joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428736
Capabilities:
Query environment variable

Disassembly:
push 0x1c
mov eax, 0x512720
call fcn.004d8abf
mov esi, ecx
mov dword [ebp - 0x14], esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor eax, eax
push eax
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x10]
push eax
push str.APPDATA
call ebx
mov edi, eax
test edi, edi
jne 0x4287b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x9a
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x28]
call fcn.00406620
and dword [ebp - 4], edi
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.0040121b
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.00407189
jmp 0x42884f
mov ecx, dword [ebp + 8]
push edi
push edi
call fcn.00406e86
push eax
push str.APPDATA
call ebx
mov ebx, eax
test ebx, ebx
jne 0x42880c
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x9c
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x28]
call fcn.00406620
mov dword [ebp - 4], 1
jmp 0x42879c
mov ecx, dword [ebp + 8]
push 0xffffffffffffffff
call fcn.004d64bc
cmp ebx, edi
jbe 0x428840
push 0x9f
push 0x80004005
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x28]
call fcn.00406620
mov dword [ebp - 4], 2
jmp 0x42879c
and dword [esi], 0
lea ecx, [esi + 8]
and dword [esi + 4], 0
call fcn.0040687a
mov eax, esi
call fcn.004d8a8d
ret

Function at 0x4289c2
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push 0x18
mov eax, 0x51274a
call fcn.004d8abf
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x10], esi
push edi
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4289ff
call fcn.00406710
push 0xc7
push eax
push ecx
mov ecx, esp
call fcn.0040687a
mov ecx, esi
call fcn.00406620
jmp 0x428a76
test al, 1
jne 0x428a0b
mov dword [esi], 1
jmp 0x428a6b
and eax, 0xfffffffe
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x428a69
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0xcd
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x24]
call fcn.00406620
lea eax, [ebp - 0x24]
mov dword [ebp - 4], ebx
push eax
mov ecx, esi
call fcn.0040121b
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.00407189
jmp 0x428a76
mov dword [esi], ebx
lea ecx, [esi + 8]
mov dword [esi + 4], ebx
call fcn.0040687a
mov eax, esi
call fcn.004d8a8d
ret
Function at 0x428aa8
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x6c
mov eax, dword [0x577014]
xor eax, esp
mov dword [esp + 0x68], eax
push esi
push 0x12
push 1
lea eax, [esp + 0x10]
xor esi, esi
push 0x53d240
push eax
mov dword [esp + 0x14], esi
call fcn.004d6394
add esp, 0x10
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
lea ecx, [esp + 8]
mov esi, eax
call fcn.004d6486
test esi, esi
jne 0x428afd
xor al, al
jmp 0x428b05
cmp dword [esp + 4], 0
setne al
mov ecx, dword [esp + 0x6c]
pop esi
xor ecx, esp
call fcn.004d818b
mov esp, ebp
pop ebp
ret

Function at 0x428d3f
Capabilities:
Move file

Disassembly:
push 0x34
mov eax, 0x512804
call fcn.004d8abf
mov ebx, ecx
mov dword [ebp - 0x20], ebx
xor edi, edi
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], edi
call fcn.004282f6
mov esi, eax
push 0x5444e8
lea edx, [ebp + 8]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00409442
push esi
mov edx, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x14]
call fcn.0040a037
push 0x5444ec
mov edx, eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x10]
call fcn.00409442
add esp, 0xc
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00407189
push dword [ebp - 0x10]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x428e20
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x15f
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x34]
call fcn.00406620
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 8
push eax
mov ecx, ebx
call fcn.0040121b
mov ecx, dword [ebp - 0x2c]
lea ecx, [ecx - 0x10]
call fcn.00407189
jmp 0x428ebf
push ecx
mov ecx, dword [ebp - 0x10]
mov esi, esp
mov dword [ebp - 0x28], esi
lea ecx, [ecx - 0x10]
call fcn.004070e7
add eax, 0x10
mov ecx, edi
mov dword [esi], eax
call fcn.00428b15
pop ecx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], edi
call fcn.0040687a
mov byte [ebp - 4], 9
cmp dword [ebp - 0x34], 0
jge 0x428ea7
cmp dword [ebp - 0x30], 0
mov eax, 0x160
mov edi, dword [ebp - 0x2c]
cmovne eax, dword [ebp - 0x30]
push eax
push dword [ebp - 0x34]
push ecx
mov esi, esp
lea ecx, [edi - 0x10]
mov dword [ebp - 0x28], esi
call fcn.004070e7
add eax, 0x10
lea ecx, [ebp - 0x40]
mov dword [esi], eax
call fcn.00406620
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0xa
push eax
mov ecx, ebx
call fcn.0040121b
mov ecx, dword [ebp - 0x38]
lea ecx, [ecx - 0x10]
call fcn.00407189
lea ecx, [edi - 0x10]
jmp 0x428e16
mov ecx, dword [ebp - 0x2c]
lea ecx, [ecx - 0x10]
call fcn.00407189
lea ecx, [ebx + 8]
mov dword [ebx], edi
mov dword [ebx + 4], edi
call fcn.0040687a
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov eax, ebx
call fcn.004d8a8d
ret
Function at 0x428edd
Capabilities:
Copy file
Move file

Disassembly:
push 0x24
mov eax, 0x51285e
call fcn.004d8abf
mov bl, dl
mov edi, ecx
mov dword [ebp - 0x20], edi
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 1
call fcn.004282f6
mov esi, eax
push 0x5444e8
lea edx, [ebp + 0xc]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.00409442
push esi
mov edx, eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x14]
call fcn.0040a037
push 0x5444ec
mov edx, eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x10]
call fcn.00409442
add esp, 0xc
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00407189
push 1
push dword [ebp - 0x10]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x428fc1
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x16a
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x30]
call fcn.00406620
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 9
push eax
mov ecx, edi
call fcn.0040121b
mov ecx, dword [ebp - 0x28]
lea ecx, [ecx - 0x10]
call fcn.00407189
jmp 0x429029
test bl, bl
jne 0x428fdd
mov edx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x30]
call fcn.004289c2
pop ecx
mov ecx, dword [ebp - 0x28]
lea ecx, [ecx - 0x10]
call fcn.00407189
movzx eax, bl
xor eax, 1
push eax
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x42901a
call fcn.00406710
mov ecx, dword [ebp - 0x10]
mov esi, eax
call fcn.00428a7e
push 0x175
push esi
push ecx
mov ecx, esp
call fcn.0040687a
mov ecx, edi
call fcn.00406620
jmp 0x429029
and dword [edi], 0
lea ecx, [edi + 8]
and dword [edi + 4], 0
call fcn.0040687a
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov eax, edi
call fcn.004d8a8d
ret
Function at 0x4293b8
Capabilities:
Move file

Disassembly:
push 0x38
mov eax, 0x51295f
call fcn.004d8abf
mov ebx, ecx
mov dword [ebp - 0x24], ebx
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 1
call fcn.004282f6
mov esi, eax
push 0x5444e8
lea edx, [ebp + 0xc]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.00409442
push esi
mov edx, eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x14]
call fcn.0040a037
push 0x5444ec
mov edx, eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x10]
call fcn.00409442
add esp, 0xc
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00407189
push ecx
mov ecx, dword [ebp - 0x10]
mov esi, esp
add ecx, 0xfffffff0
mov dword [ebp - 0x2c], esp
mov dword [ebp - 0x20], esi
call fcn.004070e7
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 9
mov edi, dword [ebp + 8]
push ecx
add edi, 0xfffffff0
mov esi, esp
mov dword [ebp - 0x20], esi
mov ecx, edi
mov dword [ebp - 0x20], edi
call fcn.004070e7
add eax, 0x10
lea ecx, [ebp - 0x38]
mov dword [esi], eax
xor esi, esi
mov edx, esi
mov byte [ebp - 4], 8
call fcn.00429052
pop ecx
pop ecx
mov byte [ebp - 4], 0xa
cmp dword [ebp - 0x38], esi
jge 0x4294e0
cmp dword [ebp - 0x34], esi
mov eax, 0x1ae
cmovne eax, dword [ebp - 0x34]
push eax
push dword [ebp - 0x38]
push ecx
mov esi, esp
mov dword [ebp - 0x2c], esi
mov ecx, dword [ebp - 0x30]
lea ecx, [ecx - 0x10]
call fcn.004070e7
add eax, 0x10
lea ecx, [ebp - 0x44]
mov dword [esi], eax
call fcn.00406620
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 0xb
push eax
mov ecx, ebx
call fcn.0040121b
mov ecx, dword [ebp - 0x3c]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x30]
lea ecx, [ecx - 0x10]
call fcn.00407189
jmp 0x429558
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
call fcn.00407189
push esi
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x42954b
call fcn.00406710
push ecx
mov esi, esp
mov edi, eax
mov dword [ebp - 0x2c], esi
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.004070e7
add eax, 0x10
xor ecx, ecx
mov dword [esi], eax
call fcn.00428b15
mov dword [esp], 0x1b4
push edi
push ecx
mov ecx, esp
call fcn.0040687a
mov ecx, ebx
call fcn.00406620
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x20]
jmp 0x429565
lea ecx, [ebx + 8]
mov dword [ebx], esi
mov dword [ebx + 4], esi
call fcn.0040687a
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, edi
call fcn.00407189
mov ecx, dword [ebp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov eax, ebx
call fcn.004d8a8d
ret
Function at 0x429667
Capabilities:
Create directory

Disassembly:
push 0x20
mov eax, 0x5129c3
call fcn.004d8abf
mov edi, ecx
mov dword [ebp - 0x18], edi
xor esi, esi
push esi
mov dword [ebp - 4], esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x42969d
lea ecx, [edi + 8]
mov dword [edi], esi
mov dword [edi + 4], esi
call fcn.0040687a
jmp 0x42979e
call fcn.00406710
mov esi, eax
cmp esi, 0x800700b7
jne 0x4296b0
xor esi, esi
jmp 0x42968b
push 0x5c
push dword [ebp + 8]
call fcn.004da090
pop ecx
pop ecx
test eax, eax
je 0x429789
sub eax, dword [ebp + 8]
sar eax, 1
cmp eax, 0xffffffff
je 0x429789
push eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp + 8]
call fcn.0040452e
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x14]
push ecx
add eax, 0xfffffff0
mov esi, esp
mov dword [ebp - 0x10], esi
mov ecx, eax
mov dword [ebp - 0x10], eax
call fcn.004070e7
add eax, 0x10
lea ecx, [ebp - 0x2c]
mov dword [esi], eax
call fcn.00429667
pop ecx
mov ecx, dword [ebp - 0x24]
lea ecx, [ecx - 0x10]
call fcn.00407189
xor esi, esi
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x42977a
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x1e5
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x2c]
call fcn.00406620
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 2
push eax
mov ecx, edi
call fcn.0040121b
mov ecx, dword [ebp - 0x24]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x10]
call fcn.00407189
jmp 0x42979e
lea ecx, [edi + 8]
mov dword [edi], esi
mov dword [edi + 4], esi
call fcn.0040687a
jmp 0x429770
push 0x1df
push esi
push ecx
mov ecx, esp
call fcn.0040687a
mov ecx, edi
call fcn.00406620
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov eax, edi
call fcn.004d8a8d
ret
Function at 0x42a406
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x512c24
call fcn.004d8abf
mov ebx, edx
mov esi, ecx
mov dword [ebp - 0x18], esi
xor edi, edi
push edi
push edi
push 2
push edi
push edi
push 2
mov dword [ebp - 4], edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 1
cmp eax, 0xffffffff
je 0x42a4ff
test eax, eax
je 0x42a4ff
push edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], edi
mov edi, dword [ebp + 0xc]
push ecx
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x42a4af
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x346
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x2c]
call fcn.00406620
mov byte [ebp - 4], 2
lea eax, [ebp - 0x2c]
mov ecx, esi
push eax
call fcn.0040121b
mov ecx, dword [ebp - 0x24]
lea ecx, [ecx - 0x10]
call fcn.00407189
jmp 0x42a523
cmp dword [ebp - 0x14], edi
je 0x42a4ee
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x347
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x2c]
call fcn.00406620
mov byte [ebp - 4], 3
jmp 0x42a497
and dword [esi], 0
lea ecx, [esi + 8]
and dword [esi + 4], 0
call fcn.0040687a
jmp 0x42a523
call fcn.00406710
push 0x343
push eax
push ecx
lea eax, [ebp + 8]
mov ecx, esp
push eax
mov edx, str.Error_creating_file:
call fcn.004093b4
pop ecx
mov ecx, esi
call fcn.00406620
lea ecx, [ebp - 0x10]
call fcn.00427477
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov eax, esi
call fcn.004d8a8d
ret
Function at 0x42a61b
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x28
mov eax, 0x512cb8
call fcn.004d8abf
mov dword [ebp - 0x14], edx
mov edi, ecx
mov dword [ebp - 0x1c], edi
xor eax, eax
push eax
push eax
push 3
push eax
push 1
push 1
mov dword [ebp - 4], eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 1
cmp esi, 0xffffffff
je 0x42a7ba
test esi, esi
je 0x42a7ba
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x42a6c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x370
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x34]
call fcn.00406620
mov byte [ebp - 4], 2
lea eax, [ebp - 0x34]
mov ecx, edi
push eax
call fcn.0040121b
mov ecx, dword [ebp - 0x2c]
lea ecx, [ecx - 0x10]
call fcn.00407189
jmp 0x42a7de
cmp dword [ebp + 0xc], 0
mov ebx, dword [ebp - 0x28]
je 0x42a6f8
cmp dword [ebp - 0x24], 0
jl 0x42a6f8
jg 0x42a6d8
cmp ebx, dword [ebp + 0xc]
jbe 0x42a6f8
push 0x375
push 0x80004005
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x34]
call fcn.00406620
mov byte [ebp - 4], 3
jmp 0x42a6a7
push ecx
mov ecx, dword [ebp - 0x14]
push ebx
call fcn.004d6193
test al, al
jne 0x42a71d
push 0x37e
push 0x8007000e
push ecx
mov ecx, esp
call fcn.0040687a
jmp 0x42a7d7
test ebx, ebx
jne 0x42a735
and dword [edi], 0
lea ecx, [edi + 8]
and dword [edi + 4], 0
call fcn.0040687a
jmp 0x42a7de
and dword [ebp - 0x18], 0
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.004b0bd0
push 0
lea ecx, [ebp - 0x18]
push ecx
push ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x42a792
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x385
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x34]
call fcn.00406620
mov byte [ebp - 4], 4
jmp 0x42a6a7
cmp dword [ebp - 0x18], ebx
je 0x42a721
push 0x386
push 0x80004005
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x34]
call fcn.00406620
mov byte [ebp - 4], 5
jmp 0x42a6a7
call fcn.00406710
push 0x36a
push eax
push ecx
lea eax, [ebp + 8]
mov ecx, esp
push eax
mov edx, str.Error_opening_file:
call fcn.004093b4
pop ecx
mov ecx, edi
call fcn.00406620
lea ecx, [ebp - 0x10]
call fcn.00427477
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov eax, edi
call fcn.004d8a8d
ret
Function at 0x42a7f9
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x28
mov eax, 0x512cb8
call fcn.004d8abf
mov dword [ebp - 0x14], edx
mov edi, ecx
mov dword [ebp - 0x1c], edi
xor eax, eax
push eax
push eax
push 3
push eax
push 1
push 1
mov dword [ebp - 4], eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 1
cmp esi, 0xffffffff
je 0x42a977
test esi, esi
je 0x42a977
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x42a8a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x3a5
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x34]
call fcn.00406620
mov byte [ebp - 4], 2
lea eax, [ebp - 0x34]
mov ecx, edi
push eax
call fcn.0040121b
mov ecx, dword [ebp - 0x2c]
lea ecx, [ecx - 0x10]
call fcn.00407189
jmp 0x42a99b
cmp dword [ebp + 0xc], 0
mov ebx, dword [ebp - 0x28]
je 0x42a8d6
cmp dword [ebp - 0x24], 0
jl 0x42a8d6
jg 0x42a8b6
cmp ebx, dword [ebp + 0xc]
jbe 0x42a8d6
push 0x3aa
push 0x80004005
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x34]
call fcn.00406620
mov byte [ebp - 4], 3
jmp 0x42a885
mov ecx, dword [ebp - 0x14]
push ebx
call fcn.00409336
test ebx, ebx
jne 0x42a8f7
and dword [edi], 0
lea ecx, [edi + 8]
and dword [edi + 4], 0
call fcn.0040687a
jmp 0x42a99b
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push 0
push eax
mov eax, dword [ebp - 0x14]
push ebx
push dword [eax]
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x42a94f
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x3b7
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x34]
call fcn.00406620
mov byte [ebp - 4], 4
jmp 0x42a885
cmp dword [ebp - 0x18], ebx
je 0x42a8e3
push 0x3b8
push 0x80004005
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x34]
call fcn.00406620
mov byte [ebp - 4], 5
jmp 0x42a885
call fcn.00406710
push 0x39f
push eax
push ecx
lea eax, [ebp + 8]
mov ecx, esp
push eax
mov edx, str.Error_opening_file:
call fcn.004093b4
pop ecx
mov ecx, edi
call fcn.00406620
lea ecx, [ebp - 0x10]
call fcn.00427477
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov eax, edi
call fcn.004d8a8d
ret
Function at 0x42b675
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x512fa8
call fcn.004d8b28
mov edi, edx
mov ebx, ecx
xor ecx, ecx
lea eax, [ebp - 0x18]
push eax
push ecx
lea eax, [ebp - 0x14]
mov dword [ebp - 4], ecx
push eax
push ecx
push edi
push ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x42b6c3
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
mov eax, 0x80004005
cmovs eax, ecx
jmp 0x42b750
cmp dword [ebp - 0x14], 1
je 0x42b6cf
cmp dword [ebp - 0x14], 2
jne 0x42b6e7
mov esi, dword [ebp - 0x18]
test esi, esi
jne 0x42b6e2
mov ecx, dword [ebp + 8]
call fcn.00406d1e
xor eax, eax
jmp 0x42b750
cmp esi, 1
jne 0x42b6ee
mov eax, 0x80004005
jmp 0x42b750
mov ecx, dword [ebp + 8]
shr esi, 1
lea eax, [esi + 1]
push eax
call fcn.0040dcc6
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x1c], eax
push ecx
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
je 0x42b732
mov ecx, dword [ebp + 8]
push 0
call fcn.00406ec4
movzx ecx, di
or ecx, 0x80070000
test edi, edi
cmovle ecx, edi
jmp 0x42b6b4
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
push 0xffffffffffffffff
mov word [eax + esi*2], cx
mov ecx, dword [ebp + 8]
call fcn.004d64bc
jmp 0x42b6de
call fcn.004d8a8d
ret

Function at 0x42b82a
Capabilities:
Timestomp file

Disassembly:
push 0x24
mov eax, 0x51300c
call fcn.004d8abf
mov edi, ecx
mov dword [ebp - 0x14], edi
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 7
push 0x100
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 1
cmp esi, 0xffffffff
je 0x42b8ef
test esi, esi
je 0x42b8ef
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], ebx
push eax
mov dword [ebp - 0x20], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea eax, [ebp - 0x24]
push eax
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x42b8e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x79f
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x30]
call fcn.00406620
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 2
push eax
mov ecx, edi
call fcn.0040121b
mov ecx, dword [ebp - 0x28]
lea ecx, [ecx - 0x10]
call fcn.00407189
jmp 0x42b909
lea ecx, [edi + 8]
mov dword [edi], ebx
mov dword [edi + 4], ebx
call fcn.0040687a
jmp 0x42b909
call fcn.00406710
push 0x79a
push eax
push ecx
mov ecx, esp
call fcn.0040687a
mov ecx, edi
call fcn.00406620
lea ecx, [ebp - 0x10]
call fcn.00427477
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov eax, edi
call fcn.004d8a8d
ret