joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415c80
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x43e00b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x98
lea ecx, [esp]
call fcn.00428870
lea ecx, [esp]
mov dword [esp + 0xa0], 0
call fcn.004288c0
test al, al
je 0x415cd9
mov eax, dword [esp + 0xac]
mov ecx, dword [esp + 0xa8]
push eax
call fcn.00418c80
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x415cf4
mov ecx, dword [esp + 0xac]
push ecx
mov ecx, dword [esp + 0xac]
call fcn.00418920
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
push ebx
lea ecx, [esp + 4]
setne bl
mov dword [esp + 0xa4], 0xffffffff
call fcn.004288b0
mov ecx, dword [esp + 0x9c]
mov al, bl
pop ebx
mov dword fs:[0], ecx
add esp, 0xa4
ret

Function at 0x415d30
Capabilities:
Set current directory

Disassembly:
push 0xffffffffffffffff
push 0x43e02b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x98
lea ecx, [esp]
call fcn.00428870
lea ecx, [esp]
mov dword [esp + 0xa0], 0
call fcn.004288c0
mov ecx, dword [esp + 0xa8]
test al, al
je 0x415d81
call fcn.00418c80
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
jmp 0x415d8d
call fcn.00418920
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
push ebx
lea ecx, [esp + 4]
setne bl
mov dword [esp + 0xa4], 0xffffffff
call fcn.004288b0
mov ecx, dword [esp + 0x9c]
mov al, bl
pop ebx
mov dword fs:[0], ecx
add esp, 0xa4
ret

Function at 0x415dc0
Capabilities:
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x43e04b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x98
lea ecx, [esp]
call fcn.00428870
lea ecx, [esp]
mov dword [esp + 0xa0], 0
call fcn.004288c0
test al, al
je 0x415e19
mov eax, dword [esp + 0xac]
mov ecx, dword [esp + 0xa8]
push eax
call fcn.00418c80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x415e34
mov ecx, dword [esp + 0xac]
push ecx
mov ecx, dword [esp + 0xac]
call fcn.00418920
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
push ebx
lea ecx, [esp + 4]
setne bl
mov dword [esp + 0xa4], 0xffffffff
call fcn.004288b0
mov ecx, dword [esp + 0x9c]
mov al, bl
pop ebx
mov dword fs:[0], ecx
add esp, 0xa4
ret
Function at 0x415eb0
Capabilities:
Get file size

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x43e073
push eax
mov eax, dword [esp + 0x18]
mov dword fs:[0], esp
sub esp, 0x78
mov byte [eax], 0
push ebx
mov ebx, dword [esp + 0x8c]
push ebp
push esi
test ebx, ebx
push edi
jne 0x415ee5
xor eax, eax
jmp 0x415ff9
cmp byte [ebx], 0
jne 0x415ef1
xor eax, eax
jmp 0x415ff9
lea ecx, [esp + 0x2c]
call fcn.004185e0
push ebx
lea ecx, [esp + 0x30]
mov dword [esp + 0x94], 0
call fcn.004187f0
mov esi, dword [esp + 0x9c]
lea ecx, [esp + 0x2c]
push esi
push ecx
call fcn.00415a60
mov edi, eax
add esp, 8
cmp edi, 0xffffffff
jne 0x415f42
lea ecx, [esp + 0x2c]
mov dword [esp + 0x90], eax
call fcn.004186a0
xor eax, eax
jmp 0x415ff9
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x415fce
test esi, esi
je 0x415fab
lea ecx, [esp + 0x10]
call fcn.004144c0
lea ecx, [esp + 0x10]
mov byte [esp + 0x90], 1
call fcn.00414ac0
mov ebp, dword [esi]
lea ecx, [esp + 0x10]
call fcn.004065f0
