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push dword [ebp + 8]
push dword [0x501458]
call sub.user32.dll_GetDlgItem
mov dword [ebp - 4], eax
lea eax, [ebp - 0xa]
push eax
push 6
push 0xd
push dword [ebp - 4]
call sub.user32.dll_SendMessageA
push 0x500c8c
lea eax, [ebp - 0xa]
push eax
call fcn.0043f1e0
leave
ret 4

Function at 0x429edf
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbdc
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [esi + 0x1c], 0
mov dword [ebp - 0x424], 0
push 0
push 0x49ffb8
push 5
lea eax, [esi + 0x203e]
push eax
push dword [esi + 0xc]
call sub.kernel32.dll_ReadFile
cmp dword [0x49ffb8], 0
jne 0x429f24
jmp 0x42a00b
cmp dword [0x49ffb8], 5
je 0x429f41
push 0
push 0x479940
call fcn.0042a460
xor eax, eax
pop esi
pop ebx
leave
ret 4
inc dword [ebp - 0x424]
movzx ebx, byte [esi + 0x203e]
cmp ebx, 0x21
je 0x429f58
cmp ebx, 0x20
jne 0x429f71
push 0
push 0x479954
call fcn.0042a460
xor eax, eax
pop esi
pop ebx
leave
ret 4
cmp ebx, 0x80
je 0x429f7e
cmp ebx, 0x30
jne 0x429fe6
push 1
push 0
push 0xfffffffffffffffb
push dword [esi + 0xc]
call sub.kernel32.dll_SetFilePointer
mov al, byte [esi + 0x203e]
push eax
push dword [ebp + 8]
call fcn.0042a016
cmp ebx, 0x80
jne 0x429fd2
push 0
push 0x49ffb8
push 0x12
lea eax, [ebp - 0x41e]
push eax
push dword [esi + 0xc]
call sub.kernel32.dll_ReadFile
push 1
push 0
push 0xffffffffffffffee
push dword [esi + 0xc]
call sub.kernel32.dll_SetFilePointer
mov eax, dword [ebp - 0x419]
add dword [esi + 0x1c], eax
push 1
push 0
push dword [esi + 0x203f]
push dword [esi + 0xc]
call sub.kernel32.dll_SetFilePointer
jmp 0x42a006
push 1
push 0
push 0xfffffffffffffffb
push dword [esi + 0xc]
call sub.kernel32.dll_SetFilePointer
push 1
push 0
push dword [esi + 0x203f]
push dword [esi + 0xc]
call sub.kernel32.dll_SetFilePointer
jmp 0x429efe
mov eax, 1
pop esi
pop ebx
leave
ret 4
Function at 0x42a087
Capabilities:
Delete file
Get common file path
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffce8
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
push 0
push 0x49ffb8
push 5
lea eax, [ebp - 0x315]
push eax
push dword [ebp - 4]
call sub.kernel32.dll_ReadFile
cmp dword [0x49ffb8], 5
je 0x42a0d2
push 0
push 0x479970
call fcn.0042a460
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
mov ebx, dword [ebp - 0x314]
push ebx
push 0x40
call sub.kernel32.dll_GlobalAlloc
mov edi, eax
or edi, edi
jne 0x42a0fb
push 0
push 0x479984
call fcn.0042a460
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
push 1
push 0
push 0xfffffffffffffffb
push dword [ebp - 4]
call sub.kernel32.dll_SetFilePointer
push 0
push 0x49ffb8
push ebx
push edi
push dword [ebp - 4]
call sub.kernel32.dll_ReadFile
mov eax, dword [edi + 5]
test eax, 1
je 0x42a17e
lea ecx, [edi + 0x11]
add ecx, 4
lea eax, [ebp - 0x20c]
push eax
push ecx
call fcn.0043f840
lea eax, [ebp - 0x108]
push eax
push 0x643154
call fcn.0043f840
mov dword [0x4a0c38], 1
lea eax, [ebp - 0x20c]
push eax
call fcn.0043ae13
mov dword [0x4a0c38], 0
push 0x643154
lea eax, [ebp - 0x108]
push eax
call fcn.0043f840
jmp 0x42a296
lea eax, [ebp - 0x310]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
push str.tempsnapshot.
lea eax, [ebp - 0x310]
push eax
call fcn.0043dd50
lea ecx, [edi + 9]
push ecx
lea eax, [ebp - 0x310]
push eax
call fcn.0043dd50
mov eax, dword [edi + 5]
test eax, 2
je 0x42a234
push dword [edi + 0xd]
push 0x40
call sub.kernel32.dll_GlobalAlloc
mov esi, eax
or esi, esi
jne 0x42a1e5
push edi
call sub.kernel32.dll_GlobalFree
push 0
push 0x4799a4
call fcn.0042a460
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
lea edx, [ebx - 0x11]
lea ecx, [edi + 0x11]
push dword [edi + 0xd]
push esi
push edx
push ecx
call fcn.0043f3b0
cmp eax, 0xffffffff
jne 0x42a21c
push esi
call sub.kernel32.dll_GlobalFree
push edi
call sub.kernel32.dll_GlobalFree
push 0
push 0x4799b4
call fcn.0042a460
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
push dword [edi + 0xd]
push esi
lea eax, [ebp - 0x310]
push eax
call fcn.0043f2c0
push esi
call sub.kernel32.dll_GlobalFree
jmp 0x42a248
lea edx, [ebx - 0x11]
lea ecx, [edi + 0x11]
push edx
push ecx
lea eax, [ebp - 0x310]
push eax
call fcn.0043f2c0
lea eax, [ebp - 0x108]
push eax
push 0x643154
call fcn.0043f840
mov dword [0x4a0c38], 1
lea eax, [ebp - 0x310]
push eax
call fcn.0043ae13
mov dword [0x4a0c38], 0
push 0x643154
lea eax, [ebp - 0x108]
push eax
call fcn.0043f840
lea eax, [ebp - 0x310]
push eax
call sub.kernel32.dll_DeleteFileA
push edi
call sub.kernel32.dll_GlobalFree
cmp byte [0x4a0c41], 0
jne 0x42a2ae
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
mov eax, 1
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x42a300
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push 0
push 0
call fcn.0042a460
push 0x104
push 0x644194
push dword [ebp + 8]
call fcn.0043f85d
push 0x486b30
call fcn.004012e2
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push 0x644194
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x42a350
leave
ret 4
mov dword [0x486b3c], eax
push 0
push 0x49ffb8
push 0xa
lea eax, [ebp - 0xe]
push eax
push dword [0x486b3c]
call sub.kernel32.dll_ReadFile
lea eax, [ebp - 0xe]
cmp dword [eax], 0x21585a52
je 0x42a38a
push 0
push 0x4799dc
call fcn.0042a460
xor eax, eax
leave
ret 4
push 0
push 0x49ffb8
push 0x1d
lea eax, [ebp - 0x2b]
push eax
push dword [0x486b3c]
call sub.kernel32.dll_ReadFile
mov edx, dword [ebp - 0x2a]
sub edx, 0x1d
cmp edx, 0
jbe 0x42a3bd
push 1
push 0
push edx
push dword [0x486b3c]
call sub.kernel32.dll_SetFilePointer
push 1
push 0
push 0
push dword [0x486b3c]
call sub.kernel32.dll_SetFilePointer
mov dword [ebp - 4], eax
push 0x486b30
call fcn.00429edf
or eax, eax
jne 0x42a3f1
push 0
push 0x4799f0
call fcn.0042a460
xor eax, eax
leave
ret 4
push 0
push 0
push dword [ebp - 4]
push dword [0x486b3c]
call sub.kernel32.dll_SetFilePointer
push 0x104
push 0x642d44
push 0x644194
call fcn.0043f85d
call fcn.0042fc9d
mov dword [0x486b50], 0
mov byte [0x4930c0], 0
mov dword [0x486b58], 0
mov byte [0x445033], 2
call fcn.0042a660
push str.Stop_Playback
push 0x4a92
push dword [0x4a0b98]
call fcn.0043f180
leave
ret 4
Function at 0x42b280
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
cmp byte [0x445033], 3
jne 0x42b39e
mov dword [ebp - 8], 0
cmp byte [0x4c726a], 1
jne 0x42b2b4
cmp byte [0x4a0c65], 1
jne 0x42b2b4
call fcn.00439cfb
push 1
call fcn.0042b7b0
push dword [0x4fb2d4]
pop dword [ebp - 0xc]
mov dword [ebp - 4], 1
cmp dword [0x4930f4], 0x19
jae 0x42b2db
mov dword [ebp - 4], 2
lea esi, [0x4930d0]
jmp 0x42b35a
dec dword [ebp - 4]
mov esi, dword [esi + 4]
push esi
call fcn.0040130a
cmp eax, 1
je 0x42b35a
cmp byte [esi + 0xc], 0x30
jne 0x42b322
mov dword [ebp - 8], esi
push esi
mov esi, dword [esi]
push esi
call fcn.0040130a
cmp eax, 1
je 0x42b31d
mov edi, dword [esi]
push esi
call fcn.0040133d
push esi
call sub.kernel32.dll_GlobalFree
mov esi, edi
jmp 0x42b300
pop esi
jmp 0x42b35a
cmp byte [esi + 0xc], 0x80
jne 0x42b358
push 0
push 0
push dword [esi + 0xd]
push dword [0x4930dc]
call sub.kernel32.dll_SetFilePointer
push 0
push 0x49ffb8
push 0x12
lea eax, [ebp - 0x1e]
push eax
push dword [0x4930dc]
call sub.kernel32.dll_ReadFile
push dword [ebp - 0x14]
pop dword [ebp - 0xc]
jmp 0x42b2e6
cmp dword [ebp - 4], 0
ja 0x42b2e3
cmp dword [ebp - 8], 0
je 0x42b39e
mov esi, dword [ebp - 8]
push 0
push 0
push dword [esi + 0xd]
push dword [0x4930dc]
call sub.kernel32.dll_SetFilePointer
push 0x4930d0
call fcn.0042a087
or eax, eax
jne 0x42b390
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
push dword [ebp - 0xc]
pop dword [0x4fb2d4]
call fcn.0042b3b0
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42b420
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push esi
push edi
push ebx
push 0x5c9660
lea eax, [ebp - 0x11d]
push eax
call fcn.0043ec10
or eax, eax
jne 0x42b448
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret
call fcn.004360b0
push dword [0x5c9660]
call sub.kernel32.dll_CloseHandle
mov dword [0x5c9660], 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call fcn.0043f040
or eax, eax
jne 0x42b48d
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_DeleteFileA
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret
push 0x30
push 0x4930d0
call fcn.0042a016
lea esi, [ebp - 0x19]
push 0
push 0x11
push esi
call fcn.0043edd0
mov byte [esi], 0x30
mov dword [esi + 9], 0x585a53
mov eax, dword [ebp - 8]
mov dword [esi + 0xd], eax
add eax, 0x11
mov dword [esi + 1], eax
push 0
push 0x49ffbc
push 0x11
push esi
push dword [0x4930dc]
call sub.kernel32.dll_WriteFile
push 0
push 0x49ffbc
push dword [ebp - 8]
push dword [ebp - 4]
push dword [0x4930dc]
call sub.kernel32.dll_WriteFile
push dword [ebp - 4]
call sub.kernel32.dll_GlobalFree
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_DeleteFileA
mov eax, 1
pop ebx
pop edi
pop esi
leave
ret