joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d60d4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
push 0
push 0
push 0xe
push esi
call sub.user32.dll_SendMessageA
mov ebx, eax
mov eax, edi
mov edx, ebx
call fcn.00405500
test ebx, ebx
jle 0x4d6108
mov eax, edi
call fcn.004052d0
push eax
inc ebx
push ebx
push 0xd
push esi
call sub.user32.dll_SendMessageA
pop edi
pop esi
pop ebx
ret

Function at 0x4dc9a0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
add esp, 0xffffff00
push esp
call sub.user32.dll_GetKeyboardState
mov eax, esp
call fcn.00463778
mov ebx, eax
mov eax, ebx
add esp, 0x100
pop ebx
ret

Function at 0x4e44a8
Capabilities:
Set global application hook

Disassembly:
cmp dword [0x542e98], 0
je 0x4e44c5
mov ecx, 0x1888
mov edx, 0x4e451c
mov eax, 0x4e457c
call fcn.00404dc0
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x4e3ac0
push eax
push 4
call sub.user32.dll_SetWindowsHookExA
mov dword [0x542e90], eax
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x4e3fbc
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x542e94], eax
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x4e43d4
push eax
push 7
call sub.user32.dll_SetWindowsHookExA
mov dword [0x542e98], eax
ret
Function at 0x4efdc4
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xa
push 0
push 0
dec ecx
jne 0x4efdcc
push ebx
mov ebx, 0x56b78c
xor eax, eax
push ebp
push 0x4effe1
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, dword [0x54463c]
call fcn.004a9a28
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00404e34
lea edx, [ebp - 8]
mov eax, dword [0x544424]
call fcn.004a9a28
mov edx, dword [ebp - 8]
lea eax, [ebx + 4]
call fcn.00404e34
lea edx, [ebp - 0xc]
mov eax, dword [0x544414]
call fcn.004a9a28
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 8]
call fcn.00404e34
lea edx, [ebp - 0x10]
mov eax, dword [0x543df4]
call fcn.004a9a28
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0xc]
call fcn.00404e34
lea edx, [ebp - 0x14]
mov eax, dword [0x543f74]
call fcn.004a9a28
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.00404e34
lea edx, [ebp - 0x18]
mov eax, dword [0x5446c0]
call fcn.004a9a28
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.00404e34
lea edx, [ebp - 0x1c]
mov eax, dword [0x5447b8]
call fcn.004a9a28
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x18]
call fcn.00404e34
lea edx, [ebp - 0x20]
mov eax, dword [0x544058]
call fcn.004a9a28
mov edx, dword [ebp - 0x20]
lea eax, [ebx + 0x1c]
call fcn.00404e34
lea edx, [ebp - 0x24]
mov eax, dword [0x543dd0]
call fcn.004a9a28
mov edx, dword [ebp - 0x24]
lea eax, [ebx + 0x20]
call fcn.00404e34
lea edx, [ebp - 0x28]
mov eax, dword [0x543f10]
call fcn.004a9a28
mov edx, dword [ebp - 0x28]
lea eax, [ebx + 0x24]
call fcn.00404e34
lea edx, [ebp - 0x2c]
mov eax, dword [0x543c2c]
call fcn.004a9a28
mov edx, dword [ebp - 0x2c]
lea eax, [ebx + 0x28]
call fcn.00404e34
lea edx, [ebp - 0x30]
mov eax, dword [0x543e9c]
call fcn.004a9a28
mov edx, dword [ebp - 0x30]
lea eax, [ebx + 0x2c]
call fcn.00404e34
lea edx, [ebp - 0x34]
mov eax, dword [0x543dbc]
call fcn.004a9a28
mov edx, dword [ebp - 0x34]
lea eax, [ebx + 0x30]
call fcn.00404e34
lea edx, [ebp - 0x38]
mov eax, dword [0x544410]
call fcn.004a9a28
mov edx, dword [ebp - 0x38]
lea eax, [ebx + 0x34]
call fcn.00404e34
lea edx, [ebp - 0x3c]
mov eax, dword [0x5445f0]
call fcn.004a9a28
mov edx, dword [ebp - 0x3c]
lea eax, [ebx + 0x38]
call fcn.00404e34
lea edx, [ebp - 0x40]
mov eax, dword [0x5443d8]
call fcn.004a9a28
mov edx, dword [ebp - 0x40]
lea eax, [ebx + 0x3c]
call fcn.00404e34
lea edx, [ebp - 0x44]
mov eax, dword [0x5442d0]
call fcn.004a9a28
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x40]
call fcn.00404e34
lea edx, [ebp - 0x48]
mov eax, dword [0x543e90]
call fcn.004a9a28
mov edx, dword [ebp - 0x48]
lea eax, [ebx + 0x44]
call fcn.00404e34
lea edx, [ebp - 0x4c]
mov eax, dword [0x54466c]
call fcn.004a9a28
mov edx, dword [ebp - 0x4c]
lea eax, [ebx + 0x48]
call fcn.00404e34
lea edx, [ebp - 0x50]
mov eax, dword [0x543c44]
call fcn.004a9a28
mov edx, dword [ebp - 0x50]
lea eax, [ebx + 0x4c]
call fcn.00404e34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4effe8
lea eax, [ebp - 0x50]
mov edx, 0x14
call fcn.00404e04
ret
Function at 0x4ffed4
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x4fff84
push dword fs:[eax]
mov dword fs:[eax], esp
test bl, bl
jne 0x4fff33
cmp dword [edi + 0x3ec], 0
je 0x4fff33
lea edx, [ebp - 4]
mov eax, dword [edi + 0x3ec]
call fcn.0044f298
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 8]
mov eax, edi
call fcn.004ffe00
mov edx, dword [ebp - 8]
pop eax
call fcn.00405208
jne 0x4fff33
mov eax, edi
call fcn.004ffdbc
cmp eax, dword [0x543118]
jne 0x4fff66
mov eax, edi
call fcn.0050028c
mov eax, dword [0x544658]
push edi
mov esi, eax
add edi, 0x3dc
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
mov esi, dword [edi + 0x3ec]
test esi, esi
je 0x4fff66
push 0
mov eax, esi
call fcn.004573b4
push eax
call sub.user32.dll_ShowWindow
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fff8b
lea eax, [ebp - 8]
call fcn.00404de0
lea eax, [ebp - 4]
call fcn.00404de0
ret
Function at 0x528ad4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
mov esi, dword [ebp + 8]
mov esi, dword [esi - 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x30]
push eax
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0x10]
mov eax, dword [ebp + 8]
movzx edx, byte [eax + 0x38]
mov eax, dword [ebp + 8]
movzx eax, byte [eax - 1]
call fcn.0052932c
mov ebx, eax
mov dl, 1
mov eax, dword [0x42970c]
call fcn.0042fc34
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x528c27
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x34]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
mov edx, dword [esi + 0xc]
sub edx, dword [esi + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov edx, dword [esi + 8]
sub edx, dword [esi]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x34]
mov edx, dword [eax]
call dword [edx + 0x2c]
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 0x30]
cdq
idiv ecx
imul ebx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x2c]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x34]
mov edx, dword [eax]
call dword [edx + 0x20]
mov ebx, eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x20]
sub ebx, eax
sar ebx, 1
jns 0x528b90
adc ebx, 0
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x20]
add eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x20]
push eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x2c]
mov ecx, eax
xor edx, edx
xor eax, eax
call fcn.0041c378
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x34]
call fcn.00430208
push eax
mov eax, dword [ebp - 4]
call fcn.00430208
pop ecx
pop edx
call fcn.0042b68c
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp + 8]
cmp byte [eax + 0x38], 3
setne al
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x20]
call fcn.0042a2a0
push eax
push 0
mov ecx, dword [esi + 4]
mov edx, dword [esi]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
call fcn.004f1fb8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x528c2e
mov eax, dword [ebp - 4]
call fcn.00403e90
ret
Function at 0x536990
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x536b9b
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
mov ebx, 0x56b95c
cmp esi, 0xa
jge 0x5369d4
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0
lea edx, [ebp - 0xc]
xor ecx, ecx
mov eax, 0x536bb4
call fcn.0040ac08
jmp 0x5369ee
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0
lea edx, [ebp - 0xc]
xor ecx, ecx
mov eax, 0x536bd0
call fcn.0040ac08
mov eax, dword [ebp - 4]
call fcn.00405270
push eax
push 0
push 0x100000
call sub.kernel32.dll_OpenMutexA
mov edi, eax
mov dword [ebx], edi
test edi, edi
jne 0x536a1f
mov eax, dword [ebp - 4]
call fcn.00405270
push eax
push 0
push 0
call fcn.00407510
mov dword [ebx], eax
inc esi
add ebx, 0x114
cmp esi, 0x20
jne 0x5369b3
push 0x536be0
call sub.kernel32.dll_LoadLibraryA
mov dword [0x543610], eax
cmp dword [0x543610], 0
je 0x536a97
push 0x536bf0
mov eax, dword [0x543610]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x56daf4], eax
push 0x536c10
mov eax, dword [0x543610]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x56daf8], eax
push 0x536c34
mov eax, dword [0x543610]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x56dafc], eax
push 0x536c50
mov eax, dword [0x543610]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x56db00], eax
push 0x536c68
call sub.kernel32.dll_LoadLibraryA
mov dword [0x54360c], eax
cmp dword [0x54360c], 0
je 0x536b85
push 0x536c70
mov eax, dword [0x54360c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x56dacc], eax
push 0x536c88
mov eax, dword [0x54360c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x56dad0], eax
push 0x536c98
mov eax, dword [0x54360c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x56dad4], eax
push 0x536cb0
mov eax, dword [0x54360c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x56dad8], eax
push 0x536cc0
mov eax, dword [0x54360c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x56dadc], eax
push 0x536cd0
mov eax, dword [0x54360c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x56dae0], eax
push 0x536ce0
mov eax, dword [0x54360c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x56dae4], eax
push 0x536cfc
mov eax, dword [0x54360c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x56dae8], eax
push 0x536d14
mov eax, dword [0x54360c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x56daec], eax
push 0x536d28
mov eax, dword [0x54360c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x56daf0], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x536ba2
lea eax, [ebp - 4]
call fcn.00404de0
ret
Function at 0x53a62c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov byte [ebp - 5], 0
push 0x53a6fc
call sub.kernel32.dll_LoadLibraryA
mov ebx, eax
test ebx, ebx
je 0x53a6ef
mov eax, dword [ebp - 4]
call fcn.00405270
push eax
mov eax, edi
call fcn.00405270
push eax
push ebx
call sub.kernel32.dll_FindResourceA
push eax
push ebx
call sub.kernel32.dll_SizeofResource
mov esi, eax
test esi, esi
je 0x53a6ef
mov eax, dword [ebp - 4]
call fcn.00405270
push eax
mov eax, edi
call fcn.00405270
push eax
push ebx
call sub.kernel32.dll_FindResourceA
push eax
push ebx
call sub.kernel32.dll_LoadResource
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x53a6ef
xor eax, eax
push ebp
push 0x53a6e8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_LockResource
mov edx, dword [ebp - 0xc]
mov ecx, esi
mov eax, dword [ebp + 8]
call fcn.00420b74
push 0
push 0
mov eax, dword [ebp + 8]
call fcn.00420930
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53a6ef
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FreeResource
ret
movzx eax, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x405ea9
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4713cb
call fcn.00465b54
push ecx
push ecx
mov al, byte [ebp - 0xd]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x14], esi
mov byte [esi + 0xc], al
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov al, byte [ebp - 0xd]
mov dword [ebp - 4], ebx
mov byte [esi + 0x1c], al
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov al, byte [ebp - 0xd]
mov dword [esi + 0x30], ebx
mov byte [esi + 0x2c], al
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x3c]
push ebx
mov byte [ebp - 4], 2
mov byte [ecx], al
call fcn.00406336
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x4c]
push ebx
mov byte [ebp - 4], 3
mov byte [ecx], al
call fcn.00406336
lea ecx, [esi + 0x70]
lea eax, [ebp - 0xd]
push ebx
mov byte [esi + 0x5c], bl
mov byte [esi + 0x5d], 1
push eax
mov byte [ebp - 4], 4
mov dword [ecx], 0x47b4b8
mov dword [ecx + 0x20], 0x47b4b0
call fcn.0040580f
mov ecx, dword [ebp - 0xc]
mov dword [esi], 0x47b540
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x409dc0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x471737
call fcn.00465b54
sub esp, 0xf0
and dword [ebp - 0x10], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x8c]
push eax
mov ecx, edi
call fcn.00408e99
mov eax, dword [eax + 0xc]
mov esi, dword [ebp + 0x14]
and dword [ebp - 4], 0
push 1
cmp esi, eax
pop ebx
ja 0x409e0d
lea eax, [ebp - 0xb4]
mov ecx, edi
push eax
call fcn.00408e99
mov esi, dword [eax + 0xc]
mov dword [ebp - 0x10], ebx
test byte [ebp - 0x10], bl
je 0x409e1d
lea ecx, [ebp - 0xb4]
call fcn.00407f77
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8c]
call fcn.00407f77
inc esi
push ebx
lea eax, [ebp - 0x10]
push esi
lea ecx, [edi + 4]
push eax
mov dword [ebp - 0x10], 0x5c
call fcn.00409f26
cmp eax, 0xffffffff
je 0x409edb
mov edi, 0x47b4b8
mov esi, 0x47b4b0
lea ecx, [ebp + 0x17]
inc eax
push 0
push ecx
push eax
push 0
push dword [ebp + 8]
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], eax
call fcn.00405b83
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], ebx
call fcn.0040650f
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x409ea0
test al, 0x10
je 0x409ea0
cmp dword [ebp + 0x10], 0
je 0x409eac
push dword [ebp - 0x10]
call dword [ebp + 0x10]
pop ecx
jmp 0x409eac
push 0
push dword [ebp - 0x10]
call dword [ebp + 0xc]
test eax, eax
je 0x409eea
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.00407f77
push ebx
lea eax, [ebp - 0x10]
push dword [ebp - 0x14]
mov dword [ebp - 0x10], 0x5c
push eax
mov eax, dword [ebp + 8]
lea ecx, [eax + 4]
call fcn.00409f26
cmp eax, 0xffffffff
jne 0x409e55
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
lea eax, [ebp + 0xb]
push 0
push eax
lea ecx, [ebp - 0x64]
push dword [ebp - 0x10]
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x44], esi
call fcn.004059b3
lea eax, [ebp - 0x64]
push ebx
push eax
lea ecx, [ebp - 0xfc]
mov byte [ebp - 4], 2
call fcn.00408b81
lea eax, [ebp - 0xfc]
push 0x47fc68
push eax
call fcn.00465b73
Function at 0x40dfa1
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x471e66
call fcn.00465b54
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x460]
mov dword [ebp - 4], 0x21
call fcn.00412ca3
lea ecx, [esi + 0x448]
mov byte [ebp - 4], 0x20
call fcn.004235b3
lea ecx, [esi + 0x430]
mov byte [ebp - 4], 0x1f
call fcn.004235b3
lea ecx, [esi + 0x41c]
mov byte [ebp - 4], 0x1e
call fcn.0040d630
lea ecx, [esi + 0x3f4]
mov byte [ebp - 4], 0x1d
call fcn.00407f77
lea ecx, [esi + 0x3c8]
mov byte [ebp - 4], 0x1c
call fcn.00407f77
lea ecx, [esi + 0x398]
mov byte [ebp - 4], 0x1b
call fcn.00407f77
lea ecx, [esi + 0x370]
mov byte [ebp - 4], 0x1a
call fcn.00407f77
lea ecx, [esi + 0x348]
mov byte [ebp - 4], 0x19
call fcn.00407f77
lea ecx, [esi + 0x320]
mov byte [ebp - 4], 0x18
call fcn.00407f77
lea ecx, [esi + 0x308]
mov byte [ebp - 4], 0x17
call fcn.00446431
lea ecx, [esi + 0x2b0]
mov byte [ebp - 4], 0x16
call fcn.00407f77
lea ecx, [esi + 0x288]
mov byte [ebp - 4], 0x15
call fcn.00407f77
lea ecx, [esi + 0x260]
mov byte [ebp - 4], 0x14
call fcn.00407f77
mov byte [ebp - 4], 0x13
lea ecx, [esi + 0x238]
call fcn.00407f77
lea ecx, [esi + 0x210]
mov byte [ebp - 4], 0x12
call fcn.00407f77
lea ecx, [esi + 0x1e8]
mov byte [ebp - 4], 0x11
call fcn.00407f77
lea ecx, [esi + 0x1c0]
mov byte [ebp - 4], 0x10
call fcn.00407f77
lea ecx, [esi + 0x198]
mov byte [ebp - 4], 0xf
call fcn.00407f77
lea ecx, [esi + 0x170]
mov byte [ebp - 4], 0xe
call fcn.00407f77
lea ecx, [esi + 0x148]
mov byte [ebp - 4], 0xd
call fcn.00407f77
lea ecx, [esi + 0x120]
mov byte [ebp - 4], 0xc
call fcn.00407f77
lea ecx, [esi + 0xf8]
mov byte [ebp - 4], 0xb
call fcn.00407f77
lea ecx, [esi + 0xd0]
mov byte [ebp - 4], 0xa
call fcn.00407f77
lea ecx, [esi + 0xa8]
mov byte [ebp - 4], 9
call fcn.00407f77
lea ecx, [esi + 0x80]
mov byte [ebp - 4], 8
call fcn.00407f77
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 7
call fcn.00407f77
lea ecx, [esi + 0x44]
mov byte [ebp - 4], 6
call fcn.00419ee5
lea ecx, [esi + 0x40]
mov byte [ebp - 4], 5
call fcn.00419ee5
lea ecx, [esi + 0x3c]
mov byte [ebp - 4], 4
call fcn.00419ee5
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 3
call fcn.00419ee5
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 2
call fcn.00419ee5
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
call fcn.00419ee5
and byte [ebp - 4], 0
lea ecx, [esi + 0x1c]
call fcn.0040d277
or dword [ebp - 4], 0xffffffff
mov ecx, esi
add esi, 0x14
neg ecx
sbb ecx, ecx
and ecx, esi
add ecx, 4
call fcn.00419ee5
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x4183b8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x472bd4
call fcn.00465b54
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
mov eax, dword [edi + 0xc]
test eax, eax
je 0x418499
mov ecx, edi
call fcn.0040650f
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
setne al
test al, al
jne 0x4183f7
push 3
pop eax
jmp 0x4184bb
mov ebx, dword [ebp + 0x10]
mov byte [esi + 0x44], 1
test ebx, ebx
je 0x41841b
mov eax, dword [ebx]
test eax, eax
jbe 0x41841b
lea edi, [esi + 0x3c]
mov dword [edi], eax
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x418449
mov eax, dword [eax]
mov dword [esi + 0x40], eax
jmp 0x418449
and dword [ebp - 4], 0
mov ecx, edi
call fcn.0040650f
mov ecx, dword [ebp + 8]
mov ebx, eax
lea eax, [esi + 0x40]
lea edi, [esi + 0x3c]
push eax
push edi
call fcn.0040650f
push eax
push ebx
lea ecx, [ebp - 0x10]
call fcn.004184cc
or dword [ebp - 4], 0xffffffff
mov ebx, dword [ebp + 0x10]
push dword [ebp + 0x2c]
mov ecx, esi
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0xc]
call fcn.0041b441
test eax, eax
mov dword [ebp + 0x10], eax
jne 0x4184b8
mov eax, dword [edi]
and dword [ebp - 0x10], 0
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], eax
push ecx
push 0
push eax
mov ecx, esi
call fcn.0041b53f
test ebx, ebx
je 0x41848b
mov eax, dword [edi]
mov dword [ebx], eax
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x4184b8
mov ecx, dword [esi + 0x40]
mov dword [eax], ecx
jmp 0x4184b8
push dword [ebp + 0x2c]
mov ecx, esi
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 8]
call fcn.0041b441
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x28
Function at 0x41b65a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
cmp dword [ebp + 0xc], 0xffffffff
push esi
mov esi, ecx
jne 0x41b66d
and dword [ebp + 0xc], 0
lea eax, [ebp + 0xc]
push 0
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x41b6a2
add esi, 0xc
push 1
push esi
lea ecx, [ebp - 0x48]
call fcn.00408b81
lea eax, [ebp - 0x48]
push 0x47fc68
push eax
call fcn.00465b73
mov eax, dword [ebp + 0xc]
pop esi
leave
ret 8

Function at 0x41b718
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push esi
mov esi, ecx
push edi
cmp dword [esi + 4], 0
je 0x41b75d
mov eax, dword [ebp + 8]
test eax, eax
je 0x41b732
and dword [eax], 0
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
call dword [eax + 0x18]
mov edi, eax
cmp edi, 0xffffffff
jne 0x41b7b9
add esi, 0xc
push 1
push esi
lea ecx, [ebp - 0x4c]
call fcn.0041b5e8
lea eax, [ebp - 0x4c]
push 0x482608
push eax
call fcn.00465b73
push dword [ebp + 8]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x41b7b9
cmp dword [ebp + 8], 0
jne 0x41b792
add esi, 0xc
push 1
push esi
lea ecx, [ebp - 0x48]
call fcn.00408b81
lea eax, [ebp - 0x48]
push 0x47fc68
push eax
call fcn.00465b73
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x41b7b9
push 1
add esi, 0xc
push eax
push esi
lea ecx, [ebp - 0x48]
call fcn.0041acd5
lea eax, [ebp - 0x48]
push 0x47fc68
push eax
call fcn.00465b73
mov eax, edi
pop edi
pop esi
leave
ret 4