joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422c90
Capabilities:
Check for peb beingdebugged flag
Check if file exists
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x486dab
mov eax, dword fs:[0]
push eax
sub esp, 0xec
mov eax, dword [0x4a5584]
xor eax, esp
mov dword [esp + 0xe8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4a5584]
xor eax, esp
push eax
lea eax, [esp + 0x100]
mov dword fs:[0], eax
mov eax, dword [0x4aedec]
mov ecx, dword [eax]
push 0x4aedec
mov dword [esp + 0x30], vtable._BaseModule::CAutoLocker.0
mov dword [esp + 0x34], 0x4aedec
call ecx
xor edi, edi
mov dword [esp + 0x108], edi
mov eax, dword [0x4aee20]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x422d00
sub eax, edx
sar eax, 1
lea esi, [eax + 1]
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004517e0
add esi, esi
push esi
mov ebp, eax
push edi
push ebp
call fcn.00458270
add esp, 0x10
shr esi, 1
mov ecx, esi
je 0x422d53
cmp ecx, 0x7fffffff
ja 0x422d53
mov eax, dword [0x4aee20]
mov edx, ebp
call fcn.00401290
push ebp
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push ebp
call esi
test eax, eax
jne 0x422d70
push edi
push ebp
push edi
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push ebp
call esi
test eax, eax
je 0x422e92
xor eax, eax
lea ecx, [esp + 0x18]
push ecx
mov word [esp + 0x1c], ax
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], eax
mov dword [esp + 0x26], eax
mov word [esp + 0x2a], ax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0xc6
lea eax, [esp + 0x3a]
xor edx, edx
push edi
push eax
mov word [esp + 0x40], dx
call fcn.00458270
movzx ecx, word [esp + 0x30]
movzx edx, word [esp + 0x2e]
movzx eax, word [esp + 0x2c]
push ecx
movzx ecx, word [esp + 0x2e]
push edx
movzx edx, word [esp + 0x2e]
push eax
movzx eax, word [esp + 0x30]
push ecx
push edx
push eax
push str._04d__02d__02d__02d:_02d:_02d
lea ecx, [esp + 0x5c]
push 0x400
push ecx
call fcn.00423040
mov edx, dword [0x4aee20]
push 0x49a18c
push edx
call fcn.00451b52
mov ebx, eax
add esp, 0x38
test ebx, ebx
je 0x422e92
mov dword [esp + 0x28], 1
cmp dword [0x4aee24], edi
je 0x422e34
lea eax, [esp + 0x34]
push eax
push 0x49a190
push ebx
call fcn.00455e98
add esp, 0xc
mov dword [0x4aee24], edi
mov eax, dword [0x4aee18]
mov edi, eax
sub edi, dword [0x4aee14]
xor esi, esi
sar edi, 2
test edi, edi
jle 0x422e7f
jmp 0x422e55
mov eax, dword [0x4aee18]
sub eax, dword [0x4aee14]
sar eax, 2
cmp esi, eax
jb 0x422e67
call fcn.00452c03
mov ecx, dword [0x4aee14]
mov eax, dword [ecx + esi*4]
push eax
push ebx
call fcn.00455e98
inc esi
add esp, 8
cmp esi, edi
jl 0x422e50
push ebx
call fcn.004560b6
push ebx
call fcn.0045349e
mov edi, dword [esp + 0x30]
add esp, 8
test ebp, ebp
je 0x422e9f
push ebp
call fcn.00452cef
add esp, 4
mov ecx, 0x4aede8
call fcn.00422bd0
mov dword [esp + 0x108], 0xffffffff
mov edx, dword [0x4aedec]
mov eax, dword [edx + 4]
push 0x4aedec
call eax
mov eax, edi
mov ecx, dword [esp + 0x100]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xe8]
xor ecx, esp
call fcn.00451a7d
add esp, 0xf8
ret
Function at 0x423360
Capabilities:
Link many functions at runtime

Disassembly:
cmp dword [esi], 0
jne 0x4233c5
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi], eax
test eax, eax
je 0x4233dd
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.HttpInit
push eax
call edi
mov ecx, dword [esi]
push str.HttpUninit
push ecx
mov dword [esi + 4], eax
call edi
mov edx, dword [esi]
push str.zlib_uncompress
push edx
mov dword [esi + 8], eax
call edi
mov dword [esi + 0x10], eax
mov eax, dword [esi]
push str.zlib_compress
push eax
call edi
mov ecx, dword [esi]
push str.zlib_compressBound
push ecx
mov dword [esi + 0x14], eax
call edi
mov dword [esi + 0x18], eax
mov eax, dword [esi + 4]
pop edi
test eax, eax
je 0x4233c5
call eax
mov dword [esi + 0xc], eax
cmp dword [esi + 8], 0
je 0x4233dd
cmp dword [esi + 4], 0
je 0x4233dd
cmp dword [esi + 0xc], 0
je 0x4233dd
mov eax, 1
ret
xor eax, eax
ret

Function at 0x423540
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x74
mov eax, dword [0x4a5584]
xor eax, esp
mov dword [esp + 0x70], eax
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
push esi
mov dword [edi + 0xc], eax
cmp ecx, eax
jne 0x423570
pop esi
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00451a7d
add esp, 0x74
ret
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov eax, dword [esp + 0x7c]
push ecx
lea esi, [esp + 0xc]
mov dword [esp + 0x14], 0x67452301
mov dword [esp + 0x18], 0xefcdab89
mov dword [esp + 0x1c], 0x98badcfe
mov dword [esp + 0x20], 0x10325476
call fcn.00423d80
add esp, 4
mov eax, esi
call fcn.00423e90
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x68]
mov dword [edi], eax
mov eax, dword [esp + 0x6c]
mov dword [edi + 4], ecx
mov ecx, dword [esp + 0x74]
pop esi
mov dword [edi + 8], edx
mov dword [edi + 0xc], eax
xor ecx, esp
mov eax, 1
call fcn.00451a7d
add esp, 0x74
ret
Function at 0x423fc0
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create two anonymous pipes

Disassembly:
sub esp, 0x464
mov eax, dword [0x4a5584]
xor eax, esp
mov dword [esp + 0x460], eax
push ebx
push ebp
push edi
push 0
lea eax, [esp + 0x10]
push eax
lea ebp, [esi + 0xc]
push ebp
lea edi, [esi + 8]
push edi
mov ebx, ecx
mov dword [esp + 0x1c], 0xc
mov dword [esp + 0x24], 1
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x42416e
mov ecx, dword [edi]
push 0
push 1
push ecx
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
push 0
lea edx, [esp + 0x10]
push edx
lea edi, [esi + 4]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x42416e
mov eax, dword [edi]
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
xor eax, eax
lea edi, [esi + 0x10]
mov dword [edi], eax
push 0x44
mov dword [edi + 4], eax
push eax
lea ecx, [esp + 0x20]
mov dword [edi + 8], eax
push ecx
mov dword [edi + 0xc], eax
call fcn.00458270
mov eax, dword [ebp]
mov edx, dword [esi]
or dword [esp + 0x50], 0x101
mov dword [esp + 0x64], eax
mov dword [esp + 0x60], eax
xor eax, eax
push 0x208
push eax
lea ecx, [esp + 0x278]
push ecx
mov dword [esp + 0x30], 0x44
mov dword [esp + 0x68], edx
mov word [esp + 0x60], ax
call fcn.00458270
push 0x4944b4
push ebx
push str.__s___s
lea edx, [esp + 0x288]
push 0x208
push edx
call fcn.00423040
push 0x208
lea eax, [esp + 0x8c]
push 0
push eax
call fcn.00458270
add esp, 0x38
push ebx
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x42411d
lea eax, [esp + 0x5c]
mov ecx, eax
mov edx, 0x104
sub ebx, ecx
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x424106
movzx ecx, word [ebx + eax]
test cx, cx
je 0x424106
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x4240e6
jmp 0x42410a
test edx, edx
jne 0x42410d
sub eax, 2
xor edx, edx
mov word [eax], dx
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push edi
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x64]
push edx
push 0
push 0
push 1
push 0
push 0
lea eax, [esp + 0x284]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x424170
mov ecx, dword [edi]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.USER32.dll_WaitForInputIdle]
pop edi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x460]
xor ecx, esp
call fcn.00451a7d
add esp, 0x464
ret
xor eax, eax
mov ecx, dword [esp + 0x46c]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.00451a7d
add esp, 0x464
ret
Function at 0x424190
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esi]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4241a6
push eax
call edi
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x4241b7
push eax
call edi
mov dword [esi + 4], 0
mov eax, dword [esi + 8]
test eax, eax
je 0x4241c8
push eax
call edi
mov dword [esi + 8], 0
mov eax, dword [esi + 0xc]
test eax, eax
je 0x4241d9
push eax
call edi
mov dword [esi + 0xc], 0
mov eax, dword [esi + 0x10]
test eax, eax
je 0x424219
push 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4241ff
mov eax, dword [esi + 0x10]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [esi + 0x10]
push ecx
call edi
mov edx, dword [esi + 0x14]
push edx
call edi
xor eax, eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov eax, 1
pop edi
ret

Function at 0x424220
Capabilities:
Check for time delay via gettickcount
Read file on windows
Read pipe

Disassembly:
mov eax, 0x100c
call fcn.0046ad70
mov eax, dword [0x4a5584]
xor eax, esp
mov dword [esp + 0x1008], eax
cmp dword [edi], 0
push esi
mov esi, ecx
je 0x424252
cmp dword [edi + 4], 0
je 0x424252
cmp dword [edi + 8], 0
je 0x424252
cmp dword [edi + 0xc], 0
jne 0x42426c
xor eax, eax
pop esi
mov ecx, dword [esp + 0x1008]
xor ecx, esp
call fcn.00451a7d
add esp, 0x100c
ret 4
push ebp
call fcn.004054d0
push 0x1000
lea eax, [esp + 0x14]
push 0
push eax
mov dword [esp + 0x14], 0
call fcn.00458270
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [esp + 0xc], eax
mov edi, edi
mov eax, dword [edi + 8]
push 0
push 0
lea ecx, [esp + 0x10]
push ecx
push 0x1000
lea edx, [esp + 0x20]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x4242c8
cmp dword [esp + 8], 0
ja 0x42433a
mov edx, dword [esi]
mov eax, dword [edx - 0xc]
test eax, eax
je 0x4242ea
lea ecx, [eax - 1]
test ecx, ecx
jl 0x42437e
cmp ecx, eax
jg 0x42437e
cmp byte [edx + ecx], 0x3e
je 0x424311
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0xc]
cmp eax, dword [esp + 0x1018]
ja 0x424311
push 0x14
test ebx, ebx
je 0x42432f
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x4242a0
mov ecx, dword [esp + 0x1010]
pop ebp
pop esi
xor ecx, esp
mov eax, 1
call fcn.00451a7d
add esp, 0x100c
ret 4
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4242a0
cmp dword [edi], 0
je 0x424311
cmp dword [edi + 4], 0
je 0x424311
mov eax, dword [edi + 8]
test eax, eax
je 0x424311
cmp dword [edi + 0xc], 0
je 0x424311
push 0
lea ecx, [esp + 0xc]
push ecx
push 0x1000
lea edx, [esp + 0x1c]
push edx
push eax
call ebp
test eax, eax
je 0x424311
mov edx, dword [esp + 8]
lea eax, [esp + 0x10]
push eax
push esi
call fcn.004246b0
jmp 0x4242a0
push 0x80070057
call fcn.00401000
int3
Function at 0x424390
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
xor ebx, ebx
cmp dword [esi], ebx
je 0x4243a7
cmp dword [esi + 4], ebx
je 0x4243a7
cmp dword [esi + 8], ebx
je 0x4243a7
cmp dword [esi + 0xc], ebx
jne 0x4243ae
xor eax, eax
pop ebx
pop ecx
ret 4
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
push edi
mov edi, dword [ecx - 0xc]
mov dword [esp + 8], ebx
cmp edi, ebx
jbe 0x424402
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [esi], 0
mov edx, dword [esp + 0x14]
mov ecx, dword [edx]
je 0x424401
mov eax, dword [esi + 4]
test eax, eax
je 0x424401
cmp dword [esi + 8], 0
je 0x424401
cmp dword [esi + 0xc], 0
je 0x424401
push 0
lea edx, [esp + 0x10]
push edx
push edi
add ecx, ebx
push ecx
push eax
call ebp
test eax, eax
je 0x424401
mov eax, dword [esp + 0xc]
add ebx, eax
sub edi, eax
jne 0x4243c7
pop ebp
pop edi
mov eax, 1
pop ebx
pop ecx
ret 4

Function at 0x42510d
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
push 9
pop ecx
push str.GetNativeSystemInfo
xor eax, eax
lea edi, [ebp - 0x30]
push str.kernel32.dll
xor esi, esi
mov dword [ebp - 0xc], 1
mov dword [ebp - 4], 0x118
xor ebx, ebx
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edi, edi
cmp eax, edi
je 0x425157
lea ecx, [ebp - 0x30]
push ecx
call eax
jmp 0x425161
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x30], 9
je 0x42516f
cmp word [ebp - 0x30], 6
jne 0x425179
cmp dword [ebp + 0x10], edi
je 0x425179
mov esi, 0x100
lea eax, [ebp - 8]
push eax
or esi, 0x20019
push esi
push edi
push dword [ebp + 8]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, edi
jne 0x4251d0
push dword [ebp - 4]
call fcn.004517e0
mov ebx, eax
pop ecx
cmp ebx, edi
je 0x4251d0
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
cmp esi, edi
jne 0x4251d0
push dword [ebp + 0x14]
mov eax, ebx
call fcn.0040d700
xor esi, esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, edi
je 0x4251e4
push ebx
call fcn.00452cef
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4252b1
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push ebx
xor edi, edi
inc edi
push edi
lea eax, [ebp - 1]
push edi
push eax
call fcn.00452f9a
add esp, 0x10
cmp eax, edi
jne 0x4252d6
movzx esi, byte [ebp - 1]
xor eax, eax
jmp 0x4252e4
push ebx
call fcn.004566cd
mov esi, dword [ebp - 8]
neg eax
pop ecx
sbb eax, eax
mov dword [ebp - 8], esi
test eax, eax
jne 0x42531f
push ebx
push edi
lea eax, [ebp - 1]
push edi
push eax
call fcn.00452f9a
add esp, 0x10
cmp eax, edi
jne 0x425311
movzx esi, byte [ebp - 1]
mov ecx, dword [ebp + 8]
shl esi, 8
xor eax, eax
add esi, dword [ebp - 8]
mov dword [ecx], esi
jmp 0x425325
push ebx
call fcn.004566cd
pop ecx
test eax, eax
je 0x425302
or eax, 0xffffffff
mov ecx, dword [ebp + 8]
and dword [ecx], 0
pop edi
pop esi
leave
ret

Function at 0x425329
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push ebx
xor edi, edi
inc edi
push edi
lea eax, [ebp - 1]
push edi
push eax
call fcn.00452f9a
add esp, 0x10
cmp eax, edi
jne 0x42534e
movzx esi, byte [ebp - 1]
xor eax, eax
jmp 0x42535c
push ebx
call fcn.004566cd
mov esi, dword [ebp - 8]
neg eax
pop ecx
sbb eax, eax
mov dword [ebp - 8], esi
test eax, eax
jne 0x425389
push ebx
push edi
lea eax, [ebp - 1]
push edi
push eax
call fcn.00452f9a
add esp, 0x10
cmp eax, edi
jne 0x42537e
movzx esi, byte [ebp - 1]
xor eax, eax
jmp 0x425389
push ebx
call fcn.004566cd
neg eax
pop ecx
sbb eax, eax
mov ecx, esi
shl ecx, 8
add dword [ebp - 8], ecx
test eax, eax
jne 0x4253bb
push ebx
push edi
lea eax, [ebp - 1]
push edi
push eax
call fcn.00452f9a
add esp, 0x10
cmp eax, edi
jne 0x4253b0
movzx esi, byte [ebp - 1]
xor eax, eax
jmp 0x4253bb
push ebx
call fcn.004566cd
neg eax
pop ecx
sbb eax, eax
mov ecx, esi
shl ecx, 0x10
add dword [ebp - 8], ecx
test eax, eax
jne 0x4253fb
push ebx
push edi
lea eax, [ebp - 1]
push edi
push eax
call fcn.00452f9a
add esp, 0x10
cmp eax, edi
jne 0x4253ed
movzx esi, byte [ebp - 1]
mov ecx, dword [ebp + 8]
shl esi, 0x18
xor eax, eax
add esi, dword [ebp - 8]
mov dword [ecx], esi
jmp 0x425401
push ebx
call fcn.004566cd
pop ecx
test eax, eax
je 0x4253de
or eax, 0xffffffff
mov ecx, dword [ebp + 8]
and dword [ecx], 0
pop edi
pop esi
leave
ret
Function at 0x425405
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 0xc], 0
push esi
push 2
push 0
push dword [ebp + 8]
mov esi, 0xffff
mov dword [ebp - 4], esi
call fcn.00453351
add esp, 0xc
test eax, eax
je 0x425432
xor eax, eax
jmp 0x425501
push dword [ebp + 8]
call fcn.00453259
pop ecx
mov dword [ebp - 0x10], eax
cmp eax, esi
jae 0x425445
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, 0x404
push edi
call fcn.004520c5
mov ebx, eax
pop ecx
test ebx, ebx
je 0x4254ff
push 4
pop eax
cmp dword [ebp - 4], eax
jbe 0x4254f5
jmp 0x425473
mov eax, dword [ebp - 8]
mov edi, 0x404
mov ecx, dword [ebp - 4]
add eax, 0x400
mov dword [ebp - 8], ecx
cmp eax, ecx
ja 0x425485
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
mov esi, eax
sub esi, dword [ebp - 8]
sub eax, esi
cmp eax, edi
ja 0x425495
mov edi, eax
push 0
push esi
push dword [ebp + 8]
call fcn.00453351
add esp, 0xc
test eax, eax
jne 0x4254f5
push dword [ebp + 8]
push 1
push edi
push ebx
call fcn.00452f9a
add esp, 0x10
cmp eax, 1
jne 0x4254f5
lea eax, [edi - 3]
jmp 0x4254dc
dec eax
cmp byte [eax + ebx], 0x50
jne 0x4254dc
cmp byte [eax + ebx + 1], 0x4b
jne 0x4254dc
cmp byte [eax + ebx + 2], 5
jne 0x4254dc
cmp byte [eax + ebx + 3], 6
je 0x4254e2
test eax, eax
jg 0x4254c0
jmp 0x4254e9
add eax, esi
mov dword [ebp - 0xc], eax
jne 0x4254f5
mov eax, dword [ebp - 4]
cmp dword [ebp - 8], eax
jb 0x42546b
push ebx
call fcn.00451fa8
mov eax, dword [ebp - 0xc]
pop ecx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x425c26
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
cmp eax, ebx
jne 0x425c41
push 0xffffffffffffff9a
pop eax
jmp 0x425d97
push esi
mov esi, dword [eax + 0x7c]
cmp esi, ebx
jne 0x425c4d
push 0xffffffffffffff9a
jmp 0x425c53
cmp dword [esi], ebx
jne 0x425c59
push 0xffffffffffffff9c
pop eax
jmp 0x425d96
mov eax, dword [ebp + 8]
mov ecx, dword [esi + 0x5c]
mov dword [esi + 0x10], eax
mov eax, 0x8000
mov dword [esi + 0x14], eax
cmp ecx, eax
jae 0x425c71
mov dword [esi + 0x14], ecx
push edi
cmp dword [esi + 0x14], ebx
jbe 0x425d84
jmp 0x425c7f
xor ebx, ebx
cmp dword [esi + 8], ebx
jne 0x425ce0
mov eax, dword [esi + 0x58]
cmp eax, ebx
jbe 0x425ce0
mov edi, 0x4000
cmp eax, edi
jae 0x425c9e
mov edi, eax
cmp edi, ebx
je 0x425d89
mov eax, dword [esi + 0x68]
add eax, dword [esi + 0x3c]
push ebx
push eax
push dword [esi + 0x60]
call fcn.00453351
add esp, 0xc
test eax, eax
jne 0x425d8d
push dword [esi + 0x60]
push 1
push edi
push dword [esi]
call fcn.00452f9a
add esp, 0x10
cmp eax, 1
jne 0x425d8d
mov eax, dword [esi]
add dword [esi + 0x3c], edi
sub dword [esi + 0x58], edi
mov dword [esi + 4], eax
mov dword [esi + 8], edi
cmp dword [esi + 0x64], ebx
jne 0x425d34
mov eax, dword [esi + 0x14]
mov edi, dword [esi + 8]
cmp eax, edi
jae 0x425cf1
mov edi, eax
xor eax, eax
cmp edi, ebx
jbe 0x425d08
mov ecx, dword [esi + 4]
mov cl, byte [eax + ecx]
mov edx, dword [esi + 0x10]
mov byte [eax + edx], cl
inc eax
cmp eax, edi
jb 0x425cf7
mov ebx, dword [esi + 0x10]
push edi
push ebx
push dword [esi + 0x50]
call fcn.0042670e
sub dword [esi + 0x5c], edi
sub dword [esi + 8], edi
sub dword [esi + 0x14], edi
add dword [esi + 4], edi
add dword [esi + 0x18], edi
add ebx, edi
add esp, 0xc
add dword [ebp - 4], edi
mov dword [esi + 0x50], eax
mov dword [esi + 0x10], ebx
jmp 0x425d74
mov eax, dword [esi + 0x10]
mov ebx, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
lea eax, [esi + 4]
push 2
push eax
call fcn.00426be3
mov edi, dword [esi + 0x18]
sub edi, ebx
push edi
push dword [ebp - 0xc]
mov dword [ebp - 8], eax
push dword [esi + 0x50]
call fcn.0042670e
sub dword [esi + 0x5c], edi
add dword [ebp - 4], edi
add esp, 0x14
cmp dword [ebp - 8], 1
mov dword [esi + 0x50], eax
je 0x425d84
cmp dword [ebp - 8], 0
jne 0x425d92
cmp dword [esi + 0x14], 0
ja 0x425c7d
cmp dword [ebp - 8], 0
jne 0x425d92
mov eax, dword [ebp - 4]
jmp 0x425d95
xor eax, eax
jmp 0x425d95
or eax, 0xffffffff
jmp 0x425d95
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x425ea3
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
cmp dword [ebp + 0xc], eax
jle 0x425ebb
mov byte [ebp + eax - 4], cl
shr ecx, 8
inc eax
cmp eax, dword [ebp + 0xc]
jl 0x425eae
push dword [ebp + 8]
lea eax, [ebp - 4]
push 1
push dword [ebp + 0xc]
push eax
call fcn.00456863
add esp, 0x10
dec eax
neg eax
sbb eax, eax
leave
ret
Function at 0x426372
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
test esi, esi
jne 0x426383
push 0xffffffffffffff9a
pop eax
leave
ret
cmp dword [esi + 0xc], 0
je 0x42637e
push ebx
push edi
push eax
push ecx
lea edi, [esi + 0x4068]
push dword [edi]
lea ebx, [esi + 0x10]
mov dword [ebx], ecx
mov dword [esi + 0x14], eax
call fcn.0042670e
add esp, 0xc
mov dword [edi], eax
cmp dword [esi + 0x14], 0
jbe 0x42643e
cmp dword [esi + 0x20], 0
jne 0x4263e1
push dword [esi]
lea edi, [esi + 0x64]
push 1
push dword [esi + 0x4c]
push edi
call fcn.00456863
add esp, 0x10
cmp eax, 1
je 0x4263d3
or dword [ebp - 4], 0xffffffff
and dword [esi + 0x4c], 0
mov dword [esi + 0x20], 0x4000
mov dword [esi + 0x1c], edi
cmp dword [esi + 0x60], 8
jne 0x4263fe
mov edi, dword [esi + 0x24]
push 0
push ebx
call fcn.004281d6
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x24]
pop ecx
pop ecx
sub eax, edi
jmp 0x426431
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0x20]
cmp eax, ecx
jb 0x42640a
mov eax, ecx
xor edi, edi
test eax, eax
jbe 0x426420
mov ecx, dword [ebx]
mov cl, byte [edi + ecx]
mov edx, dword [esi + 0x1c]
mov byte [edi + edx], cl
inc edi
cmp edi, eax
jb 0x426410
sub dword [esi + 0x14], eax
sub dword [esi + 0x20], eax
add dword [ebx], eax
add dword [esi + 0x1c], eax
add dword [esi + 0x18], eax
add dword [esi + 0x24], eax
add dword [esi + 0x4c], eax
cmp dword [ebp - 4], 0
je 0x4263a7
pop edi
xor eax, eax
pop ebx
leave
ret
Function at 0x426444
Capabilities:
Write file on windows

Disassembly:
push ecx
push edi
xor edi, edi
cmp esi, edi
jne 0x426454
push 0xffffffffffffff9a
pop eax
jmp 0x4265cd
cmp dword [esi + 0xc], edi
je 0x42644c
cmp dword [esi + 0x60], 8
push ebx
push ebp
mov dword [esi + 0x14], edi
jne 0x4264b0
lea ebp, [esi + 0x10]
cmp dword [esi + 0x20], 0
jne 0x42648e
push dword [esi]
lea edi, [esi + 0x64]
push 1
push dword [esi + 0x4c]
push edi
call fcn.00456863
add esp, 0x10
and dword [esi + 0x4c], 0
mov dword [esi + 0x20], 0x4000
mov dword [esi + 0x1c], edi
mov ebx, dword [esi + 0x24]
push 4
push ebp
call fcn.004281d6
mov edi, eax
mov eax, dword [esi + 0x24]
sub eax, ebx
add dword [esi + 0x4c], eax
pop ecx
pop ecx
test edi, edi
je 0x426467
cmp edi, 1
jne 0x4264b0
xor edi, edi
mov eax, dword [esi + 0x4c]
test eax, eax
jbe 0x4264d4
test edi, edi
jne 0x4264d4
push dword [esi]
push 1
push eax
lea eax, [esi + 0x64]
push eax
call fcn.00456863
add esp, 0x10
cmp eax, 1
je 0x4264d4
or edi, 0xffffffff
cmp dword [esi + 0x60], 8
jne 0x4264ee
test edi, edi
jne 0x4264ee
lea eax, [esi + 0x10]
push eax
call fcn.0042894c
and dword [esi + 0x48], 0
pop ecx
mov edi, eax
mov eax, dword [esi + 0x54]
mov ecx, dword [esi + 0x4068]
push 4
pop ebx
add eax, 0x10
push ebx
push eax
call fcn.00425ed6
mov eax, dword [esi + 0x54]
mov ecx, dword [esi + 0x24]
add eax, 0x14
push ebx
push eax
call fcn.00425ed6
mov eax, dword [esi + 0x54]
mov ecx, dword [esi + 0x18]
add eax, 0x18
push ebx
push eax
call fcn.00425ed6
xor ebp, ebp
add esp, 0x18
cmp edi, ebp
jne 0x42653f
push dword [esi + 0x58]
lea edi, [esi + 4]
push dword [esi + 0x54]
call fcn.00425e15
pop ecx
pop ecx
mov edi, eax
push dword [esi + 0x54]
call fcn.00451fa8
pop ecx
cmp edi, ebp
jne 0x4265c0
push dword [esi]
call fcn.00453259
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x50]
push ebp
add eax, 0xe
push eax
push dword [esi]
call fcn.00453351
add esp, 0x10
test eax, eax
je 0x426572
or edi, 0xffffffff
jmp 0x4265aa
mov ecx, dword [esi + 0x4068]
push ebx
push dword [esi]
call fcn.00425ea3
mov edi, eax
pop ecx
pop ecx
cmp edi, ebp
jne 0x4265aa
mov ecx, dword [esi + 0x24]
push ebx
push dword [esi]
call fcn.00425ea3
mov edi, eax
pop ecx
pop ecx
cmp edi, ebp
jne 0x4265aa
mov ecx, dword [esi + 0x18]
push ebx
push dword [esi]
call fcn.00425ea3
pop ecx
pop ecx
mov edi, eax
push ebp
push dword [esp + 0x10]
push dword [esi]
call fcn.00453351
add esp, 0xc
test eax, eax
je 0x4265c0
or edi, 0xffffffff
inc dword [esi + 0x4070]
mov dword [esi + 0xc], ebp
pop ebp
mov eax, edi
pop ebx
pop edi
pop ecx
ret