joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49dcb7
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
jmp 0x49dd01
mov cx, word [esp]
jmp 0x49dce2
mov al, bl
add ebp, dword [esi]
mov eax, dword [esp]
mov ch, 0xd5
jmp 0x49dd11
not ebp
not ecx
cmp edx, ecx
jb 0x49dcd8
mov cx, word [esp]
mov al, bl
jmp 0x49dce4
xchg cx, ax
rdtsc
jmp 0x49dd9a

Function at 0x49de88
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dl, 0x5e
jmp 0x49df86
lea edx, [eax*4]
jmp 0x49df69
rol al, 0
bts edx, ecx
jae 0x49df28
lea edx, [eax*4]
sub esp, 2
inc dh
lea edx, reloc.mscoree.dll__CorExeMain
lea esp, [esp + 2]
jmp 0x49dfd7
sub esp, 2
inc dh
lea edx, reloc.mscoree.dll__CorExeMain
jmp 0x49dfd3
ror al, 0
mov dl, byte [esp]
bswap edx
mov dx, word [esp]
pushfd
lea edx, [eax*4]
jmp 0x49df3e
rcr ah, cl
jl 0x49e01d
mov al, 0xd6
lea eax, [esp + ebx]
mov al, byte [esp]
rdtsc
rdtsc
jmp 0x49dffd
lea edx, [edi*4]
mov eax, dword [esp]
dec ebp
lea eax, [edi - 0x53]
rdtsc
jmp 0x49df9c
lea esp, [esp + 2]
sub bl, al
mov ah, dh
lea edx, [eax + edi]
jmp 0x49dfb2
mov al, byte [esp]
rdtsc
rdtsc
call 0x49dfe0
lea esp, [esp + 4]
not cl
mov ax, bx
xchg al, dh
neg ax
jmp 0x49e024
mov al, 0xd6
lea eax, [esp + ebx]
jmp 0x49dff6
jge 0x49e03a
sub esp, 0xe
xchg dh, ah
jmp 0x49e05d
sub esp, 0xe
xchg dh, ah
pop dx
pop edx
lea eax, [ecx + edi]
lea esp, [esp + 0xc]
xor cl, 0x3c
jmp 0x49e064
int3
pop dx
lea eax, [ecx + edi]
jmp 0x49e044
mov dx, 0x15f2
sete dl
sub esp, 0xd
ja 0x49e099
xchg word [esp + 7], ax
call fcn.0049ea10
fidiv dword [reloc.mscoree.dll__CorExeMain]
push dword [esp + 4]
ret 8
mov al, 0x60
bswap edx
lea esp, [esp + 9]
jmp 0x49e0ae
xchg word [esp + 7], ax
jmp 0x49e083
rol cl, 0
xchg dx, ax
bts ax, si
jle 0x49e0f2
jg 0x49e0d2
loop 0x49e12f
loope 0x49e040
jae 0x49e085
in al, 0x72
loopne 0x49e04d
jb 0x49e07c
ljmp 0xc20c:0x2474ff05
lea eax, [ecx + ebp]
jmp 0x49e0f5
jmp 0x49e140
lea esp, [esp + 1]
jmp 0x49e116
lea eax, [ecx + ebp]
lea esp, [esp + 4]
xor cl, 0x4f
sub esp, 0x19
jne 0x49e0d7
mov dx, word [esp + 0x13]
mov dh, bh
sub ax, 0x59bc
lea esp, [esp + 1]
jmp 0x49e116
lea esp, [esp + 0x18]
add cl, 0x3a
lea edx, [eax + ecx]
inc eax
jmp 0x49e343
lea eax, reloc.mscoree.dll__CorExeMain
call fcn.0049e18e
xlatb
add byte [eax], al
add bh, dl
push ebx
ret
mov dx, word [esp + 0x13]
mov dh, bh
sub ax, 0x59bc
jmp 0x49e0d9
mov dword [esp + 0x12], ebx
mov al, bl
mov dword [esp + 0x34], ecx
jmp 0x49e1b2
setbe dl
clc
lea esp, [esp + 0x18]
popal
jmp 0x49e1e0
jmp 0x49e1a2
bswap edx
mov edx, eax
mov dx, 0x186
shl eax, 2
call fcn.0049e1ca
mov edi, 0x72b94a2f
or al, 0x90
push es
popal
nop
push ebx
lea ebx, [edi + ebp*2]
jbe 0x49e267
mov edx, ebx
lea edx, [ecx + ebp]
push dword [esp]
ret 4
lodsb al, byte [esi]
pushal
sub esp, 0x18
jbe 0x49e1c8
mov dword [esp + 0x12], ebx
mov al, bl
mov dword [esp + 0x34], ecx
setbe dl
clc
jmp 0x49e1b6
jno 0x49e127
lea eax, reloc.mscoree.dll__CorExeMain
jmp 0x49e268
Function at 0x4a2739
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x34]
not edi
sbb cx, 0x9b72
jmp 0x4a2744
pushal
pop dx
mov ecx, ebp
lea esp, [esp + 3]
jmp 0x4a2723
jl 0x4a275a
setl al
rdtsc
jmp 0x4a278c
setl al
rdtsc
rdtsc
cmc
sbb cx, sp
call fcn.004a2798
mov dh, 0x22
mov al, 0xd7
and ah, bh
jecxz 0x4a278c
not edi
jmp 0x4a2ca4
rdtsc
cmc
sbb cx, sp
jmp 0x4a2776
or edx, 0xb3da89be
mov cl, al
jmp 0x4a2c5e
sub al, 0x2d
or edx, 0xb3da89be
mov cl, al
inc edi
neg cx
jmp 0x4a2c68
js 0x4a2c7e
mov ah, byte [esp]
neg ch
jmp 0x4a2c8c
mov ah, byte [esp]
neg ch
xchg dx, cx
jmp 0x4a2cc8
xchg dx, cx
mov dh, byte [esp]
jmp 0x4a2ccb
mov dx, word [esp]
bsf dx, dx
je 0x4a2c54
sub al, 0x2d
jmp 0x4a2c37
mov cx, word [esp]
mov ecx, ebp
setl cl
lea eax, [edi + ebp]
jmp 0x4a2cd4
mov dh, byte [esp]
inc edi
lea eax, [eax + esi]
lea ecx, [edx + ebp]
jmp 0x4a2cb2
neg edi
not dx
add edi, dword [esi]
lea edx, [edi + ebp]
jmp 0x4a2e6f
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x407281
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x461124], 0
jne 0x4072bf
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x407295
mov dword [ecx*4 + 0x461120], eax
inc ecx
cmp ecx, 0x100
jl 0x407290
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x4072ec
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x461120]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4072cd
not eax
pop ebp
ret 0xc

Function at 0x42e000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x40268b
Capabilities:
Clear file content
Get common file path
Get keyboard layout

Disassembly:
sub esp, 0x800
push esi
push edi
xor esi, esi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
cmp edi, 0x58ce99d
jg 0x4026af
inc edi
cmp edi, 0x1f6502b0
jl 0x402697
cmp dword [0x2be260c], 0x400
jne 0x4026fc
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push esi
push esi
call dword [sym.imp.USER32.dll_DdeCmpStringHandles]
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
push str.teyikekosigokifaruwoxuhaked
push esi
call fcn.00402b08
push esi
push esi
push esi
call fcn.00402ad8
push esi
push esi
call fcn.004028fc
push esi
call fcn.00402c5e
push esi
call fcn.00402c6d
add esp, 0x24
xor edi, edi
cmp edi, 0xd0fe
jge 0x40270d
push esi
call dword [sym.imp.USER32.dll_GetCaretPos]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
cmp edi, 0x3a37ee
jg 0x402734
inc edi
cmp edi, 0xe52f
jl 0x4026fe
mov eax, dword [0x423eb4]
mov dword [0x2be260c], eax
call fcn.00402447
mov edi, 0x3078f
cmp dword [0x2be260c], 0x51f
jne 0x402760
push esi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec edi
jne 0x402748
pop edi
xor eax, eax
pop esi
add esp, 0x800
ret 0x10

Function at 0x40775e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x423b80]
jne 0x407768
repz ret
jmp fcn.0040999c
Function at 0x4093dd
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x423b80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00403b24
and dword [ebp - 0x14], 0
cmp dword [0x42e9dc], 0
mov dword [ebp - 0x18], eax
jne 0x409490
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x409538
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x409538
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42e9dc], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42e9e0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x42e9e4], eax
call edi
push eax
call esi
mov dword [0x42e9ec], eax
test eax, eax
je 0x409490
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x42e9e8], eax
mov eax, dword [0x42e9e8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4094e9
cmp dword [0x42e9ec], ecx
je 0x4094e9
push eax
call esi
push dword [0x42e9ec]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4094e9
test ebx, ebx
je 0x4094e9
call edi
test eax, eax
je 0x4094e0
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4094e0
test byte [ebp - 8], 1
jne 0x4094e9
or dword [ebp + 0x10], 0x200000
jmp 0x40951c
mov eax, dword [0x42e9e0]
cmp eax, dword [ebp - 0x18]
je 0x40951c
push eax
call esi
test eax, eax
je 0x40951c
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40951c
mov eax, dword [0x42e9e4]
cmp eax, dword [ebp - 0x18]
je 0x40951c
push eax
call esi
test eax, eax
je 0x40951c
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42e9dc]
call esi
test eax, eax
je 0x409538
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40953a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040775e
leave
ret
Function at 0x40e300
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5193b6
mov eax, dword fs:[0]
push eax
sub esp, 0x374
mov eax, dword [0x56d370]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x37c], ebx
mov dword [ebp - 0x364], ebx
mov dword [ebp - 0x380], ebx
mov dword [ebx], 0
xor edi, edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x36c], edi
mov dword [ebp - 0x368], edi
lea esi, [ebp - 0x218]
mov byte [ebp - 4], 1
mov eax, esi
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
cmp eax, 0x104
jbe 0x40e420
xor ebx, ebx
add eax, 0xa
mov dword [ebp - 0x364], eax
mov byte [ebp - 4], 2
mov esi, ebx
je 0x40e400
test ebx, ebx
je 0x40e39f
cmp eax, dword [ebp - 0x368]
jle 0x40e400
push eax
call fcn.004075b0
xor ecx, ecx
mov dword [ebp - 0x368], eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0047ffab
add esp, 8
mov esi, eax
test ebx, ebx
je 0x40e3ed
mov ebx, dword [ebp - 0x368]
lea eax, [ebx - 1]
push eax
push edi
push esi
call fcn.004a0261
xor eax, eax
push edi
mov word [esi + ebx*2 - 2], ax
call fcn.0047f552
add esp, 0x10
jmp 0x40e3f2
xor eax, eax
mov word [esi], ax
mov eax, dword [ebp - 0x364]
mov edi, esi
mov dword [ebp - 0x36c], edi
push edi
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ebx, esi
cmp eax, dword [ebp - 0x364]
ja 0x40e382
mov ebx, dword [ebp - 0x37c]
test eax, eax
je 0x40e4bc
push 1
push 0xffffffffffffffff
push 0xfde9
push esi
lea ecx, [ebp - 0x378]
call fcn.00411420
mov esi, dword [ebp - 0x374]
push dword [ebx]
mov dword [ebp - 0x374], 0
mov dword [ebp - 0x378], 0
call fcn.0047f552
add esp, 4
mov dword [ebx], esi
cmp byte [ebp - 0x370], 0
mov eax, dword [ebp - 0x374]
mov byte [ebp - 4], 3
je 0x40e48f
test eax, eax
je 0x40e48f
push dword [ebp - 0x378]
push eax
call fcn.00408000
mov eax, dword [ebp - 0x374]
add esp, 8
push eax
call fcn.0047f552
push edi
call fcn.0047f552
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047fc61
mov esp, ebp
pop ebp
ret
call fcn.0049d31c
lea ecx, [ebp - 0x360]
push dword [eax]
push str.GetCurrentDirectory
call fcn.00402910
push 0x5582d8
lea eax, [ebp - 0x360]
push eax
call fcn.00481150
int3
Function at 0x40f0c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x519580
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
mov eax, dword [0x56d370]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 1
push 0xffffffffffffffff
push 0xfde9
push dword [ebp + 8]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov byte [ebp - 0x10], 0
call fcn.0042a6c0
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
cmp byte [ebp - 0x10], 0
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 4], 0
je 0x40f141
test ecx, ecx
je 0x40f141
mov eax, dword [ebp - 0x18]
add eax, eax
push eax
push ecx
call fcn.00408000
mov ecx, dword [ebp - 0x14]
add esp, 8
push ecx
call fcn.0047f552
add esp, 4
test bl, bl
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40f160
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5195a8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x56d370]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [eax]
mov eax, dword [eax + 4]
cmp esi, eax
mov dword [ebp + 0xc], eax
je 0x40f2d3
mov ebx, dword [ebp + 0x10]
mov edx, dword [esi]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
cmp byte [edx], 0
je 0x40f1e2
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40f1b8
sub eax, edi
mov al, byte [eax + edx - 1]
cmp al, 0x5c
je 0x40f1cd
cmp al, 0x2f
jne 0x40f1e2
push ebx
push edx
lea eax, [ebp - 0x14]
push 0x529908
push eax
call fcn.00407700
add esp, 0x10
jmp 0x40f1f7
push ebx
push 0x5c
push edx
lea eax, [ebp - 0x14]
push str._s_c_s
push eax
call fcn.00407700
