joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5e42f0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x150000]
push edi
or ebp, 0xffffffff
jmp 0x5e4312
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5e4319
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5e4308
mov eax, 1
add ebx, ebx
jne 0x5e432b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5e433c
jne 0x5e435b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5e435b
dec eax
add ebx, ebx
jne 0x5e4348
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5e4320
add ebx, ebx
jne 0x5e4357
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x5e43ad
xor ecx, ecx
sub eax, 3
jb 0x5e4373
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5e43e2
sar eax, 1
mov ebp, eax
jmp 0x5e437e
add ebx, ebx
jne 0x5e437e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5e434c
inc ecx
add ebx, ebx
jne 0x5e438c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5e434c
add ebx, ebx
jne 0x5e4399
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5e438e
jne 0x5e43aa
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5e438e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5e43cc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5e43be
jmp 0x5e430e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5e43cc
add edi, ecx
jmp 0x5e430e
pop esi
mov edi, esi
mov ecx, 0x37e4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5e43ea
cmp byte [edi], 0x13
jne 0x5e43ea
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5e43ef
lea edi, [esi + 0x1e1000]
mov eax, dword [edi]
or eax, eax
je 0x5e4467
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1f7bfc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1f7cc0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5e441c
mov ecx, edi
jns 0x5e444b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1f7cc8]
or eax, eax
je 0x5e4461
mov dword [ebx], eax
add ebx, 4
jmp 0x5e4439
call dword [esi + 0x1f7cc4]
mov ebp, dword [esi + 0x1f7ccc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x5e449b
sub esp, 0xffffff80
jmp 0x46f1ee
Function at 0x401c00
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x4063a0]
test esi, esi
jle 0x401d10
mov edi, dword [0x4063a4]
xor ebx, ebx
lea edx, [edi + 0xc]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x401c34
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x401cb5
add ebx, 1
add edx, 0x14
cmp ebx, esi
jne 0x401c20
mov dword [esp], eax
mov ebx, eax
call sym.___mingw_GetSectionForAddress
test eax, eax
mov edi, eax
je 0x401d37
mov eax, dword [0x4063a4]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call sym.__GetPEImageBase
add eax, dword [edi + 0xc]
mov edx, dword [0x4063a4]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401d17
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x401cae
sub eax, 4
and eax, 0xfffffffb
jne 0x401cc0
add dword [0x4063a0], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
add ebx, dword [0x4063a4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x401cae
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call sym.___report_error
lea esi, [esi]
xor esi, esi
jmp 0x401c3e
mov eax, dword [0x4063a4]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call sym.___report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call sym.___report_error
mov esi, esi
lea edi, [edi]

Function at 0x402170
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x4063b8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x4063b0]
sub esp, 4
test ebx, ebx
je 0x4021c5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x4021be
test esi, esi
je 0x4021be
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4021a0
mov dword [esp], 0x4063b8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x402888
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call sym.___acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call sym.___acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x1000eb90
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
movsd xmm0, qword [0x10037db8]
sub esp, 8
movsd qword [0x1003a920], xmm0
movsd xmm0, qword [0x10037dd8]
movsd qword [0x1003a910], xmm0
movsd xmm0, qword [0x10037dc0]
push ebx
push edi
mov edi, edx
movsd qword [0x1003a928], xmm0
movsd xmm0, qword [0x10037db0]
mov ebx, ecx
movsd qword [0x1003a918], xmm0
mov eax, edi
mov dword [edi + 0x10], 0
cmp dword [edi + 0x14], 0x10
jb 0x1000ebed
mov eax, dword [edi]
push 0
mov byte [eax], 0
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x16
push dword [ebx + 0xc]
mov dword [ebp - 4], 0
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
movsd xmm4, qword [0x1003a918]
movsd xmm5, qword [0x10037da8]
movaps xmm1, xmm4
movsd xmm6, qword [0x1003a928]
addsd xmm1, xmm5
movaps xmm0, xmm6
movsd xmm3, qword [0x1003a910]
movsd xmm2, qword [0x1003a920]
divsd xmm0, xmm1
movaps xmm1, xmm4
subsd xmm3, xmm0
movaps xmm0, xmm2
addsd xmm0, xmm5
movsd qword [0x1003a910], xmm3
divsd xmm1, xmm0
movaps xmm0, xmm3
subsd xmm6, xmm1
movaps xmm1, xmm2
addsd xmm0, xmm5
movsd qword [0x1003a928], xmm6
addsd xmm6, xmm5
divsd xmm1, xmm0
divsd xmm3, xmm6
subsd xmm4, xmm1
subsd xmm2, xmm3
movsd qword [0x1003a918], xmm4
movsd qword [0x1003a920], xmm2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1000edb0
mov eax, dword [ebp - 4]
xor ecx, ecx
shr eax, 1
mov edx, 2
mul edx
push esi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1001e38d
add esp, 4
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
push 0
push 0x16
push dword [ebx + 0xc]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
mov ecx, esi
call fcn.1000aaf0
push esi
mov ebx, eax
call fcn.1001e327
mov ecx, ebx
add esp, 4
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000ecf1
mov eax, dword [edi + 0x14]
sub ecx, edx
mov edx, dword [edi + 0x10]
sub eax, edx
cmp ecx, eax
ja 0x1000ed28
cmp dword [edi + 0x14], 0x10
lea esi, [ecx + edx]
mov dword [edi + 0x10], esi
jb 0x1000ed14
mov edi, dword [edi]
push ecx
lea eax, [edx + edi]
push ebx
push eax
call fcn.10021000
add esp, 0xc
mov byte [edi + esi], 0
jmp 0x1000ed39
push ecx
push ebx
mov byte [ebp - 8], 0
push dword [ebp - 8]
push ecx
mov ecx, edi
call fcn.1000a850
push ebx
call fcn.1001e327
movsd xmm3, qword [0x1003a928]
add esp, 4
movsd xmm1, qword [0x1003a918]
movaps xmm4, xmm3
mulsd xmm4, qword [0x1003a910]
movaps xmm2, xmm1
xor eax, eax
mulsd xmm2, xmm3
pop esi
pop edi
addsd xmm4, qword [0x1003a920]
pop ebx
addsd xmm2, qword [0x1003a910]
movaps xmm0, xmm4
movsd qword [0x1003a920], xmm4
mulsd xmm0, xmm1
movsd qword [0x1003a910], xmm2
mulsd xmm2, xmm4
addsd xmm0, xmm3
addsd xmm2, xmm1
movsd qword [0x1003a928], xmm0
movsd qword [0x1003a918], xmm2
mov esp, ebp
pop ebp
ret
pop edi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10012150
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x1003a008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10c], ecx
xor eax, eax
lea ecx, [ebp - 0x104]
xor bh, bh
mov dword [ebp - 0x108], eax
xor esi, esi
sub edi, ecx
lea ecx, [ebp - 0x104]
xor edx, edx
add ecx, esi
mov byte [edi + ecx], al
mov eax, esi
div dword [ebp + 8]
inc esi
mov al, byte [edx + 0x1003ad40]
mov byte [ecx], al
mov ecx, 0x100
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp ax, cx
jb 0x10012182
mov edx, dword [ebp - 0x10c]
lea edi, [ebp - 0x104]
mov eax, edx
sub edi, edx
mov esi, ecx
mov bl, byte [eax]
lea eax, [eax + 1]
movzx ecx, byte [edi + eax - 1]
add cl, bl
add bh, cl
movzx ecx, bh
add edx, ecx
movzx ecx, byte [edx]
mov byte [eax - 1], cl
mov byte [edx], bl
mov edx, dword [ebp - 0x10c]
sub esi, 1
jne 0x100121c6
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001e319
mov esp, ebp
pop ebp
ret

Function at 0x10012200
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
test edx, edx
je 0x1001225f
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x1001225e
push ebx
push esi
xor bh, bh
xor esi, esi
mov byte [ebp - 1], bh
test edi, edi
je 0x1001225c
mov al, byte [ebp - 1]
inc bh
movzx edx, bh
add edx, ecx
mov bl, byte [edx]
add al, bl
mov byte [ebp - 1], al
movzx eax, al
add ecx, eax
movzx eax, byte [ecx]
mov byte [edx], al
mov byte [ecx], bl
movzx eax, byte [edx]
mov ecx, dword [ebp - 8]
add al, bl
mov edx, dword [ebp - 0xc]
movzx eax, al
movzx eax, byte [eax + ecx]
xor byte [esi + edx], al
inc esi
cmp esi, edi
jb 0x10012225
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x1001bbc0
Capabilities:
Encode data using xor
Terminate process

Disassembly:
movsd xmm5, qword [0x1003a920]
movsd xmm3, qword [0x10037da8]
movaps xmm0, xmm5
movsd xmm4, qword [0x1003a918]
addsd xmm0, xmm3
movsd xmm2, qword [0x1003a910]
movsd xmm1, qword [0x1003a928]
divsd xmm4, xmm0
movaps xmm0, xmm2
addsd xmm0, xmm3
addsd xmm4, xmm2
divsd xmm5, xmm0
movaps xmm0, xmm1
movsd qword [0x1003a918], xmm4
addsd xmm0, xmm3
addsd xmm5, xmm1
divsd xmm2, xmm0
movsd qword [0x1003a920], xmm5
addsd xmm2, xmm4
addsd xmm4, xmm3
movsd qword [0x1003a910], xmm2
divsd xmm1, xmm4
addsd xmm1, xmm5
movsd qword [0x1003a928], xmm1
jmp fcn.100198e0
Function at 0x1001e040
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x84
mov eax, dword [0x1003a008]
xor eax, esp
mov dword [esp + 0x80], eax
push ebx
push esi
push edi
push dword [ebp + 8]
mov ebx, ecx
mov dword [esp + 0x1c], 0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0x67452301
mov dword [esp + 0x28], 0xefcdab89
mov dword [esp + 0x2c], 0x98badcfe
mov dword [esp + 0x30], 0x10325476
call fcn.1001bc60
mov ecx, dword [esp + 0x1c]
mov eax, 0x78
shr ecx, 3
mov esi, 0x38
and ecx, 0x3f
add esp, 4
sub eax, ecx
sub esi, ecx
cmp ecx, 0x38
lea ecx, [esp + 0x19]
cmovae esi, eax
xor edx, edx
movzx eax, byte [ecx - 1]
lea ecx, [ecx + 4]
mov byte [esp + edx + 0x74], al
movzx eax, byte [ecx - 4]
mov byte [esp + edx + 0x75], al
movzx eax, byte [ecx - 3]
mov byte [esp + edx + 0x76], al
movzx eax, byte [ecx - 2]
mov byte [esp + edx + 0x77], al
add edx, 4
cmp edx, 8
jb 0x1001e0c2
push esi
mov edx, 0x1003b058
lea ecx, [esp + 0x1c]
call fcn.1001bc60
add esp, 4
lea edx, [esp + 0x74]
lea ecx, [esp + 0x18]
push 8
call fcn.1001bc60
add esp, 4
lea ecx, [esp + 0x21]
xor edx, edx
nop word [eax + eax]
movzx eax, byte [ecx - 1]
lea ecx, [ecx + 4]
mov byte [esp + edx + 0x7c], al
movzx eax, byte [ecx - 4]
mov byte [esp + edx + 0x7d], al
movzx eax, byte [ecx - 3]
mov byte [esp + edx + 0x7e], al
movzx eax, byte [ecx - 2]
mov byte [esp + edx + 0x7f], al
add edx, 4
cmp edx, 0x10
jb 0x1001e120
mov dword [ebx + 0x10], 0
mov eax, ebx
cmp dword [ebx + 0x14], 0x10
jb 0x1001e15c
mov eax, dword [ebx]
mov byte [eax], 0
xor eax, eax
mov dword [esp + 0x14], eax
movzx eax, byte [esp + eax + 0x7c]
push eax
push str._.2x
lea eax, [esp + 0x18]
push 4
push eax
call fcn.10001160
lea esi, [esp + 0x20]
add esp, 0x10
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x1001e186
mov edx, dword [ebx + 0x14]
sub esi, ecx
mov ecx, dword [ebx + 0x10]
mov eax, edx
sub eax, ecx
cmp esi, eax
ja 0x1001e1c4
lea eax, [ecx + esi]
mov dword [ebx + 0x10], eax
mov eax, ebx
cmp edx, 0x10
jb 0x1001e1ac
mov eax, dword [ebx]
lea edi, [eax + ecx]
push esi
lea eax, [esp + 0x14]
push eax
push edi
call fcn.10021000
add esp, 0xc
mov byte [edi + esi], 0
jmp 0x1001e1db
push esi
lea eax, [esp + 0x14]
mov byte [esp + 0x78], 0
push eax
push dword [esp + 0x7c]
mov ecx, ebx
push esi
call fcn.1000a850
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x14], eax
cmp eax, 0x10
jb 0x1001e165
mov ecx, dword [esp + 0x8c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1001e319
mov esp, ebp
pop ebp
ret

Function at 0x1001e210
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
mov esi, ecx
mov ecx, 0x84222325
push edi
mov edi, 0xcbf29ce4
mov al, byte [esi]
test al, al
je 0x1001e256
nop word [eax + eax]
movsx eax, al
push 0x100
cdq
push 0x1b3
xor edx, edi
xor eax, ecx
push edx
push eax
call fcn.10031780
lea esi, [esi + 1]
mov ecx, eax
mov al, byte [esi]
mov edi, edx
test al, al
jne 0x1001e230
mov edx, edi
mov eax, ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40d139
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x40d148
pop dword [ebp - 0x3c]
mov eax, 0xa3fb06f8
sub eax, 0xa3ba35b0
sub dword [ebp - 0x3c], eax
push 0x40
push 0x1000
push 0x4d6c0
push 0
mov eax, 0x402d85ef
add eax, 0xc018e1e9
add eax, dword [ebp - 0x3c]
call dword [eax]
mov ecx, 0x46b7
xor edi, edi
add edi, eax
mov esi, 0x9f88c874
sub esi, 0x9f3fe874
add esi, dword [ebp - 0x3c]
mov ebx, 0x8729aaa1
add ebx, 0x6cd83230
xor dword [ebp - 4], 0x7fd615b9
mov edx, dword [esi]
mov dword [ebp - 0x28], 0x21fa3462
sub edx, ebx
xor dword [ebp - 0x28], 0x1945209
mov dword [edi], edx
sub dword [ebp - 0x30], 0xc8ebb0b5
add edi, 0x51db8b8d
sub edi, 0x51db8b89
add esi, 0x8d0eb500
sub esi, 0x8d0eb4fc
loop 0x40d1a3
add eax, 0x10daf
mov ebx, eax
add eax, 0x13a1db92
add eax, 0xec5e2473
mov ecx, 0x63aab299
add ecx, 0x9c954d67
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x401410
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40146b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40146b
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x40145a
cmp esi, edx
jae 0x40146b
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x401448
cmp esi, edx
jae 0x40146b
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret

Function at 0x407080
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, dword [0x409214]
mov dword [eax], ecx
mov ebx, edx
test ebx, ebx
jle 0x4070a1
mov eax, 0xff
call fcn.00402680
xor byte [esi], al
inc esi
dec ebx
jne 0x407091
pop esi
pop ebx
ret
Function at 0x415300
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42710d
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x4350d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
call fcn.00422000
mov byte [ebp - 4], 1
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
mov ecx, esp
mov dword [ebp - 0x1c], esp
cmovae eax, dword [ebp + 8]
push eax
call fcn.004094f0
push ecx
mov byte [ebp - 4], 2
mov esi, esp
mov dword [ebp - 0x20], esi
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
push eax
call fcn.0040a2c0
add eax, 0x10
add esp, 4
mov dword [esi], eax
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 1
push eax
call fcn.0041fc60
mov byte [ebp - 4], 3
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
cmovae eax, dword [ebp + 8]
add esp, 8
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
call fcn.004094f0
push ecx
mov byte [ebp - 4], 4
mov esi, esp
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
push eax
call fcn.0040a2c0
add eax, 0x10
add esp, 4
mov dword [esi], eax
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 3
push eax
call fcn.004206c0
push dword [ebp - 0x18]
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wremove]
push dword [ebp - 0x14]
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wremove]
mov ecx, dword [ebp - 0x14]
or ebx, 0xffffffff
add esp, 0x14
add ecx, 0xfffffff0
mov eax, ebx
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x415403
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x42948c]
mov ecx, edi
call esi
mov ecx, dword [ebp - 0x18]
mov eax, ebx
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x415429
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x42948c]
mov ecx, edi
call esi
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x41544d
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x42948c]
mov ecx, edi
call esi
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0x10
jb 0x415483
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x415479
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x415479
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00424702
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4157d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x4157fc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x415824
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x41582a
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x415892
jg 0x415841
test esi, esi
je 0x415892
test ecx, ecx
jl 0x41588d
jg 0x41584b
test eax, eax
je 0x41588d
cmp edi, ecx
jg 0x41585f
jl 0x415855
cmp esi, eax
jae 0x41585f
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x415895
mov ecx, dword [ebp + 8]
jmp 0x41589f
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x4158b9
jg 0x41589f
test esi, esi
je 0x4158b9
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x4158b9
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4158d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 8
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
test eax, eax
jg 0x4158f4
jl 0x4158e9
test ecx, ecx
jne 0x4158f4
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x41590e
push eax
push ecx
push dword [ebp + 8]
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push esi
push edi
mov edi, ecx
mov eax, dword [eax]
mov dword [ebp - 8], eax
test eax, eax
je 0x41595d
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [ebp - 4], edx
mov eax, dword [eax]
test eax, eax
je 0x415963
mov edi, dword [ebp + 8]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [ebp - 8]
push edi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [ebp - 8], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp - 8]
jmp 0x415966
lea eax, [ebx + 0x2c]
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
cmp dword [ebx + 0x4c], 0
je 0x4159d9
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x41598f
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [eax], edx
cmp edi, 0xfff
jbe 0x4159c3
nop word [eax + eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x4159d9
cmp edi, eax
ja 0x4159a0
test edi, edi
je 0x4159d9
push dword [ebx + 0x4c]
push edi
push 1
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc