joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4805de
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x898
mov dword [esp + 8], 0x29
mov dword [esp + 4], 0
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._memset
mov byte [ebp - 0x71], 0
cmp dword [ebp + 0x10], 0
jne 0x480613
mov eax, 0x500c60
jmp 0x480618
mov eax, 0x500c63
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x48063a
mov eax, 0xffffffff
jmp 0x48070b
lea eax, [ebp - 0x70]
mov dword [esp], eax
call sym._SHA1_Init
jmp 0x480671
lea edx, [ebp - 0x872]
mov eax, dword [ebp - 0xc]
add eax, edx
mov byte [eax], 0
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
lea eax, [ebp - 0x872]
mov dword [esp + 4], eax
lea eax, [ebp - 0x70]
mov dword [esp], eax
call sym._SHA1_Update
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x800
mov dword [esp + 4], 1
lea eax, [ebp - 0x872]
mov dword [esp], eax
call sym._fread
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x480647
lea eax, [ebp - 0x70]
mov dword [esp + 4], eax
lea eax, [ebp - 0x886]
mov dword [esp], eax
call sym._SHA1_Final
mov dword [ebp - 0xc], 0
jmp 0x4806f5
lea edx, [ebp - 0x886]
mov eax, dword [ebp - 0xc]
add eax, edx
movzx eax, byte [eax]
movzx eax, al
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x500c65
mov dword [esp + 4], 3
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._snprintf_51
add dword [ebp + 0xc], 2
add dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0x13
jbe 0x4806bd
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._fclose
mov eax, 0
leave
ret
Function at 0x486150
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8b8
mov dword [esp + 8], 0x41
mov dword [esp + 4], 0
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._memset
mov byte [ebp - 0x81], 0
cmp dword [ebp + 0x10], 0
jne 0x486188
mov eax, 0x501860
jmp 0x48618d
mov eax, 0x501863
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4861af
mov eax, 0xffffffff
jmp 0x486280
lea eax, [ebp - 0x80]
mov dword [esp], eax
call sym._SHA256_Init
jmp 0x4861e6
lea edx, [ebp - 0x882]
mov eax, dword [ebp - 0xc]
add eax, edx
mov byte [eax], 0
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
lea eax, [ebp - 0x882]
mov dword [esp + 4], eax
lea eax, [ebp - 0x80]
mov dword [esp], eax
call sym._SHA256_Update
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x800
mov dword [esp + 4], 1
lea eax, [ebp - 0x882]
mov dword [esp], eax
call sym._fread
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4861bc
lea eax, [ebp - 0x80]
mov dword [esp + 4], eax
lea eax, [ebp - 0x8a2]
mov dword [esp], eax
call sym._SHA256_Final
mov dword [ebp - 0xc], 0
jmp 0x48626a
lea edx, [ebp - 0x8a2]
mov eax, dword [ebp - 0xc]
add eax, edx
movzx eax, byte [eax]
movzx eax, al
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x501865
mov dword [esp + 4], 3
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._snprintf_54
add dword [ebp + 0xc], 2
add dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0x1f
jbe 0x486232
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._fclose
mov eax, 0
leave
ret
Function at 0x488dfc
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
cmp dword [ebp + 0xc], 0
jne 0x488e13
mov eax, 0
jmp 0x488fc0
cmp dword [ebp + 8], 0
jne 0x488e27
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._strlen
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
lea ecx, [eax*4]
mov edx, 0x55555556
mov eax, ecx
imul edx
mov eax, ecx
sar eax, 0x1f
sub edx, eax
lea eax, [edx + 4]
mov dword [esp + 4], eax
mov dword [esp], 1
call sym._calloc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x488e67
mov eax, 0
jmp 0x488fc0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
jmp 0x488fb1
mov byte [ebp - 0x19], 0
mov byte [ebp - 0x11], 0
mov byte [ebp - 0x12], 0
mov byte [ebp - 0x1a], 0
mov byte [ebp - 0x1b], 0
mov byte [ebp - 0x1c], 0
mov byte [ebp - 0x1d], 0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 0xc]
add eax, edx
movzx eax, byte [eax]
mov byte [ebp - 0x19], al
mov eax, dword [ebp - 0xc]
add eax, 1
cmp dword [ebp + 8], eax
jle 0x488ebf
mov eax, dword [ebp - 0xc]
lea edx, [eax + 1]
mov eax, dword [ebp + 0xc]
add eax, edx
movzx eax, byte [eax]
mov byte [ebp - 0x11], al
mov eax, dword [ebp - 0xc]
add eax, 2
cmp dword [ebp + 8], eax
jle 0x488edb
mov eax, dword [ebp - 0xc]
lea edx, [eax + 2]
mov eax, dword [ebp + 0xc]
add eax, edx
movzx eax, byte [eax]
mov byte [ebp - 0x12], al
movzx eax, byte [ebp - 0x19]
shr al, 2
mov byte [ebp - 0x1a], al
movzx eax, byte [ebp - 0x19]
shl eax, 4
and eax, 0x30
mov edx, eax
movzx eax, byte [ebp - 0x11]
shr al, 4
or eax, edx
mov byte [ebp - 0x1b], al
movzx eax, byte [ebp - 0x11]
shl eax, 2
and eax, 0x3c
mov edx, eax
movzx eax, byte [ebp - 0x12]
shr al, 6
or eax, edx
mov byte [ebp - 0x1c], al
movzx eax, byte [ebp - 0x12]
and eax, 0x3f
mov byte [ebp - 0x1d], al
movzx eax, byte [ebp - 0x1a]
mov ebx, dword [ebp - 0x10]
lea edx, [ebx + 1]
mov dword [ebp - 0x10], edx
mov dword [esp], eax
call dbg.encode
mov byte [ebx], al
movzx eax, byte [ebp - 0x1b]
mov ebx, dword [ebp - 0x10]
lea edx, [ebx + 1]
mov dword [ebp - 0x10], edx
mov dword [esp], eax
call dbg.encode
mov byte [ebx], al
mov eax, dword [ebp - 0xc]
add eax, 1
cmp dword [ebp + 8], eax
jle 0x488f71
movzx eax, byte [ebp - 0x1c]
mov ebx, dword [ebp - 0x10]
lea edx, [ebx + 1]
mov dword [ebp - 0x10], edx
mov dword [esp], eax
call dbg.encode
mov byte [ebx], al
jmp 0x488f7d
mov eax, dword [ebp - 0x10]
lea edx, [eax + 1]
mov dword [ebp - 0x10], edx
mov byte [eax], 0x3d
mov eax, dword [ebp - 0xc]
add eax, 2
cmp dword [ebp + 8], eax
jle 0x488fa1
movzx eax, byte [ebp - 0x1d]
mov ebx, dword [ebp - 0x10]
lea edx, [ebx + 1]
mov dword [ebp - 0x10], edx
mov dword [esp], eax
call dbg.encode
mov byte [ebx], al
jmp 0x488fad
mov eax, dword [ebp - 0x10]
lea edx, [eax + 1]
mov dword [ebp - 0x10], edx
mov byte [eax], 0x3d
add dword [ebp - 0xc], 3
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 8]
jl 0x488e79
mov eax, dword [ebp - 0x18]
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x48ab5e
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1248
call fcn.004d7290
sub esp, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x101c], 0
lea eax, [ebp - 0x101c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1000
lea eax, [ebp - 0x1018]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._EnumProcessModules_16
sub esp, 0x10
test eax, eax
je 0x48ac7f
mov dword [ebp - 0xc], 0
jmp 0x48ac6b
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x1018]
mov dword [esp + 0xc], 0x104
lea edx, [ebp - 0x1224]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._GetModuleFileNameExW_16
sub esp, 0x10
test eax, eax
je 0x48ac67
lea eax, [ebp - 0x1224]
mov dword [esp], eax
call dbg.verify_hash_and_pe_signature
test eax, eax
je 0x48ac39
mov dword [ebp - 0x18], str.The_file__S_is_not_signed_or_its_signature_is_invalid.
lea eax, [ebp - 0x1224]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.loaded_modules_verification
mov dword [esp + 4], 0x3a
mov dword [esp], str.shared_dll_load_notify.c
call dbg._plain_mwarn
jmp 0x48ac67
lea eax, [ebp - 0x1224]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.The_file__S_is_signed_and_its_signature_is_valid.
