joyce8/EMBER2024-capa huggingface dataset:
Function at 0x427080
Capabilities:
Delete file

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x18]
push eax
mov dword [edi], vtable.CInstActionBase.0
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [edi + 0x28]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea esi, [edi + 0x20]
mov dword [esi + 4], 1
test eax, eax
je 0x4270c6
push 0xffffffffffffffff
push eax
call ebx
mov eax, dword [esi + 8]
test eax, eax
je 0x4270c6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0
mov ecx, dword [edi + 0x1c]
push 0xffffffffffffffff
push ecx
call ebx
mov edx, dword [edi + 0x60]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [edi + 0x60]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4270f7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [edi + 0x48]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427116
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [edi + 0x44]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427135
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
call fcn.0041b2f0
mov eax, dword [edi + 0x1c]
xor esi, esi
cmp eax, esi
je 0x42714d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x1c], esi
mov eax, dword [edi + 0x18]
cmp eax, esi
je 0x42715e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x18], esi
pop edi
pop esi
pop ebx
ret

Function at 0x427170
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x45d274]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0
mov ebx, ecx
call dword [sym.imp.ole32.dll_CoInitialize]
xor eax, eax
push 0x208
push eax
lea ecx, [ebp - 0x20e]
push ecx
mov word [ebp - 0x210], ax
call fcn.00431420
add esp, 0xc
lea edx, [ebp - 0x210]
push edx
push 0
push 0
push 0x8023
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x42720f
lea eax, [ebp - 0x210]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4271d1
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x210]
push eax
mov ecx, ebx
call fcn.00403370
push 0xb
push str.Ebonmedia_
call fcn.00402e80
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042eecf
mov esp, ebp
pop ebp
ret
push eax
push str.SHGetFolderPath_FAILED__hr___i
push 3
push 3
push 0x4e
push str.CInstActionBase::GetEbonmediaDataFolder
push str.InstActionBase.cpp
lea ecx, [ebp - 0x21c]
call fcn.0042d360
push eax
call fcn.0042d580
mov ecx, dword [ebp - 4]
add esp, 0x14
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0042eecf
mov esp, ebp
pop ebp
ret
Function at 0x427250
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44a6b8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push edi
mov eax, dword [0x45d274]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0x44d920
mov dword [ebp - 0x10], 0
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
jns 0x4272aa
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00402c30
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea eax, [ebp - 0x14]
call fcn.00402e10
push 6
push str.Ebon_
mov ebx, edi
call fcn.00402e80
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427303
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x427320
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44a688
mov eax, dword fs:[0]
push eax
sub esp, 0x54
push ebx
push edi
mov eax, dword [0x45d274]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x38
xor ebx, ebx
lea eax, [ebp - 0x5c]
push ebx
push eax
mov dword [ebp - 0x60], 0x3c
call fcn.00431420
add esp, 0xc
push esi
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x5c], 0x40
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov edx, dword [0x45d020]
mov eax, dword [edx + 0xc]
mov ecx, 0x45d020
call eax
add eax, 0x10
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x14]
push str._q__norestart
push ecx
mov dword [ebp - 4], ebx
call fcn.004032e0
mov edx, dword [ebp + 8]
mov edi, dword [ebp - 0x14]
add esp, 8
lea eax, [ebp - 0x60]
push eax
mov dword [ebp - 0x4c], edi
mov dword [edx + 0x50], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x4273f0
lea eax, [edi - 0x10]
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4273db
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0x28]
push 0xffffffffffffffff
push ebx
lea edx, [ebp - 0x18]
push edx
push 1
mov dword [ebp - 0x18], ecx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [ebp - 0x10], eax
cmp eax, ebx
jne 0x4273b8
mov edx, dword [ebp - 0x28]
lea ecx, [ebp - 0x10]
push ecx
push edx
mov dword [ebp - 0x10], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x427474
mov eax, dword [ebp - 0x10]
cmp eax, 0xbc2
jne 0x427439
call fcn.00423c00
mov eax, dword [ebp - 0x10]
jmp 0x42743d
test eax, eax
jne 0x427442
mov ebx, 1
mov ecx, dword [0x460578]
push ecx
push eax
push esi
push str.Prerequisite_install_path__retCode__RebootRequired_:__s___u___i
push 1
push 3
push 0xac
push str.CInstActionBase::PackageInstall
push str.InstActionBase.cpp
lea ecx, [ebp - 0x24]
call fcn.0042d360
push eax
call fcn.0042d580
add esp, 0x1c
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [edi - 0x10]
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4274a1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4275e0
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x18]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi + 0x28]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [esi + 0x24], 1
test eax, eax
je 0x42761c
push 0xffffffffffffffff
push eax
call edi
mov eax, dword [esi + 0x28]
test eax, eax
je 0x42761c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x28], 0
mov ecx, dword [esi + 0x1c]
push 0xffffffffffffffff
push ecx
call edi
mov edx, dword [esi + 0x60]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
pop esi
ret
Function at 0x427640
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44b658
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x45d274]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0x4c]
test eax, eax
jne 0x427800
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [edi + 0xc], eax
mov eax, dword [edi]
mov edx, dword [eax + 0x10]
mov ecx, edi
call edx
mov eax, dword [0x45d020]
mov edx, dword [eax + 0xc]
mov ecx, 0x45d020
call edx
add eax, 0x10
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0
call fcn.00403300
mov eax, dword [edi + 0x48]
lea ecx, [ebp - 0x38]
push ecx
push eax
call fcn.0041c830
mov edx, dword [edi]
mov eax, dword [edx + 0x38]
add esp, 8
mov ecx, edi
call eax
test eax, eax
je 0x4276fb
mov edi, dword [edi + 0x4c]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x38]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4276f4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
jmp 0x427800
mov ebx, dword [ebp - 0x38]
mov eax, dword [edi + 0x48]
push 0
push ebx
lea esi, [edi + 0x20]
call fcn.0041b410
mov esi, eax
test esi, esi
je 0x427746
cmp esi, 1
je 0x427737
mov edx, dword [edi]
mov eax, dword [edx + 0x14]
mov ecx, edi
call eax
call fcn.00420550
cmp dword [edi + 4], 0
je 0x427732
mov esi, 0x2710
jmp 0x427734
neg esi
mov dword [edi + 0x4c], esi
mov edi, dword [edi + 0x4c]
mov dword [ebp - 4], 0xffffffff
lea eax, [ebx - 0x10]
jmp 0x4276db
mov edx, dword [edi]
mov eax, dword [edx + 0x38]
mov ecx, edi
call eax
test eax, eax
je 0x42776c
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [edi + 0x4c]
mov dword [ebp - 4], 0xffffffff
lea eax, [ebx - 0x10]
jmp 0x4276db
mov edx, dword [edi]
mov eax, dword [edx + 0x18]
mov ecx, edi
call eax
mov eax, dword [edi + 0x60]
lea ecx, [ebp - 0x34]
push ecx
push 0
push eax
mov dword [ebp - 0x3c], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x427796
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
mov esi, dword [edi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [edi + 0xc]
lea ecx, [ebp - 0x48]
push eax
push esi
push str.Presequisite__s_DOWNLOADED__time_spent:__u__size:__u
push 1
push 3
push 0x129
push str.CInstActionBase::Download
push str.InstActionBase.cpp
call fcn.0042d360
push eax
call fcn.0042d580
lea eax, [ebx - 0x10]
add esp, 0x1c
mov dword [edi + 0x4c], 0x2710
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4277fb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 0x2710
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042eecf
mov esp, ebp
pop ebp
ret
Function at 0x4279c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [esi + 0x4c], 0x2710
jne 0x4279fa
cmp dword [esi + 0x1c], 0
jne 0x4279fa
push 0
push 0
push esi
push 0x427840
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp + 8]
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 8]
mov dword [ecx], eax
mov eax, 1
pop ebp
ret 4
xor eax, eax
pop ebp
ret 4
Function at 0x429920
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, eax
xor ebx, ebx
push edi
mov dword [ebp - 4], 0
mov dword [esi + 0x6af80], 2
cmp dword [esi + 0x6af90], ebx
je 0x429b3e
lea ebx, [ebx]
cmp dword [esi + 0x6af90], 3
jb 0x4299a7
mov ecx, dword [esi + 0x6af84]
movzx eax, byte [ecx + esi + 0x1af72]
mov edx, dword [esi + 0x6af7c]
shl edx, 5
xor eax, edx
and eax, 0x7fff
mov dword [esi + 0x6af7c], eax
mov eax, dword [esi + eax*4 + 0x4af70]
and ecx, 0x7fff
mov dword [esi + ecx*4 + 0x2af70], eax
mov ecx, dword [esi + 0x6af84]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x6af7c]
mov dword [esi + eax*4 + 0x4af70], ecx
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x4299e7
mov edx, dword [esi + 0x6af84]
sub edx, ecx
cmp edx, 0x7efa
ja 0x4299e7
mov eax, dword [esi + 0x6af90]
cmp dword [esi + 0x6afa0], eax
jbe 0x4299d2
mov dword [esi + 0x6afa0], eax
mov eax, ecx
call fcn.00429640
mov ebx, eax
mov eax, dword [esi + 0x6af90]
cmp ebx, eax
jbe 0x4299e7
mov ebx, eax
mov eax, dword [esi + 0x6af84]
mov ecx, esi
cmp ebx, 3
jb 0x429acb
sub eax, dword [esi + 0x6af88]
lea edx, [ebx - 3]
call fcn.00428df0
sub dword [esi + 0x6af90], ebx
mov ecx, dword [esi + 0x6af90]
mov dword [ebp - 8], eax
cmp ebx, dword [esi + 0x6af98]
ja 0x429a94
cmp ecx, 3
jb 0x429a94
mov edi, 1
sub ebx, edi
lea esp, [esp]
add dword [esi + 0x6af84], edi
mov edx, dword [esi + 0x6af84]
movzx ecx, byte [esi + edx + 0x1af72]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
xor ecx, eax
and ecx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov ecx, dword [esi + ecx*4 + 0x4af70]
and edx, 0x7fff
sub ebx, edi
mov dword [esi + edx*4 + 0x2af70], ecx
mov edx, dword [esi + 0x6af84]
mov dword [ebp - 4], ecx
mov ecx, dword [esi + 0x6af7c]
mov dword [esi + ecx*4 + 0x4af70], edx
jne 0x429a30
add dword [esi + 0x6af84], edi
mov eax, dword [ebp - 8]
jmp 0x429ae6
add dword [esi + 0x6af84], ebx
mov edx, dword [esi + 0x6af84]
movzx ecx, byte [edx + esi + 0x1af70]
mov dword [esi + 0x6af7c], ecx
movzx edx, byte [edx + esi + 0x1af71]
shl ecx, 5
xor edx, ecx
xor ebx, ebx
and edx, 0x7fff
mov dword [esi + 0x6af7c], edx
jmp 0x429ae6
movzx edx, byte [eax + esi + 0x1af70]
xor eax, eax
call fcn.00428df0
dec dword [esi + 0x6af90]
inc dword [esi + 0x6af84]
test eax, eax
je 0x429b20
mov eax, dword [esi + 0x6af74]
test eax, eax
js 0x429afd
lea ecx, [eax + esi + 0x1af70]
jmp 0x429aff
xor ecx, ecx
mov edi, dword [esi + 0x6af84]
push 0
sub edi, eax
push ecx
mov eax, esi
call fcn.00428c30
mov ecx, dword [esi + 0x6af84]
add esp, 8
mov dword [esi + 0x6af74], ecx
cmp dword [esi + 0x6af90], 0x106
jae 0x429b31
call fcn.004297e0
cmp dword [esi + 0x6af90], 0
jne 0x429950
mov eax, dword [esi + 0x6af74]
test eax, eax
js 0x429b51
lea ecx, [eax + esi + 0x1af70]
jmp 0x429b53
xor ecx, ecx
mov edi, dword [esi + 0x6af84]
push 1
sub edi, eax
push ecx
mov eax, esi
call fcn.00428c30
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42a740
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x42a747
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0x42a81d
mov esi, edx
shr esi, 3
push edi
lea esp, [esp]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x450b18]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x450b18]
movzx edi, byte [ecx + 2]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x450b18]
movzx edi, byte [ecx + 3]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x450b18]
movzx edi, byte [ecx + 4]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x450b18]
movzx edi, byte [ecx + 5]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x450b18]
movzx edi, byte [ecx + 6]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x450b18]
movzx edi, byte [ecx + 7]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x450b18]
add ecx, 8
sub edx, 8
dec esi
jne 0x42a760
pop edi
test edx, edx
je 0x42a83a
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x450b18]
inc ecx
dec edx
jne 0x42a821
not eax
pop esi
ret
Function at 0x42acf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [esi + 0x18], 0
je 0x42adbc
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x20]
push ebx
push edi
mov edi, dword [ebp + 0xc]
add eax, edi
cmp eax, ecx
jb 0x42ad9b
add ecx, ecx
cmp ecx, eax
jbe 0x42ad20
mov edi, ecx
mov dword [ebp - 4], edi
jmp 0x42ad25
mov dword [ebp - 4], eax
mov edi, eax
push 0
push edi
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebx, eax
test ebx, ebx
je 0x42ad5a
push edi
push 0
push 0
push 0xf001f
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
jne 0x42ad67
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 0x300
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x18]
push ecx
push edx
push edi
call fcn.00432730
mov eax, dword [esi + 0x18]
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [esi + 0x18], edi
mov edi, dword [ebp + 0xc]
mov dword [esi + 0x20], edx
mov dword [esi + 4], ebx
mov ecx, dword [esi + 0x1c]
mov eax, dword [ebp + 8]
add ecx, dword [esi + 0x18]
push edi
push eax
push ecx
call fcn.00432730
add esp, 0xc
add dword [esi + 0x1c], edi
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi]
test eax, eax
je 0x42ade7
mov ecx, dword [ebp + 0xc]
push 0
lea edx, [ebp - 4]
push edx
mov edx, dword [ebp + 8]
push ecx
push edx
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
mov dword [esi + 0xc], 0x1000000
xor eax, eax
mov esp, ebp
pop ebp
ret 8

Function at 0x42b070
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [esi + 0x58]
push edi
test ecx, ecx
je 0x42b0b7
mov eax, dword [esi + 0x60]
mov edi, dword [esi + 0x5c]
cmp eax, edi
jae 0x42b0f4
sub edi, eax
cmp edi, edx
jbe 0x42b08e
mov edi, edx
push edi
add eax, ecx
push eax
push ebx
call fcn.00432730
mov eax, dword [esi + 0x4c]
add dword [esi + 0x60], edi
add dword [esi + 0x48], edi
add esp, 0xc
mov edx, edi
mov ecx, ebx
call fcn.0042a740
mov dword [esi + 0x4c], eax
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x50]
test eax, eax
je 0x42b0ed
push 0
lea ecx, [ebp - 4]
push ecx
push edx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42b0f4
mov edi, dword [ebp - 4]
mov eax, dword [esi + 0x4c]
add dword [esi + 0x48], edi
mov edx, edi
mov ecx, ebx
call fcn.0042a740
mov dword [esi + 0x4c], eax
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
mov dword [esi + 0xc], 0x1000000
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x42b240
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, eax
push edi
mov dword [ebp - 4], 0
lea ebx, [esi + 0x68]
mov ecx, dword [esi + 0x58]
test ecx, ecx
je 0x42b287
mov eax, dword [esi + 0x60]
mov edi, dword [esi + 0x5c]
cmp eax, edi
jae 0x42b2da
sub edi, eax
cmp edi, 0x4000
jbe 0x42b275
mov edi, 0x4000
push edi
add eax, ecx
push eax
push ebx
call fcn.00432730
add esp, 0xc
add dword [esi + 0x60], edi
jmp 0x42b2a8
mov eax, dword [esi + 0x50]
test eax, eax
je 0x42b2d3
push 0
lea ecx, [ebp - 8]
push ecx
push 0x4000
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42b2da
mov edi, dword [ebp - 8]
mov eax, dword [esi + 0x4c]
add dword [esi + 0x48], edi
mov edx, edi
mov ecx, ebx
call fcn.0042a740
mov dword [esi + 0x4c], eax
test edi, edi
je 0x42b2da
cmp edi, 0xffffffff
je 0x42b2da
push edi
push ebx
call fcn.0042acf0
cmp eax, edi
jne 0x42b2e9
add dword [ebp - 4], edi
jmp 0x42b255
mov dword [esi + 0xc], 0x1000000
mov edx, dword [ebp - 4]
pop edi
mov dword [esi + 0x64], edx
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x60000
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42d5b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ecx + 0x44], 0xffffffff
mov dword [ebp - 4], ecx
jne 0x42d5c8
mov eax, 0x80040101
mov esp, ebp
pop ebp
ret 8
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
cmp edi, esi
je 0x42d636
cmp dword [ebp + 8], esi
je 0x42d636
push ebx
mov dword [ebp + 0xc], esi
cmp edi, esi
jbe 0x42d60e
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x42d5eb
mov ecx, dword [ebp - 4]
push 0
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
mov edx, edi
sub edx, esi
push edx
lea edx, [esi + eax]
mov eax, dword [ecx + 0x44]
push edx
push eax
call ebx
test eax, eax
je 0x42d619
add esi, dword [ebp + 0xc]
cmp esi, edi
jb 0x42d5e8
xor eax, eax
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x42d610
pop ebx
and eax, 0xffff
pop edi
or eax, 0x80070000
pop esi
mov esp, ebp
pop ebp
ret 8
pop edi
mov eax, 0x80070057
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x42d9d0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x448c57
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x45d274]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor edi, edi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [ebp - 4], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov eax, dword [0x45d020]
mov edx, dword [eax + 0xc]
mov ecx, 0x45d020
mov byte [ebp - 4], 2
call edx
add eax, 0x10
mov dword [esi + 0x40], eax
lea ecx, [esi + 0x50]
mov byte [ebp - 4], 3
mov dword [esi + 0x44], 0xffffffff
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], 0x10400
call fcn.0042e8b0
lea eax, [esi + 0x5c]
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
push edi
mov dword [eax + 0x10], ecx
push eax
mov byte [ebp - 4], 4
mov dword [eax + 0x14], ecx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test eax, eax
jne 0x42daa8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x42daa0
and eax, 0xffff
or eax, 0x80070000
cmp eax, edi
jge 0x42daa8
push eax
call fcn.00403700
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42de30
Capabilities:
Check if file exists
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x448cd0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x45d274]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [0x45d020]
mov edx, dword [eax + 0xc]
mov ecx, 0x45d020
call edx
add eax, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [0x45d020]
mov edx, dword [eax + 0xc]
mov ecx, 0x45d020
mov dword [ebp - 4], 0
call edx
add eax, 0x10
mov dword [ebp - 0x10], eax
mov ecx, ebx
mov byte [ebp - 4], 1
call fcn.0042dc30
mov esi, dword [ebx + 0x34]
dec esi
mov edi, eax
test esi, esi
jle 0x42df05
lea ecx, [ebp - 0x14]
lea eax, [esi - 1]
push ecx
push eax
mov ecx, ebx
mov dword [ebp - 0x18], eax
call fcn.0042dac0
mov edi, eax
test edi, edi
js 0x42defe
lea edx, [ebp - 0x10]
push edx
push esi
mov ecx, ebx
call fcn.0042dac0
mov edi, eax
test edi, edi
js 0x42defe
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
push 1
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x42defe
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x42defe
cmp eax, 3
je 0x42defe
test eax, eax
jle 0x42defc
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
mov esi, dword [ebp - 0x18]
test esi, esi
jg 0x42dea0
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42df28
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42df4e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret