joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42996c
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
xor eax, eax
mov dword [ebp - 4], eax
push 0
push 0x80
push 3
push 0
push 0
push SysReAllocStringLen
mov edx, dword [ebp + 8]
push edx
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4299a1
xor eax, eax
jmp 0x429a1e
push 0
push ebx
call sub.KERNEL32.DLL_GetFileSize
mov esi, eax
cmp esi, 0xffffffff
je 0x4299be
push esi
push 0x42
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [edi], eax
test eax, eax
jne 0x4299c8
push ebx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
jmp 0x429a1e
mov edx, dword [ebp + 0xc]
mov dword [edx], esi
mov ecx, dword [edi]
push ecx
call sub.KERNEL32.DLL_GlobalLock
test eax, eax
jne 0x4299eb
mov eax, dword [edi]
push eax
call sub.KERNEL32.DLL_GlobalFree
push ebx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
jmp 0x429a1e
push 0
lea edx, [ebp - 4]
push edx
push esi
push eax
push ebx
call sub.KERNEL32.DLL_ReadFile
mov esi, eax
mov ecx, dword [edi]
push ecx
call sub.KERNEL32.DLL_GlobalUnlock
push ebx
call sub.KERNEL32.DLL_CloseHandle
test esi, esi
jne 0x429a19
mov eax, dword [edi]
push eax
call sub.KERNEL32.DLL_GlobalFree
xor eax, eax
jmp 0x429a1e
mov eax, 1
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x42a3dc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
push eax
mov edx, dword [ebp + 8]
push edx
push 0
call sub.KERNEL32.DLL_FindResourceA
mov ebx, eax
test ebx, ebx
jne 0x42a3fc
xor eax, eax
jmp 0x42a466
push ebx
push 0
call sub.KERNEL32.DLL_LoadResource
mov esi, eax
test esi, esi
jne 0x42a40e
xor eax, eax
jmp 0x42a466
push esi
call sub.KERNEL32.DLL_LockResource
mov edi, eax
test edi, edi
jne 0x42a41e
xor eax, eax
jmp 0x42a466
push ebx
push 0
call sub.KERNEL32.DLL_SizeofResource
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
push edx
push 0x42
call sub.KERNEL32.DLL_GlobalAlloc
mov ebx, eax
test ebx, ebx
jne 0x42a444
push esi
call sub.KERNEL32.DLL_FreeResource
xor eax, eax
jmp 0x42a466
push ebx
call sub.KERNEL32.DLL_GlobalLock
mov edx, dword [ebp - 4]
push edx
push edi
push eax
call fcn.004f30c8
add esp, 0xc
push ebx
call sub.KERNEL32.DLL_GlobalUnlock
push esi
call sub.KERNEL32.DLL_FreeResource
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x42a46c
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0
push 0x80
push 3
push 0
push 0
push SysReAllocStringLen
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x42a499
xor eax, eax
jmp 0x42a4ec
push 0
push ebx
call sub.KERNEL32.DLL_GetFileSize
mov edi, eax
cmp edi, 0xffffffff
jne 0x42a4b2
push ebx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
jmp 0x42a4ec
push edi
push 0x42
call sub.KERNEL32.DLL_GlobalAlloc
mov esi, eax
test esi, esi
jne 0x42a4ca
push ebx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
jmp 0x42a4ec
push esi
call sub.KERNEL32.DLL_GlobalLock
push 0
lea edx, [ebp - 4]
push edx
push edi
push eax
push ebx
call sub.KERNEL32.DLL_ReadFile
push esi
call sub.KERNEL32.DLL_GlobalUnlock
push ebx
call sub.KERNEL32.DLL_CloseHandle
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x42c5b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
xor edx, edx
push ebx
push esi
push edi
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x10], edx
test eax, eax
je 0x42c5db
push eax
mov eax, dword [ebp + 0xc]
push eax
push esi
call fcn.0042aa64
add esp, 0xc
jmp 0x42c73d
push 0
call sub.GDI32.DLL_CreateCompatibleDC
mov edi, eax
push esi
push edi
call sub.GDI32.DLL_SelectObject
lea eax, [ebp - 0x64]
push eax
push 0x18
push esi
call sub.GDI32.DLL_GetObjectA
mov ax, 0x18
mov word [ebp - 0x52], ax
movzx edx, ax
imul edx, dword [ebp - 0x60]
add edx, 0x1f
test edx, edx
jns 0x42c610
add edx, 0x1f
sar edx, 5
shl edx, 2
mov dword [ebp - 0x58], edx
mov ecx, dword [ebp - 0x5c]
push ecx
call fcn.004fa584
imul dword [ebp - 0x58]
pop ecx
mov dword [ebp - 8], eax
mov word [ebp - 0x20], 0x4d42
mov eax, dword [ebp - 8]
add eax, 0x36
mov dword [ebp - 0x1e], eax
xor eax, eax
mov word [ebp - 0x1a], 0
mov word [ebp - 0x18], 0
mov dword [ebp - 0x16], 0x36
mov dword [ebp - 0x4c], 0x28
mov edx, dword [ebp - 0x60]
mov dword [ebp - 0x48], edx
xor edx, edx
mov ecx, dword [ebp - 0x5c]
mov dword [ebp - 0x44], ecx
xor ecx, ecx
mov word [ebp - 0x40], 1
mov word [ebp - 0x3e], 0x18
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], ecx
xor eax, eax
mov dword [ebp - 0x30], eax
xor edx, edx
mov dword [ebp - 0x2c], edx
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 8]
push eax
push 0x42
call sub.KERNEL32.DLL_GlobalAlloc
mov ebx, eax
test ebx, ebx
jne 0x42c6a1
mov eax, dword [ebp - 0x10]
jmp 0x42c73d
push ebx
call sub.KERNEL32.DLL_GlobalLock
mov dword [ebp - 4], eax
lea edx, [ebp - 0x4c]
push 0
push edx
mov ecx, dword [ebp - 4]
push ecx
mov eax, dword [ebp - 0x44]
push eax
push 0
push esi
push edi
call sub.GDI32.DLL_GetDIBits
push 0
push 0x8000080
push 2
push 0
push 0
push 0x40000000
mov edx, dword [ebp + 0xc]
push edx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x42c728
lea eax, [ebp - 0xc]
push 0
push eax
lea edx, [ebp - 0x20]
push 0xe
push edx
push esi
call sub.KERNEL32.DLL_WriteFile
lea ecx, [ebp - 0xc]
push 0
push ecx
lea eax, [ebp - 0x4c]
push 0x28
push eax
push esi
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 0xc]
push edx
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ebp - 4]
push eax
push esi
call sub.KERNEL32.DLL_WriteFile
push esi
call sub.KERNEL32.DLL_CloseHandle
mov dword [ebp - 0x10], 1
push ebx
call sub.KERNEL32.DLL_GlobalUnlock
push ebx
call sub.KERNEL32.DLL_GlobalFree
push edi
call sub.GDI32.DLL_DeleteDC
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4357c8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
push 0
push 0
call sub.KERNEL32.DLL_GetSystemDirectoryW
mov ebx, eax
test ebx, ebx
je 0x43582a
test esi, esi
je 0x4357ee
push esi
call fcn.00435730
pop ecx
inc eax
add ebx, eax
mov eax, ebx
add eax, eax
push eax
call fcn.004559a4
pop ecx
mov edi, eax
push ebx
push edi
call sub.KERNEL32.DLL_GetSystemDirectoryW
test esi, esi
je 0x435824
mov eax, ebx
dec eax
push eax
push 0x5a98c8
push edi
call fcn.00435780
add esp, 0xc
dec ebx
push ebx
push esi
push edi
call fcn.00435780
add esp, 0xc
mov eax, edi
jmp 0x435831
push esi
call fcn.0043574c
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x451c44
Capabilities:
Get system information on windows

Disassembly:
push ebx
push esi
add esp, 0xffffffdc
cmp dword [0x5d1040], 0
jne 0x451cb7
push esp
call sub.KERNEL32.DLL_GetSystemInfo
mov ebx, dword [esp + 4]
mov esi, dword [esp + 0x1c]
mov eax, esi
dec eax
test eax, esi
jne 0x451c6e
mov edx, ebx
dec edx
test edx, ebx
je 0x451c73
call fcn.004fc8f8
mov dword [0x5d1048], esi
mov dword [0x5d1044], ebx
mov dword [0x5d104c], 0x40000
mov eax, 5
mov dword [0x5d1050], 0x200000
mov dword [0x5d1054], eax
mov dword [0x5d1214], eax
call sub.KERNEL32.DLL_GetTickCount
xor eax, 0x55555555
or eax, 8
and eax, 0xfffffff8
mov dword [0x5d1040], eax
mov eax, 1
add esp, 0x24
pop esi
pop ebx
ret

Function at 0x455bc0
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff40
mov eax, dword [ebp + 8]
cmp eax, 0x69
jg 0x455c23
je 0x455cf7
cmp eax, 4
jg 0x455c00
je 0x455cb7
sub eax, 1
jb 0x455c5c
je 0x455c70
dec eax
je 0x455c8f
dec eax
je 0x455ca3
jmp case.0x455c31.1006
sub eax, 0x65
je 0x455cbe
dec eax
je 0x455cd5
dec eax
je 0x455cdc
dec eax
je 0x455cf3
jmp case.0x455c31.1006
add eax, 0xfffffc17
cmp eax, 8
ja case.0x455c31.1006
jmp dword [eax*4 + 0x455c38]
lea edx, [ebp - 0x20]
push edx
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [ebp - 0x14]
shr eax, 0xa
jmp 0x455d45
lea edx, [ebp - 0x40]
push edx
call sub.KERNEL32.DLL_GlobalMemoryStatus
cmp dword [ebp - 0x34], 0xffffffff
jae 0x455c84
mov eax, dword [ebp - 0x34]
jmp 0x455c87
or eax, 0xffffffff
shr eax, 0xa
jmp 0x455d45
lea edx, [ebp - 0x60]
push edx
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [ebp - 0x54]
shr eax, 0xa
jmp 0x455d45
lea edx, [ebp - 0x80]
push edx
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [ebp - 0x64]
shr eax, 0xa
jmp 0x455d45
xor eax, eax
jmp 0x455d45
lea edx, [ebp - 0xa0]
push edx
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [ebp - 0x98]
shr eax, 0xa
jmp 0x455d45
mov eax, 1
jmp 0x455d45
lea edx, [ebp - 0xc0]
push edx
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [ebp - 0xac]
shr eax, 0xa
jmp 0x455d45
xor eax, eax
jmp 0x455d45
xor eax, eax
jmp 0x455d45
call fcn.00455864
jmp 0x455d45
xor eax, eax
jmp 0x455d45
call fcn.0045586c
jmp 0x455d45
call fcn.0044eda4
jmp 0x455d45
call fcn.0044eda4
shl eax, 3
lea eax, [eax + eax*2]
jmp 0x455d45
mov eax, dword [0x5d0d3c]
sub eax, dword [0x5d0d44]
test eax, eax
jns 0x455d33
add eax, 3
sar eax, 2
jmp 0x455d45
xor eax, eax
jmp 0x455d45
mov eax, 1
jmp 0x455d45
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4561e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
jmp 0x456254
test edx, 0x10000
jne 0x456325
test edx, 0x20000
je 0x45620b
mov edx, dword [eax + 8]
push edx
mov eax, dword [eax + 0xc]
call dword [eax + 0x10]
pop ecx
pop ebp
ret
test byte [eax + 1], 0x40
jne 0x45624d
cmp dword [eax + 0xc], 0
jne 0x45624d
cmp dword [eax + 0x10], 0
jl 0x45624d
mov ecx, dword [eax + 8]
add ecx, 0xfffffff0
mov eax, ecx
movzx ecx, word [0x5ab85c]
movzx edx, word [eax + 0xe]
and edx, 0xfffffffd
cmp edx, ecx
jne 0x456325
xor word [eax + 0xe], 1
lea edx, [eax + 0x10]
push edx
mov eax, dword [eax + 8]
call dword [eax + 4]
pop ecx
pop ebp
ret
push eax
call fcn.0045991c
pop ecx
mov edx, dword [eax]
test dh, 0x20
jne 0x4561e8
test byte [eax + 1], 0x80
je 0x45628f
mov eax, dword [eax + 8]
add eax, 0xfffffff0
movzx ecx, word [eax + 0xe]
and ecx, 0xfffffffd
movzx edx, word [0x5ab85c]
cmp ecx, edx
jne 0x456325
xor word [eax + 0xe], 1
lea ecx, [eax + 0x10]
push ecx
mov eax, dword [eax + 8]
call dword [eax + 4]
pop ecx
pop ebp
ret
test byte [eax], 4
je 0x4562be
mov eax, dword [eax + 8]
add eax, 0xfffffff0
movzx edx, word [eax + 0xe]
and edx, 0xfffffffd
movzx ecx, word [0x5ab85c]
cmp edx, ecx
jne 0x456325
xor word [eax + 0xe], 1
lea edx, [eax + 0x10]
push edx
mov eax, dword [eax + 8]
call dword [eax + 4]
pop ecx
pop ebp
ret
test byte [eax + 1], 0x10
je 0x4562f0
mov ecx, dword [eax + 8]
add ecx, 0xfffffff0
mov eax, ecx
movzx ecx, word [0x5ab85c]
movzx edx, word [eax + 0xe]
and edx, 0xfffffffd
cmp edx, ecx
jne 0x456325
xor word [eax + 0xe], 1
lea edx, [eax + 0x10]
push edx
mov eax, dword [eax + 8]
call dword [eax + 4]
pop ecx
pop ebp
ret
test byte [eax], 1
je 0x456325
cmp dword [eax + 0xc], 0
je 0x456325
mov ecx, dword [eax + 8]
add ecx, 0xfffffff0
mov eax, ecx
movzx ecx, word [0x5ab85c]
movzx edx, word [eax + 0xe]
and edx, 0xfffffffd
cmp edx, ecx
jne 0x456325
xor word [eax + 0xe], 1
lea edx, [eax + 0x10]
push edx
mov eax, dword [eax + 8]
call dword [eax + 4]
pop ecx
pop ebp
ret
Function at 0x4688dc
Capabilities:
Generate random numbers via winapi

Disassembly:
add esp, 0xffffffe0
cmp dword [0x5ac4a8], 0
jne 0x468912
push 0xf0000040
push 1
push 0
push 0
push 0x5d1230
call sub.ADVAPI32.DLL_CryptAcquireContextW
test eax, eax
jne 0x468912
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x80090016
je 0x468912
or eax, 0xffffffff
jmp 0x468956
mov dword [0x5ac4a8], 1
push esp
push 0x20
mov edx, dword [0x5d1230]
push edx
call sub.ADVAPI32.DLL_CryptGenRandom
test eax, eax
jne 0x468934
or eax, 0xffffffff
jmp 0x468956
push 0x20
lea edx, [esp + 4]
push edx
call fcn.00468880
add esp, 8
push 0x20
push 0
lea ecx, [esp + 8]
push ecx
call fcn.004f315c
add esp, 0xc
xor eax, eax
add esp, 0x20
ret

Function at 0x4688f1
Capabilities:
Generate random numbers via winapi

Disassembly:
add esp, 0xffffffe0
cmp dword [0x5ac4a8], 0
jne 0x468912
push 0xf0000040
push 1
push 0
push 0
push 0x5d1230
call sub.ADVAPI32.DLL_CryptAcquireContextW
test eax, eax
jne 0x468912
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x80090016
je 0x468912
or eax, 0xffffffff
jmp 0x468956
mov dword [0x5ac4a8], 1
push esp
push 0x20
mov edx, dword [0x5d1230]
push edx
call sub.ADVAPI32.DLL_CryptGenRandom
test eax, eax
jne 0x468934
or eax, 0xffffffff
jmp 0x468956
push 0x20
lea edx, [esp + 4]
push edx
call fcn.00468880
add esp, 8
push 0x20
push 0
lea ecx, [esp + 8]
push ecx
call fcn.004f315c
add esp, 0xc
xor eax, eax
add esp, 0x20
ret
Function at 0x475944
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf0
mov ebx, esp
xor esi, esi
mov ebp, 0x108
push ebx
push ebp
call sub.KERNEL32.DLL_GetCurrentDirectoryW
mov edi, eax
cmp ebp, edi
jae 0x47597c
mov ebp, edi
mov eax, ebp
add eax, eax
push eax
call fcn.004559a4
pop ecx
mov ebx, eax
push ebx
push ebp
call sub.KERNEL32.DLL_GetCurrentDirectoryW
mov edi, eax
push 0
test edi, edi
setne al
and eax, 1
push eax
call fcn.00477fc0
add esp, 8
cmp edi, 2
jb 0x4759ca
cmp ebp, edi
jbe 0x4759ca
cmp word [ebx + 2], 0x3a
jne 0x4759ca
mov ax, word [ebx]
cmp ax, 0x61
jb 0x4759b6
cmp ax, 0x7a
ja 0x4759b6
movzx esi, word [ebx]
sub esi, 0x20
jmp 0x4759b9
movzx esi, word [ebx]
cmp esi, 0x41
jl 0x4759c8
cmp esi, 0x5a
jg 0x4759c8
sub esi, 0x41
jmp 0x4759ca
xor esi, esi
mov eax, esp
cmp ebx, eax
je 0x4759d7
push ebx
call fcn.00455a78
pop ecx
mov eax, esi
add esp, 0x210
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4759e4
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov eax, dword [ebp + 8]
test eax, eax
jl 0x475a37
cmp eax, 0x19
jg 0x475a37
add ax, 0x41
mov word [ebp - 8], ax
mov word [ebp - 6], 0x3a
mov word [ebp - 4], 0
push 1
call sub.KERNEL32.DLL_SetErrorMode
mov esi, eax
lea eax, [ebp - 8]
push eax
call sub.KERNEL32.DLL_SetCurrentDirectoryW
test eax, eax
push esi
setne bl
and ebx, 1
call sub.KERNEL32.DLL_SetErrorMode
push 0
push ebx
call fcn.00477fc0
add esp, 8
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x475df4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.004377e4
mov eax, dword [ebp + 8]
push eax
call fcn.00475bb8
mov edi, eax
pop ecx
xor eax, eax
lea edx, [ebp - 4]
mov dword [ebp - 4], eax
push 0
push 0
push 0
push 0
push 0
push edx
push edi
call sub.KERNEL32.DLL_GetNamedPipeHandleStateW
test eax, eax
je 0x475f06
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004c6a34
add esp, 8
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
xor esi, esi
test byte [ebp - 4], 1
jne 0x475e62
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x10]
or eax, 1
mov dword [ebp - 0x10], eax
push 0
push 0
push edx
push edi
call sub.KERNEL32.DLL_SetNamedPipeHandleState
xor ebx, ebx
test esi, esi
je 0x475e6d
call fcn.00484d04
mov esi, dword [ebp + 0x10]
sub esi, ebx
cmp esi, 0x1000
jbe 0x475e7f
mov esi, 0x1000
push 0
lea eax, [ebp - 0x14]
push eax
push esi
mov edx, dword [ebp + 0xc]
add edx, ebx
push edx
push edi
call sub.KERNEL32.DLL_WriteFile
test eax, eax
setne cl
and ecx, 1
mov esi, ecx
test esi, esi
je 0x475ea5
add ebx, dword [ebp - 0x14]
jmp 0x475eac
test ebx, ebx
jne 0x475eac
or ebx, 0xffffffff
push 0
push esi
call fcn.00477fc0
add esp, 8
test esi, esi
je 0x475ef0
cmp ebx, dword [ebp + 0x10]
jae 0x475ef0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004c6a54
add esp, 0xc
mov dword [ebp + 0x14], eax
mov dword [ebp + 0x18], edx
cmp edx, 0
jne 0x475ee0
cmp eax, 0
je 0x475ef0
call fcn.00441a74
test ax, ax
je 0x475e64
test byte [ebp - 4], 1
jne 0x475f15
push 0
lea ecx, [ebp - 4]
push 0
push ecx
push edi
call sub.KERNEL32.DLL_SetNamedPipeHandleState
jmp 0x475f15
push 0
push 0
call fcn.00477fc0
add esp, 8
or ebx, 0xffffffff
call fcn.004377e0
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4762e8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
call fcn.004377e4
mov eax, dword [ebp + 0xc]
xor edx, edx
mov dword [eax], edx
xor ebx, ebx
mov eax, dword [ebp + 8]
push eax
call fcn.004779ec
pop ecx
mov esi, eax
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
mov edi, eax
cmp edi, 0xffffffff
je 0x476326
push edi
call fcn.004c6ae0
pop ecx
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov ebx, 1
push 0
push ebx
call fcn.00477fc0
add esp, 8
test esi, esi
je 0x47633c
push esi
call fcn.00455a78
pop ecx
call fcn.004377e0
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x476348
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 8]
push edx
lea ecx, [ebp - 4]
push ecx
push edi
call fcn.004c5434
add esp, 0x10
lea eax, [ebp - 0x1c]
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x14]
push eax
push edx
push ecx
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp + 0x10]
push edx
call fcn.004c5a08
add esp, 0x14
call fcn.004377e4
push 0x42
mov ecx, dword [ebp + 8]
push ecx
call fcn.00475f64
add esp, 8
mov esi, eax
cmp esi, 0xffffffff
setne bl
and ebx, 1
test ebx, ebx
je 0x476465
test edi, edi
jle 0x4763b5
cmp dword [ebp + 0x10], 0
jge 0x4763c0
lea eax, [ebp - 0x3c]
push eax
call sub.KERNEL32.DLL_GetLocalTime
jmp 0x4763d0
push 0x10
push 0
lea edx, [ebp - 0x3c]
push edx
call fcn.004f315c
add esp, 0xc
test edi, edi
jle 0x4763ec
mov cx, word [ebp - 4]
mov word [ebp - 0x3c], cx
mov ax, word [ebp - 8]
mov word [ebp - 0x3a], ax
mov dx, word [ebp - 0xc]
mov word [ebp - 0x36], dx
cmp dword [ebp + 0x10], 0
jl 0x476412
mov cx, word [ebp - 0x10]
mov word [ebp - 0x34], cx
mov ax, word [ebp - 0x14]
mov word [ebp - 0x32], ax
mov dx, word [ebp - 0x18]
mov word [ebp - 0x30], dx
mov cx, word [ebp - 0x1c]
mov word [ebp - 0x2e], cx
lea eax, [ebp - 0x24]
push eax
lea edx, [ebp - 0x3c]
push edx
call sub.KERNEL32.DLL_SystemTimeToFileTime
test eax, eax
je 0x476451
lea ecx, [ebp - 0x2c]
push ecx
lea eax, [ebp - 0x24]
push eax
call sub.KERNEL32.DLL_LocalFileTimeToFileTime
lea edx, [ebp - 0x2c]
push edx
lea ecx, [ebp - 0x2c]
push ecx
push 0
push esi
call fcn.00475a40
pop ecx
push eax
call sub.KERNEL32.DLL_SetFileTime
test eax, eax
setne bl
and ebx, 1
jmp 0x476453
xor ebx, ebx
push 0
push ebx
call fcn.00477fc0
add esp, 8
push esi
call fcn.00476024
pop ecx
call fcn.004377e0
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x476474
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
call fcn.004377e4
xor ebx, ebx
mov eax, dword [ebp + 8]
push eax
call fcn.004779ec
pop ecx
mov dword [ebp - 4], eax
test esi, 1
mov edi, eax
je 0x47649f
or ebx, 1
test esi, 2
je 0x4764aa
or ebx, 2
test esi, 4
je 0x4764b5
or ebx, 4
test esi, 0x20
je 0x4764c0
or ebx, 0x20
test ebx, ebx
jne 0x4764c9
mov ebx, 0x80
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_SetFileAttributesW
test eax, eax
setne dl
and edx, 1
mov ebx, edx
push 0
push ebx
call fcn.00477fc0
add esp, 8
test edi, edi
je 0x4764f3
push edi
call fcn.00455a78
pop ecx
call fcn.004377e0
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x476558
Capabilities:
Clear file content
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
xor ebx, ebx
call fcn.004377e4
test di, di
je 0x47659f
movzx ecx, di
xor eax, eax
lea edx, [ebp - 4]
mov dword [ebp - 4], eax
push 0
push edx
push ecx
mov eax, dword [ebp + 0xc]
push eax
push esi
call fcn.00475a40
pop ecx
push eax
call sub.KERNEL32.DLL_WriteFile
test eax, eax
je 0x47659b
mov bx, word [ebp - 4]
jmp 0x4765ac
xor ebx, ebx
jmp 0x4765ac
push esi
call fcn.00475a40
pop ecx
push eax
call sub.KERNEL32.DLL_SetEndOfFile
push 0
test eax, eax
setne al
and eax, 1
push eax
call fcn.00477fc0
add esp, 8
call fcn.004377e0
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4765cc
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
call fcn.004377e4
push 0
lea eax, [ebp - 4]
push eax
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
mov eax, dword [ebp + 8]
push eax
call fcn.00475a40
pop ecx
push eax
call sub.KERNEL32.DLL_ReadFile
test eax, eax
je 0x4765fd
mov ebx, dword [ebp - 4]
jmp 0x4765ff
xor ebx, ebx
push 0
test eax, eax
setne al
and eax, 1
push eax
call fcn.00477fc0
add esp, 8
call fcn.004377e0
mov eax, ebx
pop ebx
pop ecx
pop ebp
ret

Function at 0x476620
Capabilities:
Clear file content
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
xor ebx, ebx
call fcn.004377e4
test edi, edi
je 0x47666c
push 0
lea eax, [ebp - 4]
push eax
push edi
mov edx, dword [ebp + 0xc]
push edx
push esi
call fcn.00475a40
pop ecx
push eax
call sub.KERNEL32.DLL_WriteFile
test eax, eax
je 0x476657
mov ebx, dword [ebp - 4]
push 0
test eax, eax
setne al
and eax, 1
push eax
call fcn.00477fc0
add esp, 8
jmp 0x47668c
push 0
push esi
call fcn.00475a40
pop ecx
push eax
call sub.KERNEL32.DLL_SetEndOfFile
test eax, eax
setne dl
and edx, 1
push edx
call fcn.00477fc0
add esp, 8
call fcn.004377e0
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x47669c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
call fcn.004377e4
call fcn.004cafe0
test eax, eax
je 0x476714
xor eax, eax
mov dword [ebp - 4], eax
push 0x14
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.004f315c
mov eax, dword [ebp + 0x14]
add esp, 0xc
and eax, 0xffffffff
lea ecx, [ebp - 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov edx, eax
mov dword [ebp - 0x14], eax
sar edx, 0x1f
push 0
lea edx, [ebp - 0x20]
push edx
push ecx
mov eax, dword [ebp + 0x10]
push eax
push edi
push esi
call fcn.00475a40
pop ecx
push eax
call sub.KERNEL32.DLL_ReadFile
test eax, eax
setne dl
and edx, 1
push edx
call fcn.00477fc0
add esp, 8
mov ebx, dword [ebp - 4]
jmp 0x47678e
mov eax, dword [ebp + 0x14]
mov ebx, eax
mov eax, dword [ebp + 0x18]
and ebx, 0xffffffff
mov edx, eax
sar edx, 0x1f
mov dword [ebp - 8], eax
lea edx, [ebp - 8]
push 0
push edx
push ebx
push esi
call fcn.00475a40
pop ecx
push eax
call sub.KERNEL32.DLL_SetFilePointer
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x47675b
call sub.KERNEL32.DLL_GetLastError
test eax, eax
je 0x47675b
push 0
push 0
call fcn.00477fc0
add esp, 8
xor ebx, ebx
jmp 0x47678e
xor eax, eax
lea edx, [ebp - 0xc]
mov dword [ebp - 0xc], eax
push 0
push 0
push edx
mov ecx, dword [ebp + 0x10]
push ecx
push edi
push esi
call fcn.00475a40
pop ecx
push eax
call sub.KERNEL32.DLL_ReadFile
test eax, eax
setne al
and eax, 1
push eax
call fcn.00477fc0
add esp, 8
mov ebx, dword [ebp - 0xc]
call fcn.004377e0
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret