joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51ef10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x8cbf38]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x51f081
sub esp, 0x48
mov eax, dword [esp + 0x78]
cmp eax, 4
jne 0x51efa7
mov ecx, dword [esp + 0x74]
cmp dword [ecx], 0x6c616964
je 0x51ef46
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
jmp 0x51efb3
mov eax, dword [esp + 0x64]
mov ecx, dword [eax + 0x1c]
mov edx, dword [esp + 0x68]
mov dword [esp], edx
call ecx
movzx eax, byte [esp + 4]
test al, al
jne 0x51ef71
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
jmp 0x51efb3
mov eax, dword [esp + 0x64]
mov eax, dword [eax + 0x24]
mov ecx, dword [esp + 0x68]
mov dword [esp], ecx
mov ecx, dword [esp + 0x54]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x58]
mov dword [esp + 8], edx
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, eax
mov ebx, ecx
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
jmp 0x51efb3
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
mov dword [esp + 0x44], ebx
mov dword [esp + 0x40], edx
mov ebp, dword [esp + 0x54]
mov dword [esp], ebp
mov esi, dword [esp + 0x58]
mov dword [esp + 4], esi
mov edi, dword [esp + 0x5c]
mov dword [esp + 8], edi
mov edi, dword [esp + 0x60]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
call fcn.0051ed00
mov eax, dword [esp + 0x20]
movzx ecx, byte [esp + 0x24]
mov edx, dword [esp + 0x4c]
mov dword [esp], edx
mov edx, dword [esp + 0x50]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x54]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x58]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], cl
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x30], eax
call fcn.00526b80
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], ecx
mov dword [esp + 0x88], edx
add esp, 0x48
ret
call fcn.0046aab0
jmp fcn.0051ef10
Function at 0x58d4b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x8cbf38]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x58d583
sub esp, 0x48
lea edi, [esp + 0x18]
xor eax, eax
call fcn.0046c0b4
lea ecx, [0x58d6e0]
mov dword [esp + 0x18], ecx
movzx ecx, byte [esp + 0x74]
mov byte [esp + 0x1c], cl
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x5c]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x64]
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x68]
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x3c], ecx
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x40], ecx
mov edx, dword [esp + 0x50]
mov dword [esp + 0x44], edx
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
lea edx, [0x58d590]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.0058ddf0
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
mov dword [esp + 0x78], ecx
mov dword [esp + 0x7c], edx
add esp, 0x48
ret
call fcn.0046aab0
jmp fcn.0058d4b0
Function at 0x58ee80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x8cbf38]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x58ef94
sub esp, 0x1c
mov eax, dword [esp + 0x28]
test eax, eax
je 0x58eea9
mov ecx, dword [esp + 0x24]
xor edx, edx
xor ebx, ebx
jmp 0x58eeb3
mov byte [esp + 0x30], 0xf
add esp, 0x1c
ret
inc edx
cmp eax, edx
jle 0x58ef8c
mov dword [esp + 0x14], edx
mov byte [esp + 0xe], bl
lea ebp, [ecx + edx*8]
mov esi, dword [ebp]
mov ebp, dword [ebp + 4]
mov dword [esp + 0x18], ebp
lea edi, [0x70237c]
cmp esi, edi
jne 0x58eeed
mov edi, 1
xchg edi, eax
mov byte [esp + 0xf], al
xchg edi, eax
lea edi, [0x70237c]
jmp 0x58ef28
mov dword [esp + 0x10], esi
mov dword [esp], esi
mov dword [esp + 4], ebp
call fcn.005a9d50
movzx eax, byte [esp + 8]
xor eax, 1
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x14]
movzx ebx, byte [esp + 0xe]
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x10]
lea edi, [0x70237c]
mov byte [esp + 0xf], al
mov eax, dword [esp + 0x28]
movzx edi, byte [esp + 0xf]
xchg edi, eax
test al, al
xchg edi, eax
je 0x58ef3e
lea edi, [0x7023a8]
jmp 0x58eeb2
lea edi, [0x7023a8]
cmp esi, edi
je 0x58ef4d
mov ebp, 0
jne 0x58ef5d
movzx ebp, byte [ebp + 0x4d]
xchg ebp, eax
test al, al
xchg ebp, eax
jne 0x58eeb2
mov eax, dword [esi + 0x20]
mov ecx, dword [esp + 0x18]
mov dword [esp], ecx
call eax
movzx ebx, byte [esp + 4]
movzx eax, byte [esp + 0xe]
or ebx, eax
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x14]
lea edi, [0x7023a8]
jmp 0x58eeb2
mov byte [esp + 0x30], bl
add esp, 0x1c
ret
call fcn.0046aab0
jmp fcn.0058ee80
Function at 0x5a4200
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x8cbf38]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5a438b
sub esp, 0x68
mov eax, dword [esp + 0x7c]
cvtsi2sd xmm0, eax
mov ecx, dword [esp + 0x6c]
mov edx, dword [ecx + 0x14]
cvtsi2sd xmm1, edx
divsd xmm0, xmm1
movsd xmm1, qword [0x700eb0]
mulsd xmm0, xmm1
cvttsd2si edx, xmm0
mov dword [esp + 0x30], edx
nop
mov dword [esp], ecx
mov dword [esp + 4], edx
call fcn.005a3d90
mov eax, dword [esp + 8]
test eax, eax
jne 0x5a4298
mov ecx, dword [esp + 0x6c]
mov ecx, dword [ecx + 0x10]
mov dword [esp + 0x34], ecx
lea edi, [esp + 0x38]
xor eax, eax
call fcn.0046c0b4
lea ecx, [0x6339e0]
mov dword [esp], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 4], ecx
lea ecx, [esp + 0x38]
mov dword [esp + 8], ecx
call fcn.004118f0
mov ecx, dword [esp + 0x30]
xor eax, eax
xor edx, edx
jmp 0x5a435e
mov ecx, dword [esp + 0x70]
mov dword [esp], ecx
mov ecx, dword [esp + 0x74]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x80]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 3
call fcn.00549eb0
movzx eax, byte [esp + 0x24]
test al, al
je 0x5a4306
mov dword [esp + 0x84], 0
mov dword [esp + 0x88], 0
add esp, 0x68
ret
lea eax, [0x67e72d]
mov dword [esp], eax
mov dword [esp + 4], 0xa
call fcn.0059d580
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], ecx
add esp, 0x68
ret
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], edx
lea eax, [esp + 0x38]
mov dword [esp], eax
call fcn.00411b30
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov ecx, eax
mov eax, edx
mov edx, dword [esp + 0x28]
mov ebx, dword [esp + 0x38]
test ebx, ebx
je 0x5a4384
mov ebx, dword [ebx]
mov ebp, dword [esp + 0x3c]
test byte [ebp], al
cmp eax, ebx
jge 0x5a437a
mov edx, dword [ebp]
mov eax, ebx
jmp 0x5a4380
mov ebp, eax
mov eax, ebx
mov ebx, ebp
cmp eax, ecx
jle 0x5a4336
mov eax, edx
jmp 0x5a4298
call fcn.0046aab0
jmp fcn.005a4200
Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x41b51c70
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e3d0
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x6206027f
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x1052f058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1052f1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1052f07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1052f06a
add dl, dl
jne 0x1052f089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1052f0dc
xor eax, eax
add dl, dl
jne 0x1052f096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1052f17d
add dl, dl
jne 0x1052f0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1052f0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1052f0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1052f0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1052f0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1052f075
mov eax, 1
add dl, dl
jne 0x1052f0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1052f0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1052f0e1
sub eax, ebx
mov ebx, 1
jne 0x1052f128
mov ecx, 1
add dl, dl
jne 0x1052f10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1052f119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1052f105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1052f075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1052f13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1052f14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1052f136
cmp eax, 0x7d00
jae 0x1052f16d
cmp eax, 0x500
jb 0x1052f168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1052f075
cmp eax, 0x7f
ja 0x1052f170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1052f075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1052f19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1052f075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x403bd1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
je 0x403bf8
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x403bf8
mov edx, dword [ebp + 8]
push edx
call sub.MSVCRT.dll_strlen
add esp, 4
cmp eax, 0x104
jb 0x403c25
push 0
push 0x10
push 0x4b7704
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x403c11
xor al, al
jmp 0x403c7a
push 0x49c2d4
push 0x4b7704
call sub.MSVCRT.dll_strcat
add esp, 8
jmp 0x403c78
mov eax, dword [ebp + 8]
push eax
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x4b7704
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
movsx ecx, byte [eax - 1]
cmp ecx, 0x5c
jne 0x403c64
mov edx, dword [ebp - 4]
mov byte [edx + 0x4b7704], 0
jmp 0x403c78
mov eax, dword [ebp - 4]
mov byte [eax + 0x4b7704], 0x5c
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x4b7705], 0
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x407d86
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x407ddd
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x407dc4
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.00407ca5
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x3c]
and edx, 0x10
test edx, edx
je 0x407dd7
call dword [sym.imp.USER32.dll_EmptyClipboard]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x418bc7
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
cmp dword [ebp + 8], 0xd
jne 0x418bff
mov ecx, dword [ebp - 0x1c]
add ecx, 0x39c
call fcn.00406326
test eax, eax
je 0x418bf2
mov ecx, dword [ebp - 0x1c]
call fcn.00418e93
jmp 0x418bfa
mov ecx, dword [ebp - 0x1c]
call fcn.00418e03
jmp 0x418dfd
cmp dword [ebp + 8], 9
jne 0x418d4f
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
and eax, 0x8000
test eax, eax
jne 0x418cb8
mov ecx, dword [ebp - 0x1c]
add ecx, 0x25c
call fcn.00406326
test eax, eax
je 0x418c43
mov ecx, dword [ebp - 0x1c]
add ecx, 0x4dc
call fcn.00417093
jmp 0x418cb3
mov ecx, dword [ebp - 0x1c]
add ecx, 0x4dc
call fcn.00406326
test eax, eax
je 0x418c65
mov ecx, dword [ebp - 0x1c]
add ecx, 0x39c
call fcn.00417093
jmp 0x418cb3
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 4]
push edx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x124
call fcn.00415e35
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x124
call fcn.00415e64
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0xc]
push edx
call fcn.00412f35
add esp, 8
mov eax, dword [ebp - 0x1c]
add eax, 0x124
push eax
call fcn.00412fc4
add esp, 4
jmp 0x418d4a
mov ecx, dword [ebp - 0x1c]
add ecx, 0x25c
call fcn.00406326
test eax, eax
je 0x418d1a
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x10]
push edx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x1c0
call fcn.00415e35
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x1c0
call fcn.00415e64
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 0x18]
push edx
call fcn.00412f35
add esp, 8
mov eax, dword [ebp - 0x1c]
add eax, 0x1c0
push eax
call fcn.00412fc4
add esp, 4
jmp 0x418d4a
mov ecx, dword [ebp - 0x1c]
add ecx, 0x4dc
call fcn.00406326
test eax, eax
je 0x418d3c
mov ecx, dword [ebp - 0x1c]
add ecx, 0x25c
call fcn.00417093
jmp 0x418d4a
mov ecx, dword [ebp - 0x1c]
add ecx, 0x4dc
call fcn.00417093
jmp 0x418dfd
cmp dword [ebp + 8], 0x20
jne 0x418dc3
mov ecx, dword [ebp - 0x1c]
add ecx, 0x25c
call fcn.00406326
test eax, eax
je 0x418d71
mov ecx, dword [ebp - 0x1c]
call fcn.00418e03
jmp 0x418dc1
mov ecx, dword [ebp - 0x1c]
add ecx, 0x39c
call fcn.00406326
test eax, eax
je 0x418d8d
mov ecx, dword [ebp - 0x1c]
call fcn.00418e93
jmp 0x418dc1
mov ecx, dword [ebp - 0x1c]
add ecx, 0x4dc
call fcn.00406326
test eax, eax
je 0x418dc1
mov ecx, dword [ebp - 0x1c]
add ecx, 0x4dc
call fcn.0040629e
neg eax
sbb eax, eax
inc eax
push eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x4dc
call fcn.004062bc
jmp 0x418dfd
cmp dword [ebp + 8], 0x25
jne 0x418dd9
mov ecx, dword [ebp - 0x1c]
add ecx, 0x25c
call fcn.00417093
jmp 0x418dfd
cmp dword [ebp + 8], 0x27
jne 0x418def
mov ecx, dword [ebp - 0x1c]
add ecx, 0x39c
call fcn.00417093
jmp 0x418dfd
cmp dword [ebp + 8], 0x1b
jne 0x418dfd
mov ecx, dword [ebp - 0x1c]
call fcn.00418e93
mov esp, ebp
pop ebp
ret 4
Function at 0x45577a
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48c754
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1b4
lea ecx, [ebp - 0x9c]
call dword [sym.imp.Engine.dll_public:_void___thiscall_KFile::constructor_void_]
mov dword [ebp - 4], 0
push 0x80
lea eax, [ebp - 0x8c]
push eax
call fcn.004559ad
add esp, 8
mov byte [ebp - 0x90], 0
cmp dword [0x4b8cb8], 0
jne 0x4557dc
cmp dword [0x4b8cc0], 0
jle 0x45593a
lea ecx, [ebp - 0x8c]
push ecx
lea ecx, [ebp - 0x9c]
call dword [sym.imp.Engine.dll_public:_int___thiscall_KFile::Create_char__]
test eax, eax
jne 0x4557f8
jmp 0x45593a
mov byte [ebp - 0xb0], 0
xor edx, edx
mov dword [ebp - 0xaf], edx
mov dword [ebp - 0xab], edx
mov dword [ebp - 0xa7], edx
mov word [ebp - 0xa3], dx
mov byte [ebp - 0xa1], dl
mov dword [ebp - 0xb0], 0x46445400
cmp dword [0x4b8cb8], 0
je 0x45584e
mov eax, dword [0x4b8cb8]
cmp dword [eax], 0
jle 0x45584e
mov ecx, dword [0x4b8cb8]
mov edx, dword [ecx]
add edx, 4
mov dword [ebp - 0xac], edx
mov eax, dword [0x4b8cc0]
mov dword [ebp - 0xa8], eax
push 0x10
lea ecx, [ebp - 0xb0]
push ecx
lea ecx, [ebp - 0x9c]
call dword [sym.imp.Engine.dll_public:_unsigned_long_int___thiscall_KFile::Write_void___unsigned_long_int_]
cmp eax, 0x10
je 0x455878
jmp 0x45593a
cmp dword [0x4b8cb8], 0
je 0x4558a7
mov edx, dword [ebp - 0xac]
push edx
mov eax, dword [0x4b8cb8]
push eax
lea ecx, [ebp - 0x9c]
call dword [sym.imp.Engine.dll_public:_unsigned_long_int___thiscall_KFile::Write_void___unsigned_long_int_]
cmp eax, dword [ebp - 0xac]
je 0x4558a7
jmp 0x45593a
mov ecx, dword [0x4b8cbc]
mov dword [ebp - 0xa0], ecx
mov dword [ebp - 0xb4], 0
jmp 0x4558ce
mov edx, dword [ebp - 0xb4]
add edx, 1
mov dword [ebp - 0xb4], edx
mov eax, dword [ebp - 0xb4]
cmp eax, dword [0x4b8cc0]
jge 0x455925
mov ecx, dword [ebp - 0xa0]
mov edx, dword [ecx + 0xc]
add edx, 0xc
mov dword [ebp - 0xb8], edx
mov eax, dword [ebp - 0xb8]
push eax
mov ecx, dword [ebp - 0xa0]
add ecx, 4
push ecx
lea ecx, [ebp - 0x9c]
call dword [sym.imp.Engine.dll_public:_unsigned_long_int___thiscall_KFile::Write_void___unsigned_long_int_]
cmp eax, dword [ebp - 0xb8]
je 0x455915
jmp 0x455925
mov edx, dword [ebp - 0xa0]
mov eax, dword [edx]
mov dword [ebp - 0xa0], eax
jmp 0x4558bf
mov ecx, dword [ebp - 0xb4]
cmp ecx, dword [0x4b8cc0]
jl 0x45593a
mov byte [ebp - 0x90], 1
lea ecx, [ebp - 0x9c]
call dword [sym.imp.Engine.dll_public:_void___thiscall_KFile::Close_void_]
mov edx, dword [ebp - 0x90]
and edx, 0xff
test edx, edx
jne 0x45597a
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0x1bc]
push ecx
call dword [sym.imp.Engine.dll_void___cdecl_g_GetFullPath_char___char__]
add esp, 8
lea edx, [ebp - 0x1bc]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov al, byte [ebp - 0x90]
mov byte [ebp - 0x1c0], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9c]
call dword [sym.imp.Engine.dll_public:_void___thiscall_KFile::destructor_void_]
mov al, byte [ebp - 0x1c0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x45b7e3
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push 0x4a0ba4
mov ecx, 0x4b94a0
call fcn.00479722
push eax
push 0x4a0bb8
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea ecx, [ebp - 0x100]
push ecx
lea edx, [ebp - 0x80]
push edx
call dword [sym.imp.Engine.dll_void___cdecl_g_GetFullPath_char___char__]
add esp, 8
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x46181d
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x180
push 0x4a1280
mov ecx, 0x4b94a0
call fcn.00479722
push eax
push 0x4a1294
lea eax, [ebp - 0x180]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea ecx, [ebp - 0x180]
push ecx
lea edx, [ebp - 0x100]
push edx
call dword [sym.imp.Engine.dll_void___cdecl_g_GetFullPath_char___char__]
add esp, 8
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x47974c
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
mov dword [ebp - 0x250], ecx
cmp dword [ebp + 8], 0
je 0x479853
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x479853
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.Engine.dll_void___cdecl_g_GetFullPath_char___char__]
add esp, 8
lea ecx, [ebp - 0x248]
push ecx
call sub.MSVCRT.dll_strlen
add esp, 4
add eax, 1
mov dword [ebp - 0x24c], eax
push str..
lea edx, [ebp - 0x248]
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
lea eax, [ebp - 0x144]
push eax
lea ecx, [ebp - 0x248]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x47982b
lea edx, [ebp - 0x118]
push edx
mov eax, dword [ebp - 0x24c]
lea ecx, [ebp + eax - 0x248]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x80
lea edx, [ebp - 0x248]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x144]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4797d0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0xc]
and ecx, 0xff
test ecx, ecx
je 0x479853
mov edx, dword [ebp - 0x24c]
mov byte [ebp + edx - 0x249], 0
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov esp, ebp
pop ebp
ret 8

Function at 0x480740
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x4807e3
mov dword [ebp - 0x12c], 0x128
lea eax, [ebp - 0x12c]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x4807e3
mov edx, dword [ebp - 0x124]
push edx
push 0
push 0x10
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [0x4b9578], eax
cmp dword [0x4b9578], 0
je 0x4807cf
lea eax, [ebp - 0x108]
push eax
push 0x4bef5c
call sub.MSVCRT.dll_strcpy
add esp, 8
mov ecx, dword [0x4b9578]
push ecx
call fcn.004807f3
add esp, 4
and eax, 0xff
test eax, eax
je 0x4807cf
mov eax, 1
jmp 0x4807ef
lea edx, [ebp - 0x12c]
push edx
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x48077d
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4808c7
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov byte [ebp - 4], 0
mov eax, dword [ebp + 0x10]
movsx ecx, byte [eax]
cmp ecx, 0x2d
je 0x4808e7
mov edx, dword [ebp + 0x10]
movsx eax, byte [edx]
cmp eax, 0x2f
jne 0x480961
mov ecx, dword [ebp + 0x10]
add ecx, 1
mov dword [ebp + 0x10], ecx
mov edx, dword [ebp + 0x10]
movsx eax, byte [edx]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
add ecx, 1
mov dword [ebp + 0x10], ecx
mov edx, dword [ebp - 8]
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0x43
je 0x480916
cmp dword [ebp - 0xc], 0x63
je 0x480916
jmp 0x48091a
mov byte [ebp - 4], 1
mov eax, dword [ebp + 0x10]
movsx ecx, byte [eax]
cmp ecx, 0x20
je 0x480951
mov edx, dword [ebp + 0x10]
movsx eax, byte [edx]
cmp eax, 0xd
je 0x480951
mov ecx, dword [ebp + 0x10]
movsx edx, byte [ecx]
cmp edx, 0xa
je 0x480951
mov eax, dword [ebp + 0x10]
movsx ecx, byte [eax]
cmp ecx, 9
je 0x480951
mov edx, dword [ebp + 0x10]
movsx eax, byte [edx]
cmp eax, 0x78
jne 0x48095c
mov ecx, dword [ebp + 0x10]
add ecx, 1
mov dword [ebp + 0x10], ecx
jmp 0x48091a
jmp 0x4808d1
mov edx, dword [ebp - 4]
and edx, 0xff
test edx, edx
je 0x480974
call dword [sym.imp.KERNEL32.dll_AllocConsole]
mov eax, dword [ebp + 8]
mov dword [0x4b9e14], eax
push str.Sword3
mov ecx, dword [ebp + 8]
push ecx
mov ecx, 0x4b9e18
call dword [sym.imp.Engine.dll_public_virtual:_int___thiscall_KWin32App::Init_struct_HINSTANCE_____char__]
test eax, eax
je 0x4809b4
push 0
push 0
push 0
push 0x480890
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 0x4b9e18
call dword [sym.imp.Engine.dll_public_virtual:_void___thiscall_KWin32App::Run_void_]
mov edx, dword [ebp - 4]
and edx, 0xff
test edx, edx
je 0x4809c7
call dword [sym.imp.KERNEL32.dll_FreeConsole]
call fcn.00483ddd
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10