joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416a3c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x452570]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x416a82
cmp word [ebx], dx
jne 0x416a82
or byte [eax + edi + 0x28], 4
jmp 0x416a87
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x416bea
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x416bca
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x416ac8
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x416afe
cmp eax, edx
jae 0x416b0c
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x416aa3
jmp 0x416bea
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x416bc5
cmp dword [ebp - 0x18], 0
je 0x416bc5
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x452570]
test byte [eax + edi + 0x28], 0x48
je 0x416b9b
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x416b5f
mov word [esi], cx
jmp 0x416b96
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x452570]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x452570]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x452570]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x416bea
pop eax
cmp word [ebp - 4], ax
jne 0x416bab
cmp esi, ebx
jne 0x416bab
mov word [esi], ax
jmp 0x416be7
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0041795b
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x416bea
push 0xd
pop eax
jmp 0x416ba6
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x452570]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x416be4
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x416bea
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x424f9b
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
push edi
je 0x424ff0
push dword [esp + 0x10]
push 0x424f1a
call dword [sym.imp.USER32.dll_EnumWindows]
mov edi, dword [0x4528cc]
test edi, edi
je 0x425049
xor esi, esi
mov ebx, dword [edi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi + 8], eax
jne 0x424fe8
cmp byte [edi + 0x10], 0
je 0x424fe8
push 3
push esi
push esi
push esi
push esi
push 0xfffffffffffffffe
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov edi, ebx
test ebx, ebx
jne 0x424fc4
jmp 0x425049
mov edi, dword [0x4528cc]
test edi, edi
je 0x425049
xor esi, esi
push ebp
mov ebp, dword [edi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi + 8], eax
jne 0x425042
cmp byte [edi + 0x11], 0
je 0x42501b
push 1
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp byte [edi + 0x10], 0
je 0x425032
push 3
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
lea eax, [edi + 8]
push eax
push 0x4528cc
call fcn.004263cf
pop ecx
pop ecx
mov edi, ebp
test ebp, ebp
jne 0x424ffd
pop ebp
pop edi
pop esi
pop ebx
ret 4

Function at 0x425186
Capabilities:
Check if file exists

Disassembly:
xor eax, eax
push ebx
mov ebx, eax
mov eax, dword [0x4528d8]
push esi
push edi
test eax, eax
jne 0x4251ac
push fcn.004252b5
push 0x10
push 0x258
call fcn.004262d5
mov dword [0x4528d8], eax
mov edi, dword [esp + 0x10]
push edi
push eax
call fcn.00426258
mov esi, eax
test esi, esi
je 0x4252ad
cmp dword [esp + 0x14], ebx
mov eax, 0x448268
push ebp
cmovne eax, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
test ebp, ebp
je 0x4251e4
xor ecx, ecx
cmp word [ebp], cx
jne 0x4251ed
mov ebp, 0x44aa60
mov dword [esp + 0x1c], ebp
push eax
call fcn.0040d442
push ebp
mov dword [esp + 0x20], eax
call fcn.0040d442
add eax, dword [esp + 0x20]
pop ecx
pop ecx
lea eax, [eax*2 + 4]
push eax
xor eax, eax
push eax
push dword [0x451618]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, eax
test ebp, ebp
je 0x42529a
push dword [esp + 0x14]
push ebp
call fcn.0043c510
pop ecx
pop ecx
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x42524d
mov eax, dword [esp + 0x14]
cmp word [eax + ecx*2 - 2], 0x5c
je 0x42524d
push 0x445398
push ebp
call fcn.0043c532
pop ecx
pop ecx
push dword [esp + 0x1c]
push ebp
call fcn.0043c532
pop ecx
pop ecx
lea eax, [esi + 8]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x425272
xor ecx, ecx
mov dword [esi + 4], ecx
jmp 0x425286
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 2
jne 0x425288
mov dword [esi + 4], 1
mov ebx, esi
push ebp
push ecx
push dword [0x451618]
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
jne 0x4252ac
cmp edi, 0xffffffff
cmove edi, esi
push edi
push dword [0x4528d8]
call fcn.004261f7
pop ebp
pop edi
pop esi
mov eax, ebx
pop ebx
ret 0xc
Function at 0x42532b
Capabilities:
Delete file
Set file attributes

Disassembly:
cmp dword [esp + 4], 0
je 0x425354
test byte [esp + 8], 2
je 0x425348
push pe_nt_image_headers32
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x425356
xor eax, eax
ret 8

Function at 0x425390
Capabilities:
Write file on windows

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp edi, 0xffffffff
jne 0x4253a9
push dword [0x452918]
call fcn.0042631e
pop edi
ret 4
push esi
push edi
push dword [0x452918]
call fcn.00426231
mov esi, eax
test esi, esi
je 0x425413
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4253ff
cmp dword [esi + 0x14], 0
mov dword [esp + 0xc], 0
jne 0x4253ee
push 0
lea eax, [esp + 0x10]
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
push eax
push ecx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
push dword [esi + 4]
push 0
push dword [0x451618]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push dword [0x452918]
call fcn.004261f7
pop esi
pop edi
ret 4

Function at 0x425420
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [esi + 0x14], 0
jne 0x42545c
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 4
xor eax, eax
pop esi
pop ecx
ret 4

Function at 0x4256a0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push esi
push dword [esp + 0x10]
mov dword [esp + 8], 0
push dword [0x452918]
call fcn.00426231
mov esi, eax
test esi, esi
je 0x42571f
cmp dword [esi + 4], 0
je 0x4256f0
push 1
lea eax, [esp + 8]
push eax
push esi
call fcn.00425850
test eax, eax
je 0x4256e4
inc dword [esi + 0xc]
xor eax, eax
pop esi
add esp, 8
ret 4
mov eax, 1
pop esi
add esp, 8
ret 4
push 0
lea eax, [esp + 0xc]
push eax
push 1
lea eax, [esp + 0x1c]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42572a
cmp dword [esp + 8], 0
je 0x42572a
push 1
push 0
push 0xffffffffffffffff
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 4]
pop esi
add esp, 8
ret 4
or eax, 0xffffffff
pop esi
add esp, 8
ret 4
Function at 0x425850
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
push edi
cmp dword [ebx + 0x14], 0
jne 0x425873
push ebx
call fcn.00425420
mov dword [ebx + 0x14], 1
mov dword [ebx + 0xc], 0
mov esi, dword [ebx + 0xc]
mov eax, dword [ebx + 0x10]
mov ebp, dword [esp + 0x20]
sub eax, esi
add eax, dword [ebx + 4]
mov dword [esp + 0x10], esi
cmp esi, ebp
jl 0x4258f7
mov ecx, ebp
sub ecx, 1
je 0x4258e2
sub ecx, 1
je 0x4258cb
sub ecx, 2
je 0x4258b6
push ebp
push eax
push dword [esp + 0x24]
call fcn.0041b7d0
add esp, 0xc
mov eax, ebp
sub dword [ebx + 0xc], ebp
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
mov ecx, dword [eax]
mov eax, dword [esp + 0x1c]
pop edi
pop esi
mov dword [eax], ecx
mov eax, ebp
sub dword [ebx + 0xc], ebp
pop ebp
pop ebx
pop ecx
ret 0xc
mov cx, word [eax]
mov eax, dword [esp + 0x1c]
pop edi
pop esi
mov word [eax], cx
mov eax, ebp
sub dword [ebx + 0xc], ebp
pop ebp
pop ebx
pop ecx
ret 0xc
mov ecx, dword [esp + 0x1c]
mov dl, byte [eax]
mov eax, ebp
pop edi
pop esi
mov byte [ecx], dl
sub dword [ebx + 0xc], ebp
pop ebp
pop ebx
pop ecx
ret 0xc
push esi
push eax
mov eax, dword [esp + 0x24]
push eax
call fcn.0041b7d0
mov eax, dword [esp + 0x28]
add esp, 0xc
mov edx, dword [ebx + 8]
add eax, esi
mov ecx, dword [ebx]
sub ebp, esi
mov dword [esp + 0x1c], eax
push 0
cmp ebp, edx
jl 0x425940
lea edx, [esp + 0x1c]
push edx
push ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x18]
pop edi
add eax, esi
mov dword [ebx + 0xc], 0
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
lea eax, [esp + 0x1c]
push eax
push edx
push dword [ebx + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, dword [esp + 0x18]
cmp ebp, esi
mov eax, dword [esp + 0x1c]
mov dword [ebx + 0xc], esi
mov dword [ebx + 0x10], esi
cmovle esi, ebp
push esi
push dword [ebx + 4]
push eax
call fcn.0041b7d0
sub dword [ebx + 0xc], esi
add esp, 0xc
mov eax, dword [esp + 0x10]
add eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x425990
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x18]
push 0x1000
push 0
push dword [0x451618]
mov dword [esp + 0x14], 0x1000
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esp + 0x10], edx
test edx, edx
je 0x425b20
mov cl, byte [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x24]
push esi
push edi
mov esi, edx
nop
cmp ebp, 0xffffffff
je 0x4259de
test ebp, ebp
je 0x425a86
dec ebp
cmp dword [ebx + 4], 0
lea edi, [ebx + 4]
je 0x4259fa
push 1
lea eax, [esp + 0x28]
push eax
push ebx
call fcn.00425850
mov dword [esp + 0x10], eax
jmp 0x425a14
push 0
lea eax, [esp + 0x14]
push eax
push 1
lea eax, [esp + 0x30]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x10]
mov cl, byte [esp + 0x24]
cmp eax, 1
jne 0x425a89
test cl, cl
je 0x425a28
mov byte [esi], cl
inc esi
mov cl, byte [esp + 0x24]
mov eax, dword [esp + 0x14]
mov edi, esi
mov edx, dword [esp + 0x1c]
dec eax
sub edi, edx
cmp edi, eax
jle 0x425a63
mov eax, dword [esp + 0x14]
add eax, 0x1000
push eax
push edx
push 8
push dword [0x451618]
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov cl, byte [esp + 0x24]
mov edx, eax
mov dword [esp + 0x1c], edx
lea esi, [edi + edx]
test cl, cl
je 0x425a86
cmp dword [esp + 0x28], 0
jne 0x4259d0
cmp cl, 0xd
je 0x425a92
cmp cl, 0xa
jne 0x4259d0
dec esi
jmp 0x425b03
lea edi, [ebx + 4]
cmp dword [esp + 0x28], 0
jne 0x425b03
jmp 0x425a95
lea edi, [ebx + 4]
cmp cl, 0xa
jne 0x425a9d
dec esi
jmp 0x425b03
cmp cl, 0xd
jne 0x425b03
dec esi
cmp dword [edi], 0
je 0x425abb
push 1
lea eax, [esp + 0x28]
push eax
push ebx
call fcn.00425850
mov dword [esp + 0x10], eax
jmp 0x425ad1
push 0
lea eax, [esp + 0x14]
push eax
push 1
lea eax, [esp + 0x30]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [esp + 0x24], 0xa
je 0x425b03
cmp dword [edi], 0
je 0x425ae2
inc dword [ebx + 0xc]
jmp 0x425b03
push 1
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 0xffffffff
push eax
push 0xffffffffffffffff
push dword [ebx]
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x30]
mov ecx, esi
sub ecx, dword [esp + 0x1c]
pop edi
mov dword [eax], ecx
mov eax, dword [esp + 0x18]
mov byte [esi], 0
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x10
xor eax, eax
pop ebx
add esp, 0x10
ret 0x10
Function at 0x425b30
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x1c]
push 0x1000
push 0
push dword [0x451618]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esp + 8], edx
test edx, edx
je 0x425cef
mov ax, word [esp + 0x1c]
push ebp
push esi
push edi
mov edi, edx
mov dword [esp + 0x1c], 0x1000
mov dword [esp + 0x18], 0x7ff
mov ecx, dword [esp + 0x30]
cmp ecx, 0xffffffff
je 0x425b89
test ecx, ecx
je 0x425c4c
dec ecx
mov dword [esp + 0x30], ecx
cmp dword [ebx + 4], 0
lea ebp, [ebx + 4]
je 0x425ba5
push 2
lea eax, [esp + 0x2c]
push eax
push ebx
call fcn.00425850
mov dword [esp + 0x10], eax
jmp 0x425bbf
push 0
lea eax, [esp + 0x14]
push eax
push 2
lea eax, [esp + 0x34]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x10]
cmp eax, 2
mov ax, word [esp + 0x28]
jne 0x425c4f
test ax, ax
je 0x425bdd
mov word [edi], ax
add edi, 2
mov ax, word [esp + 0x28]
mov edx, dword [esp + 0x14]
mov esi, edi
mov ecx, dword [esp + 0x18]
sub esi, edx
sar esi, 1
cmp esi, ecx
jle 0x425c24
mov eax, dword [esp + 0x1c]
add ecx, 0x800
add eax, 0x1000
mov dword [esp + 0x18], ecx
push eax
push edx
push 8
push dword [0x451618]
mov dword [esp + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
mov ax, word [esp + 0x28]
mov dword [esp + 0x14], edx
lea edi, [edx + esi*2]
test ax, ax
je 0x425c4f
cmp dword [esp + 0x2c], 0
jne 0x425b73
cmp ax, 0xd
je 0x425c56
cmp ax, 0xa
jne 0x425b73
sub edi, 2
jmp 0x425cce
lea ebp, [ebx + 4]
cmp dword [esp + 0x2c], 0
jne 0x425cce
cmp ax, 0xa
jne 0x425c61
sub edi, 2
jmp 0x425cce
cmp ax, 0xd
jne 0x425cce
sub edi, 2
cmp dword [ebp], 0
je 0x425c83
push 2
lea eax, [esp + 0x2c]
push eax
push ebx
call fcn.00425850
mov dword [esp + 0x10], eax
jmp 0x425c99
push 0
lea eax, [esp + 0x14]
push eax
push 2
lea eax, [esp + 0x34]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp word [esp + 0x28], 0xa
je 0x425cce
cmp dword [ebp], 0
je 0x425cad
add dword [ebx + 0xc], 2
jmp 0x425cce
push 1
lea eax, [esp + 0x24]
mov dword [esp + 0x20], 0xfffffffe
push eax
push 0xfffffffffffffffe
push dword [ebx]
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x34]
mov ecx, edi
sub ecx, dword [esp + 0x14]
sar ecx, 1
mov dword [eax], ecx
xor eax, eax
mov word [edi], ax
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x10
xor eax, eax
pop ebx
add esp, 0x14
ret 0x10
Function at 0x425d00
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push 0x1000
push 0
push dword [0x451618]
mov dword [esp + 0x10], 0x1000
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esp + 0xc], edx
test edx, edx
je 0x425e50
mov eax, dword [esp + 0x1c]
mov cl, byte [esp + 3]
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
push edi
mov edi, dword [esp + 0x30]
mov esi, edx
cmp edi, 0xffffffff
je 0x425d4c
test edi, edi
je 0x425dbd
dec edi
push esi
push ebp
call fcn.00425f70
mov dword [esp + 0x20], eax
test eax, eax
jne 0x425d5f
xor cl, cl
jmp 0x425d61
mov cl, byte [esi]
mov edx, dword [esp + 0x1c]
add esi, eax
mov eax, dword [esp + 0x14]
mov ebx, esi
sub ebx, edx
mov byte [esp + 0x13], cl
add eax, 0xfffffffb
cmp ebx, eax
jle 0x425da4
mov eax, dword [esp + 0x14]
add eax, 0x1000
push eax
push edx
push 8
push dword [0x451618]
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov cl, byte [esp + 0x13]
mov edx, eax
mov dword [esp + 0x1c], edx
lea esi, [ebx + edx]
mov eax, dword [esp + 0x2c]
test cl, cl
je 0x425dbd
test eax, eax
jne 0x425d42
cmp cl, 0xd
je 0x425dc1
cmp cl, 0xa
jne 0x425d42
dec esi
jmp 0x425e33
test eax, eax
jne 0x425e33
cmp cl, 0xa
jne 0x425dc9
dec esi
jmp 0x425e33
cmp cl, 0xd
jne 0x425e33
dec esi
cmp dword [ebp + 4], 0
je 0x425de8
push 1
lea eax, [esp + 0x17]
push eax
push ebp
call fcn.00425850
mov dword [esp + 0x20], eax
jmp 0x425dff
push 0
lea eax, [esp + 0x24]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [ebp]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [esp + 0x13], 0xa
je 0x425e33
cmp dword [ebp + 4], 0
je 0x425e11
inc dword [ebp + 0xc]
jmp 0x425e33
push 1
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 0xffffffff
push eax
push 0xffffffffffffffff
push dword [ebp]
mov dword [esp + 0x28], 0xffffffff
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x34]
mov ecx, esi
sub ecx, dword [esp + 0x1c]
pop edi
mov dword [eax], ecx
mov eax, dword [esp + 0x18]
mov byte [esi], 0
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x10
xor eax, eax
add esp, 0x14
ret 0x10
Function at 0x425e60
Capabilities:
Write file on windows

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
mov dword [esp], 0
test edx, edx
je 0x425f5e
cmp word [edx], 0
je 0x425f5e
mov ecx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
test ecx, ecx
jne 0x425e8e
mov ecx, dword [esi + 0x18]
push edi
cmp ecx, 0x19
jne 0x425ee4
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x425ea0
sub ecx, edi
sar ecx, 1
cmp dword [esi + 4], 0
je 0x425ec6
lea eax, [ecx + ecx]
push eax
push edx
push esi
call fcn.00426070
pop edi
pop esi
pop ecx
ret 0xc
push 0
lea eax, [esp + 0xc]
push eax
lea eax, [ecx + ecx]
push eax
push edx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
lea eax, [esp + 0x14]
push eax
push edx
xor edx, edx
mov eax, 0xfde9
cmp ecx, 2
cmovne eax, edx
push eax
call fcn.00426190
mov edi, eax
test edi, edi
je 0x425eda
cmp dword [esi + 4], 0
je 0x425f31
push dword [esp + 0x14]
push edi
push esi
call fcn.00426070
push edi
push 0
push dword [0x451618]
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
push 0
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x1c]
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
push 0
push dword [0x451618]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
xor eax, eax
pop ecx
ret 0xc

Function at 0x425f70
Capabilities:
Read file on windows

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [edi + 4], 0
je 0x425f97
push 1
lea eax, [esp + 0x10]
push eax
push edi
call fcn.00425850
mov dword [esp + 4], eax
jmp 0x425fb1
push 0
lea eax, [esp + 8]
push eax
push 1
lea eax, [esp + 0x18]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 4]
cmp eax, 1
jne 0x426064
mov cl, byte [esp + 0xc]
test cl, cl
js 0x425fd6
mov eax, dword [esp + 0x10]
pop edi
mov byte [eax], cl
mov byte [eax + 1], 0
mov eax, 1
pop ecx
ret 8
mov al, cl
and al, 0xe0
push esi
cmp al, 0xc0
jne 0x425fe6
mov esi, 2
jmp 0x426002
mov al, cl
and al, 0xf0
cmp al, 0xe0
jne 0x425ff5
mov esi, 3
jmp 0x426002
mov al, cl
and al, 0xf8
cmp al, 0xf0
jne 0x426050
mov esi, 4
mov eax, dword [esp + 0x14]
push ebx
lea ebx, [esi - 1]
mov byte [eax], cl
inc eax
cmp dword [edi + 4], 0
je 0x42602b
push ebx
push eax
push edi
call fcn.00425850
xor ecx, ecx
cmp eax, ebx
pop ebx
cmovne esi, ecx
mov eax, esi
pop esi
pop edi
pop ecx
ret 8
push 0
lea ecx, [esp + 0x10]
push ecx
push ebx
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0xc]
xor ecx, ecx
cmp eax, ebx
pop ebx
cmovne esi, ecx
mov eax, esi
pop esi
pop edi
pop ecx
ret 8
mov eax, dword [esp + 0x14]
pop esi
pop edi
mov word [eax], 0x3f
mov eax, 1
pop ecx
ret 8
xor eax, eax
pop edi
pop ecx
ret 8
Function at 0x426070
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push edi
mov edi, dword [esp + 0x10]
mov dword [esp + 0x10], 0
cmp dword [edi + 0x1c], 0
jne 0x426187
cmp dword [edi + 0x14], 1
push ebx
push ebp
jne 0x4260bd
mov eax, dword [edi + 0xc]
lea ecx, [esp + 0x10]
push 1
neg eax
cdq
push ecx
push eax
push dword [edi]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [edi + 8]
mov dword [edi + 0x14], 0
mov dword [edi + 0xc], eax
mov eax, dword [edi + 0xc]
push esi
mov esi, dword [esp + 0x24]
cmp eax, esi
jle 0x426146
mov ecx, dword [edi + 4]
sub ecx, eax
mov eax, esi
add ecx, dword [edi + 8]
sub eax, 1
je 0x42612f
sub eax, 1
je 0x426116
sub eax, 2
je 0x4260ff
push esi
push dword [esp + 0x24]
push ecx
call fcn.0041b7d0
add esp, 0xc
mov eax, esi
sub dword [edi + 0xc], esi
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret 0xc
mov eax, dword [esp + 0x20]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, esi
sub dword [edi + 0xc], esi
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret 0xc
mov eax, dword [esp + 0x20]
mov ax, word [eax]
mov word [ecx], ax
mov eax, esi
sub dword [edi + 0xc], esi
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret 0xc
mov eax, dword [esp + 0x20]
mov al, byte [eax]
mov byte [ecx], al
mov eax, esi
sub dword [edi + 0xc], esi
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret 0xc
push edi
call fcn.00425420
mov eax, dword [edi + 8]
cmp esi, eax
jl 0x426175
push 0
lea eax, [esp + 0x20]
push eax
push esi
push dword [esp + 0x2c]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x1c]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret 0xc
mov ecx, dword [edi + 4]
sub ecx, dword [edi + 0xc]
push esi
push dword [esp + 0x24]
add ecx, eax
jmp 0x4260e7
xor eax, eax
pop edi
add esp, 8
ret 0xc

Function at 0x426b20
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x426b4d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x426b4d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401c1d
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
jmp 0x401c52
mov ecx, dword [edx + 0xc]
cmp dword [ebp + 0xc], ecx
jb 0x401c4f
mov eax, dword [edx + 8]
add eax, ecx
cmp dword [ebp + 0xc], eax
jb 0x401c5b
add edx, 0x28
cmp edx, esi
jne 0x401c3d
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x401c58

Function at 0x4020b8
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4020f7
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4020f7
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4020f7
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4020f7
cmp dword [ecx + 0x74], 0xe
jbe 0x4020f7
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret