joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41021e
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x47e338
lea ecx, [ebp - 0xc]
call fcn.0041be99
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 0xc]
dec eax
push eax
call fcn.0041bfe3
cmp al, 0x5c
je 0x41024c
push 0x5c
lea ecx, [ebp - 0xc]
call fcn.0041bff8
push esi
push 0
push str.Backup_
lea ecx, [ebp - 0xc]
call fcn.0041c047
push 1
lea ecx, [ebp - 0xc]
call fcn.0041cd1e
push eax
call fcn.0040dc10
mov esi, dword [ebp + 8]
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
dec eax
test eax, eax
jle 0x410292
cmp byte [eax + esi], 0x5c
jne 0x410278
lea eax, [eax + esi + 1]
push 0
push eax
lea ecx, [ebp - 0xc]
call fcn.0041c047
push 0
lea ecx, [ebp - 0xc]
call fcn.0041cd1e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 9
lea ecx, [ebp - 0xc]
call fcn.0041bff8
push 0
push esi
lea ecx, [ebp - 0xc]
call fcn.0041c047
push dword [ebp + 0x14]
lea eax, [ebp - 0xc]
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push str._t_d_t_d_t_d_t_d
push eax
call fcn.0041c467
add esp, 0x18
lea ecx, [ebp - 0xc]
call fcn.0041cd1e
push eax
mov ecx, 0x47e788
call fcn.00421d22
lea ecx, [ebp - 0xc]
call fcn.0041befb
pop esi
leave
ret 0x14
Function at 0x4102f6
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ecx, [ebp - 0x14]
mov dword [esi + 4], ebx
mov dword [ebp - 4], ebx
call fcn.0041bdc5
push dword [ebp - 4]
mov ecx, 0x47e5bc
call fcn.0041c9d2
test al, al
je 0x41048f
lea eax, [ebp - 0x14]
mov ecx, 0x47e5bc
push eax
lea eax, [ebp - 4]
push eax
call fcn.0041c92f
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
lea ecx, [ebp - 0x14]
call fcn.0041cd1e
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x410483
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 8]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x20]
mov dword [esi], edi
call fcn.0041be99
mov eax, dword [ebp - 0x20]
push 3
add eax, 0xfffffffd
lea ecx, [ebp - 0x20]
push eax
call fcn.0041c3a9
push ebx
push 0x42c0b4
lea ecx, [ebp - 0x20]
call fcn.0041c047
cmp byte [0x47f27c], bl
jne 0x4103f1
mov ecx, 0x47eea0
call fcn.0041cd1e
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041be35
push 0x20
lea ecx, [ebp - 0x2c]
call fcn.0041bff8
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x2c]
push eax
call fcn.0041c0c5
lea ecx, [ebp - 0x2c]
call fcn.0041cd1e
push eax
push 0x14
push dword [esi + 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
lea ecx, [ebp - 0x2c]
call fcn.0041befb
push 0x41505d
push 0x415012
lea ecx, [ebp - 0x20]
call fcn.0041cd1e
push eax
lea ecx, [ebp - 0x14]
call fcn.0041cd1e
push eax
call dword [0x47e2dc]
test eax, eax
lea ecx, [ebp - 0x20]
jle 0x41047e
call fcn.0041cd1e
push 0x47e794
push eax
mov ecx, 0x47e788
call fcn.00421ce6
cmp dword [0x47e610], ebx
je 0x41045f
push 0xc
call fcn.00424dd9
cmp eax, ebx
pop ecx
je 0x410450
lea ecx, [ebp - 0x20]
push ecx
mov ecx, eax
call fcn.0041be99
jmp 0x410452
xor eax, eax
push 0xffffffffffffffff
push eax
mov ecx, 0x47e634
call fcn.0041e87a
lea ecx, [ebp - 0x14]
call fcn.0041cd1e
push eax
call fcn.0040d85f
add dword [esi + 4], edi
pop ecx
lea ecx, [ebp - 0x20]
call fcn.0041befb
jmp 0x410311
call fcn.0041befb
lea ecx, [ebp - 0x14]
call fcn.0041befb
xor al, al
jmp 0x410499
lea ecx, [ebp - 0x14]
call fcn.0041befb
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x410722
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
