joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ef60
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x540b42
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x594aa4]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, dword [esp + 0x28]
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [edi], 0x57dcb0
mov dword [edi + 0x58], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
lea esi, [edi + 8]
push esi
mov dword [esp + 0x24], ebx
push edi
mov dword [esp + 0x1c], 1
call fcn.0040fe90
mov dword [esp + 0x20], 1
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push esi
mov dword [edi + ecx], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
call fcn.004109d0
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x48], bl
mov byte [esi + 0x41], bl
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ebx
mov eax, dword [esi + 0x24]
mov dword [eax], ebx
mov ecx, dword [esi + 0x34]
mov dword [ecx], ebx
mov edx, dword [esi + 0x10]
mov dword [edx], ebx
mov eax, dword [esi + 0x20]
mov edx, dword [0x5abd44]
mov dword [eax], ebx
mov ecx, dword [esi + 0x30]
mov dword [ecx], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x44], edx
mov dword [esi + 0x3c], ebx
mov eax, dword [esp + 0x2c]
push eax
mov byte [esp + 0x24], 2
call fcn.00410370
test eax, eax
jne 0x40f057
mov ecx, dword [edi]
mov ecx, dword [ecx + 4]
mov eax, dword [ecx + edi + 8]
add ecx, edi
or eax, 2
cmp dword [ecx + 0x28], ebx
jne 0x40f050
or eax, 4
push ebx
push eax
call fcn.00401cd0
mov eax, edi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 8
Function at 0x4109d0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x53e5fb
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x594aa4]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0047f117
push 4
mov dword [esp + 0x20], 0
call fcn.00446843
mov edi, eax
add esp, 4
test edi, edi
je 0x410a4e
call fcn.0047ef21
mov dword [edi], eax
call fcn.0047ed4f
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.0047ec73
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x410a43
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.0047ec9b
jmp 0x410a50
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4

Function at 0x411070
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x542273
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x594aa4]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov eax, 7
xor edi, edi
xor ecx, ecx
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], edi
mov word [esi + 4], cx
mov dword [esp + 0x14], edi
xor edx, edx
mov dword [esi + 0x34], eax
mov dword [esi + 0x30], edi
mov word [esi + 0x20], dx
mov byte [esp + 0x14], 1
push 4
mov dword [esi + 0x5c], edi
call fcn.00446843
add esp, 4
cmp eax, edi
je 0x4110d3
mov dword [eax], edi
jmp 0x4110d5
xor eax, eax
push 0xc
mov dword [esi + 0x60], eax
call fcn.00446843
add esp, 4
cmp eax, edi
je 0x4110f0
mov dword [eax + 8], edi
mov dword [eax + 4], edi
mov dword [eax], edi
jmp 0x4110f2
xor eax, eax
xor edx, edx
mov ecx, esi
mov dword [esi + 0x64], eax
mov dword [esi + 0x58], edi
call fcn.00418e30
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x415c10
Capabilities:
Set registry value

Disassembly:
cmp dword [eax + 0x18], 8
mov edx, dword [eax + 0x14]
jb 0x415c1e
mov eax, dword [eax + 4]
jmp 0x415c21
add eax, 4
cmp dword [ecx + 0x18], 8
jb 0x415c2c
mov ecx, dword [ecx + 4]
jmp 0x415c2f
add ecx, 4
lea edx, [edx + edx + 2]
push edx
push eax
mov eax, dword [esp + 0xc]
push 1
push 0
push ecx
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x415c57
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor al, al
ret 4
mov al, 1
ret 4

Function at 0x415c60
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x53f5a2
mov eax, dword fs:[0]
push eax
mov eax, 0x1014
call fcn.00481a50
mov eax, dword [0x594aa4]
xor eax, esp
mov dword [esp + 0x1010], eax
push edi
mov eax, dword [0x594aa4]
xor eax, esp
push eax
lea eax, [esp + 0x101c]
mov dword fs:[0], eax
mov dword [esp + 8], 0
xor eax, eax
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], 0
mov dword [esp + 0x10], esi
mov edi, ecx
mov word [esi + 4], ax
push 0x1000
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x102c], eax
push ecx
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], 0x1000
call fcn.004804c0
add esp, 0xc
cmp dword [edi + 0x18], 8
jb 0x415cf3
mov edi, dword [edi + 4]
jmp 0x415cf6
add edi, 4
lea edx, [esp + 0xc]
push edx
mov edx, dword [ebx + 4]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x18]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x415d20
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
call fcn.00408820
mov eax, esi
mov ecx, dword [esp + 0x101c]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x1010]
xor ecx, esp
call fcn.0047ff9f
add esp, 0x1020
ret
Function at 0x415d70
Capabilities:
Query or enumerate registry key

Disassembly:
push 0xffffffffffffffff
push 0x53febb
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x594aa4]
xor eax, esp
mov dword [esp + 0x224], eax
push ebp
push esi
push edi
mov eax, dword [0x594aa4]
xor eax, esp
push eax
lea eax, [esp + 0x23c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x24c]
xor edi, edi
xor esi, esi
push 0x200
lea eax, [esp + 0x38]
push edi
push eax
mov dword [esp + 0x20], 0x200
call fcn.004804c0
mov eax, dword [ebp + 4]
add esp, 0xc
push edi
push edi
push edi
push edi
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x48]
push edx
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, edi
jne 0x415e59
xor ecx, ecx
lea eax, [esp + 0x34]
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], edi
mov word [esp + 0x1c], cx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x415e07
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x38]
push edx
lea ecx, [esp + 0x20]
call fcn.00408820
lea eax, [esp + 0x18]
push eax
mov ecx, ebx
mov dword [esp + 0x248], edi
call fcn.00405f30
mov dword [esp + 0x244], 0xffffffff
cmp dword [esp + 0x30], 8
jb 0x415e60
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.0044687d
add esp, 4
jmp 0x415e60
cmp eax, 0x103
je 0x415e6d
inc esi
cmp esi, 0x400
jl 0x415db5
mov ecx, dword [esp + 0x23c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.0047ff9f
add esp, 0x238
ret 4
Function at 0x4178a0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov esi, eax
mov eax, dword [esi]
mov ecx, dword [esi + 8]
push eax
push 1
push ecx
push edi
call fcn.00485f76
mov ecx, dword [esi + 8]
add esp, 0x10
cmp eax, 1
mov eax, ecx
sete bl
cdq
idiv dword [esi + 0x18]
mov byte [esp + 0x12], bl
mov dword [esi + 0x1c], eax
test bl, bl
je 0x417a19
add dword [esi + 0x14], ecx
cmp dword [esi + 0x54], 8
push 0xffffffffffffffff
push eax
push 0x18
push ecx
mov ecx, esp
jb 0x4178f3
mov eax, dword [esi + 0x40]
jmp 0x4178f6
lea eax, [esi + 0x40]
mov dword [ecx], eax
push ecx
mov eax, esp
mov dword [eax], str.read
lea eax, [esi + 0x20]
push eax
mov dword [esp + 0x2c], eax
call fcn.004160d0
mov ecx, dword [esi + 0x18]
mov ebx, dword [esi + 0x1c]
add esp, 0x18
xor ebp, ebp
xor eax, eax
cmp ecx, 1
sete byte [esp + 0x13]
test ebx, ebx
je 0x4179b4
xor edx, edx
dec ebx
cmp byte [esp + 0x13], dl
je 0x417938
cmp byte [edi], dl
jmp 0x41793c
cmp word [edi], 0
sete dl
test edx, edx
je 0x417966
test eax, eax
je 0x41795f
cmp edi, eax
je 0x41795f
imul ecx, ebp
mov edx, edi
sub edx, eax
push edx
push eax
sub eax, ecx
push eax
call fcn.004853f0
add esp, 0xc
mov ecx, dword [esi + 0x18]
lea eax, [ecx + edi]
inc ebp
add edi, ecx
test ebx, ebx
jne 0x41792b
test eax, eax
je 0x417989
cmp edi, eax
je 0x417989
mov ecx, dword [esi + 0x18]
imul ecx, ebp
sub edi, eax
push edi
push eax
sub eax, ecx
push eax
call fcn.004853f0
add esp, 0xc
test ebp, ebp
je 0x4179b4
mov edx, dword [esp + 0x14]
push 0xffffffffffffffff
push ebp
push 1
push ecx
mov eax, esp
push ecx
mov dword [eax], 0
mov eax, esp
push edx
mov dword [eax], str.nulls_removed
call fcn.004160d0
add esp, 0x18
sub dword [esi + 0x1c], ebp
cmp dword [esi + 0x18], 1
jle 0x417a0b
test byte [esi + 4], 0x80
je 0x417a0b
mov esi, dword [esi + 0x1c]
test esi, esi
je 0x4179e6
jmp 0x4179d0
mov ecx, dword [esp + 0x1c]
movzx eax, word [ecx + esi*2 - 2]
dec esi
rol ax, 8
mov word [ecx + esi*2], ax
test esi, esi
jne 0x4179d0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push ecx
mov eax, esp
mov dword [eax], 0
push ecx
mov eax, esp
mov dword [eax], str.endian_swap
mov eax, dword [esp + 0x28]
push eax
call fcn.004160d0
add esp, 0x18
mov al, byte [esp + 0x12]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
push esi
call fcn.004172e0
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 8
ret 4
Function at 0x417f20
Capabilities:
Write file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, eax
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
imul ecx, eax
push edi
mov dword [esi + 8], ecx
test ebp, ebp
jne 0x417f3c
mov ebp, edx
mov ecx, dword [esi + 4]
xor edi, edi
test cl, cl
jns 0x417fb6
test edx, edx
jne 0x417f75
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00446872
mov edi, eax
mov eax, dword [esi + 0x1c]
add eax, eax
push eax
push ebp
push edi
call fcn.00481e40
add esp, 0x10
mov edx, edi
mov ebp, edi
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x417f92
lea esp, [esp]
movzx ecx, word [edx + eax*2 - 2]
dec eax
rol cx, 8
mov word [edx + eax*2], cx
test eax, eax
jne 0x417f80
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push ecx
mov eax, esp
push ecx
mov dword [eax], 0
mov eax, esp
lea ecx, [esi + 0x20]
push ecx
mov dword [eax], str.endian_swap
call fcn.004160d0
add esp, 0x18
mov edx, dword [esi]
mov eax, dword [esi + 8]
push edx
push 1
push eax
push ebp
call fcn.0048030d
add esp, 0x10
cmp eax, 1
sete bl
test edi, edi
je 0x417fdb
push edi
call fcn.0044687d
add esp, 4
test bl, bl
je 0x41801e
mov edx, dword [esi + 0x1c]
mov ecx, dword [esi + 8]
add dword [esi + 0x14], ecx
cmp dword [esi + 0x54], 8
push 0xffffffffffffffff
push edx
push 0x18
push ecx
mov ecx, esp
jb 0x417ffb
mov eax, dword [esi + 0x40]
jmp 0x417ffe
lea eax, [esi + 0x40]
push ecx
mov dword [ecx], eax
mov eax, esp
add esi, 0x20
push esi
mov dword [eax], str.write
call fcn.004160d0
add esp, 0x18
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
ret 4
push esi
call fcn.004172e0
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
ret 4
Function at 0x4191d0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x53f219
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x594aa4]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
xor esi, esi
mov dword [esp + 0x18], esi
lea edi, [ebp + 4]
xor eax, eax
mov dword [ebp + 0x18], 7
mov dword [ebp + 0x14], esi
mov dword [esp + 0x1c], ebp
mov word [edi], ax
mov dword [esp + 0x28], esi
mov eax, dword [esp + 0x34]
mov dword [esp + 0x18], 1
mov ebx, eax
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x419230
sub eax, edx
mov esi, dword [ebp + 0x14]
sar eax, 1
mov ecx, eax
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea eax, [ecx + eax + 7]
cmp esi, eax
ja 0x419281
cmp dword [ebp + 0x18], eax
je 0x419281
push 1
push eax
mov ecx, ebp
call fcn.004089e0
test al, al
je 0x419281
cmp dword [ebp + 0x18], 8
mov dword [ebp + 0x14], esi
jb 0x41927b
mov edi, dword [edi]
xor ecx, ecx
mov word [edi + esi*2], cx
movzx eax, word [ebx]
test ax, ax
je 0x41939b
mov esi, dword [esp + 0x38]
and esi, 0x100
mov dword [esp + 0x14], esi
test esi, esi
je 0x4192b8
lea edx, [eax - 0x22]
cmp dx, 0x1c
ja 0x419381
movzx ecx, ax
movsx edi, byte [ecx + 0x582bc2]
jmp 0x4192cf
lea edx, [eax - 0x26]
cmp dx, 0x18
ja 0x419381
movzx ecx, ax
movsx edi, byte [ecx + 0x582bde]
test edi, edi
je 0x419381
test byte [esp + 0x38], 8
je 0x419357
cmp ax, 0x26
jne 0x419357
movzx eax, word [ebx + 2]
lea esi, [ebx + 2]
lea edx, [eax - 0x23]
cmp dx, 0x57
ja 0x419302
movzx ecx, ax
movsx ecx, byte [ecx + 0x582bfd]
test ecx, ecx
jne 0x419308
cmp ax, 0x7f
jbe 0x419357
movzx eax, word [esi + 2]
add esi, 2
cmp ax, 0x3b
je 0x41933f
lea edx, [eax - 0x2d]
cmp dx, 0x4d
ja 0x41932c
movzx ecx, ax
movsx ecx, byte [ecx + 0x582c53]
test ecx, ecx
jne 0x419332
cmp ax, 0x7f
jbe 0x419357
movzx eax, word [esi + 2]
add esi, 2
cmp ax, 0x3b
jne 0x419315
mov eax, esi
sub eax, ebx
sar eax, 1
inc eax
push eax
push ebx
mov ecx, ebp
call fcn.00408700
mov ebx, esi
mov esi, dword [esp + 0x14]
jmp 0x41938b
mov edx, dword [edi*4 + 0x5a5ad4]
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x419363
sub eax, esi
sar eax, 1
push eax
push edx
mov ecx, ebp
call fcn.00408700
mov esi, dword [esp + 0x14]
jmp 0x41938b
push 1
push ebx
mov ecx, ebp
call fcn.00408700
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
jne 0x41929b
mov eax, ebp
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x41c020
Capabilities:
Read file on windows

Disassembly:
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push 0
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0xc]
push ecx
mov ecx, dword [eax + 0xc]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41c056
mov eax, dword [esp + 0x10]
test eax, eax
je 0x41c051
mov edx, dword [esp + 0xc]
mov dword [eax], edx
xor eax, eax
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x41c06a
and eax, 0xffff
or eax, 0x80070000
ret 0x10

Function at 0x41c0d0
Capabilities:
Get file size

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [ecx + 8]
sub esp, 8
lea eax, [esp]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x41c101
mov eax, dword [esp + 0x10]
mov ecx, dword [esp]
mov edx, dword [esp + 4]
mov dword [eax], ecx
mov dword [eax + 4], edx
xor eax, eax
add esp, 8
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x41c115
and eax, 0xffff
or eax, 0x80070000
add esp, 8
ret 8

Function at 0x41c700
Capabilities:
Get file size

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x41c798
lea ecx, [esp + 0x10]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x41c791
mov esi, dword [esp + 0x20]
mov ebp, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
mov ecx, esi
add ecx, ebp
mov eax, edi
adc eax, dword [esp + 0x2c]
cmp eax, dword [esp + 0x14]
ja 0x41c791
jb 0x41c75b
cmp ecx, dword [esp + 0x10]
ja 0x41c791
push 0
push 0
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x41c791
push 0x28
call fcn.00446843
add esp, 4
test eax, eax
je 0x41c798
mov edx, dword [esp + 0x2c]
push edx
push ebp
push edi
push esi
mov edx, ebx
call fcn.0041c6b0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x41c7b0
Capabilities:
Read file on windows

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
mov edx, dword [esi + 0x24]
mov ebp, dword [esi + 0x20]
mov eax, dword [esi + 0x10]
push edi
mov edi, dword [esi + 0x14]
cmp edx, edi
jb 0x41c7e3
ja 0x41c7cd
cmp ebp, eax
jb 0x41c7e3
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x41c7db
mov dword [eax], 0
pop edi
pop esi
xor eax, eax
pop ebp
ret 0x10
push ebx
mov ebx, dword [esp + 0x1c]
xor eax, eax
mov ecx, ebx
add ecx, ebp
adc eax, edx
cmp eax, edi
jb 0x41c800
ja 0x41c7fb
cmp ecx, dword [esi + 0x10]
jbe 0x41c800
mov ebx, dword [esi + 0x10]
sub ebx, ebp
mov ecx, dword [esp + 0x18]
mov edx, dword [esi + 0xc]
push 0
lea eax, [esp + 0x18]
push eax
push ebx
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
pop ebx
test eax, eax
je 0x41c839
mov eax, dword [esp + 0x10]
add dword [esi + 0x20], eax
mov ecx, dword [esp + 0x1c]
adc dword [esi + 0x24], 0
test ecx, ecx
je 0x41c831
mov dword [ecx], eax
pop edi
pop esi
xor eax, eax
pop ebp
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x41c84d
and eax, 0xffff
or eax, 0x80070000
pop edi
pop esi
pop ebp
ret 0x10
Function at 0x41cb90
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov ecx, dword [ebp + 0x10]
push ebx
push esi
xor eax, eax
push edi
mov edi, dword [ebp + 8]
mov dword [ecx], eax
xor edx, edx
lea ebx, [edi + 0x21c]
mov word [ebx], dx
mov dword [edi + 0x430], 0xffffffff
mov dword [edi + 0x428], eax
mov dword [edi + 0x424], eax
mov byte [edi + 0x42c], al
cmp dword [ebp + 0x14], eax
jne 0x41cc94
mov esi, dword [ebp + 0xc]
push esi
mov eax, edi
call fcn.0041ce20
test eax, eax
jne 0x41cd55
cmp word [ebx], ax
je 0x41cc94
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41cbf5
mov ecx, dword [edi + 0x218]
sub eax, edx
sar eax, 1
inc eax
lea edx, [ecx + eax]
cmp edx, 0x104
jg 0x41cd50
push eax
lea eax, [edi + ecx*2 + 0x10]
push ebx
push eax
call fcn.00481656
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
lea ebx, [edi + 0x434]
push ebx
push 0x104
lea edx, [edi + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
je 0x41cd50
cmp eax, 0x104
ja 0x41cd50
push esi
call fcn.0041cf90
test eax, eax
jne 0x41cd55
push esi
call fcn.0041cef0
test eax, eax
jne 0x41cd55
push esi
mov esi, edi
call fcn.0041d030
test eax, eax
jne 0x41cd55
cmp byte [edi + 0x42c], al
je 0x41cc9f
push eax
push ebx
push eax
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [esp + 0xc], 0
je 0x41cd50
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41ccd2
test al, 0x10
jne 0x41ccee
test al, 1
je 0x41ccc9
and eax, 0xfffffffe
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x41ccee
mov eax, dword [esp + 0xc]
movzx esi, word [eax]
xor ecx, ecx
push ecx
push ebx
push ecx
mov word [eax], cx
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov edx, dword [esp + 0xc]
mov word [edx], si
mov eax, ebx
call fcn.0041d170
mov esi, eax
test esi, esi
jne 0x41cd18
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x41cd55
and eax, 0xffff
or eax, 0x80070000
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [esi]
mov ecx, dword [eax + 4]
push esi
call ecx
mov edx, dword [esi]
mov eax, dword [edx + 4]
push esi
call eax
mov eax, dword [edi + 0x63c]
test eax, eax
je 0x41cd3a
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x63c], esi
mov dword [eax], esi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, 0x80004005
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x41cd70
Capabilities:
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp word [esi + 0x21c], 0
je 0x41ce12
cmp dword [esp + 0xc], 0
je 0x41cdac
mov eax, dword [esi + 0x63c]
test eax, eax
je 0x41ce12
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esi + 0x63c], 0
xor eax, eax
pop esi
ret 8
cmp dword [esi + 0x424], 0
lea ecx, [esi + 0x424]
jne 0x41cdc4
cmp dword [esi + 0x428], 0
je 0x41cddd
mov eax, dword [esi + 0x63c]
test eax, eax
je 0x41cddd
mov eax, dword [eax + 8]
push ecx
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov eax, dword [esi + 0x63c]
test eax, eax
je 0x41cdf9
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esi + 0x63c], 0
mov eax, dword [esi + 0x430]
cmp eax, 0xffffffff
je 0x41ce12
push eax
add esi, 0x434
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
pop esi
ret 8

Function at 0x41d1c0
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push 0
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0xc]
push ecx
mov ecx, dword [eax + 8]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x41d1f6
mov eax, dword [esp + 0x10]
test eax, eax
je 0x41d1f1
mov edx, dword [esp + 0xc]
mov dword [eax], edx
xor eax, eax
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x41d20a
and eax, 0xffff
or eax, 0x80070000
ret 0x10

Function at 0x41d210
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x542273
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x594aa4]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov eax, 7
xor edi, edi
xor ecx, ecx
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], edi
mov word [esi + 4], cx
mov dword [esp + 0x14], edi
xor edx, edx
mov dword [esi + 0x34], eax
mov dword [esi + 0x30], edi
mov word [esi + 0x20], dx
mov byte [esp + 0x14], 1
push 4
mov dword [esi + 0x5c], edi
call fcn.00446843
add esp, 4
cmp eax, edi
je 0x41d273
mov dword [eax], edi
jmp 0x41d275
xor eax, eax
push 0xc
mov dword [esi + 0x60], eax
call fcn.00446843
add esp, 4
cmp eax, edi
je 0x41d290
mov dword [eax + 8], edi
mov dword [eax + 4], edi
mov dword [eax], edi
jmp 0x41d292
xor eax, eax
push edi
mov ecx, esi
mov dword [esi + 0x64], eax
mov dword [esi + 0x58], edi
call fcn.0042d990
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x42a910
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x542273
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x594aa4]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov eax, 7
xor edi, edi
xor ecx, ecx
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], edi
mov word [esi + 4], cx
mov dword [esp + 0x14], edi
xor edx, edx
mov dword [esi + 0x34], eax
mov dword [esi + 0x30], edi
mov word [esi + 0x20], dx
mov byte [esp + 0x14], 1
push 4
mov dword [esi + 0x5c], edi
call fcn.00446843
add esp, 4
cmp eax, edi
je 0x42a973
mov dword [eax], edi
jmp 0x42a975
xor eax, eax
push 0xc
mov dword [esi + 0x60], eax
call fcn.00446843
add esp, 4
cmp eax, edi
je 0x42a990
mov dword [eax + 8], edi
mov dword [eax + 4], edi
mov dword [eax], edi
jmp 0x42a992
xor eax, eax
mov dword [esi + 0x64], eax
mov eax, dword [esp + 0x20]
push eax
mov ecx, esi
mov dword [esi + 0x58], edi
call fcn.0042d990
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 8