joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ca40
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x478128
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4921bc]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
push edi
mov eax, dword [0x4921bc]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, dword [esi]
cmp eax, 0xffffffff
mov edi, ecx
mov dword [esp + 0x28], edi
mov dword [esp + 0x30], esi
je 0x40cb94
lea ecx, [esp + 0x34]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
jne 0x40caae
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x40cb94
xor eax, eax
mov dword [esp + 0x39], eax
mov word [esp + 0x3d], ax
mov byte [esp + 0x3f], al
mov eax, dword [esi]
cmp eax, 0xffffffff
mov byte [esp + 0x38], 0
je 0x40cb94
push 0
lea edx, [esp + 0x18]
push edx
push 8
lea ecx, [esp + 0x44]
push ecx
push eax
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40cb94
mov ecx, dword [esp + 0x14]
test ecx, ecx
seta al
test al, al
je 0x40cb94
cmp ecx, 8
jne 0x40cb94
movzx edx, byte [esp + 0x38]
mov eax, 0x47
sub eax, edx
jne 0x40cb36
movzx ecx, byte [esp + 0x39]
mov eax, 0x4d
sub eax, ecx
jne 0x40cb36
movzx edx, byte [esp + 0x3a]
mov eax, 0x5a
sub eax, edx
je 0x40cb44
test eax, eax
mov ecx, 1
jg 0x40cb46
or ecx, 0xffffffff
jmp 0x40cb46
xor ecx, ecx
test ecx, ecx
jne 0x40cb94
mov al, byte [esp + 0x3b]
cmp al, 1
mov byte [edi + 0xa8], al
ja 0x40cb94
mov edi, dword [esp + 0x3c]
cmp edi, 0x3200000
mov ebx, edi
ja 0x40cb94
lea esi, [esp + 0x18]
call fcn.00408e00
mov ecx, dword [esp + 0x30]
xor edi, edi
mov dword [esp + 0x50], edi
mov eax, dword [esp + 0x20]
push ebx
lea esi, [esp + 0x18]
call fcn.004119f0
test al, al
jne 0x40cb98
lea ecx, [esp + 0x18]
call fcn.00404a80
xor al, al
jmp 0x40cbde
cmp dword [esp + 0x14], ebx
jne 0x40cb8b
mov eax, dword [esp + 0x1c]
cmp ebx, eax
mov dword [esp + 0x24], eax
ja 0x40cbae
mov dword [esp + 0x24], ebx
mov esi, dword [esp + 0x28]
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esi + 8]
mov dword [esp + 0x34], edi
call fcn.0040c4e0
test al, al
lea ecx, [esp + 0x18]
je 0x40cb8f
mov byte [esi + 0xd4], 1
call fcn.00404a80
mov al, 1
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00461f6b
mov esp, ebp
pop ebp
ret 4
Function at 0x40f740
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x478088
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4921bc]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov eax, dword [0x4921bc]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [esp + 0x38]
xor esi, esi
push 0xffffffffffffffff
push esi
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], esi
mov word [esp + 0x18], si
call fcn.00401790
push 0x24
lea ecx, [esp + 0xc]
mov dword [esp + 0x34], esi
call fcn.004091a0
mov eax, dword [esp + 0x10]
mov esi, 8
add esp, 4
cmp dword [esp + 0x20], esi
jae 0x40f7b8
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40f7db
cmp dword [esp + 0x20], esi
jb 0x40f7d7
mov eax, dword [esp + 0xc]
push eax
call fcn.0046207a
add esp, 4
mov al, 1
jmp 0x40f7f0
cmp dword [esp + 0x20], esi
jb 0x40f7ee
mov ecx, dword [esp + 0xc]
push ecx
call fcn.0046207a
add esp, 4
xor al, al
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00461f6b
add esp, 0x2c
ret

Function at 0x40f810
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x478088
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4921bc]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov eax, dword [0x4921bc]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [esp + 0x38]
xor esi, esi
push 0xffffffffffffffff
push esi
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], esi
mov word [esp + 0x18], si
call fcn.00401790
push 0x24
lea ecx, [esp + 0xc]
mov dword [esp + 0x34], esi
call fcn.004091a0
mov eax, dword [esp + 0x10]
mov esi, 8
add esp, 4
cmp dword [esp + 0x20], esi
jae 0x40f888
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40f8af
test al, 0x10
jne 0x40f8af
cmp dword [esp + 0x20], esi
jb 0x40f8ab
mov eax, dword [esp + 0xc]
push eax
call fcn.0046207a
add esp, 4
mov al, 1
jmp 0x40f8c4
cmp dword [esp + 0x20], esi
jb 0x40f8c2
mov ecx, dword [esp + 0xc]
push ecx
call fcn.0046207a
add esp, 4
xor al, al
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00461f6b
add esp, 0x2c
ret
Function at 0x40f8e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x478088
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4921bc]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov eax, dword [0x4921bc]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [esp + 0x38]
xor esi, esi
push 0xffffffffffffffff
push esi
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], esi
mov word [esp + 0x18], si
call fcn.00401790
push 0x24
lea ecx, [esp + 0xc]
mov dword [esp + 0x34], esi
call fcn.004091a0
mov eax, dword [esp + 0x10]
mov esi, 8
add esp, 4
cmp dword [esp + 0x20], esi
jae 0x40f958
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40f97f
test al, 0x10
je 0x40f97f
cmp dword [esp + 0x20], esi
jb 0x40f97b
mov eax, dword [esp + 0xc]
push eax
call fcn.0046207a
add esp, 4
mov al, 1
jmp 0x40f994
cmp dword [esp + 0x20], esi
jb 0x40f992
mov ecx, dword [esp + 0xc]
push ecx
call fcn.0046207a
add esp, 4
xor al, al
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00461f6b
add esp, 0x2c
ret

Function at 0x40fa90
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
cmp dword [edi + 0x18], 8
push esi
lea esi, [edi + 4]
jb 0x40fa9e
mov eax, dword [esi]
jmp 0x40faa0
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffffe
cmp dword [edi + 0x18], 8
jb 0x40fab4
mov ecx, dword [esi]
jmp 0x40fab6
mov ecx, esi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [edi + 0x18], 8
jb 0x40fac6
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
sub eax, 1
neg eax
sbb eax, eax
add eax, 1
pop esi
ret
Function at 0x40ffe0
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x4791d8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4921bc]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4921bc]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x48]
mov eax, dword [ebx + 0x14]
xor edi, edi
test eax, eax
mov dword [esp + 0x14], eax
jbe 0x410109
lea ebp, [ebx + 4]
lea ebx, [ebx]
cmp edi, dword [ebx + 0x14]
jbe 0x41003a
call fcn.004625df
mov esi, 8
cmp dword [ebx + 0x18], esi
jb 0x410049
mov eax, dword [ebp]
jmp 0x41004b
mov eax, ebp
cmp word [eax + edi*2], 0x2f
je 0x410073
cmp edi, dword [ebx + 0x14]
jbe 0x41005c
call fcn.004625df
cmp dword [ebx + 0x18], esi
jb 0x410066
mov eax, dword [ebp]
jmp 0x410068
mov eax, ebp
cmp word [eax + edi*2], 0x5c
jne 0x4100fc
push edi
xor ecx, ecx
lea esi, [esp + 0x1c]
mov edx, ebx
call fcn.004078e0
xor esi, esi
mov dword [esp + 0x40], esi
cmp dword [esp + 0x2c], esi
je 0x4100cf
lea ecx, [esp + 0x18]
push ecx
call fcn.0040f740
add esp, 4
test al, al
jne 0x4100cf
cmp dword [esp + 0x30], 8
mov eax, dword [esp + 0x1c]
jae 0x4100ad
lea eax, [esp + 0x1c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4100cf
mov dword [esp + 0x40], 0xffffffff
cmp dword [esp + 0x30], 8
jb 0x4100eb
mov edx, dword [esp + 0x1c]
push edx
jmp 0x4100e3
mov dword [esp + 0x40], 0xffffffff
cmp dword [esp + 0x30], 8
jb 0x4100eb
mov eax, dword [esp + 0x1c]
push eax
call fcn.0046207a
add esp, 4
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], esi
mov word [esp + 0x1c], si
add edi, 1
cmp edi, dword [esp + 0x14]
jb 0x410030
push ebx
call fcn.0040f740
add esp, 4
test al, al
jne 0x410135
cmp dword [ebx + 0x18], 8
jb 0x410121
mov eax, dword [ebx + 4]
jmp 0x410124
lea eax, [ebx + 4]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x410135
xor al, al
jmp 0x41013e
push ebx
call fcn.0040f8e0
add esp, 4
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00461f6b
add esp, 0x30
ret
Function at 0x410400
Capabilities:
Parse pe header
Read file on windows

Disassembly:
sub esp, 0x178
mov eax, dword [0x4921bc]
xor eax, esp
mov dword [esp + 0x170], eax
mov eax, dword [edi]
cmp eax, 0xffffffff
push esi
je 0x41044d
push 0
lea ecx, [esp + 8]
push ecx
push 0x40
lea edx, [esp + 0x13c]
push edx
push eax
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41044d
mov ecx, dword [esp + 4]
test ecx, ecx
seta al
test al, al
jne 0x410466
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x170]
xor ecx, esp
call fcn.00461f6b
add esp, 0x178
ret
cmp ecx, 0x40
jne 0x41044d
cmp word [esp + 0x130], 0x5a4d
jne 0x41044d
mov eax, dword [esp + 0x16c]
cdq
push 0
push edx
push eax
lea esi, [esp + 0x14]
mov eax, edi
call fcn.00411b30
test al, al
je 0x41044d
push pe_nt_image_headers32
lea esi, [esp + 8]
lea eax, [esp + 0x14]
mov ecx, edi
call fcn.004119f0
test al, al
je 0x41044d
cmp dword [esp + 4], 0xf8
jne 0x41044d
cmp dword [esp + 0x10], 0x4550
jne 0x41044d
movzx eax, word [esp + 0x16]
lea eax, [eax + eax*4 - 5]
add eax, eax
push 1
add eax, eax
add eax, eax
push 0
push eax
lea esi, [esp + 0x14]
mov eax, edi
call fcn.00411b30
test al, al
je 0x41044d
push 0x28
lea esi, [esp + 8]
lea eax, [esp + 0x10c]
mov ecx, edi
call fcn.004119f0
test al, al
je 0x41044d
cmp dword [esp + 4], 0x28
jne 0x41044d
mov esi, dword [esp + 0x118]
mov ecx, dword [esp + 0x4c]
xor edx, edx
mov eax, esi
div ecx
test edx, edx
jne 0x410525
mov eax, esi
jmp 0x41052b
add eax, 1
imul eax, ecx
mov ecx, dword [esp + 0x11c]
add eax, ecx
mov ecx, dword [esp + 0x174]
pop esi
xor ecx, esp
call fcn.00461f6b
add esp, 0x178
ret

Function at 0x410550
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
push edi
mov edi, dword [ebp]
xor ebx, ebx
cmp edi, ebx
je 0x410615
call fcn.00410400
cmp eax, 0xffffffff
je 0x410615
push ebx
push ebx
push eax
mov eax, dword [ebp]
lea esi, [esp + 0x1c]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
call fcn.00411b30
test al, al
je 0x410615
mov eax, dword [ebp]
lea esi, [ebp + 0x10]
cmp esi, ebx
mov dword [esp + 0x24], ebx
je 0x410615
cmp dword [eax], 0xffffffff
je 0x410615
push ebx
lea ecx, [esp + 0x28]
push ecx
push 0x1c
mov dword [esp + 0x30], ebx
mov edx, dword [eax]
push esi
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x410615
mov ecx, dword [esp + 0x24]
cmp ecx, ebx
seta al
cmp al, bl
je 0x410615
cmp ecx, 0x1c
jne 0x410615
cmp byte [esi], 0x47
jne 0x410615
cmp byte [ebp + 0x11], 0x4d
jne 0x410615
cmp byte [ebp + 0x12], 0xee
jne 0x410615
mov eax, dword [ebp]
lea esi, [esp + 0x18]
call fcn.00411a80
test al, al
je 0x410615
cmp dword [ebp + 0x28], 0x11223344
mov eax, dword [esp + 0x10]
mov dword [ebp + 0xc], eax
jne 0x410615
cmp dword [ebp + 0x1c], ebx
setne al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x10
ret 4
Function at 0x411ae0
Capabilities:
Get file size

Disassembly:
push ecx
mov eax, dword [eax]
cmp eax, 0xffffffff
jne 0x411aec
xor al, al
pop ecx
ret
push esi
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x411b0f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x411b0f
xor al, al
pop esi
pop ecx
ret
mov edx, dword [esp + 4]
push 1
push 0
push 0
push edx
call fcn.0046d5e0
xor ecx, ecx
add eax, esi
adc edx, ecx
mov dword [edi], eax
mov dword [edi + 4], edx
mov al, 1
pop esi
pop ecx
ret
Function at 0x4122b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x477178
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x4921bc]
xor eax, esp
mov dword [esp + 0x34], eax
push ebx
push esi
mov eax, dword [0x4921bc]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor esi, esi
push 0xffffffffffffffff
push esi
push eax
lea eax, [esp + 0x30]
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], esi
mov word [esp + 0x34], si
call fcn.00401790
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x54], esi
call fcn.00406f80
mov ecx, dword [edi + 0x10]
add esp, 4
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x18]
lea esi, [edi + 0xc]
push eax
push esi
mov dword [esp + 0x1c], ecx
call fcn.00417890
mov ebx, eax
mov eax, dword [ebx]
test eax, eax
je 0x412340
cmp eax, esi
je 0x412345
call fcn.004625df
mov ecx, dword [esp + 0x10]
cmp dword [ebx + 4], ecx
jne 0x41237b
mov ebx, dword [edi + 4]
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x20]
push eax
push edi
call fcn.00417890
mov esi, eax
mov eax, dword [esi]
test eax, eax
je 0x41236d
cmp eax, edi
je 0x412372
call fcn.004625df
cmp dword [esi + 4], ebx
jne 0x41237b
xor bl, bl
jmp 0x41237d
mov bl, 1
cmp dword [esp + 0x3c], 8
jb 0x412391
mov ecx, dword [esp + 0x28]
push ecx
call fcn.0046207a
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.00461f6b
mov esp, ebp
pop ebp
ret 4
Function at 0x4123c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4777a8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4921bc]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
push edi
mov eax, dword [0x4921bc]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
xor edi, edi
push 0xffffffffffffffff
push edi
mov dword [esp + 0x1c], edi
push eax
lea eax, [esp + 0x30]
mov esi, ecx
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], edi
mov word [esp + 0x34], di
call fcn.00401790
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x54], edi
call fcn.00406f80
add esp, 4
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x18]
push edx
lea edi, [ebx + 0xc]
push edi
call fcn.00417890
mov eax, dword [edi + 4]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x41245a
cmp eax, edi
je 0x412463
call fcn.004625df
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
cmp edi, dword [esp + 0x20]
je 0x4124b7
test eax, eax
jne 0x41247a
call fcn.004625df
mov eax, dword [esp + 0x14]
cmp edi, dword [eax + 4]
jne 0x412484
call fcn.004625df
xor ecx, ecx
push 0xffffffffffffffff
lea eax, [edi + 0x28]
push ecx
push eax
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ecx
mov eax, esi
mov word [esi + 4], cx
call fcn.00401790
cmp dword [esp + 0x3c], 8
jb 0x412558
mov ecx, dword [esp + 0x28]
push ecx
jmp 0x412550
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x20]
push eax
push ebx
call fcn.00417890
mov edi, dword [eax]
test edi, edi
mov ecx, dword [eax + 4]
mov edx, dword [ebx + 4]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], edx
je 0x4124df
cmp edi, ebx
je 0x4124e4
call fcn.004625df
mov eax, dword [esp + 0x20]
cmp dword [esp + 0x18], eax
jne 0x41250b
xor eax, eax
push eax
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], eax
push 0x47d1ec
mov word [esi + 4], ax
call fcn.00401890
jmp 0x4124a2
test edi, edi
jne 0x412514
call fcn.004625df
mov edx, dword [esp + 0x18]
cmp edx, dword [edi + 4]
jne 0x412522
call fcn.004625df
mov eax, dword [esp + 0x18]
xor ecx, ecx
push 0xffffffffffffffff
add eax, 0x28
push ecx
push eax
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ecx
mov eax, esi
mov word [esi + 4], cx
call fcn.00401790
cmp dword [esp + 0x3c], 8
jb 0x412558
mov eax, dword [esp + 0x28]
push eax
call fcn.0046207a
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00461f6b
mov esp, ebp
pop ebp
ret 8
Function at 0x415fb0
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x479780
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x4921bc]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
push edi
mov eax, dword [0x4921bc]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor edx, edx
xor esi, esi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], edx
mov dword [esp + 0x58], edx
mov ecx, dword [ebx + 0x160]
mov eax, dword [ebx + 0x15c]
xor edi, edi
cmp ecx, edx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x10], eax
jbe 0x416089
jmp 0x416024
mov eax, dword [esp + 0x10]
mov ebx, dword [edi + eax]
mov ecx, ebx
shr ecx, 1
add edi, 4
mov dword [esp + 0x40], edx
mov word [esp + 0x30], dx
push ecx
lea edx, [edi + eax]
push edx
lea esi, [esp + 0x34]
mov dword [esp + 0x4c], 7
call fcn.00401890
mov eax, esi
push eax
lea esi, [esp + 0x1c]
mov byte [esp + 0x5c], 1
call fcn.004088f0
add edi, ebx
mov byte [esp + 0x58], 0
cmp dword [esp + 0x44], 8
jb 0x416079
mov ecx, dword [esp + 0x30]
push ecx
call fcn.0046207a
add esp, 4
xor edx, edx
cmp edi, dword [esp + 0x28]
jb 0x416020
mov esi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x14]
xor edi, edi
cmp esi, edx
mov dword [esp + 0x10], edi
je 0x4161c0
mov ecx, dword [esp + 0x20]
sub ecx, esi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jae 0x4161a0
sub eax, edi
sub eax, 1
push eax
lea eax, [esp + 0x1c]
call fcn.00417640
mov esi, eax
mov eax, dword [ebx + 0x13c]
cmp eax, dword [esi + 0x14]
ja 0x41618e
or edi, 0xffffffff
cmp eax, 0xffffffff
jae 0x4160e2
mov edi, eax
cmp dword [ebx + 0x140], 8
jb 0x4160f3
mov ecx, dword [ebx + 0x12c]
jmp 0x4160f9
lea ecx, [ebx + 0x12c]
push ecx
mov ecx, esi
call fcn.00407c00
test eax, eax
sete al
test al, al
je 0x41618e
push esi
call fcn.0040f740
add esp, 4
test al, al
je 0x41618e
push 0x47d494
mov eax, esi
call fcn.00406ea0
add esp, 4
push esi
call fcn.0040f8e0
add esp, 4
test al, al
je 0x416152
push esi
call fcn.0040fae0
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x20]
add esp, 4
add edi, 1
xor edx, edx
jmp 0x41608b
cmp dword [esi + 0x18], 8
lea edi, [esi + 4]
jb 0x41615f
mov eax, dword [edi]
jmp 0x416161
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffffe
cmp dword [esi + 0x18], 8
jb 0x416175
mov ecx, dword [edi]
jmp 0x416177
mov ecx, edi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [esi + 0x18], 8
jb 0x416187
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0x1c]
add edi, 1
xor edx, edx
jmp 0x41608b
mov edx, dword [esp + 0x14]
mov edi, dword [esp + 0x20]
push edx
mov eax, esi
call fcn.00404e90
mov eax, dword [esp + 0x20]
add esp, 4
push eax
call fcn.0046207a
add esp, 4
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00461f6b
mov esp, ebp
pop ebp
ret 4
Function at 0x419b10
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, eax
mov eax, dword [esi + 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebx]
cmp eax, 0xffffffff
push edi
mov dword [esp + 0xc], 0
je 0x419b93
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [esp + 0x10]
push ecx
push 4
lea edx, [esp + 0x1c]
push edx
push eax
call edi
test eax, eax
je 0x419b93
cmp dword [esp + 0xc], 4
jne 0x419b93
mov edx, dword [esp + 0x10]
test edx, edx
jne 0x419b65
pop edi
pop esi
mov al, 1
pop ebx
add esp, 8
ret
mov eax, dword [esi + 8]
test eax, eax
mov esi, edx
je 0x419b93
mov ecx, dword [ebx]
cmp ecx, 0xffffffff
je 0x419b93
push 0
lea ebx, [esp + 0x10]
push ebx
push edx
push eax
push ecx
call edi
test eax, eax
je 0x419b93
mov eax, dword [esp + 0xc]
cmp esi, eax
jne 0x419b93
cmp eax, dword [esp + 0x10]
je 0x419b5c
pop edi
pop esi
xor al, al
pop ebx
add esp, 8
ret
Function at 0x41ecd0
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x476af8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4921bc]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x24], 0
cmp dword [eax + 0x18], 8
jb 0x41ed10
mov eax, dword [eax + 4]
jmp 0x41ed13
add eax, 4
push 0
push 0x80
push 3
push 0
push 1
push Ordinal_4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [esp + 0x18], ebx
je 0x41edf6
lea eax, [esp + 0x14]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x41ed5c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x41edef
mov ecx, dword [esp + 0x14]
push 1
push 0
push 0
push ecx
call fcn.0046d5e0
mov ebp, eax
xor eax, eax
add ebp, edi
adc edx, eax
mov ecx, ebp
or ecx, edx
je 0x41edef
lea edi, [ebp + 3]
call fcn.00405120
mov eax, dword [esi + 4]
cmp ebp, eax
ja 0x41ed8b
mov eax, ebp
mov dword [esi + 0xc], eax
mov eax, dword [esi + 8]
xor edi, edi
cmp eax, edi
mov dword [esp + 0x2c], edi
je 0x41edef
push edi
lea edx, [esp + 0x30]
push edx
push ebp
push eax
push ebx
mov dword [esp + 0x40], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41edef
mov ecx, dword [esp + 0x2c]
cmp ecx, edi
seta al
test al, al
je 0x41edef
cmp ecx, ebp
jne 0x41edef
mov eax, dword [esi + 8]
xor ecx, ecx
add eax, ebp
mov word [eax], cx
lea esi, [esp + 0x18]
mov byte [eax + 2], cl
call fcn.004119d0
mov al, 1
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret