joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46bc0c
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
pushal
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
cmp eax, 1
jl 0x46bc7d
cmp ecx, 1
jl 0x46bc7d
cmp dword [ebp + 8], 0
jl 0x46bc7d
cmp dword [ebp + 0xc], 0
jl 0x46bc7d
mov word [ebp - 0xc], ax
mov word [ebp - 0xa], cx
sub ax, 1
sub cx, 1
mov bx, word [ebp + 8]
mov word [ebp - 8], bx
add ax, bx
mov word [ebp - 4], ax
mov bx, word [ebp + 0xc]
mov word [ebp - 6], bx
add cx, bx
mov word [ebp - 2], cx
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 0x18]
cmp word [eax], 0
je 0x46bc7d
lea edx, [ebp - 8]
push edx
push 0
push ecx
push eax
push dword [0x4012dc]
call dword [sym.imp.kernel32.dll_WriteConsoleOutputW]
popal
leave
ret 0x14

Function at 0x46c24b
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
cmp dword [0x401528], 0
je 0x46c2cd
cmp dword [0x40158c], 5
jle 0x46c2cd
mov dword [ebp - 0x54], 0x54
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0x190
lea edx, [ebp - 0x40]
call fcn.0046c29a
push esp
add byte [ebp], ah
jb 0x46c28e
insd dword es:[edi], dx
add byte [ecx], ch
outsb dx, byte [esi]
add byte [ecx], ah
insb byte es:[edi], dx
add byte [eax], al
add byte [edx - 1], dl
push edx
call dword [sym.imp.kernel32.dll_lstrcpyW]

Function at 0x46c2d2
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
cmp dword [0x401528], 0
je 0x46c325
pushal
mov dword [ebp - 0x60], 0x60
lea edx, [ebp - 0x60]
push edx
push dword [0x4012dc]
call dword [0x401534]
mov ecx, 0x10
mov esi, 0x401014
lea edi, [ebp - 0x40]
lodsd eax, dword [esi]
stosd dword es:[edi], eax
loop 0x46c306
add word [ebp - 0x4e], 1
add word [ebp - 0x4c], 1
lea edx, [ebp - 0x60]
push edx
push dword [0x4012dc]
call dword [0x401538]
popal
leave
ret
Function at 0x46ca51
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ecx
push edx
mov dword [ebp - 0x10], 0xffffffff
push 0x1000
call fcn.0046bf84
mov dword [ebp - 8], eax
push 0x104
push eax
push 0
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
test eax, eax
je 0x46cbc0
push 0
push pe_nt_image_headers32
push 3
push 0
push 0
push 0x80000000
push dword [ebp - 8]
call dword [sym.imp.kernel32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x46cbc0
mov dword [ebp - 0xc], eax
mov eax, 0x20
neg eax
push 2
push 0
push eax
push dword [ebp - 0xc]
call dword [sym.imp.kernel32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x46cbb7
push 0x1000
push dword [ebp - 8]
call fcn.0046c00c
push 0
lea edx, [ebp - 4]
push edx
push 0x20
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x46cbb7
push 0x403f3c
push dword [ebp - 8]
call dword [sym.imp.kernel32.dll_lstrcmpW]
test eax, eax
jne 0x46cbb7
mov eax, 0x30
neg eax
push 2
push 0
push eax
push dword [ebp - 0xc]
call dword [sym.imp.kernel32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x46cbb7
push 0x1000
push dword [ebp - 8]
call fcn.0046c00c
push 0
lea edx, [ebp - 4]
push edx
push 0x10
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x46cbb7
push dword [ebp - 8]
call dword [sym.imp.shlwapi.dll_StrToIntW]
add eax, eax
push eax
add eax, 0x30
push eax
add eax, 0x104
push eax
call fcn.0046bf84
mov dword [ebp - 0x10], eax
pop ecx
neg ecx
push 2
push 0
push ecx
push dword [ebp - 0xc]
call dword [sym.imp.kernel32.dll_SetFilePointer]
pop ecx
cmp eax, 0xffffffff
jne 0x46cb90
push dword [ebp - 0x10]
call fcn.0046bff1
mov dword [ebp - 0x10], 0xffffffff
jmp 0x46cbb7
push 0
lea edx, [ebp - 4]
push edx
push ecx
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call dword [sym.imp.kernel32.dll_ReadFile]
cmp eax, 0
jne 0x46cbb7
push dword [ebp - 0x10]
call fcn.0046bff1
mov dword [ebp - 0x10], 0xffffffff
push dword [ebp - 0xc]
call dword [sym.imp.kernel32.dll_CloseHandle]
push dword [ebp - 8]
call fcn.0046bff1
mov eax, dword [ebp - 0x10]
pop edx
pop ecx
leave
ret

Function at 0x46cd5b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ecx
push edx
mov dword [ebp - 4], 0xffffffff
push 0
push pe_nt_image_headers32
push 4
push 0
push 0
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x46cdc6
mov dword [ebp - 8], eax
push 2
push 0
push 0
push eax
call dword [sym.imp.kernel32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x46cdbd
push dword [ebp + 0xc]
call dword [sym.imp.kernel32.dll_lstrlenW]
add eax, eax
push 0
lea edx, [ebp - 4]
push edx
push eax
push dword [ebp + 0xc]
push dword [ebp - 8]
call dword [sym.imp.kernel32.dll_WriteFile]
push dword [ebp - 8]
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop edx
pop ecx
leave
ret 8
Function at 0x46cdcf
Capabilities:
Create thread
Create udp socket
Get local ipv4 addresses
Get socket information
Initialize winsock library
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ecx
push edx
mov dword [0x404fb0], 0
push 0x4691f4
push 0x202
call dword [sym.imp.ws2_32.dll_WSAStartup]
cmp eax, 0
jne 0x46cdff
cmp byte [0x4691f4], 2
jge 0x46ce09
mov eax, 0xffffffff
jmp 0x46cf56
push 0x11
push 2
push 2
call dword [sym.imp.ws2_32.dll_socket]
cmp eax, 0xffffffff
jne 0x46ce37
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov edx, dword [0x404f2c]
push eax
pop dword [edx + 0x44]
add edx, 0x58
mov eax, 0xffffffff
jmp 0x46cf56
mov dword [0x404fb0], eax
mov dword [0x404fdc], 1
push 0x404fdc
push 0x8004667e
push eax
call dword [sym.imp.ws2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x46ce79
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov edx, dword [0x404f2c]
push eax
pop dword [edx + 0x44]
add edx, 0x58
mov eax, 0xffffffff
jmp 0x46cf56
mov word [0x4691e4], 2
push 0
call dword [sym.imp.ws2_32.dll_htonl]
mov dword [0x4691e8], eax
push dword [0x404fb4]
call dword [sym.imp.ws2_32.dll_htons]
mov word [0x4691e6], ax
mov dword [ebp - 0x18], 0x10
lea edx, [ebp - 0x18]
push edx
push 0x4691e4
push dword [0x404fb0]
call dword [sym.imp.ws2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x46cedc
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov edx, dword [0x404f2c]
push eax
pop dword [edx + 0x44]
add edx, 0x58
mov eax, 0xffffffff
jmp 0x46cf56
push 0x10
lea edx, [ebp - 0x10]
push edx
call fcn.0046c00c
mov dword [ebp - 0x18], 0x10
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x10]
push edx
push dword [0x404fb0]
call dword [sym.imp.ws2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x46cf21
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov edx, dword [0x404f2c]
push eax
pop dword [edx + 0x44]
add edx, 0x58
mov eax, 0xffffffff
jmp 0x46cf56
mov dword [0x404fd4], 1
lea edx, [ebp - 0x14]
push edx
push 0
push 0
push 0x46cfc6
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
xor eax, eax
mov ax, word [ebp - 0xe]
push eax
call dword [sym.imp.ws2_32.dll_ntohs]
pop edx
pop ecx
leave
ret
Function at 0x46d09a
Capabilities:
Receive data
Receive data on socket

Disassembly:
cmp dword [0x404fd4], 1
jne 0x46d132
cmp dword [0x404fb8], 0x3e8
jge 0x46d126
mov dword [ebp - 0x20], 0x10
push 0x10
lea edx, [ebp - 0x10]
push edx
call fcn.0046c00c
push 0xffff
push dword [ebp - 0x28]
call fcn.0046c00c
lea edx, [ebp - 0x20]
push edx
lea edx, [ebp - 0x10]
push edx
push 0
push 0xffff
push dword [ebp - 0x28]
push dword [0x404fb0]
call dword [sym.imp.ws2_32.dll_recvfrom]
cmp eax, 0
jle 0x46d126
push 0
push 0
push 0xffffffffffffffff
push dword [ebp - 0x28]
push 0
push 0xfde9
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
add eax, 1
add eax, eax
push eax
call fcn.0046bf84
mov dword [ebp - 0x24], eax
push ecx
push eax
push 0xffffffffffffffff
push dword [ebp - 0x28]
push 0
push 0xfde9
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
nop
call fcn.0046d09a
or dword [eax], eax
and byte [eax], al
or eax, 0xa00
add bh, bh
push dword [ebp - 0x24]
invalid
push dword [ebp - 0x24]
call dword [sym.imp.shlwapi.dll_StrTrimW]
push dword [ebp - 0x24]
call dword [sym.imp.kernel32.dll_lstrlenW]
cmp eax, 0
je 0x46d126
mov dword [ebp - 0x14], eax
mov ebx, dword [0x404f3c]
cmp dword [ebx + 0x50], 0
je 0x46d0c5
mov ebx, dword [ebx + 0x50]
jmp 0x46d0ba
mov eax, dword [ebp - 0x24]
mov dword [ebx + 0x44], eax
push 0x58
call fcn.0046bf84
mov dword [ebx + 0x50], eax
push dword [ebp - 0x1c]
lea edx, [ebp - 0x10]
push edx
call fcn.0046d2d8
call fcn.00472d9c
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
call 0x46d108
and eax, 0x20007300
add byte [0x20006400], ah
add byte [ebx], dh
and byte [eax], al
and eax, 0x20006400
add byte [0x39002e00], ah
add byte [eax + eax], ah
add bh, bh
jne 0x46d0f3
call dword [sym.imp.user32.dll_wsprintfW]
add esp, 0x14
push dword [ebp - 0x18]
call fcn.00472bbb
mov dword [ebx + 0x48], eax
add dword [0x404fb8], 1
push 1
call fcn.0046bcac
jmp 0x46cfed
push dword [ebp - 0x28]
call fcn.0046bff1
pop edx
pop ecx
pop ebx
pop eax
leave
ret
Function at 0x46d108
Capabilities:
Receive data
Receive data on socket

Disassembly:
cmp dword [0x404fd4], 1
jne 0x46d132
cmp dword [0x404fb8], 0x3e8
jge 0x46d126
mov dword [ebp - 0x20], 0x10
push 0x10
lea edx, [ebp - 0x10]
push edx
call fcn.0046c00c
push 0xffff
push dword [ebp - 0x28]
call fcn.0046c00c
lea edx, [ebp - 0x20]
push edx
lea edx, [ebp - 0x10]
push edx
push 0
push 0xffff
push dword [ebp - 0x28]
push dword [0x404fb0]
call dword [sym.imp.ws2_32.dll_recvfrom]
cmp eax, 0
jle 0x46d126
push 0
push 0
push 0xffffffffffffffff
push dword [ebp - 0x28]
push 0
push 0xfde9
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
add eax, 1
add eax, eax
push eax
call fcn.0046bf84
mov dword [ebp - 0x24], eax
push ecx
push eax
push 0xffffffffffffffff
push dword [ebp - 0x28]
push 0
push 0xfde9
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
nop
call fcn.0046d09a
or dword [eax], eax
and byte [eax], al
or eax, 0xa00
add bh, bh
push dword [ebp - 0x24]
invalid
push dword [ebp - 0x24]
call dword [sym.imp.shlwapi.dll_StrTrimW]
push dword [ebp - 0x24]
call dword [sym.imp.kernel32.dll_lstrlenW]
cmp eax, 0
je 0x46d126
mov dword [ebp - 0x14], eax
mov ebx, dword [0x404f3c]
cmp dword [ebx + 0x50], 0
je 0x46d0c5
mov ebx, dword [ebx + 0x50]
jmp 0x46d0ba
mov eax, dword [ebp - 0x24]
mov dword [ebx + 0x44], eax
push 0x58
call fcn.0046bf84
mov dword [ebx + 0x50], eax
push dword [ebp - 0x1c]
lea edx, [ebp - 0x10]
push edx
call fcn.0046d2d8
call fcn.00472d9c
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
call 0x46d108
and eax, 0x20007300
add byte [0x20006400], ah
add byte [ebx], dh
and byte [eax], al
and eax, 0x20006400
add byte [0x39002e00], ah
add byte [eax + eax], ah
add bh, bh
jne 0x46d0f3
call dword [sym.imp.user32.dll_wsprintfW]
add esp, 0x14
push dword [ebp - 0x18]
call fcn.00472bbb
mov dword [ebx + 0x48], eax
add dword [0x404fb8], 1
push 1
call fcn.0046bcac
jmp 0x46cfed
push dword [ebp - 0x28]
call fcn.0046bff1
pop edx
pop ecx
pop ebx
pop eax
leave
ret

Function at 0x46d1e0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push ecx
push edx
push dword [ebp + 8]
call fcn.0046d285
cmp eax, 0xffffffff
je 0x46d27e
push 0x10
lea edx, [ebp - 0x10]
push edx
call fcn.0046c00c
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov word [ebp - 0x10], 2
push dword [ebp + 0xc]
call dword [sym.imp.ws2_32.dll_htons]
mov word [ebp - 0xe], ax
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [ebp + 0x10]
push 0
push 0xfde9
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov ecx, eax
add ecx, 1
push ecx
call fcn.0046bf84
mov ebx, eax
push 0
push 0
push ecx
push ebx
push 0xffffffffffffffff
push dword [ebp + 0x10]
push 0
push 0xfde9
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
cmp eax, 0
jle 0x46d278
push 0x10
lea edx, [ebp - 0x10]
push edx
push 0
push eax
push ebx
push dword [0x404fb0]
call dword [sym.imp.ws2_32.dll_sendto]
push ebx
call fcn.0046bff1
pop edx
pop ecx
pop ebx
leave
ret 0xc
Function at 0x46d285
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ecx
push edx
push 0x20
lea edx, [ebp - 0x20]
push edx
call fcn.0046c00c
mov dword [ebp - 0x1c], 2
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x14], 0x11
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp - 0x20]
push edx
push 0
push dword [ebp + 8]
call dword [sym.imp.ws2_32.dll_GetAddrInfoW]
cmp eax, 0
jne 0x46d2cd
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0x18]
jmp 0x46d2d2
mov eax, 0xffffffff
pop edx
pop ecx
leave
ret 4
Function at 0x46e469
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push ecx
push edx
push esi
push edi
push 0x4000
call fcn.0046bf84
mov dword [ebp - 0x14], eax
add eax, 0x1000
mov dword [ebp - 0x10], eax
add eax, 0x1000
mov dword [ebp - 0xc], eax
add eax, 0x1000
mov dword [ebp - 8], eax
mov esi, dword [ebp + 8]
Function at 0x46fba6
Capabilities:
Get file size
Read file on windows

Disassembly:
call fcn.0046c505
cmp dword [0x40153c], 0
je 0x46fb73
call dword [0x401548]
push 0
push 0
push 0
call dword [sym.imp.winmm_PlaySoundW]
jmp 0x46fee8
push ebx
call dword [sym.imp.shlwapi.dll_StrTrimW]
push ebx
call dword [sym.imp.kernel32.dll_lstrlenW]
test eax, eax
je 0x46fb5f
cmp dword [ebp - 4], 1
jne 0x46fbd5
add eax, 1
add eax, eax
push eax
call fcn.0046bf84
mov edi, eax
push ebx
push eax
call dword [sym.imp.kernel32.dll_lstrcpyW]
jmp 0x46fc3e
push 0
push pe_nt_image_headers32
push 3
push 0
push 0
push 0x80000000
push ebx
call dword [sym.imp.kernel32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x46fee8
mov ebx, eax
push 0
push ebx
call dword [sym.imp.kernel32.dll_GetFileSize]
cmp eax, 0xffffffff
jne 0x46fc18
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, 0xffffffff
jmp 0x46fee8
push eax
add eax, 0x104
push eax
call fcn.0046bf84
mov edi, eax
pop eax
push 0
push 0x404fdc
push eax
push edi
push ebx
call dword [sym.imp.kernel32.dll_ReadFile]
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [ebp - 8]
mov ebx, dword [0x404f58]
call fcn.0046c4e4
cmp eax, 0xffffffff
je 0x46fc58
push dword [ebx]
call fcn.0046bff1
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [ebx], edi
mov dword [ebx + 4], eax
mov dword [ebx + 8], ecx
jmp 0x46fee8
mov edx, dword [0x404f2c]
push eax
pop dword [edx + 0x44]
add edx, 0x58
pop edi
pop edx
pop ecx
pop ebx
pop eax
leave
ret
Function at 0x46ffa9
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push eax
push ebx
push ecx
push edx
push edi
mov dword [ebp - 8], 0
lea edx, [ebp - 0x1c]
push edx
call fcn.004759ae
push 0x2c
call fcn.004767b2
lea edx, [ebp - 0x18]
push edx
call fcn.004759ae
push 0x2c
call fcn.004767b2
call fcn.00474395
mov esi, dword [0x404fac]
cmp dword [0x404f6c], 3
je 0x47001c
cmp dword [0x404f6c], 0xb
je 0x47001c
cmp dword [0x404f6c], 8
jne 0x47000f
cmp eax, 0xe1
jl 0x47000f
cmp eax, 0xf4
jle 0x47001c
cmp dword [0x404f6c], 0xa
jne 0x4700d4
lea edx, [ebp - 0xc]
push edx
call fcn.0046eb6f
push 0
push pe_nt_image_headers32
push 3
push 0
push 0
push 0x80000000
push dword [ebp - 0xc]
call dword [sym.imp.kernel32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x4701a0
mov ebx, eax
push 0
push eax
call dword [sym.imp.kernel32.dll_GetFileSize]
mov dword [ebp - 4], eax
push eax
call fcn.0046bf84
mov dword [ebp - 8], eax
push 0
push 0x404fdc
push dword [ebp - 4]
push eax
push ebx
call dword [sym.imp.kernel32.dll_ReadFile]
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov edi, dword [ebp - 8]
mov eax, dword [edi + 8]
mov ebx, dword [edi + 0xc]
mov edx, eax
imul edx, ebx
test edx, edx
jl 0x4701a0
cmp dword [ebp - 0x1c], 0
jl 0x47009b
cmp dword [ebp - 0x18], 0
jge 0x4700b4
mov edx, dword [0x404f2c]
push eax
pop dword [edx + 0x44]
add edx, 0x58
push ebx
pop dword [edx + 0x44]
add edx, 0x58
jmp 0x4701a0
add edi, 0x10
push edi
push ebx
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.0046bc0c
mov eax, dword [0x404fdc]
jmp 0x4701a0
lea edx, [ebp - 0x14]
push edx
call fcn.004759ae
push 0x2c
call fcn.004767b2
lea edx, [ebp - 0x10]
push edx
call fcn.004759ae
push 0x2c
call fcn.004767b2
lea edx, [ebp - 0xc]
push edx
call fcn.0046eb6f
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
cmp eax, 1
jl 0x4701a0
cmp ecx, 1
jl 0x4701a0
cmp dword [ebp - 0x1c], 0
jl 0x4701a0
cmp dword [ebp - 0x18], 0
jl 0x4701a0
imul eax, ecx
lea eax, [eax*4]
add eax, 0x10
mov dword [ebp - 4], eax
push eax
call fcn.0046bf84
mov dword [ebp - 8], eax
mov edi, eax
push esi
lea esi, [ebp - 0x1c]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
pop esi
push edi
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.0046bb7d
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push dword [ebp - 0xc]
call dword [sym.imp.kernel32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x4701a0
push eax
push 0
push 0x404fdc
push dword [ebp - 4]
push dword [ebp - 8]
push eax
call dword [sym.imp.kernel32.dll_WriteFile]
pop eax
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [0x404fdc]
cmp dword [ebp - 8], 0
je 0x4701ae
push dword [ebp - 8]
call fcn.0046bff1
mov edx, dword [0x404f2c]
push eax
pop dword [edx + 0x44]
add edx, 0x58
pop edi
pop edx
pop ecx
pop ebx
pop eax
leave
ret
Function at 0x4720a7
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push eax
push ebx
push ecx
push edx
lea edx, [ebp - 4]
push edx
call fcn.0046eb6f
push 0x2c
call fcn.004767b2
call fcn.00474395
cmp dword [0x404f6c], 0xb
je 0x4720d8
cmp dword [0x404f6c], 0xa
jne 0x472128
cmp dword [0x404f6c], 0xb
jne 0x4720eb
call fcn.0046c4a4
lea ebx, [eax + 0x44]
jmp 0x472106
cmp dword [0x404f6c], 0xa
jne 0x472106
lea edx, [ebp - 0xc]
push edx
call fcn.00475775
mov ebx, dword [eax + 0x44]
mov ecx, dword [ebp - 0xc]
lea ebx, [ebx + ecx*4]
push 0xfde9
push dword [ebp - 4]
call fcn.00472ed4
cmp eax, 0xffffffff
je 0x4721c4
mov dword [ebx], eax
jmp 0x4721c4
cmp dword [0x404f6c], 9
jne 0x4721ad
lea edx, [ebp - 0xc]
push edx
call fcn.00475775
mov ebx, eax
push dword [ebp - 4]
call fcn.00472d07
cmp eax, 0xffffffff
je 0x4721c4
push 0
push pe_nt_image_headers32
push 3
push 0
push 0
push 0x80000000
push eax
call dword [sym.imp.kernel32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x4721c4
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0xffffffff
push 0
push eax
call dword [sym.imp.kernel32.dll_GetFileSize]
cmp eax, 0xffffffff
je 0x47219f
mov ecx, eax
shr ecx, 2
cmp ecx, dword [ebx + 0x50]
jle 0x47218c
mov eax, dword [ebx + 0x50]
push 0
lea edx, [ebp - 0xc]
push edx
push eax
push dword [ebx + 0x44]
push dword [ebp - 8]
call dword [sym.imp.kernel32.dll_ReadFile]
push dword [ebp - 8]
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [ebp - 0xc]
jmp 0x4721c4
mov esi, dword [0x404fac]
lea edx, [ebp - 0xc]
push edx
call fcn.004759ae
push dword [ebp - 4]
call fcn.00472d07
mov edx, dword [0x404f2c]
push eax
pop dword [edx + 0x44]
add edx, 0x58
pop edx
pop ecx
pop ebx
pop eax
leave
ret

Function at 0x4721d7
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push eax
push ebx
push ecx
push edx
push edi
lea edx, [ebp - 8]
push edx
call fcn.0046eb6f
push 0x2c
call fcn.004767b2
call fcn.00474395
cmp dword [0x404f6c], 9
je 0x472209
cmp dword [0x404f6c], 0xa
jne 0x47223f
lea edx, [ebp - 0xc]
push edx
call fcn.00475775
mov edi, eax
mov ecx, dword [edi + 0x50]
lea ecx, [ecx*4]
mov dword [ebp - 0x10], ecx
push esi
push edi
push ecx
call fcn.0046bf84
mov dword [ebp - 4], eax
mov esi, dword [edi + 0x44]
mov edi, eax
lodsb al, byte [esi]
stosb byte es:[edi], al
sub ecx, 1
jne 0x472231
pop edi
pop esi
jmp 0x472304
cmp dword [0x404f6c], 3
je 0x472271
cmp dword [0x404f6c], 0xb
je 0x472271
cmp dword [0x404f6c], 8
jne 0x472268
cmp eax, 0xe1
jl 0x472268
cmp eax, 0xf4
jle 0x472271
cmp dword [0x404f6c], 0xa
jne 0x4722ee
mov esi, dword [0x404fac]
lea edx, [ebp - 0xc]
push edx
call fcn.0046eb6f
push dword [ebp - 8]
call dword [sym.imp.shlwapi.dll_PathFindExtensionW]
call fcn.00472298
add byte cs:[ecx], ah
outsb dx, byte [esi]
add byte [ebx], dh
add byte [eax], al
mov esi, dword [0x404fac]
lea edx, [ebp - 0xc]
push edx
call fcn.004759ae
mov eax, 0xffffffff
jmp 0x47234b
Function at 0x472298
Capabilities:
Write file on windows

Disassembly:
push eax
call dword [sym.imp.kernel32.dll_lstrcmpiW]
mov ebx, 0xfde9
cmp eax, 0
jne 0x4722ae
mov ebx, 0x2e1
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [ebp - 0xc]
push 0
push ebx
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov ecx, eax
add ecx, 1
push ecx
call fcn.0046bf84
mov dword [ebp - 4], eax
push 0
push 0
push ecx
push eax
push 0xffffffffffffffff
push dword [ebp - 0xc]
push 0
push ebx
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
sub eax, 1
mov dword [ebp - 0x10], eax
jmp 0x472304
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push dword [ebp - 8]
call dword [sym.imp.kernel32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x47234b
push eax
push 0
lea edx, [ebp - 0xc]
push edx
push dword [ebp - 0x10]
push dword [ebp - 4]
push eax
call dword [sym.imp.kernel32.dll_WriteFile]
pop eax
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
push dword [ebp - 4]
call fcn.0046bff1
mov eax, dword [ebp - 0xc]
mov edx, dword [0x404f2c]
push eax
pop dword [edx + 0x44]
add edx, 0x58
pop edi
pop edx
pop ecx
pop ebx
pop eax
leave
ret

Function at 0x47235f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push eax
push ecx
push edx
lea edx, [ebp - 0x10]
push edx
call fcn.0046eb6f
push 0x2c
call fcn.004767b2
lea edx, [ebp - 0xc]
push edx
call fcn.0046eb6f
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [ebp - 0xc]
push 0
push 0xfde9
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov ecx, eax
add ecx, 1
push ecx
call fcn.0046bf84
mov dword [ebp - 8], eax
push 0
push 0
push ecx
push eax
push 0xffffffffffffffff
push dword [ebp - 0xc]
push 0
push 0xfde9
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
sub eax, 1
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0xffffffff
push 0
push pe_nt_image_headers32
push 4
push 0
push 0
push 0x40000000
push dword [ebp - 0x10]
call dword [sym.imp.kernel32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x472421
mov dword [ebp - 0x14], eax
push 2
push 0
push 0
push eax
call dword [sym.imp.kernel32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x472418
push 0
lea edx, [ebp - 0xc]
push edx
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_WriteFile]
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_CloseHandle]
push dword [ebp - 8]
call fcn.0046bff1
mov edx, dword [0x404f2c]
push dword [ebp - 0xc]
pop dword [edx + 0x44]
add edx, 0x58
pop edx
pop ecx
pop eax
leave
ret