joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40eb30
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x46400c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
push ebx
push 0xfa0
push 0
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
jne 0x40eb6c
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042cf3b
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x458eec
push ebx
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x40eb59
push esi
push edi
sub esp, 8
lea ecx, [ebx + 0xfa4]
push dword [ebp - 0xc]
call fcn.0040c2f0
mov eax, dword [ebp - 0xc]
lea ecx, [ebx + 0xfac]
sub esp, 8
add eax, 2
push eax
call fcn.0040c2f0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x45876c
lea ecx, [ebx + 0xfac]
call fcn.0040ad30
push eax
lea ecx, [ebx + 0xfa4]
call fcn.0040ad30
push eax
push str.StringFileInfo_
lea ecx, [ebx + 0xfb4]
call fcn.0040acd0
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042cf3b
mov esp, ebp
pop ebp
ret 4

Function at 0x40edc0
Capabilities:
Check if file exists

Disassembly:
push ebx
mov ebx, ecx
cmp byte [ebx + 0x34], 0
lea ecx, [ebx + 8]
jne 0x40edd2
pop ebx
jmp fcn.0040ad30
mov eax, dword [ebx]
push esi
push edi
push 1
mov esi, dword [eax]
push 0
push 0x104
push 0
push 0x800
call fcn.0040afa0
push eax
push dword [ebx]
call dword [esi + 0xc]
lea ecx, [ebx + 8]
test eax, eax
jns 0x40ee02
pop edi
pop esi
pop ebx
jmp fcn.0040ad30
call fcn.0040ad30
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40ee2f
push 0x800
lea ecx, [ebx + 8]
call fcn.0040ad30
push eax
lea ecx, [ebx + 8]
call fcn.0040ad30
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
pop edi
pop esi
lea ecx, [ebx + 8]
pop ebx
jmp fcn.0040ad30

Function at 0x40f0b0
Capabilities:
Create new key via cryptacquirecontext
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebx
push esi
push 0xf0000000
push 0x18
push str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
mov esi, ecx
mov ebx, edx
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x40f0e7
push 0xf0000000
push 0x18
push str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider__Prototype_
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x40f10c
push ebx
push 0
push 0
push 0x8003
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x40f113
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esi], 0
pop esi
xor al, al
pop ebx
ret 4
pop esi
mov al, 1
pop ebx
ret 4
Function at 0x40f120
Capabilities:
Hash data via wincrypt
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44c4d0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x46400c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 0
push 0
push 3
push 0
push 1
push SysReAllocString
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
push ecx
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
or eax, 0xffffffff
test edi, edi
cmove edi, eax
mov dword [ebp - 0x28], edi
mov dword [ebp - 4], 0
cmp edi, eax
je 0x40f2bf
test edi, edi
je 0x40f2bf
push ecx
lea edx, [ebp - 0x14]
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x14], 0
xor bl, bl
call fcn.0040f0b0
test al, al
je 0x40f2bf
push 0x44e798
push 0x80000
mov dword [ebp - 0x18], 0x80000
call fcn.0042d302
mov esi, eax
add esp, 8
mov dword [ebp - 0x24], esi
mov byte [ebp - 4], 1
test esi, esi
je 0x40f292
push 0
lea eax, [ebp - 0x18]
push eax
push 0x80000
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40f22e
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x40f22e
push 0
push eax
push esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x40f292
call fcn.0040c7b0
push 0
lea eax, [ebp - 0x18]
push eax
push 0x80000
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40f1f6
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x20]
push 0
push eax
push edx
push 4
push dword [ebp - 0x14]
mov dword [ebp - 0x20], 4
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x40f292
mov esi, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
push dword [esi]
call fcn.00423220
test eax, eax
je 0x40f28f
push 0
push esi
mov esi, dword [ebp - 0x24]
push esi
push 2
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x40f292
mov edx, dword [ebp - 0x2c]
mov ecx, esi
push 0
push 0xffff
push dword [ebp - 0x30]
mov edx, dword [edx]
call fcn.0040cbf0
mov bl, al
jmp 0x40f292
mov esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40f2a2
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x40f2b0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
test esi, esi
je 0x40f2c1
push esi
call fcn.0042cfa2
add esp, 4
jmp 0x40f2c1
xor bl, bl
cmp edi, 0xffffffff
je 0x40f2d1
test edi, edi
je 0x40f2d1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042cf3b
mov esp, ebp
pop ebp
ret 8
Function at 0x40f300
Capabilities:
Contain obfuscated stackstrings
Encrypt data using aes via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x46400c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov esi, edx
mov edi, ecx
cmp dword [eax], 0xa070
je 0x40f335
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042cf3b
mov esp, ebp
pop ebp
ret 4
push 0x20
push str.9F15E8B42592E073F0A14AFF69039F7D
mov edx, 0x20
mov dword [ebp - 0x40], 0x208
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x3c], 0x6610
mov dword [ebp - 0x38], 0x20
call fcn.0042ce60
add esp, 8
lea eax, [ebp - 0x40]
push esi
push 0
push 0
push 0x2c
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x40f321
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x34333231
push eax
push 1
push dword [esi]
mov dword [ebp - 0x10], 0x38373635
mov dword [ebp - 0xc], 0x32313039
mov dword [ebp - 8], 0x36353433
call dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0042cf3b
mov esp, ebp
pop ebp
ret 4

Function at 0x40f3c0
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x46400c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xf0000000
push 0x18
push str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x40f40a
push 0xf0000000
push 0x18
push str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider__Prototype_
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 8]
xor ecx, ebp
call fcn.0042cf3b
mov esp, ebp
pop ebp
ret
Function at 0x40f540
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x46400c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0xa070
mov eax, ecx
push ebx
mov ebx, edx
mov dword [ebp - 0x10], eax
jne 0x40f648
test eax, eax
je 0x40f648
cmp dword [ebx], 0
je 0x40f648
push edi
call fcn.0040f3c0
mov edi, eax
test edi, edi
jne 0x40f594
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042cf3b
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebx]
lea edx, [ebp - 8]
push esi
mov dword [ebp - 0xc], eax
mov ecx, edi
lea eax, [ebp + 8]
mov dword [ebp - 8], 0
push eax
xor esi, esi
call fcn.0040f300
test al, al
je 0x40f61c
push esi
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push 1
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x40f61c
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x40f61c
push 0x44e798
push eax
call fcn.0042d302
mov esi, eax
add esp, 8
test esi, esi
je 0x40f61c
push dword [ebx]
mov edx, dword [ebp - 0xc]
mov ecx, esi
push dword [ebp - 0x10]
call fcn.0042ce60
add esp, 8
push dword [ebp - 0xc]
push ebx
push esi
push 0
push 1
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x40f61c
push esi
call fcn.0042cfa2
add esp, 4
xor esi, esi
mov eax, dword [ebp - 8]
test eax, eax
je 0x40f62a
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, esi
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042cf3b
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop ebx
call fcn.0042cf3b
mov esp, ebp
pop ebp
ret 4

Function at 0x40f660
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x46400c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0xa070
push ebx
push edi
mov ebx, edx
mov edi, ecx
jne 0x40f719
test edi, edi
je 0x40f719
cmp dword [ebx], 0
je 0x40f719
push esi
call fcn.0040f3c0
mov esi, eax
test esi, esi
jne 0x40f6b5
pop esi
pop edi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042cf3b
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp + 8]
mov dword [ebp - 8], 0
push eax
lea edx, [ebp - 8]
mov byte [ebp - 9], 0
mov ecx, esi
call fcn.0040f300
test al, al
je 0x40f6ea
push ebx
push edi
push 0
push 1
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
setne bl
jmp 0x40f6ed
mov bl, byte [ebp - 9]
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x40f6fb
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop esi
pop edi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042cf3b
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop ebx
call fcn.0042cf3b
mov esp, ebp
pop ebp
ret 4
Function at 0x40f7f0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44c543
mov eax, dword fs:[0]
push eax
sub esp, 0x264
mov eax, dword [0x46400c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov ebx, ecx
sub esp, 0x1c
lea ecx, [ebp - 0x18]
xorps xmm0, xmm0
movq qword [ebp - 0x18], xmm0
push 0
push 0
push 0
push 0x458c2c
push ebx
call fcn.0040ab50
push 0x258
lea eax, [ebp - 0x270]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.00431b40
add esp, 0xc
lea ecx, [ebp - 0x18]
call fcn.0040ad30
push 0x250
mov esi, eax
lea eax, [ebp - 0x270]
push 0
push eax
call fcn.00431b40
add esp, 0xc
lea eax, [ebp - 0x270]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edx, eax
mov dword [ebp - 0x20], edx
cmp edx, 0xffffffff
je 0x40f8ab
lea ecx, [ebp - 0x270]
mov dword [ebp - 0x1c], 1
call fcn.00401340
mov edx, dword [ebp - 0x20]
mov byte [ebp - 4], 1
cmp edx, 0xffffffff
je 0x40f96b
mov esi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
nop
test byte [ebp - 0x270], 0x10
je 0x40f90a
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x244]
push eax
push 0x45876c
push ebx
lea ecx, [ebp - 0x18]
call fcn.0040acd0
lea ecx, [ebp - 0x18]
call fcn.0040ad30
mov edx, edi
mov ecx, eax
call fcn.0040f7f0
call fcn.0040c7b0
mov edx, dword [ebp - 0x20]
jmp 0x40f920
mov ecx, dword [ebp - 0x254]
xor eax, eax
add eax, dword [ebp - 0x250]
adc ecx, 0
add dword [edi], eax
adc dword [edi + 4], ecx
cmp edx, 0xffffffff
je 0x40f96b
lea eax, [ebp - 0x270]
push eax
push edx
call esi
test eax, eax
je 0x40f95b
lea ecx, [ebp - 0x270]
call fcn.00401340
test al, al
je 0x40f94a
mov edx, dword [ebp - 0x20]
jmp 0x40f8c0
mov eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x40f96b
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x40f96b
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x20], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0040ac10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042cf3b
mov esp, ebp
pop ebp
ret
Function at 0x40fe80
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, ecx
push esi
mov ebx, edx
call edi
test eax, eax
jne 0x40ff03
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x40ff03
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 5
je 0x40febf
and eax, 0xfffffffa
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call edi
test eax, eax
jne 0x40ff03
test bl, 2
je 0x40feda
mov ecx, dword [ebp + 8]
push dword [ecx + 4]
push 4
push ecx
push esi
call fcn.0040d1f0
push esi
call edi
test eax, eax
jne 0x40ff03
test bl, 1
je 0x40fefa
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x40fefa
mov eax, 2
pop edi
pop esi
pop ebx
pop ebp
ret 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 4

Function at 0x40ff10
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, ecx
push esi
mov ebx, edx
call edi
test eax, eax
jne 0x40ff93
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x40ff93
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 5
je 0x40ff4f
and eax, 0xfffffffa
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call edi
test eax, eax
jne 0x40ff93
test bl, 2
je 0x40ff6a
mov ecx, dword [ebp + 8]
push dword [ecx + 4]
push 5
push ecx
push esi
call fcn.0040d1f0
push esi
call edi
test eax, eax
jne 0x40ff93
test bl, 1
je 0x40ff8a
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x40ff8a
mov eax, 2
pop edi
pop esi
pop ebx
pop ebp
ret 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 4

Function at 0x410020
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x46400c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx]
cmp eax, 0xffffffff
je 0x41006c
test eax, eax
je 0x41006c
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push ecx
push eax
mov dword [ebp - 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x41006c
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042cf3b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
xor edx, edx
call fcn.0042cf3b
mov esp, ebp
pop ebp
ret
Function at 0x410080
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x46400c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx]
cmp eax, 0xffffffff
je 0x4100ce
test eax, eax
je 0x4100ce
push 0
lea ecx, [ebp - 0xc]
mov dword [ebp - 8], 0xffff
push ecx
push 2
lea ecx, [ebp - 8]
mov dword [ebp - 0xc], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ax, word [ebp - 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042cf3b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0xffff
xor ecx, ebp
call fcn.0042cf3b
mov esp, ebp
pop ebp
ret

Function at 0x4100f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x46400c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx]
cmp eax, 0xffffffff
je 0x41013a
test eax, eax
je 0x41013a
push 0
lea ecx, [ebp - 0xc]
mov byte [ebp - 5], 0xff
push ecx
push 1
lea ecx, [ebp - 5]
mov dword [ebp - 0xc], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov al, byte [ebp - 5]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042cf3b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
or al, 0xff
xor ecx, ebp
call fcn.0042cf3b
mov esp, ebp
pop ebp
ret
Function at 0x410430
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x46400c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx]
mov edx, dword [ebp + 8]
cmp eax, 0xffffffff
je 0x41047d
test eax, eax
je 0x41047d
push 0
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
push ecx
push dword [ebp + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
neg eax
sbb eax, eax
and eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042cf3b
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.0042cf3b
mov esp, ebp
pop ebp
ret 8

Function at 0x410490
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44c5f8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x46400c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebx]
mov edi, dword [ebp + 8]
cmp eax, 0xffffffff
je 0x4105b7
test eax, eax
je 0x4105b7
mov ecx, edi
mov dword [ebp - 0x14], 0
call fcn.0040ac20
mov ecx, ebx
call fcn.00410000
push 0x44e798
mov dword [ebp - 0x1c], eax
lea ecx, [eax + 2]
push ecx
call fcn.0042d302
mov esi, eax
add esp, 8
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x4105a4
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov eax, ecx
shr eax, 1
push edx
mov dword [ebp - 0x1c], eax
mov word [esi + eax*2], dx
lea eax, [ebp - 0x14]
push eax
push ecx
push esi
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4105a4
mov eax, dword [ebp - 0x14]
mov ecx, edi
mov byte [esi + eax], 0
mov eax, dword [ebp - 0x14]
mov byte [esi + eax + 1], 0
mov eax, dword [ebx + 4]
test al, 0x20
je 0x410561
mov eax, esi
xor esi, esi
push esi
push eax
call fcn.0040ac90
mov ecx, edi
call fcn.0040ac70
mov edi, eax
jmp 0x4105a6
test al, 0x40
je 0x410579
push dword [ebp - 0x1c]
push esi
call fcn.0040c150
mov ecx, edi
call fcn.0040ac70
mov edi, eax
jmp 0x4105a6
sub esp, 8
push esi
test eax, 0x180
je 0x410594
call fcn.0040c1d0
mov ecx, edi
call fcn.0040ac70
mov edi, eax
jmp 0x4105a6
call fcn.0040c0f0
mov ecx, edi
call fcn.0040ac70
mov edi, eax
jmp 0x4105a6
xor edi, edi
test esi, esi
je 0x4105b3
push esi
call fcn.0042cfa2
add esp, 4
mov eax, edi
jmp 0x4105b9
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042cf3b
mov esp, ebp
pop ebp
ret 8
Function at 0x410610
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x46400c]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [edx]
mov dword [ebp - 0xc], edx
push edi
mov edi, dword [ebp + 0xc]
cmp esi, 0xffffffff
je 0x410769
test esi, esi
je 0x410769
cmp edi, 1
jge 0x410657
mov ecx, ebx
call fcn.0040c840
mov edi, eax
test edi, edi
je 0x410769
mov eax, dword [edx + 4]
mov dword [ebp - 8], 0
test al, 0x60
je 0x410691
push 0
lea eax, [ebp - 8]
push eax
lea eax, [edi + edi]
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
pop edi
sbb eax, eax
and eax, dword [ebp - 8]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042cf3b
mov esp, ebp
pop ebp
ret 8
test eax, 0x188
je 0x410729
push 0
push 0
push 0
push 0
push edi
push ebx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x410769
push 0x44e798
push eax
call fcn.0042d302
add esp, 8
mov esi, eax
push 0
push 0
push dword [ebp - 0x10]
push esi
push edi
push ebx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x410705
push 0
lea ecx, [ebp - 8]
push ecx
push eax
mov eax, dword [ebp - 0xc]
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x410705
mov edi, dword [ebp - 8]
jmp 0x410707
xor edi, edi
test esi, esi
je 0x410714
push esi
call fcn.0042cfa2
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042cf3b
mov esp, ebp
pop ebp
ret 8
push 0x44e798
push edi
call fcn.0042d302
add esp, 8
mov esi, eax
push 0
push 0
push edi
push esi
push edi
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
lea ecx, [ebp - 8]
push ecx
push eax
mov eax, dword [ebp - 0xc]
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
neg edi
sbb edi, edi
and edi, dword [ebp - 8]
jmp 0x410707
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042cf3b
mov esp, ebp
pop ebp
ret 8
Function at 0x410880
Capabilities:
Create process on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44c628
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x78
mov eax, dword [0x46400c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
mov eax, dword [ebx + 8]
push 0x44
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x68]
push 0
push eax
call fcn.00431b40
add esp, 0xc
mov dword [ebp - 0x68], 0x44
mov eax, 5
mov dword [ebp - 0x3c], 1
xorps xmm0, xmm0
mov word [ebp - 0x38], ax
mov ecx, esi
movups xmmword [ebp - 0x7c], xmm0
call fcn.0040c840
neg eax
mov ecx, edi
sbb eax, eax
and eax, esi
mov dword [ebp - 0x88], eax
call fcn.0040c840
mov ecx, dword [ebp - 0x6c]
neg eax
sbb eax, eax
and eax, edi
mov dword [ebp - 0x80], eax
call fcn.0040c840
neg eax
movq qword [ebp - 0x1c], xmm0
sbb eax, eax
and eax, ecx
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x84], eax
call fcn.0040aae0
mov dword [ebp - 4], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x6c], 0
call esi
mov ecx, eax
call fcn.00410bf0
xor edi, edi
call esi
mov ecx, eax
call fcn.00410bf0
test eax, eax
je 0x410970
lea ecx, [ebp - 0x6c]
call fcn.00410a90
mov edi, eax
mov eax, dword [ebp - 0x80]
test eax, eax
je 0x41098d
push eax
push 0x7d00
lea ecx, [ebp - 0x1c]
call fcn.0040afa0
lea ecx, [ebp - 0x1c]
call fcn.0040ad30
lea ecx, [ebp - 0x7c]
push ecx
lea ecx, [ebp - 0x68]
push ecx
push dword [ebp - 0x84]
push 0
push 0
push 0
push 0
push 0
push eax
push dword [ebp - 0x88]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
test edi, edi
je 0x4109c0
mov ecx, dword [ebp - 0x6c]
call fcn.00410b50
test esi, esi
je 0x4109d0
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x7c]
lea ecx, [ebp - 0x1c]
call fcn.0040ac10
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0042cf3b
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0xc

Function at 0x410cc0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x410ccf
xor al, al
ret
shr eax, 4
and al, 1
ret