joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f6d4c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, ebx
call fcn.005c1ed8
test al, al
jne 0x4f6e72
cmp byte [ebx + 0x46e], 0
jne 0x4f6e72
cmp byte [ebx + 0x40f], 0
je 0x4f6dc1
mov eax, ebx
call fcn.005b5e50
lea edx, [ebx + 0x258]
xor ecx, ecx
mov eax, ebx
call fcn.005ba5f0
mov cl, 0x13
mov dl, 0x28
mov eax, ebx
call fcn.0055f6fc
lea edx, [ebx + 0x258]
mov cl, byte [0x4f6e78]
mov eax, ebx
call fcn.005bb3b8
mov edx, 2
mov eax, ebx
call fcn.0055f788
mov byte [ebx + 0x40f], 0
jmp 0x4f6e72
cmp byte [ebx + 0x40d], 0
jne 0x4f6e5b
cmp byte [ebx + 0x40e], 0
jne 0x4f6e5b
mov eax, 0x12c
call fcn.006566a4
test al, al
je 0x4f6e5b
call fcn.0065867c
mov esi, eax
mov eax, dword [ebx + 0x13c]
cmp dword [eax + 0x18], 0x3e8
jl 0x4f6e0d
mov byte [ebx + 0x40e], 1
call fcn.004fe3f4
jmp 0x4f6e5b
cmp byte [ebx + 0x14e], 0
je 0x4f6e25
mov eax, ebx
call fcn.005bf884
test al, al
je 0x4f6e25
xor eax, eax
jmp 0x4f6e27
mov al, 1
and eax, 0x7f
lea ecx, [eax + eax*4]
mov eax, dword [ebx + 0x13c]
add ecx, dword [eax + 0x18]
mov eax, dword [ebx + 0x13c]
mov edx, dword [eax + 0x18]
mov eax, ebx
call fcn.005b7cb4
cmp byte [ebx + 0x40d], 0
jne 0x4f6e5b
call fcn.0065867c
sub eax, esi
cmp eax, 0x32
jl 0x4f6df0
mov eax, 0x1388
call fcn.006566a4
test al, al
je 0x4f6e72
xor edx, edx
mov eax, ebx
call fcn.005e75fc
pop esi
pop ebx
ret
Function at 0x509534
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd3c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c4], ecx
mov dword [ebp - 0x2c0], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
lea eax, [ebp - 4]
call fcn.00403e28
xor eax, eax
push ebp
push 0x50967e
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x2c0]
mov eax, dword [ebp - 4]
call fcn.00653d58
mov edx, dword [ebp - 0x2c0]
lea eax, [ebp - 4]
call fcn.004038bc
mov edx, dword [ebp - 4]
mov eax, dword [esi + 4]
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x50963e
lea edx, [ebp - 0x2c0]
mov eax, dword [ebp - 4]
call fcn.006549c4
mov edx, dword [ebp - 0x2c0]
lea eax, [ebp - 0x2c4]
call fcn.004034e4
mov eax, dword [ebp - 0x2c4]
lea edx, [ebp - 8]
call fcn.00653d20
mov eax, dword [ebp - 8]
mov edx, 0x509698
call fcn.0040362c
je 0x509605
mov eax, dword [esi + 4]
mov edi, dword [eax + 0x24]
dec edi
cmp edi, 0
jl 0x509605
mov eax, dword [esi + 4]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + edi*4]
mov edx, dword [ebp - 8]
call fcn.00654884
test al, al
je 0x5095ff
mov ebx, edi
jmp 0x509605
dec edi
cmp edi, 0xffffffff
jne 0x5095e6
cmp ebx, 0xffffffff
jne 0x50963e
push 0x101
push 0x2b4
lea eax, [ebp - 0x2bc]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetFileInfoW
mov ecx, dword [ebp - 0x2bc]
mov edx, dword [ebp - 4]
mov eax, dword [esi + 4]
call fcn.0064ed68
mov eax, dword [esi + 4]
mov ebx, dword [eax + 0x24]
dec ebx
mov edx, ebx
mov eax, dword [esi + 4]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x509685
lea eax, [ebp - 0x2c4]
call fcn.00403274
lea eax, [ebp - 0x2c0]
call fcn.00403880
lea eax, [ebp - 8]
call fcn.00403274
lea eax, [ebp - 4]
call fcn.00403880
ret
Function at 0x52cbf8
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x52cc5a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x19c]
mov edx, dword [eax]
call dword [edx + 0x28]
push eax
push 0x64
mov eax, dword [ebx + 0x198]
mov eax, dword [eax + 0x30]
push eax
call sub.kernel32.dll_MulDiv
mov edx, eax
lea ecx, [ebp - 4]
mov eax, 0x52cc68
call fcn.00655344
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0063fd6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52cc61
lea eax, [ebp - 4]
call fcn.00403274
ret
Function at 0x52f96c
Capabilities:
Read clipboard data

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov esi, edx
mov ebx, eax
cmp dword [ebx + 0x24], 0
jne 0x52f984
push esi
call sub.user32.dll_GetClipboardData
jmp 0x52f9be
mov edi, esi
mov edx, edi
mov eax, dword [ebx + 0x18]
call fcn.0064e36c
test al, al
je 0x52f9bc
push esp
mov edx, edi
mov eax, dword [ebx + 0x18]
call fcn.0064e308
mov edx, dword [ebx + 0x20]
mov edx, dword [edx + 0x1c]
mov eax, dword [edx + eax*4]
push eax
mov eax, dword [ebx + 0x24]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
test eax, eax
jne 0x52f9bc
mov eax, dword [esp + 4]
jmp 0x52f9be
xor eax, eax
add esp, 0xc
pop edi
pop esi
pop ebx
ret

Function at 0x52fbc8
Capabilities:
Check for time delay via gettickcount
Open clipboard

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
call fcn.0065867c
mov esi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x10]
push eax
call sub.user32.dll_OpenClipboard
neg eax
sbb ebx, ebx
neg ebx
test bl, bl
jne 0x52fbfc
call fcn.0065867c
sub eax, esi
mov edx, dword [ebp + 8]
cmp eax, dword [edx - 8]
jl 0x52fbd4
mov eax, ebx
pop esi
pop ebx
pop ebp
ret

Function at 0x52ff38
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x53001d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebx + 0x2c]
call fcn.00403274
mov edx, dword [0x66c000]
mov eax, dword [ebx + 0x18]
call fcn.0064e36c
test al, al
je 0x530007
mov eax, dword [0x66c000]
push eax
call sub.user32.dll_GetClipboardData
mov esi, eax
push esi
call sub.kernel32.dll_GlobalSize
mov edi, eax
lea eax, [ebx + 0x28]
mov edx, edi
call fcn.00403804
push esi
call sub.kernel32.dll_GlobalLock
mov edx, eax
lea eax, [ebx + 0x28]
mov ecx, edi
call fcn.00403358
push esi
call sub.kernel32.dll_GlobalUnlock
mov edx, dword [ebx + 0x28]
mov eax, 0x530034
call fcn.006540dc
mov esi, eax
test esi, esi
je 0x52ffff
add esi, 0xa
jmp 0x52ffd8
lea eax, [ebp - 4]
mov edx, dword [ebx + 0x28]
mov dl, byte [edx + esi - 1]
call fcn.00403418
mov edx, dword [ebp - 4]
lea eax, [ebx + 0x2c]
call fcn.00403524
inc esi
cmp edi, esi
jl 0x52ffff
mov eax, dword [ebx + 0x28]
cmp byte [eax + esi - 1], 0x20
je 0x52ffbd
mov eax, dword [ebx + 0x28]
xor edx, edx
mov dl, byte [eax + esi - 1]
mov eax, dword [0x669a08]
mov eax, dword [eax]
call fcn.0064e6b4
test al, al
jne 0x52ffbd
lea eax, [ebx + 0x2c]
call fcn.00653318
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x530024
lea eax, [ebp - 4]
call fcn.00403274
ret
Function at 0x530230
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x53037e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 0x28]
call fcn.004a18b4
lea eax, [ebp - 4]
mov ecx, 0x530390
mov edx, dword [0x66bff0]
call fcn.00403b24
mov eax, dword [ebp - 4]
call fcn.0064d9e0
mov edx, dword [ebp + 8]
mov dword [edx - 4], eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_DeleteFileW
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
cmp dword [eax + 8], 0
jle 0x530355
push 0x5303a4
call sub.kernel32.dll_lstrlenA
mov ebx, eax
add ebx, 0x14
mov edx, 0x5303fc
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
call fcn.00653458
mov esi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edi, dword [eax + 4]
sub esi, edi
add esi, ebx
add esi, 0x16
mov edx, 0x530414
mov eax, dword [ebp + 8]
mov eax, edi
call fcn.00653458
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
sub eax, dword [edx + 4]
add eax, ebx
sub eax, 2
mov edi, eax
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x28], ebx
mov byte [ebp - 0x24], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 8]
add eax, ebx
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
mov dword [ebp - 0x18], esi
mov byte [ebp - 0x14], 0
mov dword [ebp - 0x10], edi
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x28]
mov eax, 0x5303a4
mov ecx, 3
call fcn.006550e0
push ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
xor ecx, ecx
mov edx, dword [ebp - 8]
call fcn.0064dcf0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
call fcn.0061fed8
mov edx, dword [ebp + 8]
mov dword [edx - 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004028c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x530385
lea eax, [ebp - 8]
call fcn.00403274
lea eax, [ebp - 4]
call fcn.00403880
ret
Function at 0x530954
Capabilities:
Write clipboard data

Disassembly:
push ebx
mov ebx, edx
test ebx, ebx
je 0x53097b
call sub.user32.dll_EmptyClipboard
mov eax, ebx
call fcn.00403ab8
mov edx, eax
inc edx
add edx, edx
mov eax, ebx
call fcn.0061fed8
push eax
push 0xd
call sub.user32.dll_SetClipboardData
pop ebx
ret

Function at 0x530f10
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov edi, ecx
mov dword [esp], edx
mov ebp, eax
mov byte [esp + 4], 0
mov ecx, 1
mov edx, 0x80000000
mov eax, dword [esp]
call fcn.006585a4
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x530f4b
mov eax, 0x530fac
mov edx, dword [esp]
call fcn.0061fa50
jmp 0x530f9e
push 0
push ebx
call sub.kernel32.dll_GetFileSize
mov esi, eax
mov eax, edi
mov edx, esi
call fcn.00403804
push 0
lea eax, [esp + 0xc]
push eax
push esi
mov eax, dword [edi]
push eax
push ebx
call sub.kernel32.dll_ReadFile
test eax, eax
jne 0x530f88
mov edx, dword [ebp + 4]
mov eax, 0x530fc4
call fcn.0061fa50
push ebx
call sub.kernel32.dll_CloseHandle
jmp 0x530f9e
push ebx
call sub.kernel32.dll_CloseHandle
lea eax, [ebp + 4]
mov edx, dword [esp]
call fcn.004038bc
mov byte [esp + 4], 1
mov al, byte [esp + 4]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x530fe0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x530fe8
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5311ce
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, dword [ebp - 8]
call fcn.0064d9e0
mov ebx, eax
mov ecx, dword [ebx + 8]
mov edx, dword [ebx + 4]
lea eax, [ebp - 0x10]
call fcn.00403358
mov eax, ebx
call fcn.004028c0
mov eax, dword [0x66c018]
mov edi, dword [eax + 0x18]
dec edi
test edi, edi
jl 0x5310ee
inc edi
xor esi, esi
mov eax, dword [0x66c018]
mov eax, dword [eax + 0x1c]
mov ebx, dword [eax + esi*4]
cmp byte [ebx + 0x427], 0
jne 0x5310e6
cmp byte [ebx + 0x45c], 0
jne 0x5310e6
cmp byte [ebx + 0x43c], 0
je 0x53107b
mov eax, dword [ebx + 0x160]
call fcn.00654560
test al, al
je 0x5310e6
cmp dword [ebp - 0x18], 0
je 0x53108e
lea eax, [ebp - 0x18]
mov edx, 0x5311e4
call fcn.00403ac4
mov eax, dword [0x66c018]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + esi*4]
cmp eax, dword [0x66c020]
jne 0x5310ae
lea eax, [ebp - 0x18]
mov edx, 0x5311f0
call fcn.00403ac4
lea edx, [ebp - 0x20]
mov eax, dword [ebx + 0x160]
call fcn.0062686c
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
call fcn.00403ac4
cmp byte [ebx + 0x3f6], 0
je 0x5310e6
cmp byte [ebx + 0x3f7], 0
je 0x5310e6
lea eax, [ebp - 0x18]
mov edx, 0x5311f8
call fcn.00403ac4
inc esi
dec edi
jne 0x53103e
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0x18]
call fcn.006542f4
mov eax, dword [ebp - 0x14]
call fcn.0040351c
mov ebx, eax
mov eax, dword [ebp - 0x18]
call fcn.00403ab8
cmp ebx, eax
je 0x531125
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x14]
call fcn.006544e4
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0x14]
call fcn.0040330c
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.0040362c
je 0x531197
mov eax, dword [ebp - 8]
call fcn.006585c4
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x531153
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.0061fba8
cmp ax, 2
je 0x53119b
jmp 0x531132
cmp dword [ebp - 0x14], 0
je 0x531191
push 0
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x14]
call fcn.0040351c
push eax
mov eax, dword [ebp - 0x14]
push eax
push ebx
call sub.kernel32.dll_WriteFile
test eax, eax
jne 0x531191
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dl, 2
call fcn.0061fba8
cmp ax, 2
jne 0x531159
push ebx
call sub.kernel32.dll_CloseHandle
jmp 0x53119b
push ebx
call sub.kernel32.dll_CloseHandle
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5311d5
lea eax, [ebp - 0x24]
call fcn.00403274
lea eax, [ebp - 0x20]
call fcn.00403880
lea eax, [ebp - 0x18]
call fcn.00403880
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00403298
ret
Function at 0x531450
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd88
push ebx
xor edx, edx
mov dword [ebp - 0x270], edx
mov dword [ebp - 0x274], edx
mov dword [ebp - 0x278], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov ebx, eax
lea eax, [ebp - 0x26c]
mov edx, dword [0x65271c]
call fcn.00403e48
xor eax, eax
push ebp
push 0x5315a6
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0064d744
mov dword [ebx + 8], eax
lea eax, [ebp - 4]
call fcn.0061c4fc
mov ecx, dword [0x6692b0]
mov ecx, dword [ecx + 4]
lea eax, [ebp - 0x278]
mov edx, 0x5315bc
call fcn.00403568
mov edx, dword [ebp - 0x278]
lea eax, [ebp - 0x274]
call fcn.00403a34
mov ecx, dword [ebp - 0x274]
lea eax, [ebp - 0x270]
mov edx, dword [ebp - 4]
call fcn.00403b24
mov eax, dword [ebp - 0x270]
lea ecx, [ebp - 0x26c]
mov edx, 0x20
call fcn.00654658
test eax, eax
jne 0x531548
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0x264]
mov edx, dword [ebp - 4]
call fcn.00403b24
mov eax, dword [ebp - 8]
call fcn.00531428
test al, al
jne 0x531539
cmp dword [ebp - 0x26c], 0
jne 0x53152e
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_DeleteFileW
jmp 0x531539
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 8]
mov ecx, dword [eax]
call dword [ecx + 0x30]
lea eax, [ebp - 0x26c]
call fcn.006546fc
test eax, eax
je 0x5314fd
lea eax, [ebp - 0x26c]
call fcn.00654720
mov eax, dword [ebx + 8]
cmp dword [eax + 0x24], 0
setg al
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5315ad
lea eax, [ebp - 0x278]
call fcn.00403274
lea eax, [ebp - 0x274]
mov edx, 2
call fcn.00403898
lea eax, [ebp - 0x26c]
mov edx, dword [0x65271c]
call fcn.00403f10
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403898
ret
Function at 0x533254
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
xor eax, eax
push ebp
push 0x53333a
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4b2b70]
call fcn.004b2d18
mov ebx, eax
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004b2d50
test al, al
je 0x53330a
mov byte [ebp - 9], 1
call fcn.0064d744
mov edi, eax
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.00531200
test al, al
je 0x5332f3
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
dec eax
test eax, eax
jl 0x5332f3
inc eax
mov dword [ebp - 0x10], eax
xor esi, esi
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + esi*4]
mov eax, dword [eax + 0x160]
call fcn.00654994
mov ecx, dword [ebp - 0x14]
mov eax, dword [edi + 0x18]
mov edx, dword [eax + esi*4]
mov eax, ebx
call fcn.004b31fc
test al, al
jne 0x5332ed
mov byte [ebp - 9], 0
jmp 0x5332f3
inc esi
dec dword [ebp - 0x10]
jne 0x5332bc
mov eax, edi
call fcn.00531320
mov eax, edi
call fcn.004028c0
mov eax, ebx
call fcn.004b352c
jmp 0x53330e
mov byte [ebp - 9], 0
cmp byte [ebp - 9], 0
jne 0x53331d
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_DeleteFileW
mov eax, ebx
call fcn.004028c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x533341
lea eax, [ebp - 0x14]
call fcn.00403880
ret
Function at 0x535fd4
Capabilities:
Delete file
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd3c
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x2c0], edx
mov dword [ebp - 0x2c4], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x536170
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x10c]
test eax, eax
je 0x53603f
cmp byte [eax + 0x45c], 0
je 0x53603f
cmp dword [ebx + 0x100], 0
jne 0x53613e
mov eax, dword [0x6691ec]
movzx eax, byte [eax + 4]
add eax, 0x3b9aca16
call fcn.0060bd9c
mov dword [ebx + 0x100], eax
jmp 0x53613e
lea edx, [ebp - 0x2c0]
mov eax, dword [ebx + 0x110]
call fcn.006549c4
mov edx, dword [ebp - 0x2c0]
mov eax, dword [ebx + 0xfc]
mov eax, dword [eax + 0x124]
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov esi, eax
test esi, esi
jge 0x536125
lea eax, [ebp - 4]
mov edx, dword [ebx + 0x110]
call fcn.004038bc
mov eax, dword [ebp - 4]
call fcn.00654560
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
xor al, 1
test al, al
je 0x5360ca
lea edx, [ebp - 0x2c4]
mov eax, dword [ebp - 4]
call fcn.006549c4
mov eax, dword [ebp - 0x2c4]
lea edx, [ebp - 0x2c0]
call fcn.0061c8a4
mov edx, dword [ebp - 0x2c0]
lea eax, [ebp - 4]
call fcn.004038bc
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0061c4d0
push 0x101
push 0x2b4
lea eax, [ebp - 0x2bc]
push eax
push 0
mov esi, dword [ebp - 4]
push esi
call sub.shell32.dll_SHGetFileInfoW
mov al, byte [ebp - 5]
xor al, 1
test al, al
je 0x5360f5
push esi
call sub.kernel32.dll_DeleteFileW
mov eax, dword [ebx + 0xfc]
mov edi, dword [eax + 0x124]
mov esi, dword [edi + 0x24]
lea edx, [ebp - 0x2c0]
mov eax, dword [ebp - 4]
call fcn.006549c4
mov edx, dword [ebp - 0x2c0]
mov eax, edi
mov ecx, dword [ebp - 0x2bc]
call fcn.0064ed68
mov eax, dword [ebx + 0xfc]
mov eax, dword [eax + 0x124]
mov edx, esi
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov dword [ebx + 0x104], eax
mov cl, 1
mov edx, dword [ebx + 0x30]
mov eax, ebx
call fcn.00536180
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x536177
lea eax, [ebp - 0x2c4]
mov edx, 2
call fcn.00403898
lea eax, [ebp - 4]
call fcn.00403880
ret
Function at 0x5584e0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x558588
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp + 8], 0
jne 0x55850d
mov eax, dword [0x6693a0]
test byte [eax + 1], 0x10
je 0x558519
lea eax, [ebx + 0xc]
mov edx, esi
call fcn.004038bc
jmp 0x55855d
lea edx, [ebp - 4]
xor eax, eax
call fcn.0061c8e8
mov edx, dword [ebp - 4]
lea eax, [ebx + 0xc]
call fcn.004038bc
test esi, esi
je 0x558540
push 0
mov eax, dword [ebx + 0xc]
push eax
push esi
call sub.kernel32.dll_CopyFileW
jmp 0x55855d
mov eax, dword [ebx + 0xc]
call fcn.00650d88
mov esi, eax
mov edx, edi
mov ecx, dword [ebp + 0xc]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 8]
mov eax, esi
call fcn.004028c0
mov ecx, 1
mov edx, 0x80000000
mov eax, dword [ebx + 0xc]
call fcn.006585a4
mov dword [ebx + 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55858f
lea eax, [ebp - 4]
call fcn.00403880
ret

Function at 0x5600c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
xor eax, eax
push ebp
push 0x5601f3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov edx, dword [ebp + 8]
add eax, dword [edx - 0xc]
mov edx, dword [ebp + 8]
cmp eax, dword [edx - 0x10]
jge 0x5601db
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov edx, dword [ebp + 8]
add dword [edx - 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x10]
mov edx, dword [ebp + 8]
sub eax, dword [edx - 8]
mov edx, 0x4000
call fcn.00652c54
mov edx, dword [ebp + 8]
mov dword [edx - 0xc], eax
push 0
mov eax, dword [ebp + 8]
add eax, 0xfffffffc
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
push eax
mov eax, dword [0x66c3a8]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x14]
push eax
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x5601a1
mov eax, dword [ebp + 8]
cmp dword [eax - 8], 0
jne 0x560189
call fcn.00421650
lea ecx, [ebp - 4]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x18]
call fcn.0042106c
mov eax, dword [ebp - 4]
push eax
call fcn.00421650
mov edx, dword [0x66c3a8]
pop ecx
call fcn.00421300
call fcn.00421650
mov edx, dword [ebp + 8]
mov ecx, dword [edx - 0xc]
sub ecx, 0x2a
mov edx, dword [0x66c3a8]
add edx, 0x2a
call fcn.00421498
jmp 0x5601b6
call fcn.00421650
mov edx, dword [ebp + 8]
mov ecx, dword [edx - 0xc]
mov edx, dword [0x66c3a8]
call fcn.00421498
jmp 0x5601b6
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0x1c]
mov eax, 0x560200
call fcn.0061fa50
call fcn.0065612c
cmp byte [0x66506c], 0
je 0x5601d7
mov eax, dword [ebp + 8]
mov edx, dword [eax - 8]
mov eax, dword [ebp + 8]
add edx, dword [eax - 0xc]
mov eax, dword [0x6698c0]
mov eax, dword [eax]
call fcn.004f64d8
mov bl, 1
jmp 0x5601dd
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5601fa
lea eax, [ebp - 4]
call fcn.00403274
ret
Function at 0x560294
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x14], eax
cmp byte [0x66506c], 0
je 0x5602cb
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetFileSize
push eax
call fcn.004fe288
mov ecx, 0x5603ac
pop edx
call fcn.004fb54c
xor eax, eax
push ebp
push 0x560378
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetFileSize
mov dword [ebp - 0x10], eax
push 0
push 0
mov eax, dword [ebp - 0x10]
sub eax, 0x10
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 4]
push eax
push 0x10
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x56031a
sub dword [ebp - 0x10], 0x10
jmp 0x56032c
mov eax, 0x5603bc
mov edx, dword [ebp - 0x1c]
call fcn.0061fa50
call fcn.0065612c
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_SetFilePointer
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xc], eax
push ebp
call fcn.005600c0
pop ecx
test al, al
jne 0x560345
push ebp
call fcn.0056021c
pop ecx
cmp byte [0x66506c], 0
je 0x56036c
call fcn.004fe288
mov dl, 1
call fcn.004fb5a4
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x560399
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5603d8
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
add esi, 0xfffffffc
mov edi, dword [ebp + 8]
mov edi, dword [edi - 8]
xor eax, eax
push ebp
push 0x560469
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea edx, [ebp - 4]
xor eax, eax
call fcn.0061c8e8
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.004038bc
push 0xffffffffffffffff
mov eax, dword [esi]
push eax
mov eax, dword [edi + 8]
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
jne 0x560440
mov ax, word [0x560478]
push eax
mov edx, dword [edi + 8]
mov eax, 0x56047c
mov cl, 1
call fcn.0061f824
cmp ax, 2
je 0x560453
jmp 0x560410
push 0x20
mov eax, dword [esi]
push eax
call sub.kernel32.dll_SetFileAttributesW
mov eax, dword [ebp + 8]
mov byte [eax - 9], 1
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x560470
lea eax, [ebp - 4]
call fcn.00403880
ret