push eax
mov ecx, esi
call dword [ebp + 0x10]
mov edx, dword [esi]
push ebx
push str.filename
mov ecx, esi
call dword [edx + 0x28]
mov eax, dword [esi]
push str.Failed_to_get_file_size
mov ecx, esi
call dword [eax + 0x10]
lea ecx, [esp + 0x10]
mov byte [esp + 0x90], 0
call fcn.00414650
push 0
push edi
call fcn.00424e00
add esp, 8
lea ecx, [esp + 0x2c]
mov dword [esp + 0x90], 0xffffffff
call fcn.004186a0
xor eax, eax
jmp 0x415ff9
push 0
push edi
call fcn.00424e00
mov ecx, dword [esp + 0xa8]
add esp, 8
mov dword [esp + 0x90], 0xffffffff
mov byte [ecx], 1
lea ecx, [esp + 0x2c]
call fcn.004186a0
mov eax, ebp
mov ecx, dword [esp + 0x88]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x84
ret
Function at 0x416020
Capabilities:
Get file size

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x43e093
push eax
mov eax, dword [esp + 0x18]
mov dword fs:[0], esp
sub esp, 0x78
mov byte [eax], 0
push ebx
mov ebx, dword [esp + 0x8c]
push ebp
push esi
test ebx, ebx
push edi
jne 0x416055
xor eax, eax
jmp 0x41616a
cmp word [ebx], 0
jne 0x416062
xor eax, eax
jmp 0x41616a
lea ecx, [esp + 0x2c]
call fcn.004185e0
push ebx
lea ecx, [esp + 0x30]
mov dword [esp + 0x94], 0
call fcn.004188b0
mov esi, dword [esp + 0x9c]
lea ecx, [esp + 0x2c]
push esi
push ecx
call fcn.00415a60
mov edi, eax
add esp, 8
cmp edi, 0xffffffff
jne 0x4160b3
lea ecx, [esp + 0x2c]
mov dword [esp + 0x90], eax
call fcn.004186a0
xor eax, eax
jmp 0x41616a
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x41613f
test esi, esi
je 0x41611c
lea ecx, [esp + 0x10]
call fcn.004144c0
lea ecx, [esp + 0x10]
mov byte [esp + 0x90], 1
call fcn.00414ac0
mov ebp, dword [esi]
lea ecx, [esp + 0x10]
call fcn.004065f0
push eax
mov ecx, esi
call dword [ebp + 0x10]
mov edx, dword [esi]
push ebx
push str.filename
mov ecx, esi
call dword [edx + 0x28]
mov eax, dword [esi]
push str.Failed_to_get_file_size
mov ecx, esi
call dword [eax + 0x10]
lea ecx, [esp + 0x10]
mov byte [esp + 0x90], 0
call fcn.00414650
push 0
push edi
call fcn.00424e00
add esp, 8
lea ecx, [esp + 0x2c]
mov dword [esp + 0x90], 0xffffffff
call fcn.004186a0
xor eax, eax
jmp 0x41616a
push 0
push edi
call fcn.00424e00
mov ecx, dword [esp + 0xa8]
add esp, 8
mov dword [esp + 0x90], 0xffffffff
mov byte [ecx], 1
lea ecx, [esp + 0x2c]
call fcn.004186a0
mov eax, ebp
mov ecx, dword [esp + 0x88]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x84
ret
Function at 0x416630
Capabilities:
Access peb ldr_data
Delete file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x43e158
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
push edi
mov edi, dword [esp + 0x34]
test edi, edi
je 0x416741
cmp byte [edi], 0
je 0x416741
mov esi, dword [esp + 0x38]
push esi
push edi
call fcn.004162b0
add esp, 8
test al, al
jne 0x4166a5
test esi, esi
je 0x416753
mov eax, dword [esi]
push edi
push str.delete_filename
mov ecx, esi
call dword [eax + 0x28]
mov edx, dword [esi]
push str.Cannot_delete_file__file_does_not_exist
mov ecx, esi
call dword [edx + 0x14]
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x41672e
test esi, esi
je 0x416753
lea ecx, [esp + 8]
call fcn.004144c0
push str.DeleteFile:
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0
call fcn.00414190
lea ecx, [esp + 8]
call fcn.00414ac0
mov eax, dword [esi]
push str.Cannot_delete_file
mov ecx, esi
call dword [eax + 0x14]
mov edx, dword [esi]
push edi
push str.delete_filename
mov ecx, esi
call dword [edx + 0x28]
mov edi, dword [esi]
lea ecx, [esp + 8]
call fcn.004065f0
push eax
mov ecx, esi
call dword [edi + 0x14]
lea ecx, [esp + 8]
mov dword [esp + 0x2c], 0xffffffff
call fcn.00414650
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret
mov ecx, dword [esp + 0x38]
test ecx, ecx
je 0x416753
mov eax, dword [ecx]
push str.Cannot_delete_file__filename_is_null_or_empty
call dword [eax + 0x10]
mov ecx, dword [esp + 0x24]
pop edi
xor al, al
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x416c90
Capabilities:
Write file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x43e243
push eax
mov dword fs:[0], esp
sub esp, 0x7c
push ebx
mov ebx, dword [esp + 0x90]
push ebp
push esi
test ebx, ebx
push edi
jne 0x416cbe
xor al, al
jmp 0x416e15
cmp byte [ebx], 0
jne 0x416cca
xor al, al
jmp 0x416e15
lea ecx, [esp + 0x30]
call fcn.004185e0
push ebx
lea ecx, [esp + 0x34]
mov dword [esp + 0x98], 0
call fcn.004187f0
mov esi, dword [esp + 0xa8]
lea eax, [esp + 0x30]
push esi
push eax
call fcn.00415860
mov edi, eax
add esp, 8
cmp edi, 0xffffffff
jne 0x416d3c
test esi, esi
je 0x416d21
mov edx, dword [esi]
push ebx
push str.filename
mov ecx, esi
call dword [edx + 0x28]
mov eax, dword [esi]
push str.Failed_to_write_complete_file__7_
mov ecx, esi
call dword [eax + 0x10]
lea ecx, [esp + 0x30]
mov dword [esp + 0x94], 0xffffffff
call fcn.004186a0
xor al, al
jmp 0x416e15
mov eax, dword [esp + 0xa0]
test eax, eax
je 0x416df4
mov ebp, dword [esp + 0xa4]
test ebp, ebp
je 0x416df4
lea ecx, [esp + 0x10]
push 0
push ecx
push ebp
push eax
push edi
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [esp + 0x10], ebp
je 0x416df4
test esi, esi
je 0x416dd1
lea ecx, [esp + 0x14]
call fcn.004144c0
lea ecx, [esp + 0x14]
mov byte [esp + 0x94], 1
call fcn.00414ac0
mov edx, dword [esi]
push ebx
push str.filename
mov ecx, esi
call dword [edx + 0x28]
mov ebx, dword [esi]
lea ecx, [esp + 0x14]
call fcn.004065f0
push eax
mov ecx, esi
call dword [ebx + 0x10]
mov eax, dword [esi]
push str.Failed_to_write_complete_file__1_
mov ecx, esi
call dword [eax + 0x10]
lea ecx, [esp + 0x14]
mov byte [esp + 0x94], 0
call fcn.00414650
push 0
push edi
call fcn.00424e00
add esp, 8
lea ecx, [esp + 0x30]
mov dword [esp + 0x94], 0xffffffff
call fcn.004186a0
xor al, al
jmp 0x416e15
push 0
push edi
call fcn.00424e00
add esp, 8
lea ecx, [esp + 0x30]
mov dword [esp + 0x94], 0xffffffff
call fcn.004186a0
mov al, 1
mov ecx, dword [esp + 0x8c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x88
ret
Function at 0x416e30
Capabilities:
Write file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x43e26e
push eax
mov dword fs:[0], esp
sub esp, 0xd8
push ebx
push ebp
mov ebp, dword [esp + 0xf0]
xor ebx, ebx
push esi
cmp ebp, ebx
push edi
jne 0x416e63
xor al, al
jmp 0x416fd5
lea ecx, [esp + 0x30]
call fcn.004185e0
push ebp
lea ecx, [esp + 0x34]
mov dword [esp + 0xf4], ebx
call fcn.004188b0
mov esi, dword [esp + 0x104]
lea eax, [esp + 0x30]
push esi
push eax
call fcn.00415860
mov edi, eax
add esp, 8
cmp edi, 0xffffffff
jne 0x416f11
cmp esi, ebx
je 0x416ef6
lea ecx, [esp + 0x8c]
call fcn.004185e0
push ebp
lea ecx, [esp + 0x90]
mov byte [esp + 0xf4], 1
call fcn.004188b0
mov edi, dword [esi]
lea ecx, [esp + 0x8c]
call fcn.00418e90
push eax
push str.utf8Filename
mov ecx, esi
call dword [edi + 0x28]
mov edx, dword [esi]
push str.Failed_to_write_complete_file__6_
mov ecx, esi
call dword [edx + 0x10]
lea ecx, [esp + 0x8c]
mov byte [esp + 0xf0], bl
call fcn.004186a0
lea ecx, [esp + 0x30]
mov dword [esp + 0xf0], 0xffffffff
call fcn.004186a0
xor al, al
jmp 0x416fd5
mov eax, dword [esp + 0xfc]
cmp eax, ebx
je 0x416fb5
mov ebp, dword [esp + 0x100]
cmp ebp, ebx
je 0x416fb5
lea ecx, [esp + 0x10]
push ebx
push ecx
push ebp
push eax
push edi
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [esp + 0x10], ebp
je 0x416fb5
cmp esi, ebx
je 0x416f93
lea ecx, [esp + 0x14]
call fcn.004144c0
lea ecx, [esp + 0x14]
mov byte [esp + 0xf0], 2
call fcn.00414ac0
mov ebp, dword [esi]
lea ecx, [esp + 0x14]
call fcn.004065f0
push eax
mov ecx, esi
call dword [ebp + 0x10]
mov edx, dword [esi]
push str.Failed_to_write_complete_file__3_
mov ecx, esi
call dword [edx + 0x10]
lea ecx, [esp + 0x14]
mov byte [esp + 0xf0], bl
call fcn.00414650
push ebx
push edi
call fcn.00424e00
add esp, 8
lea ecx, [esp + 0x30]
mov dword [esp + 0xf0], 0xffffffff
call fcn.004186a0
xor al, al
jmp 0x416fd5
push ebx
push edi
call fcn.00424e00
add esp, 8
lea ecx, [esp + 0x30]
mov dword [esp + 0xf0], 0xffffffff
call fcn.004186a0
mov al, 1
mov ecx, dword [esp + 0xe8]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xe4
ret
Function at 0x417410
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x43e2de
push eax
mov dword fs:[0], esp
sub esp, 0x80
push ebx
push ebp
push esi
mov esi, ecx
push edi
cmp byte [esi + 4], 0xdb
je 0x417444
xor ebp, ebp
push ebp
call fcn.00413f40
add esp, 4
jmp 0x417446
xor ebp, ebp
mov eax, dword [esi + 8]
cmp eax, ebp
je 0x417460
mov cl, byte [esi + 5]
test cl, cl
jne 0x41745d
push eax
call fcn.004342a8
add esp, 4
mov dword [esi + 8], ebp
lea ecx, [esp + 0x34]
mov dword [esi + 0xc], ebp
mov dword [esi + 0x10], ebp
mov byte [esi + 5], 0
call fcn.004185e0
mov eax, dword [esp + 0xa0]
lea ecx, [esp + 0x34]
push eax
mov dword [esp + 0x9c], ebp
call fcn.004188b0
mov edi, dword [esp + 0xa4]
lea ecx, [esp + 0x34]
push edi
push ecx
call fcn.00415a60
mov ebx, eax
add esp, 8
cmp ebx, 0xffffffff
jne 0x4174be
lea ecx, [esp + 0x34]
mov dword [esp + 0x98], eax
call fcn.004186a0
xor al, al
jmp 0x417635
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x417533
test edi, edi
je 0x41750d
lea ecx, [esp + 0x18]
call fcn.004144c0
lea ecx, [esp + 0x18]
mov byte [esp + 0x98], 1
call fcn.00414ac0
mov esi, dword [edi]
lea ecx, [esp + 0x18]
call fcn.004065f0
push eax
mov ecx, edi
call dword [esi + 0x10]
lea ecx, [esp + 0x18]
mov byte [esp + 0x98], 0
call fcn.00414650
push 0
push ebx
call fcn.00424e00
add esp, 8
lea ecx, [esp + 0x34]
mov dword [esp + 0x98], 0xffffffff
call fcn.004186a0
xor al, al
jmp 0x417635
test ebp, ebp
jne 0x41755c
push ebp
push ebx
call fcn.00424e00
add esp, 8
lea ecx, [esp + 0x34]
mov dword [esp + 0x98], 0xffffffff
call fcn.004186a0
mov al, 1
jmp 0x417635
lea edi, [ebp + 4]
push edi
call fcn.00434d24
mov edx, eax
mov ecx, edi
mov dword [esi + 8], edx
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
add esp, 4
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esi + 8]
lea eax, [esp + 0x14]
push 0
push eax
push ebp
push ecx
push ebx
mov dword [esi + 0xc], ebp
mov dword [esi + 0x10], ebp
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, dword [esp + 0xa4]
mov byte [esp + 0x13], 1
test eax, eax
jne 0x4175f7
test esi, esi
je 0x4175f2
lea ecx, [esp + 0x18]
call fcn.004144c0
lea ecx, [esp + 0x18]
mov byte [esp + 0x98], 2
call fcn.00414ac0
mov edi, dword [esi]
lea ecx, [esp + 0x18]
call fcn.004065f0
push eax
mov ecx, esi
call dword [edi + 0x10]
lea ecx, [esp + 0x18]
mov byte [esp + 0x98], 0
call fcn.00414650
mov byte [esp + 0x13], 0
cmp dword [esp + 0x14], ebp
je 0x417612
test esi, esi
je 0x41760d
mov edx, dword [esi]
push str.Failed_to_read_the_entire_file
mov ecx, esi
call dword [edx + 0x10]
mov byte [esp + 0x13], 0
push 0
push ebx
call fcn.00424e00
add esp, 8
lea ecx, [esp + 0x34]
mov dword [esp + 0x98], 0xffffffff
call fcn.004186a0
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x90]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x8c
ret 8
Function at 0x424050
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
mov esi, ecx
mov byte [edi], 0
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
push eax
push ecx
mov ecx, esi
mov byte [esi + 0x2c], 0
call fcn.00423fe0
mov edx, dword [esp + 0x14]
mov ebx, dword [esi + 8]
add ebx, edx
mov ebp, eax
mov eax, dword [esi + 4]
mov ecx, ebx
cmp ecx, eax
mov dword [esi + 8], ebx
jbe 0x42408a
mov dword [esi + 8], eax
push eax
mov eax, dword [esi + 8]
push eax
mov ecx, esi
call fcn.00423fe0
mov ebx, eax
mov eax, dword [esi + 0xc]
test eax, eax
je 0x4240f4
cmp ebx, ebp
jbe 0x4240c6
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0xc]
mov dword [esi + 0x30], eax
push edi
push ebx
mov edx, dword [ecx]
call dword [edx + 4]
cmp byte [edi], 0
je 0x4240f4
mov byte [esi + 0x2c], 1
pop edi
pop esi
pop ebp
pop ebx
ret 8
test eax, eax
je 0x4240f4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [esi + 0x30]
mov ecx, eax
sub ecx, ebx
cmp ecx, 0x12c
jbe 0x4240f4
mov ecx, dword [esi + 0xc]
mov dword [esi + 0x30], eax
push edi
mov edx, dword [ecx]
call dword [edx + 8]
cmp byte [edi], 0
je 0x4240f4
mov byte [esi + 0x2c], 1
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x4243b0
Capabilities:
Encode data using base64

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
test ebx, ebx
push edi
je 0x424559
mov ebp, dword [esp + 0x18]
test ebp, ebp
je 0x424559
push ebx
call fcn.00424380
mov edi, dword [esp + 0x20]
push eax
mov ecx, edi
call fcn.00414110
mov eax, 0x55555556
xor esi, esi
imul ebx
mov eax, edx
shr eax, 0x1f
add edx, eax
test edx, edx
jle 0x4244a8
mov dword [esp + 0x20], edx
jmp 0x424401
mov ebp, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
xor ebx, ebx
mov bl, byte [esi + ebp]
inc esi
xor ecx, ecx
xor edx, edx
mov cl, byte [esi + ebp]
mov dl, byte [esi + eax + 1]
inc esi
mov ebp, ecx
mov ecx, ebx
mov dword [esp + 0x10], edx
mov edx, dword [0x44fc24]
inc esi
sar ecx, 2
and ecx, 0x3f
mov al, byte [ecx + edx]
mov ecx, edi
push eax
call fcn.00414060
mov edx, dword [0x44fc24]
mov ecx, ebp
sar ecx, 4
and ebx, 3
and ecx, 0xf
shl ebx, 4
or ecx, ebx
mov al, byte [ecx + edx]
mov ecx, edi
push eax
call fcn.00414060
mov ebx, dword [esp + 0x10]
mov edx, dword [0x44fc24]
mov ecx, ebx
and ebp, 0xf
sar ecx, 6
and ecx, 3
shl ebp, 2
or ecx, ebp
mov al, byte [ecx + edx]
mov ecx, edi
push eax
call fcn.00414060
mov ecx, dword [0x44fc24]
and ebx, 0x3f
mov dl, byte [ebx + ecx]
mov ecx, edi
push edx
call fcn.00414060
mov eax, dword [esp + 0x20]
dec eax
mov dword [esp + 0x20], eax
jne 0x4243fd
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
mov eax, ebx
mov ecx, 3
cdq
idiv ecx
dec edx
je 0x424511
dec edx
jne 0x424559
xor ebx, ebx
mov ecx, dword [0x44fc24]
mov bl, byte [esi + ebp]
xor edx, edx
mov dl, byte [esi + ebp + 1]
mov eax, ebx
sar eax, 2
and eax, 0x3f
mov esi, edx
mov dl, byte [eax + ecx]
mov ecx, edi
push edx
call fcn.00414060
mov ecx, dword [0x44fc24]
mov eax, esi
sar eax, 4
and ebx, 3
and eax, 0xf
shl ebx, 4
or eax, ebx
mov dl, byte [eax + ecx]
mov ecx, edi
push edx
call fcn.00414060
mov eax, dword [0x44fc24]
and esi, 0xf
mov cl, byte [eax + esi*4]
push ecx
jmp 0x424549
xor edx, edx
mov ecx, dword [0x44fc24]
mov dl, byte [esi + ebp]
mov esi, edx
mov eax, esi
sar eax, 2
and eax, 0x3f
mov dl, byte [eax + ecx]
mov ecx, edi
push edx
call fcn.00414060
mov eax, dword [0x44fc24]
and esi, 3
shl esi, 4
mov cl, byte [esi + eax]
push ecx
mov ecx, edi
call fcn.00414060
push 0x3d
mov ecx, edi
call fcn.00414060
push 0x3d
mov ecx, edi
call fcn.00414060
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x4250c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43f5b9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.MemoryData.0
mov eax, dword [esi + 0xc]
xor ebx, ebx
cmp eax, ebx
mov dword [esp + 0x14], 3
je 0x425103
cmp byte [esi + 9], bl
je 0x425103
push eax
call fcn.004342a8
add esp, 4
lea ecx, [esi + 0x4c]
mov dword [esi + 0xc], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x10], ebx
mov byte [esp + 0x14], 2
call fcn.0042d7b0
lea ecx, [esi + 0x30]
mov byte [esp + 0x14], 1
call fcn.00414650
lea ecx, [esi + 0x1c]
mov byte [esp + 0x14], bl
call fcn.004179b0
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.00418580
mov ecx, dword [esp + 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x425250
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x43f5ee
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
call fcn.00418540
xor eax, eax
lea ecx, [esi + 0x1c]
mov dword [esp + 0x10], eax
mov byte [esi + 8], al
mov byte [esi + 9], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
call fcn.004173a0
lea ecx, [esi + 0x30]
mov byte [esp + 0x10], 1
call fcn.004144c0
lea ecx, [esi + 0x4c]
mov byte [esp + 0x10], 2
call fcn.0042d770
mov ecx, dword [esp + 8]
mov dword [esi], vtable.MemoryData.0
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4257c0
Capabilities:
Check if file exists
Get file attributes
Get file size

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x43f688
push eax
mov dword fs:[0], esp
sub esp, 0x5c
xor edx, edx
push ebx
push ebp
push esi
mov esi, ecx
xor ecx, ecx
push edi
lea eax, [esi + 0x34]
lea edi, [esi + 8]
xor ebp, ebp
mov dword [eax], ecx
mov dword [eax + 4], ecx
lea eax, [esi + 0x3c]
mov dword [esi + 0x3c], edx
mov dword [eax + 4], edx
lea eax, [esi + 0x2c]
mov dword [esi + 0x2c], ecx
mov dword [eax + 4], ecx
mov ecx, edi
mov dword [esi + 0x44], ebp
mov byte [esi + 0x24], 0
mov dword [esi + 0x28], ebp
call fcn.00414030
mov ebx, dword [esp + 0x7c]
cmp ebx, ebp
jne 0x425836
mov ecx, dword [esp + 0x80]
cmp ecx, ebp
je 0x42582f
mov edx, dword [ecx]
push str.loadFileInfoAnsi_failed:_no_filename
call dword [edx + 0x10]
xor al, al
jmp 0x4259a0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x425887
mov esi, dword [esp + 0x80]
cmp esi, ebp
je 0x425880
mov eax, dword [esi]
push str.loadFileInfoAnsi_failed:_cannot_get_attributes
mov ecx, esi
call dword [eax + 0x10]
push esi
push ebx
call fcn.004162b0
add esp, 8
test al, al
jne 0x425873
mov edx, dword [esi]
push str.File_does_not_exist.
mov ecx, esi
call dword [edx + 0x10]
mov eax, dword [esi]
push ebx
push str.filename
mov ecx, esi
call dword [eax + 0x28]
xor al, al
jmp 0x4259a0
mov dword [esi + 0x44], eax
lea ecx, [esp + 0x10]
shr eax, 4
and al, 1
mov byte [esi + 0x24], al
call fcn.004185e0
push ebx
lea ecx, [esp + 0x14]
mov dword [esp + 0x78], ebp
call fcn.004187f0
lea ecx, [esp + 0x10]
call fcn.00418e90
push eax
mov ecx, edi
call fcn.004149b0
mov al, byte [esi + 0x24]
mov ebp, dword [esp + 0x80]
test al, al
push ebp
je 0x4258d5
lea ecx, [esp + 0x14]
push ecx
call fcn.00415b80
jmp 0x4258df
lea edx, [esp + 0x14]
push edx
call fcn.00415a60
mov edi, eax
add esp, 8
cmp edi, 0xffffffff
jne 0x425920
test ebp, ebp
je 0x425908
mov eax, dword [ebp]
push str.loadFileInfoAnsi_failed:_cannot_open_for_reading
mov ecx, ebp
call dword [eax + 0x10]
mov edx, dword [ebp]
push ebx
push str.filename
mov ecx, ebp
call dword [edx + 0x28]
lea ecx, [esp + 0x10]
mov dword [esp + 0x74], 0xffffffff
call fcn.004186a0
xor al, al
jmp 0x4259a0
lea eax, [esi + 0x2c]
push eax
lea eax, [esi + 0x3c]
push eax
lea eax, [esi + 0x34]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
jne 0x425976
test ebp, ebp
je 0x425956
mov eax, dword [ebp]
push str.loadFileInfoAnsi_failed:_cannot_get_file_time
mov ecx, ebp
call dword [eax + 0x10]
mov edx, dword [ebp]
push ebx
push str.filename
mov ecx, ebp
call dword [edx + 0x28]
push 0
push edi
call fcn.00424e00
add esp, 8
lea ecx, [esp + 0x10]
mov dword [esp + 0x74], 0xffffffff
call fcn.004186a0
xor al, al
jmp 0x4259a0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push edi
mov dword [esi + 0x28], eax
call fcn.00424e00
add esp, 8
lea ecx, [esp + 0x10]
mov dword [esp + 0x74], 0xffffffff
call fcn.004186a0
mov al, 1
mov ecx, dword [esp + 0x6c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x68
ret 8