push esi
push edi
je 0x410783
cmp dword [ebp + 0xc], ebx
je 0x410783
mov edi, 0x80
push ebx
push edi
push 3
push ebx
push 1
push 0x80000000
mov ecx, 0x47e6c8
call fcn.0041cd1e
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push eax
call esi
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x410783
lea ecx, [ebp - 0x14]
push ebx
push ecx
mov dword [ebp - 0x14], ebx
push dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x41078c
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0x10
push ebx
push edi
push 2
push ebx
push 1
push 0xc0000000
push dword [ebp + 8]
call esi
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x410783
mov edi, 0x8000
push edi
call fcn.00424dd9
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, ebx
pop ecx
mov dword [ebp + 0xc], eax
jne 0x4107d9
push dword [ebp - 4]
call esi
push dword [ebp + 8]
call esi
mov ecx, 0x47e924
call fcn.0041cd1e
push eax
call fcn.0041d881
pop ecx
mov dword [ebp - 8], ebx
cmp byte [ebp + 0x14], bl
je 0x4107f7
lea eax, [ebp - 0x10]
push eax
push edi
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
call fcn.004111c2
add esp, 0x10
jmp 0x410822
mov ecx, dword [ebp - 8]
mov eax, edi
lea edx, [ecx + 0x8000]
cmp edx, dword [ebp + 0x10]
jbe 0x41080c
mov eax, dword [ebp + 0x10]
sub eax, ecx
lea ecx, [ebp - 0x10]
push ebx
push ecx
push eax
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x410856
lea eax, [ebp - 0xc]
push ebx
push eax
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x410856
mov eax, dword [ebp - 0xc]
add dword [ebp - 8], eax
cmp byte [ebp + 0x14], bl
je 0x41084c
push eax
call fcn.00414f7f
pop ecx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x10]
jae 0x41086e
jmp 0x4107dc
push dword [ebp + 0xc]
call fcn.00424dce
pop ecx
push dword [ebp - 4]
call esi
push dword [ebp + 8]
call esi
jmp 0x410783
push dword [ebp + 0xc]
call fcn.00424dce
pop ecx
push dword [ebp - 4]
call esi
push dword [ebp + 8]
call esi
mov ecx, dword [ebp - 0xc]
xor eax, eax
cmp ecx, dword [ebp - 0x10]
sete al
jmp 0x410785
Function at 0x4111c2
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [ebp - 4]
xor ebx, ebx
push 1
push eax
push ebx
mov dword [ebp - 4], ebx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [0x42bf9c]
mov edx, dword [0x47f28c]
sub ecx, dword [0x47f21c]
mov edi, dword [ebp + 0x10]
mov dword [ebp + 8], ebx
mov dword [ebp + 0x10], edi
mov ecx, dword [edx + ecx*4]
lea edx, [eax + edi]
cmp ecx, edx
jae 0x41120a
sub ecx, eax
mov dword [ebp + 0x10], ecx
lea eax, [ebp + 8]
push ebx
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
test eax, eax
mov dword [ebx], ecx
je 0x411290
cmp ecx, edi
jae 0x411290
mov eax, dword [0x42bf9c]
mov ecx, dword [0x47e290]
sub eax, dword [0x47f21c]
dec ecx
cmp eax, ecx
jge 0x411290
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
mov ecx, 0x47e880
call fcn.00413a88
mov ecx, dword [0x42bf9c]
mov edx, dword [0x47f28c]
sub ecx, dword [0x47f21c]
mov eax, dword [ebp + 8]
sub edi, eax
mov ecx, dword [edx + ecx*4]
cmp ecx, edi
jae 0x411276
mov edi, ecx
lea ecx, [ebp + 8]
push 0
push ecx
mov ecx, dword [ebp + 0xc]
add eax, ecx
push edi
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp + 8]
add dword [ebx], eax
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push 1
push eax
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
mov dword [0x47f200], eax
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4112b1
