joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403e10
Capabilities:
Delete file
Set file attributes

Disassembly:
cmp byte [edi], 0
je 0x403e4f
push esi
mov esi, dword [edi + 4]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x403e3b
mov ecx, dword [edi + 4]
xor al, al
test al, al
sete al
pop esi
push ecx
mov byte [edi], al
call fcn.004e0a60
pop ecx
ret
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
test al, al
sete al
mov byte [edi], al
pop esi
mov ecx, dword [edi + 4]
push ecx
call fcn.004e0a60
pop ecx
ret

Function at 0x403f00
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fe145
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x54c2c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], 4
mov dword [edi], vtable.CObjectVector_struct_NArchive::N7z::CMethodFull_.0
mov dword [ebp - 4], eax
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], eax
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], 0x10
mov dword [edi + 0x14], vtable.CRecordVector_struct_NArchive::N7z::CBind_.0
mov ecx, 1
mov byte [ebp - 4], cl
lea esi, [edi + 0x30]
mov dword [edi + 0x28], ecx
mov byte [edi + 0x2c], al
call fcn.00406150
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x405770
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fbef2
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x54c2c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [esi + 0x30]
push eax
call fcn.004e0a60
mov eax, dword [esi + 0x1c]
add esp, 4
push eax
push ebx
lea ecx, [esi + 0x14]
mov dword [esi + 0x14], vtable.CBaseRecordVector.0
call dword [0x515848]
mov eax, dword [esi + 0x20]
push eax
call fcn.004e0a60
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
add esp, 4
mov dword [esi], vtable.CObjectVector_struct_NArchive::N7z::CMethodFull_.0
mov dword [ebp - 4], 1
mov ecx, dword [esi + 8]
push ecx
push ebx
mov ecx, esi
call dword [0x5159c0]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [esi + 8]
push edx
push ebx
mov ecx, esi
mov dword [esi], vtable.CBaseRecordVector.0
call dword [0x515848]
mov eax, dword [esi + 0xc]
push eax
call fcn.004e0a60
add esp, 4
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x409140
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
xor ebx, ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], 4
mov dword [esi + 8], vtable.CObjectVector_struct_NArchive::COneMethodInfo_.0
lea eax, [ebp - 0x24]
push eax
mov byte [esi + 0x1c], bl
mov dword [esi + 0x32], 1
mov word [esi + 0x36], 0x100
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x10]
or eax, 0xffffffff
mov byte [esi + 0x40], bl
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov word [esi + 0x30], bx
mov dword [esi], ecx
mov dword [esi + 0x3c], 5
mov byte [esi + 0x38], 1
mov dword [esi + 4], 4
mov eax, esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40b9f0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fde18
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x54c2c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 2
mov eax, dword [esi + 0x44]
push eax
xor ebx, ebx
push ebx
lea ecx, [esi + 0x3c]
mov dword [esi + 0x3c], vtable.CBaseRecordVector.0
call dword [0x515848]
mov eax, dword [esi + 0x48]
push eax
call fcn.004e0a60
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov byte [ebp - 4], 1
mov ecx, dword [esi + 0x30]
add esp, 4
push ecx
push ebx
lea ecx, [esi + 0x28]
mov dword [esi + 0x28], vtable.CBaseRecordVector.0
call dword [0x515848]
mov eax, dword [esi + 0x34]
push eax
call fcn.004e0a60
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov byte [ebp - 4], bl
mov edx, dword [esi + 0x1c]
add esp, 4
push edx
push ebx
lea ecx, [esi + 0x14]
mov dword [esi + 0x14], vtable.CBaseRecordVector.0
call dword [0x515848]
mov eax, dword [esi + 0x20]
push eax
call fcn.004e0a60
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
add esp, 4
mov dword [esi], vtable.CObjectVector_struct_NArchive::N7z::CCoderInfo_.0
mov dword [ebp - 4], 3
mov eax, dword [esi + 8]
push eax
push ebx
mov ecx, esi
call dword [0x5159e4]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [esi + 8]
push ecx
push ebx
mov ecx, esi
mov dword [esi], vtable.CBaseRecordVector.0
call dword [0x515848]
mov edx, dword [esi + 0xc]
push edx
call fcn.004e0a60
add esp, 4
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41ab90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fdbef
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x54c2c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebx], eax
mov dword [ebp - 4], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], ecx
lea esi, [ebx + 0x10]
mov dword [ebx + 0xc], edx
mov ecx, 8
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ecx
mov dword [esi], vtable.CRecordVector_unsigned_long_long_unsigned___int64__.0
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x34], ecx
mov dword [ebx + 0x24], vtable.CRecordVector_unsigned_long_long_unsigned___int64__.0
mov ecx, 4
mov dword [ebx + 0x3c], eax
mov dword [ebx + 0x40], eax
mov dword [ebx + 0x44], eax
mov dword [ebx + 0x48], ecx
mov dword [ebx + 0x38], vtable.CRecordVector_unsigned_long_long_unsigned___int64__const__.0
mov dword [ebx + 0x50], eax
mov dword [ebx + 0x54], eax
mov dword [ebx + 0x58], eax
mov dword [ebx + 0x5c], ecx
mov dword [ebx + 0x4c], vtable.CRecordVector_unsigned_long_long_unsigned___int64__const__.0
mov byte [ebp - 4], 5
mov edi, dword [ebx + 8]
call fcn.00447010
mov edi, dword [ebx + 8]
lea esi, [ebx + 0x38]
call fcn.00447010
mov edi, dword [ebx + 0xc]
lea esi, [ebx + 0x24]
call fcn.00447010
mov edi, dword [ebx + 0xc]
lea esi, [ebx + 0x4c]
call fcn.00447010
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41f890
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fbbb0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x54c2c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 1
mov eax, dword [edi + 0x34]
push eax
xor ebx, ebx
push ebx
lea ecx, [edi + 0x2c]
mov dword [edi + 0x2c], vtable.CBaseRecordVector.0
call dword [0x515848]
mov eax, dword [edi + 0x38]
push eax
call fcn.004e0a60
lea esi, [edi + 0x18]
mov dword [edi + 0x30], ebx
mov dword [edi + 0x34], ebx
mov dword [edi + 0x38], ebx
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.CObjectVector_class_CMyComPtr_struct_IInStream__.0
mov byte [ebp - 4], 2
mov ecx, dword [esi + 8]
push ecx
push ebx
mov ecx, esi
call dword [0x51641c]
mov byte [ebp - 4], bl
mov edx, dword [esi + 8]
push edx
push ebx
mov ecx, esi
mov dword [esi], vtable.CBaseRecordVector.0
call dword [0x515848]
mov eax, dword [esi + 0xc]
push eax
call fcn.004e0a60
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [edi + 0xc]
push ecx
call fcn.004e0a60
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x424550
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
cmp eax, 0x400000
jbe 0x424562
mov eax, 0x400000
mov edx, dword [ebp + 0xc]
push 0
lea ecx, [ebp + 0x10]
push ecx
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
push edx
push ecx
mov dword [ebp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 0x14]
test eax, eax
setne al
test ecx, ecx
je 0x424592
mov edx, dword [ebp + 0x10]
mov dword [ecx], edx
test al, al
je 0x42459c
xor eax, eax
pop ebp
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4245af
mov eax, 0x80004005
pop ebp
ret 0x10
jle 0x4245bb
and eax, 0xffff
or eax, 0x80070000
pop ebp
ret 0x10

Function at 0x4246f0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
push esi
push edi
lea eax, [ebp + 8]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x424719
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
jne 0x424734
mov edx, dword [ebp + 8]
xor eax, eax
xor ecx, ecx
add ecx, esi
adc edx, eax
mov eax, dword [ebp + 0xc]
pop edi
mov dword [eax], ecx
mov dword [eax + 4], edx
xor eax, eax
pop esi
pop ebp
ret 8
call edi
test eax, eax
jne 0x424745
pop edi
mov eax, 0x80004005
pop esi
pop ebp
ret 8
jle 0x424751
and eax, 0xffff
or eax, 0x80070000
pop edi
pop esi
pop ebp
ret 8
Function at 0x4247a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
cmp eax, 0x400000
jbe 0x4247b2
mov eax, 0x400000
mov edx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push 0
lea ecx, [ebp + 0x10]
push ecx
push eax
mov eax, dword [esi + 8]
push edx
push eax
mov dword [ebp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 0x14]
test eax, eax
mov eax, dword [ebp + 0x10]
setne dl
add dword [esi + 0x10], eax
adc dword [esi + 0x14], 0
pop esi
test ecx, ecx
je 0x4247eb
mov dword [ecx], eax
test dl, dl
je 0x4247f5
xor eax, eax
pop ebp
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x424808
mov eax, 0x80004005
pop ebp
ret 0x10
jle 0x424814
and eax, 0xffff
or eax, 0x80070000
pop ebp
ret 0x10

Function at 0x424970
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x424981
mov dword [esi], 0
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4249ba
mov eax, 0x8000
cmp ecx, eax
jae 0x424993
mov eax, ecx
mov edx, dword [ebp + 0xc]
push 0
lea ecx, [ebp + 0x14]
push ecx
push eax
push edx
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test esi, esi
je 0x4249b6
mov ecx, dword [ebp + 0x14]
add dword [esi], ecx
test eax, eax
je 0x4249c1
xor eax, eax
pop esi
pop ebp
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4249d5
mov eax, 0x80004005
pop esi
pop ebp
ret 0x10
jle 0x4249e1
and eax, 0xffff
or eax, 0x80070000
pop esi
pop ebp
ret 0x10
Function at 0x424d20
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fd928
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x54c2c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [esi + 4], vtable.ICompressSetInStream.0
mov dword [esi + 8], vtable.ISequentialInStream.0
mov dword [esi + 0xc], vtable.ICompressSetOutStream.0
mov dword [esi + 0x10], vtable.ISequentialOutStream.0
mov dword [esi + 0x14], vtable.IOutStreamFlush.0
mov dword [esi + 0x18], vtable.ICryptoSetPassword.0
mov dword [esi + 0x1c], vtable.ICompressSetCoderProperties.0
mov dword [esi + 0x20], vtable.ICompressWriteCoderProperties.0
mov dword [esi + 0x24], vtable.ICryptoResetInitVector.0
mov dword [esi + 0x28], vtable.ICompressSetDecoderProperties2.0
xor edi, edi
mov dword [esi + 0x2c], edi
mov dword [esi], vtable.CFilterCoder.0
mov dword [esi + 4], vtable.CFilterCoder.1.0
mov dword [esi + 8], vtable.CFilterCoder.2.0
mov dword [esi + 0xc], vtable.CFilterCoder.3.0
mov dword [esi + 0x10], vtable.CFilterCoder.4.0
mov dword [esi + 0x14], vtable.CFilterCoder.5.0
mov dword [esi + 0x18], vtable.CFilterCoder.6.0
mov dword [esi + 0x1c], vtable.CFilterCoder.7.0
mov dword [esi + 0x20], vtable.CFilterCoder.8.0
mov dword [esi + 0x24], vtable.CFilterCoder.9.0
mov dword [esi + 0x28], vtable.CFilterCoder.10.0
mov dword [esi + 0x34], edi
mov dword [ebp - 4], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
push 4
push 0x1000
push 0x20000
push edi
mov byte [ebp - 4], 7
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [esi + 0x30], eax
cmp eax, edi
jne 0x424e2d
push 0x531ba0
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], 1
call fcn.004e667f
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x424e50
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fbb68
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x54c2c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [esi], vtable.CFilterCoder.0
mov dword [esi + 4], vtable.CFilterCoder.1.0
mov dword [esi + 8], vtable.CFilterCoder.2.0
mov dword [esi + 0xc], vtable.CFilterCoder.3.0
mov dword [esi + 0x10], vtable.CFilterCoder.4.0
mov dword [esi + 0x14], vtable.CFilterCoder.5.0
mov dword [esi + 0x18], vtable.CFilterCoder.6.0
mov dword [esi + 0x1c], vtable.CFilterCoder.7.0
mov dword [esi + 0x20], vtable.CFilterCoder.8.0
mov dword [esi + 0x24], vtable.CFilterCoder.9.0
mov dword [esi + 0x28], vtable.CFilterCoder.10.0
mov dword [ebp - 4], 7
mov eax, dword [esi + 0x30]
test eax, eax
je 0x424ede
push 0x8000
push 0
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov byte [ebp - 4], 6
mov eax, dword [esi + 0x74]
test eax, eax
je 0x424ef1
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [ebp - 4], 5
mov eax, dword [esi + 0x70]
test eax, eax
je 0x424f04
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [ebp - 4], 4
mov eax, dword [esi + 0x6c]
test eax, eax
je 0x424f17
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [ebp - 4], 3
mov eax, dword [esi + 0x68]
test eax, eax
je 0x424f2a
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [ebp - 4], 2
mov eax, dword [esi + 0x64]
test eax, eax
je 0x424f3d
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [ebp - 4], 1
mov eax, dword [esi + 0x60]
test eax, eax
je 0x424f50
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [ebp - 4], 0
mov eax, dword [esi + 0x38]
test eax, eax
je 0x424f63
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [ebp - 4], 0xffffffff
mov esi, dword [esi + 0x34]
test esi, esi
je 0x424f79
mov eax, dword [esi]
mov ecx, dword [eax + 8]
push esi
call ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x425930
Capabilities:
Delete file
Set file attributes

Disassembly:
mov eax, dword [esi + 0x14]
push eax
call fcn.004e0a60
mov ecx, dword [esi + 0x1c]
push ecx
call fcn.004e0a60
mov eax, dword [esi + 0x10]
add esp, 8
cmp eax, 0xffffffff
je 0x42595f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x42595f
mov dword [esi + 0x10], 0xffffffff
cmp byte [esi], 0
je 0x42599e
push edi
mov edi, dword [esi + 4]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x42598a
xor al, al
test al, al
mov eax, dword [esi + 4]
sete dl
pop edi
push eax
mov byte [esi], dl
call fcn.004e0a60
pop ecx
ret
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
test al, al
sete dl
mov byte [esi], dl
pop edi
mov eax, dword [esi + 4]
push eax
call fcn.004e0a60
pop ecx
ret
Function at 0x425b60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ff4c8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
mov eax, dword [0x54c2c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [edi + 0x10]
or esi, 0xffffffff
cmp eax, esi
je 0x425b9f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x425c17
mov dword [edi + 0x10], esi
mov eax, dword [edi + 0x18]
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], esi
cmp eax, ecx
jbe 0x425be4
mov ecx, dword [edi + 0x14]
mov ebx, dword [ebp + 8]
call fcn.00426c30
test eax, eax
jne 0x425c1c
mov eax, dword [edi + 0x18]
mov edx, dword [edi + 0x14]
push 0x556a60
push eax
mov ecx, esi
call dword [0x553c48]
mov dword [ebp - 0x14], eax
mov eax, dword [edi + 0x18]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0
cmp byte [edi + 0x28], 0
je 0x425cc5
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov eax, dword [edi + 0x1c]
push eax
lea esi, [ebp - 0x10]
call fcn.00449f70
test al, al
jne 0x425c2f
mov eax, dword [ebp - 0x10]
cmp eax, 0xffffffff
je 0x425c17
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x80004005
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [edi + 0x34]
ja 0x425cb6
jb 0x425c41
mov edx, dword [ebp - 0x20]
cmp edx, dword [edi + 0x30]
jae 0x425cb6
mov eax, dword [edi + 0x14]
mov edx, dword [ebp - 0x10]
push 0
lea ecx, [ebp - 0x18]
push ecx
push 0x100000
push eax
push edx
mov dword [ebp - 0x18], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x425cfe
mov esi, dword [ebp - 0x18]
test esi, esi
je 0x425cb6
mov ecx, dword [edi + 0x14]
mov ebx, dword [ebp + 8]
mov eax, esi
call fcn.00426c30
mov ebx, eax
test ebx, ebx
jne 0x425d0b
mov edx, dword [edi + 0x14]
mov ecx, dword [ebp - 0x14]
push 0x556a60
push esi
call dword [0x553c48]
add dword [ebp - 0x20], esi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x1c]
adc eax, ebx
mov dword [ebp - 0x1c], eax
cmp eax, dword [edi + 0x34]
jb 0x425c41
ja 0x425cb6
mov eax, dword [ebp - 0x20]
cmp eax, dword [edi + 0x30]
jb 0x425c41
mov eax, dword [ebp - 0x10]
cmp eax, 0xffffffff
je 0x425cc5
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x14]
cmp dword [edi + 0x38], ecx
jne 0x425c17
mov edx, dword [ebp - 0x20]
cmp edx, dword [edi + 0x30]
jne 0x425c17
mov eax, dword [ebp - 0x1c]
cmp eax, dword [edi + 0x34]
jne 0x425c17
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea esi, [ebp - 0x10]
call fcn.00424530
jmp 0x425c17
lea esi, [ebp - 0x10]
call fcn.00424530
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x426c90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0
push ecx
push edx
push 0
push 0
call fcn.004e1cd8
mov ecx, dword [ebp + 8]
add esp, 0x18
mov dword [ecx], eax
test eax, eax
je 0x426cb9
xor eax, eax
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x426cc8
mov eax, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x42b730
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fd74f
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x54c2c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, edi
call fcn.00406150
lea esi, [edi + 0xc]
mov dword [ebp - 4], 0
call fcn.00406150
lea esi, [edi + 0x18]
mov byte [ebp - 4], 1
call fcn.00406150
lea esi, [edi + 0x24]
mov byte [ebp - 4], 2
call fcn.00406150
lea esi, [edi + 0x30]
mov byte [ebp - 4], 3
call fcn.00406150
mov byte [ebp - 4], 4
lea esi, [edi + 0x40]
mov byte [edi + 0x3c], 0
call fcn.00406150
lea esi, [edi + 0x4c]
mov byte [ebp - 4], 5
call fcn.00406150
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x42d710
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fd6f0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x54c2c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
lea edi, [esi + 0x3c]
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.CObjectVector_struct_CDirItem_.0
mov byte [ebp - 4], 3
mov eax, dword [edi + 8]
push eax
push ebx
mov ecx, edi
call dword [0x5173b4]
mov byte [ebp - 4], 2
mov ecx, dword [edi + 8]
push ecx
push ebx
mov ecx, edi
mov dword [edi], vtable.CBaseRecordVector.0
call dword [0x515848]
mov eax, dword [edi + 0xc]
push eax
call fcn.004e0a60
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov byte [ebp - 4], 1
mov edx, dword [esi + 0x30]
add esp, 4
push edx
push ebx
lea ecx, [esi + 0x28]
mov dword [esi + 0x28], vtable.CBaseRecordVector.0
call dword [0x515848]
mov eax, dword [esi + 0x34]
push eax
call fcn.004e0a60
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov byte [ebp - 4], bl
mov eax, dword [esi + 0x1c]
add esp, 4
push eax
push ebx
lea ecx, [esi + 0x14]
mov dword [esi + 0x14], vtable.CBaseRecordVector.0
call dword [0x515848]
mov eax, dword [esi + 0x20]
push eax
call fcn.004e0a60
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
add esp, 4
mov dword [esi], vtable.CObjectVector_class_CStringBase_wchar_t__.0
mov dword [ebp - 4], 4
mov ecx, dword [esi + 8]
push ecx
push ebx
mov ecx, esi
call dword [0x5162a4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [esi + 8]
push edx
push ebx
mov ecx, esi
mov dword [esi], vtable.CBaseRecordVector.0
call dword [0x515848]
mov eax, dword [esi + 0xc]
push eax
call fcn.004e0a60
add esp, 4
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x42e890
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fd74f
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x54c2c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
push edi
mov ecx, esi
call fcn.00406fd0
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
mov dword [ebp - 4], 0
call fcn.00406fd0
lea ecx, [edi + 0x18]
push ecx
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.00406fd0
lea edx, [edi + 0x24]
push edx
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call fcn.00406fd0
lea eax, [edi + 0x30]
push eax
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
call fcn.00406fd0
mov byte [ebp - 4], 4
mov cl, byte [edi + 0x3c]
lea edx, [edi + 0x40]
mov byte [esi + 0x3c], cl
push edx
lea ecx, [esi + 0x40]
call fcn.00406fd0
add edi, 0x4c
push edi
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 5
call fcn.00406fd0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4