joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5534a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
je 0x55356e
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test esi, esi
jl 0x55355d
jg 0x5534d8
test edx, edx
je 0x55355d
call fcn.00452550
mov esi, eax
mov eax, edx
mov dword [ebp - 8], eax
test eax, eax
jl 0x553526
jg 0x5534ee
test esi, esi
je 0x553526
cmp ebx, eax
jg 0x5534fd
jl 0x5534f8
cmp edi, esi
jae 0x5534fd
mov esi, edi
mov dword [ebp - 8], ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
push esi
push eax
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.004fc120
mov ecx, dword [ebp - 4]
add esp, 0xc
sub edi, esi
sbb ebx, dword [ebp - 8]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x55354a
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
push eax
call edx
cmp eax, 0xffffffff
je 0x553557
mov ecx, dword [ebp - 4]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [ebp + 8], esi
test ebx, ebx
jg 0x5534d8
jl 0x553557
test edi, edi
jne 0x5534d8
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
pop edi
sbb esi, ebx
mov eax, edx
mov edx, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], esi
mov eax, dword [eax]
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], eax
test eax, eax
je 0x55358d
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x55358f
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [ebp + 0x10], eax
test edi, edi
jl 0x553608
jg 0x5535a1
test esi, esi
je 0x553608
test eax, eax
jl 0x5535e2
jg 0x5535ab
test ebx, ebx
je 0x5535e2
cmp edi, eax
jg 0x5535ba
jl 0x5535b5
cmp esi, ebx
jae 0x5535ba
mov ebx, esi
mov dword [ebp + 0x10], edi
push ebx
push dword [ebp + 8]
push dword [ebp - 8]
call fcn.004fc120
mov ecx, dword [ebp - 4]
add esp, 0xc
mov edx, dword [ebp + 8]
add edx, ebx
sub esi, ebx
mov eax, dword [ecx + 0x30]
sbb edi, dword [ebp + 0x10]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
jmp 0x5535e5
mov edx, dword [ebp + 8]
test edi, edi
jl 0x553608
jg 0x5535ef
test esi, esi
je 0x553608
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x553608
push eax
push esi
push 1
push edx
call fcn.0053da9f
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x57f510
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0
push dword [ebp + 8]
call fcn.0057fb20
add esp, 8
test al, al
je 0x57f535
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x57f535
mov al, 1
pop ebp
ret
xor al, al
pop ebp
ret

Function at 0x57fb20
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
pop ebp
ret

Function at 0x580fd0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x580ffb
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x580ffb
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
add ecx, esi
pop esi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x408470
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4780dc
mov eax, dword fs:[0]
push eax
sub esp, 0x1ac
mov eax, dword [0x4b1570]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1b4], ecx
push 0
call fcn.0044d16e
add esp, 4
push 0x4d5ed8
push 0x96
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
call fcn.00415f00
mov al, byte [0x4d5f71]
mov byte [ebp - 0x1b8], al
cmp byte [ebp - 0x1b8], 0
je 0x4084d3
jmp 0x4084e9
mov dword [0x4b2980], 0
mov dword [0x4b2984], 0
jmp 0x408503
push str.Lang_chn.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x4b2980], eax
mov dword [0x4b2984], 1
mov dword [ebp - 0x198], 1
jmp 0x40851e
mov ecx, dword [ebp - 0x198]
add ecx, 1
mov dword [ebp - 0x198], ecx
cmp dword [ebp - 0x198], 0x100
jge 0x40858d
lea ecx, [ebp - 0x19c]
call fcn.004028e0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x198]
push edx
push str..COM_d
lea eax, [ebp - 0x19c]
push eax
call fcn.004023c0
add esp, 0xc
mov ecx, dword [ebp - 0x19c]
push ecx
mov edx, dword [ebp - 0x198]
sub edx, 1
shl edx, 4
add edx, str..COM1
push edx
call fcn.004601b0
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x19c]
call fcn.00401fc0
jmp 0x40850f
push 1
push 0x4804f0
call fcn.00408650
add esp, 8
test eax, eax
jne 0x4085a7
xor eax, eax
jmp 0x40863b
cmp dword [0x4b2988], 0
jne 0x4085c7
push 2
push 0x4804ec
call fcn.00408650
add esp, 8
test eax, eax
jne 0x4085c7
xor eax, eax
jmp 0x40863b
push 0
lea ecx, [ebp - 0x194]
call fcn.00414bf0
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x1b4]
lea ecx, [ebp - 0x194]
mov dword [eax + 0x20], ecx
lea ecx, [ebp - 0x194]
call fcn.0043eb32
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1a0], 0
mov dword [ebp - 4], 3
lea ecx, [ebp - 0xc8]
call fcn.004025a0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x120]
call fcn.00449003
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x194]
call fcn.0043e3e7
mov eax, dword [ebp - 0x1a0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x40b140
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
call fcn.0042b4d0
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0x4295b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40b184
push 0
push str.Error:_Failed_to_create_thread.
call fcn.00414a60
add esp, 8
call fcn.0042b480
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret 4
Function at 0x40eaf0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0
call fcn.0042b4d0
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x42b000
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40eb3b
call fcn.0042b480
push 0
push str.Error:_Failed_to_create_thread.
call fcn.00414a60
add esp, 8
jmp 0x40eb45
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x414050
Capabilities:
Read .ini file
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x4b1570]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x238], ecx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x1a0]
push ecx
mov ecx, dword [ebp - 0x238]
call fcn.00414340
test eax, eax
jne 0x41408a
xor eax, eax
jmp 0x41427a
push 0x480bc8
mov edx, dword [ebp + 8]
push edx
call fcn.00460890
add esp, 8
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0
jne 0x4140b1
xor eax, eax
jmp 0x41427a
push 0x80
push 0
lea eax, [ebp - 0x88]
push eax
call fcn.004602b0
add esp, 0xc
push 0
push 0
push 0x1009
mov ecx, dword [ebp - 0x238]
mov edx, dword [ecx + 0x94]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 4], 0
mov byte [ebp - 0x94], 0
xor eax, eax
mov dword [ebp - 0x93], eax
mov word [ebp - 0x8f], ax
mov byte [ebp - 0x8d], al
mov ecx, dword [ebp - 0x8c]
push ecx
push 0x80
push 1
lea edx, [ebp - 0x88]
push edx
call fcn.0046373b
add esp, 0x10
cmp eax, 0x80
jne 0x414256
mov eax, dword [ebp - 4]
push eax
push 0x47fa8c
lea ecx, [ebp - 0x94]
push ecx
call fcn.004600f6
add esp, 0xc
mov edx, dword [ebp - 4]
mov dword [ebp - 0x234], edx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x94]
push eax
mov ecx, dword [ebp - 0x234]
push ecx
push 1
mov ecx, dword [ebp - 0x238]
add ecx, 0x74
call fcn.00449102
mov dword [ebp - 0x1a4], eax
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 0x1a4], 0
jl 0x414251
lea eax, [ebp - 0x88]
push eax
push 1
mov ecx, dword [ebp - 0x1a4]
push ecx
mov ecx, dword [ebp - 0x238]
add ecx, 0x74
call fcn.00448f10
lea edx, [ebp - 0x80]
push edx
push 2
mov eax, dword [ebp - 0x1a4]
push eax
mov ecx, dword [ebp - 0x238]
add ecx, 0x74
call fcn.00448f10
lea ecx, [ebp - 0x80]
push ecx
call fcn.0045fc50
add esp, 4
push eax
push 0x47fa8c
lea edx, [ebp - 0x94]
push edx
call fcn.004600f6
add esp, 0xc
lea eax, [ebp - 0x94]
push eax
push 3
mov ecx, dword [ebp - 0x1a4]
push ecx
mov ecx, dword [ebp - 0x238]
add ecx, 0x74
call fcn.00448f10
lea edx, [ebp - 0x1a0]
push edx
push 0x81
lea eax, [ebp - 0x230]
push eax
push 0x47f760
lea ecx, [ebp - 0x88]
push ecx
push str.COMMENT
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [ebp - 0x230]
push edx
push 4
mov eax, dword [ebp - 0x1a4]
push eax
mov ecx, dword [ebp - 0x238]
add ecx, 0x74
call fcn.00448f10
jmp 0x414106
mov ecx, dword [ebp - 0x8c]
push ecx
call fcn.00460750
add esp, 4
mov edx, dword [ebp - 0x238]
mov dword [edx + 0xcc], 0
mov eax, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004600a2
mov esp, ebp
pop ebp
ret 4
Function at 0x415de0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x479858
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x4b1570]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x18]
call fcn.004028e0
mov dword [ebp - 4], 0
push 0x4d5ed8
call fcn.0045fc50
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movsx ecx, byte [eax + 0x4d5ed7]
cmp ecx, 0x5c
jne 0x415e50
push str.PCLoader.ini
push 0x4d5ed8
push str._s_s
lea edx, [ebp - 0x18]
push edx
call fcn.004023c0
add esp, 0x10
jmp 0x415e6b
push str.PCLoader.ini
push 0x4d5ed8
push 0x481ae4
lea eax, [ebp - 0x18]
push eax
call fcn.004023c0
add esp, 0x10
push 0x480378
push 0
lea ecx, [ebp - 0x18]
call fcn.00407de0
push eax
call fcn.00460890
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x415ea7
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00401fc0
mov eax, dword [ebp - 0x1c]
jmp 0x415ee4
mov ecx, dword [ebp - 0x10]
push ecx
push 0x2ef5
push 1
push 0x4d5f70
call fcn.00463c4f
add esp, 0x10
mov edx, dword [ebp - 0x10]
push edx
call fcn.00460750
add esp, 4
mov dword [ebp - 0x20], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00401fc0
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x415f00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x479888
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4b1570]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x18]
call fcn.004028e0
mov dword [ebp - 4], 0
push 0x2ef5
push 0
push 0x4d5f70
call fcn.004602b0
add esp, 0xc
mov byte [0x4d8e62], 0
mov byte [0x4d8e63], 6
push 0x4d5ed8
call fcn.0045fc50
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movsx ecx, byte [eax + 0x4d5ed7]
cmp ecx, 0x5c
jne 0x415f92
push str.PCLoader.ini
push 0x4d5ed8
push str._s_s
lea edx, [ebp - 0x18]
push edx
call fcn.004023c0
add esp, 0x10
jmp 0x415fad
push str.PCLoader.ini
push 0x4d5ed8
push 0x481ae4
lea eax, [ebp - 0x18]
push eax
call fcn.004023c0
add esp, 0x10
push 0x480bc8
push 0
lea ecx, [ebp - 0x18]
call fcn.00407de0
push eax
call fcn.00460890
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x416028
push 2
push 0
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.004639e3
add esp, 0xc
mov edx, dword [ebp - 0x10]
push edx
call fcn.004638ee
add esp, 4
cmp eax, 0x2ef5
jne 0x41601c
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
call fcn.004639e3
add esp, 0xc
mov ecx, dword [ebp - 0x10]
push ecx
push 0x2ef5
push 1
push 0x4d5f70
call fcn.0046373b
add esp, 0x10
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x10]
push edx
call fcn.00460750
add esp, 4
movzx eax, byte [0x4d8e63]
cmp eax, 1
jg 0x41603d
mov byte [0x4d5f6e], 4
jmp 0x416059
movzx ecx, byte [0x4d8e63]
cmp ecx, 4
jg 0x416052
mov byte [0x4d5f6e], 2
jmp 0x416059
mov byte [0x4d5f6e], 1
mov dword [ebp - 0x1c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00401fc0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x417500
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x479b00
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x4b1570]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x18]
call fcn.004028e0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.004028e0
mov byte [ebp - 4], 1
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x20], 1
jmp 0x417560
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x100
jge 0x4175fa
mov ecx, dword [ebp - 0x20]
push ecx
push str.COM_d
lea edx, [ebp - 0x18]
push edx
call fcn.004023c0
add esp, 0xc
mov eax, dword [ebp - 0x20]
push eax
push str..COM_d
lea ecx, [ebp - 0x1c]
push ecx
call fcn.004023c0
add esp, 0xc
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x44], edx
push 0
push 0x80
push 3
push 0
push 0
push 0
mov eax, dword [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x4175d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jne 0x4175d0
jmp 0x417557
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
lea edx, [ebp - 0x18]
push edx
mov ecx, dword [ebp + 8]
call fcn.0044d7fb
cmp dword [ebp - 0x14], 0
je 0x4175f5
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x417557
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x28], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.00401fc0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00401fc0
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x41e010
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47a1a0
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x4b1570]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x30]
call fcn.004028e0
mov dword [ebp - 4], 0
mov dword [ebp - 0x34], 0
cmp dword [ebp + 0xc], 0
jne 0x41e06f
mov dword [ebp - 0x38], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00401fc0
mov eax, dword [ebp - 0x38]
jmp 0x41e199
push 0
lea eax, [ebp - 0x10]
push eax
push 1
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [0x497298]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x41e0d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [0x497298]
push edx
call dword [sym.imp.KERNEL32.dll_ClearCommError]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x3c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00401fc0
mov eax, dword [ebp - 0x3c]
jmp 0x41e199
cmp dword [ebp + 0xc], 1
jbe 0x41e180
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0xc]
sub ecx, 1
push ecx
mov edx, dword [ebp + 8]
add edx, 1
push edx
mov eax, dword [0x497298]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x41e180
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x18]
push edx
mov eax, dword [0x497298]
push eax
call dword [sym.imp.KERNEL32.dll_ClearCommError]
mov dword [ebp - 0x14], eax
push 0xa0
lea ecx, [ebp - 0x40]
push ecx
call fcn.00408350
add esp, 8
mov dword [ebp - 0x74], eax
mov edx, dword [ebp - 0x74]
mov dword [ebp - 0x60], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x60]
mov ecx, dword [eax]
mov dword [ebp - 0x64], ecx
push 0
push 0
mov edx, dword [ebp - 0x64]
push edx
call fcn.00408a00
add esp, 0xc
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00401fc0
mov dword [ebp - 0x44], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00401fc0
mov eax, dword [ebp - 0x44]
jmp 0x41e199
mov dword [ebp - 0x48], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00401fc0
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x41e1b0
Capabilities:
Check for time delay via gettickcount
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47a1c8
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x4b1570]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x34]
call fcn.004028e0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x38], eax
mov eax, 1
test eax, eax
je 0x41e325
cmp dword [0x4d8e70], 1
jne 0x41e228
mov dword [ebp - 0x3c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00401fc0
mov eax, dword [ebp - 0x3c]
jmp 0x41e334
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x14]
push edx
mov eax, dword [0x497298]
push eax
call dword [sym.imp.KERNEL32.dll_ClearCommError]
push 0
lea ecx, [ebp - 0x30]
push ecx
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x10]
push eax
mov ecx, dword [0x497298]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x41e2b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x20], eax
lea edx, [ebp - 0x2c]
push edx
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [0x497298]
push ecx
call dword [sym.imp.KERNEL32.dll_ClearCommError]
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x20]
push eax
push str.Failed_to_receive_data_Error_Code_ld:_ld__
lea ecx, [ebp - 0x34]
push ecx
call fcn.004023c0
add esp, 0x10
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x40], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00401fc0
mov eax, dword [ebp - 0x40]
jmp 0x41e334
cmp dword [ebp - 0x30], 0
jne 0x41e2f5
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x38]
cmp eax, dword [ebp + 0x10]
jb 0x41e2eb
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x44], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00401fc0
mov eax, dword [ebp - 0x44]
jmp 0x41e334
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41e320
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 0x30]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
jb 0x41e320
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x48], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00401fc0
mov eax, dword [ebp - 0x48]
jmp 0x41e334
jmp 0x41e1f4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00401fc0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x41fe70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x10], 0
cmp dword [ebp + 0x10], 0
jne 0x41fe8f
lea ecx, [ebp - 0x18]
mov dword [ebp + 0x10], ecx
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
mov eax, dword [ebp - 0x20]
cmp dword [eax + 4], 0
jne 0x41feb6
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 0x10], 6
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 0x10]
jmp 0x42000b
mov eax, dword [ebp - 0x20]
cmp dword [eax + 0x1c], 0
jne 0x41fee0
cmp dword [ebp + 0x14], 0
jne 0x41fecb
cmp dword [ebp + 0x18], 0xffffffff
je 0x41fee0
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 0x10], 1
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 0x10]
jmp 0x42000b
cmp dword [ebp + 0x14], 0
jne 0x41ff0e
mov eax, dword [ebp - 0x20]
cmp dword [eax + 0x1c], 0
je 0x41ff0e
push 0x14
push 0
lea ecx, [ebp - 0x14]
push ecx
call fcn.004602b0
add esp, 0xc
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 0x1c]
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x14]
mov dword [ebp + 0x14], ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x41fff2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x3e5
je 0x41ff59
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov dword [edx + 0x10], eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ecx + 0x10]
jmp 0x42000b
mov edx, dword [ebp + 0x14]
lea eax, [ebp - 0x14]
cmp edx, eax
jne 0x41fff0
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x41ff8c
cmp dword [ebp - 0x24], 0x102
je 0x41ffbd
jmp 0x41ffdc
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x41ffbb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x10]
jmp 0x42000b
jmp 0x41fff0
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_CancelIo]
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x10], 0x5b4
mov ecx, dword [ebp - 0x20]
mov eax, dword [ecx + 0x10]
jmp 0x42000b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x10]
jmp 0x42000b
jmp 0x420005
cmp dword [ebp + 0x14], 0
je 0x420005
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ecx + 0x10]
mov esp, ebp
pop ebp
ret 0x14