joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407cd0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x4710b0]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push esi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
xor esi, esi
lea eax, [ebp - 0x28]
push eax
push 0x28
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x34], 0x10
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x407d3f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043db8a
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x30]
push ecx
push str.SeDebugPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x407d6e
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043db8a
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
lea edx, [ebp - 0x34]
push edx
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x24]
push eax
push 0x10
mov dword [ebp - 0xc], ecx
lea ecx, [ebp - 0x14]
push ecx
push esi
push edx
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x407dc0
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043db8a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov al, 1
pop esi
call fcn.0043db8a
mov esp, ebp
pop ebp
ret
Function at 0x407de0
Capabilities:
Check if file exists
Copy file
Create process on windows
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5c
cmp dword [0x476248], 3
push ebx
push esi
push edi
jl 0x407ed7
mov eax, dword [0x476250]
mov ecx, dword [eax + 4]
push str._update
push ecx
call fcn.0043e52c
add esp, 8
test eax, eax
jne 0x407ed7
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x7d0
call edi
mov edx, dword [0x476250]
mov eax, dword [edx + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call ebx
test eax, eax
jne 0x407e74
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 2
je 0x407e74
cmp eax, 5
jne 0x407e61
mov ecx, dword [0x476250]
mov edx, dword [ecx + 8]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x64
call edi
mov eax, dword [0x476250]
mov ecx, dword [eax + 8]
push ecx
call ebx
test eax, eax
je 0x407e40
mov eax, dword [0x476250]
mov edx, dword [eax + 8]
mov eax, dword [eax]
push 0
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0x44
lea ecx, [esp + 0x24]
push 0
push ecx
call fcn.004426d0
mov ecx, dword [0x476250]
add esp, 0xc
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x24]
push eax
push 0
push 0
push 0
push 0
push 0
mov dword [esp + 0x3c], 0x44
mov edx, dword [ecx + 8]
push 0
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call fcn.00407cd0
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov eax, dword [ebp + 8]
push eax
call fcn.0040d926
add esp, 4
call fcn.0040d90e
mov ecx, eax
call fcn.00411bf7
push eax
call fcn.0040d930
add esp, 4
push 0x1004
call fcn.0043dba4
add esp, 4
test eax, eax
je 0x407f22
push eax
call fcn.00403720
mov esi, eax
test esi, esi
jne 0x407f41
push 0x10
push 0x468d34
push 0x469404
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0
push SysReAllocString
push SysReAllocString
push SysReAllocString
push SysReAllocString
push 0
push 0x10cf0000
push 0x46941c
push 0
mov ecx, esi
call fcn.0040d6dd
mov ecx, esi
call fcn.0040d25f
push 1
push 1
mov ecx, esi
call fcn.0040d226
call fcn.00410c28
call dword [sym.imp.ole32.dll_CoUninitialize]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x409090
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x456b38
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4710b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebx + 0x44], 0
je 0x409221
cmp byte [ebx + 0x49], 0
je 0x409221
mov eax, dword [ebx]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
mov ecx, ebx
call edx
cmp eax, 0xffffffff
je 0x409215
lea esi, [ebp - 0x2c]
call fcn.00408c90
mov dword [ebp - 4], 0
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov edx, eax
cmp edi, 0x10
jae 0x409103
lea edx, [ebp - 0x2c]
mov eax, edx
mov ecx, dword [ebx + 0x44]
mov esi, dword [ecx]
lea edi, [ebp - 0x30]
push edi
mov edi, dword [ebp - 0x1c]
add edi, edx
push edi
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [esi + 0x18]
call eax
sub eax, 0
je 0x40913c
dec eax
je 0x409140
sub eax, 2
lea ecx, [ebp - 0x2c]
je 0x40921c
call fcn.0040af60
xor al, al
jmp 0x409223
mov byte [ebx + 0x49], 0
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov edx, eax
cmp edi, 0x10
jae 0x409150
lea edx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, edx
je 0x40917d
cmp edi, 0x10
jae 0x40915f
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x54]
push ecx
push esi
push 1
push eax
call fcn.0043efbd
add esp, 0x10
cmp esi, eax
jne 0x40920d
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [ebx + 0x49], 0
je 0x409219
test esi, esi
jne 0x4090f7
mov ecx, dword [ebp - 0x1c]
or edx, 0xffffffff
sub edx, ecx
cmp edx, 8
jbe 0x40923e
lea esi, [ecx + 8]
cmp esi, 0xfffffffe
ja 0x40923e
cmp edi, esi
jae 0x4091f6
push ecx
push esi
lea ecx, [ebp - 0x2c]
call fcn.0040ac00
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
test esi, esi
je 0x4090f7
mov ecx, eax
cmp edi, 0x10
jae 0x4091d2
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 0x1c]
xor eax, eax
mov dword [ecx + edx], eax
mov dword [ecx + edx + 4], eax
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], esi
jae 0x4091ed
lea eax, [ebp - 0x2c]
mov byte [eax + esi], 0
jmp 0x4090f1
test esi, esi
jne 0x4091c8
mov dword [ebp - 0x1c], esi
cmp edi, 0x10
jae 0x409205
lea eax, [ebp - 0x2c]
mov byte [eax], 0
jmp 0x4090f1
lea ecx, [ebp - 0x2c]
call fcn.0040af60
xor al, al
jmp 0x409223
lea ecx, [ebp - 0x2c]
call fcn.0040af60
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043db8a
mov esp, ebp
pop ebp
ret
push str.string_too_long
call fcn.0040c5d1
int3
Function at 0x4093c0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4568fb
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4710b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0040cdf0
push 4
mov dword [ebp - 4], 0
call fcn.0043dba4
mov edi, eax
add esp, 4
test edi, edi
je 0x40943c
call fcn.0040cae2
mov dword [edi], eax
call fcn.0040c8a1
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.0040c7d6
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x409432
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.0040c7fe
jmp 0x40943e
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b5a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20bc
call fcn.004449d0
mov eax, dword [0x4710b0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push 0x469750
push eax
lea eax, [ebp - 0x20b8]
push eax
call fcn.0043ee1f
add esp, 0xc
test eax, eax
je 0x40b5e7
xor al, al
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0043db8a
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x20b4]
push ecx
call dword [sym.imp.ADVAPI32.dll_MD5Init]
mov edx, dword [ebp - 0x20b8]
push 0
push 0
push edx
call fcn.00440145
mov eax, dword [ebp - 0x20b8]
push eax
call fcn.004401c1
add esp, 0x10
test eax, eax
jne 0x40b673
mov ebx, dword [sym.imp.ADVAPI32.dll_MD5Update]
lea ecx, [ecx]
mov ecx, dword [ebp - 0x20b8]
push ecx
push 0x2000
lea edx, [ebp - 0x204c]
push 1
push edx
call fcn.0044045b
mov esi, eax
mov eax, dword [ebp - 0x20b8]
push eax
call fcn.004401e9
add esp, 0x14
test eax, eax
jne 0x40b673
push esi
lea ecx, [ebp - 0x204c]
push ecx
lea edx, [ebp - 0x20b4]
push edx
call ebx
mov eax, dword [ebp - 0x20b8]
push eax
call fcn.004401c1
add esp, 4
test eax, eax
je 0x40b620
mov ecx, dword [ebp - 0x20b8]
push ecx
call fcn.0043f28a
add esp, 4
lea edx, [ebp - 0x20b4]
push edx
call dword [sym.imp.ADVAPI32.dll_MD5Final]
xor esi, esi
movzx eax, byte [ebp + esi - 0x205c]
push eax
push 0x469744
lea edx, [ebp - 0x4c]
call fcn.00409790
lea ecx, [ebp - 0x4c]
push ecx
push 0x21
push edi
call fcn.0043e1fd
inc esi
add esp, 0x14
cmp esi, 0x10
jl 0x40b691
mov ecx, dword [ebp - 8]
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.0043db8a
mov esp, ebp
pop ebp
ret
Function at 0x40b7e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
mov eax, dword [ebp + 8]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40b7f8
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40b82a
mov ecx, dword [ebp + 8]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x40b826
cmp esi, eax
jae 0x40b82a
dec edi
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x40b818
cmp esi, eax
jb 0x40b830
pop esi
xor eax, eax
pop edi
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x40b840
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor esi, esi
push esi
mov ecx, 0x477004
call fcn.00454e54
mov ebx, eax
mov dword [ebp - 4], 1
test ebx, ebx
je 0x40b8f4
test esi, esi
jne 0x40b8f4
mov eax, dword [ebp + 8]
shr eax, 4
inc eax
push esi
movzx ecx, ax
push ecx
push 6
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov edi, eax
test edi, edi
je 0x40b8d8
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40b8d2
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40b8d2
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
add eax, esi
and ecx, 0xf
jbe 0x40b8c1
cmp esi, eax
jae 0x40b8c5
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x40b8b3
cmp esi, eax
jb 0x40b8c9
xor eax, eax
jmp 0x40b8d2
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
mov esi, eax
test eax, eax
jne 0x40b8fd
mov edi, dword [ebp - 4]
push edi
mov ecx, 0x477004
call fcn.00454e54
mov ebx, eax
inc edi
mov dword [ebp - 4], edi
test ebx, ebx
jne 0x40b865
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40b9e0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4710b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [0x4697b4]
mov eax, dword [str._unknown_]
mov ecx, dword [0x4697b0]
push esi
push 0x1f4
mov dword [ebp - 0x204], edx
mov dword [ebp - 0x20c], eax
mov eax, dword [0x4697b8]
mov dword [ebp - 0x208], ecx
mov ecx, dword [0x4697bc]
lea edx, [ebp - 0x1f8]
push 0
push edx
mov dword [ebp - 0x200], eax
mov dword [ebp - 0x1fc], ecx
call fcn.004426d0
add esp, 0xc
push edi
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x40ba8d
lea eax, [ebp - 0x214]
push eax
push 4
lea ecx, [ebp - 0x210]
push ecx
push esi
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x40ba8d
mov eax, dword [ebp - 0x210]
push 0x104
lea edx, [ebp - 0x20c]
push edx
push eax
push esi
call dword [sym.imp.PSAPI.DLL_GetModuleBaseNameW]
push edi
lea ecx, [ebp - 0x20c]
push ecx
push str._s___PID:__u__n
call fcn.0043e771
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0043db8a
mov esp, ebp
pop ebp
ret
Function at 0x40be90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [0x477448]
cmp eax, 0xffffffff
jne 0x40bea6
xor eax, eax
pop esi
pop ebp
ret 4
cmp dword [esi + 4], 0
mov dword [esi + 8], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0xc], eax
je 0x40be9f
push 0
push 0
push esi
push 0x40bee0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x14], eax
test eax, eax
je 0x40be9f
mov eax, 1
mov dword [esi + 0x10], eax
pop esi
pop ebp
ret 4

Function at 0x40d777
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0x11
xor edi, edi
call esi
test ax, ax
jge 0x40d78d
push 8
pop edi
push 2
call esi
test ax, ax
jge 0x40d799
or edi, 1
push 1
call esi
test ax, ax
jge 0x40d7a5
or edi, 2
push 0x10
call esi
test ax, ax
jge 0x40d7b1
or edi, 4
push 0x12
call esi
test ax, ax
jge 0x40d7bd
or edi, 0x20
mov eax, edi
pop edi
pop esi
ret

Function at 0x40f2fb
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [esi]
mov ebx, dword [ebp + 8]
cmp eax, ecx
je 0x40f320
cmp ebx, dword [esi + 0x54]
je 0x40f320
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [esi + 0x54]
cmp ebx, eax
je 0x40f3e2
push edi
test eax, eax
je 0x40f373
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x20], 0x14
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x54]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ecx]
push edx
call dword [eax + pe_nt_image_headers32]
xor edi, edi
push edi
push edi
push edi
push str.killfocus
push dword [esi + 0x54]
mov ecx, esi
call fcn.0040ee33
mov dword [esi + 0x54], edi
test ebx, ebx
je 0x40f3e1
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
cmp eax, esi
jne 0x40f3e1
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xc8]
test al, al
je 0x40f3e1
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xd4]
test al, al
je 0x40f3e1
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov dword [esi + 0x54], ebx
mov dword [ebp - 0x20], 0x15
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x54]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ecx]
push edx
call dword [eax + pe_nt_image_headers32]
xor eax, eax
push eax
push eax
push eax
push str.setfocus
push dword [esi + 0x54]
mov ecx, esi
call fcn.0040ee33
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40f5df
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 0xd0]
mov ecx, edi
xor ebx, ebx
call fcn.0040d1f0
test eax, eax
jle 0x40f62e
push ebx
mov ecx, edi
mov byte [ebp - 1], 0
call fcn.00411a76
mov edx, dword [eax]
lea ecx, [ebp - 1]
push ecx
push dword [ebp + 0x10]
mov ecx, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [edx]
cmp byte [ebp - 1], 0
jne 0x40f68f
mov ecx, edi
inc ebx
call fcn.0040d1f0
cmp ebx, eax
jl 0x40f5fd
mov eax, dword [ebp + 8]
sub eax, 0x100
je 0x40f6e8
sub eax, 4
je 0x40f693
dec eax
dec eax
jne 0x40f6df
push dword [ebp + 0xc]
mov word [ebp + 8], ax
lea edi, [ebp + 0xa]
stosw word es:[edi], ax
call fcn.00442973
pop ecx
mov ecx, dword [esi + 0x50]
push 0x8000000a
lea edx, [ebp + 8]
push edx
mov word [ebp + 8], ax
mov eax, dword [ecx]
push 0x40e8ba
call dword [eax + 0xfc]
mov esi, eax
test esi, esi
je 0x40f6df
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xf0]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x18]
mov al, 1
jmp 0x40f6e1
cmp dword [esi + 0x54], 0
je 0x40f6df
xor eax, eax
push 7
pop ecx
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
mov ax, word [ebp + 0xc]
mov word [ebp - 0x10], ax
mov eax, dword [esi + 0x64]
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 0x68]
mov dword [ebp - 0x24], 6
mov dword [ebp - 0x14], eax
call fcn.0040d777
mov word [ebp - 0xe], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x54]
lea edx, [ebp - 0x24]
mov dword [ebp - 0x1c], eax
mov eax, dword [ecx]
push edx
call dword [eax + pe_nt_image_headers32]
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0x10
cmp dword [ebp + 0xc], 9
jne 0x40f6df
cmp dword [esi + 0x54], 0
je 0x40f737
mov ecx, dword [esi + 0x54]
mov eax, dword [ecx]
call dword [eax + 0xc8]
test al, al
je 0x40f737
mov ecx, dword [esi + 0x54]
mov eax, dword [ecx]
call dword [eax + 0xd4]
test al, al
je 0x40f737
mov ecx, dword [esi + 0x54]
mov eax, dword [ecx]
push str.RichEditUI
call dword [eax + 0xc]
push eax
call fcn.0043e342
pop ecx
pop ecx
test eax, eax
je 0x40f737
mov ecx, dword [esi + 0x54]
call fcn.00421843
test al, al
jne 0x40f6df
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setge al
movzx eax, al
push eax
mov ecx, esi
call fcn.0040f493
jmp 0x40f68f
Function at 0x416b25
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
sub esp, 0x2b4
lea ebp, [esp - 4]
mov eax, dword [0x4710b0]
xor eax, ebp
mov dword [ebp + 0x2b4], eax
push 0xc
mov eax, 0x4558d5
call fcn.00440ee5
mov edi, dword [ebp + 0x2c0]
mov ebx, ecx
call fcn.0041610e
call fcn.0040d90e
push eax
lea ecx, [ebp + 0x230]
call fcn.00411e5c
xor esi, esi
mov dword [ebp - 4], esi
call fcn.0040d914
mov ecx, eax
call fcn.00411bcc
test al, al
je 0x416c87
push edi
lea ecx, [ebp + 0x230]
call fcn.00411c5f
push esi
push 0x80
push 3
push esi
push 1
push SysReAllocString
lea ecx, [ebp + 0x230]
call fcn.00411bf7
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x18], eax
push esi
cmp eax, 0xffffffff
jne 0x416bfb
push str.Error_opening_file
mov ecx, ebx
call fcn.004162e4
mov bl, al
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x230]
call fcn.00411aa7
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x2b4]
xor ecx, ebp
call fcn.0043db8a
add ebp, 0x2b8
leave
ret 8
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, esi
jne 0x416c10
push esi
push str.File_is_empty
jmp 0x416bbc
cmp edi, 0x400000
jbe 0x416c20
push esi
push 0x45997c
jmp 0x416bbc
push edi
mov dword [ebp - 0x14], esi
call fcn.0040c4fb
pop ecx
push esi
lea ecx, [ebp - 0x14]
push ecx
push edi
push eax
push dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x14], edi
je 0x416c66
push dword [ebp - 0x10]
call fcn.0043dc24
pop ecx
mov ecx, ebx
call fcn.0041610e
push esi
push str.Could_not_read_file
jmp 0x416bbc
push dword [ebp + 0x2c4]
mov ecx, ebx
push edi
push dword [ebp - 0x10]
call fcn.004169d4
push dword [ebp - 0x10]
mov bl, al
call fcn.0043dc24
pop ecx
jmp 0x416bc5
call fcn.0040d914
push eax
lea ecx, [ebp + 0x230]
call fcn.00411c45
call fcn.0040d91a
test al, al
je 0x416ca8
call fcn.0040d920
jmp 0x416cbf
push 2
push esi
lea ecx, [ebp + 0x230]
call fcn.00411bf7
push eax
call fcn.0041a593
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp eax, esi
jne 0x416cd1
push esi
push str.Error_opening_zip_file
jmp 0x416bbc
lea eax, [ebp]
push eax
lea eax, [ebp - 0x18]
push eax
push 1
push edi
push dword [ebp - 0x10]
call fcn.00418c91
add esp, 0x14
test eax, eax
je 0x416cf6
push esi
push str.Could_not_find_ziped_file
jmp 0x416bbc
mov eax, dword [ebp + 0x22c]
mov dword [ebp - 0x14], eax
cmp eax, esi
je 0x416c08
cmp eax, 0x400000
ja 0x416c18
push eax
call fcn.0040c4fb
push 3
push dword [ebp - 0x14]
mov edi, eax
push edi
push dword [ebp - 0x18]
push dword [ebp - 0x10]
call fcn.0041a5f0
add esp, 0x18
cmp eax, esi
je 0x416d5d
cmp eax, 0x600
je 0x416d5d
push edi
call fcn.0043dc24
pop ecx
call fcn.0040d91a
test al, al
jne 0x416d52
push dword [ebp - 0x10]
call fcn.0041a62a
pop ecx
push esi
push str.Could_not_unzip_file
jmp 0x416bbc
call fcn.0040d91a
test al, al
jne 0x416d6f
push dword [ebp - 0x10]
call fcn.0041a62a
pop ecx
push dword [ebp + 0x2c4]
mov ecx, ebx
push dword [ebp - 0x14]
push edi
call fcn.004169d4
push edi
jmp 0x416c7a