joyce8/EMBER2024-capa huggingface dataset:
Function at 0x13f1944
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
cmp dword [ebp + 0x10], 0
je 0x13f1b11
and dword [ebp - 8], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
lea eax, [ebx + 0xc]
cmp dword [eax], 0
je 0x13f1b0e
mov ecx, ebx
mov edi, dword [ecx + 0x10]
mov edx, dword [ebp + 8]
add edi, edx
mov esi, dword [eax]
mov ecx, dword [ecx]
add esi, edx
add ecx, edx
mov dword [ebp - 0x14], edi
push esi
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp + 0x10], eax
test eax, eax
jne 0x13f199d
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp + 0x10], eax
push 0x104
lea eax, [ebp - 0x118]
push 0
push eax
call fcn.013ea4a6
add esp, 0xc
cmp dword [ebp + 0x10], 0
je 0x13f1aaf
and dword [ebp - 4], 0
cmp dword [edi], 0
je 0x13f1a95
xor ebx, ebx
mov esi, edi
mov edi, dword [esi]
mov eax, dword [ebp + 8]
push 4
add eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x13f19e8
mov eax, dword [ebp - 0xc]
mov edi, dword [ebx + eax]
test edi, edi
jns 0x13f19f1
movzx edi, di
jmp 0x13f19f9
mov eax, dword [ebp + 8]
add eax, 2
add edi, eax
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi], eax
test eax, eax
jne 0x13f1a78
cmp dword [0x13f4eac], 1
jne 0x13f1a78
push 0x104
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.013ea4a6
lea eax, [ebp - 0x118]
push eax
call fcn.013f1b4f
lea eax, [ebp - 0x118]
push 0x13ea24c
push eax
call fcn.013f4330
lea eax, [ebp - 0x118]
push edi
push eax
call fcn.013f4330
add esp, 0x20
lea eax, [ebp - 0x10]
push 0
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.013f4420
pop ecx
push eax
lea eax, [ebp - 0x118]
push eax
push dword [0x13f4e50]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
mov esi, dword [ebp - 0x14]
inc eax
mov ebx, eax
mov dword [ebp - 4], eax
shl ebx, 2
add esi, ebx
cmp dword [esi], 0
jne 0x13f19ce
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
inc eax
imul ecx, eax, 0x14
mov dword [ebp - 8], eax
add ecx, ebx
lea eax, [ecx + 0xc]
cmp dword [eax], 0
jne 0x13f196f
jmp 0x13f1b0e
lea eax, [ebp - 0x118]
push eax
call fcn.013f1b4f
lea eax, [ebp - 0x118]
mov dword [esp], 0x13ea230
push eax
call fcn.013f4330
lea eax, [ebp - 0x118]
push esi
push eax
call fcn.013f4330
add esp, 0x10
cmp dword [0x13f4eac], 1
jne 0x13f1b0e
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.013f4420
pop ecx
push eax
lea eax, [ebp - 0x118]
push eax
push dword [0x13f4e50]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebx
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x13f1ba7
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 0xc]
add eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
and dword [ebp - 0x24], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 8]
movzx eax, word [eax + 4]
cmp eax, 0x14c
jne 0x13f1beb
mov eax, dword [ebp - 8]
add eax, 0xf8
mov dword [ebp - 0xc], eax
jmp 0x13f1c04
mov eax, dword [ebp - 8]
movzx eax, word [eax + 4]
cmp eax, 0x8664
jne 0x13f1c04
mov eax, dword [ebp - 8]
add eax, 0x108
mov dword [ebp - 0xc], eax
and dword [ebp - 0x10], 0
jmp 0x13f1c11
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x10], eax
je 0x13f1c4a
imul eax, dword [ebp - 0x10], 0x28
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax + 0xc]
mov dword [ebp - 0x28], edx
lea eax, [ebp - 0x24]
push eax
push 0x40
imul eax, dword [ebp - 0x10], 0x28
mov ecx, dword [ebp - 0xc]
push dword [ecx + eax + 8]
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x13f1c0a
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 0x2c]
jae 0x13f1cea
mov eax, dword [ebp + 0xc]
add eax, 8
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
sub eax, 8
shr eax, 1
mov dword [ebp - 0x30], eax
and dword [ebp - 4], 0
jmp 0x13f1c7a
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x30]
je 0x13f1cd9
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
movzx eax, word [ecx + eax*2]
test eax, eax
jne 0x13f1c92
jmp 0x13f1c73
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
movzx eax, word [ecx + eax*2]
and eax, 0xfff
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx]
add ecx, eax
add ecx, dword [ebp + 8]
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
movzx eax, word [ecx + eax*2]
sar eax, 0xc
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
je 0x13f1cca
jmp 0x13f1cd7
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
add eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x20]
mov dword [ecx], eax
jmp 0x13f1c73
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax + 4]
mov dword [ebp + 0xc], ecx
jmp 0x13f1c4a
and dword [ebp - 0x14], 0
jmp 0x13f1cf7
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x14], eax
je 0x13f1d2f
imul eax, dword [ebp - 0x14], 0x28
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax + 0xc]
mov dword [ebp - 0x38], edx
push 0
push dword [ebp - 0x24]
imul eax, dword [ebp - 0x14], 0x28
mov ecx, dword [ebp - 0xc]
push dword [ecx + eax + 8]
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x13f1cf0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x13f1f00
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, dword [eax]
xor edi, edi
call fcn.013f1eb7
push esi
call fcn.013f20aa
push dword [ebp + 0xc]
mov ebx, eax
mov dword [ebp - 0x1c], ebx
call fcn.013f20aa
push 0x50
mov dword [ebp - 0x10], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x70]
movlpd qword [ebp - 0x78], xmm0
push edi
push eax
call fcn.013ea4a6
lea eax, [ebp - 0x78]
push eax
push 5
push ebx
call fcn.013f1db5
mov esi, eax
add esp, 0x20
mov dword [ebp - 0x20], esi
cmp esi, 5
jb 0x13f2097
push dword [ebp - 0x6c]
push dword [ebp - 0x70]
push dword [ebp - 0x74]
push dword [ebp - 0x78]
push ebx
call fcn.013f20e2
mov edi, eax
add esp, 0x14
test edi, edi
je 0x13f2097
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and dword [ebp - 0xc], 0
lea ecx, [ebp - 0xc]
and dword [ebp - 8], 0
push ecx
push 0x40
push esi
push ebx
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x13f207c
lea eax, [ebp - 8]
push eax
push 0x40
push 0x6c
push edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x13f205f
xor edx, edx
lea ecx, [edi + 0x2c]
test esi, esi
je 0x13f1fdd
sub ebx, ecx
mov al, byte [ebx + ecx]
mov byte [ecx], al
mov byte [edi + edx + 0x4c], al
inc edx
inc ecx
cmp edx, esi
jb 0x13f1fc8
mov ebx, dword [ebp - 0x1c]
lea ecx, [edi + 0x2c]
lea eax, [esi + ebx]
push eax
lea eax, [ecx + esi]
push eax
call fcn.013f1e6e
mov edx, dword [ebp - 0x10]
mov eax, edx
pop ecx
pop ecx
mov ecx, ebx
sub eax, ebx
sub ecx, edx
cmp edx, ebx
push edx
cmovb eax, ecx
cmp eax, 0x7fff0000
jbe 0x13f202b
lea esi, [edi + 0xc]
push esi
call fcn.013f1e6e
pop ecx
pop ecx
sub eax, edi
sub eax, 0xc
push eax
push esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
push esi
push ebx
call fcn.013f1e6e
mov esi, dword [ebp - 0x20]
jmp 0x13f2031
push ebx
call fcn.013f1e6e
mov eax, dword [ebp - 0x10]
pop ecx
pop ecx
mov dword [edi + 8], eax
lea eax, [edi + 0x2c]
push esi
push eax
push dword [ebp - 4]
mov dword [edi + 4], esi
mov dword [edi], ebx
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 0x6c
push edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push esi
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push esi
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
cmp dword [edi], 0
je 0x13f208b
mov ecx, dword [ebp + 8]
lea eax, [edi + 0x2c]
mov dword [ecx], eax
jmp 0x13f2097
push 1
push edi
call fcn.013f21d1
pop ecx
pop ecx
xor edi, edi
call fcn.013f1ef4
xor eax, eax
test edi, edi
pop edi
pop esi
setne al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x13f20e2
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
xor ebx, ebx
cmp dword [0x13f4d2c], 0x40
jae 0x13f21ca
mov ecx, dword [ebp + 8]
mov edx, 0xfff80000
push esi
mov esi, dword [ebp + 0xc]
add esi, ecx
add ecx, dword [ebp + 0x14]
push edi
cmp ecx, 0x80000000
lea edi, [ebp - 0x40]
push 8
lea eax, [ecx + 0x7ff80000]
cmovb edx, eax
and dword [ebp - 0x44], ebx
pop ecx
xor eax, eax
mov dword [ebp - 4], edx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor eax, eax
lea edi, [esi - 0x7fff0000]
inc eax
cmp esi, 0x80000000
mov esi, dword [ebp - 4]
cmovb edi, eax
cmp edi, esi
jae 0x13f21c8
push 0x1c
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x13f21a3
cmp dword [ebp - 0x10], 0x10000
jne 0x13f2197
mov eax, dword [ebp - 0x14]
cmp eax, 0x6c
jb 0x13f219a
mov ecx, dword [ebp - 0x28]
cmp eax, ecx
jb 0x13f219a
lea eax, [ecx - 1]
xor edx, edx
add eax, edi
div ecx
push 0x20
imul eax, ecx
push 0x3000
push 0x6c
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, eax
test ebx, ebx
jne 0x13f21a7
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
add edi, eax
cmp edi, esi
jb 0x13f214c
test ebx, ebx
je 0x13f21c8
xor eax, eax
cmp dword [eax*4 + 0x13f4d50], 0
je 0x13f21bb
inc eax
cmp eax, 0x40
jb 0x13f21a9
jmp 0x13f21c8
inc dword [0x13f4d2c]
mov dword [eax*4 + 0x13f4d50], ebx
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x13f42ab
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x14]
mov ebx, dword [edx]
mov eax, dword [edx + 4]
test esi, esi
jle 0x13f430d
mov ecx, dword [ebp + 0x10]
sub dword [ebp + 0xc], ecx
mov dword [ebp - 4], esi
mov esi, dword [ebp + 0xc]
push edi
inc bl
movzx ebx, bl
mov cl, byte [edx + ebx + 8]
add al, cl
movzx eax, al
mov dword [ebp + 8], eax
mov edi, dword [ebp + 8]
mov al, byte [edx + eax + 8]
mov byte [edx + ebx + 8], al
add al, cl
movzx eax, al
mov byte [edx + edi + 8], cl
mov cl, byte [eax + edx + 8]
mov eax, dword [ebp + 0x10]
xor cl, byte [esi + eax]
mov byte [eax], cl
inc eax
dec dword [ebp - 4]
mov dword [ebp + 0x10], eax
mov eax, edi
jne 0x13f42cd
mov esi, dword [ebp + 0x14]
pop edi
mov dword [edx + 4], eax
mov eax, esi
pop esi
mov dword [edx], ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x475299
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4752c7
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4752e5
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00475203
jmp 0x4752e5
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4752e5
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00475203
test edi, edi
mov eax, edi
jne 0x4752cf
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x4c0a5c]
test ecx, ecx
je 0x475398
jmp 0x475298
ret 8

Function at 0x48d7f0
Capabilities:
Encode data using xor

Disassembly:
shr byte [eax + 0x701d8af1], cl
invalid
push ebp
jo 0x48d700
int3
sal dword [esp + eax*4 - 0x1669716b], 0xde
lodsb al, byte [esi]
jo 0x48d71e
invalid
mov edi, 0x2183a1d
loopne 0x48d78a
daa
int1
mov bl, 0x97
and cl, byte [ebx - 0x1f]
int1
loope 0x48d7d2
sbb eax, 0x20274b63
fdiv qword [esi]
lea eax, [ebp + 0x6639973c]
dec bp
dec ebp
dec ebp
jo 0x48d7df
push es
inc ebp
lds ecx, [ebp + 3]
in eax, dx
mov byte [0xe2be4d70], al
dec ecx
dec edi
fst dword [ebx + 1]
add byte [eax + 0x39], al
sar dword [ecx + 0x312a04ff], 0xcc
fldcw word [ecx + ebx*2 + 0xd922fa]
or esp, dword [ecx - 0x43]
loope 0x48d7fc
mov esi, 0xd94f49e2
push ebx
add dword [eax], eax
inc eax
cmp ecx, eax
mov ecx, 0x312a04ff
int3
sub dword [ecx - 0x1b418482], 0x10
or eax, 0x9720c6f6
sub dl, byte [ebp + 0x16ee1e26]
pushal
sub al, dh
mov word gs:[ebx - 0x2c], cx
out 0x53, al
mov dh, 0x1f
xlatb
sbb bh, cl
test eax, 0x96fe3766
fidivr word [esi]
push ss
cmp ecx, dword [esi]
jbe 0x48d8b6
mov ecx, 0x8a3498c8
pop ss
pushal
xchg edi, eax
in eax, 0x11
scasb al, byte es:[edi]
adc al, byte [eax + 0x7c]
xchg dword [esi - 0x273c9208], ebp
sub esp, dword [0x822377b4]
mov esi, 0xf0dc8862
adc cl, byte [edi + 0x65]
push 0xc1965688
cmp byte [esi - 0xf23779e], 0x12
dec edi
push 0xc1965688
pushfd
xor eax, 0x5ea44266
salc
jecxz 0x48d861
lahf
leave
xchg ebx, eax
push es
mov es, word [eax - 0x3c]
cmp eax, 0xedf16222
call 0xa572a311
xor byte [esi - 0x633cc0dc], al
cmp eax, 0x1ece82a7
cli
pop ss
pop esi
dec esi
leave
pop esp
xchg esp, eax
adc eax, 0xcaf4f6d0
fstpnce st(4), st(0)
jg 0x48d8fb
mov dl, cl
sub dword [ebp + 0x3f248630], esp
ret
push cs
push cs
jge 0x48d885
retf
jnp 0x48d8fe
and al, bl
pop es
push edx
pop eax
mov esp, 0x2d336c55
loope 0x48d887
sub ah, ch
cmp ebx, esp
cli
out 0xf, al
test byte [ebp + edx*8 + 0x27], 0xf5
into
sub ch, byte [ecx - 0x1d]
dec esp
and edi, dword [ebp + 0x755c6787]
invalid
push cs
mov cl, 0xc8
push eax
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x40de38
nop
mov ecx, 0x30ef742c
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x53482107
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x4052f0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
test byte [ecx + 0x55], 0x10
push esi
je 0x405305
mov eax, dword [esp + 8]
pop esi
mov dword [eax], 0
ret 4
mov esi, dword [esp + 8]
push edi
xor eax, eax
mov dword [esi], 0x10
mov edx, dword [ecx + 0x14]
mov edi, dword [ecx + 0x18]
cmp edx, edi
pop edi
setne al
mov edx, eax
test edx, edx
je 0x405330
test byte [ecx + 0x54], 0x10
jne 0x405330
mov dword [esi], 0x12
test byte [ecx + 0x54], 8
jne 0x40536e
mov eax, dword [esi]
test al, 2
je 0x405340
or al, 1
mov dword [esi], eax
test edx, edx
je 0x40534a
mov eax, dword [esi]
or al, 8
mov dword [esi], eax
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x40536e
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
test eax, eax
je 0x405368
mov eax, dword [esi]
or al, 4
mov dword [esi], eax
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
ret 4

Function at 0x408c90
Capabilities:
Copy file
Delete file
Get file size
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x114
push esi
push edi
lea eax, [esp + 0x18]
push 0x104
push eax
mov edi, ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov esi, dword [esp + 0x120]
push 0
lea ecx, [esp + 0x1c]
push esi
push ecx
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x408dd0
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x408dd0
push ebx
push ebp
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, eax
push 0
push 0
lea edx, [ebx - 8]
push edx
push esi
call ebp
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x20]
push 8
push ecx
push esi
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0x10], 8
jne 0x408db1
cmp dword [esp + 0x18], 0xfa123456
jne 0x408d4e
mov ecx, dword [esp + 0x1c]
mov edx, 0xfffffff8
sub edx, ecx
add ebx, edx
push 0
push 0
push ebx
push esi
call ebp
mov ecx, dword [edi + 0x98]
mov edx, dword [edi]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [esp + 0x10]
push 0
push eax
push ecx
push edx
push esi
call ebx
mov eax, dword [edi + 0x98]
mov ecx, dword [esp + 0x10]
cmp ecx, eax
jne 0x408db1
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x20]
push 8
push ecx
push esi
mov dword [esp + 0x2c], 0xfa123456
call ebx
cmp dword [esp + 0x10], 8
jne 0x408db1
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [esp + 0x14], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x14]
pop ebp
test eax, eax
pop ebx
jne 0x408dd0
mov edx, dword [esp + 0x120]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
add esp, 0x114
ret 4
Function at 0x40191c
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x418e53
call fcn.00418820
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push 0xf
mov dword [ebp - 0x10], esi
mov dword [esi], 0x41b43c
mov dword [esi + 4], 0x41b418
lea ecx, [esi + 0x10]
mov dword [esi + 8], 0x41b408
mov dword [esi + 0xc], ebx
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.00402285
lea ecx, [esi + 0x20]
push 0xf
mov dword [ebp - 4], ebx
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.00402285
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
call fcn.004019ec
lea eax, [esi + 0xa0]
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], 4
mov dword [eax], 0x41b344
lea ecx, [esi + 0xc8]
mov byte [esi + 0xb4], 1
mov dword [esi + 0xb8], ebx
mov dword [esi + 0xc0], ebx
mov byte [esi + 0xc4], bl
push 0xf
mov byte [ebp - 4], 3
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.00402285
mov ecx, dword [ebp - 0xc]
mov dword [esi], 0x41b3d0
mov dword [esi + 4], 0x41b3ac
mov dword [esi + 8], 0x41b39c
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x40426b
Capabilities:
Set file attributes

Disassembly:
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
setne al
ret

Function at 0x404294
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x4219bc], 0
push esi
mov esi, edx
jne 0x4042cc
mov edx, ecx
push ebx
lea ecx, [ebp - 0xc]
call fcn.004042dc
mov eax, dword [eax]
mov edx, esi
mov ecx, eax
call fcn.0040426b
mov bl, al
push dword [ebp - 0xc]
call fcn.004031ec
pop ecx
mov al, bl
pop ebx
jmp 0x4042d9
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
pop esi
leave
ret

Function at 0x40432b
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x4219bc], 0
jne 0x40435c
mov edx, ecx
push ebx
lea ecx, [ebp - 0xc]
call fcn.004042dc
mov ecx, dword [eax]
call fcn.00404279
mov bl, al
push dword [ebp - 0xc]
call fcn.004031ec
pop ecx
mov al, bl
pop ebx
leave
ret
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
leave
ret

Function at 0x4043eb
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x4219bc], 0
jne 0x40441c
mov edx, ecx
push ebx
lea ecx, [ebp - 0xc]
call fcn.004042dc
mov ecx, dword [eax]
call fcn.004043dc
mov bl, al
push dword [ebp - 0xc]
call fcn.004031ec
pop ecx
mov al, bl
pop ebx
leave
ret
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne al
leave
ret
Function at 0x404649
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x4219bc], 0
push esi
mov esi, ecx
jne 0x40467d
push ebx
mov edx, esi
lea ecx, [ebp - 0xc]
call fcn.004042dc
mov ecx, dword [eax]
call fcn.0040462b
mov bl, al
push dword [ebp - 0xc]
call fcn.004031ec
pop ecx
mov al, bl
pop ebx
jmp 0x404696
xor edx, edx
mov ecx, esi
call fcn.00404294
test al, al
je 0x404696
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
pop esi
leave
ret

Function at 0x404922
Capabilities:
Get common file path

Disassembly:
mov eax, 0x419308
call fcn.00418820
sub esp, 0x18
push ebx
xor ebx, ebx
cmp byte [0x4219bc], bl
push esi
mov esi, ecx
je 0x40498a
push edi
mov edi, 0x105
cmp dword [esi + 8], edi
jg 0x404952
push 0x106
call fcn.00402285
push dword [esi]
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, dword [esi]
xor edx, edx
cmp word [ecx], bx
je 0x40496e
mov edi, ecx
inc edx
inc edi
inc edi
cmp word [edi], bx
jne 0x404966
mov word [ecx + edx*2], bx
cmp eax, ebx
mov dword [esi + 4], edx
pop edi
jbe 0x404986
cmp eax, 0x104
ja 0x404986
push 1
pop eax
jmp 0x4049d9
xor eax, eax
jmp 0x4049d9
push 0xf
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call fcn.00402dce
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], ebx
call fcn.004048e2
test al, al
je 0x4049ce
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x24]
call fcn.004041e7
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.00401d29
push dword [ebp - 0x24]
call fcn.004031ec
pop ecx
mov bl, 1
push dword [ebp - 0x18]
call fcn.004031ec
pop ecx
mov al, bl
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x404cb7
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x419360
call fcn.00418820
sub esp, 0x18
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
push 1
mov eax, dword [edi]
push 0
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0x18]
push 0
mov dword [esi + 0x18], eax
push dword [edi + 0x1c]
call fcn.004189a0
mov ecx, dword [edi + 0x20]
xor ebx, ebx
add eax, ecx
lea ecx, [ebp - 0x18]
mov dword [esi + 0x20], eax
lea eax, [edi + 0x2c]
adc edx, ebx
push eax
mov dword [esi + 0x24], edx
call fcn.00402d87
and dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
neg eax
sbb eax, eax
lea edx, [ebp - 0x18]
inc eax
lea ecx, [ebp - 0x24]
push eax
call fcn.00404d6a
push eax
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
call fcn.00401d29
push dword [ebp - 0x24]
call fcn.004031ec
push dword [ebp - 0x18]
call fcn.004031ec
mov eax, dword [edi + 0x24]
pop ecx
pop ecx
mov dword [esi + 0x28], eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret