joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402afd
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4b2070]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x24], ecx
push edi
test esi, esi
jne 0x402b26
push 0xffffffffffffff88
jmp 0x402bc2
push eax
movzx eax, dx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x402b40
or eax, 0xffffffff
jmp 0x402bc3
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402b50
push 0xfffffffffffffffe
jmp 0x402bc2
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x402b61
push 0xfffffffffffffffd
jmp 0x402bc2
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
jle 0x402bc0
push ecx
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
push eax
call fcn.0041bec2
cmp dword [eax + 0x14], 0x10
jb 0x402b84
mov eax, dword [eax]
push 0x49c6f4
push eax
call fcn.00465fd0
pop ecx
pop ecx
lea ecx, [ebp - 0x20]
mov esi, eax
call fcn.004016b2
test esi, esi
jne 0x402ba3
push 0xfffffffffffffffc
jmp 0x402bc2
push esi
push 1
push edi
push ebx
call fcn.004664fc
push esi
call fcn.00466175
push esi
call fcn.00466244
add esp, 0x18
xor eax, eax
jmp 0x402bc3
push 0xfffffffffffffffa
pop eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045e16b
leave
ret

Function at 0x403882
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x4038c6
mov edi, dword [ebp + 0xc]
test edi, edi
jl 0x4038c6
mov ebx, dword [ebp + 8]
jg 0x40389e
test ebx, ebx
je 0x4038c6
or edx, 0xffffffff
movzx eax, byte [esi]
add ebx, 0xffffffff
movzx ecx, dl
adc edi, 0xffffffff
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x49c758]
mov ecx, ebx
inc esi
or ecx, edi
jne 0x4038a1
not edx
mov eax, edx
jmp 0x4038c8
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4038cd
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov edx, ecx
test esi, esi
je 0x403921
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
jl 0x403920
mov eax, dword [ebp + 0xc]
jg 0x4038eb
test eax, eax
je 0x403920
push ebx
mov ebx, dword [edx + 8]
add eax, 0xffffffff
movzx ecx, bl
mov dword [ebp + 8], eax
movzx eax, byte [esi]
adc edi, 0xffffffff
xor ecx, eax
shr ebx, 8
mov eax, dword [ebp + 8]
xor ebx, dword [ecx*4 + 0x49c758]
inc esi
or eax, edi
mov dword [edx + 8], ebx
mov eax, dword [ebp + 8]
jne 0x4038ef
add dword [edx], 0xffffffff
pop ebx
adc dword [edx + 4], 0xffffffff
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x403bf4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x485029
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4b2070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor edi, edi
lea ecx, [esi + 0x54]
mov dword [ebp - 4], edi
call fcn.00404495
lea ecx, [esi + 0x48]
mov dword [ebp - 4], 1
call fcn.00404495
lea ecx, [esi + 0x3c]
mov dword [ebp - 4], 2
call fcn.00404495
lea ecx, [esi + 0x30]
mov dword [ebp - 4], 3
call fcn.00404495
lea ecx, [esi + 0x24]
mov dword [ebp - 4], 4
call fcn.00404495
cmp dword [esi + 0xc], edi
je 0x403c96
push dword [esi + 0x10]
push dword [esi + 0xc]
call fcn.00404470
mov eax, dword [esi + 0x14]
sub eax, dword [esi + 0xc]
push 0x58
pop ecx
cdq
idiv ecx
imul eax, eax, 0x58
push eax
push dword [esi + 0xc]
call fcn.004017d3
mov dword [esi + 0xc], edi
pop ecx
mov dword [esi + 0x10], edi
pop ecx
mov dword [esi + 0x14], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
leave
ret
Function at 0x404a84
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push 0x49ce8c
mov edi, ecx
call esi
push str.psapi.dll
mov dword [ebp - 4], eax
call esi
push str.Wlanapi.dll
mov dword [ebp - 8], eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x2c], eax
mov dword [edi + 0x1c], eax
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], eax
mov dword [edi + 0x28], eax
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], eax
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], eax
mov dword [edi + 0x40], eax
mov dword [edi + 0x44], eax
mov dword [edi + 0x48], eax
mov dword [edi + 0x4c], eax
mov dword [edi + 0x50], eax
mov dword [edi + 0x54], eax
mov dword [edi + 0x58], eax
mov dword [edi + 0x5c], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x404b66
push str.CreateToolhelp32Snapshot
push eax
call esi
push str.Process32First
push dword [ebp - 4]
mov dword [edi], eax
call esi
push str.Process32Next
push dword [ebp - 4]
mov dword [edi + 4], eax
call esi
push str.Module32First
push dword [ebp - 4]
mov dword [edi + 8], eax
call esi
push str.Module32Next
push dword [ebp - 4]
mov dword [edi + 0xc], eax
call esi
push str.Thread32First
push dword [ebp - 4]
mov dword [edi + 0x10], eax
call esi
push str.Thread32Next
push dword [ebp - 4]
mov dword [edi + 0x14], eax
call esi
push str.GlobalMemoryStatusEx
push dword [ebp - 4]
mov dword [edi + 0x18], eax
call esi
mov dword [edi + 0x30], eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x404bac
push str.EnumProcesses
push eax
call esi
push str.EnumProcessModules
push dword [ebp - 8]
mov dword [edi + 0x1c], eax
call esi
push str.EnumProcessModulesEx
push dword [ebp - 8]
mov dword [edi + 0x24], eax
call esi
push str.GetModuleFileNameExW
push dword [ebp - 8]
mov dword [edi + 0x28], eax
call esi
push str.GetProcessImageFileNameW
push dword [ebp - 8]
mov dword [edi + 0x20], eax
call esi
mov dword [edi + 0x2c], eax
test ebx, ebx
je 0x404c29
push str.WlanOpenHandle
push ebx
call esi
push str.WlanEnumInterfaces
push ebx
mov dword [edi + 0x34], eax
call esi
push str.WlanGetAvailableNetworkList
push ebx
mov dword [edi + 0x38], eax
call esi
push str.WlanGetProfile
push ebx
mov dword [edi + 0x3c], eax
call esi
push str.WlanCloseHandle
push ebx
mov dword [edi + 0x40], eax
call esi
push str.WlanFreeMemory
push ebx
mov dword [edi + 0x44], eax
call esi
push str.WlanDeleteProfile
push ebx
mov dword [edi + 0x48], eax
call esi
push str.WlanDisconnect
push ebx
mov dword [edi + 0x4c], eax
call esi
push str.WlanSetProfile
push ebx
mov dword [edi + 0x50], eax
call esi
push str.WlanConnect
push ebx
mov dword [edi + 0x54], eax
call esi
push str.WlanGetNetworkBssList
push ebx
mov dword [edi + 0x58], eax
call esi
mov dword [edi + 0x5c], eax
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40506b
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x4b2070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x200
mov esi, ecx
lea eax, [ebp - 0x204]
push 0
mov dword [ebp - 0x208], esi
push eax
mov dword [ebp - 0x208], esi
call fcn.004606c0
add esp, 0xc
mov dword [ebp - 0x208], 0x100
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x204]
mov ecx, esi
push eax
call fcn.0041ba7d
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0045e16b
leave
ret

Function at 0x40524a
Capabilities:
Get common file path

Disassembly:
push 0x218
mov eax, 0x485401
call fcn.0045edb6
mov esi, ecx
mov dword [ebp - 0x220], esi
xor edi, edi
lea eax, [ebp - 0x218]
push 0x208
mov dword [ebp - 4], edi
push edi
mov dword [ebp - 0x224], esi
push eax
mov dword [ebp - 0x21c], edi
call fcn.004606c0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.0041ba7d
mov dword [ebp - 4], edi
mov ecx, esi
push edi
mov dword [ebp - 0x21c], 1
call fcn.0041c39d
mov eax, esi
call fcn.0045ed60
ret

Function at 0x405472
Capabilities:
Get common file path

Disassembly:
push 0x234
mov eax, 0x485469
call fcn.0045edb6
mov esi, ecx
mov dword [ebp - 0x240], esi
mov dword [ebp - 0x240], esi
call fcn.004051cf
test al, al
je 0x4054a6
mov dl, 1
mov ecx, esi
call fcn.004052c4
jmp 0x405560
push 0x208
lea eax, [ebp - 0x21c]
push 0
push eax
call fcn.004606c0
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x405498
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x238]
call fcn.0041ba7d
and dword [ebp - 4], 0
lea ecx, [ebp - 0x238]
call fcn.0041d1ea
push 0
lea ecx, [ebp - 0x238]
call fcn.0041c39d
lea edx, [ebp - 0x239]
lea ecx, [ebp - 0x238]
call fcn.0040684f
test al, al
jne 0x405520
lea ecx, [ebp - 0x238]
call fcn.00406296
lea ecx, [ebp - 0x238]
call fcn.004065e8
test al, al
jne 0x40553a
mov dl, 1
mov ecx, esi
call fcn.004052c4
jmp 0x405555
push 1
lea ecx, [ebp - 0x238]
call fcn.0041c39d
lea eax, [ebp - 0x238]
mov ecx, esi
push eax
call fcn.0041bada
lea ecx, [ebp - 0x238]
call fcn.0041bf1b
mov eax, esi
call fcn.0045ed60
ret
Function at 0x405d0c
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4b2070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x20]
push eax
call fcn.0041d83a
xor esi, esi
cmp dword [ebp + 0xc], esi
jg 0x405d39
jl 0x405d35
cmp dword [ebp + 8], esi
ja 0x405d39
push 0xffffffffffffff9c
jmp 0x405d9a
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
push esi
cmovae eax, dword [ebp - 0x1c]
push 0x80
push 2
push esi
push esi
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x405d98
push esi
lea eax, [ebp - 0x28]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x405d8c
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
and esi, 3
add esi, 0xfffffffd
jmp 0x405d8f
push 0xfffffffffffffffb
pop esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x405d9b
push 0xfffffffffffffff7
pop esi
lea ecx, [ebp - 0x20]
call fcn.0041bf1b
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0045e16b
leave
ret
Function at 0x406296
Capabilities:
Create directory

Disassembly:
push 0x6c
mov eax, 0x4855af
call fcn.0045edb6
lea eax, [ebp - 0x64]
push eax
call fcn.0041d2c3
xor ebx, ebx
lea ecx, [ebp - 0x64]
push ebx
mov dword [ebp - 4], ebx
call fcn.0041c39d
lea ecx, [ebp - 0x2c]
call fcn.0041b469
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ebx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x48]
push 0x49d1e0
mov byte [ebp - 0x65], bl
call fcn.0041ba7d
push ebx
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x64]
call fcn.0041d13b
lea ecx, [ebp - 0x48]
mov bl, al
call fcn.0041bf1b
test bl, bl
je 0x40630b
cmp dword [ebp - 0x50], 2
jne 0x406307
or esi, 0xffffffff
jmp 0x40644c
mov bl, 1
jmp 0x40630e
mov bl, byte [ebp - 0x65]
push 0x49d1e8
lea ecx, [ebp - 0x48]
call fcn.0041ba7d
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x78]
push eax
lea ecx, [ebp - 0x64]
call fcn.0041dc32
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call fcn.0041bf1b
mov eax, dword [ebp - 0x74]
xor esi, esi
sub eax, dword [ebp - 0x78]
push 0x1c
cdq
pop edi
idiv edi
mov dword [ebp - 0x6c], esi
test eax, eax
je 0x40644c
mov edi, esi
mov eax, dword [ebp - 0x78]
cmp dword [edi + eax + 0x14], esi
je 0x406432
cmp dword [ebp - 0x18], 0
je 0x406392
push 0x49c6c0
lea ecx, [ebp - 0x48]
call fcn.0041ba7d
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x28]
call fcn.00408abe
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call fcn.0041bf1b
test bl, bl
je 0x4063c5
cmp dword [ebp - 0x18], 0
jne 0x4063c5
push 0x49d1e0
lea ecx, [ebp - 0x48]
call fcn.0041ba7d
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x28]
call fcn.00408abe
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call fcn.0041bf1b
mov eax, dword [ebp - 0x78]
lea ecx, [ebp - 0x28]
add eax, 4
add eax, edi
push eax
call fcn.00408abe
push 0x49c6bc
lea ecx, [ebp - 0x2c]
call fcn.0041bb23
test al, al
jne 0x406432
push 0x49ce7c
lea ecx, [ebp - 0x2c]
call fcn.0041bb23
test al, al
jne 0x406432
cmp dword [ebp - 0x18], 2
jne 0x406410
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
cmp word [eax + 2], 0x3a
je 0x406432
lea edx, [ebp - 0x65]
lea ecx, [ebp - 0x2c]
call fcn.0040684f
test al, al
jne 0x406432
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push esi
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, dword [ebp - 0x74]
sub eax, dword [ebp - 0x78]
push 0x1c
pop ecx
cdq
add edi, ecx
idiv ecx
inc dword [ebp - 0x6c]
cmp dword [ebp - 0x6c], eax
jb 0x406356
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 7
call fcn.00404495
lea ecx, [ebp - 0x2c]
call fcn.0041bf1b
lea ecx, [ebp - 0x64]
call fcn.0041bf1b
mov eax, esi
call fcn.0045ed60
ret
Function at 0x406470
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push 0x24
mov eax, 0x4855dc
call fcn.0045edb6
lea eax, [ebp - 0x2c]
push eax
call fcn.0041d2c3
xor esi, esi
lea edx, [ebp - 0x2d]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], esi
call fcn.0040684f
test al, al
jne 0x40649e
or esi, 0xffffffff
jmp 0x4064dd
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x4064bb
push 0xffffffffffffff9c
jmp 0x4064dc
test cl, 1
je 0x4064dd
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
and ecx, 0xfffffffe
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x4064dd
push 0xfffffffffffffffd
pop esi
lea ecx, [ebp - 0x2c]
call fcn.0041bf1b
mov eax, esi
call fcn.0045ed60
ret

Function at 0x4064ed
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push 0x24
mov eax, 0x4855dc
call fcn.0045edb6
lea eax, [ebp - 0x2c]
push eax
call fcn.0041d2c3
xor esi, esi
lea edx, [ebp - 0x2d]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], esi
call fcn.0040684f
test al, al
jne 0x40651b
or esi, 0xffffffff
jmp 0x40655a
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x406538
push 0xffffffffffffff9c
jmp 0x406559
test cl, 2
je 0x40655a
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
and ecx, 0xfffffffd
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x40655a
push 0xfffffffffffffffd
pop esi
lea ecx, [ebp - 0x2c]
call fcn.0041bf1b
mov eax, esi
call fcn.0045ed60
ret

Function at 0x40684f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4b2070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x20]
mov esi, edx
push eax
call fcn.0041d2c3
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40688d
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor bl, bl
jmp 0x406896
shr eax, 4
mov bl, 1
and al, 1
mov byte [esi], al
lea ecx, [ebp - 0x20]
call fcn.0041bf1b
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.0045e16b
leave
ret

Function at 0x406c2b
Capabilities:
Delete file

Disassembly:
push 0x3c
mov eax, 0x485764
call fcn.0045edb6
lea eax, [ebp - 0x2c]
push eax
call fcn.0041d2c3
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x104
jl 0x406c71
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041d442
add eax, 4
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x28]
call fcn.0041e62b
lea ecx, [ebp - 0x48]
call fcn.0041bf1b
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
lea ecx, [ebp - 0x2c]
setne bl
call fcn.0041bf1b
mov al, bl
call fcn.0045ed60
ret
Function at 0x406c98
Capabilities:
Move file

Disassembly:
push 0x5c
mov eax, 0x4857a9
call fcn.0045edb6
mov esi, edx
lea eax, [ebp - 0x48]
push eax
call fcn.0041d2c3
and dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
push eax
mov ecx, esi
call fcn.0041d2c3
mov esi, 0x104
mov byte [ebp - 4], 1
cmp dword [ebp - 0x34], esi
jl 0x406cf4
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x48]
call fcn.0041d518
add eax, 4
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x44]
call fcn.0041e62b
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 1
call fcn.0041bf1b
cmp dword [ebp - 0x18], esi
jl 0x406d1d
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041d518
add eax, 4
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x28]
call fcn.0041e62b
lea ecx, [ebp - 0x64]
call fcn.0041bf1b
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
lea eax, [ebp - 0x44]
cmovae ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x30], 8
push ecx
cmovae eax, dword [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
lea ecx, [ebp - 0x2c]
setne bl
call fcn.0041bf1b
lea ecx, [ebp - 0x48]
call fcn.0041bf1b
mov al, bl
call fcn.0045ed60
ret

Function at 0x406d58
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24c
mov eax, dword [0x4b2070]
xor eax, esp
mov dword [esp + 0x248], eax
push ebx
push esi
push edi
mov edi, ecx
test edi, edi
jne 0x406d82
xor eax, eax
jmp 0x406e94
push 0x40
xor ebx, ebx
lea eax, [esp + 0x14]
push ebx
push eax
call fcn.004606c0
push edi
push 1
lea eax, [esp + 0x24]
push 0x40
push eax
call fcn.0046702c
add esp, 0x1c
cmp eax, 0xffffffff
jne 0x406daf
push 0xfffffffffffffffc
jmp 0x406e91
mov eax, 0x5a4d
cmp word [esp + 0x10], ax
je 0x406dc2
push 0xfffffffffffffffb
jmp 0x406e91
push ebx
push dword [esp + 0x50]
push edi
call fcn.00466e45
add esp, 0xc
test eax, eax
je 0x406ddb
push 0xfffffffffffffffa
jmp 0x406e91
mov esi, 0xf8
lea eax, [esp + 0x50]
push esi
push ebx
push eax
call fcn.004606c0
push 0x108
lea eax, [esp + 0x158]
push ebx
push eax
call fcn.004606c0
push edi
push 1
lea eax, [esp + 0x70]
push esi
push eax
call fcn.0046702c
add esp, 0x28
cmp eax, 0xffffffff
jne 0x406e19
push 0xfffffffffffffff9
jmp 0x406e91
cmp dword [esp + 0x50], 0x4550
je 0x406e27
push 0xfffffffffffffff8
jmp 0x406e91
mov eax, 0x10b
cmp word [esp + 0x68], ax
jne 0x406e38
xor esi, esi
inc esi
jmp 0x406e92
mov eax, 0x20b
cmp word [esp + 0x68], ax
jne 0x406e8f
push 2
pop esi
push ebx
push dword [esp + 0x50]
push edi
call fcn.00466e45
add esp, 0xc
test eax, eax
je 0x406e5d
push 0xfffffffffffffff6
jmp 0x406e91
push edi
push 1
lea eax, [esp + 0x150]
push 0x108
push eax
call fcn.0046702c
add esp, 0x10
cmp eax, 0xffffffff
jne 0x406e7e
push 0xfffffffffffffff5
jmp 0x406e91
cmp dword [esp + 0x148], 0x4550
je 0x406e92
push 0xfffffffffffffff4
jmp 0x406e91
push 0xfffffffffffffff7
pop esi
mov eax, esi
mov ecx, dword [esp + 0x254]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0045e16b
mov esp, ebp
pop ebp
ret
Function at 0x406ea9
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push 0x80
mov eax, 0x4857d6
call fcn.0045edb6
mov edi, edx
mov dword [ebp - 0x8c], edi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x48]
push 7
push eax
call fcn.0041bf64
and dword [ebp - 4], 0
lea eax, [ebp - 0x60]
push ecx
push eax
mov ecx, esi
call fcn.0041bec2
cmp dword [eax + 0x14], 0x10
jb 0x406ee6
mov eax, dword [eax]
push 0x49d210
push eax
call fcn.00465fd0
pop ecx
pop ecx
mov ebx, eax
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x88], ebx
call fcn.004016b2
push 0x64
pop esi
test ebx, ebx
jne 0x406f12
or esi, 0xffffffff
jmp 0x407074
push 2
push 0
push ebx
call fcn.00466e45
add esp, 0xc
push ebx
call fcn.00466b32
pop ecx
push 0
push 0
push ebx
mov dword [ebp - 0x7c], eax
call fcn.00466e45
pop ecx
pop ecx
lea eax, [ebp - 0x78]
mov ecx, edi
push eax
call fcn.0041bec2
cmp dword [eax + 0x14], 0x10
jb 0x406f48
mov eax, dword [eax]
push 0x49d214
push eax
call fcn.00465fd0
pop ecx
pop ecx
mov edi, eax
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x84], edi
call fcn.004016b2
test edi, edi
jne 0x406f78
push ebx
call fcn.00466244
pop ecx
push 0xfffffffffffffffd
pop esi
jmp 0x407074
mov ecx, ebx
xor edi, edi
call fcn.00406d58
mov dword [ebp - 0x80], eax
cmp eax, 1
je 0x406f95
cmp eax, 2
je 0x406f95
mov esi, eax
jmp 0x40703f
push 0
push 0
push ebx
call fcn.00466e45
add esp, 0xc
push dword [ebp - 0x7c]
call fcn.0045e3ba
pop ecx
push ebx
push 1
push dword [ebp - 0x7c]
mov edi, eax
push edi
call fcn.0046702c
add esp, 0x10
cmp eax, 0xffffffff
jne 0x406fc6
push 0xfffffffffffffff3
pop esi
jmp 0x40703f
mov eax, dword [edi + 0x3c]
movzx ecx, word [eax + edi + 0x14]
add ecx, eax
movzx eax, word [eax + edi + 6]
movzx edx, ax
lea eax, [edi + 0x18]
add eax, ecx
mov dword [ebp - 0x7c], edx
mov dword [ebp - 0x80], eax
test edx, edx
je 0x40703f
mov ebx, eax
push ebx
lea ecx, [ebp - 0x2c]
call fcn.0041b9a3
push 0
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041d7e8
test eax, eax
jne 0x407028
push dword [ebp - 0x84]
mov eax, dword [ebx + 0x14]
push 1
push dword [ebx + 8]
add eax, edi
push eax
call fcn.004664fc
add esp, 0x10
xor ecx, ecx
cmp eax, 0xffffffff
push 0xfffffffffffffff1
pop esi
cmovne esi, ecx
lea ecx, [ebp - 0x2c]
call fcn.0041bf1b
add ebx, 0x28
sub dword [ebp - 0x7c], 1
jne 0x406fe9
mov ebx, dword [ebp - 0x88]
push ebx
call fcn.00466244
mov ebx, dword [ebp - 0x84]
pop ecx
push ebx
call fcn.00466175
pop ecx
push ebx
call fcn.00466244
pop ecx
test edi, edi
je 0x407065
push edi
call fcn.0045e17c
pop ecx
test esi, esi
je 0x407074
mov ecx, dword [ebp - 0x8c]
call fcn.00406c2b
lea ecx, [ebp - 0x48]
call fcn.0041bf1b
mov eax, esi
call fcn.0045ed60
ret
Function at 0x407572
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
lea eax, [ebp - 4]
push edi
push eax
push dword [ebp + 0xc]
mov esi, ecx
mov dword [ebp - 4], edi
push dword [ebp + 8]
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4075a9
mov eax, dword [ebp - 4]
test eax, eax
je 0x4075a9
add dword [esi + 0x28], eax
mov dword [esi + 0x34], edi
adc dword [esi + 0x2c], edi
jmp 0x4075b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xfffffffffffffffe
mov dword [esi + 0x34], eax
pop eax
pop edi
pop esi
leave
ret 8

Function at 0x4076ff
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
lea eax, [ebp - 4]
push edi
push eax
push dword [ebp + 0xc]
mov esi, ecx
mov dword [ebp - 4], edi
push dword [ebp + 8]
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x407739
mov eax, dword [ebp - 4]
cmp dword [ebp + 0xc], eax
jne 0x407739
add dword [esi + 0x20], eax
mov dword [esi + 0x34], edi
adc dword [esi + 0x24], edi
xor eax, eax
jmp 0x407745
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xfffffffffffffffe
mov dword [esi + 0x34], eax
pop eax
pop edi
pop esi
leave
ret 8