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
xor eax, eax
cmp dword [0x47e504], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
jle 0x4114da
push ebx
push esi
push edi
mov esi, 0x47dfb8
push dword [ebp - 8]
mov ecx, 0x47e4f8
call fcn.0041e860
mov edi, eax
mov eax, dword [edi + 0x1c]
cmp eax, dword [ebp + 8]
jne 0x4114c5
push dword [edi + 0x20]
call fcn.00412ba7
test al, al
pop ecx
je 0x4114c5
lea ebx, [edi + 4]
mov ecx, esi
push ebx
call fcn.004164b1
lea eax, [edi + 0x10]
mov ecx, esi
push eax
call fcn.004164b1
or dword [edi + 0x1c], 0xffffffff
push ebx
mov ecx, esi
call fcn.0041a81a
lea eax, [edi + 0x10]
mov ecx, esi
push eax
call fcn.0041a81a
push 0x7fffffff
push ebx
mov ecx, esi
call fcn.0041b3b9
lea eax, [edi + 0x10]
push 0x7fffffff
push eax
mov ecx, esi
call fcn.0041b3b9
mov eax, dword [edi]
cmp eax, 4
jne 0x411365
inc dword [ebp - 4]
mov ecx, ebx
call fcn.0041cd1e
push eax
call fcn.00424269
jmp 0x4114c5
cmp eax, 5
jne 0x41137d
mov ecx, ebx
call fcn.0041cd1e
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x4114c5
push 0x1e
lea eax, [ebp - 0x38]
push 0
push eax
call fcn.00424500
mov eax, dword [0x47e178]
add esp, 0xc
mov ecx, ebx
mov dword [ebp - 0x38], eax
push 0
mov word [ebp - 0x28], 0x650
call fcn.0041bff8
mov ecx, ebx
call fcn.0041cd1e
mov dword [ebp - 0x30], eax
mov eax, dword [edi]
test eax, eax
je 0x4113be
cmp eax, 2
je 0x4113be
cmp eax, 3
jne 0x4113d4
lea ebx, [edi + 0x10]
push 0
mov ecx, ebx
call fcn.0041bff8
mov ecx, ebx
call fcn.0041cd1e
mov dword [ebp - 0x2c], eax
mov eax, dword [edi]
push 1
pop ecx
cmp eax, ecx
jne 0x4113e6
mov dword [ebp - 0x34], 3
jmp 0x4113fc
cmp eax, 2
je 0x4113f9
xor ecx, ecx
cmp eax, 3
setne cl
dec ecx
and ecx, 2
inc ecx
inc ecx
mov dword [ebp - 0x34], ecx
lea ecx, [edi + 0x10]
call fcn.0041cd1e
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push eax
call ebx
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
test eax, eax
jne 0x411457
cmp dword [edi], eax
jne 0x411457
cmp dword [ebp - 0xc], 0xffffffff
jne 0x411457
inc dword [ebp - 4]
lea ecx, [edi + 0x10]
call fcn.0041cd1e
push eax
call ebx
cmp eax, 0xffffffff
je 0x411457
test al, 0x10
jne 0x411457
lea ecx, [edi + 0x10]
call fcn.0041cd1e
push 0x47e794
push eax
mov ecx, 0x47e788
call fcn.00421ce6
mov eax, dword [edi + 0x10]
lea ebx, [edi + 0x10]
cmp eax, 4
jbe 0x4114c5
mov edi, dword [edi]
cmp edi, 2
je 0x41146d
test edi, edi
jne 0x4114c5
add eax, 0xfffffffb
push 4
push eax
mov ecx, ebx
call fcn.0041cc95
push eax
lea ecx, [ebp - 0x18]
call fcn.0041be99
lea ecx, [ebp - 0x18]
call fcn.0041cd68
push 1
push str..TTF
lea ecx, [ebp - 0x18]
call fcn.0041c1fa
test al, al
je 0x4114bd
mov ecx, ebx
call fcn.0041cd1e
push eax
call dword [sym.imp.GDI32.dll_AddFontResourceA]
push 0
push 0
push 0x1d
push 0xffff
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [ebp - 0x18]
call fcn.0041befb
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp eax, dword [0x47e504]
jl 0x4112d3
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 4]
leave
ret 4
Function at 0x4114e1
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x47e110]
push ebx
push esi
xor esi, esi
cmp eax, esi
push edi
je 0x411502
mov eax, dword [eax + 4]
cmp eax, esi
mov dword [ebp - 4], eax
jne 0x41151d
mov eax, dword [0x47df60]
cmp eax, esi
je 0x411515
mov eax, dword [eax + 4]
cmp eax, esi
mov dword [ebp - 4], eax
jne 0x41151d
mov eax, dword [0x47e178]
mov dword [ebp - 4], eax
push esi
push 0x405811
push dword [ebp - 4]
push 0x12
push dword [0x47e17c]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
lea ecx, [ebp - 0x14]
mov dword [ebp - 8], eax
call fcn.0041bdc5
push str.___Internal_WaitExternal___
call fcn.0041d46f
cmp eax, esi
je 0x411558
push eax
lea ecx, [ebp - 0x14]
call fcn.0041bf12
jmp 0x411565
push 0x47f044
lea ecx, [ebp - 0x14]
call fcn.0041bf80
push 1
lea ecx, [ebp - 0x14]
pop edi
push edi
push esi
push esi
push 0x42c130
push str.__n_
call fcn.0041cbf9
lea ecx, [ebp - 0x14]
call fcn.0041cd1e
push eax
push 0x422
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov ecx, 0x47e850
call fcn.0041cd1e
push eax
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_SetWindowTextA]
push esi
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_EnableWindow]
push 0x10
lea eax, [ebp - 0x24]
push esi
push eax
call fcn.00424500
push 0x44
lea eax, [ebp - 0x84]
pop ebx
push ebx
push esi
push eax
call fcn.00424500
add esp, 0x18
lea eax, [ebp - 0x24]
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x58], edi
push eax
lea eax, [ebp - 0x84]
push eax
mov word [ebp - 0x54], di
push dword [ebp + 0xc]
push esi
push 0x4000000
push esi
push esi
push esi
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x411670
mov eax, dword [ebp - 0x24]
mov ebx, dword [sym.imp.USER32.dll_PeekMessageA]
mov dword [ebp + 0xc], eax
push 0xff
push 0xffffffffffffffff
lea eax, [ebp + 0xc]
push esi
push eax
push edi
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, esi
je 0x411660
cmp eax, edi
jne 0x411660
push esi
push esi
push esi
lea eax, [ebp - 0x40]
push esi
push eax
call ebx
test eax, eax
je 0x411610
push esi
push esi
lea eax, [ebp - 0x40]
push esi
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x411610
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x41162b
push dword [ebp - 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x20]
call esi
push edi
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_EnableWindow]
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_DestroyWindow]
lea ecx, [ebp - 0x14]
call fcn.0041befb
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x411692
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
push dword [esi + 0x34]
mov ecx, 0x47e6c8
mov dword [ebp - 4], edi
push dword [eax]
call fcn.0041cd1e
mov ebx, dword [ebp + 0xc]
push eax
mov ecx, ebx
call fcn.0041cac5
test eax, eax
jge 0x4116df
push 0
push str.Couldnt_read_filename___skipping_file
push dword [edi + 8]
mov ecx, 0x47dfb8
call fcn.0041b2a8
xor eax, eax
jmp 0x41180a
mov edi, 0x47dfb8
push ebx
mov ecx, edi
call fcn.004164b1
push ebx
mov ecx, edi
call fcn.0041a81a
push 0x7fffffff
push ebx
mov ecx, edi
call fcn.0041b3b9
mov eax, dword [ebp + 0x14]
mov ecx, ebx
mov byte [eax], 1
mov eax, dword [esi + 0x34]
add dword [0x47f200], eax
call fcn.0041cd1e
push eax
call fcn.0040df52
test al, al
pop ecx
jne 0x411788
lea ecx, [ebp - 0x10]
call fcn.0041bdc5
mov ecx, ebx
call fcn.0041cd1e
push eax
mov ecx, 0x47ee94
call fcn.0041cd1e
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0041c467
add esp, 0xc
mov ecx, 0x47e700
call fcn.0041cd1e
mov ecx, dword [ebp - 4]
push 4
push eax
mov esi, dword [ecx + 8]
lea ecx, [ebp - 0x10]
call fcn.0041cd1e
push eax
push esi
mov ecx, edi
call fcn.0041b2cc
cmp eax, 7
jne 0x411777
or esi, 0xffffffff
jmp 0x411779
xor esi, esi
lea ecx, [ebp - 0x10]
call fcn.0041befb
mov eax, esi
jmp 0x41180a
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov ecx, ebx
call fcn.0041cd1e
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x411807
and dword [ebp + 8], 0
lea eax, [ebp + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0x34], eax
lea eax, [esi + 0x10]
push eax
lea eax, [esi + 0x18]
push 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esi + 0x24]
mov ecx, ebx
push eax
lea eax, [esi + 0x20]
push eax
call fcn.0041cd1e
push eax
call fcn.0040d883
add esp, 0xc
add esi, 0x28
mov ecx, ebx
push 0
push esi
call fcn.0041cd1e
push eax
call fcn.0040d917
add esp, 0xc
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x411ce5
Capabilities:
Delete file

Disassembly:
push ebx
push esi
push edi
push str..DLL
push dword [esp + 0x14]
call fcn.0041dbff
mov edi, dword [esp + 0x1c]
pop ecx
pop ecx
mov esi, 0x47e2f0
push edi
mov ecx, esi
call fcn.0041c8fd
add edi, 4
mov ecx, esi
push edi
mov ebx, eax
call fcn.0041c8fd
test ebx, ebx
mov esi, eax
je 0x411d76
test esi, esi
je 0x411d76
push 1
pop eax
mov dword [0x47f21c], eax
mov dword [0x47e290], eax
mov eax, dword [0x47f28c]
test eax, eax
je 0x411d3d
push eax
call fcn.00424dce
pop ecx
push 4
call fcn.00424dd9
pop ecx
mov dword [0x47f28c], eax
push esi
lea ecx, [esi + ebx]
push ebx
mov dword [eax], ecx
push dword [esp + 0x18]
mov ecx, 0x47e6c8
call fcn.0041cd1e
push eax
call fcn.00401ac0
add esp, 0x10
test eax, eax
je 0x411d7e
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor al, al
pop edi
pop esi
pop ebx
ret 8
mov al, 1
jmp 0x411d78

Function at 0x411d82
Capabilities:
Shutdown system
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 4]
push ebx
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea eax, [ebp - 0x10]
xor ebx, ebx
push eax
push str.SeShutdownPrivilege
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push ebx
push ebx
lea eax, [ebp - 0x14]
push ebx
push eax
push ebx
push dword [ebp - 4]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 1
mov ecx, 0x47dfb8
call fcn.0041b45d
push ebx
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
xor eax, eax
cmp byte [0x47f2d5], bl
sete al
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x412ba7
Capabilities:
Inspect section memory permissions

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
jne 0x412bb4
mov al, 1
pop esi
ret
mov edx, dword [esi]
push 1
pop eax
test al, dl
jne 0x412c3b
mov ecx, dword [0x47e1ec]
test edx, 0x40000000
je 0x412bcf
cmp ecx, eax
je 0x412c3b
test edx, 0x20000000
je 0x412bdc
cmp ecx, 2
je 0x412c3b
cmp ecx, eax
jne 0x412c04
mov ecx, dword [0x47e1e4]
cmp ecx, 0x5a
je 0x412bff
cmp dword [0x47e1e0], 4
jne 0x412bff
neg ecx
sbb ecx, ecx
and ecx, 2
inc ecx
inc ecx
jmp 0x412c33
push 8
pop ecx
jmp 0x412c33
mov ecx, dword [0x47e1e0]
cmp ecx, 4
ja 0x412c13
push 0x10
jmp 0x412c01
cmp ecx, 5
jne 0x412c2e
mov ecx, dword [0x47e1e4]
test ecx, ecx
jne 0x412c26
push 0x20
jmp 0x412c01
cmp ecx, eax
jne 0x412c2e
push 0x40
jmp 0x412c01
mov ecx, 0x80
test ecx, edx
jne 0x412c3b
xor al, al
pop esi
ret
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x412c56
shr edx, 0x1f
and dl, al
push edx
push 0
push dword [esi + 4]
push ecx
call fcn.0041285d
add esp, 0x10
pop esi
ret
Function at 0x412c58
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
xor ebx, ebx
cmp byte [ebp + 0xc], bl
push esi
push edi
mov esi, 0x47dfb8
je 0x412cdd
mov edi, 0x47e1ac
mov ecx, esi
push edi
call fcn.004164b1
push edi
mov ecx, esi
call fcn.0041a81a
push 0x7fffffff
push edi
mov ecx, esi
call fcn.0041b3b9
push 1
mov edi, 0x47e1ac
push ebx
push 0x42bc5c
mov ecx, edi
call fcn.0041c7db
push eax
push ebx
mov ecx, edi
call fcn.0041cc95
push eax
lea ecx, [ebp - 0xc]
call fcn.0041be99
push 1
lea ecx, [ebp - 0xc]
call fcn.0041cd1e
push eax
push ebx
mov ecx, edi
call fcn.0041cd1e
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp - 0xc]
call fcn.0041befb
cmp byte [ebp + 8], bl
je 0x412da5
mov edi, 0x47e1a0
mov ecx, esi
push edi
call fcn.004164b1
push edi
mov ecx, esi
call fcn.0041a81a
push 0x7fffffff
push edi
mov ecx, esi
call fcn.0041b3b9
push 0x10
lea eax, [ebp - 0x1c]
push ebx
push eax
call fcn.00424500
push 0x44
lea eax, [ebp - 0x60]
push ebx
push eax
call fcn.00424500
add esp, 0x18
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x60], 0x44
push 1
pop eax
mov dword [ebp - 0x34], eax
mov word [ebp - 0x30], ax
call fcn.0041bdc5
push ebx
mov ecx, 0x47e1a0
call fcn.0041bfe3
cmp al, 0x22
jne 0x412d56
push edi
lea ecx, [ebp - 0xc]
call fcn.0041bf80
jmp 0x412d72
mov ecx, 0x47e1a0
call fcn.0041cd1e
push eax
lea eax, [ebp - 0xc]
push 0x42c1dc
push eax
call fcn.0041c467
add esp, 0xc
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0xc]
push eax
lea eax, [ebp - 0x60]
push eax
push ebx
push ebx
push 0x4000000
push ebx
push ebx
push ebx
call fcn.0041cd1e
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0xc]
call fcn.0041befb
cmp byte [ebp + 0x10], bl
je 0x412e51
mov edi, 0x47e284
mov ecx, esi
push edi
call fcn.004164b1
push edi
mov ecx, esi
call fcn.0041a81a
push 0x7fffffff
push edi
mov ecx, esi
call fcn.0041b3b9
push 0x10
lea eax, [ebp - 0x1c]
push ebx
push eax
call fcn.00424500
push 0x44
lea eax, [ebp - 0x60]
pop esi
push esi
push ebx
push eax
call fcn.00424500
add esp, 0x18
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x60], esi
push 1
pop eax
mov dword [ebp - 0x34], eax
mov word [ebp - 0x30], ax
call fcn.0041bdc5
mov ecx, 0x47e284
call fcn.0041cd1e
push eax
lea eax, [ebp - 0xc]
push 0x42c1dc
push eax
call fcn.0041c467
add esp, 0xc
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0xc]
push eax
lea eax, [ebp - 0x60]
push eax
push ebx
push ebx
push 0x4000000
push ebx
push ebx
push ebx
call fcn.0041cd1e
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0xc]
call fcn.0041befb
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x413c46
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x7d08
call fcn.00425220
push ebx
push esi
push edi
xor ebx, ebx
mov edi, 0x80
push ebx
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push edi
push 3
push ebx
push 1
push 0x80000000
push dword [ebp + 8]
call esi
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x413cf8
push dword [ebp + 0xc]
call fcn.0040d85f
pop ecx
push ebx
push edi
push 2
push ebx
push 1
push 0x40000000
push dword [ebp + 0xc]
call esi
mov edi, eax
cmp edi, 0xffffffff
jne 0x413ca8
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x413cf8
mov dword [ebp + 8], ebx
mov esi, 0x7d00
lea eax, [ebp + 8]
push ebx
push eax
lea eax, [ebp - 0x7d08]
push esi
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [ebp - 0x7d08]
push dword [ebp + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp + 8]
call fcn.00414f7f
cmp dword [ebp + 8], esi
pop ecx
je 0x413cb0
push dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
pop edi
pop esi
pop ebx
leave
ret 8