add esp, 0x14
mov edi, dword [ebp - 0x14]
push 0
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
call fcn.0047f552
push dword [ebp - 0x14]
call fcn.0047f552
add esp, 8
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x18], 0
push 1
push 0xffffffffffffffff
push 0xfde9
push edi
call fcn.0042a6c0
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
cmp byte [ebp - 0x18], 0
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 4], 1
je 0x40f27a
test ecx, ecx
je 0x40f27a
mov eax, dword [ebp - 0x20]
add eax, eax
push eax
push ecx
call fcn.00408000
mov ecx, dword [ebp - 0x1c]
add esp, 8
push ecx
call fcn.0047f552
add esp, 4
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0xffffffff
test bl, bl
jne 0x40f2b0
push edi
call fcn.0047f552
add esi, 4
add esp, 4
cmp esi, dword [ebp + 0xc]
jmp 0x40f195
mov esi, dword [ebp + 8]
push 0
mov dword [esi], edi
call fcn.0047f552
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40f2f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5195db
mov eax, dword fs:[0]
push eax
sub esp, 0x284
mov eax, dword [0x56d370]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x27c]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
push 1
push 0x52c48c
push eax
mov dword [ebp - 0x290], esi
mov dword [ebp - 4], 0
call fcn.0042a240
mov byte [ebp - 4], 1
nop
lea ecx, [ebp - 0x27c]
call fcn.0042a430
test eax, eax
je 0x40f4b2
push dword [ebp - 0x1c]
call fcn.00410830
add esp, 4
test al, al
je 0x40f3bd
push edi
push dword [ebp - 0x1c]
lea eax, [ebp - 0x28c]
push eax
call fcn.0040f2f0
mov ecx, dword [ebp - 0x28c]
add esp, 0xc
push 0
test ecx, ecx
je 0x40f3b5
mov dword [ebp - 0x28c], 0
mov dword [esi], ecx
call fcn.0047f552
add esp, 4
lea ecx, [ebp - 0x27c]
call fcn.0042a3e0
jmp 0x40f4d1
call fcn.0047f552
add esp, 4
mov eax, dword [ebp - 0x18]
test edi, edi
je 0x40f3f7
test eax, eax
je 0x40f350
mov ecx, edi
nop word [eax + eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x40f3f0
test dl, dl
je 0x40f3ec
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x40f3f0
add ecx, 2
add eax, 2
test dl, dl
jne 0x40f3d0
xor eax, eax
jmp 0x40f3fb
sbb eax, eax
or eax, 1
jmp 0x40f3fb
neg eax
sbb eax, eax
test eax, eax
jne 0x40f350
push 1
push 0xffffffffffffffff
push 0xfde9
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x288]
mov dword [ebp - 0x288], eax
mov dword [ebp - 0x284], eax
mov byte [ebp - 0x280], al
call fcn.0042a6c0
push dword [ebp - 0x284]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
cmp byte [ebp - 0x280], 0
mov ecx, dword [ebp - 0x284]
mov byte [ebp - 4], 2
je 0x40f46d
test ecx, ecx
je 0x40f46d
mov eax, dword [ebp - 0x288]
add eax, eax
push eax
push ecx
call fcn.00408000
mov ecx, dword [ebp - 0x284]
add esp, 8
push ecx
call fcn.0047f552
add esp, 4
mov dword [ebp - 0x288], 0
mov dword [ebp - 0x284], 0
mov byte [ebp - 4], 1
test bl, bl
je 0x40f350
push 0xffffffffffffffff
push dword [ebp - 0x1c]
call fcn.00407040
add esp, 8
mov dword [esi], eax
lea ecx, [ebp - 0x27c]
call fcn.0042a3e0
jmp 0x40f4d1
lea ecx, [ebp - 0x27c]
call fcn.0042a3e0
jmp 0x40f4cb
mov dword [esi], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0047fc61
mov esp, ebp
pop ebp
ret
Function at 0x4100c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
mov eax, dword [0x56d370]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push esi
push dword [ebp + 0x10]
push 1
push eax
call fcn.0049f656
add esp, 0x10
test eax, eax
jle 0x4100fc
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0047fc61
mov esp, ebp
pop ebp
ret
push esi
call fcn.0049f3a8
add esp, 4
test eax, eax
jne 0x41012e
lea eax, [ebp - 0x14c]
push str.reading_from_file_failed
push eax
call fcn.00406390
add esp, 8
lea eax, [ebp - 0x14c]
push 0x5598a4
push eax
call fcn.00481150
push str.End_of_file
lea ecx, [ebp - 0x148]
call fcn.0040e560
push 0x55986c
lea eax, [ebp - 0x148]
push eax
call fcn.00481150
int3

Function at 0x4101b0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5197a0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
mov eax, dword [0x56d370]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 1
push 0xffffffffffffffff
push 0xfde9
push dword [ebp + 8]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov byte [ebp - 0x10], 0
call fcn.0042a6c0
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
cmp byte [ebp - 0x10], 0
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 4], 0
je 0x410230
test ecx, ecx
je 0x410230
mov eax, dword [ebp - 0x18]
add eax, eax
push eax
push ecx
call fcn.00408000
mov ecx, dword [ebp - 0x14]
add esp, 8
push ecx
call fcn.0047f552
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4102c0
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5197c0
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x56d370]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
test edi, edi
jle 0x41049d
dec edi
test edi, edi
jle 0x41045a
lea eax, [edi + 1]
push eax
push ecx
push ebx
lea eax, [ebp - 0x1c]
push str._s_s_d
push eax
call fcn.00402670
push edi
mov esi, dword [eax]
mov eax, dword [ebp + 0xc]
push eax
push ebx
lea eax, [ebp - 0x14]
push str._s_s_d
push eax
call fcn.00402670
add esp, 0x28
mov dword [ebp - 0x30], 0
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x2c], 0
mov byte [ebp - 0x28], 0
mov ebx, dword [eax]
push 1
push 0xffffffffffffffff
push 0xfde9
push esi
call fcn.0042a6c0
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x410386
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x410386
cmp byte [ebp - 0x28], 0
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 4], 0
je 0x41041a
jmp 0x410404
mov esi, dword [ebp - 0x2c]
lea ecx, [ebp - 0x3c]
push 1
push 0xffffffffffffffff
push 0xfde9
push ebx
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov byte [ebp - 0x34], 0
call fcn.0042a6c0
push esi
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
cmp byte [ebp - 0x34], 0
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 4], 1
je 0x4103dd
test ecx, ecx
je 0x4103dd
mov eax, dword [ebp - 0x3c]
add eax, eax
push eax
push ecx
call fcn.00408000
mov ecx, dword [ebp - 0x38]
add esp, 8
push ecx
call fcn.0047f552
add esp, 4
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
cmp byte [ebp - 0x28], 0
mov dword [ebp - 4], 2
je 0x410417
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x41041a
mov eax, dword [ebp - 0x30]
add eax, eax
push eax
push ecx
call fcn.00408000
add esp, 8
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.0047f552
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x30], 0
push dword [ebp - 0x14]
call fcn.0047f552
push dword [ebp - 0x1c]
call fcn.0047f552
mov ebx, dword [ebp + 8]
dec edi
mov ecx, dword [ebp + 0xc]
add esp, 8
test edi, edi
jg 0x410302
push ecx
push ebx
lea eax, [ebp - 0x14]
push str._s_s1
push eax
call fcn.00402670
mov esi, dword [eax]
mov eax, dword [ebp + 0xc]
push eax
push ebx
lea eax, [ebp - 0x1c]
push 0x529908
push eax
call fcn.00402670
push esi
push dword [eax]
call fcn.004104e0
push dword [ebp - 0x1c]
call fcn.0047f552
push dword [ebp - 0x14]
call fcn.0047f552
mov ecx, dword [ebp + 0xc]
add esp, 0x30
push ecx
push ebx
lea eax, [ebp - 0x24]
push 0x529908
push eax
call fcn.00402670
push dword [eax]
push ebx
call fcn.004104e0
push dword [ebp - 0x24]
mov bl, al
call fcn.0047f552
add esp, 0x1c
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret