joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ea2dc
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [0x67283c]
mov eax, dword [eax + 8]
xor edx, edx
call fcn.0053ca54
test eax, eax
je 0x4ea2f5
call fcn.0059bfd4
ret
mov eax, dword [0x671f34]
cmp byte [eax], 0
je 0x4ea33e
mov eax, dword [0x67283c]
mov eax, dword [eax + 8]
call fcn.0053cf44
test al, al
je 0x4ea33e
push 5
push 0
push 0
mov eax, dword [0x67283c]
mov eax, dword [eax + 8]
push eax
push 0x4ea374
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
jg 0x4ea371
mov eax, dword [0x671a64]
mov eax, dword [eax]
call fcn.006233ec
jmp 0x4ea371
mov eax, dword [0x67283c]
mov eax, dword [eax + 8]
call fcn.0053ce60
test al, al
je 0x4ea364
call fcn.0053c3b0
mov edx, dword [0x67283c]
mov edx, dword [edx + 8]
call fcn.0053a4e0
jmp 0x4ea371
mov eax, dword [0x67283c]
mov eax, dword [eax + 8]
call fcn.00624a8c
ret

Function at 0x4ea380
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
xor eax, eax
push ebp
push 0x4ea4ee
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, dword [0x67283c]
mov eax, dword [eax + 8]
call fcn.00658904
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 4]
call fcn.006587e0
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004038bc
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 4]
push eax
push 0x4fe314
mov edx, dword [0x672964]
mov edx, dword [edx]
lea eax, [ebp - 8]
mov cl, 1
call fcn.00436d18
test al, al
je 0x4ea4d3
mov eax, dword [0x67283c]
mov eax, dword [eax + 8]
xor edx, edx
call fcn.0053ca54
mov ebx, eax
test ebx, ebx
je 0x4ea416
mov eax, ebx
call fcn.0059bfd4
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 4]
mov edx, 0x8c
call fcn.004f63fc
mov eax, dword [0x6719c8]
mov eax, dword [eax]
mov edx, ebx
call fcn.006521b4
test al, al
jne 0x4ea4d3
lea edx, [ebp - 0x10]
mov eax, dword [0x67283c]
mov eax, dword [eax + 8]
call fcn.00658934
mov edx, dword [ebp - 0x10]
lea ecx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.00658754
mov eax, dword [ebp - 0xc]
push eax
lea edx, [ebp - 0x10]
mov eax, dword [0x67283c]
mov eax, dword [eax + 8]
call fcn.0065885c
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
pop ecx
call fcn.00403b24
push 1
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x67283c]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_MoveFileExW
test eax, eax
je 0x4ea4b3
mov eax, dword [0x67283c]
add eax, 8
mov edx, dword [ebp - 8]
call fcn.004038bc
mov eax, dword [0x6723cc]
mov byte [eax + 0x11], 1
test ebx, ebx
je 0x4ea4ac
call fcn.0053c3b0
mov edx, dword [ebp - 8]
call fcn.0053a4e0
call fcn.00509530
jmp 0x4ea4d3
mov eax, dword [0x67283c]
mov eax, dword [eax + 8]
call fcn.006584d0
test al, al
je 0x4ea4d3
mov eax, dword [0x673348]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
call fcn.006234a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ea4f5
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00403898
ret
Function at 0x50282c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, ebx
call fcn.005c9a10
test al, al
jne 0x502952
cmp byte [ebx + 0x46e], 0
jne 0x502952
cmp byte [ebx + 0x40f], 0
je 0x5028a1
mov eax, ebx
call fcn.005bdba8
lea edx, [ebx + 0x258]
xor ecx, ecx
mov eax, ebx
call fcn.005c2348
mov cl, 0x13
mov dl, 0x28
mov eax, ebx
call fcn.00567f54
lea edx, [ebx + 0x258]
mov cl, byte [0x502958]
mov eax, ebx
call fcn.005c3110
mov edx, 2
mov eax, ebx
call fcn.00567fe0
mov byte [ebx + 0x40f], 0
jmp 0x502952
cmp byte [ebx + 0x40d], 0
jne 0x50293b
cmp byte [ebx + 0x40e], 0
jne 0x50293b
mov eax, 0x12c
call fcn.0065a614
test al, al
je 0x50293b
call fcn.0065c614
mov esi, eax
mov eax, dword [ebx + 0x13c]
cmp dword [eax + 0x18], 0x3e8
jl 0x5028ed
mov byte [ebx + 0x40e], 1
call fcn.00509530
jmp 0x50293b
cmp byte [ebx + 0x14e], 0
je 0x502905
mov eax, ebx
call fcn.005c7574
test al, al
je 0x502905
xor eax, eax
jmp 0x502907
mov al, 1
and eax, 0x7f
lea ecx, [eax + eax*4]
mov eax, dword [ebx + 0x13c]
add ecx, dword [eax + 0x18]
mov eax, dword [ebx + 0x13c]
mov edx, dword [eax + 0x18]
mov eax, ebx
call fcn.005bfa0c
cmp byte [ebx + 0x40d], 0
jne 0x50293b
call fcn.0065c614
sub eax, esi
cmp eax, 0x32
jl 0x5028d0
mov eax, 0x1388
call fcn.0065a614
test al, al
je 0x502952
xor edx, edx
mov eax, ebx
call fcn.005ee5ec
pop esi
pop ebx
ret
Function at 0x50d567
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add esp, 4
and edx, 0x51a4
xor edx, 0x8cf7
call fcn.0050d584
add byte [esp + edi + 0x4c], al
Function at 0x512970
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edi
mov byte [ebp - 0x960], 0x56
mov byte [ebp - 0x95f], 0x69
mov byte [ebp - 0x95e], 0x72
mov byte [ebp - 0x95d], 0x74
mov byte [ebp - 0x95c], 0x75
mov byte [ebp - 0x95b], 0x61
mov byte [ebp - 0x95a], 0x6c
mov byte [ebp - 0x959], 0x50
mov byte [ebp - 0x958], 0x72
mov byte [ebp - 0x957], 0x6f
mov byte [ebp - 0x956], 0x74
mov byte [ebp - 0x955], 0x65
mov byte [ebp - 0x954], 0x63
mov byte [ebp - 0x953], 0x74
mov byte [ebp - 0x952], 0
push esi
xor esi, 0x15c6c
sub esi, 0x8456
call 0x5129f7
add byte [ebp + 0x49], al
dec ecx
inc ecx
cmp byte [edx + 0x40], cl
add esp, 4
pop esi
push ebx
push ebx
add esp, 4
add ebx, 0x16883
pop ebx
push ebx
and ebx, 0x9bf
pop ebx
mov eax, dword fs:[0x18]
mov dword [ebp - 0x1c34], eax
mov ecx, dword [ebp - 0x1c34]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x18d4], edx
mov eax, dword [ebp - 0x18d4]
mov dword [ebp - 0x150c], eax
push ecx
push ebx
add esp, 4
add ecx, 0x177de
xor ecx, 0x8f30
pop ecx
push eax
sub eax, 0x13311
and eax, 0xea4e
sub eax, 0xe0c6
pop eax
push edi
push ebx
add esp, 4
xor edi, 0xc199
pop edi
cmp dword [ebp - 0x150c], 0
jne 0x512a80
mov dword [ebp - 0x2a8], 0
jmp 0x512d27
mov ecx, dword [ebp - 0x150c]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xc4c], eax
push edx
push eax
add esp, 4
xor edx, 0x12448
pop edx
push ecx
push esi
add esp, 4
xor ecx, 0x1863
jmp 0x512ab0
call 0x512ac0
add byte [edi + 0x48], cl
dec esp
dec edx
aaa
dec ecx
dec esp
cmp bh, byte [edx + ecx*2]
add esp, 4
pop ecx
cmp dword [ebp - 0xc4c], 0
jne 0x512adc
mov dword [ebp - 0x2a8], 0
jmp 0x512d27
mov ecx, dword [ebp - 0xc4c]
mov dword [ebp - 0x4e4], ecx
Function at 0x5129f7
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edi
mov byte [ebp - 0x960], 0x56
mov byte [ebp - 0x95f], 0x69
mov byte [ebp - 0x95e], 0x72
mov byte [ebp - 0x95d], 0x74
mov byte [ebp - 0x95c], 0x75
mov byte [ebp - 0x95b], 0x61
mov byte [ebp - 0x95a], 0x6c
mov byte [ebp - 0x959], 0x50
mov byte [ebp - 0x958], 0x72
mov byte [ebp - 0x957], 0x6f
mov byte [ebp - 0x956], 0x74
mov byte [ebp - 0x955], 0x65
mov byte [ebp - 0x954], 0x63
mov byte [ebp - 0x953], 0x74
mov byte [ebp - 0x952], 0
push esi
xor esi, 0x15c6c
sub esi, 0x8456
call 0x5129f7
add byte [ebp + 0x49], al
dec ecx
inc ecx
cmp byte [edx + 0x40], cl
add esp, 4
pop esi
push ebx
push ebx
add esp, 4
add ebx, 0x16883
pop ebx
push ebx
and ebx, 0x9bf
pop ebx
mov eax, dword fs:[0x18]
mov dword [ebp - 0x1c34], eax
mov ecx, dword [ebp - 0x1c34]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x18d4], edx
mov eax, dword [ebp - 0x18d4]
mov dword [ebp - 0x150c], eax
push ecx
push ebx
add esp, 4
add ecx, 0x177de
xor ecx, 0x8f30
pop ecx
push eax
sub eax, 0x13311
and eax, 0xea4e
sub eax, 0xe0c6
pop eax
push edi
push ebx
add esp, 4
xor edi, 0xc199
pop edi
cmp dword [ebp - 0x150c], 0
jne 0x512a80
mov dword [ebp - 0x2a8], 0
jmp 0x512d27
mov ecx, dword [ebp - 0x150c]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xc4c], eax
push edx
push eax
add esp, 4
xor edx, 0x12448
pop edx
push ecx
push esi
add esp, 4
xor ecx, 0x1863
jmp 0x512ab0
call 0x512ac0
add byte [edi + 0x48], cl
dec esp
dec edx
aaa
dec ecx
dec esp
cmp bh, byte [edx + ecx*2]
add esp, 4
pop ecx
cmp dword [ebp - 0xc4c], 0
jne 0x512adc
mov dword [ebp - 0x2a8], 0
jmp 0x512d27
mov ecx, dword [ebp - 0xc4c]
mov dword [ebp - 0x4e4], ecx
Function at 0x512ac0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edi
mov byte [ebp - 0x960], 0x56
mov byte [ebp - 0x95f], 0x69
mov byte [ebp - 0x95e], 0x72
mov byte [ebp - 0x95d], 0x74
mov byte [ebp - 0x95c], 0x75
mov byte [ebp - 0x95b], 0x61
mov byte [ebp - 0x95a], 0x6c
mov byte [ebp - 0x959], 0x50
mov byte [ebp - 0x958], 0x72
mov byte [ebp - 0x957], 0x6f
mov byte [ebp - 0x956], 0x74
mov byte [ebp - 0x955], 0x65
mov byte [ebp - 0x954], 0x63
mov byte [ebp - 0x953], 0x74
mov byte [ebp - 0x952], 0
push esi
xor esi, 0x15c6c
sub esi, 0x8456
call 0x5129f7
add byte [ebp + 0x49], al
dec ecx
inc ecx
cmp byte [edx + 0x40], cl
add esp, 4
pop esi
push ebx
push ebx
add esp, 4
add ebx, 0x16883
pop ebx
push ebx
and ebx, 0x9bf
pop ebx
mov eax, dword fs:[0x18]
mov dword [ebp - 0x1c34], eax
mov ecx, dword [ebp - 0x1c34]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x18d4], edx
mov eax, dword [ebp - 0x18d4]
mov dword [ebp - 0x150c], eax
push ecx
push ebx
add esp, 4
add ecx, 0x177de
xor ecx, 0x8f30
pop ecx
push eax
sub eax, 0x13311
and eax, 0xea4e
sub eax, 0xe0c6
pop eax
push edi
push ebx
add esp, 4
xor edi, 0xc199
pop edi
cmp dword [ebp - 0x150c], 0
jne 0x512a80
mov dword [ebp - 0x2a8], 0
jmp 0x512d27
mov ecx, dword [ebp - 0x150c]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xc4c], eax
push edx
push eax
add esp, 4
xor edx, 0x12448
pop edx
push ecx
push esi
add esp, 4
xor ecx, 0x1863
jmp 0x512ab0
call 0x512ac0
add byte [edi + 0x48], cl
dec esp
dec edx
aaa
dec ecx
dec esp
cmp bh, byte [edx + ecx*2]
add esp, 4
pop ecx
cmp dword [ebp - 0xc4c], 0
jne 0x512adc
mov dword [ebp - 0x2a8], 0
jmp 0x512d27
mov ecx, dword [ebp - 0xc4c]
mov dword [ebp - 0x4e4], ecx
Function at 0x51311d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
add edx, 0xaca8
pop edx
push eax
and eax, 0xfd8b
pop eax
mov edx, dword [ebp - 0x4e8]
mov dword [ebp - 0x710], edx
jmp 0x5131a5
Function at 0x535b08
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x535b6c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x19c]
mov edx, dword [eax]
call dword [edx + 0x28]
push eax
push 0x64
mov eax, dword [ebx + 0x198]
mov eax, dword [eax + 0x30]
push eax
call sub.kernel32.dll_MulDiv
mov edx, eax
lea ecx, [ebp - 4]
mov eax, dword [0x672a04]
mov eax, dword [eax]
call fcn.006592b4
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.006431c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x535b73
lea eax, [ebp - 4]
call fcn.00403274
ret
Function at 0x53880c
Capabilities:
Read clipboard data

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov esi, edx
mov ebx, eax
cmp dword [ebx + 0x24], 0
jne 0x538824
push esi
call sub.user32.dll_GetClipboardData
jmp 0x53885e
mov edi, esi
mov edx, edi
mov eax, dword [ebx + 0x18]
call fcn.006521b4
test al, al
je 0x53885c
push esp
mov edx, edi
mov eax, dword [ebx + 0x18]
call fcn.00652150
mov edx, dword [ebx + 0x20]
mov edx, dword [edx + 0x1c]
mov eax, dword [edx + eax*4]
push eax
mov eax, dword [ebx + 0x24]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
test eax, eax
jne 0x53885c
mov eax, dword [esp + 4]
jmp 0x53885e
xor eax, eax
add esp, 0xc
pop edi
pop esi
pop ebx
ret

Function at 0x538a68
Capabilities:
Check for time delay via gettickcount
Open clipboard

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
call fcn.0065c614
mov esi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x10]
push eax
call sub.user32.dll_OpenClipboard
neg eax
sbb ebx, ebx
neg ebx
test bl, bl
jne 0x538a9c
call fcn.0065c614
sub eax, esi
mov edx, dword [ebp + 8]
cmp eax, dword [edx - 8]
jl 0x538a74
mov eax, ebx
pop esi
pop ebx
pop ebp
ret

Function at 0x538dd8
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x538ebd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebx + 0x2c]
call fcn.00403274
mov edx, dword [0x67601c]
mov eax, dword [ebx + 0x18]
call fcn.006521b4
test al, al
je 0x538ea7
mov eax, dword [0x67601c]
push eax
call sub.user32.dll_GetClipboardData
mov esi, eax
push esi
call sub.kernel32.dll_GlobalSize
mov edi, eax
lea eax, [ebx + 0x28]
mov edx, edi
call fcn.00403804
push esi
call sub.kernel32.dll_GlobalLock
mov edx, eax
lea eax, [ebx + 0x28]
mov ecx, edi
call fcn.00403358
push esi
call sub.kernel32.dll_GlobalUnlock
mov edx, dword [ebx + 0x28]
mov eax, 0x538ed4
call fcn.0065804c
mov esi, eax
test esi, esi
je 0x538e9f
add esi, 0xa
jmp 0x538e78
lea eax, [ebp - 4]
mov edx, dword [ebx + 0x28]
mov dl, byte [edx + esi - 1]
call fcn.00403418
mov edx, dword [ebp - 4]
lea eax, [ebx + 0x2c]
call fcn.00403524
inc esi
cmp edi, esi
jl 0x538e9f
mov eax, dword [ebx + 0x28]
cmp byte [eax + esi - 1], 0x20
je 0x538e5d
mov eax, dword [ebx + 0x28]
xor edx, edx
mov dl, byte [eax + esi - 1]
mov eax, dword [0x673030]
mov eax, dword [eax]
call fcn.006524fc
test al, al
jne 0x538e5d
lea eax, [ebx + 0x2c]
call fcn.00657234
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x538ec4
lea eax, [ebp - 4]
call fcn.00403274
ret
Function at 0x5390d0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x53921e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 0x28]
call fcn.004b32b4
lea eax, [ebp - 4]
mov ecx, 0x539230
mov edx, dword [0x67600c]
call fcn.00403b24
mov eax, dword [ebp - 4]
call fcn.0065180c
mov edx, dword [ebp + 8]
mov dword [edx - 4], eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_DeleteFileW
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
cmp dword [eax + 8], 0
jle 0x5391f5
push 0x539244
call sub.kernel32.dll_lstrlenA
mov ebx, eax
add ebx, 0x14
mov edx, 0x53929c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
call fcn.006573c8
mov esi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edi, dword [eax + 4]
sub esi, edi
add esi, ebx
add esi, 0x16
mov edx, 0x5392b4
mov eax, dword [ebp + 8]
mov eax, edi
call fcn.006573c8
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
sub eax, dword [edx + 4]
add eax, ebx
sub eax, 2
mov edi, eax
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x28], ebx
mov byte [ebp - 0x24], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 8]
add eax, ebx
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
mov dword [ebp - 0x18], esi
mov byte [ebp - 0x14], 0
mov dword [ebp - 0x10], edi
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x28]
mov eax, 0x539244
mov ecx, 3
call fcn.00659050
push ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
xor ecx, ecx
mov edx, dword [ebp - 8]
call fcn.00651b1c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
call fcn.006238a4
mov edx, dword [ebp + 8]
mov dword [edx - 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004028c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x539225
lea eax, [ebp - 8]
call fcn.00403274
lea eax, [ebp - 4]
call fcn.00403880
ret
Function at 0x5397f4
Capabilities:
Write clipboard data

Disassembly:
push ebx
mov ebx, edx
test ebx, ebx
je 0x53981b
call sub.user32.dll_EmptyClipboard
mov eax, ebx
call fcn.00403ab8
mov edx, eax
inc edx
add edx, edx
mov eax, ebx
call fcn.006238a4
push eax
push 0xd
call sub.user32.dll_SetClipboardData
pop ebx
ret

Function at 0x539d88
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov edi, ecx
mov dword [esp], edx
mov ebp, eax
mov byte [esp + 4], 0
mov ecx, 1
mov edx, 0x80000000
mov eax, dword [esp]
call fcn.0065c53c
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x539dc5
mov eax, dword [0x671bb0]
mov eax, dword [eax]
mov edx, dword [esp]
call fcn.006235b8
jmp 0x539e1a
push 0
push ebx
call sub.kernel32.dll_GetFileSize
mov esi, eax
mov eax, edi
mov edx, esi
call fcn.00403804
push 0
lea eax, [esp + 0xc]
push eax
push esi
mov eax, dword [edi]
push eax
push ebx
call sub.kernel32.dll_ReadFile
test eax, eax
jne 0x539e04
mov edx, dword [ebp + 4]
mov eax, dword [0x671e84]
mov eax, dword [eax]
call fcn.006235b8
push ebx
call sub.kernel32.dll_CloseHandle
jmp 0x539e1a
push ebx
call sub.kernel32.dll_CloseHandle
lea eax, [ebp + 4]
mov edx, dword [esp]
call fcn.004038bc
mov byte [esp + 4], 1
mov al, byte [esp + 4]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x539e28
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x539e30
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x53a016
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, dword [ebp - 8]
call fcn.0065180c
mov ebx, eax
mov ecx, dword [ebx + 8]
mov edx, dword [ebx + 4]
lea eax, [ebp - 0x10]
call fcn.00403358
mov eax, ebx
call fcn.004028c0
mov eax, dword [0x676034]
mov edi, dword [eax + 0x18]
dec edi
test edi, edi
jl 0x539f36
inc edi
xor esi, esi
mov eax, dword [0x676034]
mov eax, dword [eax + 0x1c]
mov ebx, dword [eax + esi*4]
cmp byte [ebx + 0x427], 0
jne 0x539f2e
cmp byte [ebx + 0x45c], 0
jne 0x539f2e
cmp byte [ebx + 0x43c], 0
je 0x539ec3
mov eax, dword [ebx + 0x160]
call fcn.006584d0
test al, al
je 0x539f2e
cmp dword [ebp - 0x18], 0
je 0x539ed6
lea eax, [ebp - 0x18]
mov edx, 0x53a02c
call fcn.00403ac4
mov eax, dword [0x676034]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + esi*4]
cmp eax, dword [0x67603c]
jne 0x539ef6
lea eax, [ebp - 0x18]
mov edx, 0x53a038
call fcn.00403ac4
lea edx, [ebp - 0x20]
mov eax, dword [ebx + 0x160]
call fcn.00629fe0
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
call fcn.00403ac4
cmp byte [ebx + 0x3f6], 0
je 0x539f2e
cmp byte [ebx + 0x3f7], 0
je 0x539f2e
lea eax, [ebp - 0x18]
mov edx, 0x53a040
call fcn.00403ac4
inc esi
dec edi
jne 0x539e86
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0x18]
call fcn.00658264
mov eax, dword [ebp - 0x14]
call fcn.0040351c
mov ebx, eax
mov eax, dword [ebp - 0x18]
call fcn.00403ab8
cmp ebx, eax
je 0x539f6d
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x14]
call fcn.00658454
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0x14]
call fcn.0040330c
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.0040362c
je 0x539fdf
mov eax, dword [ebp - 8]
call fcn.0065c55c
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x539f9b
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.006236a4
cmp ax, 2
je 0x539fe3
jmp 0x539f7a
cmp dword [ebp - 0x14], 0
je 0x539fd9
push 0
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x14]
call fcn.0040351c
push eax
mov eax, dword [ebp - 0x14]
push eax
push ebx
call sub.kernel32.dll_WriteFile
test eax, eax
jne 0x539fd9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dl, 2
call fcn.006236a4
cmp ax, 2
jne 0x539fa1
push ebx
call sub.kernel32.dll_CloseHandle
jmp 0x539fe3
push ebx
call sub.kernel32.dll_CloseHandle
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53a01d
lea eax, [ebp - 0x24]
call fcn.00403274
lea eax, [ebp - 0x20]
call fcn.00403880
lea eax, [ebp - 0x18]
call fcn.00403880
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00403298
ret
Function at 0x53a298
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd88
push ebx
xor edx, edx
mov dword [ebp - 0x270], edx
mov dword [ebp - 0x274], edx
mov dword [ebp - 0x278], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov ebx, eax
lea eax, [ebp - 0x26c]
mov edx, dword [0x656638]
call fcn.00403e48
xor eax, eax
push ebp
push 0x53a3ee
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00650ca0
mov dword [ebx + 8], eax
lea eax, [ebp - 4]
call fcn.0061feb4
mov ecx, dword [0x671dec]
mov ecx, dword [ecx + 4]
lea eax, [ebp - 0x278]
mov edx, 0x53a404
call fcn.00403568
mov edx, dword [ebp - 0x278]
lea eax, [ebp - 0x274]
call fcn.00403a34
mov ecx, dword [ebp - 0x274]
lea eax, [ebp - 0x270]
mov edx, dword [ebp - 4]
call fcn.00403b24
mov eax, dword [ebp - 0x270]
lea ecx, [ebp - 0x26c]
mov edx, 0x20
call fcn.006585c8
test eax, eax
jne 0x53a390
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0x264]
mov edx, dword [ebp - 4]
call fcn.00403b24
mov eax, dword [ebp - 8]
call fcn.0053a270
test al, al
jne 0x53a381
cmp dword [ebp - 0x26c], 0
jne 0x53a376
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_DeleteFileW
jmp 0x53a381
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 8]
mov ecx, dword [eax]
call dword [ecx + 0x30]
lea eax, [ebp - 0x26c]
call fcn.0065866c
test eax, eax
je 0x53a345
lea eax, [ebp - 0x26c]
call fcn.00658690
mov eax, dword [ebx + 8]
cmp dword [eax + 0x24], 0
setg al
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53a3f5
lea eax, [ebp - 0x278]
call fcn.00403274
lea eax, [ebp - 0x274]
mov edx, 2
call fcn.00403898
lea eax, [ebp - 0x26c]
mov edx, dword [0x656638]
call fcn.00403f10
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403898
ret
Function at 0x53bf2c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
xor eax, eax
push ebp
push 0x53c012
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x437778]
call fcn.00437920
mov ebx, eax
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00437958
test al, al
je 0x53bfe2
mov byte [ebp - 9], 1
call fcn.00650ca0
mov edi, eax
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.0053a048
test al, al
je 0x53bfcb
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
dec eax
test eax, eax
jl 0x53bfcb
inc eax
mov dword [ebp - 0x10], eax
xor esi, esi
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + esi*4]
mov eax, dword [eax + 0x160]
call fcn.00658904
mov ecx, dword [ebp - 0x14]
mov eax, dword [edi + 0x18]
mov edx, dword [eax + esi*4]
mov eax, ebx
call fcn.00437e04
test al, al
jne 0x53bfc5
mov byte [ebp - 9], 0
jmp 0x53bfcb
inc esi
dec dword [ebp - 0x10]
jne 0x53bf94
mov eax, edi
call fcn.0053a168
mov eax, edi
call fcn.004028c0
mov eax, ebx
call fcn.00438108
jmp 0x53bfe6
mov byte [ebp - 9], 0
cmp byte [ebp - 9], 0
jne 0x53bff5
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_DeleteFileW
mov eax, ebx
call fcn.004028c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53c019
lea eax, [ebp - 0x14]
call fcn.00403880
ret