joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4248a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x436868
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x442f98]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x200
call fcn.00434cb1
mov esi, eax
add esp, 4
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
push str.SoftwareAdobeAdobe_AcrobatDCLanguageNext
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x42495c
lea eax, [ebp - 0x10]
push eax
push str.SoftwareAdobeAdobe_AcrobatDCLanguageNext
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x42495c
lea eax, [ebp - 0x10]
push eax
push str.SoftwareAdobeAcrobat_ReaderDCLanguageNext
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x42495c
lea eax, [ebp - 0x10]
push eax
push str.SoftwareAdobeAcrobat_ReaderDCLanguageNext
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x42495c
lea eax, [ebp - 0x10]
push eax
push str.SoftwareAdobeAcrobat_ReaderDCLanguageCurrent
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x424a6a
push 0x200
push 0
push esi
mov dword [ebp - 0x14], 0x200
call sub.VCRUNTIME140.dll_memset
sub dword [ebp - 0x14], 2
lea eax, [ebp - 0x14]
add esp, 0xc
push eax
push esi
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x14]
shr eax, 1
test edi, edi
jne 0x424a6a
cmp dword [ebp - 0x18], 1
jne 0x424a6a
cmp eax, 4
jb 0x424a6a
add eax, 0xfffffffc
push 0x43956c
lea edi, [esi + eax*2]
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x424a66
push 0x439574
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x424a66
movzx eax, word [edi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswalpha]
add esp, 4
test eax, eax
je 0x424a6a
movzx eax, word [edi + 2]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswalpha]
add esp, 4
test eax, eax
je 0x424a6a
movzx eax, word [edi + 4]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswalpha]
add esp, 4
test eax, eax
je 0x424a6a
cmp word [edi + 6], 0
jne 0x424a6a
mov ecx, dword [ebp + 8]
mov edx, 4
sub edi, ecx
lea eax, [edx + 0x7ffffffa]
test eax, eax
je 0x424a50
movzx eax, word [edi + ecx]
test ax, ax
je 0x424a50
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x424a32
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
test edx, edx
je 0x424a6a
lea edi, [ecx + 1]
jmp 0x424a6d
xor edi, edi
jmp 0x424a6d
or edi, 0xffffffff
push 2
push esi
call fcn.00434c83
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x424be0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x43beb0
push 0x435200
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x442f98]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
cmp dword [0x4435b4], 0
jne 0x424cbb
mov eax, dword [0x4435b0]
test eax, eax
jne 0x424cbb
mov ecx, dword [0x4435bc]
test ecx, ecx
je 0x424c58
push str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x4435b0]
mov ecx, dword [0x4435bc]
test eax, eax
jne 0x424cbb
test ecx, ecx
jne 0x424c69
call fcn.00424d60
test eax, eax
je 0x424c7c
lea eax, [ebp - 0x20]
push eax
push dword [section..data]
call fcn.00424ab0
test eax, eax
jne 0x424cbb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7f
je 0x424cb1
cmp eax, 0x7e
je 0x424cb1
cmp eax, 0x78
je 0x424cb1
cmp eax, 1
je 0x424cb1
cmp eax, 0x32
je 0x424cb1
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov dword [0x4435b0], 1
mov dword [ebp - 4], 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0xfffffffe
call fcn.00424cfb
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4254e0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0042dc90
add esp, 8
test eax, eax
jne 0x425503
mov eax, 0x80004005
mov esp, ebp
pop ebp
ret 0x18
push esi
push dword [ebp + 0x14]
call fcn.00429bd0
add esp, 4
lea ecx, [ebp - 0x14]
mov esi, eax
call fcn.0042e130
push dword [ebp + 0x18]
lea ecx, [ebp - 0x14]
push esi
call fcn.0042edc0
test al, al
jne 0x42553f
lea ecx, [ebp - 0x14]
mov esi, 1
call fcn.0042e360
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x18
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push dword [ebp + 0x18]
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42556d
push dword [ebp + 0x1c]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x14]
xor esi, esi
call fcn.0042e360
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x18
Function at 0x425580
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x442f98]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0042dc90
add esp, 8
test eax, eax
jne 0x4255af
mov eax, 0x80004005
jmp 0x4256ac
push dword [ebp + 0x14]
call fcn.00429bd0
add esp, 4
lea ecx, [ebp - 0x18]
mov ebx, eax
call fcn.0042e130
mov edi, dword [ebp + 0x18]
lea ecx, [ebp - 0x18]
push edi
push ebx
call fcn.0042edc0
test al, al
jne 0x4255df
mov esi, 1
jmp 0x4256a2
test edi, edi
jne 0x4255e7
xor eax, eax
jmp 0x425623
mov ecx, edi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4255f0
sub ecx, edx
sar ecx, 1
lea esi, [ecx + 1]
cmp esi, 0x3fffffff
jle 0x42560e
xor eax, eax
jmp 0x425623
add esi, esi
mov eax, esi
call fcn.00435230
mov eax, esp
push 3
push esi
push edi
push eax
call fcn.00429b90
push 0
lea ecx, [ebp - 8]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4256a0
mov edi, dword [ebp + 0x1c]
test edi, edi
je 0x42566a
mov ecx, edi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x425650
sub ecx, edx
sar ecx, 1
lea esi, [ecx + 1]
cmp esi, 0x3fffffff
jle 0x42566e
xor eax, eax
jmp 0x425683
add esi, esi
mov eax, esi
call fcn.00435230
mov eax, esp
push 3
push esi
push edi
push eax
call fcn.00429b90
push 4
lea ecx, [ebp + 0x20]
push ecx
push 4
push 0
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
lea ecx, [ebp - 0x18]
call fcn.0042e360
mov eax, esi
lea esp, [ebp - 0x24]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00434ca0
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x4256d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x442f98]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0042dc90
add esp, 8
test eax, eax
jne 0x4256ff
mov eax, 0x80004005
jmp 0x4257dd
push dword [ebp + 0x14]
call fcn.00429bd0
add esp, 4
lea ecx, [ebp - 0x18]
mov ebx, eax
call fcn.0042e130
mov edi, dword [ebp + 0x18]
lea ecx, [ebp - 0x18]
push edi
push ebx
call fcn.0042edc0
test al, al
jne 0x42572f
mov esi, 1
jmp 0x4257d3
test edi, edi
jne 0x425737
xor eax, eax
jmp 0x425773
mov ecx, edi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x425740
sub ecx, edx
sar ecx, 1
lea esi, [ecx + 1]
cmp esi, 0x3fffffff
jle 0x42575e
xor eax, eax
jmp 0x425773
add esi, esi
mov eax, esi
call fcn.00435230
mov eax, esp
push 3
push esi
push edi
push eax
call fcn.00429b90
push 0
lea ecx, [ebp - 8]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4257d1
mov edx, dword [ebp + 0x20]
mov ecx, edx
lea esi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4257a0
sub ecx, esi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push dword [ebp + 0x1c]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
lea ecx, [ebp - 0x18]
call fcn.0042e360
mov eax, esi
lea esp, [ebp - 0x24]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00434ca0
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x425800
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x442f98]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0042dc90
add esp, 8
test eax, eax
jne 0x42582f
mov eax, 0x80004005
jmp 0x42597a
push dword [ebp + 0x14]
call fcn.00429bd0
add esp, 4
lea ecx, [ebp - 0x20]
mov esi, eax
mov dword [ebp - 0xc], esi
call fcn.0042e130
mov ebx, dword [ebp + 0x18]
lea ecx, [ebp - 0x20]
push ebx
push esi
call fcn.0042edc0
test al, al
jne 0x425862
mov esi, 1
jmp 0x425970
mov edi, dword [ebp + 0x20]
test edi, edi
jne 0x425871
lea esi, [edi + 0x57]
jmp 0x425970
cmp word [edi], 1
jne 0x42596b
cmp dword [edi + 4], 1
jne 0x42596b
cmp dword [edi + 0x14], 0
jne 0x42596b
lea eax, [ebp - 0x10]
push eax
push edi
call dword [sym.imp.OLEAUT32.dll_SafeArrayUnaccessData]
mov esi, eax
test esi, esi
jne 0x425970
test ebx, ebx
je 0x4258e3
mov ecx, ebx
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4258b0
sub ecx, edx
sar ecx, 1
lea esi, [ecx + 1]
cmp esi, 0x3fffffff
jle 0x4258ce
xor eax, eax
jmp 0x4258e3
add esi, esi
mov eax, esi
call fcn.00435230
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.00429b90
push 0
lea ecx, [ebp - 8]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x425960
mov ebx, dword [ebp + 0x1c]
test ebx, ebx
je 0x42592a
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x425910
sub ecx, edx
sar ecx, 1
lea esi, [ecx + 1]
cmp esi, 0x3fffffff
jle 0x42592e
xor eax, eax
jmp 0x425943
add esi, esi
mov eax, esi
call fcn.00435230
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.00429b90
push dword [edi + 0x10]
push dword [ebp - 0x10]
push 3
push 0
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetElement]
xor esi, esi
jmp 0x425970
mov esi, 0x80004005
lea ecx, [ebp - 0x20]
call fcn.0042e360
mov eax, esi
lea esp, [ebp - 0x2c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00434ca0
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x425990
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x442f98]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0042dc90
add esp, 8
test eax, eax
jne 0x4259bf
mov eax, 0x80004005
jmp 0x425b64
mov edi, dword [ebp + 0x20]
test edi, edi
je 0x425a05
mov ecx, edi
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4259d0
sub ecx, edx
sar ecx, 1
lea esi, [ecx + 1]
cmp esi, 0x3fffffff
jle 0x4259ee
xor edi, edi
jmp 0x425a05
add esi, esi
mov eax, esi
call fcn.00435230
mov eax, esp
push 3
push esi
push edi
push eax
call fcn.00429b90
mov edi, eax
push dword [ebp + 0x14]
call fcn.00429bd0
add esp, 4
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x1c]
call fcn.0042e130
mov ebx, dword [ebp + 0x18]
lea ecx, [ebp - 0x1c]
push ebx
push dword [ebp - 8]
call fcn.0042edc0
test al, al
jne 0x425a38
mov esi, 1
jmp 0x425b5a
test ebx, ebx
jne 0x425a40
xor eax, eax
jmp 0x425a78
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x425a45
sub ecx, edx
sar ecx, 1
lea esi, [ecx + 1]
cmp esi, 0x3fffffff
jle 0x425a63
xor eax, eax
jmp 0x425a78
add esi, esi
mov eax, esi
call fcn.00435230
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.00429b90
push 0
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x425b58
mov ebx, dword [ebp + 0x1c]
test ebx, ebx
jne 0x425aa8
xor esi, esi
jmp 0x425ae5
mov ecx, ebx
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x425ab0
sub ecx, edx
sar ecx, 1
lea esi, [ecx + 1]
cmp esi, 0x3fffffff
jle 0x425ace
xor esi, esi
jmp 0x425ae5
add esi, esi
mov eax, esi
call fcn.00435230
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.00429b90
mov esi, eax
test edi, edi
je 0x425b24
xor eax, eax
nop dword [eax + eax]
cmp byte [eax + edi], 0
je 0x425afe
inc eax
cmp eax, 0x7fffffff
jb 0x425af0
cmp eax, 0x7fffffff
jne 0x425b3e
push 0
push 0
push 0
push str.ASstrnlen_safe
push str.String_greater_than_maxSize
call fcn.00417600
add esp, 0x14
mov eax, SysReAllocString
jmp 0x425b3e
push 0
push 0
push 0
push str.ASstrnlen_safe
push str.Bad_parameter
call fcn.00417600
add esp, 0x14
xor eax, eax
inc eax
push eax
push edi
push 3
push 0
push esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
lea ecx, [ebp - 0x1c]
call fcn.0042e360
mov eax, esi
lea esp, [ebp - 0x28]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00434ca0
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x427010
Capabilities:
Get file attributes
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0042dc90
add esp, 8
test eax, eax
jne 0x427033
mov eax, 0x80004005
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [ebp + 0x1c]
lea ecx, [ebp - 0x2c]
push ebx
push esi
xor esi, esi
push edi
mov dword [eax], esi
call fcn.0042e130
mov ebx, dword [ebp + 0x18]
mov edi, dword [ebp + 0x14]
test bl, 6
je 0x427064
push esi
push 1
push edi
lea ecx, [ebp - 0x2c]
call fcn.0042ef50
test al, al
je 0x427201
test edi, edi
je 0x427201
cmp word [edi], si
je 0x427201
mov ecx, edi
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x427080
sub ecx, edx
sar ecx, 1
cmp word [edi + ecx*2 - 2], 0x2e
je 0x427201
test bl, 4
je 0x4270b1
mov edx, 0xc0000000
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], 2
jmp 0x4270fd
test bl, 2
je 0x4270e1
mov eax, 0xc0000000
mov dword [ebp - 0xc], esi
push edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 3
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
and esi, 1
jne 0x427206
mov edx, 0xc0000000
jmp 0x427100
test bl, 1
je 0x427201
mov edx, SysReAllocString
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 3
mov dword [ebp - 0x10], edx
mov eax, ebx
and eax, 0x28
cmp al, 0x28
je 0x427201
mov ecx, ebx
mov eax, ebx
and ecx, 8
and eax, 0x20
add ecx, ecx
or ecx, eax
mov eax, 0x80
shl ecx, 0x17
test bl, 0x40
push 0
mov ebx, 0x4000100
cmovne eax, ebx
or ecx, eax
push ecx
push dword [ebp - 8]
mov dword [ebp - 0x14], ecx
push 0
push dword [ebp - 0xc]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x4271bf
mov ebx, dword [ebp - 0x14]
test ebx, 0x10000000
je 0x4271dd
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x18], eax
cmp eax, 0xffffffff
jne 0x42717a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4271da
mov eax, dword [ebp - 0x14]
xor ecx, ecx
or ecx, dword [ebp - 0x18]
or eax, 0
mov dword [ebp - 0x18], eax
ja 0x427192
cmp ecx, 0xee6b280
jbe 0x4271da
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
and ebx, 0xefffffff
push 0
push ebx
push dword [ebp - 8]
push 0
push dword [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x4271dd
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x2c]
mov esi, eax
call fcn.0042e360
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [ebp - 4]
test eax, eax
je 0x427206
push dword [ebp + 0x1c]
push eax
mov eax, dword [ebp + 8]
add eax, 8
push eax
call fcn.0042a840
add esp, 0xc
test al, al
jne 0x427206
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 1
lea ecx, [ebp - 0x2c]
call fcn.0042e360
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x4272f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0042dc90
add esp, 8
test eax, eax
je 0x4273ab
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push dword [ebp + 0x14]
push dword [eax + 8]
call fcn.0042a900
add esp, 0xc
test al, al
je 0x42739e
mov ebx, dword [ebp + 0x1c]
test ebx, ebx
je 0x42739e
mov esi, dword [ebp + 0x20]
test esi, esi
je 0x42739e
push dword [ebp + 0x18]
push 0
push 0x11
call dword [sym.imp.OLEAUT32.dll_SafeArrayCopyData]
mov dword [esi], eax
test eax, eax
je 0x4273ab
push edi
lea ecx, [ebp - 4]
xor edi, edi
push ecx
push eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayUnaccessData]
test eax, eax
jne 0x427393
push eax
push ebx
push dword [ebp + 0x18]
mov dword [ebx], edi
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x427379
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push dword [esi]
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetElement]
test edi, edi
je 0x427393
push dword [esi]
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetDim]
mov dword [esi], 0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
pop esi
mov eax, 0x57
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
pop esi
mov eax, 0x80004005
pop ebx
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x4273c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0042dc90
add esp, 8
test eax, eax
je 0x427467
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push dword [ebp + 0x14]
push dword [eax + 8]
call fcn.0042a900
add esp, 0xc
test al, al
je 0x42745a
mov ebx, dword [ebp + 0x1c]
test ebx, ebx
je 0x42745a
mov esi, dword [ebp + 0x18]
test esi, esi
je 0x42745a
cmp word [esi], 1
jne 0x427467
cmp dword [esi + 4], 1
jne 0x427467
cmp dword [esi + 0x14], 0
jne 0x427467
push edi
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.OLEAUT32.dll_SafeArrayUnaccessData]
mov edi, eax
test edi, edi
jne 0x427451
push eax
push ebx
mov dword [ebx], eax
push dword [esi + 0x10]
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x427448
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetElement]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
pop esi
mov eax, 0x57
pop ebx
mov esp, ebp
pop ebp
ret 0x18
pop esi
mov eax, 0x80004005
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x427480
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0042dc90
add esp, 8
test eax, eax
jne 0x4274a1
mov eax, 0x80004005
mov esp, ebp
pop ebp
ret 0x18
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x14]
push dword [edi + 8]
call fcn.0042a900
add esp, 0xc
test al, al
jne 0x4274c7
mov eax, 0x57
pop edi
mov esp, ebp
pop ebp
ret 0x18
push esi
push dword [ebp + 0x1c]
mov esi, dword [edi]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
mov esi, dword [esi + 0x60]
mov ecx, esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [0x438430]
call esi
pop esi
test eax, eax
jne 0x4274fa
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
neg eax
sbb eax, eax
inc eax
pop edi
mov esp, ebp
pop ebp
ret 0x18

Function at 0x427510
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push dword [ebp + 0x10]
mov dword [ebp - 4], 0
push dword [ebp + 0xc]
call fcn.0042dc90
add esp, 8
test eax, eax
jne 0x42753a
mov eax, 0x80004005
mov esp, ebp
pop ebp
ret 0x1c
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push dword [ebp + 0x14]
push dword [eax + 8]
call fcn.0042a900
add esp, 0xc
test al, al
jne 0x42755e
mov eax, 0x57
mov esp, ebp
pop ebp
ret 0x1c
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, eax
cmp edx, 0xffffffff
jne 0x42757e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esp, ebp
pop ebp
ret 0x1c
cmp dword [ebp + 0x20], 0
jne 0x427599
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
xor eax, eax
mov esp, ebp
pop ebp
ret 0x1c
cmp dword [ebp - 4], 0
jne 0x4275b4
cmp edx, 0x7fffffff
ja 0x4275b4
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
xor eax, eax
mov esp, ebp
pop ebp
ret 0x1c
mov eax, 1
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x4275c0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0042dc90
add esp, 8
test eax, eax
jne 0x4275e3
mov eax, 0x80004005
mov esp, ebp
pop ebp
ret 0x10
push esi
push edi
mov edi, dword [ebp + 0x14]
xor esi, esi
test edi, edi
je 0x42763e
lea ecx, [ebp - 0x10]
call fcn.0042e130
push esi
push 1
push edi
lea ecx, [ebp - 0x10]
call fcn.0042ef50
test al, al
jne 0x427619
lea ecx, [ebp - 0x10]
call fcn.0042e360
pop edi
lea eax, [esi + 1]
pop esi
mov esp, ebp
pop ebp
ret 0x10
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x42762c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea ecx, [ebp - 0x10]
call fcn.0042e360
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov esi, 1
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x10