joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ad01b35
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [ebp + 0x14]
xor bl, bl
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, dword [ebp + 0x18]
or esi, 0xffffffff
cmp eax, esi
mov dword [edi], eax
jne 0x4ad01ba4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x4ad2ba04], eax
pop edi
pop esi
mov al, bl
pop ebx
pop ebp
ret 0x14
push dword [ebp + 0x10]
push dword [ebp + 0x14]
call dword [ebp + 8]
test eax, eax
je 0x4ad0c189
and dword [0x4ad2ba04], 0
mov bl, 1
cmp dword [edi], esi
je 0x4ad01c12
mov eax, dword [0x4ad2fa8c]
test eax, eax
je 0x4ad0572e
mov ebx, dword [0x4ad2fa90]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
push 0
lea ebx, [ebx*4 + 4]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapSize]
cmp ebx, eax
ja 0x4ad18805
mov eax, dword [0x4ad2fa8c]
test eax, eax
je 0x4ad01c10
mov ecx, dword [edi]
mov edx, dword [0x4ad2fa90]
mov dword [eax + edx*4], ecx
inc dword [0x4ad2fa90]
mov bl, 1
test bl, bl
jne 0x4ad01b62
jmp 0x4ad01b57
push 0x14
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [0x4ad2fa8c], eax
jmp 0x4ad01bf6
push dword [ebp + 0x14]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x4ad0c206
cmp dword [edi], esi
jne 0x4ad01ba4
jmp 0x4ad01bbe
push dword [edi]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [edi], esi
jmp 0x4ad01bbe

Function at 0x4ad01b70
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and word [str..COM_.EXE_.BAT_.CMD_.VBS_.VBE_.JS_.JSE_.WSF_.WSH], 0
push ebx
push esi
mov ebx, 0x2000
push ebx
mov esi, str..COM_.EXE_.BAT_.CMD_.VBS_.VBE_.JS_.JSE_.WSF_.WSH
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x4ad045aa
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4
cmp byte [0x4ad2fa64], 0
push edi
je 0x4ad0464a
mov edi, dword [sym.imp.msvcrt.dll__wcsicmp]
push 0x4ad34190
push dword [ebp + 8]
call edi
test eax, eax
pop ecx
pop ecx
je 0x4ad12df9
push str.ERRORLEVEL
push dword [ebp + 8]
call edi
test eax, eax
pop ecx
pop ecx
je 0x4ad0a861
push str.CMDEXTVERSION
push dword [ebp + 8]
call edi
test eax, eax
pop ecx
pop ecx
je 0x4ad12e05
push 0x4ad04664
push dword [ebp + 8]
call edi
test eax, eax
pop ecx
pop ecx
je 0x4ad12e0c
push str.DATE
push dword [ebp + 8]
call edi
test eax, eax
pop ecx
pop ecx
je 0x4ad12e17
push str.TIME
push dword [ebp + 8]
call edi
test eax, eax
pop ecx
pop ecx
je 0x4ad12e23
push 0x4ad04654
push dword [ebp + 8]
call edi
test eax, eax
pop ecx
pop ecx
je 0x4ad12e3b
xor eax, eax
pop edi
jmp 0x4ad01b9e
push dword [0x4ad2fa20]
push 0x4ad081bc
push esi
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0xc
mov eax, esi
jmp 0x4ad0464c
Function at 0x4ad01cde
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x4ad33b78]
or dword [ebp - 0x214], 0xffffffff
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x218], eax
xor al, al
push edi
mov byte [ebp - 0x20d], 0
xor ebx, ebx
mov ecx, dword [esi + 0x38]
mov di, word [ecx + ebx*2]
cmp di, 0x22
je 0x4ad0a14b
test di, di
je 0x4ad01d64
cmp byte [ebp - 0x20d], 0
jne 0x4ad01d44
test al, al
jne 0x4ad01d44
push edi
push str._______t_
call fcn.4ad01323
test eax, eax
jne 0x4ad01d64
cmp dword [ebp - 0x214], 0xffffffff
je 0x4ad01ea2
xor al, al
mov word [ebp + ebx*2 - 0x20c], di
inc ebx
cmp ebx, 0x103
jb 0x4ad01d12
test ebx, ebx
je 0x4ad148b6
and word [ebp + ebx*2 - 0x20c], 0
cmp dword [ebp - 0x214], 0xffffffff
je 0x4ad01d9c
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4ad03b2f
test al, 0x10
jne 0x4ad03b2f
push dword [ebp - 0x218]
lea eax, [ebp - 0x20c]
push eax
push 0x28
call fcn.4ad01c99
mov edi, eax
cmp edi, 0xffffffff
mov dword [ebp - 0x21c], edi
jne 0x4ad05c78
push dword [ebp - 0x218]
lea eax, [ebp - 0x20c]
push eax
push 0x2b
call fcn.4ad01c99
cmp eax, 0x2b
je 0x4ad01e93
cmp edi, 0xffffffff
mov byte [ebp - 0x20d], 0
mov byte [ebp - 0x20e], 0
jne 0x4ad01e66
xor ebx, ebx
mov byte [ebp - 0x20f], bl
mov eax, dword [esi + 0x38]
mov di, word [eax + ebx*2]
test di, di
je 0x4ad03a73
cmp di, 0x22
je 0x4ad0a171
cmp byte [ebp - 0x20d], 0
jne 0x4ad01e55
cmp byte [ebp - 0x20e], 0
jne 0x4ad01e55
push edi
call dword [sym.imp.msvcrt.dll_iswspace]
test eax, eax
pop ecx
jne 0x4ad03a73
push edi
push 0x4ad33b80
call fcn.4ad01323
test eax, eax
jne 0x4ad03a73
cmp di, word [0x4ad33b88]
je 0x4ad03a73
inc ebx
mov byte [ebp - 0x20e], 0
cmp byte [ebp - 0x20f], 0
je 0x4ad01df9
mov eax, dword [esi + 0x38]
test eax, eax
mov edi, dword [sym.imp.msvcrt.dll_wcslen]
je 0x4ad0a165
push eax
call edi
pop ecx
mov dword [ebp - 0x214], eax
cmp ebx, dword [ebp - 0x214]
jne 0x4ad148be
mov eax, dword [ebp - 0x21c]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.4ad01305
leave
ret 8
push edi
push 0x4ad343ec
call fcn.4ad01323
test eax, eax
je 0x4ad01d51
cmp byte [0x4ad2fa64], 0
je 0x4ad01d64
mov dword [ebp - 0x214], ebx
jmp 0x4ad01d51
mov byte [ebp - 0x20f], 1
jmp 0x4ad01e5d
mov ebx, dword [ebp - 0x214]
and word [ebp + ebx*2 - 0x20c], 0
jmp 0x4ad01d9c
cmp edi, 0x14
jne 0x4ad01dde
mov dword [esi + 0x40], 1
jmp 0x4ad01dde
cmp byte [ebp - 0x20d], 0
sete al
test al, al
mov byte [ebp - 0x20d], al
sete al
jmp 0x4ad01d23
and dword [ebp - 0x214], 0
jmp 0x4ad01e81
cmp byte [ebp - 0x20d], 0
sete al
test al, al
mov byte [ebp - 0x20d], al
sete byte [ebp - 0x20e]
jmp 0x4ad01e13
Function at 0x4ad02a5b
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4ad33b78]
and word [ebp - 6], 0
mov dword [ebp - 4], eax
mov ax, word [ebp + 8]
mov word [ebp - 0xc], ax
mov ax, word [0x4ad33b8c]
mov word [ebp - 8], ax
lea eax, [ebp - 0xc]
push eax
mov word [ebp - 0xa], 0x3a
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor ecx, ecx
inc ecx
cmp ecx, eax
mov ecx, dword [ebp - 4]
sbb eax, eax
neg eax
call fcn.4ad01305
leave
ret 4

Function at 0x4ad02bc9
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x4ad12dcf
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
cmp esi, ebx
je 0x4ad12dd6
push edi
push ebx
push dword [ebp + 8]
call fcn.4ad02b6b
mov edi, eax
push 0x20
push edi
mov dword [ebp + 8], edi
call fcn.4ad01a53
cmp eax, ebx
jne 0x4ad12ddd
cmp edi, ebx
je 0x4ad02c58
push edi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
mov edi, eax
test esi, esi
je 0x4ad02c5c
push esi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
mov ebx, eax
test ebx, ebx
jbe 0x4ad02c4f
cmp dword [0x4ad2b9e8], 0
jne 0x4ad02c4f
push edi
push esi
push dword [ebp + 8]
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x4ad12de5
lea esi, [esi + ebx*2 + 2]
jmp 0x4ad02c18
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
xor edi, edi
jmp 0x4ad02c18
xor ebx, ebx
jmp 0x4ad02c26
Function at 0x4ad02e82
Capabilities:
Get file size
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
push ebx
push esi
xor ebx, ebx
push edi
inc ebx
xor edi, edi
and eax, 3
cmp eax, 2
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], 0xc
ja 0x4ad0e2c0
test byte [ebp + 0xc], bl
je 0x4ad02ebd
test byte [ebp + 0xc], 8
jne 0x4ad0e2c0
cmp eax, edi
mov esi, 0x80000000
je 0x4ad067fa
push 0x4ad03d08
push dword [ebp + 8]
mov dword [ebp - 8], 0x40000000
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x4ad02ee8
mov dword [ebp + 0x10], ebx
push 2
cmp dword [ebp + 0xc], 0x10a
pop eax
push edi
je 0x4ad0e272
push 0x80
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0x10]
push dword [ebp - 8]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4ad17170
push 8
push ebx
call dword [sym.imp.msvcrt.dll__open_osfhandle]
test byte [ebp + 0xc], 8
pop ecx
pop ecx
mov dword [ebp + 0x10], eax
jne 0x4ad0e030
push dword [ebp + 0x10]
call fcn.4ad02e4b
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
leave
ret 0xc
mov dword [ebp - 8], esi
push 3
jmp 0x4ad02eea
push eax
call fcn.4ad02c65
test eax, eax
jne 0x4ad02f35
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
je 0x4ad02f35
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
or dword [ebp - 4], 0xffffffff
push 2
lea eax, [ebp - 4]
push eax
push 0xffffffffffffffff
push ebx
mov dword [ebp - 0xc], edi
call esi
cmp eax, 0xffffffff
je 0x4ad17144
push edi
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0xc]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4ad17193
cmp word [ebp - 0xc], 0x1a
jne 0x4ad02f35
jmp 0x4ad171a5
mov edi, 0x80
push edi
push 3
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0x10]
mov eax, dword [ebp - 8]
or eax, esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
push dword [ebp + 8]
call esi
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4ad0e2a0
xor edi, edi
jmp 0x4ad02f1d
push 0
push edi
push 4
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0x10]
push dword [ebp - 8]
push dword [ebp + 8]
call esi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4ad0e299
jmp 0x4ad17170
or eax, 0xffffffff
jmp 0x4ad02f40

Function at 0x4ad02f53
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x4ad33b78]
mov dword [ebp - 4], eax
mov ax, word [ebp + 8]
mov word [ebp - 0x10], ax
mov ax, word [0x4ad33b8c]
push esi
mov word [ebp - 0xc], ax
lea eax, [ebp - 0x10]
xor esi, esi
push eax
mov word [ebp - 0xe], 0x3a
mov word [ebp - 0xa], si
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x4ad02fd6
cmp eax, 2
je 0x4ad02fc7
cmp eax, 5
je 0x4ad02fc7
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x220]
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x4ad17103
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
call fcn.4ad01305
leave
ret 4
xor eax, eax
inc eax
jmp 0x4ad02fc9
Function at 0x4ad0419f
Capabilities:
Check if file exists
Get common file path
Get file attributes
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x62c
mov eax, dword [0x4ad33b78]
push esi
mov esi, dword [ebp + 8]
mov cx, word [esi]
mov dword [ebp - 4], eax
mov ax, word [0x4ad33b8c]
cmp cx, ax
je 0x4ad17505
cmp cx, 0x2e
je 0x4ad17519
push edi
lea eax, [ebp - 0x214]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push dword [ebp - 0x214]
mov edi, dword [sym.imp.msvcrt.dll_towupper]
call edi
mov word [ebp - 0xc], 0x3d
mov dword [ebp - 0x62c], eax
xor eax, eax
mov ax, word [esi]
push eax
call dword [sym.imp.msvcrt.dll_iswalpha]
test eax, eax
pop ecx
pop ecx
je 0x4ad0dd24
cmp word [esi + 2], 0x3a
jne 0x4ad0dd24
xor eax, eax
mov ax, word [esi]
push eax
call edi
pop ecx
add esi, 4
push ebx
xor ebx, ebx
cmp esi, ebx
mov word [ebp - 0xa], ax
mov word [ebp - 8], 0x3a
mov word [ebp - 6], bx
je 0x4ad0424b
push esi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
mov ebx, eax
mov ax, word [esi]
cmp ax, word [0x4ad33b8c]
jne 0x4ad0dd3e
add ebx, 2
cmp ebx, 0x208
ja 0x4ad1754c
mov ax, word [ebp - 0xa]
mov word [ebp - 0x624], ax
mov ax, word [ebp - 8]
mov word [ebp - 0x622], ax
lea eax, [ebp - 0x620]
push esi
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
xor ebx, ebx
pop ecx
pop ecx
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x214]
push eax
push 0x103
lea eax, [ebp - 0x624]
push eax
mov word [ebp - 0xe], bx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
je 0x4ad17589
mov eax, dword [ebp - 0x628]
cmp eax, ebx
je 0x4ad0dcca
cmp word [eax], bx
je 0x4ad0dcea
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 0x214]
push eax
call esi
cmp eax, 0xffffffff
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
je 0x4ad17591
cmp byte [0x4ad2fa64], 0
je 0x4ad04311
push ebx
lea eax, [ebp - 0x214]
push eax
call fcn.4ad04469
test eax, eax
je 0x4ad1754c
cmp dword [ebp + 0xc], 2
je 0x4ad04333
lea eax, [ebp - 0x214]
push eax
call esi
cmp eax, 0xffffffff
je 0x4ad175b4
test ax, 0x410
je 0x4ad175aa
cmp dword [ebp + 0xc], ebx
je 0x4ad0434b
cmp dword [ebp + 0xc], 1
jne 0x4ad04360
mov ax, word [ebp - 0x62c]
cmp ax, word [ebp - 0xa]
jne 0x4ad04360
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x4ad175c3
push 0x4ad2b0d0
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.4ad0158f
test eax, eax
jne 0x4ad175ca
push ebx
push str.C:Documents_and_SettingsPat
call fcn.4ad01550
xor eax, eax
pop ebx
pop edi
mov ecx, dword [ebp - 4]
pop esi
call fcn.4ad01305
leave
ret 8
Function at 0x4ad05046
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x28
push 0x4ad05168
call fcn.4ad0161a
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x4ad05159
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4ad05159
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
jne 0x4ad1903e
cmp dword [ecx + 0x74], 0xe
jbe 0x4ad05159
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x4ad2fa50], 0xffffffff
or dword [0x4ad2fa4c], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x4ad34878]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x4ad34874]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x4ad2fa54], eax
call fcn.4ad04fd0
cmp dword [0x4ad34868], edi
je 0x4ad19063
call fcn.4ad05184
push 0x4ad34860
push 0x4ad3485c
call sub.msvcrt.dll__initterm
mov eax, dword [0x4ad34870]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x4ad3486c]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x34], eax
push 0x4ad34858
push 0x4ad34850
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x20]
mov ecx, dword [sym.imp.msvcrt.dll___initenv]
mov dword [ecx], eax
push dword [ebp - 0x20]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.4ad03fdd
jmp 0x4ad19074
mov dword [ebp - 0x1c], edi
jmp 0x4ad0509e
cmp eax, 0x20b
jne 0x4ad05159
cmp dword [ecx + 0x84], 0xe
jbe 0x4ad05159
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x4ad05098
push fcn.4ad04fd0
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
jmp 0x4ad050f1
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x1c], edi
jne 0x4ad19088
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x4ad190c7
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.4ad01442
ret
Function at 0x4ad05494
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x4ad33b78]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
call fcn.4ad056e5
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push 8
mov ebx, 0x4ad34b40
push ebx
push 0x1e
push eax
mov dword [ebp - 0x108], eax
call esi
test eax, eax
mov edi, dword [sym.imp.msvcrt.dll_wcscpy]
je 0x4ad128d2
mov ebx, 0x80
push ebx
lea eax, [ebp - 0x104]
push eax
push 0x23
push dword [ebp - 0x108]
call esi
test eax, eax
je 0x4ad0550a
lea eax, [ebp - 0x104]
push 0x4ad056dc
push eax
call dword [sym.imp.msvcrt.dll_wcscmp]
pop ecx
pop ecx
mov dword [0x4ad2fa3c], eax
push 0x4ad056d8
push 0x4ad34900
call edi
push 0x4ad056d4
push 0x4ad348c0
call edi
and dword [0x4ad2ba00], 0
add esp, 0x10
push ebx
lea eax, [ebp - 0x104]
push eax
push 0x21
push dword [ebp - 0x108]
call esi
test eax, eax
push 2
pop ecx
je 0x4ad05566
movzx eax, word [ebp - 0x104]
sub eax, 0x30
jne 0x4ad128e1
and dword [0x4ad2ba00], 0
mov dword [0x4ad34b10], 0x4ad056c0
push ebx
lea eax, [ebp - 0x104]
push eax
push 0x24
push dword [ebp - 0x108]
mov dword [0x4ad2fa48], ecx
call esi
test eax, eax
je 0x4ad05596
cmp word [ebp - 0x104], 0x31
jne 0x4ad05596
mov dword [0x4ad2fa48], 4
push 8
mov ebx, 0x4ad34b30
push ebx
push 0x1d
push dword [ebp - 0x108]
call esi
test eax, eax
je 0x4ad12919
push 0x20
mov ebx, 0x4ad34ac0
push ebx
push 0x31
push dword [ebp - 0x108]
call esi
test eax, eax
je 0x4ad12928
push 0x20
mov ebx, 0x4ad34a80
push ebx
push 0x32
push dword [ebp - 0x108]
call esi
test eax, eax
je 0x4ad12937
push 0x20
mov ebx, 0x4ad34a40
push ebx
push 0x33
push dword [ebp - 0x108]
call esi
test eax, eax
je 0x4ad12946
push 0x20
mov ebx, 0x4ad34a00
push ebx
push 0x34
push dword [ebp - 0x108]
call esi
test eax, eax
je 0x4ad12955
push 0x20
mov ebx, 0x4ad349c0
push ebx
push 0x35
push dword [ebp - 0x108]
call esi
test eax, eax
je 0x4ad12964
push 0x20
mov ebx, 0x4ad34980
push ebx
push 0x36
push dword [ebp - 0x108]
call esi
test eax, eax
je 0x4ad12973
push 0x20
mov ebx, 0x4ad34940
push ebx
push 0x37
push dword [ebp - 0x108]
call esi
test eax, eax
je 0x4ad12982
push 8
mov ebx, 0x4ad34b20
push ebx
push 0xe
push dword [ebp - 0x108]
call esi
test eax, eax
je 0x4ad12991
push 8
mov ebx, 0x4ad34b00
push ebx
push 0xf
push dword [ebp - 0x108]
call esi
test eax, eax
je 0x4ad129a0
push 0x4ad056b8
push 0
call dword [sym.imp.msvcrt.dll_setlocale]
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.4ad01305
leave
ret
Function at 0x4ad06142
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [0x4ad2ba04], ebx
mov eax, dword [esi]
cmp eax, ebx
push edi
mov dword [ebp - 8], 0x4ad34b6c
je 0x4ad0d980
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
mov dword [ebp - 4], eax
push dword [esi]
call fcn.4ad01a79
mov edi, eax
cmp word [edi], 0x3a
je 0x4ad16d09
push 0x250
call fcn.4ad01758
mov dword [esi + 0x14], eax
movzx edi, word [edi]
xor eax, eax
mov ax, word [0x4ad33b8c]
cmp di, ax
mov dword [ebp + 8], edi
je 0x4ad0f80c
push eax
push dword [esi]
call fcn.4ad01a53
mov edi, eax
test edi, edi
je 0x4ad0d94f
inc edi
inc edi
mov ebx, dword [sym.imp.msvcrt.dll__wcsicmp]
push 0x4ad01a9c
push edi
call ebx
test eax, eax
pop ecx
pop ecx
je 0x4ad0f80c
push 0x4ad01a94
push edi
call ebx
test eax, eax
pop ecx
pop ecx
je 0x4ad0f80c
cmp dword [0x4ad2fa60], 4
jne 0x4ad0620b
cmp dword [0x4ad33b44], 1
je 0x4ad0620b
cmp dword [0x4ad33b48], 1
jne 0x4ad06233
and dword [0x4ad33b48], 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4ad062d6
and dword [0x4ad2ba04], 0
cmp ebx, 0xffffffff
je 0x4ad06233
test bl, 0x10
jne 0x4ad0f80c
mov edx, dword [esi]
xor ebx, ebx
inc ebx
xor edi, edi
mov ecx, edx
mov ax, word [ecx]
test ax, ax
je 0x4ad06258
cmp ax, word [0x4ad33b8c]
je 0x4ad062a7
cmp ax, 0x3a
je 0x4ad062ab
inc ecx
inc ecx
inc ebx
jmp 0x4ad0623c
test edi, edi
mov dword [esi + 8], edi
je 0x4ad0d976
cmp word [edi], ax
lea eax, [edi + 2]
je 0x4ad16dd9
mov dword [esi + 0xc], eax
push 0x2a
push edi
call fcn.4ad01323
test eax, eax
jne 0x4ad0c003
push 0x3f
push edi
call fcn.4ad01323
test eax, eax
jne 0x4ad0c003
push 0x2e
push edi
call fcn.4ad01323
mov dword [esi + 0x10], eax
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret 4
mov edi, ecx
jmp 0x4ad06253
cmp ebx, 2
jne 0x4ad06253
jmp 0x4ad062a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x4ad2ba04], eax
jmp 0x4ad06225
or dword [esi + 0x18], 8
mov dword [0x4ad33af0], 1
jmp 0x4ad06292
mov ax, word [0x4ad33b8c]
cmp word [ebp + 8], ax
je 0x4ad16dcd
push dword [esi]
call fcn.4ad0f881
test al, al
jne 0x4ad0f86e
mov edi, dword [ebp - 4]
lea edi, [edi + edi + 0xa]
push edi
call fcn.4ad01758
test eax, eax
je 0x4ad0d98c
mov eax, dword [esi]
test eax, eax
je 0x4ad0d98c
push eax
push edi
call fcn.4ad01758
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
test eax, eax
mov dword [esi], eax
je 0x4ad0f86e
cmp dword [ebp - 8], 0
je 0x4ad0f86e
push dword [ebp - 8]
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
pop ecx
pop ecx
mov eax, dword [esi + 0x14]
mov dword [eax], 0x10
jmp 0x4ad06233
Function at 0x4ad062eb
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4ad33b78]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x20
mov dword [ebp - 4], eax
call fcn.4ad01758
mov esi, eax
push esi
mov dword [esi], edi
call fcn.4ad06142
mov eax, dword [esi + 0x14]
mov ebx, dword [esi]
mov edi, dword [esi + 8]
push 0x208
mov dword [ebp - 0x210], eax
call fcn.4ad01758
push 0
push eax
mov dword [0x4ad33ae8], eax
call fcn.4ad01550
push 0x104
push ebx
lea eax, [ebp - 0x20c]
push eax
call fcn.4ad01aa5
test eax, eax
jne 0x4ad0640f
mov ax, word [0x4ad33b8c]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.4ad01a53
and word [eax + 2], 0
lea eax, [ebp - 0x20c]
push eax
push str.C:Documents_and_SettingsPat
call dword [sym.imp.msvcrt.dll_wcscpy]
test edi, edi
pop ecx
pop ecx
je 0x4ad063eb
mov ax, word [edi]
cmp ax, 0x3a
je 0x4ad063eb
cmp ax, word [0x4ad33b8c]
jne 0x4ad063b3
cmp edi, ebx
je 0x4ad0640b
push edi
push ebx
call fcn.4ad06419
mov ax, word [eax]
cmp ax, 0x3a
je 0x4ad0640b
cmp ax, word [0x4ad33b8c]
je 0x4ad0640b
mov ax, word [edi]
and word [edi], 0
push ebx
mov word [ebp - 0x214], ax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4ad16de0
and dword [0x4ad2ba04], 0
mov ax, word [ebp - 0x214]
mov word [edi], ax
cmp dword [0x4ad2ba04], 0
jne 0x4ad0640f
push esi
call fcn.4ad06142
mov eax, dword [ebp - 0x210]
mov dword [esi + 0x14], eax
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.4ad01305
leave
ret 4
inc edi
inc edi
jmp 0x4ad063b3
xor eax, eax
inc eax
jmp 0x4ad063fc

Function at 0x4ad064bd
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
push dword [ebp + 8]
mov dword [ebp - 8], esi
call dword [sym.imp.msvcrt.dll__get_osfhandle]
xor ebx, ebx
cmp byte [0x4ad34b74], bl
pop ecx
mov dword [ebp + 8], eax
jne 0x4ad15df1
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp + 0xc], eax
mov edi, 0x4ad290a0
mov esi, 0x2000
cmp dword [ebp + 0x10], esi
ja 0x4ad15e05
cmp dword [ebp + 0x10], ebx
je 0x4ad0654a
push ebx
push ebx
push esi
push edi
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push dword [0x4ad2b9ec]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
mov ebx, dword [ebp + 0x14]
mov esi, eax
push ebx
dec esi
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4ad06546
cmp dword [ebx], esi
jne 0x4ad06546
mov eax, dword [ebp - 8]
mov dword [ebx], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0x10
xor eax, eax
jmp 0x4ad0653f
mov ebx, dword [ebp + 0x14]
jmp 0x4ad06537
Function at 0x4ad071e5
Capabilities:
Manipulate console buffer
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileType]
and eax, 0xffff7fff
cmp eax, 2
je 0x4ad10d3d
pop ebp
jmp fcn.4ad069c3
pop ebp
jmp fcn.4ad0ef42