joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a6d9
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
test esi, esi
jne 0x40a6eb
or eax, 0xffffffff
leave
ret
push 0x110
lea eax, [ebp - 0x110]
push 0
push eax
call fcn.0048e7e0
add esp, 0xc
lea eax, [ebp - 0x114]
push eax
mov dword [ebp - 0x114], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40a72e
cmp dword [ebp - 0x110], 5
jne 0x40a72e
cmp dword [ebp - 0x10c], 0
je 0x40a73b
push esi
call fcn.0040a5f7
test eax, eax
pop ecx
jne 0x40a73b
leave
ret
push esi
call fcn.0040a50e
pop ecx
leave
ret

Function at 0x40a744
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
xor ebx, ebx
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 1], bl
mov dword [ebp - 8], ebx
mov byte [ebp - 0x18], bl
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], bl
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], bl
mov byte [ebp - 0x13], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x40a804
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push 2
push dword [ebp + 8]
call esi
test eax, eax
jne 0x40a7aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x40a803
push edi
push dword [ebp - 0xc]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push edi
push 2
push dword [ebp + 8]
call esi
test eax, eax
je 0x40a7f7
cmp dword [edi], ebx
mov dword [ebp - 0x10], ebx
jbe 0x40a7f7
lea esi, [edi + 4]
push dword [esi]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x40a7f3
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
add esi, 8
cmp eax, dword [edi]
jb 0x40a7d5
jmp 0x40a7f7
mov byte [ebp - 1], 1
cmp edi, ebx
je 0x40a802
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
cmp dword [ebp - 8], ebx
pop ebx
je 0x40a813
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov al, byte [ebp - 1]
leave
ret
Function at 0x40a818
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push edi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
xor edi, edi
push 1
push edi
push edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call sub.WTSAPI32.dll_WTSEnumerateSessionsW
test eax, eax
jne 0x40a886
push 0x110
lea eax, [ebp - 0x118]
push edi
push eax
call fcn.0048e7e0
add esp, 0xc
lea eax, [ebp - 0x11c]
push eax
mov dword [ebp - 0x11c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40a880
cmp dword [ebp - 0x118], 6
jne 0x40a880
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40a8bb
mov dword [esi], edi
xor eax, eax
jmp 0x40a8bb
mov ecx, dword [ebp - 8]
xor eax, eax
cmp dword [ebp - 4], edi
push ebx
mov ebx, 0x490
jbe 0x40a8b2
lea edx, [ecx + 8]
cmp dword [edx], edi
je 0x40a8a8
inc eax
add edx, 0xc
cmp eax, dword [ebp - 4]
jb 0x40a899
jmp 0x40a8b2
imul eax, eax, 0xc
mov eax, dword [eax + ecx]
mov dword [esi], eax
xor ebx, ebx
push ecx
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, ebx
pop ebx
pop edi
leave
ret

Function at 0x40b234
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
xor eax, eax
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0x6c], 0x67452301
mov dword [ebp - 0x68], 0xefcdab89
mov dword [ebp - 0x64], 0x98badcfe
mov dword [ebp - 0x60], 0x10325476
call fcn.0040b058
lea eax, [ebp - 0x14]
push eax
lea esi, [ebp - 0x6c]
call fcn.0040b11b
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call fcn.0040b1b7
mov eax, dword [ebp + 8]
add esp, 0x10
pop esi
leave
ret

Function at 0x40bb62
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x230
push esi
mov esi, eax
cmp dword [esi + 0x14], 0x104
push edi
jb 0x40bb82
xor al, al
jmp 0x40bc0f
and word [esp + 0x28], 0
push 0x208
lea eax, [esp + 0x2e]
push 0
push eax
call fcn.0048e7e0
add esp, 0xc
cmp dword [esi + 0x18], 8
jb 0x40bba7
mov esi, dword [esi + 4]
jmp 0x40bbaa
add esi, 4
push esi
lea eax, [esp + 0x2c]
push 0x105
push eax
call fcn.00490963
and dword [esp + 0x14], 0
add esp, 0xc
push 6
xor eax, eax
pop ecx
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x28]
mov dword [esp + 0x10], eax
lea eax, [esp + 8]
push eax
mov dword [esp + 0x10], 3
mov word [esp + 0x1c], 0x414
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
cmp dword [esp + 0x1a], 0
jne 0x40bb7b
test eax, eax
je 0x40bc0c
cmp eax, 2
je 0x40bc0c
cmp eax, 0x402
je 0x40bc0c
xor eax, eax
jmp 0x40bc0f
xor eax, eax
inc eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40ec4b
Capabilities:
Terminate process

Disassembly:
push ebx
lea ebx, [esi + 4]
cmp dword [ebx], 0
jne 0x40ec5f
push ebx
call fcn.00417a79
test eax, eax
pop ecx
jne 0x40eca1
push edi
lea edi, [esi + 8]
cmp dword [edi], 0
jne 0x40ec73
push edi
call fcn.00417a79
test eax, eax
pop ecx
jne 0x40eca0
mov eax, ebx
call fcn.00417a5e
mov eax, edi
call fcn.00417a5e
lea eax, [esi + 0xc]
cmp dword [eax], 0
mov byte [esi + 0x10], 0
je 0x40ec91
xor eax, eax
jmp 0x40eca0
push esi
push 0x40ec21
push eax
call fcn.004179dc
add esp, 0xc
pop edi
pop ebx
ret

Function at 0x40f088
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4abbe3
call fcn.004ab348
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [edi], eax
mov dword [ebp - 4], eax
mov dword [edi + 4], eax
mov dword [edi + 8], ecx
mov ecx, dword [ebp + 0xc]
mov dword [edi + 0xc], ecx
lea esi, [edi + 0x10]
push 8
pop edx
mov ecx, vtable.CRecordVector_unsigned_long_long_unsigned___int64__.0
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], edx
mov dword [esi], ecx
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], eax
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], edx
mov dword [edi + 0x24], ecx
push 4
pop edx
mov ecx, vtable.CRecordVector_unsigned_long_long_unsigned___int64__const__.0
mov dword [edi + 0x3c], eax
mov dword [edi + 0x40], eax
mov dword [edi + 0x44], eax
mov dword [edi + 0x48], edx
mov dword [edi + 0x38], ecx
mov dword [edi + 0x50], eax
mov dword [edi + 0x54], eax
mov dword [edi + 0x58], eax
mov dword [edi + 0x5c], edx
mov dword [edi + 0x4c], ecx
mov byte [ebp - 4], 5
mov ebx, dword [edi + 8]
call fcn.00417c0c
mov ebx, dword [edi + 8]
lea esi, [edi + 0x38]
call fcn.00417c0c
mov ebx, dword [edi + 0xc]
lea esi, [edi + 0x24]
call fcn.00417c0c
mov ebx, dword [edi + 0xc]
lea esi, [edi + 0x4c]
call fcn.00417c0c
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x412c39
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
cmp dword [esi], 0
je 0x412c45
xor eax, eax
pop ebp
ret
lea eax, [esi + 0x30]
push eax
call fcn.00417ad4
test eax, eax
pop ecx
je 0x412c58
push 0xc
pop eax
pop ebp
ret
push edi
xor edi, edi
lea eax, [esi + 0x14]
inc edi
push eax
mov dword [esi + 0x28], edi
call fcn.00417a79
test eax, eax
pop ecx
jne 0x412ccc
lea eax, [esi + 0x18]
push eax
call fcn.00417a79
test eax, eax
pop ecx
jne 0x412ccc
lea eax, [esi + 0x1c]
push eax
call fcn.00417a79
test eax, eax
pop ecx
jne 0x412ccc
push dword [ebp + 0x10]
lea eax, [esi + 0x20]
push dword [ebp + 0x10]
push eax
call fcn.00417a8a
add esp, 0xc
test eax, eax
jne 0x412ccc
push dword [ebp + 0x10]
push eax
lea eax, [esi + 0x24]
push eax
call fcn.00417a8a
add esp, 0xc
test eax, eax
jne 0x412ccc
push dword [ebp + 0xc]
lea eax, [esi + 0x10]
push dword [ebp + 8]
mov dword [esi + 4], edi
push eax
call fcn.004179dc
add esp, 0xc
test eax, eax
je 0x412cd1
push 0xc
pop eax
jmp 0x412cd5
mov dword [esi], edi
xor eax, eax
pop edi
pop ebp
ret
Function at 0x415332
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, eax
mov eax, pe_nt_image_headers32
push edi
mov ebx, eax
or esi, eax
shl dword [ebp + 0x10], 1
mov eax, esi
shr eax, 7
and eax, 1
push eax
mov eax, ebx
and eax, dword [ebp + 0x10]
mov ecx, esi
add eax, ebx
shr ecx, 8
add ecx, eax
mov eax, dword [ebp + 0xc]
lea edi, [eax + ecx*2]
mov eax, dword [ebp + 8]
call fcn.004152ac
add esi, esi
mov eax, esi
xor eax, dword [ebp + 0x10]
pop ecx
not eax
and ebx, eax
cmp esi, 0x10000
jb 0x415343
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x415384
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
or ecx, 0x100
push esi
mov esi, dword [esp + 8]
mov edx, ecx
shr edx, 8
movzx edx, word [esi + edx*2]
mov esi, ecx
shr esi, 7
and esi, 1
neg esi
sar esi, 4
and esi, 0x7f
shr edx, 4
xor edx, esi
mov esi, dword [esp + 0xc]
add eax, dword [esi + edx*4]
add ecx, ecx
cmp ecx, 0x10000
jb 0x41538d
pop esi
ret

Function at 0x4153c2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, pe_nt_image_headers32
push esi
xor eax, eax
or edx, ecx
push edi
shl dword [ebp + 0xc], 1
mov esi, ecx
and esi, dword [ebp + 0xc]
mov edi, edx
add esi, ecx
shr edi, 8
add edi, esi
mov esi, dword [ebp + 8]
movzx esi, word [esi + edi*2]
mov edi, edx
shr edi, 7
and edi, 1
neg edi
shr esi, 4
sar edi, 4
and edi, 0x7f
xor esi, edi
mov edi, dword [ebp + 0x10]
add eax, dword [edi + esi*4]
add edx, edx
mov esi, edx
xor esi, dword [ebp + 0xc]
not esi
and ecx, esi
cmp edx, 0x10000
jb 0x4153d0
pop edi
pop esi
pop ebp
ret

Function at 0x4154c8
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
push esi
mov esi, eax
xor eax, eax
inc edx
test esi, esi
je 0x415508
push ebx
push edi
mov ecx, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
movzx edi, word [edi + edx*2]
shr dword [esp + 0x14], 1
and ecx, 1
mov ebx, ecx
neg ebx
sar ebx, 4
and ebx, 0x7f
shr edi, 4
xor edi, ebx
mov ebx, dword [esp + 0x18]
add eax, dword [ebx + edi*4]
add edx, edx
or edx, ecx
dec esi
jne 0x4154d6
pop edi
pop ebx
pop esi
ret
Function at 0x416e50
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
xor edx, edx
lea ecx, [esi + 0x19c]
mov dword [esi + 0x3bcd4], edx
mov dword [esi + 0x3bcd0], edx
push ebx
mov dword [ecx + 0x30], edx
mov dword [ecx + 0x4c], edx
mov dword [ecx + 0x20], edx
mov dword [ecx + 0x2c], 0x20
mov dword [ecx + 0x54], 1
mov dword [ecx + 0x48], 4
mov dword [ecx + 0x58], edx
mov dword [ebp - 4], edx
lea eax, [ecx + 0x70]
push edi
mov edi, dword [ebp - 4]
mov dword [ebp - 8], 8
mov ebx, edi
and ebx, 1
dec ebx
not ebx
and ebx, 0xedb88320
shr edi, 1
xor edi, ebx
dec dword [ebp - 8]
jne 0x416e9d
inc dword [ebp - 4]
mov dword [eax], edi
add eax, 4
cmp dword [ebp - 4], 0x100
jb 0x416e93
mov dword [esi + 0x118], edx
lea eax, [esi + 0x148]
mov dword [eax], edx
mov dword [eax + 0x28], edx
mov dword [eax + 0x2c], edx
mov dword [eax + 0x10], edx
mov dword [eax + 0x14], edx
mov dword [eax + 0x18], edx
mov dword [eax + 0x1c], edx
mov dword [eax + 0x20], edx
mov dword [eax + 0x24], edx
mov dword [esi + 0x4c], edx
mov dword [esi + 0x74], edx
mov dword [esi + 0x78], edx
mov dword [esi + 0x5c], edx
mov dword [esi + 0x60], edx
mov dword [esi + 0x64], edx
mov dword [esi + 0x68], edx
mov dword [esi + 0x6c], edx
mov dword [esi + 0x70], edx
lea eax, [ebp - 0x38]
mov dword [esi + 0x198], ecx
call fcn.00414fa2
mov ebx, esi
call fcn.004150a5
push 2
pop edi
mov byte [esi + 0x306a0], 0
mov byte [esi + 0x306a1], 1
mov dword [ebp - 4], edi
mov ecx, dword [ebp - 4]
xor ebx, ebx
sar ecx, 1
dec ecx
inc ebx
shl ebx, cl
test ebx, ebx
jbe 0x416f54
push ebx
push dword [ebp - 4]
lea eax, [edi + esi + 0x306a0]
push eax
call fcn.0048e7e0
add esp, 0xc
add edi, ebx
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x16
jl 0x416f2f
push 8
pop edi
mov edx, 0x10000
push 4
mov eax, edi
xor ecx, ecx
pop ebx
imul eax, eax
add ecx, ecx
jmp 0x416f76
shr eax, 1
inc ecx
cmp eax, edx
jae 0x416f73
dec ebx
jne 0x416f6c
mov eax, 0xa1
sub eax, ecx
mov ecx, edi
shr ecx, 4
add edi, 0x10
cmp edi, 0x800
mov dword [esi + ecx*4 + 0x30ea0], eax
jb 0x416f65
and dword [esi + 0x325ac], ebx
and dword [esi + 0x3bd14], ebx
pop edi
pop ebx
leave
ret

Function at 0x4179dc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push 0
call fcn.0049193f
mov ecx, dword [ebp + 8]
add esp, 0x18
test eax, eax
mov dword [ecx], eax
je 0x417a05
xor eax, eax
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x417a10
inc eax
leave
ret
Function at 0x41b05b
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x4ac0c2
call fcn.004ab348
xor eax, eax
push esi
mov esi, dword [ebp + 8]
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 4
mov dword [esi], vtable.CObjectVector_struct_NArchive::N7z::CMethodFull_.0
mov dword [ebp - 4], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], 0x10
mov dword [esi + 0x14], vtable.CRecordVector_struct_NArchive::N7z::CBind_.0
mov byte [ebp - 4], 1
mov byte [esi + 0x2c], al
lea eax, [esi + 0x30]
mov dword [esi + 0x28], 1
call fcn.0040d049
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x423c2b
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4acc6a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x258]
push dword [esi + 8]
mov eax, dword [esi]
xor ebx, ebx
push ebx
mov ecx, esi
call dword [eax + 4]
lea eax, [esp + 0xc]
add edi, 0x1c8
push eax
call fcn.0040fefe
push 0xe
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], ebx
call fcn.00423ba7
pop ecx
push 0xf
lea ecx, [esp + 0x10]
call fcn.00423ba7
pop ecx
push 0x11
push esi
lea edi, [esp + 0x14]
call fcn.00423b63
push 0x10
push esi
call fcn.00423b63
push 9
push esi
call fcn.00423b63
push 6
push esi
call fcn.00423b63
push 0x12
push esi
call fcn.00423b63
push 0x14
push esi
call fcn.00423b63
push 0x13
push esi
call fcn.00423b63
push 0x15
push esi
call fcn.00423b63
add esp, 0x40
push 0xa
push esi
call fcn.00423b63
push 0x16
push esi
call fcn.00423b63
add esp, 0x10
mov eax, esi
call fcn.00410195
push ebx
push 0x61
call fcn.0040f13e
push ebx
push 0x62
call fcn.0040f13e
push ebx
push 0x63
call fcn.0040f13e
push 0x14
mov eax, esi
call fcn.00423bdd
pop ecx
push 6
mov eax, esi
call fcn.00423bdd
pop ecx
push 9
mov eax, esi
call fcn.00423bdd
pop ecx
push 0x11
mov eax, esi
call fcn.00423bdd
or dword [esp + 0x30], 0xffffffff
pop ecx
mov ecx, edi
call fcn.00417bac
mov ecx, dword [esp + 0x24]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4277b4
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4ae046
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
mov eax, dword [0x4de22c]
push ebx
push esi
push edi
mov ecx, 0x4de22c
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x10], eax
mov edi, dword [ebp + 8]
push dword [ebp + 0xc]
and dword [esp + 0x50], 0
lea ebx, [edi + 8]
push ebx
mov dword [esp + 0x2c], ebx
call fcn.00406003
mov esi, ebx
call fcn.004285e7
push dword [ebx]
call fcn.00406390
mov eax, dword [edi + 0x20]
mov eax, dword [eax]
add edi, 0x1c
pop ecx
mov dword [esp + 0x18], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], eax
cmp dword [esp + 0x30], 0
mov esi, dword [edi + 4]
je 0x427834
cmp dword [esp + 0x30], edi
je 0x427839
call fcn.0048e16e
cmp dword [esp + 0x34], esi
je 0x427930
lea esi, [esp + 0x30]
call fcn.00428c48
mov dword [esp + 0x14], eax
call fcn.00428c48
mov esi, eax
push 0x4bcd44
push dword [esp + 0x18]
add esi, 4
mov dword [esp + 0x28], esi
call fcn.0040571a
test eax, eax
je 0x4278af
push dword [esp + 0x14]
lea eax, [esp + 0x20]
push eax
mov ecx, ebx
call fcn.00406621
pop ecx
pop ecx
lea edi, [esp + 0x10]
mov byte [esp + 0x4c], 1
call fcn.00405107
mov byte [esp + 0x4c], 0
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
call fcn.00405b78
push dword [esp + 0x10]
call fcn.00406390
mov edi, dword [esp + 0x1c]
pop ecx
mov eax, dword [esi + 4]
mov eax, dword [eax]
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x28], 0
mov eax, dword [esi + 4]
mov dword [esp + 0x3c], eax
je 0x4278d0
cmp dword [esp + 0x28], esi
je 0x4278d5
call fcn.0048e16e
mov eax, dword [esp + 0x3c]
cmp dword [esp + 0x2c], eax
je 0x427922
cmp dword [esp + 0x28], 0
jne 0x4278eb
call fcn.0048e16e
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
cmp eax, dword [ecx + 4]
jne 0x4278fd
call fcn.0048e16e
mov eax, dword [esp + 0x2c]
push dword [ebx]
mov ebx, dword [eax + 8]
call fcn.004280b4
lea esi, [esp + 0x28]
call fcn.0042ae5c
mov esi, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
mov edi, dword [esp + 0x18]
jmp 0x4278bc
lea esi, [esp + 0x30]
call fcn.00407c78
jmp 0x427824
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
call fcn.00405b78
mov ecx, dword [esp + 0x44]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x427cb2
Capabilities:
Copy file

Disassembly:
mov eax, 0x4ae02c
call fcn.004ab348
mov eax, dword [ebx + 0x14]
sub esp, 0x14
cmp eax, 0xffffffff
push esi
push edi
je 0x427e08
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebx + 0xc]
push eax
lea eax, [ebp - 0x18]
lea ecx, [ebx + 8]
push eax
call fcn.00406621
pop ecx
pop ecx
and dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00428675
test eax, eax
je 0x427dfd
mov eax, dword [0x4de22c]
mov esi, 0x4de22c
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 1
mov eax, dword [0x4de22c]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
lea edi, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.00428719
lea edi, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.00405107
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.00405b78
push dword [ebp - 0x18]
lea eax, [ebp - 0x1c]
push eax
call fcn.004287b1
pop ecx
pop ecx
lea edi, [ebp - 0x10]
mov byte [ebp - 4], 4
call fcn.00405107
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.00405b78
mov eax, edi
push eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x14]
call fcn.00406621
mov eax, dword [eax]
pop ecx
pop ecx
push 0
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov esi, eax
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.00405b78
test esi, esi
mov edi, dword [ebp - 0x10]
je 0x427dea
push ecx
lea eax, [edi - 0x10]
mov dword [ebp - 0x20], esp
mov esi, esp
call fcn.00405b90
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 5
call fcn.00406621
pop ecx
pop ecx
mov byte [ebp - 4], 6
push eax
mov byte [ebp - 4], 7
call fcn.0042880a
mov eax, dword [ebp - 0x1c]
pop ecx
pop ecx
add eax, 0xfffffff0
call fcn.00405b78
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00405b78
lea eax, [edi - 0x10]
call fcn.00405b78
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.00405b78
mov ecx, dword [ebp - 0xc]
or dword [ebx + 0x14], 0xffffffff
pop edi
mov dword fs:[0], ecx
pop esi
leave
ret
Function at 0x428324
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
xor edi, edi
push edi
push 0x80
push 2
push edi
push 1
push 0xc0000000
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [ebp - 0x10], ebx
jne 0x428360
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x42845d
mov esi, dword [ebp + 8]
push edi
push dword [esi + 4]
push edi
push 4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
cmp ebx, edi
mov dword [ebp - 8], eax
je 0x42838e
push dword [esi + 4]
push edi
push edi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, edi
mov dword [ebp - 0xc], eax
jne 0x428399
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x428429
lea ebx, [esi + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x18], edi
mov eax, dword [ebx + 4]
mov dword [ebp - 0x1c], eax
je 0x4283ba
cmp dword [ebp - 0x18], ebx
je 0x4283bf
call fcn.0048e16e
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x14], eax
je 0x428419
lea esi, [ebp - 0x18]
call fcn.00428c68
mov esi, dword [eax]
mov ecx, dword [esi + 4]
cmp ecx, edi
jne 0x4283dc
xor eax, eax
jmp 0x4283e1
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edi
call fcn.0040bdda
push eax
push dword [ebp - 4]
call fcn.00490060
mov eax, dword [esi + 4]
add esp, 0xc
cmp eax, edi
jne 0x4283ff
xor esi, esi
jmp 0x428404
mov esi, dword [esi + 8]
sub esi, eax
add dword [ebp - 4], esi
lea edi, [ebp - 0x28]
lea esi, [ebp - 0x18]
call fcn.00428c88
mov esi, dword [ebp + 8]
xor edi, edi
jmp 0x4283aa
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebp - 4], 1
cmp dword [ebp - 8], edi
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x428439
push dword [ebp - 8]
call ebx
push dword [ebp - 0x10]
call ebx
cmp dword [ebp - 4], edi
je 0x42845d
push dword [ebp + 0xc]
mov eax, esi
call fcn.00428467
cmp eax, edi
mov dword [ebp - 4], eax
jne 0x42845d
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x428467
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
push dword [ebp + 8]
mov esi, eax
mov dword [ebp - 0x10], edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [ebp - 0x14], ebx
jne 0x4284a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x42858b
push edi
push dword [esi + 4]
push edi
push 2
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
cmp ebx, edi
mov dword [ebp - 0xc], eax
jne 0x4284c6
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x428576
push dword [esi + 4]
push edi
push edi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, edi
mov dword [ebp - 8], eax
jne 0x4284e6
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x428568
lea ebx, [esi + 8]
mov dword [ebp + 8], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x1c], edi
mov esi, dword [ebx + 4]
je 0x428504
cmp dword [ebp - 0x1c], ebx
je 0x428509
call fcn.0048e16e
cmp dword [ebp - 0x18], esi
je 0x428561
lea esi, [ebp - 0x1c]
call fcn.00428c68
mov esi, dword [eax]
mov ecx, dword [esi + 4]
cmp ecx, edi
jne 0x428523
xor eax, eax
jmp 0x428528
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edi
call fcn.0040bdda
push eax
push dword [ebp + 8]
call fcn.0048bf94
add esp, 0xc
test eax, eax
jne 0x428568
mov eax, dword [esi + 4]
cmp eax, edi
jne 0x42854a
xor esi, esi
jmp 0x42854f
mov esi, dword [esi + 8]
sub esi, eax
add dword [ebp + 8], esi
lea edi, [ebp - 0x24]
lea esi, [ebp - 0x1c]
call fcn.00428c88
xor edi, edi
jmp 0x4284f7
mov dword [ebp - 0x10], 1
cmp dword [ebp - 8], edi
je 0x428576
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp dword [ebp - 0xc], edi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x428586
push dword [ebp - 0xc]
call esi
push dword [ebp - 0x14]
call esi
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x428624
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 0xc], 0
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, ecx
push 0
lea ecx, [ebp - 4]
push ecx
mov dword [ebp - 8], eax
push eax
jmp 0x42865b
mov eax, dword [ebp - 4]
add ebx, eax
sub dword [ebp - 8], eax
je 0x428667
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push ebx
push dword [ebp + 8]
call esi
test eax, eax
jne 0x428648
jmp 0x42866e
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
pop esi
pop ebx
leave
ret