joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432050
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x214
mov eax, dword [0x46d070]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_ReportEventW]
mov eax, dword [esi + 0x38]
shr eax, 1
test al, 1
jne 0x432164
push 0
push 0x1e
push dword [esi + 0x14]
push dword [esi + 0x10]
call fcn.00436340
mov ebx, eax
mov eax, edx
mov dword [esp + 0xc], eax
test eax, eax
jne 0x4320a6
cmp ebx, 1
jbe 0x432164
push 0
push 0x1e
push dword [esi + 0x24]
push dword [esi + 0x20]
call fcn.00436340
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edx
cmp ecx, edx
jb 0x4320e7
ja 0x4320cb
cmp ebx, eax
jb 0x4320e7
mov edx, ebx
mov eax, ecx
add edx, 0xffffffff
adc eax, 0xffffffff
cmp eax, dword [esp + 0x10]
jb 0x432164
ja 0x4320e7
cmp edx, dword [esp + 0x14]
jbe 0x432164
mov eax, dword [esi + 0x10]
mov dword [esi + 0x20], eax
mov eax, dword [esi + 0x14]
mov dword [esi + 0x24], eax
xor eax, eax
mov word [esp + 0x18], ax
test ecx, ecx
jne 0x432103
cmp ebx, 0x78
jb 0x432130
push 0x464e0c
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [esi + 8]
test eax, eax
je 0x432130
push 0
push 0
push 0
push 0
push 0
push 0x40000004
push 0
push 4
push eax
call edi
mov eax, dword [esi + 8]
test eax, eax
je 0x43214d
push 0
push 0
push 0
push 0
push 0
push 0x40000003
push 0
push 4
push eax
call edi
mov ecx, dword [esi + 4]
lea edx, [esp + 0x18]
push 0
add ecx, 0x20a
call fcn.00431480
add esp, 4
mov eax, dword [esi + 8]
test eax, eax
je 0x432181
push 0
push 0
push 0
push 0
push 0
push 0x400003e8
push 0
push 4
push eax
call edi
cmp dword [esi + 0x3c], 1
mov eax, dword [esi + 0x10]
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x14]
mov dword [esi + 0x30], 0
mov dword [esi + 0x1c], eax
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
jne 0x4321f4
cmp dword [esi + 0x108], 0
jne 0x4321e6
cmp dword [esi + 0x120], 0
jne 0x4321e6
cmp dword [esi + 0x138], 0
mov eax, 3
mov ecx, 6
cmovne eax, ecx
mov dword [esi + 0x34], eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0043598e
mov esp, ebp
pop ebp
ret
mov ecx, esi
mov dword [esi + 0x34], 2
call fcn.00432210
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0043598e
mov esp, ebp
pop ebp
ret
Function at 0x432210
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
cmp dword [esi + 0x4c], 0xa
jae 0x432283
mov eax, dword [esi + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
lea eax, [esi + 0x50]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x38]
shr eax, 1
test al, 1
je 0x432242
mov eax, dword [esi + 0x140]
jmp 0x432244
xor eax, eax
push eax
lea eax, [esi + 0x110]
push eax
lea eax, [esi + 0xf8]
push eax
lea ecx, [ebp - 0xc]
call fcn.0041e240
test al, al
je 0x43227b
cmp dword [esi + 0x30], 0
jne 0x432271
mov eax, dword [esi + 0x10]
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x14]
mov dword [esi + 0x1c], eax
mov eax, 1
mov dword [esi + 0x30], eax
jmp 0x43229a
mov eax, dword [esi + 0x30]
mov dword [esi + 0x30], eax
jmp 0x43229a
cmp dword [esi + 0x48], 0xa
jae 0x432292
cmp dword [esi + 0x138], 0
jne 0x43229a
lea ecx, [esi + 0x50]
call fcn.00416a40
cmp dword [esi + 0x108], 0
jne 0x4322b5
cmp dword [esi + 0x120], 0
jne 0x4322b5
cmp dword [esi + 0x138], 0
je 0x4322f7
cmp dword [esi + 0x30], 0
je 0x4322cb
mov eax, dword [esi + 0x10]
cmp eax, dword [esi + 0x18]
jne 0x4322f7
mov eax, dword [esi + 0x14]
cmp eax, dword [esi + 0x1c]
jne 0x4322f7
push 0
push 0x1e
push dword [esi + 0x14]
push dword [esi + 0x10]
call fcn.00451b20
test edx, edx
jne 0x4322f7
cmp eax, 0x1d
jae 0x4322f7
cmp dword [esi + 0x138], edx
je 0x43231f
mov dword [esi + 0x34], 6
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 8]
mov dword [esi + 0x34], 3
test eax, eax
je 0x43231f
push 0
push 0
push 0
push 0
push 0
push 0x400003fc
push 0
push 4
push eax
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x432400
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20c
mov eax, dword [0x46d070]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
push esi
push edi
mov esi, ecx
push 0
push 0x1e
push dword [esi + 0x14]
push dword [esi + 0x10]
call fcn.00436340
mov ebx, edx
mov edi, eax
test ebx, ebx
jne 0x43243b
cmp edi, 1
jb 0x432452
push 0
push 0x1e
push dword [esi + 0x24]
push dword [esi + 0x20]
call fcn.00436340
cmp edi, eax
jne 0x432460
cmp ebx, edx
jne 0x432460
mov eax, dword [esi + 0x38]
shr eax, 2
test al, 1
je 0x432506
push 0x1fe
lea eax, [esp + 0x16]
push 0
push eax
call fcn.0043a360
mov eax, dword [esi + 0x10]
add esp, 0xc
mov dword [esi + 0x20], eax
mov eax, dword [esi + 0x14]
mov dword [esi + 0x24], eax
xor eax, eax
mov word [esp + 0x10], ax
test ebx, ebx
jne 0x432490
cmp edi, 0x78
jb 0x4324c1
push 0x464e0c
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [esi + 8]
test eax, eax
je 0x4324c1
push 0
push 0
push 0
push 0
push 0
push 0x40000004
push 0
push 4
push eax
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
mov eax, dword [esi + 8]
test eax, eax
je 0x4324e2
push 0
push 0
push 0
push 0
push 0
push 0x40000003
push 0
push 4
push eax
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
mov ecx, dword [esi + 4]
lea edx, [esp + 0x10]
push 0
add ecx, 0x20a
call fcn.00431480
add esp, 4
test eax, eax
je 0x432529
test ebx, ebx
jne 0x432522
cmp edi, 0x78
jae 0x432522
mov dword [esi + 0x34], 4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.0043598e
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x34], 5
mov ecx, dword [esp + 0x214]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0043598e
mov esp, ebp
pop ebp
ret
Function at 0x432700
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
lea eax, [esi + 0xf8]
push eax
push str.CanonPortO
call fcn.00432e10
lea eax, [esi + 0x110]
push eax
push str.CanonPortN
call fcn.00432e10
lea eax, [esi + 0x128]
push eax
push str.CanonPort
call fcn.00432e10
mov eax, dword [esi + 0x30]
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
push 0x20006
push 0
push str.SoftwareCanonIJPLM
push 0x80000002
mov dword [esp + 0x20], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x432798
push 4
lea eax, [esp + 0x14]
push eax
push 4
push 0
push str.Retreive
push dword [esp + 0x20]
call edi
push dword [esp + 0xc]
call ebx
mov eax, dword [esi + 0x34]
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
push 0x20006
push 0
push str.SoftwareCanonIJPLM
push 0x80000002
mov dword [esp + 0x20], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4327e3
push 4
lea eax, [esp + 0x14]
push eax
push 4
push 0
push str.Mode
push dword [esp + 0x20]
call edi
push dword [esp + 0xc]
call ebx
mov eax, dword [esi + 0x38]
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
push 0x20006
push 0
push str.SoftwareCanonIJPLM
push 0x80000002
mov dword [esp + 0x20], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43282e
push 4
lea eax, [esp + 0x14]
push eax
push 4
push 0
push str.ExtFlag
push dword [esp + 0x20]
call edi
push dword [esp + 0xc]
call ebx
mov eax, dword [esi + 0x10]
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [esp + 0x14], eax
lea eax, [esp + 0xc]
push eax
push 0x20006
push 0
push str.SoftwareCanonIJPLM
push 0x80000002
mov dword [esp + 0x20], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x432880
push 8
lea eax, [esp + 0x14]
push eax
push 0xb
push 0
push str.BeforeDate
push dword [esp + 0x20]
call edi
push dword [esp + 0xc]
call ebx
mov eax, dword [esi + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x1c]
mov dword [esp + 0x14], eax
lea eax, [esp + 0xc]
push eax
push 0x20006
push 0
push str.SoftwareCanonIJPLM
push 0x80000002
mov dword [esp + 0x20], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4328d2
push 8
lea eax, [esp + 0x14]
push eax
push 0xb
push 0
push str.RetreiveDate
push dword [esp + 0x20]
call edi
push dword [esp + 0xc]
call ebx
mov eax, dword [esi + 0x20]
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x24]
mov dword [esp + 0x14], eax
lea eax, [esp + 0xc]
push eax
push 0x20006
push 0
push str.SoftwareCanonIJPLM
push 0x80000002
mov dword [esp + 0x20], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x432924
push 8
lea eax, [esp + 0x14]
push eax
push 0xb
push 0
push str.BeforeSendDate
push dword [esp + 0x20]
call edi
push dword [esp + 0xc]
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x432e10
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x20006
push 0
push str.SoftwareCanonIJPLM
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x432e6f
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 0x14], 8
mov eax, dword [ecx + 0x10]
jb 0x432e4b
mov ecx, dword [ecx]
lea eax, [eax*2 + 2]
push eax
push ecx
push 1
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
pop esi
sete al
mov esp, ebp
pop ebp
ret 8

Function at 0x4330a0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, edx
mov dword [esp + 0x1c], ecx
nop dword [eax + eax]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
push 0x20019
push 0
push str.SoftwareCanonIJPLM
xorps xmm0, xmm0
mov dword [esp + 0x24], 0
push 0x80000002
movlpd qword [esp + 0x3c], xmm0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x433217
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 8
push eax
lea eax, [esp + 0x2c]
push eax
push 0
push 0
push str.InstallDate
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0x10]
mov esi, eax
call edi
test esi, esi
jne 0x433217
mov esi, dword [esp + 0x28]
mov eax, esi
mov edi, dword [esp + 0x2c]
or eax, edi
je 0x433217
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
test ebx, ebx
je 0x433160
mov dword [ebx], ecx
mov dword [ebx + 4], eax
cmp eax, edi
jb 0x4331a5
ja 0x43316a
cmp ecx, esi
jbe 0x4331a5
sub ecx, esi
push 0xc9
push 0x2a69c000
sbb eax, edi
push eax
push ecx
call fcn.00436340
mov ecx, eax
mov dword [esp + 0x20], eax
and ecx, edx
mov dword [esp + 0x24], edx
cmp ecx, 0xffffffff
je 0x4331b5
mov ecx, dword [esp + 0x1c]
mov dword [ecx], eax
mov eax, 1
mov dword [ecx + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x24], 0xffffffff
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0
lea eax, [esp + 0x1c]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push str.SoftwareCanonIJPLM
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4330c0
push 8
lea eax, [esp + 0x34]
push eax
push 0xb
push 0
push str.InstallDate
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x18]
call edi
jmp 0x4330c0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x433220
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x46d070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
lea eax, [ebp - 0x11c]
xor ebx, ebx
push eax
push 0x20019
push ebx
push str.SoftwareCanonIJPLM
push 0x80000002
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4332ee
lea eax, [ebp - 0x128]
mov dword [ebp - 0x120], 0x270f
push eax
lea eax, [ebp - 0x120]
mov dword [ebp - 0x124], ebx
push eax
lea eax, [ebp - 0x130]
mov dword [ebp - 0x128], 4
push eax
push ebx
push str.UnsupportMajor
push dword [ebp - 0x11c]
mov dword [ebp - 0x12c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
lea eax, [ebp - 0x12c]
push eax
cmove edi, dword [ebp - 0x120]
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push str.UnsupportMinor
push dword [ebp - 0x11c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x11c]
test eax, eax
cmove ebx, dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x114
lea eax, [ebp - 0x118]
push 0
push eax
call fcn.0043a360
add esp, 0xc
mov dword [ebp - 0x118], 0x114
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x43334e
cmp dword [ebp - 0x108], 2
jne 0x43334e
mov eax, dword [ebp - 0x114]
cmp eax, edi
ja 0x43334e
jne 0x43333c
cmp dword [ebp - 0x110], ebx
jae 0x43334e
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043598e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop ebx
call fcn.0043598e
mov esp, ebp
pop ebp
ret

Function at 0x433410
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov edi, ecx
xor esi, esi
push edi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x433477
push esi
lea eax, [ebp - 4]
mov dword [ebp - 8], esi
push eax
push 1
xorps xmm0, xmm0
push str.D:_A_OICI_GWGRSDDTDC___BU__A_OICI_GWGRSDDTDC___AU__A_OICI_GA___BA__A_OICI_GA___SY_
movq qword [ebp - 0x10], xmm0
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
je 0x43345f
mov eax, dword [ebp - 4]
mov dword [ebp - 8], esi
lea esi, [ebp - 0x10]
mov dword [ebp - 0x10], 0xc
mov dword [ebp - 0xc], eax
push esi
push edi
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov eax, dword [ebp - 4]
test eax, eax
je 0x433477
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x433490
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x468
mov eax, dword [0x46d070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor esi, esi
call fcn.00433950
test eax, eax
jne 0x43357b
push 0x20a
push eax
lea eax, [ebp - 0x428]
push eax
call fcn.0043a360
push 0x20a
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.0043a360
add esp, 0x18
mov dword [ebp - 0x440], esi
xorps xmm0, xmm0
lea eax, [ebp - 0x218]
movaps xmmword [ebp - 0x460], xmm0
movaps xmmword [ebp - 0x450], xmm0
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x43357b
lea eax, [ebp - 0x218]
push eax
push str._skernel32.dll
lea eax, [ebp - 0x428]
push 0x105
push eax
call fcn.004339f0
add esp, 0x10
xor eax, eax
mov ecx, str.KERNEL32.DLL
mov word [ebp - 0x220], ax
call fcn.00401160
mov edi, eax
test edi, edi
je 0x43357b
push str.GetNativeSystemInfo
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x433574
lea ecx, [ebp - 0x460]
push ecx
call eax
movzx esi, word [ebp - 0x460]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov ax, si
pop edi
xor ecx, ebp
pop esi
call fcn.0043598e
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret

Function at 0x433950
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x46d070]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x114
lea eax, [ebp - 0x118]
push 0
push eax
call fcn.0043a360
add esp, 0xc
mov dword [ebp - 0x118], 0x114
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x108], 2
jne 0x4339be
cmp dword [ebp - 0x114], 5
jne 0x4339be
cmp dword [ebp - 0x110], 0
jne 0x4339be
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043598e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.0043598e
mov esp, ebp
pop ebp
ret
Function at 0x1022a000
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x1022a1ed
pushal
mov esi, section..data
lea edi, [esi - 0xc1000]
push edi
or ebp, 0xffffffff
jmp 0x1022a02a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1022a031
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1022a020
mov eax, 1
add ebx, ebx
jne 0x1022a043
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1022a054
jne 0x1022a073
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1022a073
dec eax
add ebx, ebx
jne 0x1022a060
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x1022a038
add ebx, ebx
jne 0x1022a06f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x1022a0c5
xor ecx, ecx
sub eax, 3
jb 0x1022a08b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1022a0fa
sar eax, 1
mov ebp, eax
jmp 0x1022a096
add ebx, ebx
jne 0x1022a096
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1022a064
inc ecx
add ebx, ebx
jne 0x1022a0a4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1022a064
add ebx, ebx
jne 0x1022a0b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1022a0a6
jne 0x1022a0c2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1022a0a6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x1022a0e4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1022a0d6
jmp 0x1022a026
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x1022a0e4
add edi, ecx
jmp 0x1022a026
pop esi
mov edi, esi
mov ecx, 0x4318
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x1022a102
cmp byte [edi], 0x13
jne 0x1022a102
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x1022a107
lea edi, [esi + 0x223000]
mov eax, dword [edi]
or eax, eax
je 0x1022a17f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x22a324]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x22a43c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1022a134
mov ecx, edi
jns 0x1022a163
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x22a440]
or eax, eax
je 0x1022a179
mov dword [ebx], eax
add ebx, 4
jmp 0x1022a151
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x1022a1b0
cmp al, 0xef
ja 0x1022a1a3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x1022a185
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x1022a192
mov ebp, dword [esi + 0x22a444]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1022a1e4
sub esp, 0xffffff80
jmp 0x1006195d
Function at 0x4014d8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
xor esi, esi
push edi
test edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], 1
jbe 0x401533
mov eax, dword [ecx + 2]
mov edi, dword [ecx + 0x32]
mov dword [ebp - 0xc], eax
mov ebx, 0x10000
cmp dword [ebp - 4], ebx
ja 0x401507
mov ebx, dword [ebp - 4]
lea eax, [ebp - 0x10]
push 0
push eax
lea eax, [esi + edi]
push ebx
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40152f
mov eax, dword [ebp - 0x10]
cmp eax, ebx
jne 0x40152f
add esi, eax
sub dword [ebp - 4], eax
jne 0x4014fa
jmp 0x401533
and dword [ebp - 8], 0
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
mov eax, dword [ebp - 8]
pop esi
pop ebx
leave
ret 4

Function at 0x401563
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
xor esi, esi
push edi
test edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], 1
jbe 0x4015be
mov eax, dword [ecx + 2]
mov edi, dword [ecx + 0x32]
mov dword [ebp - 0xc], eax
mov ebx, 0x10000
cmp dword [ebp - 4], ebx
ja 0x401592
mov ebx, dword [ebp - 4]
lea eax, [ebp - 0x10]
push 0
push eax
lea eax, [esi + edi]
push ebx
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4015ba
mov eax, dword [ebp - 0x10]
cmp eax, ebx
jne 0x4015ba
add esi, eax
sub dword [ebp - 4], eax
jne 0x401585
jmp 0x4015be
and dword [ebp - 8], 0
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
mov eax, dword [ebp - 8]
pop esi
pop ebx
leave
ret 4
Function at 0x401841
Capabilities:
Check if file exists
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 0x46
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
push 0x40
call edi
mov esi, eax
test esi, esi
je 0x4018fa
and dword [esi + 0x32], 0
push 0x40000
push 0x40
mov word [esi], 0x46
call edi
test eax, eax
mov dword [ebp - 0xc], eax
mov dword [esi + 0x32], eax
jne 0x40188b
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x4018fa
lea ecx, [ebp - 0x20]
call fcn.0040182b
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x20]
push 0
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push ebx
push dword [ebp - 4]
push dword [ebp - 8]
call edi
cmp eax, 0xffffffff
mov dword [esi + 2], eax
jne 0x4018e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x4018e4
test bl, 1
je 0x4018e4
push 0
lea eax, [ebp - 0x20]
push dword [ebp + 0x10]
or ebx, 2
push dword [ebp + 0xc]
push eax
push ebx
push dword [ebp - 4]
push dword [ebp - 8]
call edi
mov dword [esi + 2], eax
mov ecx, dword [esi + 2]
cmp ecx, 0xffffffff
jne 0x4018ff
push dword [ebp - 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
call edi
push esi
call edi
or esi, 0xffffffff
jmp 0x401955
mov eax, dword [ebp - 4]
mov dword [esi + 0xe], 0x40000
mov dword [esi + 6], eax
mov eax, dword [ebp - 0xc]
add eax, 0x40000
mov dword [esi + 0x36], eax
xor eax, eax
mov dword [esi + 0x22], eax
mov dword [esi + 0x1a], eax
mov dword [esi + 0x26], eax
mov dword [esi + 0x1e], eax
lea eax, [ebp - 0x10]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x14], eax
mov dword [esi + 0x12], eax
mov eax, dword [ebp - 0x10]
xor edx, edx
mov ecx, esi
mov dword [esi + 0x16], eax
call fcn.004017fe
mov eax, dword [esi + 0xe]
mov ecx, esi
add eax, dword [esi + 0x32]
mov dword [esi + 0x36], eax
call fcn.00401607
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0xc