joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4353d0
Capabilities:
Check if file exists
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x643c70
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x6c3afc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea edi, [esi + 0x38]
mov dword [ebp - 0x68], 0
cmp dword [edi + 0x10], 0
mov dword [ebp - 0x6c], esi
je 0x435443
cmp dword [edi + 0x14], 8
jb 0x435419
mov eax, dword [edi]
jmp 0x43541b
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne al
test al, al
je 0x435443
xor eax, eax
mov dword [ebx + 0x14], 7
mov dword [ebx + 0x10], 0
mov word [ebx], ax
jmp 0x4355e7
cmp byte [esi + 0x134], 0
je 0x4354c3
cmp dword [esi + 0x128], 0
je 0x4354c3
call fcn.00432bf0
mov ecx, edi
cmp eax, 1
je 0x435492
push 9
push str.C:Users_
call fcn.0040a780
push 0xffffffffffffffff
push 0
add esi, 0x118
push esi
mov ecx, eax
call fcn.0040a950
push 0x10
push str.AppDataRoaming
mov ecx, eax
call fcn.0040a780
jmp 0x4355d4
push 0x1a
push str.C:Documents_and_Settings_
call fcn.0040a780
push 0xffffffffffffffff
push 0
add esi, 0x118
push esi
mov ecx, eax
call fcn.0040a950
push 0x11
push str.Application_Data
mov ecx, eax
call fcn.0040a780
jmp 0x4355d4
mov esi, 7
xor ecx, ecx
push esi
mov word [ebp - 0x64], cx
push str.AppData
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x54], 0
call fcn.00403600
xor eax, eax
mov dword [ebp - 4], eax
push 0x40
xor edx, edx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], eax
mov word [ebp - 0x2c], dx
call fcn.00403600
lea eax, [ebp - 0x68]
mov byte [ebp - 4], 1
push eax
lea edx, [ebp - 0x64]
lea ecx, [ebp - 0x2c]
lea esi, [ebp - 0x48]
mov dword [ebp - 0x68], reloc.WS2_32.dll_accept
call fcn.00435610
push eax
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.00402260
mov esi, 8
cmp dword [ebp - 0x34], esi
jb 0x435545
mov ecx, dword [ebp - 0x48]
push ecx
call fcn.004effaf
add esp, 4
xor edx, edx
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x38], 0
mov word [ebp - 0x48], dx
cmp dword [ebp - 0x18], esi
jb 0x43556a
mov eax, dword [ebp - 0x2c]
push eax
call fcn.004effaf
add esp, 4
xor ecx, ecx
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], cx
cmp dword [ebp - 0x50], esi
jb 0x435596
mov edx, dword [ebp - 0x64]
push edx
call fcn.004effaf
add esp, 4
mov eax, dword [ebp - 0x6c]
cmp dword [eax + 0x48], 0
jne 0x4355d4
push 0x654300
lea esi, [ebp - 0x48]
call fcn.00410b00
push eax
mov ecx, edi
mov dword [ebp - 4], 3
call fcn.00402260
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x34], 8
jb 0x4355d4
mov ecx, dword [ebp - 0x48]
push ecx
call fcn.004effaf
add esp, 4
xor edx, edx
mov dword [ebx + 0x14], 7
mov dword [ebx + 0x10], 0
mov word [ebx], dx
push 0xffffffffffffffff
push 0
push edi
mov ecx, ebx
call fcn.00403240
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005dd8e2
mov esp, ebp
pop ebp
ret
Function at 0x435770
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x643c28
mov eax, dword fs:[0]
push eax
sub esp, 0x278
mov eax, dword [0x6c3afc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor esi, esi
cmp dword [edi + 0x10], esi
je 0x4358d5
push 0xffffffffffffffff
push esi
xor eax, eax
push edi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], esi
mov word [ebp - 0x2c], ax
call fcn.00403240
mov dword [ebp - 4], esi
push 0x2f
lea esi, [ebp - 0x2c]
call fcn.00432350
push 0x5c
call fcn.00432350
add esp, 8
cmp dword [ebp - 0x1c], 3
mov esi, 8
ja case.default.0x4357ff
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], esi
jae 0x4357f3
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 4
ja case.default.0x4357ff
jmp dword [eax*4 + 0x4358f4]
lea ecx, [ebp - 0x2c]
call fcn.004bf3b0
jmp 0x4358d5
lea ecx, [ebp - 0x2c]
call fcn.004bf3b0
mov al, 1
jmp 0x4358d7
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], esi
jae 0x43582d
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x280]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x435899
mov eax, dword [edi + 0x10]
lea ecx, [eax - 1]
cmp eax, ecx
ja 0x435854
push str.invalid_string_position
call fcn.005fe693
mov edx, dword [edi + 0x14]
cmp edx, esi
jb 0x43585f
mov eax, dword [edi]
jmp 0x435861
mov eax, edi
cmp word [eax + ecx*2], 0x5c
je 0x435884
cmp dword [edi + 0x10], ecx
ja 0x435877
push str.invalid_string_position
call fcn.005fe693
cmp edx, esi
jb 0x43587d
mov edi, dword [edi]
cmp word [edi + ecx*2], 0x2f
jne case.0x4357ff.0
cmp dword [ebp - 0x18], esi
jb 0x435895
mov edx, dword [ebp - 0x2c]
push edx
call fcn.004effaf
add esp, 4
mov al, 1
jmp 0x4358d7
test byte [ebp - 0x280], 0x10
push eax
je 0x4358be
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 0x18], esi
jb 0x435895
mov eax, dword [ebp - 0x2c]
push eax
call fcn.004effaf
add esp, 4
mov al, 1
jmp 0x4358d7
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 0x18], esi
jb 0x4358d5
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.004effaf
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005dd8e2
mov esp, ebp
pop ebp
ret
Function at 0x435b80
Capabilities:
Check if file exists
Copy file
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x643bf8
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x6c3afc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 0xffffffffffffffff
xor ebx, ebx
xor ecx, ecx
push ebx
mov word [ebp - 0x2c], cx
push eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], ebx
call fcn.00403240
lea eax, [ebx + 0x20]
lea edi, [ebp - 0x2c]
mov dword [ebp - 4], ebx
call fcn.00401880
lea edi, [ebx + 8]
cmp dword [ebp - 0x1c], ebx
je 0x435bfd
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], edi
jae 0x435bed
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne al
cmp al, bl
jne 0x435c15
cmp dword [ebp - 0x18], edi
jb 0x435c0e
mov edx, dword [ebp - 0x2c]
push edx
call fcn.004effaf
add esp, 4
mov al, 1
jmp 0x435cde
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
add eax, 2
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004effa4
add esp, 4
mov esi, eax
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], edi
jae 0x435c41
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x1c]
add eax, 2
push eax
push esi
call fcn.005dfa9d
mov edx, dword [ebp - 0x1c]
xor eax, eax
xor ecx, ecx
mov word [esi + edx*2], cx
mov ecx, dword [ebp - 0x1c]
mov word [esi + ecx*2 + 2], ax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov word [ebp - 0x34], ax
mov edx, 0x414
or ax, dx
mov ecx, 0xffbf
add esp, 0xc
lea edx, [ebp - 0x50]
and ax, cx
push edx
mov dword [ebp - 0x3a], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x36], ebx
mov dword [ebp - 0x4c], 3
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x44], ebx
mov word [ebp - 0x40], ax
mov byte [ebp - 0x2d], 1
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x435cbd
mov byte [ebp - 0x2d], bl
cmp esi, ebx
je 0x435cca
push esi
call fcn.004effaf
add esp, 4
cmp dword [ebp - 0x18], edi
jb 0x435cdb
mov eax, dword [ebp - 0x2c]
push eax
call fcn.004effaf
add esp, 4
mov al, byte [ebp - 0x2d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005dd8e2
mov esp, ebp
pop ebp
ret
Function at 0x436030
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [esi + 0x10], 0
push ebx
push edi
je 0x4360d9
mov ebx, 8
cmp dword [esi + 0x14], ebx
jb 0x43604e
mov eax, dword [esi]
jmp 0x436050
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne al
test al, al
je 0x4360d9
mov ecx, esi
call fcn.00435770
test al, al
je 0x436072
xor al, al
pop edi
pop ebx
pop ecx
pop ebp
ret
cmp dword [esi + 0x14], ebx
jb 0x43607b
mov eax, dword [esi]
jmp 0x43607d
mov eax, esi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call edi
test eax, eax
jne 0x4360d9
cmp byte [ebp + 8], al
je 0x4360d9
cmp dword [esi + 0x14], ebx
jb 0x436098
mov eax, dword [esi]
jmp 0x43609a
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 1
je 0x4360bb
and eax, 0xfffffffe
cmp dword [esi + 0x14], ebx
jb 0x4360b1
mov ecx, dword [esi]
jmp 0x4360b3
mov ecx, esi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [esi + 0x14], ebx
jb 0x4360c4
mov eax, dword [esi]
jmp 0x4360c6
mov eax, esi
push eax
call edi
test eax, eax
jne 0x4360d9
mov ecx, esi
call fcn.00436c30
pop edi
pop ebx
pop ecx
pop ebp
ret
pop edi
mov al, 1
pop ebx
pop ecx
pop ebp
ret

Function at 0x4360e0
Capabilities:
Get file attributes

Disassembly:
push esi
mov esi, eax
cmp dword [esi + 0x10], 0
jne 0x4360ed
mov al, 1
pop esi
ret
cmp dword [esi + 0x14], 8
jb 0x4360f5
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x436114
push esi
call fcn.00435d00
add esp, 4
push esi
call fcn.00435b80
add esp, 4
pop esi
ret
push 0
call fcn.00436030
add esp, 4
pop esi
ret
Function at 0x436c30
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x643517
mov eax, dword fs:[0]
push eax
sub esp, 0xd8
mov eax, dword [0x6c3afc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x7e
mov esi, ecx
xor ebx, ebx
lea ecx, [ebp - 0x8e]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x90], ax
call fcn.005de050
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea edx, [ebp - 0x90]
push 0x688780
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
xor eax, eax
add esp, 0xc
mov dword [ebp - 0x98], 7
mov dword [ebp - 0x9c], ebx
mov word [ebp - 0xac], ax
push 4
push ebx
push str..tmp
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.00402580
lea ecx, [ebp - 0xe4]
cmp eax, 0xffffffff
je 0x436cfd
add eax, 4
push eax
push ebx
push ecx
mov ecx, esi
call fcn.00401e00
lea edx, [ebp - 0x90]
push edx
push eax
lea eax, [ebp - 0xc8]
push eax
mov byte [ebp - 4], 1
call fcn.0040ac00
add esp, 0xc
mov byte [ebp - 4], 2
jmp 0x436d28
push str..tmp
push esi
push ecx
call fcn.0040aa60
lea edx, [ebp - 0x90]
push edx
push eax
lea eax, [ebp - 0xc8]
push eax
mov byte [ebp - 4], 3
call fcn.0040ac00
add esp, 0x18
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0xac]
call fcn.00402260
mov edi, 8
cmp dword [ebp - 0xb4], edi
jb 0x436d50
mov ecx, dword [ebp - 0xc8]
push ecx
call fcn.004effaf
add esp, 4
xor edx, edx
mov word [ebp - 0xc8], dx
mov dword [ebp - 0xb8], ebx
mov dword [ebp - 0xb4], 7
cmp dword [ebp - 0xd0], edi
jb 0x436d80
mov eax, dword [ebp - 0xe4]
push eax
call fcn.004effaf
add esp, 4
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x98], edi
jae 0x436d94
lea eax, [ebp - 0xac]
cmp dword [esi + 0x14], edi
jb 0x436d9b
mov esi, dword [esi]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x436df5
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x98], edi
jae 0x436dbb
lea eax, [ebp - 0xac]
push 4
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x436dda
cmp dword [ebp - 0x98], edi
jb 0x436e0c
mov ecx, dword [ebp - 0xac]
push ecx
jmp 0x436e04
cmp dword [ebp - 0x98], edi
jb 0x436df1
mov edx, dword [ebp - 0xac]
push edx
call fcn.004effaf
add esp, 4
mov al, 1
jmp 0x436e0e
cmp dword [ebp - 0x98], edi
jb 0x436e0c
mov eax, dword [ebp - 0xac]
push eax
call fcn.004effaf
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005dd8e2
mov esp, ebp
pop ebp
ret
Function at 0x4370d0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [eax + 0x10], 0
jne 0x4370e2
xor al, al
mov esp, ebp
pop ebp
ret
cmp dword [eax + 0x14], 8
jb 0x4370ea
mov eax, dword [eax]
push esi
push 0
push 0x80
push 3
push 0
push 0
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x437112
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push edi
lea eax, [ebp - 4]
push eax
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp dword [ebp - 4], 0
mov edi, eax
je 0x43713c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
test edi, edi
jne 0x437154
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], edi
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
cmp edi, eax
jbe 0x43716f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp + 0x10]
mov dword [edx], edi
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
test eax, eax
jne 0x437178
mov dword [ebp + 0xc], edi
mov eax, edi
mov edx, dword [ebp + 8]
push ebx
push 0
lea ecx, [ebp - 8]
push ecx
push eax
push edx
push esi
mov bl, 1
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x43719a
xor bl, bl
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0x10]
push esi
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x437640
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x643428
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x6c3afc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
xor edi, edi
mov dword [ebp - 4], edi
mov eax, dword [ebp + 0xc]
mov esi, 0x10
lea ebx, [edi + 2]
cmp dword [ebp + 0x20], esi
jae 0x437686
lea eax, [ebp + 0xc]
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x10], eax
cmp eax, 0xffffffff
jne 0x4376bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp + 0x20], esi
jb 0x4377a8
mov ecx, dword [ebp + 0xc]
push ecx
jmp 0x4377a0
lea edx, [ebp - 0x1c]
push edx
push eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push eax
mov dword [ebp - 0x20], eax
call fcn.004effa4
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x10]
add esp, 4
push edi
mov esi, eax
lea eax, [ebp - 0x24]
push eax
push ecx
push esi
push edx
mov dword [ebp - 0x24], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x437790
mov ecx, dword [esi]
lea eax, [esi + 9]
cmp ecx, 4
je 0x43770a
cmp ecx, 5
jne 0x437771
mov edx, dword [esi + 4]
mov ebx, 1
mov dword [ebp - 0x28], ebx
cmp edx, edi
jbe 0x437771
lea esp, [esp]
mov ecx, eax
add eax, 6
cmp byte [ebp + 0x2c], 0
je 0x437742
test eax, eax
je 0x437751
movzx ebx, word [ecx]
cmp dword [ebp + 0x28], ebx
jne 0x437751
mov ecx, dword [ecx + 2]
mov eax, dword [eax + 2]
sub eax, ecx
push eax
jmp 0x437764
test eax, eax
je 0x437751
mov ebx, dword [eax + 2]
sub ebx, dword [ecx + 2]
cmp ebx, 0x40
je 0x43775b
inc edi
cmp edi, edx
jb 0x437720
mov ebx, dword [ebp - 0x28]
jmp 0x437771
mov ecx, dword [ecx + 2]
mov edx, dword [eax + 2]
sub edx, ecx
push edx
add ecx, esi
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.00412860
xor ebx, ebx
push esi
call fcn.004effaf
mov eax, dword [ebp - 0x10]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x20], 0x10
jb 0x4377a8
mov ecx, dword [ebp + 0xc]
push ecx
jmp 0x4377a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp + 0x20], 0x10
jb 0x4377a8
mov edx, dword [ebp + 0xc]
push edx
call fcn.004effaf
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x28
Function at 0x4377c0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x643428
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x6c3afc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
xor esi, esi
mov dword [ebp - 4], esi
cmp dword [ebp + 0x20], 0x10
mov eax, dword [ebp + 0xc]
lea edi, [esi + 2]
jae 0x437802
lea eax, [ebp + 0xc]
push esi
push 0x80
push 3
push esi
push 1
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
mov dword [ebp - 0x10], ebx
cmp ebx, 0xffffffff
jne 0x43783c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp + 0x20], 0x10
jb 0x437916
mov ecx, dword [ebp + 0xc]
push ecx
jmp 0x43790e
lea edx, [ebp - 0x1c]
push edx
push ebx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push eax
mov dword [ebp - 0x20], eax
call fcn.004effa4
mov ecx, dword [ebp - 0x20]
add esp, 4
push 0
mov esi, eax
lea eax, [ebp - 0x24]
push eax
push ecx
push esi
push ebx
mov dword [ebp - 0x24], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4378fe
cmp dword [esi], 5
lea eax, [esi + 0xc]
jne 0x4378e2
xor edx, edx
mov edi, 1
cmp dword [esi + 8], edx
jbe 0x4378e2
mov ecx, eax
add eax, 6
cmp byte [ebp + 0x2c], 0
je 0x4378b2
test eax, eax
je 0x4378c1
movzx ebx, word [ecx]
cmp dword [ebp + 0x28], ebx
jne 0x4378c1
mov ecx, dword [ecx + 2]
mov edx, dword [eax + 2]
sub edx, ecx
push edx
jmp 0x4378d2
test eax, eax
je 0x4378c1
mov ebx, dword [eax + 2]
sub ebx, dword [ecx + 2]
cmp ebx, 0x40
je 0x4378c9
inc edx
cmp edx, dword [esi + 8]
jb 0x437890
jmp 0x4378df
mov ecx, dword [ecx + 2]
mov eax, dword [eax + 2]
sub eax, ecx
push eax
add ecx, esi
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.00412860
xor edi, edi
mov ebx, dword [ebp - 0x10]
push esi
call fcn.004effaf
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x20], 0x10
jb 0x437916
mov ecx, dword [ebp + 0xc]
push ecx
jmp 0x43790e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp + 0x20], 0x10
jb 0x437916
mov edx, dword [ebp + 0xc]
push edx
call fcn.004effaf
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x28
Function at 0x437ba0
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x645c10
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x6c3afc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0x30], ebx
push ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 0x18]
push 0x688638
push eax
push ebx
lea ecx, [ebp + 8]
call fcn.0040c070
lea edi, [ebx + 8]
test eax, eax
je 0x437d60
mov eax, dword [ebp + 8]
cmp dword [ebp + 0x1c], edi
jae 0x437bfb
lea eax, [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x437d60
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], 0
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
cmp dword [ebp + 0x1c], edi
jae 0x437c27
lea eax, [ebp + 8]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x437c8d
lea ecx, [ebp - 0x2c]
mov edi, 0xf
push ecx
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], ebx
mov ecx, esi
mov byte [esi], 0
call fcn.00403740
cmp dword [ebp - 0x18], 0x10
jb 0x437c70
mov edx, dword [ebp - 0x2c]
push edx
call fcn.004effaf
add esp, 4
cmp dword [ebp + 0x1c], 8
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], 0
jb 0x437d8b
mov eax, dword [ebp + 8]
push eax
jmp 0x437d83
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
test ebx, ebx
jne 0x437cc7
lea ecx, [ebp - 0x2c]
push ecx
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], eax
mov ecx, esi
mov byte [esi], al
call fcn.00403740
lea ecx, [ebp - 0x2c]
call fcn.004037f0
lea ecx, [ebp + 8]
call fcn.004bf3b0
jmp 0x437d8b
push ebx
call fcn.004effa4
add esp, 4
push 0
lea edx, [ebp - 0x34]
push edx
push ebx
push eax
push edi
mov dword [ebp - 0x30], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
test ebx, ebx
je 0x437d07
nop
mov eax, dword [ebp - 0x30]
movzx ecx, byte [edi + eax]
push ecx
push 1
lea ecx, [ebp - 0x2c]
call fcn.00402040
inc edi
cmp edi, ebx
jb 0x437cf0
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x437d17
push eax
call fcn.004effaf
add esp, 4
lea edx, [ebp - 0x2c]
mov edi, 0xf
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], 0
push edx
mov ecx, esi
mov byte [esi], 0
call fcn.00403740
cmp dword [ebp - 0x18], 0x10
jb 0x437d46
mov eax, dword [ebp - 0x2c]
push eax
call fcn.004effaf
add esp, 4
cmp dword [ebp + 0x1c], 8
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
jb 0x437d8b
mov ecx, dword [ebp + 8]
push ecx
jmp 0x437d83
push ebx
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
push 0x688621
mov ecx, esi
mov byte [esi], 0
call fcn.00403c90
cmp dword [ebp + 0x1c], edi
jb 0x437d8b
mov edx, dword [ebp + 8]
push edx
call fcn.004effaf
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005dd8e2
mov esp, ebp
pop ebp
ret