joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c7168
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x190]
test eax, eax
je 0x5c720a
cmp dword [ebx + 0xac], 0
jne 0x5c7204
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x5c70a8
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0xa8]
cmp dword [eax + 8], 0
je 0x5c7204
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x5c71ca
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x5c7204
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [ebx + 0xa8]
mov edx, esi
call fcn.004a9c40
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x5c71d9
inc dword [ebx + 0xac]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x5c754c
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x60bc08]
cmp dword [eax + 0x190], 0
je 0x5c76b5
test bl, bl
jne 0x5c7608
cmp dword [esi + 0xb4], 0
jne 0x5c75fd
mov eax, esi
call fcn.005caa94
push eax
push 0x5c744c
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x58], 0
je 0x5c75ce
mov eax, dword [0x60bc08]
cmp byte [eax + 0xeb], 0
je 0x5c75ce
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x5c75af
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5c75ce
push 0
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5c75b7
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5c75fd
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.004a9c40
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5c75dd
inc dword [esi + 0xb4]
jmp 0x5c76b5
cmp dword [esi + 0xb4], 0
jle 0x5c76b5
dec dword [esi + 0xb4]
cmp dword [esi + 0xb4], 0
jne 0x5c76b5
cmp dword [esi + 0x58], 0
je 0x5c766a
mov eax, dword [0x60bc08]
cmp byte [eax + 0xeb], 0
je 0x5c766a
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x5c764b
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5c766a
push 5
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5c7653
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5c7699
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.004a9c40
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5c7679
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esi + 0xf0]
mov edx, dword [0x5b7d9c]
call fcn.0040d96c
pop edi
pop esi
pop ebx
ret
Function at 0x5c84ac
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x5c8509
cmp byte [ebx + 0xeb], 0
jne 0x5c8509
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x190]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040a830
mov eax, dword [esi]
test eax, eax
je 0x5c84f6
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x5c8516
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040aa88
jmp 0x5c8516
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040aa88
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5ca138
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x5ca1a9
mov eax, esi
call fcn.0052b070
test al, al
je 0x5ca1a9
mov eax, dword [ebx + 0x98]
call fcn.0052ac08
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5ca1a9
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x160]
test al, al
je 0x5ca19a
push 0
mov eax, dword [ebx + 0x98]
call fcn.0052ac08
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebx + 0x98]
xor edx, edx
call fcn.00520fe0
jmp 0x5ca1a9
mov edx, dword [ebx + 0x88]
mov cl, 1
mov eax, ebx
call fcn.005c9f44
pop esi
pop ebx
ret
Function at 0x5cff0c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
cmp dword [ebx + 0x94], 0
jne 0x5cff92
mov eax, dword [ebx + 8]
call fcn.0052ac08
mov ecx, eax
mov dl, 1
mov eax, dword [0x5396b4]
call fcn.00524870
mov dword [ebx + 0x94], eax
mov esi, dword [ebx + 0x94]
xor edx, edx
mov eax, esi
call fcn.00540250
mov dword [esi + 0x2dc], ebx
mov dword [esi + 0x2d8], 0x5cf7dc
push 8
mov edx, 3
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xe0]
push eax
push 0
push 0
push 0
push 0
mov eax, dword [ebx + 0x94]
call fcn.0052ac08
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x94]
call fcn.0052ac08
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0xa4], 0
jne 0x5d0014
mov eax, dword [ebx + 8]
call fcn.0052ac08
mov ecx, eax
mov dl, 1
mov eax, dword [0x5396b4]
call fcn.00524870
mov dword [ebx + 0xa4], eax
mov esi, dword [ebx + 0xa4]
mov dl, 1
mov eax, esi
call fcn.00540250
mov dword [esi + 0x2dc], ebx
mov dword [esi + 0x2d8], 0x5cf828
push 8
push 0
mov edx, 2
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xe0]
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0xa4]
call fcn.0052ac08
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0xa4]
call fcn.0052ac08
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x9c], 0
jne 0x5d0092
mov eax, dword [ebx + 8]
call fcn.0052ac08
mov ecx, eax
mov dl, 1
mov eax, dword [0x53a1a8]
call fcn.00524870
mov dword [ebx + 0x9c], eax
mov esi, dword [ebx + 0x9c]
mov byte [esi + 0x2b0], 1
push 8
mov edx, 3
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xe0]
push eax
mov edx, 2
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xe0]
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x9c]
call fcn.0052ac08
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x9c]
call fcn.0052ac08
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x5d4388
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor eax, eax
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x5d4421
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
xor ebx, ebx
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x24]
mov edx, ebx
add dx, 0x41
call fcn.0040b4fc
lea eax, [ebp - 0x24]
mov edx, 0x5d4440
call fcn.0040b6d0
mov eax, dword [ebp - 0x24]
call fcn.0040b4d8
push eax
call sub.kernel32.dll_GetDiskFreeSpaceExW
test eax, eax
je 0x5d4403
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x18]
sbb edx, dword [ebp - 0x14]
add eax, dword [ebp - 8]
adc edx, dword [ebp - 4]
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
inc ebx
cmp ebx, 0x1a
jne 0x5d43b2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d4428
lea eax, [ebp - 0x24]
call fcn.0040a698
pop eax
jmp eax

Function at 0x5d4890
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xfffffdfc
mov ebx, eax
mov dword [esp], pe_nt_image_headers32
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x5d48c1
mov eax, ebx
lea edx, [esp + 4]
mov ecx, pe_nt_image_headers32
call fcn.0040b230
jmp 0x5d48cd
mov eax, ebx
mov edx, 0x5d48dc
call fcn.0040aafc
add esp, 0x204
pop ebx
ret

Function at 0x5d5274
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
xor edx, edx
mov dword [ebp - 0x20c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5d5324
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x208]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathW
mov eax, ebx
lea edx, [ebp - 0x208]
mov ecx, 0x104
call fcn.0040b230
lea edx, [ebp - 0x20c]
mov eax, dword [ebx]
call fcn.00425314
mov edx, dword [ebp - 0x20c]
mov eax, ebx
call fcn.0040aafc
mov edx, dword [ebx]
mov eax, edx
test eax, eax
je 0x5d52e2
sub eax, 4
mov eax, dword [eax]
shr eax, 1
test eax, eax
je 0x5d5309
mov eax, edx
test eax, eax
je 0x5d52f3
sub eax, 4
mov eax, dword [eax]
shr eax, 1
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x5d5309
mov eax, ebx
mov edx, 0x5d5334
call fcn.0040b280
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d532b
lea eax, [ebp - 0x20c]
call fcn.0040a6e0
pop eax
jmp eax
Function at 0x5d5410
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
xor edx, edx
mov dword [ebp - 0x20c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5d54c0
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x208]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
mov eax, ebx
lea edx, [ebp - 0x208]
mov ecx, 0x104
call fcn.0040b230
lea edx, [ebp - 0x20c]
mov eax, dword [ebx]
call fcn.00425314
mov edx, dword [ebp - 0x20c]
mov eax, ebx
call fcn.0040aafc
mov edx, dword [ebx]
mov eax, edx
test eax, eax
je 0x5d547e
sub eax, 4
mov eax, dword [eax]
shr eax, 1
test eax, eax
je 0x5d54a5
mov eax, edx
test eax, eax
je 0x5d548f
sub eax, 4
mov eax, dword [eax]
shr eax, 1
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x5d54a5
mov eax, ebx
mov edx, 0x5d54d0
call fcn.0040b280
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d54c7
lea eax, [ebp - 0x20c]
call fcn.0040a6e0
pop eax
jmp eax
Function at 0x5d6544
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x5d672c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.004073d8
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.00426460
lea eax, [ebp - 0x18]
mov edx, 0x5d6748
call fcn.0040b6d0
mov eax, dword [ebp - 0x18]
call fcn.0040b4d8
push eax
call sub.kernel32.dll_CreateFileW
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x5d65bf
or ecx, 0xffffffff
or edx, 0xffffffff
mov eax, 0x5d6768
call fcn.0055f2c8
jmp 0x5d66fc
lea eax, [ebp - 0x10]
push eax
push ebx
call sub.kernel32.dll_GetFileSizeEx
lea eax, [ebp - 4]
mov edx, dword [0x5d3f80]
call fcn.0040d96c
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x5d3f80]
call fcn.0040d848
add esp, 4
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x5d661a
push 0
push 0
push 0
push 0
push ebx
call sub.kernel32.dll_SetFilePointerEx
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
push eax
push ebx
call sub.kernel32.dll_ReadFile
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x14]
jne 0x5d65f8
push ebx
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 4]
test eax, eax
je 0x5d6634
sub eax, 4
mov eax, dword [eax]
sub eax, 8
push eax
lea edx, [ebp - 4]
lea eax, [ebp - 4]
mov ecx, 8
call fcn.005d50e0
push 4
lea edx, [ebp - 8]
lea eax, [ebp - 4]
xor ecx, ecx
call fcn.005d50e0
mov eax, dword [ebp - 4]
test eax, eax
je 0x5d6663
sub eax, 4
mov eax, dword [eax]
sub eax, 4
push eax
lea edx, [ebp - 4]
lea eax, [ebp - 4]
mov ecx, 4
call fcn.005d50e0
lea eax, [ebp - 8]
call fcn.005d50b4
mov ebx, eax
push ebx
mov eax, dword [0x604340]
mov ecx, 1
mov edx, dword [0x5d641c]
call fcn.0040d848
add esp, 4
mov esi, ebx
dec esi
test esi, esi
jl 0x5d66fc
inc esi
xor ebx, ebx
push 0x20
lea edi, [ebx + ebx*4]
mov eax, dword [0x604340]
mov eax, dword [eax]
lea edx, [eax + edi*4]
lea eax, [ebp - 4]
xor ecx, ecx
call fcn.005d50e0
mov eax, dword [0x604340]
mov eax, dword [eax]
lea edx, [eax + edi*4 + 4]
mov eax, dword [ebp - 4]
add eax, 0x20
mov ecx, 0x10
call fcn.004071b4
mov eax, dword [ebp - 4]
test eax, eax
je 0x5d66e4
sub eax, 4
mov eax, dword [eax]
sub eax, 0x30
push eax
lea edx, [ebp - 4]
lea eax, [ebp - 4]
mov ecx, 0x30
call fcn.005d50e0
inc ebx
dec esi
jne 0x5d66a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d6733
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.0040a6f8
lea eax, [ebp - 8]
mov edx, dword [0x5d3f80]
mov ecx, 2
call fcn.0040c420
pop eax
jmp eax
Function at 0x5d739c
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff9a4
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [0x5d3fb8]
call fcn.0040d96c
mov eax, dword [ebp - 8]
mov edx, dword [0x5d3fb8]
call fcn.0040d96c
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x5d749f
xor edx, edx
push ebp
push 0x5d748c
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
lea eax, [ebp - 0x10]
push eax
push 0x400
lea eax, [ebp - 0x65c]
push eax
push 0
push 0
push 0x4004747f
mov eax, dword [ebp - 0xc]
push eax
call sub.WS2_32.DLL_WSAIoctl
inc eax
je 0x5d7482
mov eax, dword [ebp - 0x10]
mov ecx, 0x4c
cdq
idiv ecx
mov esi, eax
dec esi
test esi, esi
jl 0x5d7482
inc esi
lea edi, [ebp - 0x658]
push esi
push edi
mov esi, edi
lea edi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
cmp dword [ebp - 0x1c], 0x100007f
je 0x5d747c
movzx eax, byte [ebp - 0x1a]
push eax
movzx eax, byte [ebp - 0x19]
push eax
mov eax, dword [ebp - 4]
movzx ecx, byte [ebp - 0x1b]
movzx ebx, byte [ebp - 0x1c]
mov edx, ebx
call fcn.005d41d0
movzx eax, byte [ebp - 0x1a]
push eax
movzx eax, byte [ebp - 0x19]
push eax
mov eax, dword [ebp - 8]
movzx ecx, byte [ebp - 0x1b]
mov edx, ebx
call fcn.005d41d0
add edi, 0x4c
dec esi
jne 0x5d7432
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5d7496
mov eax, dword [ebp - 0xc]
push eax
call sub.wsock32.dll_closesocket
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5d7f94
Capabilities:
Initialize winsock library

Disassembly:
mov eax, dword [0x604464]
add eax, 4
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
test eax, eax
je 0x5d7fb3
mov eax, dword [0x604464]
mov byte [eax], 1
ret

Function at 0x5d88dc
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x58
call fcn.00407f8c
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret

Function at 0x5d8ce0
Capabilities:
Timestomp file

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe0
mov esi, edx
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, eax
xor ebx, ebx
mov esi, 1
cmp dword [esp], 0
jne 0x5d8d03
cmp dword [esp + 4], 0
je 0x5d8d4b
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x10]
push eax
mov eax, dword [edi]
push eax
call sub.kernel32.dll_GetFileTime
test eax, eax
jne 0x5d8d27
push 0x64
call sub.kernel32.dll_Sleep
jmp 0x5d8d4f
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 8]
push eax
mov eax, dword [edi]
push eax
call sub.kernel32.dll_SetFileTime
test eax, eax
jne 0x5d8d4b
push 0x64
call sub.kernel32.dll_Sleep
jmp 0x5d8d4f
mov bl, 1
jmp 0x5d8d55
inc esi
cmp esi, 0xb
jne 0x5d8cf6
mov eax, ebx
add esp, 0x20
pop edi
pop esi
pop ebx
ret
Function at 0x5d8d60
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x5d8d69
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov esi, eax
lea eax, [ebp - 4]
call fcn.0040a7ac
xor eax, eax
push ebp
push 0x5d8eb7
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov edi, 1
cmp dword [esi], 0xffffffff
je 0x5d8daa
mov eax, dword [esi]
push eax
call sub.kernel32.dll_CloseHandle
mov dword [esi], 0xffffffff
lea eax, [ebp - 0x14]
mov edx, dword [ebx]
call fcn.0040b5b4
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00426460
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 4]
call fcn.0040b5b4
mov edx, dword [ebp - 0x18]
pop eax
call fcn.0040b6d0
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
call fcn.0040b5c8
mov eax, dword [ebp - 8]
mov edx, dword [ebx]
call fcn.0040b43c
jne 0x5d8dfd
mov byte [ebp - 9], 1
jmp 0x5d8e80
lea eax, [ebp - 8]
mov edx, 0x5d8ed0
call fcn.0040b280
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 8]
call fcn.0040b5b4
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x1c]
xor edx, edx
call fcn.005d9090
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 8]
call fcn.0040b5c8
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 8]
call fcn.005d4710
mov eax, dword [ebp - 0x24]
call fcn.0040b26c
push eax
lea edx, [ebp - 0x28]
mov eax, dword [ebx]
call fcn.005d4710
mov eax, dword [ebp - 0x28]
call fcn.0040b26c
push eax
call sub.kernel32.dll_MoveFileW
test eax, eax
jne 0x5d8e66
push 0x64
call sub.kernel32.dll_Sleep
jmp 0x5d8e76
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.0040aafc
mov byte [ebp - 9], 1
jmp 0x5d8e80
inc edi
cmp edi, 0xb
jne 0x5d8d9d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d8ebe
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.0040a768
lea eax, [ebp - 0x20]
mov edx, 5
call fcn.0040a6f8
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040a768
pop eax
jmp eax
Function at 0x5d9294
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov esi, eax
lea eax, [ebp - 4]
call fcn.0040a7ac
xor eax, eax
push ebp
push 0x5d9391
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 1
mov bl, 1
cmp dword [esi], 0xffffffff
jne 0x5d9300
push 0x64
call sub.kernel32.dll_Sleep
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.005d4710
mov eax, dword [ebp - 0xc]
call fcn.0040b26c
push eax
call sub.kernel32.dll_CreateFileW
mov dword [esi], eax
jmp 0x5d935e
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
mov eax, dword [esi]
push eax
call sub.kernel32.dll_SetFilePointerEx
test al, al
je 0x5d9322
mov eax, dword [esi]
push eax
call sub.kernel32.dll_SetEndOfFile
test eax, eax
jne 0x5d936c
mov eax, dword [esi]
push eax
call sub.kernel32.dll_CloseHandle
push 0x64
call sub.kernel32.dll_Sleep
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.005d4710
mov eax, dword [ebp - 0x10]
call fcn.0040b26c
push eax
call sub.kernel32.dll_CreateFileW
mov dword [esi], eax
inc ebx
cmp bl, 0xb
jne 0x5d92c5
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d9398
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.0040a768
lea eax, [ebp - 4]
call fcn.0040a6e0
pop eax
jmp eax

Function at 0x5d94a8
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov edi, eax
lea eax, [ebp - 4]
call fcn.0040a7ac
xor eax, eax
push ebp
push 0x5d9596
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.005d4710
mov eax, dword [ebp - 8]
call fcn.0040b26c
push eax
call sub.kernel32.dll_CreateFileW
mov dword [edi], eax
cmp dword [edi], 0xffffffff
jne 0x5d9579
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.005d4710
mov eax, dword [ebp - 0xc]
call fcn.0040b26c
push eax
call sub.kernel32.dll_GetFileAttributesW
mov esi, eax
cmp esi, 0xffffffff
je 0x5d9577
and esi, 0xfffffffe
push esi
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.005d4710
mov eax, dword [ebp - 0x10]
call fcn.0040b26c
push eax
call sub.kernel32.dll_SetFileAttributesW
test eax, eax
je 0x5d9577
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.005d4710
mov eax, dword [ebp - 0x14]
call fcn.0040b26c
push eax
call sub.kernel32.dll_CreateFileW
mov dword [edi], eax
cmp dword [edi], 0xffffffff
jne 0x5d9579
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d959d
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.0040a768
pop eax
jmp eax
Function at 0x5d95a8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
lea eax, [ebp + 8]
call fcn.0040a7ac
xor eax, eax
push ebp
push 0x5d96ba
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 1
mov bl, 1
cmp dword [esi], 0xffffffff
jne 0x5d9617
push 0x64
call sub.kernel32.dll_Sleep
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
lea edx, [ebp - 0x10]
mov eax, dword [ebp + 8]
call fcn.005d4710
mov eax, dword [ebp - 0x10]
call fcn.0040b26c
push eax
call sub.kernel32.dll_CreateFileW
mov dword [esi], eax
jmp 0x5d9687
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
mov eax, dword [esi]
push eax
call sub.kernel32.dll_SetFilePointerEx
test al, al
je 0x5d964b
push 0
lea eax, [ebp - 0xc]
push eax
push edi
mov eax, dword [ebp - 4]
mov eax, dword [eax]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_WriteFile
test eax, eax
je 0x5d964b
cmp edi, dword [ebp - 0xc]
je 0x5d9695
mov eax, dword [esi]
push eax
call sub.kernel32.dll_CloseHandle
push 0x64
call sub.kernel32.dll_Sleep
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
lea edx, [ebp - 0x14]
mov eax, dword [ebp + 8]
call fcn.005d4710
mov eax, dword [ebp - 0x14]
call fcn.0040b26c
push eax
call sub.kernel32.dll_CreateFileW
mov dword [esi], eax
inc ebx
cmp bl, 0xb
jne 0x5d95dc
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d96c1
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0040a768
lea eax, [ebp + 8]
call fcn.0040a6e0
pop eax
jmp eax