mov dword [esp + 8], str.loaded_modules_verification
mov dword [esp + 4], 0x3d
mov dword [esp], str.shared_dll_load_notify.c
call dbg._plain_mdebug1
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x101c]
shr eax, 2
cmp dword [ebp - 0xc], eax
jb 0x48abbf
jmp 0x48acb4
mov dword [ebp - 0x14], str.The_mechanism_of_signature_validation_for_loaded_modules_at_startup_failed_because_the_modules_of_the_process_couldnt_be_enumerated._Error:__lu
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.loaded_modules_verification
mov dword [esp + 4], 0x47
mov dword [esp], str.shared_dll_load_notify.c
call dbg._plain_mwarn
nop
leave
ret
Function at 0x48b5a1
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
test eax, eax
jne 0x48b696
mov dword [esp], 0x201
call sym._malloc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x48b61c
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x502a10
mov dword [esp + 8], str.w_enrollment_extract_agent_name
mov dword [esp + 4], 0x9e
mov dword [esp], str.shared_enrollment_op.c
call dbg._merror_exit
mov eax, dword [ebp - 0xc]
add eax, 0x200
mov byte [eax], 0
mov dword [esp + 4], 0x1ff
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.WSOCK32.DLL_gethostname]
call eax
sub esp, 8
test eax, eax
je 0x48b689
mov dword [esp + 0xc], str.Unable_to_extract_hostname._Custom_agent_name_not_set.
mov dword [esp + 8], str.w_enrollment_extract_agent_name
mov dword [esp + 4], 0xa1
mov dword [esp], str.shared_enrollment_op.c
call dbg._merror
cmp dword [ebp - 0xc], 0
je 0x48b67f
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._free
mov dword [ebp - 0xc], 0
mov eax, 0
jmp 0x48b786
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call dbg.OS_ConvertToValidAgentName
jmp 0x48b6a1
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
movzx eax, byte [eax + 0x11]
xor eax, 1
test al, al
je 0x48b71d
mov dword [esp + 4], 0x502b27
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x48b71d
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str._4104_:_Invalid_hostname:__s.
mov dword [esp + 8], str.w_enrollment_extract_agent_name
mov dword [esp + 4], 0xab
mov dword [esp], str.shared_enrollment_op.c
call dbg._merror
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
cmp dword [ebp - 0xc], eax
je 0x48b716
cmp dword [ebp - 0xc], 0
je 0x48b716
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._free
mov dword [ebp - 0xc], 0
mov eax, 0
jmp 0x48b786
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call dbg.OS_IsValidName
test eax, eax
jne 0x48b783
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Invalid_agent_name___s_._Please_pick_a_valid_name.
mov dword [esp + 8], str.w_enrollment_extract_agent_name
mov dword [esp + 4], 0xb2
mov dword [esp], str.shared_enrollment_op.c
call dbg._merror
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
cmp dword [ebp - 0xc], eax
je 0x48b77c
cmp dword [ebp - 0xc], 0
je 0x48b77c
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._free
mov dword [ebp - 0xc], 0
mov eax, 0
jmp 0x48b786
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x48efab
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x858
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x20], 0
cmp dword [ebp + 0xc], 0
jne 0x48efeb
mov eax, 0x5035ea
jmp 0x48eff0
mov eax, 0x5035ed
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x48f03d
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Unable_to_read_merged_file:__s.
mov dword [esp + 8], str.TestUnmergeFiles
mov dword [esp + 4], 0x31f
mov dword [esp], str.shared_file_op.c
call dbg._merror
mov eax, 0
jmp 0x48f1d4
mov eax, dword [ebp - 0x24]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x800
lea eax, [ebp - 0x829]
mov dword [esp], eax
call sym._fgets
test eax, eax
je 0x48f1c5
movzx eax, byte [ebp - 0x829]
movsx eax, al
cmp eax, 0x21
je 0x48f086
cmp eax, 0x23
je 0x48f1bf
mov dword [ebp - 0xc], 0
jmp 0x48f1c6
nop
lea eax, [ebp - 0x829]
add eax, 1
mov dword [esp], eax
call sym._atol
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov dword [esp + 4], 0xa
lea eax, [ebp - 0x829]
mov dword [esp], eax
call sym._strchr
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x48f0c6
mov eax, dword [ebp - 0x28]
mov byte [eax], 0
mov dword [esp + 4], 0x20
lea eax, [ebp - 0x829]
mov dword [esp], eax
call sym._strchr
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x48f0f1
mov dword [ebp - 0xc], 0
jmp 0x48f1c0
add dword [ebp - 0x28], 1
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test al, al
jne 0x48f10b
mov dword [ebp - 0xc], 0
jmp 0x48f1c6
cmp dword [ebp - 0x14], 0x7ff
ja 0x48f123
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0
jmp 0x48f131
mov dword [ebp - 0x10], 0x800
sub dword [ebp - 0x14], 0x800
mov dword [ebp - 0x18], 0
jmp 0x48f17a
lea edx, [ebp - 0x829]
mov eax, dword [ebp - 0x1c]
add eax, edx
mov byte [eax], 0
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0x18], eax
cmp dword [ebp - 0x14], 0
je 0x48f1a9
cmp dword [ebp - 0x14], 0x7ff
ja 0x48f16c
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0
jmp 0x48f17a
mov dword [ebp - 0x10], 0x800
sub dword [ebp - 0x14], 0x800
mov eax, dword [ebp - 0x24]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 1
lea eax, [ebp - 0x829]
mov dword [esp], eax
call sym._fread
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x48f13a
jmp 0x48f1aa
nop
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x20]
je 0x48f03d
mov dword [ebp - 0xc], 0
jmp 0x48f1c6
nop
jmp 0x48f03d
nop
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sym._fclose
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x48f700
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0xb4
mov dword [0x589cc0], 0
lea edx, [ebp - 0xa8]
mov eax, 0
mov ecx, 0x27
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [ebp - 0xa8], 0x9c
lea eax, [ebp - 0xa8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetVersionExA]
call eax
sub esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x48f79a
mov dword [ebp - 0xa8], 0x94
lea eax, [ebp - 0xa8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetVersionExA]
call eax
sub esp, 4
test eax, eax
jne 0x48f79a
mov dword [esp + 0xc], str.Cannot_get_Windows_version_number.
mov dword [esp + 8], str.checkVista
mov dword [esp + 4], 0x494
mov dword [esp], str.shared_file_op.c
call dbg._merror
mov eax, 0xffffffff
jmp 0x48f7b4
mov eax, dword [ebp - 0xa4]
cmp eax, 5
jbe 0x48f7af
mov dword [0x589cc0], 1
mov eax, dword [0x589cc0]
mov edi, dword [ebp - 4]
leave
ret
Function at 0x48f9b8
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
call eax
sub esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x48fa9a
mov dword [ebp - 0x14], 0x40000000
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 2
mov dword [ebp - 0x20], pe_nt_image_headers32
mov dword [esp + 0x18], 0
mov eax, dword [ebp - 0x20]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov eax, dword [ebp - 0x18]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileA]
call eax
sub esp, 0x1c
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffff
jne 0x48fa83
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Could_not_create_file___s__which_returned___lu_
mov dword [esp + 8], str.rename_ex
mov dword [esp + 4], 0x4e1
mov dword [esp], str.shared_file_op.c
call dbg._mferror
mov eax, 0xffffffff
jmp 0x48fb34
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov dword [ebp - 0xc], 1
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_ReplaceFileA]
call eax
sub esp, 0x18
test eax, eax
jne 0x48fb2f
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Could_not_move___s__to___s__which_returned___lu_
mov dword [esp + 8], str.rename_ex
mov dword [esp + 4], 0x4ea
mov dword [esp], str.shared_file_op.c
call dbg._mferror
cmp dword [ebp - 0xc], 0
je 0x48fb28
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_DeleteFileA]
call eax
sub esp, 4
mov eax, 0xffffffff
jmp 0x48fb34
mov eax, 0
leave
ret
Function at 0x492830
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1138
call fcn.004d7290
sub esp, eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._s.XXXXXX
mov dword [esp + 4], 0x100
lea eax, [ebp - 0x11d]
mov dword [esp], eax
call sym._snprintf_59
mov dword [esp], 0x7f
call sym._umask
mov word [ebp - 0xa], ax
mov dword [ebp - 0x10], 0
movzx eax, word [ebp - 0xa]
mov dword [esp], eax
call sym._umask
cmp dword [ebp - 0x10], 0
jns 0x492897
mov eax, 0xffffffff
jmp 0x492a35
mov dword [esp + 4], 0x5035ed
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0x14], eax
mov dword [esp + 4], 0x5036dc
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._fdopen
mov edx, dword [ebp + 8]
mov dword [edx + 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
test eax, eax
jne 0x492904
cmp dword [ebp - 0x14], 0
je 0x4928e1
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._fclose
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._close
lea eax, [ebp - 0x11d]
mov dword [esp], eax
call sym._unlink
mov eax, 0xffffffff
jmp 0x492a35
cmp dword [ebp + 0x10], 0
je 0x492a0a
cmp dword [ebp - 0x14], 0
je 0x492a0a
jmp 0x4929f7
mov eax, dword [ebp - 0x14]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1000
mov dword [esp + 4], 1
lea eax, [ebp - 0x111d]
mov dword [esp], eax
call sym._fread
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._ferror
test eax, eax
je 0x492985
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._fclose
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [esp], eax
call sym._fclose
lea eax, [ebp - 0x11d]
mov dword [esp], eax
call sym._unlink
mov eax, 0xffffffff
jmp 0x492a35
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], 1
lea eax, [ebp - 0x111d]
mov dword [esp], eax
call sym._fwrite
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x18]
jne 0x4929c9
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [esp], eax
call sym._ferror
test eax, eax
je 0x4929f7
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._fclose
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [esp], eax
call sym._fclose
lea eax, [ebp - 0x11d]
mov dword [esp], eax
call sym._unlink
mov eax, 0xffffffff
jmp 0x492a35
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._feof
test eax, eax
je 0x49291d
cmp dword [ebp - 0x14], 0
je 0x492a1b
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._fclose
lea eax, [ebp - 0x11d]
mov dword [esp], eax
call sym._strdup
mov edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov eax, 0
leave
ret
Function at 0x492f4a
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strdup
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
jmp 0x493070
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
mov byte [ebp - 0x15], al
mov eax, dword [ebp - 0xc]
mov byte [eax], 0
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test al, al
je 0x49305e
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._mkdir
test eax, eax
jns 0x49305e
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
cmp eax, 0x11
je 0x492fb2
cmp eax, 0x15
je 0x49305a
jmp 0x493005
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dbg.IsDir
test eax, eax
jns 0x49305d
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Couldnt_make_dir__s:_not_a_directory.
mov dword [esp + 8], str.mkdir_ex
mov dword [esp + 4], 0x999
mov dword [esp], str.shared_file_op.c
call dbg._merror
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._free
mov eax, 0xffffffff
jmp 0x493184
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Couldnt_make_dir__s:__s
mov dword [esp + 8], str.mkdir_ex
mov dword [esp + 4], 0x9a4
mov dword [esp], str.shared_file_op.c
call dbg._merror
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._free
mov eax, 0xffffffff
jmp 0x493184
nop
jmp 0x49305e
nop
mov eax, dword [ebp - 0xc]
movzx edx, byte [ebp - 0x15]
mov byte [eax], dl
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0x10], eax
mov dword [esp + 4], 0x2f
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._strchr
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4930a8
mov dword [esp + 4], 0x5c
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._strchr
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4930af
mov eax, 1
jmp 0x4930b4
mov eax, 0
test eax, eax
jne 0x492f69
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._mkdir
test eax, eax
jns 0x49317f
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
cmp eax, 0x11
je 0x4930f3
cmp eax, 0x15
je 0x49317b
jmp 0x493134
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dbg.IsDir
test eax, eax
jns 0x49317e
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Couldnt_make_dir__s:_not_a_directory.
mov dword [esp + 8], str.mkdir_ex
mov dword [esp + 4], 0x9b3
mov dword [esp], str.shared_file_op.c
call dbg._merror
mov eax, 0xffffffff
jmp 0x493184
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Couldnt_make_dir__s:__s
mov dword [esp + 8], str.mkdir_ex
mov dword [esp + 4], 0x9bd
mov dword [esp], str.shared_file_op.c
call dbg._merror
mov eax, 0xffffffff
jmp 0x493184
nop
jmp 0x49317f
nop
mov eax, 0
leave
ret