joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d1f0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4529b8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x47d00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push ecx
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
push ecx
lea ecx, [ebp - 0x1c]
movq qword [ebp - 0x1c], xmm0
call fcn.00409a00
mov dword [ebp - 4], 0
lea edx, [ebp - 0x20]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x20], 2
call fcn.0040cfb0
mov esi, eax
test esi, esi
jne 0x40d256
xor bl, bl
jmp 0x40d26b
lea ecx, [ebp - 0x1c]
call fcn.00409c40
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
sete bl
lea ecx, [ebp - 0x1c]
call fcn.00409af0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042520b
mov esp, ebp
pop ebp
ret
Function at 0x40d850
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x47d00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
mov dword [ebp - 0xc], 0
test ecx, ecx
mov dword [ebp - 8], edi
lea eax, [ebp - 0xc]
lea esi, [ebp - 8]
push eax
cmovne esi, ecx
push 0xf01ff
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40d9c9
push ebx
push 0x454798
push 0x94
mov dword [esi], 0x94
call fcn.004255d2
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x40d9c8
push 0x454798
push dword [esi]
call fcn.004255d2
mov edi, eax
add esp, 8
test edi, edi
je 0x40d9bf
mov esi, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
lea ecx, [ebx + 4]
push ecx
push str.SeRestorePrivilege
push 0
mov dword [ebx], 0xc
call esi
lea eax, [ebx + 0x10]
push eax
push str.SeTakeOwnershipPrivilege
push 0
call esi
lea eax, [ebx + 0x1c]
push eax
push str.SeDebugPrivilege
push 0
call esi
lea eax, [ebx + 0x28]
push eax
push str.SeSecurityPrivilege
push 0
call esi
lea eax, [ebx + 0x34]
push eax
push str.SeBackupPrivilege
push 0
call esi
lea eax, [ebx + 0x40]
push eax
push str.SeImpersonatePrivilege
push 0
call esi
lea eax, [ebx + 0x4c]
push eax
push str.SeSystemProfilePrivilege
push 0
call esi
lea eax, [ebx + 0x58]
push eax
push str.SeAssignPrimaryTokenPrivilege
push 0
call esi
lea eax, [ebx + 0x64]
push eax
push str.SeTrustedCredManAccessPrivilege
push 0
call esi
lea eax, [ebx + 0x70]
push eax
push str.SeTcbPrivilege
push 0
call esi
lea eax, [ebx + 0x7c]
push eax
push str.SeIncreaseQuotaPrivilege
push 0
call esi
lea eax, [ebx + 0x88]
push eax
push str.SeShutdownPrivilege
push 0
call esi
lea eax, [ebx + 0xc]
mov ecx, 0xc
nop word [eax + eax]
mov dword [eax], 2
lea eax, [eax + 0xc]
sub ecx, 1
jne 0x40d990
mov eax, dword [ebp - 0x10]
push eax
push edi
push dword [eax]
push ebx
push ecx
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x40d9bf
push edi
call fcn.0042524f
add esp, 4
xor edi, edi
push ebx
call fcn.0042524f
add esp, 4
pop ebx
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x40d9d7
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0042520b
mov esp, ebp
pop ebp
ret
Function at 0x40ede0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x47d00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
push ebx
push 0xfa0
push 0
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
jne 0x40ee1c
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042520b
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push str.VarFileInfoTranslation
push ebx
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x40ee09
push esi
push edi
sub esp, 8
lea ecx, [ebx + 0xfa4]
push dword [ebp - 0xc]
call fcn.0040b410
mov eax, dword [ebp - 0xc]
lea ecx, [ebx + 0xfb0]
sub esp, 8
add eax, 2
push eax
call fcn.0040b410
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x46d668
lea ecx, [ebx + 0xfb0]
call fcn.00409c40
push eax
lea ecx, [ebx + 0xfa4]
call fcn.00409c40
push eax
push str.StringFileInfo_
lea ecx, [ebx + 0xfbc]
call fcn.00409be0
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042520b
mov esp, ebp
pop ebp
ret 4

Function at 0x40f080
Capabilities:
Check if file exists

Disassembly:
push ebx
mov ebx, ecx
cmp byte [ebx + 0x48], 0
lea ecx, [ebx + 8]
jne 0x40f092
pop ebx
jmp fcn.00409c40
mov eax, dword [ebx]
push esi
push edi
push 1
mov esi, dword [eax]
push 0
push 0x104
push 0
push 0x800
call fcn.00409f00
push eax
push dword [ebx]
call dword [esi + 0xc]
lea ecx, [ebx + 8]
test eax, eax
jns 0x40f0c2
pop edi
pop esi
pop ebx
jmp fcn.00409c40
call fcn.00409c40
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40f0ef
push 0x800
lea ecx, [ebx + 8]
call fcn.00409c40
push eax
lea ecx, [ebx + 8]
call fcn.00409c40
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
pop edi
pop esi
lea ecx, [ebx + 8]
pop ebx
jmp fcn.00409c40

Function at 0x40f370
Capabilities:
Create new key via cryptacquirecontext
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebx
push esi
push 0xf0000000
push 0x18
push str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
mov esi, ecx
mov ebx, edx
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x40f3a7
push 0xf0000000
push 0x18
push str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider__Prototype_
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x40f3cc
push ebx
push 0
push 0
push 0x8003
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x40f3d3
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esi], 0
pop esi
xor al, al
pop ebx
ret 4
pop esi
mov al, 1
pop ebx
ret 4
Function at 0x40f3e0
Capabilities:
Hash data via wincrypt
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x47d00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push edi
push 0
push 0
push 3
push 0
push 1
push SysReAllocString
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push ecx
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x10], 0
or eax, 0xffffffff
mov dword [ebp - 8], 0
test edi, edi
lea edx, [ebp - 8]
push ecx
cmove edi, eax
lea ecx, [ebp - 0x10]
xor bl, bl
mov byte [ebp - 0x15], bl
call fcn.0040f370
test al, al
je 0x40f552
push esi
push 0x454798
push 0x80000
mov dword [ebp - 0xc], 0x80000
call fcn.004255d2
mov esi, eax
add esp, 8
test esi, esi
je 0x40f526
push 0
lea eax, [ebp - 0xc]
push eax
push 0x80000
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40f4b8
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x40f4b8
push 0
push eax
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x40f526
call fcn.0040b8b0
push 0
lea eax, [ebp - 0xc]
push eax
push 0x80000
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40f480
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 4
push eax
push dword [ebp - 0x1c]
push 4
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x40f526
mov eax, dword [ebp - 0x1c]
push esi
mov ebx, dword [eax]
call fcn.0042524f
push 0x454798
push ebx
call fcn.004255d2
mov esi, eax
add esp, 0xc
test esi, esi
je 0x40f523
mov ebx, dword [ebp - 0x1c]
push 0
push ebx
push esi
push 2
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x40f523
mov edx, dword [ebx]
mov ecx, esi
push 0
push 0xffff
push dword [ebp - 0x20]
call fcn.0040bd90
mov bl, al
jmp 0x40f526
mov bl, byte [ebp - 0x15]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x40f536
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [ebp - 8]
test eax, eax
je 0x40f544
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
test esi, esi
je 0x40f551
push esi
call fcn.0042524f
add esp, 4
pop esi
cmp edi, 0xffffffff
je 0x40f562
test edi, edi
je 0x40f562
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
xor ecx, ebp
pop ebx
call fcn.0042520b
mov esp, ebp
pop ebp
ret 8
Function at 0x40f580
Capabilities:
Contain obfuscated stackstrings
Encrypt data using aes via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x47d00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov esi, edx
mov edi, ecx
cmp dword [eax], 0xa070
je 0x40f5b5
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042520b
mov esp, ebp
pop ebp
ret 4
push 0x20
push str.9F15E8B42592E073F0A14AFF69039F7D
mov edx, 0x20
mov dword [ebp - 0x40], 0x208
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x3c], 0x6610
mov dword [ebp - 0x38], 0x20
call fcn.00425160
add esp, 8
lea eax, [ebp - 0x40]
push esi
push 0
push 0
push 0x2c
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x40f5a1
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x34333231
push eax
push 1
push dword [esi]
mov dword [ebp - 0x10], 0x38373635
mov dword [ebp - 0xc], 0x32313039
mov dword [ebp - 8], 0x36353433
call dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0042520b
mov esp, ebp
pop ebp
ret 4

Function at 0x40f640
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x47d00c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xf0000000
push 0x18
push str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x40f68a
push 0xf0000000
push 0x18
push str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider__Prototype_
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 8]
xor ecx, ebp
call fcn.0042520b
mov esp, ebp
pop ebp
ret
Function at 0x40f7d0
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x47d00c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0xa070
mov eax, ecx
push edi
mov edi, edx
mov dword [ebp - 0x10], eax
jne 0x40f8e0
test eax, eax
je 0x40f8e0
test edi, edi
je 0x40f8e0
cmp dword [edi], 0
je 0x40f8e0
push ebx
call fcn.0040f640
mov ebx, eax
test ebx, ebx
jne 0x40f82c
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042520b
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi]
lea edx, [ebp - 8]
push esi
mov dword [ebp - 0xc], eax
mov ecx, ebx
lea eax, [ebp + 8]
mov dword [ebp - 8], 0
push eax
xor esi, esi
call fcn.0040f580
test al, al
je 0x40f8b4
push esi
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push 1
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x40f8b4
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x40f8b4
push 0x454798
push eax
call fcn.004255d2
mov esi, eax
add esp, 8
test esi, esi
je 0x40f8b4
push dword [edi]
mov edx, dword [ebp - 0xc]
mov ecx, esi
push dword [ebp - 0x10]
call fcn.00425160
add esp, 8
push dword [ebp - 0xc]
push edi
push esi
push 0
push 1
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x40f8b4
push esi
call fcn.0042524f
add esp, 4
xor esi, esi
mov eax, dword [ebp - 8]
test eax, eax
je 0x40f8c2
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, esi
pop esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042520b
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop edi
call fcn.0042520b
mov esp, ebp
pop ebp
ret 4

Function at 0x40f900
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x47d00c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0xa070
push ebx
push edi
mov ebx, edx
mov edi, ecx
jne 0x40f9b9
test edi, edi
je 0x40f9b9
cmp dword [ebx], 0
je 0x40f9b9
push esi
call fcn.0040f640
mov esi, eax
test esi, esi
jne 0x40f955
pop esi
pop edi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042520b
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp + 8]
mov dword [ebp - 8], 0
push eax
lea edx, [ebp - 8]
mov byte [ebp - 9], 0
mov ecx, esi
call fcn.0040f580
test al, al
je 0x40f98a
push ebx
push edi
push 0
push 1
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
setne bl
jmp 0x40f98d
mov bl, byte [ebp - 9]
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x40f99b
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop esi
pop edi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042520b
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop ebx
call fcn.0042520b
mov esp, ebp
pop ebp
ret 4
Function at 0x40fa90
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x452c13
mov eax, dword fs:[0]
push eax
sub esp, 0x26c
mov eax, dword [0x47d00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov ebx, ecx
sub esp, 0x1c
mov dword [ebp - 0x14], 0
xorps xmm0, xmm0
lea ecx, [ebp - 0x1c]
movq qword [ebp - 0x1c], xmm0
push 0
push 0
push 0
push 0x46db24
push ebx
call fcn.00409a30
push 0x258
lea eax, [ebp - 0x278]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.0043eb00
add esp, 0xc
lea ecx, [ebp - 0x1c]
call fcn.00409c40
push 0x250
mov esi, eax
lea eax, [ebp - 0x278]
push 0
push eax
call fcn.0043eb00
add esp, 0xc
lea eax, [ebp - 0x278]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edx, eax
mov dword [ebp - 0x28], edx
cmp edx, 0xffffffff
je 0x40fb52
lea ecx, [ebp - 0x278]
mov dword [ebp - 0x24], 1
call fcn.00401770
mov edx, dword [ebp - 0x28]
mov byte [ebp - 4], 1
cmp edx, 0xffffffff
je 0x40fc10
mov esi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
test byte [ebp - 0x278], 0x10
je 0x40fbaf
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x24c]
push eax
push 0x46d668
push ebx
lea ecx, [ebp - 0x1c]
call fcn.00409be0
lea ecx, [ebp - 0x1c]
call fcn.00409c40
mov edx, edi
mov ecx, eax
call fcn.0040fa90
call fcn.0040b8b0
mov edx, dword [ebp - 0x28]
jmp 0x40fbc5
mov ecx, dword [ebp - 0x25c]
xor eax, eax
add eax, dword [ebp - 0x258]
adc ecx, 0
add dword [edi], eax
adc dword [edi + 4], ecx
cmp edx, 0xffffffff
je 0x40fc10
lea eax, [ebp - 0x278]
push eax
push edx
call esi
test eax, eax
je 0x40fc00
lea ecx, [ebp - 0x278]
call fcn.00401770
test al, al
je 0x40fbef
mov edx, dword [ebp - 0x28]
jmp 0x40fb65
mov eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x40fc10
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x40fc10
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x28], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00409af0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042520b
mov esp, ebp
pop ebp
ret
Function at 0x410140
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, ecx
push esi
mov ebx, edx
call edi
test eax, eax
jne 0x4101c3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x4101c3
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 5
je 0x41017f
and eax, 0xfffffffa
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call edi
test eax, eax
jne 0x4101c3
test bl, 2
je 0x41019a
mov ecx, dword [ebp + 8]
push dword [ecx + 4]
push 4
push ecx
push esi
call fcn.0040c390
push esi
call edi
test eax, eax
jne 0x4101c3
test bl, 1
je 0x4101ba
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x4101ba
mov eax, 2
pop edi
pop esi
pop ebx
pop ebp
ret 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 4

Function at 0x4101d0
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, ecx
push esi
mov ebx, edx
call edi
test eax, eax
jne 0x410253
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x410253
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 5
je 0x41020f
and eax, 0xfffffffa
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call edi
test eax, eax
jne 0x410253
test bl, 2
je 0x41022a
mov ecx, dword [ebp + 8]
push dword [ecx + 4]
push 5
push ecx
push esi
call fcn.0040c390
push esi
call edi
test eax, eax
jne 0x410253
test bl, 1
je 0x41024a
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x41024a
mov eax, 2
pop edi
pop esi
pop ebx
pop ebp
ret 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 4

Function at 0x410350
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x47d00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx]
cmp eax, 0xffffffff
je 0x41039c
test eax, eax
je 0x41039c
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push ecx
push eax
mov dword [ebp - 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x41039c
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042520b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
xor edx, edx
call fcn.0042520b
mov esp, ebp
pop ebp
ret
Function at 0x4103b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x47d00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx]
cmp eax, 0xffffffff
je 0x4103fe
test eax, eax
je 0x4103fe
push 0
lea ecx, [ebp - 0xc]
mov dword [ebp - 8], 0xffff
push ecx
push 2
lea ecx, [ebp - 8]
mov dword [ebp - 0xc], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ax, word [ebp - 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042520b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0xffff
xor ecx, ebp
call fcn.0042520b
mov esp, ebp
pop ebp
ret

Function at 0x410420
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x47d00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx]
cmp eax, 0xffffffff
je 0x41046a
test eax, eax
je 0x41046a
push 0
lea ecx, [ebp - 0xc]
mov byte [ebp - 5], 0xff
push ecx
push 1
lea ecx, [ebp - 5]
mov dword [ebp - 0xc], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov al, byte [ebp - 5]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042520b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
or al, 0xff
xor ecx, ebp
call fcn.0042520b
mov esp, ebp
pop ebp
ret
Function at 0x410770
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x47d00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx]
mov edx, dword [ebp + 8]
cmp eax, 0xffffffff
je 0x4107bd
test eax, eax
je 0x4107bd
push 0
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
push ecx
push dword [ebp + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
neg eax
sbb eax, eax
and eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042520b
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.0042520b
mov esp, ebp
pop ebp
ret 8

Function at 0x4107d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x452cf8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x47d00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebx]
mov edi, dword [ebp + 8]
cmp eax, 0xffffffff
je 0x4108fb
test eax, eax
je 0x4108fb
mov ecx, edi
mov dword [ebp - 0x14], 0
call fcn.00409b00
mov ecx, ebx
call fcn.00410330
push 0x454798
mov dword [ebp - 0x1c], eax
lea ecx, [eax + 2]
push ecx
call fcn.004255d2
mov esi, eax
add esp, 8
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x4108e8
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov eax, ecx
shr eax, 1
push edx
mov dword [ebp - 0x1c], eax
mov word [esi + eax*2], dx
lea eax, [ebp - 0x14]
push eax
push ecx
push esi
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4108e8
mov eax, dword [ebp - 0x14]
mov ecx, edi
mov byte [esi + eax], 0
mov eax, dword [ebp - 0x14]
mov byte [esi + eax + 1], 0
mov eax, dword [ebx + 4]
test al, 0x20
je 0x4108a1
mov eax, esi
xor esi, esi
push esi
push eax
call fcn.00409b90
mov ecx, edi
call fcn.00409b70
mov edi, eax
jmp 0x4108ea
test al, 0x40
je 0x4108b9
push dword [ebp - 0x1c]
push esi
call fcn.0040b270
mov ecx, edi
call fcn.00409b70
mov edi, eax
jmp 0x4108ea
test eax, 0x180
je 0x4108d4
sub esp, 8
push esi
call fcn.0040b2e0
mov ecx, edi
call fcn.00409b70
mov edi, eax
jmp 0x4108ea
sub esp, 0xc
push esi
call fcn.0040b220
mov ecx, edi
call fcn.00409b70
mov edi, eax
jmp 0x4108ea
xor edi, edi
test esi, esi
je 0x4108f7
push esi
call fcn.0042524f
add esp, 4
mov eax, edi
jmp 0x4108fd
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042520b
mov esp, ebp
pop ebp
ret 8