joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404946
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push 0x49be94
mov edi, ecx
call esi
push str.psapi.dll
mov dword [ebp - 4], eax
call esi
push str.Wlanapi.dll
mov dword [ebp - 8], eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x2c], eax
mov dword [edi + 0x1c], eax
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], eax
mov dword [edi + 0x28], eax
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], eax
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], eax
mov dword [edi + 0x40], eax
mov dword [edi + 0x44], eax
mov dword [edi + 0x48], eax
mov dword [edi + 0x4c], eax
mov dword [edi + 0x50], eax
mov dword [edi + 0x54], eax
mov dword [edi + 0x58], eax
mov dword [edi + 0x5c], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x404a28
push str.CreateToolhelp32Snapshot
push eax
call esi
push str.Process32First
push dword [ebp - 4]
mov dword [edi], eax
call esi
push str.Process32Next
push dword [ebp - 4]
mov dword [edi + 4], eax
call esi
push str.Module32First
push dword [ebp - 4]
mov dword [edi + 8], eax
call esi
push str.Module32Next
push dword [ebp - 4]
mov dword [edi + 0xc], eax
call esi
push str.Thread32First
push dword [ebp - 4]
mov dword [edi + 0x10], eax
call esi
push str.Thread32Next
push dword [ebp - 4]
mov dword [edi + 0x14], eax
call esi
push str.GlobalMemoryStatusEx
push dword [ebp - 4]
mov dword [edi + 0x18], eax
call esi
mov dword [edi + 0x30], eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x404a6e
push str.EnumProcesses
push eax
call esi
push str.EnumProcessModules
push dword [ebp - 8]
mov dword [edi + 0x1c], eax
call esi
push str.EnumProcessModulesEx
push dword [ebp - 8]
mov dword [edi + 0x24], eax
call esi
push str.GetModuleFileNameExW
push dword [ebp - 8]
mov dword [edi + 0x28], eax
call esi
push str.GetProcessImageFileNameW
push dword [ebp - 8]
mov dword [edi + 0x20], eax
call esi
mov dword [edi + 0x2c], eax
test ebx, ebx
je 0x404aeb
push str.WlanOpenHandle
push ebx
call esi
push str.WlanEnumInterfaces
push ebx
mov dword [edi + 0x34], eax
call esi
push str.WlanGetAvailableNetworkList
push ebx
mov dword [edi + 0x38], eax
call esi
push str.WlanGetProfile
push ebx
mov dword [edi + 0x3c], eax
call esi
push str.WlanCloseHandle
push ebx
mov dword [edi + 0x40], eax
call esi
push str.WlanFreeMemory
push ebx
mov dword [edi + 0x44], eax
call esi
push str.WlanDeleteProfile
push ebx
mov dword [edi + 0x48], eax
call esi
push str.WlanDisconnect
push ebx
mov dword [edi + 0x4c], eax
call esi
push str.WlanSetProfile
push ebx
mov dword [edi + 0x50], eax
call esi
push str.WlanConnect
push ebx
mov dword [edi + 0x54], eax
call esi
push str.WlanGetNetworkBssList
push ebx
mov dword [edi + 0x58], eax
call esi
mov dword [edi + 0x5c], eax
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404f2d
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x4b1070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x200
mov esi, ecx
lea eax, [ebp - 0x204]
push 0
mov dword [ebp - 0x208], esi
push eax
mov dword [ebp - 0x208], esi
call fcn.0045fe80
add esp, 0xc
mov dword [ebp - 0x208], 0x100
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x204]
mov ecx, esi
push eax
call fcn.0041b69b
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0045d929
leave
ret

Function at 0x40510c
Capabilities:
Get common file path

Disassembly:
push 0x218
mov eax, 0x484bd1
call fcn.0045e574
mov esi, ecx
mov dword [ebp - 0x220], esi
xor edi, edi
lea eax, [ebp - 0x218]
push 0x208
mov dword [ebp - 4], edi
push edi
mov dword [ebp - 0x224], esi
push eax
mov dword [ebp - 0x21c], edi
call fcn.0045fe80
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.0041b69b
mov dword [ebp - 4], edi
mov ecx, esi
push edi
mov dword [ebp - 0x21c], 1
call fcn.0041bfa4
mov eax, esi
call fcn.0045e51e
ret

Function at 0x405334
Capabilities:
Get common file path

Disassembly:
push 0x234
mov eax, 0x484c39
call fcn.0045e574
mov esi, ecx
mov dword [ebp - 0x240], esi
mov dword [ebp - 0x240], esi
call fcn.00405091
test al, al
je 0x405368
mov dl, 1
mov ecx, esi
call fcn.00405186
jmp 0x405422
push 0x208
lea eax, [ebp - 0x21c]
push 0
push eax
call fcn.0045fe80
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x40535a
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x238]
call fcn.0041b69b
and dword [ebp - 4], 0
lea ecx, [ebp - 0x238]
call fcn.0041cdf1
push 0
lea ecx, [ebp - 0x238]
call fcn.0041bfa4
lea edx, [ebp - 0x239]
lea ecx, [ebp - 0x238]
call fcn.00406711
test al, al
jne 0x4053e2
lea ecx, [ebp - 0x238]
call fcn.00406158
lea ecx, [ebp - 0x238]
call fcn.004064aa
test al, al
jne 0x4053fc
mov dl, 1
mov ecx, esi
call fcn.00405186
jmp 0x405417
push 1
lea ecx, [ebp - 0x238]
call fcn.0041bfa4
lea eax, [ebp - 0x238]
mov ecx, esi
push eax
call fcn.0041b6f8
lea ecx, [ebp - 0x238]
call fcn.0041bb22
mov eax, esi
call fcn.0045e51e
ret
Function at 0x405bce
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4b1070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x20]
push eax
call fcn.0041d42b
xor esi, esi
cmp dword [ebp + 0xc], esi
jg 0x405bfb
jl 0x405bf7
cmp dword [ebp + 8], esi
ja 0x405bfb
push 0xffffffffffffff9c
jmp 0x405c5c
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
push esi
cmovae eax, dword [ebp - 0x1c]
push 0x80
push 2
push esi
push esi
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x405c5a
push esi
lea eax, [ebp - 0x28]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x405c4e
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
and esi, 3
add esi, 0xfffffffd
jmp 0x405c51
push 0xfffffffffffffffb
pop esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x405c5d
push 0xfffffffffffffff7
pop esi
lea ecx, [ebp - 0x20]
call fcn.0041bb22
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0045d929
leave
ret
Function at 0x406158
Capabilities:
Create directory

Disassembly:
push 0x6c
mov eax, 0x484d7f
call fcn.0045e574
lea eax, [ebp - 0x64]
push eax
call fcn.0041ceca
xor ebx, ebx
lea ecx, [ebp - 0x64]
push ebx
mov dword [ebp - 4], ebx
call fcn.0041bfa4
lea ecx, [ebp - 0x2c]
call fcn.0041b087
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ebx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x48]
push 0x49c1e8
mov byte [ebp - 0x65], bl
call fcn.0041b69b
push ebx
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x64]
call fcn.0041cd42
lea ecx, [ebp - 0x48]
mov bl, al
call fcn.0041bb22
test bl, bl
je 0x4061cd
cmp dword [ebp - 0x50], 2
jne 0x4061c9
or esi, 0xffffffff
jmp 0x40630e
mov bl, 1
jmp 0x4061d0
mov bl, byte [ebp - 0x65]
push 0x49c1f0
lea ecx, [ebp - 0x48]
call fcn.0041b69b
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x78]
push eax
lea ecx, [ebp - 0x64]
call fcn.0041d823
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call fcn.0041bb22
mov eax, dword [ebp - 0x74]
xor esi, esi
sub eax, dword [ebp - 0x78]
push 0x1c
cdq
pop edi
idiv edi
mov dword [ebp - 0x6c], esi
test eax, eax
je 0x40630e
mov edi, esi
mov eax, dword [ebp - 0x78]
cmp dword [edi + eax + 0x14], esi
je 0x4062f4
cmp dword [ebp - 0x18], 0
je 0x406254
push 0x49b6b4
lea ecx, [ebp - 0x48]
call fcn.0041b69b
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x28]
call fcn.004086f5
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call fcn.0041bb22
test bl, bl
je 0x406287
cmp dword [ebp - 0x18], 0
jne 0x406287
push 0x49c1e8
lea ecx, [ebp - 0x48]
call fcn.0041b69b
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x28]
call fcn.004086f5
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call fcn.0041bb22
mov eax, dword [ebp - 0x78]
lea ecx, [ebp - 0x28]
add eax, 4
add eax, edi
push eax
call fcn.004086f5
push 0x49b6b0
lea ecx, [ebp - 0x2c]
call fcn.0041b741
test al, al
jne 0x4062f4
push 0x49be84
lea ecx, [ebp - 0x2c]
call fcn.0041b741
test al, al
jne 0x4062f4
cmp dword [ebp - 0x18], 2
jne 0x4062d2
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
cmp word [eax + 2], 0x3a
je 0x4062f4
lea edx, [ebp - 0x65]
lea ecx, [ebp - 0x2c]
call fcn.00406711
test al, al
jne 0x4062f4
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push esi
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, dword [ebp - 0x74]
sub eax, dword [ebp - 0x78]
push 0x1c
pop ecx
cdq
add edi, ecx
idiv ecx
inc dword [ebp - 0x6c]
cmp dword [ebp - 0x6c], eax
jb 0x406218
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 7
call fcn.00404357
lea ecx, [ebp - 0x2c]
call fcn.0041bb22
lea ecx, [ebp - 0x64]
call fcn.0041bb22
mov eax, esi
call fcn.0045e51e
ret
Function at 0x406332
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push 0x24
mov eax, 0x484dac
call fcn.0045e574
lea eax, [ebp - 0x2c]
push eax
call fcn.0041ceca
xor esi, esi
lea edx, [ebp - 0x2d]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], esi
call fcn.00406711
test al, al
jne 0x406360
or esi, 0xffffffff
jmp 0x40639f
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x40637d
push 0xffffffffffffff9c
jmp 0x40639e
test cl, 1
je 0x40639f
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
and ecx, 0xfffffffe
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x40639f
push 0xfffffffffffffffd
pop esi
lea ecx, [ebp - 0x2c]
call fcn.0041bb22
mov eax, esi
call fcn.0045e51e
ret

Function at 0x4063af
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push 0x24
mov eax, 0x484dac
call fcn.0045e574
lea eax, [ebp - 0x2c]
push eax
call fcn.0041ceca
xor esi, esi
lea edx, [ebp - 0x2d]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], esi
call fcn.00406711
test al, al
jne 0x4063dd
or esi, 0xffffffff
jmp 0x40641c
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x4063fa
push 0xffffffffffffff9c
jmp 0x40641b
test cl, 2
je 0x40641c
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
and ecx, 0xfffffffd
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x40641c
push 0xfffffffffffffffd
pop esi
lea ecx, [ebp - 0x2c]
call fcn.0041bb22
mov eax, esi
call fcn.0045e51e
ret

Function at 0x406711
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4b1070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x20]
mov esi, edx
push eax
call fcn.0041ceca
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40674f
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor bl, bl
jmp 0x406758
shr eax, 4
mov bl, 1
and al, 1
mov byte [esi], al
lea ecx, [ebp - 0x20]
call fcn.0041bb22
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.0045d929
leave
ret

Function at 0x406aed
Capabilities:
Delete file

Disassembly:
push 0x3c
mov eax, 0x484f34
call fcn.0045e574
lea eax, [ebp - 0x2c]
push eax
call fcn.0041ceca
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x104
jl 0x406b33
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041d033
add eax, 4
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x28]
call fcn.0041e21c
lea ecx, [ebp - 0x48]
call fcn.0041bb22
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
lea ecx, [ebp - 0x2c]
setne bl
call fcn.0041bb22
mov al, bl
call fcn.0045e51e
ret
Function at 0x406b5a
Capabilities:
Move file

Disassembly:
push 0x5c
mov eax, 0x484f79
call fcn.0045e574
mov esi, edx
lea eax, [ebp - 0x48]
push eax
call fcn.0041ceca
and dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
push eax
mov ecx, esi
call fcn.0041ceca
mov esi, 0x104
mov byte [ebp - 4], 1
cmp dword [ebp - 0x34], esi
jl 0x406bb6
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x48]
call fcn.0041d109
add eax, 4
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x44]
call fcn.0041e21c
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 1
call fcn.0041bb22
cmp dword [ebp - 0x18], esi
jl 0x406bdf
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041d109
add eax, 4
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x28]
call fcn.0041e21c
lea ecx, [ebp - 0x64]
call fcn.0041bb22
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
lea eax, [ebp - 0x44]
cmovae ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x30], 8
push ecx
cmovae eax, dword [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
lea ecx, [ebp - 0x2c]
setne bl
call fcn.0041bb22
lea ecx, [ebp - 0x48]
call fcn.0041bb22
mov al, bl
call fcn.0045e51e
ret

Function at 0x406c1a
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24c
mov eax, dword [0x4b1070]
xor eax, esp
mov dword [esp + 0x248], eax
push ebx
push esi
push edi
mov edi, ecx
test edi, edi
jne 0x406c44
xor eax, eax
jmp 0x406d56
push 0x40
xor ebx, ebx
lea eax, [esp + 0x14]
push ebx
push eax
call fcn.0045fe80
push edi
push 1
lea eax, [esp + 0x24]
push 0x40
push eax
call fcn.004667fc
add esp, 0x1c
cmp eax, 0xffffffff
jne 0x406c71
push 0xfffffffffffffffc
jmp 0x406d53
mov eax, 0x5a4d
cmp word [esp + 0x10], ax
je 0x406c84
push 0xfffffffffffffffb
jmp 0x406d53
push ebx
push dword [esp + 0x50]
push edi
call fcn.00466615
add esp, 0xc
test eax, eax
je 0x406c9d
push 0xfffffffffffffffa
jmp 0x406d53
mov esi, 0xf8
lea eax, [esp + 0x50]
push esi
push ebx
push eax
call fcn.0045fe80
push 0x108
lea eax, [esp + 0x158]
push ebx
push eax
call fcn.0045fe80
push edi
push 1
lea eax, [esp + 0x70]
push esi
push eax
call fcn.004667fc
add esp, 0x28
cmp eax, 0xffffffff
jne 0x406cdb
push 0xfffffffffffffff9
jmp 0x406d53
cmp dword [esp + 0x50], 0x4550
je 0x406ce9
push 0xfffffffffffffff8
jmp 0x406d53
mov eax, 0x10b
cmp word [esp + 0x68], ax
jne 0x406cfa
xor esi, esi
inc esi
jmp 0x406d54
mov eax, 0x20b
cmp word [esp + 0x68], ax
jne 0x406d51
push 2
pop esi
push ebx
push dword [esp + 0x50]
push edi
call fcn.00466615
add esp, 0xc
test eax, eax
je 0x406d1f
push 0xfffffffffffffff6
jmp 0x406d53
push edi
push 1
lea eax, [esp + 0x150]
push 0x108
push eax
call fcn.004667fc
add esp, 0x10
cmp eax, 0xffffffff
jne 0x406d40
push 0xfffffffffffffff5
jmp 0x406d53
cmp dword [esp + 0x148], 0x4550
je 0x406d54
push 0xfffffffffffffff4
jmp 0x406d53
push 0xfffffffffffffff7
pop esi
mov eax, esi
mov ecx, dword [esp + 0x254]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0045d929
mov esp, ebp
pop ebp
ret
Function at 0x406d6b
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push 0x80
mov eax, 0x484fa6
call fcn.0045e574
mov edi, edx
mov dword [ebp - 0x8c], edi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x48]
push 7
push eax
call fcn.0041bb6b
and dword [ebp - 4], 0
lea eax, [ebp - 0x60]
push ecx
push eax
mov ecx, esi
call fcn.0041bac9
cmp dword [eax + 0x14], 0x10
jb 0x406da8
mov eax, dword [eax]
push 0x49c218
push eax
call fcn.004657a0
pop ecx
pop ecx
mov ebx, eax
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x88], ebx
call fcn.004019a2
push 0x64
pop esi
test ebx, ebx
jne 0x406dd4
or esi, 0xffffffff
jmp 0x406f36
push 2
push 0
push ebx
call fcn.00466615
add esp, 0xc
push ebx
call fcn.00466302
pop ecx
push 0
push 0
push ebx
mov dword [ebp - 0x7c], eax
call fcn.00466615
pop ecx
pop ecx
lea eax, [ebp - 0x78]
mov ecx, edi
push eax
call fcn.0041bac9
cmp dword [eax + 0x14], 0x10
jb 0x406e0a
mov eax, dword [eax]
push 0x49c21c
push eax
call fcn.004657a0
pop ecx
pop ecx
mov edi, eax
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x84], edi
call fcn.004019a2
test edi, edi
jne 0x406e3a
push ebx
call fcn.00465a14
pop ecx
push 0xfffffffffffffffd
pop esi
jmp 0x406f36
mov ecx, ebx
xor edi, edi
call fcn.00406c1a
mov dword [ebp - 0x80], eax
cmp eax, 1
je 0x406e57
cmp eax, 2
je 0x406e57
mov esi, eax
jmp 0x406f01
push 0
push 0
push ebx
call fcn.00466615
add esp, 0xc
push dword [ebp - 0x7c]
call fcn.0045dc17
pop ecx
push ebx
push 1
push dword [ebp - 0x7c]
mov edi, eax
push edi
call fcn.004667fc
add esp, 0x10
cmp eax, 0xffffffff
jne 0x406e88
push 0xfffffffffffffff3
pop esi
jmp 0x406f01
mov eax, dword [edi + 0x3c]
movzx ecx, word [eax + edi + 0x14]
add ecx, eax
movzx eax, word [eax + edi + 6]
movzx edx, ax
lea eax, [edi + 0x18]
add eax, ecx
mov dword [ebp - 0x7c], edx
mov dword [ebp - 0x80], eax
test edx, edx
je 0x406f01
mov ebx, eax
push ebx
lea ecx, [ebp - 0x2c]
call fcn.0041b5c1
push 0
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041d3d9
test eax, eax
jne 0x406eea
push dword [ebp - 0x84]
mov eax, dword [ebx + 0x14]
push 1
push dword [ebx + 8]
add eax, edi
push eax
call fcn.00465ccc
add esp, 0x10
xor ecx, ecx
cmp eax, 0xffffffff
push 0xfffffffffffffff1
pop esi
cmovne esi, ecx
lea ecx, [ebp - 0x2c]
call fcn.0041bb22
add ebx, 0x28
sub dword [ebp - 0x7c], 1
jne 0x406eab
mov ebx, dword [ebp - 0x88]
push ebx
call fcn.00465a14
mov ebx, dword [ebp - 0x84]
pop ecx
push ebx
call fcn.00465945
pop ecx
push ebx
call fcn.00465a14
pop ecx
test edi, edi
je 0x406f27
push edi
call fcn.0045dbd4
pop ecx
test esi, esi
je 0x406f36
mov ecx, dword [ebp - 0x8c]
call fcn.00406aed
lea ecx, [ebp - 0x48]
call fcn.0041bb22
mov eax, esi
call fcn.0045e51e
ret
Function at 0x407434
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
lea eax, [ebp - 4]
push edi
push eax
push dword [ebp + 0xc]
mov esi, ecx
mov dword [ebp - 4], edi
push dword [ebp + 8]
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40746b
mov eax, dword [ebp - 4]
test eax, eax
je 0x40746b
add dword [esi + 0x28], eax
mov dword [esi + 0x34], edi
adc dword [esi + 0x2c], edi
jmp 0x407477
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xfffffffffffffffe
mov dword [esi + 0x34], eax
pop eax
pop edi
pop esi
leave
ret 8

Function at 0x4075c1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
lea eax, [ebp - 4]
push edi
push eax
push dword [ebp + 0xc]
mov esi, ecx
mov dword [ebp - 4], edi
push dword [ebp + 8]
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4075fb
mov eax, dword [ebp - 4]
cmp dword [ebp + 0xc], eax
jne 0x4075fb
add dword [esi + 0x20], eax
mov dword [esi + 0x34], edi
adc dword [esi + 0x24], edi
xor eax, eax
jmp 0x407607
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xfffffffffffffffe
mov dword [esi + 0x34], eax
pop eax
pop edi
pop esi
leave
ret 8
Function at 0x4090f5
Capabilities:
Get file size

Disassembly:
push 0x44
mov eax, 0x485483
call fcn.0045e574
mov edi, ecx
call fcn.00407409
lea eax, [ebp - 0x2c]
xor ebx, ebx
lea esi, [edi + 4]
mov dword [edi + 0x38], ebx
push eax
mov ecx, esi
mov dword [edi + 0x3c], ebx
call fcn.0041d42b
push eax
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.0041b82a
or ebx, 0xffffffff
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], ebx
call fcn.0041bb22
lea eax, [ebp - 0x48]
mov ecx, esi
push eax
call fcn.0041ceca
push eax
mov ecx, esi
mov dword [ebp - 4], 1
call fcn.0041b82a
lea ecx, [ebp - 0x48]
call fcn.0041bb22
lea eax, [edi + 8]
cmp dword [eax + 0x14], 8
jb 0x409164
mov eax, dword [eax]
push 0
push 0x80
push 3
push 0
push 3
push connect
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [edi + 0x30], eax
cmp eax, ebx
jne 0x409192
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0x34], eax
push 0xfffffffffffffffe
pop eax
jmp 0x4091d0
lea ecx, [ebp - 0x50]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x4091bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0x34], eax
cmp dword [edi + 0x30], ebx
je 0x4091bb
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x30], ebx
push 0xfffffffffffffffd
jmp 0x40918f
mov eax, dword [ebp - 0x50]
mov dword [edi + 0x38], eax
mov eax, dword [ebp - 0x4c]
mov dword [edi + 0x3c], eax
xor eax, eax
mov byte [edi], 1
call fcn.0045e51e
ret
Function at 0x409d71
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push 0x50
mov eax, 0x485589
call fcn.0045e574
mov edi, ecx
call fcn.00407409
lea eax, [ebp - 0x30]
lea esi, [edi + 4]
push eax
mov ecx, esi
call fcn.0041d42b
and dword [ebp - 4], 0
mov ecx, esi
push eax
call fcn.0041b82a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.0041bb22
lea eax, [ebp - 0x4c]
mov ecx, esi
push eax
call fcn.0041ceca
push eax
mov ecx, esi
mov dword [ebp - 4], 1
call fcn.0041b82a
lea ecx, [ebp - 0x4c]
call fcn.0041bb22
mov byte [ebp - 0x4d], 0
mov ebx, 0x80
cmp byte [ebp + 8], 0
lea esi, [edi + 8]
mov eax, esi
je 0x409def
cmp dword [esi + 0x14], 8
jb 0x409de8
mov eax, dword [esi]
push 0
push ebx
push 4
jmp 0x409dfc
cmp dword [esi + 0x14], 8
jb 0x409df7
mov eax, dword [esi]
push 0
push ebx
push 2
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [edi + 0x30], eax
cmp eax, 0xffffffff
jne 0x409e6e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0x34], eax
cmp eax, 5
jne 0x409e69
cmp byte [ebp - 0x4d], 0
jne 0x409e69
cmp dword [esi + 0x14], 8
mov eax, esi
mov byte [ebp - 0x4d], 1
jb 0x409e36
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x409e69
cmp ebx, 0x80
je 0x409e69
test bl, 1
je 0x409dd5
and ebx, 0xfffffffe
cmp dword [esi + 0x14], 8
jb 0x409e5c
mov esi, dword [esi]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x409dd5
push 0xfffffffffffffffe
pop eax
jmp 0x409eae
cmp byte [ebp + 8], 0
je 0x409ea9
push 2
push 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x5c], xmm0
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x409ea9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [edi + 0x30]
mov dword [edi + 0x34], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xfffffffffffffffc
jmp 0x409e6b
mov byte [edi], 1
xor eax, eax
call fcn.0045e51e
ret 4

Function at 0x40d200
Capabilities:
Hash data with md5

Disassembly:
and dword [ecx + 4], 0
and dword [ecx], 0
mov dword [ecx + 8], 0x67452301
mov dword [ecx + 0xc], 0xefcdab89
mov dword [ecx + 0x10], 0x98badcfe
mov dword [ecx + 0x14], 0x10325476
ret