joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a228
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40a261
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004039f8
jmp 0x40a26a
mov eax, ebx
mov edx, esi
call fcn.004039ac
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40a274
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40a295
mov al, byte [esp]
jmp 0x40a297
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40f124
Capabilities:
Contain obfuscated stackstrings

Disassembly:
clc
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.0040ed7b
push eax
push esi
push dword [ebp + 8]
call fcn.0040ed30
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a

Function at 0x40f384
Capabilities:
Inspect section memory permissions

Disassembly:
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
cmp eax, ebx
je 0x40f3a1
test eax, 0x80000000
lea ecx, [eax + esi]
je 0x40f37c
and eax, 0xffff
push eax
jmp 0x40f380
add ecx, 2
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
jne 0x40f38e
jne 0x40f38e
call fcn.0040ed30
add esp, 0xc
cmp edi, ebx
mov dword [edi], eax
je 0x40f55a
add edi, 4
add dword [ebp + 0x10], 4
jmp 0x40f361
add dword [ebp - 0x44], 0x14
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp - 0x44]
jmp 0x40f302
Function at 0x415ad0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x415ad6
ret

Function at 0x417f3c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x417f8d
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x417f74
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x417f64
jmp 0x417f8d
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x417f75
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401160
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp byte [esi + 0x208], 0
jne 0x401176
xor eax, eax
pop esi
pop ebp
ret 8
push edi
push 0x410
call fcn.0040471a
push 0x410
mov edi, eax
push 0
push edi
call fcn.00406000
add esp, 0x10
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
nop
call fcn.00409efb
push esi
push 0x208
push edi
push 0
push dword [ebp + 0xc]
mov dword [eax], 0
push str.DllInjector
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4011fc
call fcn.00409efb
cmp dword [eax], 0
jne 0x4011fc
nop dword [eax]
test esi, esi
je 0x4011fc
cmp esi, 0x207
je 0x4011fc
cmp esi, 0x206
je 0x4011fc
mov eax, edi
pop edi
pop esi
pop ebp
ret 8
push edi
call fcn.00404486
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
ret 8
Function at 0x4023a0
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x420040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0
push 0x80
push 3
push 0
push 1
mov esi, ecx
mov bl, dl
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x4023f6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp bl, 1
jne 0x40243d
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404478
mov esp, ebp
pop ebp
ret
cmp bl, 1
je 0x40243d
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40243d
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 1
push 0x41cde0
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00404478
mov esp, ebp
pop ebp
ret

Function at 0x402460
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x420040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push 2
mov dword [ebp - 0x238], edx
mov dword [ebp - 0x23c], ecx
mov dword [ebp - 0x240], edi
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4024c1
nop dword [eax]
test edi, edi
je 0x4025d4
mov dword [edi], 1
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404478
mov esp, ebp
pop ebp
ret
xor al, al
xor esi, esi
push 0x228
mov byte [ebp - 0x231], al
lea eax, [ebp - 0x22c]
push esi
push eax
call fcn.00406000
add esp, 0xc
mov dword [ebp - 0x230], 0x22c
lea eax, [ebp - 0x230]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x402529
nop dword [eax]
test edi, edi
je 0x40250a
mov dword [edi], 2
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404478
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x238]
nop
mov edx, dword ds:[ebp - 0x23c]
lea ecx, [ebp - 0x20c]
call fcn.00401220
cmp al, 1
jne 0x402571
test esi, esi
mov byte [ebp - 0x231], al
cmove esi, dword [ebp - 0x228]
test edi, edi
je 0x402571
nop dword [eax]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x228], eax
je 0x402571
mov byte [edi], 1
lea eax, [ebp - 0x230]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
nop
cmp eax, 1
je 0x402530
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0x231], 0
mov edi, dword [ebp - 0x240]
jne 0x4025b8
test edi, edi
je 0x4025d4
mov dword [edi], 3
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404478
mov esp, ebp
pop ebp
ret
push esi
push 0
push 0x80
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
jne 0x4025d6
test edi, edi
je 0x4025d4
mov dword [edi], 4
xor eax, eax
mov ecx, dword ds:[ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404478
mov esp, ebp
pop ebp
ret
Function at 0x404f73
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x404fb2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x404fb2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x404fb2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x404fb2
cmp dword [ecx + 0x74], 0xe
jbe 0x404fb2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x40e5fe
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40e69b
push ebx
push esi
call fcn.0040e5c7
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040e55b
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40e648
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40e69a
push edi
push eax
call fcn.0040bc54
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40e668
call fcn.0040bc1a
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40e699
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040e55b
add esp, 0x20
test eax, eax
jne 0x40e687
push edi
call fcn.0040bc1a
jmp 0x40e68f
push ebx
call fcn.0040bc1a
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x40e89b
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x418f40
push 0x418f38
push str.FlsAlloc
push 0x1f
call fcn.0040e7b7
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40e8cf
push dword [ebp + 8]
mov ecx, esi
call dword [0x417198]
call esi
jmp 0x40e8d5
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40e919
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x418f50
push 0x418f48
push str.FlsGetValue
push 0x21
call fcn.0040e7b7
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40e950
push dword [ebp + 8]
mov ecx, esi
call dword [0x417198]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40e958
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x418f58
push 0x418f50
push str.FlsSetValue
push 0x22
call fcn.0040e7b7
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40e992
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x417198]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x415ec0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x415eed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x415eed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x40272c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0040372c
test esi, esi
jne 0x402762
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.0040381c
jmp 0x402780
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402640
mov edi, eax
test esi, esi
je 0x402780
cmp dword [ebx], 0
je 0x402780
dec esi
jmp 0x402769
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4028bf
Capabilities:
Get file size
Read file on windows

Disassembly:
add byte [ecx + 3], bh
mov dword [esi + 0x1c], 0x402800
mov dword [esi + 0x24], 0x40284c
mov dword [esi + 0x20], 0x4027fc
cmp byte [esi + 0x48], 0
je 0x402996
push 0
push 0x80
push ecx
push 0
push edx
push eax
lea eax, [esi + 0x48]
push eax
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x402a0a
mov dword [esi], eax
cmp word [esi + 4], 0xd7b3
jne 0x4029d3
dec word [esi + 4]
push 0
push dword [esi]
call sub.kernel32.dll_GetFileSize
inc eax
je 0x402a0a
sub eax, 0x81
jae 0x40292d
xor eax, eax
push 0
push 0
push eax
push dword [esi]
call sub.kernel32.dll_SetFilePointer
inc eax
je 0x402a0a
push 0
mov edx, esp
push 0
push edx
push 0x80
lea edx, [esi + 0x14c]
push edx
push dword [esi]
call sub.kernel32.dll_ReadFile
pop edx
dec eax
jne 0x402a0a
xor eax, eax
cmp eax, edx
jae 0x4029d3
cmp byte [esi + eax + 0x14c], 0xe
je 0x402975
inc eax
jmp 0x402964
push 2
push 0
sub eax, edx
push eax
push dword [esi]
call sub.kernel32.dll_SetFilePointer
inc eax
je 0x402a0a
push dword [esi]
call sub.kernel32.dll_SetEndOfFile
dec eax
jne 0x402a0a
jmp 0x4029d3
lea eax, [esi + 0x14c]
mov dword [esi + 8], 0x80
mov dword [esi + 0x24], 0x4027fc
mov dword [esi + 0x14], eax
cmp word [esi + 4], 0xd7b2
je 0x4029b9
push 0xfffffffffffffff6
jmp 0x4029c7
cmp esi, 0x41e3d0
jne 0x4029c5
push 0xfffffffffffffff4
jmp 0x4029c7
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
cmp eax, 0xffffffff
je 0x402a0a
mov dword [esi], eax
cmp word [esi + 4], 0xd7b1
je 0x4029f2
push dword [esi]
call sub.kernel32.dll_GetFileType
test eax, eax
je 0x4029f6
cmp eax, 2
jne 0x4029f2
mov dword [esi + 0x20], 0x402800
xor eax, eax
pop esi
ret
push dword [esi]
call sub.kernel32.dll_CloseHandle
mov word [esi + 4], 0xd7b0
mov eax, 0x69
jmp 0x4029f4
mov word [esi + 4], 0xd7b0
call sub.kernel32.dll_GetLastError
jmp 0x4029f4

Function at 0x402bf8
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x41d008], 0x8088405
inc edx
mov dword [ebx + 0x41d008], edx
mul edx
mov eax, edx
pop ebx
ret
Function at 0x402e44
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x41d018]
sbb al, dl
inc ecx
add byte [ecx + 0x458df845], cl
cld
push eax
push 1
push 0
push 0x402edc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402ebc
xor eax, eax
push ebp
push 0x402eb5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402ef8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402ebc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x41d018]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x41d018], ax
mov esp, ebp
pop ebp
ret

Function at 0x403534
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x41e034], 0
je 0x403595
cmp word [0x41e208], 0xd7b2
jne 0x40355d
cmp dword [0x41e210], 0
jbe 0x40355d
mov eax, 0x41e204
call dword [0x41e220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x41d084
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4035bc
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x41d024], 0
jne 0x4035b1
push 0
push 0x41d07c
push 0x41d084
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4036e8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.004024d0
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x41e035], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x4036b0
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x4043a8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x40440e
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.0040388c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402d38
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4043f8
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404415
lea eax, [ebp - 0x10]
call fcn.0040372c
ret
Function at 0x40548c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403a94
xor eax, eax
push ebp
push 0x405597
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0040372c
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.00403aa4
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x405581
mov eax, dword [ebp - 8]
mov edx, 0x73
call fcn.00403b84
push 0
lea eax, [ebp - 0x10]
push eax
push 0x73
mov eax, dword [ebp - 8]
call fcn.00403af4
mov edx, 1
dec edx
test eax, eax
je 0x40550f
cmp edx, dword [eax - 4]
jb 0x405514
call fcn.00402f14
inc edx
lea eax, [eax + edx - 1]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadFile_1
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov eax, 0x4055ac
call fcn.00403b3c
test eax, eax
jne 0x405549
mov eax, dword [ebp - 8]
call fcn.0040372c
jmp 0x405581
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov eax, 0x4055b8
call fcn.00403b3c
mov ecx, eax
sub ecx, 1
jno 0x405568
call fcn.00402f1c
sub ecx, 0x50
jno 0x405572
call fcn.00402f1c
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 0x51
call fcn.00403afc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40559e
lea eax, [ebp - 4]
call fcn.0040372c
ret

Function at 0x4055bc
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff64
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403a94
xor eax, eax
push ebp
push 0x40568a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
push 0
lea eax, [ebp - 0x9c]
push eax
mov eax, dword [ebp - 4]
call fcn.00403aa4
push eax
call sub.kernel32.dll_OpenFile
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x40566c
lea eax, [ebp - 0x10]
mov edx, 0x186a0
call fcn.00403b84
push 0
lea eax, [ebp - 0x14]
push eax
push 0x186a0
lea eax, [ebp - 0x10]
call fcn.00403af4
mov edx, 1
dec edx
test eax, eax
je 0x405636
cmp edx, dword [eax - 4]
jb 0x40563b
call fcn.00402f14
inc edx
lea eax, [eax + edx - 1]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x40566c
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
mov edx, dword [ebp - 0x10]
mov eax, 0x4056a0
call fcn.00403b3c
test eax, eax
jle 0x40566c
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405691
lea eax, [ebp - 0x10]
call fcn.0040372c
lea eax, [ebp - 4]
call fcn.0040372c
ret
Function at 0x4056b8
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403a94
mov eax, dword [ebp - 8]
call fcn.00403a94
xor eax, eax
push ebp
push 0x405752
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [ebp - 9]
xor al, 1
neg al
sbb eax, eax
push eax
mov eax, dword [ebp - 8]
call fcn.00403aa4
push eax
mov eax, dword [ebp - 4]
call fcn.00403aa4
push eax
call sub.kernel32.dll_CopyFileA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xa], al
mov al, byte [ebp - 0xa]
and al, byte [ebp + 0x10]
je 0x405737
mov ecx, dword [ebp + 8]
test ecx, ecx
jns 0x405723
call fcn.00402f14
mov edx, dword [ebp + 0xc]
test edx, edx
jns 0x40572f
call fcn.00402f14
mov eax, dword [ebp - 8]
call fcn.00405c8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405759
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403750
ret

Function at 0x4057dc
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea4
xor edx, edx
mov dword [ebp - 0x15c], edx
mov dword [ebp - 0x158], edx
mov dword [ebp - 0x154], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403a94
xor eax, eax
push ebp
push 0x405996
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004038a4
cmp eax, 2
invalid
invalid
cmp al, byte [ecx]
invalid

Function at 0x4059d4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403a94
xor eax, eax
push ebp
push 0x405a20
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00403aa4
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405a27
lea eax, [ebp - 4]
call fcn.0040372c
ret
Function at 0x405b30
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec0
xor edx, edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403a94
xor eax, eax
push ebp
push 0x405c5c
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea edx, [ebp - 0x138]
mov eax, dword [ebp - 4]
call fcn.0040520c
mov edx, dword [ebp - 0x138]
lea eax, [ebp - 4]
call fcn.004037c4
xor edx, edx
mov eax, 2
call fcn.00404cf0
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x134], 0x128
lea edx, [ebp - 0x134]
mov eax, dword [ebp - 0xc]
call fcn.00404d10
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 6], al
jmp 0x405c27
lea eax, [ebp - 0x140]
lea edx, [ebp - 0x110]
mov ecx, 0x104
call fcn.0040388c
mov eax, dword [ebp - 0x140]
lea edx, [ebp - 0x13c]
call fcn.0040520c
mov eax, dword [ebp - 0x13c]
mov edx, dword [ebp - 4]
call fcn.004039f0
jne 0x405c10
push 0
mov eax, dword [ebp - 0x12c]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
lea edx, [ebp - 0x134]
mov eax, dword [ebp - 0xc]
call fcn.00404d30
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 6], al
cmp byte [ebp - 6], 0
jne 0x405bb8
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405c63
lea eax, [ebp - 0x140]
mov edx, 3
add al, ch
std
invalid
invalid
dec dword [ebp - 0x2e1703bb]
invalid
invalid
inc ebx