joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4165f5
Capabilities:
Create directory

Disassembly:
push ebx
push esi
mov ebx, eax
lea eax, [edi + 0x110]
mov esi, ecx
push eax
push esi
call fcn.0042df63
pop ecx
pop ecx
test al, al
jne 0x416618
mov eax, 0x8007000e
jmp 0x4166eb
cmp ebx, dword [edi + 0x114]
je 0x416647
test ebx, ebx
je 0x41662b
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
mov ecx, dword [edi + 0x114]
test ecx, ecx
je 0x416641
mov eax, dword [ecx]
call dword [eax + 8]
and dword [edi + 0x114], 0
mov dword [edi + 0x114], ebx
cmp dword [edi + 0x114], 0
jne 0x416665
push 0x4890c8
call fcn.00416f04
pop ecx
mov eax, 0x80070057
jmp 0x4166eb
push esi
call fcn.0041681c
pop ecx
mov byte [edi + 0x118], al
test al, al
je 0x416683
push str.extraction_was_completed_in_a_previous_session____nothing_extracted
call fcn.00416edc
pop ecx
jmp 0x4166ba
push 0
xor bl, bl
call fcn.004077cb
pop ecx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4166ba
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0xb7
je 0x4166ba
call ebx
push eax
push esi
push str.CInstallUnpacker::ExtractPackage_48__:_failed_to_create_directory:__s___lu_
call fcn.00416f04
add esp, 0xc
mov edx, dword [esp + 0xc]
mov ecx, edi
call fcn.0040496f
mov ebx, eax
test ebx, ebx
jl 0x4166e9
cmp byte [edi + 0x118], 0
jne 0x4166e9
push esi
call fcn.00416791
test al, al
jne 0x4166e9
push str.CInstallUnpacker::ExtractPackage_58__:_failed_to_write_extraction_complete_flag
call fcn.00416f04
pop ecx
mov eax, ebx
pop esi
pop ebx
ret 4

Function at 0x41681c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x497a28
lea ecx, [ebp - 4]
call fcn.004037fc
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.0042df63
pop ecx
pop ecx
test al, al
jne 0x41684e
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.00403af7
xor al, al
leave
ret
push ebx
lea eax, [ebp - 4]
push str.extract.dat
push eax
call fcn.0042e4ce
pop ecx
pop ecx
test al, al
jne 0x416875
xor bl, bl
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.00403af7
mov al, bl
pop ebx
leave
ret
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
jmp 0x416865

Function at 0x416886
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push dword [ebp + 8]
call fcn.0041681c
pop ecx
test al, al
jne 0x41689b
inc al
leave
ret
push 0x497a28
lea ecx, [ebp - 4]
call fcn.004037fc
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.0042df63
pop ecx
pop ecx
test al, al
jne 0x4168c9
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.00403af7
xor al, al
leave
ret
push ebx
lea eax, [ebp - 4]
push str.extract.dat
push eax
call fcn.0042e4ce
pop ecx
pop ecx
test al, al
jne 0x4168f0
xor bl, bl
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.00403af7
mov al, bl
pop ebx
leave
ret
push 0x80
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
jmp 0x4168e0
Function at 0x417da6
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
jne 0x417db4
push 0xd
pop eax
jmp 0x417de7
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x417dbb
mov eax, dword [ebp + 8]
push edi
push dword [ebp + 0x10]
push 7
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x41821e
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x4960a8]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov ecx, dword [esi + 4]
push edi
or ecx, 0x2001f
push ecx
push eax
push dword [esi]
xor edi, edi
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x214], edi
mov dword [ebp - 0x210], edi
call fcn.004181dd
mov ebx, eax
cmp ebx, edi
je 0x418289
lea ecx, [ebp - 0x214]
call fcn.00418335
mov eax, ebx
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00459871
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x4182a7
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x214]
call fcn.0041821e
cmp eax, edi
jne 0x4182ec
lea eax, [ebp - 0x224]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
push dword [ebp - 0x214]
mov dword [ebp - 0x218], 0x100
call ebx
test eax, eax
je 0x418291
lea ecx, [ebp - 0x214]
call fcn.00418335
push dword [ebp - 0x21c]
call fcn.00418355
lea ecx, [ebp - 0x214]
mov esi, eax
call fcn.00418335
mov eax, esi
jmp 0x418278

Function at 0x418355
Capabilities:
Delete registry key

Disassembly:
cmp byte [0x498cb8], 0
jne 0x418385
push 0x48a0c4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41837e
push str.RegDeleteKeyExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x498cbc], eax
mov byte [0x498cb8], 1
mov eax, dword [0x498cbc]
test eax, eax
je 0x41839d
push 0
push dword [esi + 4]
push dword [esp + 0xc]
push dword [esi]
call eax
jmp 0x4183a9
push dword [esp + 4]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
ret 4
Function at 0x41d3e5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x41d40f
push dword [ebp + 8]
push str.C7zArchive::Open_176__:_failed_to_open_archive__file_not_found_:__s
call fcn.00416f04
pop ecx
pop ecx
mov eax, 0x80070002
jmp 0x41d4eb
push esi
lea esi, [ebx + 0x14]
mov ecx, dword [esi]
push edi
test ecx, ecx
jne 0x41d436
call fcn.0042cb80
mov edi, eax
call fcn.004046e4
mov ecx, dword [esi]
test ecx, ecx
jne 0x41d436
mov eax, 0x8007000e
jmp 0x41d4e9
call fcn.0042caea
mov edi, eax
xor eax, eax
push eax
push 0x8000000
push 3
push eax
push eax
push SysReAllocString
push dword [ebp + 8]
mov ecx, edi
call fcn.0042d0bc
test eax, eax
jne 0x41d48b
mov ecx, edi
call fcn.0042d07f
push eax
push dword [ebp + 8]
push str.C7zArchive::Open_199__:_failed_to_open_file:__s___lu_
call fcn.00416f04
add esp, 0xc
mov ecx, edi
call fcn.0042d07f
test eax, eax
jle 0x41d4e9
and eax, 0xffff
or eax, 0x80070000
jmp 0x41d4e9
mov esi, dword [esi]
test esi, esi
je 0x41d496
add esi, 8
jmp 0x41d498
xor esi, esi
push esi
lea ecx, [ebx + 0x18]
call fcn.0041e45b
mov eax, dword [ebx + 0x10]
mov edx, dword [eax]
lea ecx, [ebx + 4]
push ecx
push 0
push ebx
push eax
call dword [edx + 0xc]
mov esi, eax
test esi, esi
jge 0x41d4cc
push esi
push dword [ebp + 8]
push str.C7zArchive::Open_211__:_failed_to_open_archive:__s__0x_08x_
call fcn.00416f04
add esp, 0xc
mov eax, esi
jmp 0x41d4e9
cmp esi, 1
jne 0x41d4e7
push dword [ebp + 8]
push str.C7zArchive::Open_216__:_failed_to_open_file_archive:__s__S_FALSE_
call fcn.00416f04
pop ecx
pop ecx
mov eax, 0x80047c74
jmp 0x41d4e9
xor eax, eax
pop edi
pop esi
pop ebp
ret 4

Function at 0x41fb29
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [esi + 4], 0x48bf24
push edi
xor edi, edi
mov dword [esi + 8], edi
mov dword [esi], 0x48bffc
mov dword [esi + 4], 0x48c030
lea eax, [esi + 0x10]
mov dword [esi + 0xc], edi
call fcn.0041fb92
lea eax, [esi + 0x1e8]
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], 8
mov dword [eax], 0x48bfd0
lea eax, [ebp - 0x24]
push eax
mov dword [esi + 0x1e4], 4
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x10]
mov dword [esi + 0x1e0], eax
mov eax, esi
pop edi
leave
ret
Function at 0x426edd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
mov edx, dword [edx]
sub esp, 0xc
xor eax, eax
and edx, 7
cmp ecx, 5
jae 0x426ef4
leave
ret
add dword [ebp + 0xc], 5
or dword [ebp - 4], 0xffffffff
push ebx
push esi
mov esi, dword [ebp + 8]
lea ecx, [esi + ecx - 4]
push edi
mov dword [ebp - 8], ecx
lea edi, [eax + esi]
jmp 0x426f17
mov al, byte [edi]
and al, 0xfe
cmp al, 0xe8
je 0x426f1c
inc edi
cmp edi, dword [ebp - 8]
jb 0x426f0e
mov eax, edi
sub eax, esi
cmp edi, dword [ebp - 8]
jae 0x42700b
mov ecx, eax
sub ecx, dword [ebp - 4]
cmp ecx, 3
jbe 0x426f9e
xor edx, edx
mov cl, byte [edi + 4]
mov dword [ebp - 4], eax
test cl, cl
je 0x426f48
cmp cl, 0xff
jne 0x426fcd
movzx esi, cl
movzx ecx, byte [edi + 3]
shl esi, 8
or esi, ecx
movzx ecx, byte [edi + 2]
shl esi, 8
or esi, ecx
movzx ecx, byte [edi + 1]
shl esi, 8
or esi, ecx
sub esi, eax
sub esi, dword [ebp + 0xc]
mov ebx, esi
mov dword [ebp - 0xc], ebx
test edx, edx
je 0x426fde
movzx esi, byte [edx + 0x47baec]
push 0x18
shl esi, 3
pop ecx
sub ecx, esi
shr ebx, cl
test bl, bl
je 0x426f8e
cmp bl, 0xff
jne 0x426fdb
push 0x20
pop ecx
sub ecx, esi
xor esi, esi
inc esi
shl esi, cl
dec esi
xor esi, dword [ebp - 0xc]
jmp 0x426f66
dec ecx
shl edx, cl
and edx, 7
je 0x426f35
movzx ecx, byte [edx + 0x47baec]
mov ebx, edi
sub ebx, ecx
cmp byte [edx + 0x47bae4], 0
mov cl, byte [ebx + 4]
je 0x426fca
test cl, cl
je 0x426fca
cmp cl, 0xff
jne 0x426f35
mov dword [ebp - 4], eax
and edx, 3
add edx, edx
or edx, 1
inc eax
jmp 0x426f09
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp + 8]
mov ecx, ebx
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [edi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [edi + 3], cl
mov ecx, ebx
shr ecx, 8
mov byte [edi + 2], cl
mov byte [edi + 1], bl
add eax, 5
jmp 0x426f09
mov esi, eax
sub esi, dword [ebp - 4]
push 3
lea ecx, [esi - 1]
shl edx, cl
pop edi
and edx, 7
cmp edi, esi
sbb ecx, ecx
not ecx
pop edi
and ecx, edx
mov edx, dword [ebp + 0x10]
pop esi
mov dword [edx], ecx
pop ebx
leave
ret
Function at 0x4292ad
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
lea eax, [esi + 4]
xor ebx, ebx
cmp dword [eax], ebx
jne 0x4292c7
push ebx
push ebx
push eax
call fcn.004286c0
add esp, 0xc
cmp eax, ebx
jne 0x429324
push edi
lea edi, [esi + 8]
cmp dword [edi], ebx
jne 0x4292de
push ebx
push ebx
push edi
call fcn.004286c0
add esp, 0xc
cmp eax, ebx
jne 0x429323
lea eax, [esi + 4]
call fcn.00429262
mov eax, edi
call fcn.00429262
mov byte [esi + 0x10], bl
cmp dword [esi + 0xc], ebx
je 0x4292f9
xor eax, eax
jmp 0x429323
lea eax, [esp + 8]
push eax
push ebx
push esi
push 0x42927d
push ebx
push ebx
call fcn.0045cf66
add esp, 0x18
mov dword [esi + 0xc], eax
cmp eax, ebx
jne 0x4292f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jne 0x429323
xor eax, eax
inc eax
pop edi
pop ebx
pop ecx
ret

Function at 0x42a8be
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
call fcn.0042a74e
test eax, eax
jne 0x42a90b
mov eax, dword [0x497644]
cmp eax, 0x497644
je 0x42a906
test byte [eax + 0x1c], 1
je 0x42a906
cmp byte [eax + 0x19], 2
jb 0x42a906
lea ecx, [esi + 0x14]
call fcn.0042a4bd
push dword [eax]
mov eax, dword [0x497644]
push 0x4724f4
push 0x12
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0042a72b
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
lea ecx, [esi + 0x14]
call fcn.0042a4a7
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop esi
ret

Function at 0x42a96d
Capabilities:
Terminate thread

Disassembly:
push esi
push edi
xor edi, edi
mov esi, ecx
inc edi
call fcn.0042a74e
test eax, eax
je 0x42a9da
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
push dword [esp + 0xc]
mov ecx, esi
call fcn.0042a91c
test eax, eax
jne 0x42a9da
mov eax, dword [0x497644]
cmp eax, 0x497644
je 0x42a9c7
test byte [eax + 0x1c], 1
je 0x42a9c7
cmp byte [eax + 0x19], 2
jb 0x42a9c7
push dword [esi + 0x3c]
push dword [esp + 0x10]
push 0x4724f4
push 0x13
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.004402b1
add esp, 0x18
push 0xffffffffffffffff
lea ecx, [esi + 0x14]
call fcn.0042a4a7
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
xor edi, edi
lea ecx, [esi + 0x14]
call fcn.0042a4c1
mov eax, edi
pop edi
pop esi
ret 4
Function at 0x42ae37
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 4]
lea ebx, [esi + 0x14]
mov ecx, ebx
call fcn.0042a4c1
xor edi, edi
push edi
lea ecx, [esi + 4]
call fcn.0043e71b
mov dword [esi + 0x38], edi
cmp dword [esi + 0x30], edi
je 0x42aec0
lea ecx, [esi + 0xc]
call fcn.0042a5f3
test eax, eax
jne 0x42aeb8
push 1
push edi
push edi
push edi
push 1
push edi
lea ecx, [esi + 0xc]
call fcn.0042b355
test eax, eax
jne 0x42aeb8
mov eax, dword [0x497644]
cmp eax, 0x497644
je 0x42aeb1
test byte [eax + 0x1c], 1
je 0x42aeb1
cmp byte [eax + 0x19], 2
jb 0x42aeb1
push 0x4724f4
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0040d1fe
add esp, 0x10
xor eax, eax
jmp 0x42b04d
lea ecx, [esi + 0xc]
call fcn.0042b25d
cmp dword [esi + 0x24], edi
je 0x42af2d
mov eax, dword [ebp + 0x10]
lea edi, [esi + 0x3c]
push edi
or eax, 4
push eax
push esi
push 0x42ad66
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
mov ecx, ebx
call fcn.0042a572
mov ecx, ebx
call fcn.0042a4ab
test al, al
jne 0x42afa3
mov eax, dword [0x497644]
cmp eax, 0x497644
je 0x42afa3
test byte [eax + 0x1c], 1
je 0x42afa3
cmp byte [eax + 0x19], 2
jb 0x42afa3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4724f4
push 0xd
jmp 0x42af90
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0x10]
or eax, 4
push eax
push esi
push 0x42ad4c
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
push dword [ebp + 8]
call fcn.0045cf66
add esp, 0x18
push eax
mov ecx, ebx
call fcn.0042a572
mov eax, dword [ebp - 4]
lea edi, [esi + 0x3c]
mov ecx, ebx
mov dword [edi], eax
call fcn.0042a4ab
test al, al
jne 0x42afa3
mov eax, dword [0x497644]
cmp eax, 0x497644
je 0x42afa3
test byte [eax + 0x1c], 1
je 0x42afa3
cmp byte [eax + 0x19], 2
jb 0x42afa3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4724f4
push 0xe
mov eax, dword [0x497644]
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0042a72b
add esp, 0x14
mov ecx, ebx
call fcn.0042a4ab
test al, al
je 0x42aeb1
mov eax, dword [0x497644]
mov ebx, 0x497644
cmp eax, ebx
je 0x42afef
test byte [eax + 0x1c], 1
je 0x42afef
cmp byte [eax + 0x19], 4
jb 0x42afef
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
mov eax, dword [0x497644]
push 0x4724f4
push 0xf
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.004402b1
add esp, 0x18
xor edi, edi
inc edi
test byte [ebp + 0x10], 4
jne 0x42b043
mov ecx, esi
call fcn.0042a8be
cmp dword [esi + 0x30], 0
je 0x42b043
push dword [esi + 0x28]
lea ecx, [esi + 0xc]
mov eax, dword [ecx]
push 0xffffffffffffffff
call dword [eax + 4]
mov edi, dword [esi + 0x38]
test edi, edi
jne 0x42b043
mov eax, dword [0x497644]
cmp eax, ebx
je 0x42b043
test byte [eax + 0x1c], 1
je 0x42b043
cmp byte [eax + 0x19], 2
jb 0x42b043
push 0x4724f4
push 0x10
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0040d1fe
add esp, 0x10
lea ecx, [esi + 0xc]
call fcn.0042b1fd
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x42c8b4
Capabilities:
Get system information on windows

Disassembly:
cmp byte [0x497bf0], 0
jne 0x42c958
push esi
push edi
mov edi, 0x11c
push edi
push 0
mov esi, 0x497aa8
push esi
call fcn.0045b990
add esp, 0xc
mov dword [0x497aa8], edi
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push esi
call edi
test eax, eax
jne 0x42c936
push esi
mov dword [0x497aa8], 0x114
call edi
test eax, eax
jne 0x42c936
mov eax, dword [0x497644]
cmp eax, 0x497644
je 0x42c936
test byte [eax + 0x1c], 1
je 0x42c936
cmp byte [eax + 0x19], 2
jb 0x42c936
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x497644]
push 0x472618
push 0x19
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0042a72b
add esp, 0x14
push 0x24
push 0
mov esi, 0x497bc4
push esi
call fcn.0045b990
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
pop edi
mov byte [0x497bf0], 1
pop esi
mov al, 1
ret

Function at 0x42cdf8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 8]
mov esi, ecx
lea ecx, [esi + 4]
call fcn.0042a4a7
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42ce2e
cmp dword [ebp - 4], edi
jne 0x42ce2e
xor eax, eax
inc eax
jmp 0x42ce69
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0xc], eax
mov ecx, dword [0x497644]
cmp ecx, 0x497644
je 0x42ce67
test byte [ecx + 0x1c], 1
je 0x42ce67
cmp byte [ecx + 0x19], 2
jb 0x42ce67
push eax
push 0x4726ac
push 0xe
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0042a72b
add esp, 0x14
xor eax, eax
pop edi
pop esi
leave
ret 8

Function at 0x42ce6f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 8]
mov esi, ecx
lea ecx, [esi + 4]
call fcn.0042a4a7
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x42cea5
cmp dword [ebp - 4], edi
jne 0x42cea5
xor eax, eax
inc eax
jmp 0x42cee0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0xc], eax
mov ecx, dword [0x497644]
cmp ecx, 0x497644
je 0x42cede
test byte [ecx + 0x1c], 1
je 0x42cede
cmp byte [ecx + 0x19], 2
jb 0x42cede
push eax
push 0x4726ac
push 0xf
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0042a72b
add esp, 0x14
xor eax, eax
pop edi
pop esi
leave
ret 8

Function at 0x42cf08
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
xor eax, eax
push eax
lea edx, [ebp - 4]
push edx
push eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
add ecx, 4
call fcn.0042a4a7
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
neg eax
leave
ret
Function at 0x42cf36
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
and dword [esi], 0
and dword [esi + 4], 0
push edi
mov edi, ecx
lea eax, [ebp - 4]
push eax
lea ecx, [edi + 4]
call fcn.0042a4a7
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x42cfa5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0xc], eax
test eax, eax
je 0x42cfa5
mov ecx, dword [0x497644]
cmp ecx, 0x497644
je 0x42cfa1
test byte [ecx + 0x1c], 1
je 0x42cfa1
cmp byte [ecx + 0x19], 2
jb 0x42cfa1
push eax
push 0x4726ac
push 0x11
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0042a72b
add esp, 0x14
xor eax, eax
jmp 0x42cfb3
mov eax, dword [ebp - 8]
mov dword [esi], eax
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
xor eax, eax
inc eax
pop edi
pop esi
leave
ret 4

Function at 0x42d1f7
Capabilities:
Clear file content

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, ecx
push dword [esp + 0xc]
call fcn.0042d06d
test eax, eax
je 0x42d223
lea ecx, [esi + 4]
call fcn.0042a4a7
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x42d223
xor eax, eax
inc eax
jmp 0x42d25e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0xc], eax
mov ecx, dword [0x497644]
cmp ecx, 0x497644
je 0x42d25c
test byte [ecx + 0x1c], 1
je 0x42d25c
cmp byte [ecx + 0x19], 2
jb 0x42d25c
push eax
push 0x4726ac
push 0x12
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0042a72b
add esp, 0x14
xor eax, eax
pop esi
ret 8
Function at 0x42d372
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push 0x74
mov eax, 0x46d72f
call fcn.0045d4e7
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x60]
call fcn.0042a635
and dword [ebp - 4], 0
push esi
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
inc eax
push eax
lea ecx, [ebp - 0x78]
call fcn.0042d335
push 0
lea ecx, [ebp - 0x78]
call fcn.0042d288
mov edi, eax
push esi
push edi
mov dword [ebp - 0x38], edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push edi
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsUNCW]
test eax, eax
je 0x42d3dd
push edi
call dword [sym.imp.SHLWAPI.dll_PathSkipRootW]
push eax
push edi
call dword [sym.imp.USER32.dll_CharPrevW]
jmp 0x42d3e7
push 0x5c
push edi
call fcn.0045bf7c
pop ecx
pop ecx
xor ebx, ebx
inc ebx
mov edi, 0x497644
mov esi, 0x4726ac
mov dword [ebp - 0x3c], eax
test eax, eax
je 0x42d565
test ebx, ebx
je 0x42d565
push dword [ebp - 0x38]
xor ecx, ecx
mov word [eax], cx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x42d513
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x42d4b0
cmp eax, 3
je 0x42d4b0
cmp eax, 5
jne 0x42d481
mov eax, dword [0x497644]
cmp eax, edi
je 0x42d462
test byte [eax + 0x1c], 1
je 0x42d462
cmp byte [eax + 0x19], 3
jb 0x42d462
push 5
push dword [ebp - 0x38]
push esi
push 0x18
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0042b189
add esp, 0x18
mov eax, dword [ebp - 0x3c]
push 0x5c
pop ecx
push eax
mov word [eax], cx
call dword [sym.imp.USER32.dll_CharNextW]
push 0x5c
push eax
call fcn.0045bf7c
pop ecx
pop ecx
jmp 0x42d3f4
mov ecx, dword [0x497644]
cmp ecx, edi
je 0x42d4ac
test byte [ecx + 0x1c], 1
je 0x42d4ac
cmp byte [ecx + 0x19], 2
jb 0x42d4ac
push eax
push dword [ebp - 0x38]
push esi
push 0x19
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0042b189
add esp, 0x18
xor ebx, ebx
jmp 0x42d462
push 0
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, eax
test ebx, ebx
jne 0x42d462
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x497644]
cmp ecx, edi
je 0x42d4f2
test byte [ecx + 0x1c], 1
je 0x42d4f2
cmp byte [ecx + 0x19], 2
jb 0x42d4f2
push eax
push dword [ebp - 0x38]
push esi
push 0x17
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0042b189
add esp, 0x18
lea ecx, [ebp - 0x78]
call fcn.00457462
push dword [ebp - 0x78]
call fcn.0041cd48
pop ecx
lea ecx, [ebp - 0x60]
call fcn.0042a615
xor eax, eax
call fcn.0045d543
ret
test al, 0x10
jne 0x42d462
mov ecx, dword [0x497644]
cmp ecx, edi
je 0x42d546
test byte [ecx + 0x1c], 1
je 0x42d546
cmp byte [ecx + 0x19], 2
jb 0x42d546
push eax
push dword [ebp - 0x38]
push esi
push 0x1a
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0042b189
add esp, 0x18
lea ecx, [ebp - 0x78]
call fcn.00457462
push dword [ebp - 0x78]
call fcn.0041cd48
xor esi, esi
pop ecx
lea ecx, [ebp - 0x60]
call fcn.0042a615
mov eax, esi
jmp 0x42d50d
lea ecx, [ebp - 0x78]
call fcn.00457462
push dword [ebp - 0x78]
call fcn.0041cd48
mov esi, ebx
jmp 0x42d558
Function at 0x42f8b6
Capabilities:
Get system information on windows

Disassembly:
push esi
mov esi, ecx
call fcn.0042f55d
mov ecx, dword [0x497c48]
test ecx, ecx
jne 0x42f8d9
push 0x497c44
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [0x497c48]
mov eax, dword [esp + 8]
xor edx, edx
div ecx
push ebx
xor ebx, ebx
push 4
cmp ebx, edx
sbb edx, edx
imul eax, ecx
and edx, ecx
add edx, eax
pop eax
push eax
push 0x1000
push edx
push ebx
mov dword [esi + 8], edx
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [esi + 0xc], eax
pop ebx
test eax, eax
jne 0x42f945
mov eax, dword [0x497644]
cmp eax, 0x497644
je 0x42f93b
test byte [eax + 0x1c], 1
je 0x42f93b
cmp byte [eax + 0x19], 2
jb 0x42f93b
push 0x472a68
push 0xe
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0040d1fe
add esp, 0x10
and dword [esi + 8], 0
and dword [esi + 4], 0
jmp 0x42f950
push dword [esi + 8]
mov edx, dword [esi]
push eax
mov ecx, esi
call dword [edx + 4]
mov eax, dword [esi + 0xc]
pop esi
ret 4