joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415570
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
push 0x14
call dword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov esi, eax
test esi, esi
je 0x415632
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
mov dword [esi], 1
mov dword [esi + 4], eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], edx
mov eax, dword [edi]
push edi
call dword [eax + 4]
lea ecx, [esp + 0xc]
mov dword [esi + 8], edi
push ecx
push 4
push esi
push 0x415640
push 0
push 0
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
je 0x4155fc
cmp dword [esi], 0
jne 0x4155de
int3
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
test eax, eax
jne 0x4155ea
int3
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
jmp 0x41561e
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
jg 0x41560e
call edi
mov edi, eax
jmp 0x41561e
call edi
mov edi, eax
and edi, 0xffff
or edi, 0x80070000
cmp dword [esi], 0
jne 0x415624
int3
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov eax, edi
pop edi
pop esi
ret 0x10
mov eax, 0x8007000e
pop esi
ret 0x10

Function at 0x417cb0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x24
call fcn.00424e40
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0x417d6e
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push ebx
push ebx
push 1
push ebx
call edi
cmp eax, ebx
mov dword [esi + 0xc], eax
je 0x417d68
push ebx
push ebx
push 1
push ebx
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, ebx
mov dword [esi + 0x10], eax
je 0x417d5f
mov edi, dword [esp + 0x14]
lea eax, [esi + 0x18]
push eax
push 4
mov ecx, dword [edi + 0x48]
push esi
push 0x417d80
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
mov dword [esi + 0x14], eax
je 0x417d56
push esi
call fcn.004118a0
mov dword [esi + 0x20], ebx
lea ebx, [edi + 0x30]
push ebx
mov dword [esi + 8], edi
mov dword [esi + 0x1c], 2
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
add edi, 0xc
push esi
push edi
call fcn.004118c0
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [esi + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret 4
mov eax, dword [esi + 0x10]
mov dword [esi + 0x10], ebx
push eax
call ebp
mov eax, dword [esi + 0xc]
mov dword [esi + 0xc], ebx
push eax
call ebp
push esi
call fcn.00425310
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 4
Function at 0x418b20
Capabilities:
Create directory

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x418b48
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 8
mov edi, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0xb7
je 0x418bfc
call esi
cmp eax, 3
jne 0x418bfc
push 0x5c
push edi
call fcn.0042e28c
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x418bfc
mov esi, ebp
sub esi, edi
lea ecx, [esi + 1]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
je 0x418bfc
mov ecx, esi
mov esi, edi
mov edx, ecx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x1c]
sub eax, edi
mov byte [eax + ebp], 0
call fcn.00418b20
test eax, eax
jne 0x418bcf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x418bcf
mov esi, 1
jmp 0x418bd1
xor esi, esi
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
test esi, esi
jne 0x418bfc
mov ecx, dword [esp + 0x18]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x418b44
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8

Function at 0x418cd0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
push esi
push edi
push eax
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], 5
mov dword [esp + 0x1c], 3
mov dword [esp + 0x20], 7
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x418d0f
or eax, ebx
mov ebx, eax
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileA]
xor edi, edi
mov ecx, dword [esp + edi*4 + 0x10]
mov edx, dword [esp + 0x24]
push 0
push ebx
push 2
push 0
push ecx
push 0xc0000000
push edx
call ebp
mov esi, eax
cmp esi, 0xffffffff
je 0x418d45
test esi, esi
jne 0x418d4e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x418d4e
or esi, 0xffffffff
inc edi
cmp edi, 4
jb 0x418d17
mov eax, dword [esp + 0x2c]
pop edi
mov dword [eax], esi
xor eax, eax
cmp esi, 0xffffffff
pop esi
pop ebp
pop ebx
setne al
add esp, 0x10
ret 0xc
Function at 0x418de0
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
sub esp, 0x114
push ebx
push ebp
push esi
mov esi, dword [esp + 0x124]
push edi
push 0x5c
push esi
call fcn.0042d770
add esp, 8
test eax, eax
je 0x418e01
int3
lea eax, [esp + 0x20]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x418fea
cmp eax, 0x104
jae 0x418fea
mov eax, dword [esp + 0x12c]
or ecx, 0xffffffff
test esi, esi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
je 0x418fe0
mov ebp, dword [esp + 0x138]
test ebp, ebp
je 0x418fe0
test eax, eax
jne 0x418e5b
mov edx, dword [0x4393d0]
mov dword [esp + 0x18], edx
lea edi, [esp + 0x20]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
je 0x418e77
mov al, byte [esp + ebx + 0x1f]
mov byte [esp + 0x14], 1
cmp al, 0x5c
jne 0x418e7c
mov byte [esp + 0x14], 0
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 4
mov edx, ecx
jb 0x418e94
mov edx, 4
mov edi, dword [esp + 0x18]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x14]
not ecx
dec ecx
and eax, 0xff
add edx, ecx
add eax, edx
lea ecx, [eax + ebx + 5]
mov eax, dword [esp + 0x13c]
cmp ecx, eax
jb 0x418ecb
push 0x6f
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x418fbb
mov eax, dword [esp + 0x134]
mov dword [esp + 0x10], 0
neg eax
sbb eax, eax
and eax, 0xfc000000
add eax, 0x4000000
or eax, 0x102
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov edx, dword [esp + 0x10]
mov al, byte [esp + 0x14]
inc edx
inc edi
test al, al
mov eax, dword [0x439330]
mov dword [esp + 0x10], edx
jne 0x418f13
mov eax, dword [0x439340]
mov edx, dword [esp + 0x18]
mov ecx, edi
and ecx, 0xffff
push edx
push ecx
mov ecx, dword [esp + 0x144]
push esi
push eax
mov eax, dword [str._s_s_.4s_04X._s]
lea edx, [esp + 0x30]
push edx
push eax
push ecx
push ebp
call fcn.0041c640
mov edx, dword [esp + 0x150]
add esp, 0x20
push 0
push ebx
push 1
push 0
push edx
push 0xc0000000
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x418f70
test esi, esi
jne 0x418fad
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x418fad
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x50
je 0x418f99
cmp eax, 5
jne 0x418fbb
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x418f99
call esi
cmp eax, 5
jne 0x418fd6
cmp word [esp + 0x10], 0
je 0x418fbb
mov esi, dword [esp + 0x128]
jmp 0x418ef7
and edi, 0xffff
mov dword [esp + 0x1c], esi
test edi, edi
jne 0x418fc5
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x418fea
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x114
ret 0x18
push 5
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x418fbb
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x418fbb
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x114
ret 0x18
Function at 0x419000
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
sub esp, 0x218
push ebx
push ebp
mov ebp, dword [esp + 0x224]
push esi
push edi
push 0x5c
push ebp
call fcn.0042d770
add esp, 8
test eax, eax
je 0x419021
int3
lea eax, [esp + 0x20]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x4191e0
cmp eax, 0x104
jae 0x4191e0
test ebp, ebp
mov dword [esp + 0x18], 0xffffffff
je 0x4191d6
lea edi, [esp + 0x20]
or ecx, 0xffffffff
xor eax, eax
mov esi, dword [0x4393d0]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x1c], esi
mov ebx, ecx
je 0x41907d
mov al, byte [esp + ebx + 0x1f]
mov byte [esp + 0x10], 1
cmp al, 0x5c
jne 0x419082
mov byte [esp + 0x10], 0
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 4
mov edx, ecx
jb 0x41909a
mov edx, 4
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x10]
not ecx
dec ecx
and eax, 0xff
add edx, ecx
add eax, edx
lea ecx, [eax + ebx + 5]
cmp ecx, 0x104
jb 0x4190cc
push 0x6f
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4191b1
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebp, dword [esp + 0x230]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
mov edx, dword [esp + 0x14]
mov al, byte [esp + 0x10]
inc edx
inc edi
test al, al
mov eax, dword [0x439330]
mov dword [esp + 0x14], edx
jne 0x419105
mov eax, dword [0x439340]
mov ecx, dword [esp + 0x22c]
mov edx, edi
and edx, 0xffff
push esi
push edx
push ecx
push eax
mov eax, dword [str._s_s_.4s_04X._s]
lea edx, [esp + 0x30]
lea ecx, [esp + 0x134]
push edx
push eax
push 0x104
push ecx
call fcn.0041c640
add esp, 0x20
lea edx, [esp + 0x124]
push 0
push 0x4000102
push 1
push 0
push ebp
push 0xc0000000
push edx
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x419169
test esi, esi
jne 0x4191a3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x4191a3
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x50
je 0x419192
cmp eax, 5
jne 0x4191b1
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x419192
call esi
cmp eax, 5
jne 0x4191cc
cmp word [esp + 0x14], 0
je 0x4191b1
mov esi, dword [esp + 0x1c]
jmp 0x4190e9
and edi, 0xffff
mov dword [esp + 0x18], esi
test edi, edi
jne 0x4191bb
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4191e0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x218
ret 8
push 5
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4191b1
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4191b1
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x218
ret 8
Function at 0x419390
Capabilities:
Read .ini file

Disassembly:
mov ecx, dword [esp + 0x10]
mov eax, dword [0x439340]
sub esp, 0x10
lea edx, [esp]
push esi
push ecx
mov ecx, dword [esp + 0x1c]
push 0x10
push edx
push eax
mov eax, dword [esp + 0x2c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
mov esi, dword [esp + 0x20]
je 0x4193dd
lea edx, [esp + 0x24]
lea eax, [esp + 4]
push edx
push 0xa
push 0
push eax
mov dword [esp + 0x34], esi
call fcn.0040f750
test al, al
mov eax, dword [esp + 0x24]
jne 0x4193df
mov eax, esi
pop esi
add esp, 0x10
ret 0x10
Function at 0x4193f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
test ebx, ebx
push edi
je 0x4195c1
mov edx, dword [esp + 0x18]
test edx, edx
je 0x4195c1
mov ebp, dword [esp + 0x20]
test ebp, ebp
je 0x4195c1
mov eax, dword [0x4393d0]
mov edi, ebx
mov dword [esp + 0x20], eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
je 0x41943e
mov al, byte [esi + ebx - 1]
mov byte [esp + 0x14], 1
cmp al, 0x5c
jne 0x419443
mov byte [esp + 0x14], 0
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 4
mov edx, ecx
jb 0x41945b
mov edx, 4
mov edi, dword [esp + 0x20]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x14]
not ecx
dec ecx
and eax, 0xff
add edx, ecx
mov ecx, dword [esp + 0x24]
add eax, edx
lea edx, [eax + esi + 5]
cmp edx, ecx
jb 0x419493
push 0x6f
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x14
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x4194db
mov al, byte [esp + 0x14]
test al, al
mov eax, dword [0x439330]
jne 0x4194ad
mov eax, dword [0x439340]
mov edx, dword [esp + 0x20]
push edx
mov edx, esi
and edx, 0xffff
push edx
mov edx, dword [esp + 0x20]
push edx
push eax
mov eax, dword [str._s_s_.4s_04X._s]
push ebx
push eax
push ecx
push ebp
call fcn.0041c640
add esp, 0x20
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov edx, dword [esp + 0x1c]
mov al, byte [esp + 0x14]
inc edx
inc edi
test al, al
mov eax, dword [0x439330]
mov dword [esp + 0x1c], edx
jne 0x419507
mov eax, dword [0x439340]
mov ecx, dword [esp + 0x20]
mov edx, edi
push ecx
mov ecx, dword [esp + 0x1c]
and edx, 0xffff
push edx
mov edx, dword [str._s_s_.4s_04X._s]
push ecx
push eax
mov eax, dword [esp + 0x34]
push ebx
push edx
push eax
push ebp
call fcn.0041c640
add esp, 0x20
push 0
push 0x102
push 1
push 0
push 0
push 0xc0000000
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x419560
test esi, esi
jne 0x41959a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x41959a
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x50
je 0x419585
cmp eax, 5
jne 0x4195c9
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x419585
call esi
cmp eax, 5
jne 0x4195b0
cmp word [esp + 0x1c], 0
jne 0x4194eb
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x14
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and edi, 0xffff
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
push 5
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x14
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x14
Function at 0x4195e0
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x419602
cmp eax, esi
jae 0x419602
mov eax, 1
pop esi
ret 8
xor eax, eax
pop esi
ret 8

Function at 0x419610
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x41962c
test al, 0x10
jne 0x41962c
mov eax, 1
ret 4
xor eax, eax
ret 4

Function at 0x4196b0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x10c
lea eax, [esp + 4]
push ebx
push ebp
push esi
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov esi, eax
test esi, esi
jbe 0x41974e
mov al, byte [esp + esi + 0xf]
mov ebp, dword [esp + 0x11c]
cmp al, 0x5c
push edi
setne bl
mov byte [esp + 0x10], bl
mov edi, ebp
mov edx, dword [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
and edx, 0xff
repne scasb al, byte es:[edi]
mov eax, 0x105
pop edi
not ecx
sub eax, edx
dec ecx
sub eax, esi
cmp ecx, eax
jae 0x41974e
test bl, bl
je 0x419711
mov byte [esp + esi + 0x10], 0x5c
sub edx, ebp
mov eax, ebp
add edx, esi
lea edx, [esp + edx + 0x10]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x41971b
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor ecx, ecx
pop esi
mov edx, dword [esp + 0x11c]
pop ebp
test eax, eax
setne cl
mov dword [edx], eax
mov eax, ecx
pop ebx
add esp, 0x10c
ret 8
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10c
ret 8

Function at 0x419890
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
push edi
push eax
push ecx
push ebx
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x4198ea
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4198ea
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x4198e3
mov edx, dword [esp + 0x24]
push esi
push ebx
mov dword [edx], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, 1
mov ecx, dword [esp + 0x20]
mov dword [ecx], eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
ret 0x14
Function at 0x419900
Capabilities:
Clear file content

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
push edi
lea edx, [esp + 8]
xor ecx, ecx
push 1
xor eax, eax
push edx
push ecx
push eax
push esi
xor edi, edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
call fcn.004199b0
test eax, eax
je 0x419997
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push eax
push edi
push ecx
push edx
push esi
call fcn.004199b0
test eax, eax
je 0x419997
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x419972
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push edi
push edi
push eax
push ecx
push esi
call fcn.004199b0
test eax, eax
je 0x419997
pop edi
mov eax, 1
pop esi
add esp, 8
ret 0x10
push ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x10]
mov ebx, eax
mov eax, dword [esp + 0xc]
push 0
push 0
push edx
push eax
push esi
call fcn.004199b0
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop ebx
mov eax, edi
pop edi
pop esi
add esp, 8
ret 0x10

Function at 0x419b70
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x20
push ebx
push esi
xor ebx, ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
push ebx
call edi
mov esi, dword [esp + 0x30]
cmp esi, ebx
je 0x419c34
cmp dword [esi], 0x40
jne 0x419c34
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x10]
mov dword [esp + 0xc], 0x20
rep stosd dword es:[edi], eax
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.GlobalMemoryStatusEx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x419bd2
push esi
call eax
pop edi
pop esi
pop ebx
add esp, 0x20
ret 4
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov dword [esi + 0xc], ebx
mov dword [esi + 0x14], ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov dword [esi + 4], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esi + 8], edx
mov edx, dword [esp + 0x20]
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x24]
mov dword [esi + 0x18], ecx
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], edx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x20
ret 4
push 0x57
call edi
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x20
ret 4
Function at 0x419c50
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x1004
call fcn.0042d600
mov ecx, dword [esp + 0x100c]
lea eax, [esp + 0x1010]
push edi
push eax
push ecx
lea edx, [esp + 0x10]
push 0x1000
push edx
call fcn.0042d62f
lea edi, [esp + 0x18]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
mov byte [esp + 0x1007], 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
pop edi
cmp ecx, 0xffffffff
jbe 0x419caa
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add esp, 0x1004
ret
mov edx, dword [esp + 0x1008]
lea eax, [esp]
push 0
push eax
push ecx
lea ecx, [esp + 0x10]
push ecx
push edx
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
add esp, 0x1004
ret

Function at 0x41a1c0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x108
lea eax, [esp + 4]
push ebx
push esi
push edi
push 0x104
xor edi, edi
push eax
push 1
push edi
push edi
push str.afr
call fcn.00418de0
mov esi, eax
cmp esi, 0xffffffff
je 0x41a265
mov ebx, dword [esp + 0x11c]
mov edx, dword [esp + 0x118]
lea ecx, [esp + 0xc]
push edi
push ecx
push ebx
push edx
push esi
mov dword [esp + 0x20], edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x41a25e
cmp ebx, dword [esp + 0xc]
jne 0x41a25e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x10]
push eax
call fcn.00419fa0
mov esi, eax
cmp esi, edi
je 0x41a250
push edi
push 0x4000000
push 3
push edi
push 1
lea ecx, [esp + 0x24]
push 0xc0000000
push ecx
call fcn.00418c10
push eax
push esi
call fcn.0041a280
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x108
ret 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x108
ret 8

Function at 0x41a290
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
push edi
push eax
push ecx
xor ebp, ebp
push edx
push ebx
mov dword [esp + 0x20], ebp
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
mov esi, eax
test esi, esi
je 0x41a30d
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x41a30d
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
test ebp, ebp
je 0x41a2f8
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push ebp
call fcn.0041a1c0
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov esi, dword [esp + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
Function at 0x41a7b0
Capabilities:
Check http status code

Disassembly:
sub esp, 0xc
push ebx
push esi
mov esi, dword [esp + 0x1c]
xor ebx, ebx
push esi
mov dword [esp + 0xc], ebx
call fcn.0041a440
cmp eax, 7
je 0x41a870
cmp eax, 0xd
jne 0x41a8dd
lea eax, [esp + 0x1c]
push edi
push eax
push 0x13
push esi
mov dword [esp + 0x2c], ebx
call fcn.0041a490
test eax, eax
mov edi, dword [esp + 0x1c]
je 0x41a84d
cmp dword [esp + 0x20], 0x190
jae 0x41a84d
lea ecx, [esp + 0xc]
push ecx
push 5
push esi
call fcn.0041a490
test eax, eax
je 0x41a82a
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0xc]
mov bl, 1
mov dword [edi + 0x20], edx
pop edi
mov dword [eax], ecx
mov al, bl
pop esi
pop ebx
add esp, 0xc
ret 0xc
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x1c], 0xa0000004
mov dword [edi + 0x20], edx
pop edi
mov dword [eax], ecx
mov al, bl
pop esi
pop ebx
add esp, 0xc
ret 0xc
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x1c], 0xa0000003
mov dword [edi + 0x20], edx
pop edi
mov dword [eax], ecx
mov al, bl
pop esi
pop ebx
add esp, 0xc
ret 0xc
lea eax, [esp + 0x10]
push eax
push esi
call dword [0x4410e0]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x41a8b2
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x41a8ae
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
pop esi
mov dword [ecx + 0x1c], 0xa0000004
mov ecx, dword [esp + 4]
mov dword [eax], ecx
mov al, bl
pop ebx
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0xc]
cmp dword [esp + 0x10], ebx
jne 0x41a8d2
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 8]
mov bl, 1
mov dword [eax], ecx
mov al, bl
pop esi
pop ebx
add esp, 0xc
ret 0xc
mov edx, dword [esp + 0x18]
mov dword [edx + 0x1c], 0xa0000005
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 8]
pop esi
mov dword [eax], ecx
mov al, bl
pop ebx
add esp, 0xc
ret 0xc