joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e5d0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x418
push ebx
push esi
push edi
mov eax, 0x10
mov ebx, 0x400
push 1
mov word [esp + 0x10], ax
mov word [esp + 0x24], bx
call fcn.0040af0c
push eax
push 0x2e
push 1
push str.Error_reading_global.env_environment_file_set.
call fcn.0040b1a1
push 0x4326b0
call fcn.00401410
add esp, 0x18
xor eax, eax
mov word [esp + 0x22], ax
lea eax, [esp + 0x20]
push 0x4325e0
push eax
call sym.find_string.exe__string_appends_8
push 0x20
lea eax, [esp + 0x24]
push eax
call sym.find_string.exe__string_append1_8
mov edi, dword [esp + 0x428]
lea eax, [esp + 0xc]
push dword [edi + 0x914]
push eax
call sym.find_string.exe__string_f_int_8
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x24]
push eax
call sym.find_string.exe__string_append_8
push 0x432630
lea eax, [esp + 0x24]
push eax
call sym.find_string.exe__string_appends_8
mov ax, word [esp + 0x22]
cmp ax, bx
jle 0x41e68c
cwde
push 0x4356b2
sub eax, ebx
push eax
push 0x4326b4
call fcn.00401410
mov ax, word [esp + 0x2e]
add esp, 0xc
test ax, ax
jle 0x41e69f
cmp ax, bx
jge 0x41e69b
movsx esi, ax
jmp 0x41e6a1
mov esi, ebx
jmp 0x41e6a1
xor esi, esi
push 1
call fcn.0040af0c
push eax
push esi
lea eax, [esp + 0x30]
push 1
push eax
call fcn.0040b1a1
push 0x4326b8
call fcn.00401410
movzx ecx, word [edi + 0x50e]
add esp, 0x18
mov eax, ecx
cmp cx, bx
jle 0x41e6f3
movsx eax, cx
push 0x4356b3
sub eax, 0x400
push eax
push 0x4326bc
call fcn.00401410
movzx eax, word [edi + 0x50e]
add esp, 0xc
test ax, ax
jle 0x41e706
cmp ax, bx
jge 0x41e702
movsx esi, ax
jmp 0x41e708
mov esi, ebx
jmp 0x41e708
xor esi, esi
push 1
call fcn.0040af0c
push eax
push esi
lea eax, [edi + 0x510]
push 1
push eax
call fcn.0040b1a1
push 0x4326c0
call fcn.00401410
add esp, 0x18
call sym.find_string.exe__sys_bomb_0
pop edi
pop esi
pop ebx
add esp, 0x418
ret 4
Function at 0x41ed50
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x418
push ebx
push esi
push edi
mov eax, 0x10
mov ebx, 0x400
push 1
mov word [esp + 0x10], ax
mov word [esp + 0x24], bx
call fcn.0040af0c
push eax
push 0xe
push 1
push str.Error_reading
call fcn.0040b1a1
mov edi, dword [esp + 0x43c]
add esp, 0x14
movzx ecx, word [edi + 2]
mov eax, ecx
cmp cx, 0x20
jle 0x41edb6
movsx eax, cx
push 0x435712
sub eax, 0x20
push eax
push 0x4328f8
call fcn.00401410
movzx eax, word [edi + 2]
add esp, 0xc
test ax, ax
jle 0x41edcd
cmp ax, 0x20
jge 0x41edc6
movsx esi, ax
jmp 0x41edcf
mov esi, 0x20
jmp 0x41edcf
xor esi, esi
push 1
call fcn.0040af0c
push eax
push esi
lea eax, [edi + 4]
push 1
push eax
call fcn.0040b1a1
push 1
call fcn.0040af0c
push eax
push 0x22
push 1
push str..lan_language_descriptor_file_set.
call fcn.0040b1a1
push 0x432920
call fcn.00401410
add esp, 0x2c
xor eax, eax
mov word [esp + 0x22], ax
lea eax, [esp + 0x20]
push str.Error_on_line
push eax
call sym.find_string.exe__string_appends_8
push 0x20
lea eax, [esp + 0x24]
push eax
call sym.find_string.exe__string_append1_8
mov edi, dword [esp + 0x42c]
lea eax, [esp + 0xc]
push dword [edi + 0x914]
push eax
call sym.find_string.exe__string_f_int_8
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x24]
push eax
call sym.find_string.exe__string_append_8
push str._of_file
lea eax, [esp + 0x24]
push eax
call sym.find_string.exe__string_appends_8
mov ax, word [esp + 0x22]
cmp ax, bx
jle 0x41ee85
cwde
push 0x435713
sub eax, 0x400
push eax
push 0x432924
call fcn.00401410
mov ax, word [esp + 0x2e]
add esp, 0xc
test ax, ax
jle 0x41ee98
cmp ax, bx
jge 0x41ee94
movsx esi, ax
jmp 0x41ee9a
mov esi, ebx
jmp 0x41ee9a
xor esi, esi
push 1
call fcn.0040af0c
push eax
push esi
lea eax, [esp + 0x30]
push 1
push eax
call fcn.0040b1a1
push 0x432928
call fcn.00401410
movzx ecx, word [edi + 0x50e]
add esp, 0x18
mov eax, ecx
cmp cx, bx
jle 0x41eeec
movsx eax, cx
push 0x435714
sub eax, 0x400
push eax
push 0x43292c
call fcn.00401410
movzx eax, word [edi + 0x50e]
add esp, 0xc
test ax, ax
jle 0x41eeff
cmp ax, bx
jge 0x41eefb
movsx esi, ax
jmp 0x41ef01
mov esi, ebx
jmp 0x41ef01
xor esi, esi
push 1
call fcn.0040af0c
push eax
push esi
lea eax, [edi + 0x510]
push 1
push eax
call fcn.0040b1a1
push 0x432930
call fcn.00401410
add esp, 0x18
call sym.find_string.exe__sys_bomb_0
pop edi
pop esi
pop ebx
add esp, 0x418
ret 8
Function at 0xe5bc1c
Capabilities:
Encode data using xor

Disassembly:
jmp 0xe5bc26
pushal
call 0xe5bc2c
pop ebp
sub ebp, 0x10
sub ebp, 0xa5bc1c
jmp 0xe5bc42
mov eax, 0xa5bc1c
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c8
mov edx, 0x64baa1ba
xor byte [eax], dl
inc eax
dec ecx
jne 0xe5bc59
jmp 0xe5bc6c
xor dword [edi + 0x31], esi
xor eax, dword [esi + 0x3bbababa]
jnp 0xe5bcb9
mov edx, 0x77b9baba
add bh, byte [edi + 0xbababa]
xchg edx, eax
mov edx, 0x584dbaba
mov ecx, 0xb63b3172
mov edx, 0x7fb9baba
aaa
ficomp word [esi - 0x6141ccba]
ljmp 0xd2ba
inc esi
xor edx, dword [esi + 0x3156319e]
aas
mov dl, 0xba
mov edx, 0xb62f31ba
mov edx, 0x3731baba
stosb byte es:[edi], al
mov edx, 0x537bbaba
mov eax, 0x7839b88b
mov esi, 0x4e3fb5f3
inc ebp
inc ebp
inc ebp
xor dword [esi - 0x6121c862], edx
mov esi, 0x31bab678
sahf
mov esi, 0xd2bababa
push eax
lcall 0xba3e, 0x6b3ad2ba
mov ebx, 0xde379e96
sahf
inc esi
xor esi, dword [esi - 0x4540ad62]
mov edx, 0xb8e953ba
mov edx, 0xd637efba
sahf
mov edx, 0x45b6cf45
iretd
Function at 0x403104
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x417008], 0x8088405
inc edx
mov dword [ebx + 0x417008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403734
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x417024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4037cc
push 0x80000002
call fcn.00401180
test eax, eax
jne 0x4037ac
xor eax, eax
push ebp
push 0x4037a5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403804
mov eax, dword [ebp - 4]
push eax
call fcn.00401188
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4037ac
mov eax, dword [ebp - 4]
push eax
call fcn.00401178
ret
movzx eax, word [0x417024]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x417024], ax
mov esp, ebp
pop ebp
ret

Function at 0x404618
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x41804c], 0
je 0x404679
cmp word [0x418328], 0xd7b2
jne 0x404641
cmp dword [0x418330], 0
jbe 0x404641
mov eax, 0x418324
call dword [0x418340]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4046a4
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x417030], 0
jne 0x404695
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x415900
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4985a0]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp + 8]
push eax
call fcn.00425c90
add esp, 4
test eax, eax
je 0x41593a
push 0
push 0
push 0x488aac
mov ecx, dword [ebp - 0x1c]
call fcn.00430333
xor eax, eax
jmp 0x4159a1
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004325b3
mov ecx, dword [ebp + 0xc]
call fcn.00402600
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x415969
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
cmp dword [eax], 0
jne 0x415981
push 0
push 0x488acc
push 0x488ad8
mov ecx, dword [ebp - 0x1c]
call fcn.00430333
xor eax, eax
jmp 0x4159a1
mov ecx, dword [ebp - 4]
movsx edx, word [ecx + 0xa]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
push edx
lea eax, [ebp - 0x14]
push eax
call fcn.00453040
add esp, 0xc
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0044cd51
mov esp, ebp
pop ebp
ret 8

Function at 0x417450
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47ea2b
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x4985a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov dword [eax], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov dl, byte [ecx + 4]
mov byte [eax + 4], dl
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
mov dword [eax + 8], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov dx, word [ecx + 0xc]
mov word [eax + 0xc], dx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov dl, byte [ecx + 0xe]
mov byte [eax + 0xe], dl
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x10]
mov dword [eax + 0x10], edx
mov eax, dword [ebp + 8]
add eax, 0x14
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.00413ff0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x30]
mov dword [ecx + 0x30], eax
mov ecx, dword [ebp + 8]
add ecx, 0x34
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x34
call fcn.00417840
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x41c8f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47eae6
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x4985a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0xc], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x10
call fcn.0041e1e0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.0040b740
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x48
call fcn.0041e530
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.0042bcd0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x41cda0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x41cdc0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
jmp 0x41cdc9
mov edx, dword [ebp + 0xc]
add edx, 0x30
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0xc]
mov cl, byte [ebp + 0x18]
mov byte [eax + 0x64], cl
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x24]
add eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x24], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x20]
sub eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x20], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
add eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov ecx, dword [edx]
sub ecx, dword [eax + 0x20]
mov edx, dword [ebp - 4]
mov dword [edx], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x2c], 0
mov ecx, 0x49d7ec
call fcn.00421c30
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x41ce34
or eax, 0xffffffff
jmp 0x41ceb6
mov ecx, dword [ebp - 8]
mov dl, byte [ebp + 0x18]
mov byte [ecx + 0x14], dl
mov dword [ebp - 0xc], 0
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x41ce75
push 0
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x2c]
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x28
push ecx
push 1
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_WSASend]
mov dword [ebp - 0xc], eax
jmp 0x41ce9c
push 0
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
add edx, 0x2c
push edx
mov eax, dword [ebp - 4]
add eax, 0x28
push eax
push 1
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_WSARecv]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x41ceb3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x41ceb3
xor eax, eax
jmp 0x41ceb6
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 0x14
Function at 0x41cec0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x41cee0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
jmp 0x41cee9
mov edx, dword [ebp + 0xc]
add edx, 0x30
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0xc]
mov cl, byte [ebp + 0x18]
mov byte [eax + 0x64], cl
mov edx, dword [ebp - 4]
mov dword [edx + 0x24], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x10]
mov dword [eax + 0x20], ecx
mov ecx, dword [ebp - 4]
add ecx, 8
call fcn.00407fb0
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x20]
jae 0x41cf2a
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x20]
push ecx
mov ecx, dword [ebp - 4]
add ecx, 8
call fcn.00407f90
push 0
mov ecx, dword [ebp - 4]
add ecx, 8
call fcn.00407fd0
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x20]
mov dword [eax], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x2c], 0
mov ecx, 0x49d7ec
call fcn.00421c30
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x41cf6d
or eax, 0xffffffff
jmp 0x41cfef
mov ecx, dword [ebp - 8]
mov dl, byte [ebp + 0x18]
mov byte [ecx + 0x14], dl
mov dword [ebp - 0xc], 0
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x41cfae
push 0
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x2c]
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x28
push ecx
push 1
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_WSASend]
mov dword [ebp - 0xc], eax
jmp 0x41cfd5
push 0
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
add edx, 0x2c
push edx
mov eax, dword [ebp - 4]
add eax, 0x28
push eax
push 1
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_WSARecv]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x41cfec
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x41cfec
xor eax, eax
jmp 0x41cfef
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 0x14
Function at 0x424370
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x4985a0]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x38], ecx
push 1
push 0
push 0
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_WSASocketA]
mov ecx, dword [ebp - 0x38]
mov dword [ecx + 0x18], eax
mov edx, dword [ebp - 0x38]
cmp dword [edx + 0x18], 0
ja 0x4243a9
jmp 0x4244f4
push 0x488778
call fcn.0044d9fc
add esp, 4
push eax
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x18]
push ecx
call fcn.0042b490
add esp, 8
test eax, eax
jge 0x4243cf
jmp 0x4244f4
mov edx, dword [0x49a56c]
push edx
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x18]
push ecx
call fcn.0042b500
add esp, 8
test eax, eax
jge 0x4243ee
jmp 0x4244f4
mov ecx, dword [ebp - 0x38]
call fcn.00429ea0
cmp eax, 1
jne 0x424400
jmp 0x4244f4
mov dword [ebp - 4], 0x10
push 0x7d0
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx + 0x18]
push edx
call fcn.0042b560
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jg 0x424433
jmp 0x4243ee
xor eax, eax
mov word [ebp - 0x22], ax
mov ecx, 1
mov word [ebp - 0x24], cx
push 4
lea edx, [ebp - 0x24]
push edx
push 0x80
push 0xffff
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
mov dword [ebp - 0x20], 0
push 4
lea ecx, [ebp - 0x20]
push ecx
push 0x1001
push 0xffff
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov eax, 1
test eax, eax
je 0x4244d7
mov byte [ebp - 0x25], 1
push 1
lea ecx, [ebp - 0x25]
push ecx
push 8
push 0xffff
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x30], 0x7530
mov dword [ebp - 0x2c], 0x3a98
push 0
push 0
lea eax, [ebp - 0x25]
push eax
push 0
push 0
push 0xc
lea ecx, [ebp - 0x34]
push ecx
push 0x98000004
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.WS2_32.dll_WSAIoctl]
movzx eax, word [ebp - 0x1a]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x14]
call fcn.0041ded0
jmp 0x4243ee
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0044cd51
mov esp, ebp
pop ebp
ret
Function at 0x427c40
Capabilities:
Delete file
Move file
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47e4ab
mov eax, dword fs:[0]
push eax
mov eax, 0x2058
call fcn.00452710
mov eax, dword [0x4985a0]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x205c], ecx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x2058]
call fcn.00413e90
mov dword [ebp - 0x2060], eax
mov ecx, dword [ebp - 0x2060]
mov dword [ebp - 0x2064], ecx
mov dword [ebp - 4], 0
push str..ndfs30_api_log_utility_file_cut_and_move
mov edx, dword [ebp - 0x2064]
push edx
lea eax, [ebp - 0x2038]
push eax
call fcn.0042ae10
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2058]
call fcn.00402710
push 0x48843c
mov ecx, dword [ebp + 8]
push ecx
call fcn.0044d853
add esp, 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x427cf4
lea ecx, [ebp - 0x2038]
call fcn.00402710
jmp 0x427ddc
push 0
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x14]
push eax
call fcn.0044ed9d
add esp, 0xc
push 0x488440
lea ecx, [ebp - 0x2038]
call fcn.00402510
push eax
call fcn.0044d853
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x427d47
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.0044dc49
add esp, 4
lea ecx, [ebp - 0x2038]
call fcn.00402710
jmp 0x427ddc
mov dword [ebp - 0x203c], 0
mov edx, dword [ebp - 0x14]
push edx
push 0x2000
push 1
lea eax, [ebp - 0x201c]
push eax
call fcn.0044eb12
add esp, 0x10
mov dword [ebp - 0x203c], eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x203c]
push edx
push 1
lea eax, [ebp - 0x201c]
push eax
call fcn.0044ec91
add esp, 0x10
cmp dword [ebp - 0x203c], 0x2000
je 0x427d51
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.0044dc49
add esp, 4
mov edx, dword [ebp - 0x10]
push edx
call fcn.0044dc49
add esp, 4
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x2038]
call fcn.00402510
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
lea ecx, [ebp - 0x2038]
call fcn.00402710
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0044cd51
mov esp, ebp
pop ebp
ret 0xc
Function at 0x429bd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47de88
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x4985a0]
xor eax, ebp
mov dword [ebp - 0x18], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x68], ecx
mov eax, dword [ebp - 0x68]
cmp dword [eax + 0x3c], 0
je 0x429c10
mov ecx, dword [ebp - 0x68]
movzx edx, byte [ecx + 0x41]
test edx, edx
jne 0x429c1c
mov al, 1
jmp 0x429dbf
mov dword [ebp - 0x10], 8
call fcn.00426640
push eax
mov eax, dword [ebp - 0x68]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x68]
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 0x3c], eax
call fcn.00426640
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.00426620
add esp, 8
movzx eax, al
test eax, eax
je 0x429c5f
xor al, al
jmp 0x429dbf
push 0
push 8
lea ecx, [ebp - 0x34]
call fcn.00429200
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x48]
push edx
lea ecx, [ebp - 0x34]
call fcn.00429450
mov ecx, eax
call fcn.0042a140
mov esi, eax
lea ecx, [ebp - 0x34]
call fcn.0042cb90
add esi, eax
push esi
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x34]
call fcn.00429450
mov ecx, eax
call fcn.0042a140
push eax
mov ecx, dword [ebp - 0x68]
add ecx, 0x44
push ecx
mov edx, dword [ebp - 0x68]
mov ecx, dword [edx + 0x3c]
call fcn.0042a920
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
je 0x429cda
cmp dword [ebp - 0x6c], 1
je 0x429ce1
cmp dword [ebp - 0x6c], 3
je 0x429d7b
jmp 0x429d93
mov eax, dword [ebp - 0x68]
mov byte [eax + 0x41], 0
lea ecx, [ebp - 0x58]
push ecx
lea ecx, [ebp - 0x34]
call fcn.00429450
mov ecx, eax
call fcn.0042a140
mov edx, dword [ebp - 0x14]
sub edx, eax
mov dword [ebp - 0x38], edx
je 0x429d44
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 1
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x34]
call fcn.00429450
mov ecx, eax
call fcn.0042a140
push eax
call fcn.0044ec91
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x429d44
mov byte [ebp - 0x61], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00402710
mov al, byte [ebp - 0x61]
jmp 0x429dbf
mov ecx, dword [ebp - 0x68]
movzx edx, byte [ecx + 0x41]
test edx, edx
jne 0x429d67
mov byte [ebp - 0x62], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00402710
mov al, byte [ebp - 0x62]
jmp 0x429dbf
cmp dword [ebp - 0x38], 0
jne 0x429d79
push 0
push 8
lea ecx, [ebp - 0x34]
call fcn.00429240
jmp 0x429dab
mov byte [ebp - 0x63], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00402710
mov al, byte [ebp - 0x63]
jmp 0x429dbf
mov byte [ebp - 0x64], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00402710
mov al, byte [ebp - 0x64]
jmp 0x429dbf
jmp 0x429c72
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0044cd51
mov esp, ebp
pop ebp
ret