joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001c83a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x1001c881
call fcn.1000ec3e
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x1001c881
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x1001c89d
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.1001c33f
mov esi, eax
test edi, edi
je 0x1001c89b
test ebx, ebx
je 0x1001c89b
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x1001cd37
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x1011e5be
call fcn.100feeae
mov esi, ecx
cmp dword [esi + 0x6c], 0
jne 0x1001cd5c
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x1001cdae
call fcn.10011b58
push eax
lea ecx, [ebp - 0x10]
call fcn.1000b6e2
mov ecx, dword [esi + 0x6c]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.101014dc
push eax
call fcn.1000aba3
add esp, 0x14
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.1000af29
mov eax, esi
call fcn.100fef86
ret 8

Function at 0x1004697a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.1000ec3e
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x100469b3
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.100465bc
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x10046a11
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x78], ebx
test ebx, 0xffff0000
jne 0x10046a35
cmp dword [edi + 0x74], 0
jne 0x10046a35
movzx eax, bx
mov dword [edi + 0x74], eax
call fcn.1000ec3e
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.100469d2
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x10048abd
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
mov ecx, esi
call fcn.1004877c
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x10048b07
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.10011a52
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.1000d3b7
jmp 0x10048b12
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.10010320
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x10048b18
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 4]
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
call fcn.1001ca01
push 0xfffffffffffffff0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongA]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x10048b55
call fcn.1004877c
mov dword [esi + 0xc], 1
jmp 0x10048b5a
call fcn.1004877c
cmp dword [esi], 0
je 0x10048ba3
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
test eax, eax
jle 0x10048b7b
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.10011a52
jmp 0x10048b8d
mov ecx, dword [ebp + 0x10]
push 0xff
call fcn.1000b8a5
push 0x100
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.1000d3b7
jmp 0x10048bc7
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x10048bc7
push dword [esi]
push dword [ebp + 8]
call fcn.10010320
pop esi
pop ebp
ret 0xc

Function at 0x10078082
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 4], ecx
test esi, esi
jne 0x1007809c
call fcn.1000ec3e
mov esi, dword [eax + 0xc]
push dword [0x1017397c]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x100780ba
xor eax, eax
pop edi
pop esi
leave
ret 8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x100780b2
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x100780e7
xor esi, esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop ebx
jmp 0x100780b4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.10077fb0
mov esi, eax
jmp 0x100780d9

Function at 0x100c31ed
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.100f74c9
call fcn.1000e66f
cmp dword [eax + 0x14], 0
jne 0x100c320a
mov ecx, esi
pop esi
jmp fcn.100c2cf2
pop esi
ret
Function at 0x100c6372
Capabilities:
Get common file path
Get file system object information

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.100721f9
call fcn.1000e66f
cmp dword [eax + 0x14], 0
jne 0x100c638f
mov ecx, esi
pop esi
jmp fcn.100c5d45
pop esi
ret

Function at 0x100d87ae
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test byte [esi + 4], 1
push edi
mov ebx, ecx
je 0x100d87c6
mov edi, dword [esi + 0xc]
jmp 0x100d8806
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x100d87df
call fcn.1000effd
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x100d87f4
call fcn.1000effd
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x100d8806
call fcn.1000effd
call fcn.1000ec3e
cmp dword [eax + 0x3c], 0
je 0x100d881b
push edi
mov ecx, ebx
call fcn.100d766c
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.100d86c8
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x7c]
test eax, eax
je 0x100d8839
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [ebx + 0x7c], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x100d8845
mov edi, eax
mov dword [ebx + 0x7c], eax
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x100fdcec
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1016e630]
jne 0x100fdcf6
repz ret
jmp fcn.10106bec
Function at 0x10113467
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1016e630]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.10105702
and dword [ebp - 0x14], 0
cmp dword [0x10176150], 0
mov dword [ebp - 0x18], eax
jne 0x1011351a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x101135c2
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x101135c2
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x1014e9b0
push ebx
mov dword [0x10176150], eax
call edi
push eax
call esi
push 0x1014e99c
push ebx
mov dword [0x10176154], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x10176158], eax
call edi
push eax
call esi
mov dword [0x10176160], eax
test eax, eax
je 0x1011351a
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x1017615c], eax
mov eax, dword [0x1017615c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x10113573
cmp dword [0x10176160], ecx
je 0x10113573
push eax
call esi
push dword [0x10176160]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x10113573
test ebx, ebx
je 0x10113573
call edi
test eax, eax
je 0x1011356a
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x1011356a
test byte [ebp - 8], 1
jne 0x10113573
or dword [ebp + 0x10], 0x200000
jmp 0x101135a6
mov eax, dword [0x10176154]
cmp eax, dword [ebp - 0x18]
je 0x101135a6
push eax
call esi
test eax, eax
je 0x101135a6
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x101135a6
mov eax, dword [0x10176158]
cmp eax, dword [ebp - 0x18]
je 0x101135a6
push eax
call esi
test eax, eax
je 0x101135a6
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x10176150]
call esi
test eax, eax
je 0x101135c2
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x101135c4
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100fdcec
leave
ret
Function at 0x404bef
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40db60]
jne 0x404bf9
repz ret
jmp fcn.0040883b

Function at 0x4060f3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004029c4
and dword [ebp - 4], 0
cmp dword [0x40e54c], 0
mov ebx, eax
jne 0x4061a4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406255
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40aa14
push edi
call esi
test eax, eax
je 0x406255
push eax
call fcn.00402952
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40e54c], eax
call esi
push eax
call fcn.00402952
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40e550], eax
call esi
push eax
call fcn.00402952
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40e554], eax
call esi
push eax
call fcn.00402952
pop ecx
mov dword [0x40e55c], eax
test eax, eax
je 0x4061a4
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402952
pop ecx
mov dword [0x40e558], eax
mov eax, dword [0x40e558]
cmp eax, ebx
je 0x4061fc
cmp dword [0x40e55c], ebx
je 0x4061fc
push eax
call fcn.004029cd
push dword [0x40e55c]
mov esi, eax
call fcn.004029cd
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4061fc
test edi, edi
je 0x4061fc
call esi
test eax, eax
je 0x4061f3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4061f3
test byte [ebp - 0xc], 1
jne 0x4061fc
or dword [ebp + 0x10], 0x200000
jmp 0x406235
mov eax, dword [0x40e550]
cmp eax, ebx
je 0x406235
push eax
call fcn.004029cd
pop ecx
test eax, eax
je 0x406235
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x406235
mov eax, dword [0x40e554]
cmp eax, ebx
je 0x406235
push eax
call fcn.004029cd
pop ecx
test eax, eax
je 0x406235
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40e54c]
call fcn.004029cd
pop ecx
test eax, eax
je 0x406255
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x406257
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401650
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, dword [0x413904]
sub esp, 0x100
lea ecx, [esp]
push ebx
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
push esi
push eax
push str.c_nCount_d
push ecx
call ebx
lea edx, [esp + 0x14]
push edx
call fcn.004046c0
mov eax, dword [0x413904]
add esp, 0x10
xor esi, esi
test eax, eax
jle 0x4016bd
push edi
mov edi, 0x409538
mov eax, dword [edi + 4]
mov ecx, dword [edi]
push eax
push ecx
push esi
lea edx, [esp + 0x18]
push str.__d____X___X
push edx
call ebx
lea eax, [esp + 0x20]
push eax
call fcn.004046c0
mov eax, dword [0x413904]
add esp, 0x18
inc esi
add edi, 8
cmp esi, eax
jl 0x40168e
pop edi
push 0
push 0x4014f0
call dword [sym.imp.USER32.dll_EnumWindows]
pop esi
pop ebx
add esp, 0x100
ret

Function at 0x4016e0
Capabilities:
Enumerate gui resources

Disassembly:
push 2
push 0x4014f0
call dword [sym.imp.USER32.dll_EnumWindows]
ret

Function at 0x401770
Capabilities:
Create process on windows

Disassembly:
push 4
push 0x409044
push 0x412c88
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x4017a4
push 1
push 0
push 0
push 0x413088
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov al, 1
ret
xor al, al
ret

Function at 0x401b20
Capabilities:
Get common file path
Set current directory

Disassembly:
mov al, byte [0x409784]
sub esp, 0x1a4
test al, 0xa0
je 0x401b54
push 0
call fcn.00401840
add esp, 4
test al, al
jne 0x401b4b
push 0
call fcn.004018c0
add esp, 4
test al, al
je 0x401b54
mov al, 1
add esp, 0x1a4
ret
mov al, byte [0x413908]
test al, al
je 0x401b66
mov al, 1
add esp, 0x1a4
ret
push edi
push str.DoOpgDlg2
call fcn.004046c0
mov ecx, 0x26
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov al, byte [0x409784]
add esp, 4
test al, 2
pop edi
je 0x401ba7
lea eax, [esp]
push eax
call fcn.00401ca0
push 0
call fcn.00401ce0
add esp, 8
push ebx
push esi
call fcn.004014d0
lea ecx, [esp + 0xa4]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
mov eax, dword [0x409784]
test al, 0x20
mov byte [0x413908], 1
je 0x401bfb
push 0x4138c8
push 0x413888
push 0x409738
call fcn.00404860
add esp, 8
push eax
call fcn.00401a30
add esp, 8
jmp 0x401c24
test al, 0x80
je 0x401c06
call fcn.004019c0
jmp 0x401c24
test ah, 4
je 0x401c17
push 0x409738
call fcn.00401af0
jmp 0x401c21
push 0x409748
call fcn.00401950
add esp, 4
lea edx, [esp + 0xa4]
mov bl, al
push edx
mov byte [0x413908], 0
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
call fcn.00401650
test byte [0x409784], 2
je 0x401c56
lea eax, [esp + 8]
push eax
call fcn.00401ce0
add esp, 4
test esi, esi
je 0x401c8a
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
je 0x401c7d
push str.SetForegroundWindow___succeeded.
call fcn.004046c0
add esp, 4
mov al, bl
pop esi
pop ebx
add esp, 0x1a4
ret
push str.SetForegroundWindow___failed.
call fcn.004046c0
add esp, 4
mov al, bl
pop esi
pop ebx
add esp, 0x1a4
ret
Function at 0x401ef0
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push esi
push 0x4090f8
call fcn.004046c0
mov ecx, dword [esp + 0x14]
mov esi, dword [sym.imp.MSVCRT.dll_strtoul]
lea eax, [esp + 0xc]
push 0x10
add ecx, 3
push eax
push ecx
mov dword [esp + 0x18], 0
call esi
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x401f84
mov eax, dword [esp + 8]
lea edx, [esp + 8]
push 0x10
push edx
push eax
call esi
add esp, 0xc
test eax, eax
je 0x401f84
push ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenProcess]
push eax
push 0
push 0x1f0fff
call edi
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call ebp
push ebx
push 0
push 0x1f0fff
call edi
mov esi, eax
test esi, esi
je 0x401f7c
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call ebp
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
pop ecx
ret
pop esi
mov eax, 1
pop ebx
pop ecx
ret

Function at 0x402010
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 4]
push esi
push 0
push eax
push 0
push 0
push 0
push SysReAllocStringLen
push 0
push SysReAllocStringLen
push 0xcf0000
push 0x413974
push 0x413910
push 0x80
mov dword [0x4139d8], eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
test esi, esi
jne 0x402051
pop esi
ret
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0
push 0
push 0x414
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, 1
pop esi
ret
Function at 0x403d90
Capabilities:
Parse pe header
Read file on windows

Disassembly:
sub esp, 0x404
mov eax, dword [esp + 0x408]
push esi
push 0
push 0x10000000
push 3
push 0
push 1
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x403e22
lea ecx, [esp + 4]
push 0
push ecx
lea edx, [esp + 0x10]
push 0x400
push edx
push esi
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x403e1b
cmp dword [esp + 4], 0x400
jne 0x403e1b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp word [esp + 8], 0x5a4d
jne 0x403e22
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + eax + 8]
lea eax, [esp + eax + 8]
cmp ecx, 0x4550
jne 0x403e22
mov eax, dword [eax + 0x34]
pop esi
add esp, 0x404
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
add esp, 0x404
ret

Function at 0x403f80
Capabilities:
Delete directory
Delete file

Disassembly:
mov al, byte [0x413e28]
sub esp, 0x400
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
xor ebx, ebx
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
test al, 0x40
jne 0x403feb
mov eax, dword [0x413e1c]
cmp eax, ebx
je 0x403fbc
cmp eax, 0xffffffff
je 0x403fbc
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x413e1c], ebx
push 0x413af0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, eax
call ebp
push eax
push esi
push 0x413af0
lea eax, [esp + 0x1c]
push str.DeleteFile__s__d___d
push eax
call edi
lea ecx, [esp + 0x24]
push ecx
call fcn.004046c0
add esp, 0x18
cmp byte [0x4139e8], bl
je 0x404022
push 0x4139e8
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov esi, eax
call ebp
push eax
push esi
push 0x4139e8
lea edx, [esp + 0x1c]
push str.RemoveDirectory__s__d___d
push edx
call edi
lea eax, [esp + 0x24]
push eax
call fcn.004046c0
add esp, 0x18
pop edi
pop esi
mov byte [0x413af0], bl
mov byte [0x4139e8], bl
pop ebp
pop ebx
add esp, 0x400
ret
Function at 0x4040f0
Capabilities:
Read file on windows
Timestomp file
Write file on windows

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
xor ebp, ebp
push edi
mov edi, dword [esp + 0x20]
push ebp
push 0x80
push 3
push ebp
push 3
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x404132
push str.UnPatchFile._cannnot_open_the_file.
call fcn.004046c0
add esp, 4
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ebp
push eax
push ebp
push ebp
push esi
mov dword [esp + 0x28], ebp
call dword [sym.imp.KERNEL32.dll_GetFileTime]
mov ebx, dword [edi + 0x88]
cmp ebx, ebp
jne 0x404157
mov ebx, 4
push ebx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x40417d
push str.UnPatchFile._cannnot_allocate_buffer.
call fcn.004046c0
add esp, 4
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov ecx, dword [edi + 0x80]
push 0
push 0
push ecx
push esi
mov byte [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, dword [edi + 0x80]
jne 0x40420f
lea edx, [esp + 0x10]
push 0
push edx
push ebx
push ebp
push esi
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40420f
cmp dword [esp + 0x10], ebx
jne 0x40420f
mov eax, dword [esp + 0x24]
push eax
push edi
push ebp
call fcn.00404800
mov ecx, dword [edi + 0x80]
add esp, 0xc
mov byte [esp + 0x20], al
push 0
push 0
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov al, byte [esp + 0x20]
test al, al
je 0x40420f
lea edx, [esp + 0x10]
push 0
push edx
push ebx
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40420f
lea eax, [esp + 0x14]
push eax
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push ebp
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x404230
Capabilities:
Read file on windows
Timestomp file
Write file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
push ebx
push esi
xor esi, esi
push esi
push 0x80
push 3
push esi
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40426e
push str.UnPatchFile._cannnot_open_the_file.
call fcn.004046c0
add esp, 4
xor al, al
pop esi
pop ebx
add esp, 0xc
ret
push ebp
lea ecx, [esp + 0x10]
push edi
push ecx
push esi
push esi
push ebx
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
mov eax, dword [esp + 0x28]
mov byte [esp + 0x20], 1
cmp eax, esi
mov dword [esp + 0x10], esi
jle 0x40438c
mov edx, dword [esp + 0x24]
lea esi, [edx + 0x80]
cmp dword [esi], 0
jne 0x4042b5
mov al, byte [esi - 0x80]
test al, al
je 0x40438c
mov ebp, dword [esi + 8]
test ebp, ebp
jne 0x4042c1
mov ebp, 4
push ebp
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
add esp, 4
test edi, edi
je 0x40436a
mov eax, dword [esi]
push 0
push 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, dword [esi]
jne 0x40437e
lea ecx, [esp + 0x24]
push 0
push ecx
push ebp
push edi
push ebx
mov dword [esp + 0x38], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40437e
cmp dword [esp + 0x24], ebp
jne 0x40437e
mov edx, dword [esp + 0x2c]
lea eax, [esi - 0x80]
push edx
push eax
push edi
call fcn.00404800
mov ecx, dword [esi]
add esp, 0xc
push 0
push 0
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, dword [esi]
jne 0x40437e
lea edx, [esp + 0x24]
push 0
push edx
push ebp
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40437e
push edi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x2c]
add esp, 4
inc eax
add esi, 0x94
cmp eax, ecx
mov dword [esp + 0x10], eax
jl 0x4042a5
jmp 0x40438c
push str.UnPatchFile._cannnot_allocate_buffer.
mov byte [esp + 0x24], 0
call fcn.004046c0
add esp, 4
jmp 0x40438c
push edi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov byte [esp + 0x20], 0
lea eax, [esp + 0x14]
push eax
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [esp + 0x20]
pop edi
pop ebp
pop esi
pop ebx
add esp, 0xc
ret