joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46cb4b
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
mov esi, edx
mov ebx, ecx
mov edx, dword [ebp + 8]
push edi
test edx, edx
je 0x46cc9b
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x46cc9b
xor eax, eax
test esi, esi
je 0x46cb7c
cmp dword [esi + 4], eax
jne 0x46cb86
cmp dword [esi + 0xc], eax
je 0x46cbbe
cmp dword [esi + 4], eax
je 0x46cba1
push ecx
push edx
mov edx, esi
mov ecx, ebx
call fcn.0046cce9
pop ecx
pop ecx
test eax, eax
jne 0x46cc9d
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
cmp dword [esi + 0xc], 0
je 0x46cc9d
push ecx
push edx
lea edx, [esi + 8]
mov ecx, ebx
call fcn.0046cce9
pop ecx
pop ecx
jmp 0x46cc9d
push 0x103
push eax
mov byte [ebp - 0x10c], al
lea eax, [ebp - 0x10b]
push eax
call fcn.0042a910
add esp, 0xc
lea edx, [ebp - 0x10c]
push str.theme_
push 0x104
call fcn.00463088
mov edx, ebx
mov esi, ebx
mov al, byte [edx]
inc edx
test al, al
jne 0x46cbf2
lea edi, [ebp - 0x10c]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x46cc02
mov ecx, edx
xor eax, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push eax
push eax
push 3
push eax
push 1
mov ecx, edx
lea eax, [ebp - 0x10c]
and ecx, 3
push SysReAllocStringLen
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x46cca4
push str.data_
push 0x104
lea edx, [ebp - 0x10c]
call fcn.00463088
mov esi, ebx
mov al, byte [ebx]
inc ebx
test al, al
jne 0x46cc52
lea edi, [ebp - 0x10c]
sub ebx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x46cc62
mov ecx, ebx
lea eax, [ebp - 0x10c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 1
and ecx, 3
push SysReAllocStringLen
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x46cca6
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor ebx, ebx
push ebx
push eax
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, dword [ebp + 0xc]
mov dword [esi], eax
inc eax
push eax
call fcn.0040627a
mov edi, dword [ebp + 8]
pop ecx
push ebx
mov ebx, dword [ebp - 4]
lea ecx, [ebp - 8]
push ecx
mov dword [edi], eax
push dword [esi]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [edi]
mov ecx, dword [esi]
push ebx
mov byte [edx + ecx], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
jmp 0x46cc9d
Function at 0x46e98b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
push ebx
mov eax, ecx
mov dword [ebp - 0xc], edx
push esi
xor ebx, ebx
mov dword [ebp - 8], eax
push 0x103
mov dword [eax], ebx
lea eax, [ebp - 0x133]
push ebx
push eax
mov dword [edx], ebx
mov byte [ebp - 0x134], bl
call fcn.0042a910
add esp, 0xc
lea eax, [ebp - 0x134]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push ebx
push ebx
push 3
push ebx
push 5
push SysReAllocStringLen
lea eax, [ebp - 0x134]
mov dword [ebp - 4], ebx
push eax
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x46e9ff
xor eax, eax
jmp 0x46eb4a
push edi
push ebx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0x3c
push esi
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 4]
push 0
push eax
push 4
lea eax, [ebp - 0x14]
push eax
push esi
call edi
push 0
push 0
push dword [ebp - 0x14]
push esi
call ebx
push 0
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp - 0x20]
push eax
push esi
call edi
cmp dword [ebp - 0x20], 0x4550
jne 0x46eb38
mov edi, dword [ebp - 0x14]
xor eax, eax
push eax
push eax
add edi, 0x18
mov dword [ebp - 0x10], eax
push edi
push esi
call ebx
push 0
lea eax, [ebp - 4]
push eax
push 2
lea eax, [ebp - 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, 0x10b
cmp word [ebp - 0x10], ax
jne 0x46ea7c
sub edi, 0xffffff80
jmp 0x46ea91
mov eax, 0x20b
cmp word [ebp - 0x10], ax
jne 0x46ea8f
add edi, 0x90
jmp 0x46ea91
xor edi, edi
test edi, edi
je 0x46eb38
push 0
push 0
push edi
push esi
call ebx
push 0
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor ecx, ecx
lea edi, [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x30], ecx
stosd dword es:[edi], eax
mov dword [ebp - 0x18], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0x1c]
test edi, edi
je 0x46eb38
push ecx
push ecx
lea eax, [edi - 0x10]
push eax
push esi
call ebx
push 0
lea eax, [ebp - 0x18]
push eax
push 0x10
lea eax, [ebp - 0x30]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x30], 0
jne 0x46eb38
cmp dword [ebp - 0x2c], 0
jne 0x46eb38
cmp dword [ebp - 0x28], 0
jne 0x46eb38
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x46eb38
mov ecx, dword [ebp - 0xc]
push eax
mov dword [ecx], eax
call fcn.0040627a
pop ecx
mov ecx, dword [ebp - 8]
push 0
push 0
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
sub edi, dword [eax]
sub edi, 0x10
push edi
push esi
call ebx
push 0
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0xc]
push dword [eax]
mov eax, dword [ebp - 8]
push dword [eax]
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
xor eax, eax
pop edi
cmp dword [ecx], eax
setne al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46ed84
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 4]
xor edi, edi
push eax
push 0x2001f
push edi
push ecx
mov esi, edx
push SysReAllocStringLen
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, dword [ebp + 0xc]
test eax, eax
jne 0x46edee
push ebx
push edi
push dword [ebp + 8]
push edi
push esi
push dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call esi
mov eax, dword [ebx]
inc eax
push eax
call fcn.0040627a
pop ecx
push ebx
mov edi, eax
push edi
push dword [ebp + 8]
push 0
push dword [ebp - 8]
push dword [ebp - 4]
call esi
test eax, eax
je 0x46edee
test edi, edi
je 0x46edec
push edi
call fcn.00406283
pop ecx
xor edi, edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 0x10], 0
je 0x46ee10
test edi, edi
je 0x46ee1a
push dword [ebx]
mov edx, edi
mov ecx, 0x4a5390
call fcn.0045ab1e
pop ecx
test edi, edi
je 0x46ee1a
mov eax, dword [ebx]
mov byte [edi + eax], 0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46ee23
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0x14], 0
push ebx
push esi
push edi
mov esi, edx
mov edi, ecx
je 0x46ee45
push dword [ebp + 0x10]
mov edx, dword [ebp + 8]
mov ecx, 0x4a5390
call fcn.0045ab1e
pop ecx
xor ebx, ebx
lea eax, [ebp + 0x14]
push ebx
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push edi
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x46ee79
push dword [ebp + 0x10]
push dword [ebp + 8]
push dword [ebp + 0xc]
push ebx
push esi
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x46f38d
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push edi
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4a8624
push eax
mov dword [0x4ca9d8], eax
call edi
push str.user32
mov dword [0x4ca9e4], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.SetWindowTextW
push eax
mov dword [0x4ca9e0], eax
call edi
push str.GetWindowTextW
push dword [0x4ca9e0]
mov dword [0x4ca9d0], eax
call edi
cmp dword [0x4ca9e4], 0
mov dword [0x4ca9c8], eax
pop edi
je 0x46f403
cmp dword [0x4ca9d0], 0
mov byte [0x4ca9c7], 1
jne 0x46f40a
mov byte [0x4ca9c7], 0
push 0x90
lea eax, [ebp - 0x90]
mov dword [ebp - 0x94], 0x94
push 0
push eax
call fcn.0042a910
add esp, 0xc
lea eax, [ebp - 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x90], 5
sbb al, al
inc al
mov byte [0x4ca9c7], al
mov esp, ebp
pop ebp
ret
Function at 0x4704c1
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
mov esi, dword [0x4ca9e8]
push edi
mov edi, ecx
cmp byte [esi + 0xac8f], 0
je 0x4705dd
lea edx, [esi + 0xac90]
test edx, edx
je 0x4705dd
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x4704f3
sub edx, ecx
je 0x4705dd
lea ecx, [esi + 0xb594]
test ecx, ecx
je 0x4705dd
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x470513
sub ecx, edx
je 0x4705dd
lea edx, [esi + 0xb698]
mov ecx, SysReAllocStringLen
call fcn.0046f564
test al, al
jne 0x4705dd
mov edx, dword [0x4ca9e8]
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
lea edx, [edx + 0xb698]
call fcn.0046f564
test al, al
jne 0x4705dd
call fcn.0046c705
xor ebx, ebx
mov esi, eax
push 0x103
lea eax, [ebp - 0x10f]
mov byte [ebp - 0x110], bl
push ebx
push eax
call fcn.0042a910
mov ecx, dword [0x4ca9e8]
lea eax, [ebp - 8]
add esp, 0xc
mov dword [ebp - 4], ebx
lea edx, [ebp - 0x110]
mov dword [ebp - 8], ebx
push ecx
push fcn.0046cde8
push eax
lea eax, [ebp - 4]
add ecx, 0xb490
push eax
push 0x104
call fcn.0046cd5e
add esp, 0x14
test esi, esi
je 0x4705d6
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4705b8
sub ecx, edx
je 0x4705d6
push 5
push ebx
lea eax, [ebp - 0x110]
push eax
push esi
push ebx
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push esi
call fcn.00406283
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x470dd1
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea edx, [ecx + 4]
push str.mupdb
lea ecx, [ebp - 0x18]
call fcn.00408ef6
cmp dword [ebp - 4], 0x10
lea eax, [ebp - 0x18]
pop ecx
cmovae eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x470e12
cmp dword [ebp - 4], 0x10
lea eax, [ebp - 0x18]
push 0
cmovae eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0
push 1
lea ecx, [ebp - 0x18]
call fcn.00408760
mov esp, ebp
pop ebp
ret
Function at 0x473fca
Capabilities:
Print debug messages

Disassembly:
push ebx
push esi
push edi
xor eax, eax
xor ebx, ebx
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
inc ebx
mov edi, ecx
push ebx
call fcn.00487a12
push str.BIGV_in_the_house
mov dword [edi], 0x4a8ac0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov esi, dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
xor eax, eax
push eax
push ebx
push ebx
push eax
mov byte [edi + 0x2bc], bl
mov dword [edi + 0x2b0], eax
mov dword [edi + 0x2b4], eax
call esi
push 0
push ebx
push ebx
push 0
mov dword [edi + 0x2b8], eax
call esi
mov dword [edi + 0x284], eax
xor eax, eax
push eax
push ebx
push ebx
push eax
mov dword [edi + 0x18], 2
mov dword [edi + 0x254], eax
mov dword [edi + 0x258], eax
mov dword [edi + 0x25c], eax
mov dword [edi + 0x260], eax
mov dword [edi + 0x264], eax
mov dword [edi + 0x268], eax
mov dword [edi + 0x26c], eax
mov dword [edi + 0x270], eax
mov dword [edi + 0x274], eax
mov dword [edi + 0x278], eax
mov dword [edi + 0x27c], eax
mov dword [edi + 0x280], eax
mov dword [edi + 0x288], eax
mov byte [edi + 0x250], al
mov dword [edi + 0x290], eax
mov dword [edi + 0x294], eax
mov dword [edi + 0x298], eax
call esi
mov dword [edi + 0x2a0], eax
xor eax, eax
mov byte [edi + 0x29c], al
mov byte [edi + 0x251], al
mov byte [edi + 0x28c], al
mov dword [edi + 0x2a4], eax
mov dword [edi + 0x2a8], eax
mov dword [edi + 0x2ac], eax
mov eax, edi
pop edi
pop esi
pop ebx
ret 0x40
Function at 0x4769cf
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
xor eax, eax
mov dword [ebp - 0x10], 1
push ebx
mov dword [ebp - 8], eax
lea eax, [ebp - 0x44]
push esi
push eax
push dword [ebp + 8]
call fcn.00426710
pop ecx
pop ecx
test eax, eax
jne 0x476a24
push 0x4a6bf0
push dword [ebp + 8]
call fcn.004260ba
mov dword [ebp - 0xc], eax
pop ecx
pop ecx
test eax, eax
jne 0x476a2e
push dword [ebp + 8]
push str.ERROR:_Unable_to_open__s_for_reading_n
call fcn.00425f47
mov eax, dword [ebp + 0x10]
pop ecx
pop ecx
test eax, eax
je 0x476a24
and dword [eax], 0
xor al, al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov esi, dword [ebp - 0x30]
lea eax, [esi + 1]
push eax
call fcn.004249e8
mov ebx, eax
mov eax, dword [ebp + 0xc]
pop ecx
mov dword [eax], ebx
test ebx, ebx
je 0x476a24
mov eax, dword [ebp + 0x10]
mov byte [ebx + esi], 0
mov esi, dword [ebp - 0x30]
test eax, eax
je 0x476a56
mov dword [eax], esi
test esi, esi
je 0x476ac2
mov eax, dword [ebp - 8]
mov ecx, 0x8000
push dword [ebp - 0xc]
sub esi, eax
cmp esi, ecx
cmova esi, ecx
push esi
push 1
push ebx
call fcn.00426294
mov ecx, eax
add esp, 0x10
mov eax, dword [ebp - 8]
cmp ecx, esi
jne 0x476a96
mov esi, dword [ebp - 0x30]
add eax, ecx
add ebx, ecx
mov dword [ebp - 8], eax
mov ecx, 0x8000
cmp eax, esi
jb 0x476a62
jmp 0x476ac2
push dword [ebp + 8]
push eax
push esi
push str.Unable_to_read__li_bytes_at_offset__li_from_file__s_n
call fcn.00425f47
mov ebx, dword [ebp + 0xc]
push dword [ebx]
call fcn.004249b0
mov eax, dword [ebp + 0x10]
xor ecx, ecx
add esp, 0x14
mov dword [ebx], ecx
test eax, eax
je 0x476abf
mov dword [eax], ecx
mov byte [ebp - 0x10], cl
push dword [ebp - 0xc]
call fcn.00426699
mov al, byte [ebp - 0x10]
pop ecx
jmp 0x476a26
Function at 0x47701e
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18c
push ebx
push esi
push edi
lea eax, [ebp - 0x48]
mov esi, ecx
push eax
push dword [ebp + 0xc]
mov dword [ebp - 8], esi
call fcn.00426710
pop ecx
pop ecx
test eax, eax
jne 0x4771a5
push 0x200
call fcn.004249e8
mov ebx, dword [ebp + 0x14]
pop ecx
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x47705d
sub ecx, edx
lea eax, [ecx + 1]
mov ecx, esi
push eax
push dword [ebp + 0xc]
call fcn.00476e6d
mov edx, eax
mov dword [ebp - 0x10], edx
lea edi, [edx - 1]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x47707c
mov ax, word [0x4a5edc]
mov esi, ebx
mov word [edi], ax
mov al, byte [ebx]
inc ebx
test al, al
jne 0x47708f
sub ebx, esi
lea edi, [edx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x47709b
mov ecx, ebx
lea eax, [ebp - 0x188]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
mov dword [ebp - 0xc], esi
cmp esi, 0xffffffff
je 0x477192
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0x200
mov dword [ebp + 0x14], 0x80
lea ecx, [ebp - 0x15c]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4770e7
sub ecx, edx
lea eax, [ecx + 1]
mov ecx, dword [ebp - 8]
push eax
push dword [ebp + 0xc]
call fcn.00476e6d
mov esi, eax
mov dword [ebp - 0x14], esi
lea edi, [esi - 1]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x477107
mov ax, word [0x4a5edc]
lea edx, [ebp - 0x15c]
mov ecx, edx
mov word [edi], ax
mov dword [ebp + 8], ecx
mov al, byte [edx]
inc edx
test al, al
jne 0x477123
sub edx, ecx
lea edi, [esi - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x47712f
mov esi, dword [ebp + 8]
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
cmp esi, 2
jae 0x477172
sub esi, 0xffffff80
mov dword [ebp + 0x14], esi
mov esi, dword [ebp - 4]
add esi, 0x200
push esi
push dword [ebx]
mov dword [ebp - 4], esi
call fcn.00424a7a
pop ecx
pop ecx
test eax, eax
je 0x4771b0
mov dword [ebx], eax
mov eax, dword [ebx]
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebp - 0xc]
mov dword [eax], ecx
lea eax, [ebp - 0x188]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4770de
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x10]
push eax
call fcn.00476d99
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ebx], 0
je 0x4771bd
push dword [ebx]
call fcn.004249b0
pop ecx
and dword [ebx], 0
jmp 0x4771a5
Function at 0x47acf0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x40
pop eax
cmp ebx, eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], ecx
cmova ebx, eax
xor esi, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
cmp dword [ebp + 0xc], esi
je 0x47ad6a
mov ecx, dword [0x4ca9ec]
call fcn.0047acbd
mov ecx, dword [ebp + 0xc]
lea eax, [esp + 0xc]
push esi
push 1
push eax
lea eax, [esp + 0x20]
push eax
lea edx, [esp + 0x20]
call fcn.0047a77a
mov ecx, dword [0x4ca9ec]
add esp, 0x10
test al, al
je 0x47ae18
call fcn.0047ac30
mov esi, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
jmp 0x47ad79
mov eax, dword [0x4ca9ec]
mov esi, 0x4cb020
mov edi, 0x4caf20
mov dword [esp + 0xc], eax
jmp 0x47ad87
mov ecx, dword [ebp + 0xc]
call fcn.0047aa64
cmp dword [esi], ebx
jae 0x47ad7f
mov ecx, dword [esp + 0xc]
call fcn.0047acbd
mov ebx, dword [esp + 0x1c]
xor eax, eax
push eax
push 4
push ebx
push dword [esp + 0x24]
push eax
push eax
call fcn.00427ad7
mov ecx, dword [esi]
add esp, 0x18
and dword [esp + 0x14], 0
mov dword [edi + ecx*4], eax
mov eax, dword [esi]
cmp dword [edi + eax*4], 0xffffffff
jne 0x47aded
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
push eax
push 4
push ebx
push dword [esp + 0x24]
push eax
push eax
call fcn.00427ad7
mov ecx, dword [esi]
add esp, 0x18
mov dword [edi + ecx*4], eax
mov ecx, dword [esp + 0x14]
inc ecx
mov dword [esp + 0x14], ecx
cmp ecx, 5
jl 0x47adb6
mov ecx, dword [esi]
mov ebx, dword [esp + 0xc]
cmp dword [edi + ecx*4], 0xffffffff
jne 0x47ae01
dec ecx
or eax, 0xffffffff
mov dword [esi], ecx
jmp 0x47ae1f
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esi]
push dword [edi + eax*4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
inc dword [esi]
mov ecx, ebx
call fcn.0047ac30
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47e522
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x84
push esi
push edi
push eax
push 0
push dword [eax + 0x20]
lea eax, [ebp - 0x84]
mov esi, ecx
push str.size:__llu__hash:__s
push eax
call fcn.00424b65
lea ecx, [ebp - 0x84]
add esp, 0x14
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x47e555
sub ecx, edx
mov edi, 0x80
cmp ecx, edi
jae 0x47e57f
mov eax, edi
sub eax, ecx
push eax
lea eax, [ebp - 0x84]
add eax, ecx
push 0
push eax
call fcn.0042a910
add esp, 0xc
push esi
push edi
lea eax, [ebp - 0x84]
push 1
push eax
call fcn.004265ab
add esp, 0x10
cmp eax, edi
je 0x47e59a
xor al, al
jmp 0x47e5a3
push esi
call fcn.00428010
pop ecx
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x47e5b4
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x244
push ebx
mov ebx, ecx
push esi
mov esi, ebx
push edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x47e5ca
sub esi, ecx
cmp esi, 0x104
jae 0x47e7cd
test dl, dl
je 0x47e5fe
push ecx
push ecx
lea edx, [esp + 0x150]
mov ecx, ebx
call fcn.0047e826
pop ecx
pop ecx
lea edi, [esp + 0x148]
jmp 0x47e600
mov edi, ebx
lea eax, [esp + 0x10]
push eax
push edi
call fcn.00426710
pop ecx
pop ecx
test eax, eax
jne 0x47e629
test dword [esp + 0x16], 0x4000
je 0x47e629
mov ecx, ebx
call fcn.0047e7d6
mov al, 1
jmp 0x47e7cf
lea edx, [esp + 0x40]
mov ecx, edi
sub edx, edi
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x47e631
lea eax, [esp + 0x40]
push 0x5c
push eax
call fcn.00425160
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x47e758
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x47e658
sub ecx, edx
cmp ecx, 3
jbe 0x47e69a
cmp byte [esi + 1], 0x5c
jne 0x47e69a
lea eax, [esi + 2]
push 0x5c
push eax
call fcn.00425160
pop ecx
pop ecx
test eax, eax
je 0x47e758
inc eax
push 0x5c
push eax
call fcn.00425160
pop ecx
pop ecx
test eax, eax
je 0x47e758
inc eax
jmp 0x47e744
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x47e69f
sub ecx, edx
lea edx, [esp + 0x40]
lea ebx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x47e6af
sub edx, ebx
cmp ecx, edx
je 0x47e750
mov al, byte [esi - 1]
cmp al, 0x3a
je 0x47e741
cmp al, 0x5c
jne 0x47e750
jmp 0x47e741
lea ecx, [esp + 0x40]
mov byte [esi], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x47e6db
sub ecx, edx
je 0x47e73e
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x44]
push eax
call fcn.00426710
pop ecx
pop ecx
test eax, eax
jne 0x47e726
test dword [esp + 0x16], 0x4000
jne 0x47e73e
lea eax, [esp + 0x40]
push eax
push edi
push str.Cant_create_dir__s:_non_dir__s_in_the_way
call fcn.00425e56
add eax, 0x40
push eax
call fcn.00426340
add esp, 0x10
jmp 0x47e7cd
lea eax, [esp + 0x40]
push eax
call fcn.00428242
pop ecx
test eax, eax
jne 0x47e771
lea ecx, [esp + 0x40]
call fcn.0047e7d6
mov byte [esi], 0x5c
lea eax, [esi + 1]
push 0x5c
push eax
call fcn.00425160
pop ecx
mov esi, eax
pop ecx
test esi, esi
jne 0x47e6d1
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push edi
call esi
cmp eax, 0xffffffff
je 0x47e791
test al, 0x10
je 0x47e791
mov ecx, edi
jmp 0x47e61d
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x47e785
test al, 0x10
jne 0x47e7cd
lea eax, [esp + 0x40]
push eax
push str.Cant_create_dir__s:_mkdir_fails
jmp 0x47e7bc
push edi
call fcn.00428242
pop ecx
test eax, eax
je 0x47e76a
push edi
call esi
cmp eax, 0xffffffff
je 0x47e7b6
test al, 0x10
je 0x47e7b6
mov ecx, edi
call fcn.0047e7d6
test al, al
setne al
jmp 0x47e7cf
push edi
push str.Unable_to_create_dir__s
call fcn.00425e56
add eax, 0x40
push eax
call fcn.00426340
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x481283
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
lea eax, [ebp - 0x80]
push esi
push dword [ebp + 8]
mov esi, 0x80
push esi
push 1
push eax
call fcn.00426294
add esp, 0x10
cmp eax, esi
je 0x4812af
xor al, al
jmp 0x481369
lea ecx, [ebp - 0x80]
mov byte [ebp - 1], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4812b9
sub ecx, edx
jmp 0x4812cc
cmp byte [ebp + ecx - 0x80], 0
jne 0x4812a8
inc ecx
cmp ecx, esi
jb 0x4812c4
lea eax, [ebp - 0x100]
push eax
push str.size
lea eax, [ebp - 0x80]
push eax
call fcn.004811e8
test al, al
je 0x4812a8
lea eax, [ebp - 0x100]
push ebx
push eax
call fcn.004257b5
pop ecx
mov ebx, eax
lea eax, [ebp - 0x100]
push eax
push str.hash
lea eax, [ebp - 0x80]
push eax
call fcn.004811e8
test al, al
je 0x481329
lea ecx, [ebp - 0x100]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x48131b
sub ecx, edx
cmp ecx, 0x20
jb 0x48132d
xor al, al
jmp 0x481368
push 0x24
call fcn.0042493a
mov edx, eax
pop ecx
test edx, edx
je 0x481344
and dword [edx + 0x20], 0
mov byte [edx], 0
jmp 0x481346
xor edx, edx
mov eax, dword [ebp + 0xc]
lea esi, [ebp - 0x100]
push edi
mov edi, edx
mov dword [eax], edx
mov eax, esi
sub edi, eax
mov cl, byte [esi]
mov byte [edi + esi], cl
inc esi
test cl, cl
jne 0x481358
mov dword [edx + 0x20], ebx
mov al, 1
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 8