joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a2d7c
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1f8], 0
je 0x4a2d98
cmp dword [esi + 4], 0
je 0x4a2dc5
test byte [ebx + 0x55], 1
jne 0x4a2db7
mov eax, ebx
call fcn.0044ceb0
test eax, eax
jne 0x4a2db7
mov edx, esi
mov eax, ebx
call fcn.00451eb4
jmp 0x4a2ed5
mov edx, esi
mov eax, ebx
call fcn.0044de34
jmp 0x4a2ed5
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4a2ece
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00450180
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.0044aa38
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.004a2d7c
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00450180
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a2ed5
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a513c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404ba4
xor eax, eax
push ebp
push 0x4a52c8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.004046f4
cmp dword [ebp - 4], 0
je 0x4a529d
lea eax, [ebp - 0xc]
call fcn.004046f4
mov ebx, 1
jmp 0x4a51f2
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov dl, byte [edx + ebx - 1]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x1c]
call fcn.00403078
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 4]
mov dl, byte [edx + ebx]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov cl, 2
call fcn.00403048
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x14]
call fcn.00404958
mov eax, dword [ebp - 0x14]
call fcn.004a50c4
mov edx, eax
lea eax, [ebp - 0x10]
call fcn.004048dc
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.004049bc
add ebx, 2
mov eax, dword [ebp - 4]
call fcn.004049b4
cmp ebx, eax
jl 0x4a5190
mov eax, dword [ebp - 0xc]
call fcn.004049b4
mov esi, eax
test esi, esi
jle 0x4a523a
mov ebx, 1
mov eax, dword [ebp - 0xc]
movzx edi, byte [eax + ebx - 1]
sub edi, 0x11
sub edi, ebx
test edi, edi
jge 0x4a5228
add edi, 0x100
lea eax, [ebp - 0xc]
call fcn.00404c0c
mov edx, edi
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x4a5211
mov eax, dword [ebp - 0xc]
call fcn.004049b4
mov esi, eax
test esi, esi
jle 0x4a5267
mov ebx, 1
lea eax, [ebp - 0xc]
call fcn.00404c0c
mov edx, dword [ebp - 0xc]
mov dl, byte [edx + ebx - 1]
xor dl, 0x1c
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x4a524d
mov eax, dword [ebp - 0xc]
call fcn.004049b4
mov esi, eax
test esi, esi
jle 0x4a529d
mov ebx, 1
lea eax, [ebp - 0x24]
mov edx, dword [ebp - 0xc]
mov dl, byte [edx + ebx - 1]
call fcn.004048dc
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov eax, dword [ebp - 8]
call fcn.00404a00
inc ebx
dec esi
jne 0x4a527a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a52cf
lea eax, [ebp - 0x24]
call fcn.004046f4
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404718
lea eax, [ebp - 4]
call fcn.004046f4
ret
Function at 0x4a52d8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404ba4
xor eax, eax
push ebp
push 0x4a5419
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.004046f4
cmp dword [ebp - 4], 0
je 0x4a53f6
lea eax, [ebp - 0xc]
call fcn.004046f4
mov eax, dword [ebp - 4]
call fcn.004049b4
mov esi, eax
test esi, esi
jle 0x4a534f
mov ebx, 1
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
mov dl, byte [edx + ebx - 1]
call fcn.004048dc
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
call fcn.00404a00
inc ebx
dec esi
jne 0x4a532e
mov eax, dword [ebp - 0xc]
call fcn.004049b4
mov esi, eax
test esi, esi
jle 0x4a537c
mov ebx, 1
lea eax, [ebp - 0xc]
call fcn.00404c0c
mov edx, dword [ebp - 0xc]
mov dl, byte [edx + ebx - 1]
xor dl, 0x1c
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x4a5362
mov eax, dword [ebp - 0xc]
call fcn.004049b4
mov esi, eax
test esi, esi
jle 0x4a53bc
mov ebx, 1
mov eax, dword [ebp - 0xc]
movzx edi, byte [eax + ebx - 1]
add edi, 0x11
add edi, ebx
cmp edi, 0xff
jle 0x4a53aa
sub edi, 0x100
lea eax, [ebp - 0xc]
call fcn.00404c0c
mov edx, edi
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x4a538f
mov eax, dword [ebp - 0xc]
call fcn.004049b4
mov esi, eax
test esi, esi
jle 0x4a53f6
mov ebx, 1
lea ecx, [ebp - 0x14]
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax + ebx - 1]
mov edx, 2
call fcn.00408eec
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.004049bc
mov eax, dword [ebp - 8]
inc ebx
dec esi
jne 0x4a53cf
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a5420
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404718
lea eax, [ebp - 4]
call fcn.004046f4
ret
Function at 0x4a6d20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x24]
mov edi, dword [ebx + 0x34]
sub edi, dword [ebx + 0x6c]
sub edi, dword [ebx + 0x64]
jmp 0x4a6d4d
mov eax, dword [ebx + 0x24]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x64]
ja 0x4a6dcc
push esi
mov eax, dword [ebx + 0x30]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.004a5d98
add esp, 0xc
sub dword [ebx + 0x68], esi
sub dword [ebx + 0x64], esi
sub dword [ebx + 0x54], ebp
mov eax, dword [ebx + 0x44]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x3c]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4a6d9a
mov cx, word [esp]
sub cx, si
jmp 0x4a6d9c
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4a6d83
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x38]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4a6dc2
mov cx, word [esp]
sub cx, si
jmp 0x4a6dc4
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4a6dab
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x4a6e29
mov edx, dword [ebx + 0x30]
mov ecx, edi
add edx, dword [ebx + 0x64]
mov eax, ebp
add edx, dword [ebx + 0x6c]
call fcn.004a6a1c
add dword [ebx + 0x6c], eax
cmp dword [ebx + 0x6c], 3
jb 0x4a6e14
mov eax, dword [ebx + 0x30]
mov edx, dword [ebx + 0x64]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x40], eax
mov ecx, dword [ebx + 0x50]
shl eax, cl
mov edx, dword [ebx + 0x30]
mov ecx, dword [ebx + 0x64]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp dword [ebx + 0x6c], 0x106
jae 0x4a6e29
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x4a6d2a
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4ac2c8
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x4e5f24
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x4ac2ea
shr eax, 1
xor eax, 0xedb88320
jmp 0x4ac2ec
shr eax, 1
dec edx
jne 0x4ac2d8
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4ac2d1
mov byte [0x4e6324], 1
pop esi
pop ebx
ret

Function at 0x4ac308
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x4e6324], 0
jne 0x4ac31f
call fcn.004ac2c8
mov eax, edi
dec eax
test eax, eax
jl 0x4ac348
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4e5f24]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x4ac329
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4aebec
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x4aec1d
dec al
je 0x4aec59
dec al
je 0x4aec9d
dec al
je 0x4aed08
jmp 0x4aed92
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x4aed92
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4aec2d
jmp 0x4aed92
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4aed92
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4aec69
jmp 0x4aed92
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4aed92
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x4aeccb
xor ebp, ebp
jmp 0x4aecdc
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4aece5
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4aecad
jmp 0x4aed92
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4aed92
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x4aed60
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.004ac350
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4aed1c
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4bf978
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
test dl, dl
je 0x4bf98c
add esp, 0xfffffff0
call fcn.00403b38
mov ebx, edx
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.004037d0
mov dl, 1
mov eax, dword [0x417f34]
call fcn.0041a6c8
mov dword [esi + 8], eax
mov dl, 1
mov eax, dword [0x417f34]
call fcn.0041a6c8
mov dword [esi + 0xc], eax
push esi
push 0x4bfbfc
call fcn.00421dd4
mov dword [esi + 0x18], eax
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [esi + 0x14], eax
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 0x10]
shl eax, 2
sub eax, 2
mov dword [esi + 4], eax
mov eax, esi
test bl, bl
je 0x4bfa05
call fcn.00403b90
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4c05ac
Capabilities:
Access peb ldr_data

Disassembly:
call sub.kernel32.dll_GetCurrentThreadId_1
mov ecx, eax
call fcn.004c04ec
cmp eax, ecx
jne 0x4c06a8
pop ecx
mov edx, 0x80
sub esp, edx
mov eax, esp
push ecx
call fcn.004c0408
pop ecx
call sub.kernel32.dll_GetLastError
mov edx, eax
mov eax, esp
mov dword [eax + 0x48], edx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ebp
mov dword [eax + 0x30], ebx
mov dword [eax + 0x34], edi
mov dword [eax + 0x38], esi
inc dword [eax + 8]
mov ebx, eax
call fcn.004c0148
mov edx, eax
mov eax, ebx
mov dword [eax], edx
call fcn.004c0120
xor eax, eax
push ebp
push 0x4c069b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004c0248
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
mov eax, ebx
mov ebp, dword [eax + 0x10]
mov ecx, dword [eax + 0x3c]
cmp ecx, 0x80
jg 0x4c0633
mov ecx, 0x80
sub ebx, ecx
sub ecx, 4
mov edx, dword [eax]
mov dword [ebx], edx
add eax, 4
add ebx, 4
sub ecx, 4
jns 0x4c0638
mov edx, 0x80
sub ebx, edx
add esp, edx
mov eax, ebx
mov ecx, dword [eax + 0x3c]
sub ecx, 4
js 0x4c0670
push ecx
call fcn.004c04d0
pop ecx
mov edx, ecx
add eax, edx
mov edx, dword [eax]
sub eax, 4
push edx
sub ecx, 4
jns 0x4c0665
mov eax, ebx
mov edx, dword [eax + 0x14]
push edx
mov ebx, eax
mov eax, dword [eax]
call fcn.004c0120
mov eax, ebx
mov ebx, dword [eax + 0x30]
mov edi, dword [eax + 0x34]
mov esi, dword [eax + 0x38]
mov ecx, dword [eax + 0x48]
push eax
push ecx
call sub.kernel32.dll_SetLastError
pop eax
call fcn.004c0468
ret
call fcn.004c0148
test eax, eax
je 0x4c06b5
inc dword [eax + 8]
ret
call fcn.004c030c
ret
Function at 0x401050
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [esi + 0x3c]
mov eax, dword [eax + esi + 0x78]
mov ecx, dword [eax + esi + 0x1c]
add eax, esi
add ecx, esi
push ebx
mov ebx, dword [eax + 0x20]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + 0x24]
mov eax, dword [eax + 0x18]
push edi
add ebx, esi
add ecx, esi
xor edi, edi
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], eax
test eax, eax
je 0x4010b7
mov eax, dword [ebx + edi*4]
movsx ecx, byte [eax + esi]
add eax, esi
mov edx, 0x21f6
test ecx, ecx
je 0x4010ac
mov ebx, edx
shl ebx, 5
inc eax
add ebx, ecx
movsx ecx, byte [eax]
add edx, ebx
test ecx, ecx
jne 0x401098
mov ebx, dword [ebp - 4]
cmp edx, dword [ebp + 8]
je 0x4010c1
inc edi
cmp edi, dword [ebp - 8]
jb 0x401086
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0xc]
movzx edx, word [ecx + edi*2]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + edx*4]
pop edi
add eax, esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x401350
Capabilities:
Execute command
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [sym.imp.MSVCRT.dll_fopen]
push 0x402148
push str.c:_file.ojs
call edi
mov esi, dword [sym.imp.MSVCRT.dll_system]
add esp, 8
mov dword [ebp - 8], eax
test eax, eax
jne 0x401394
push 0x402158
push str.c:_file.ojs
call edi
push 0x402144
mov dword [ebp - 8], eax
call esi
add esp, 0xc
mov edi, dword [sym.imp.MSVCRT.dll_fflush]
mov ebx, dword [0x400000]
push 0x402144
call esi
call ebx
push eax
call edi
mov eax, dword [ebp - 8]
push eax
push 1
push 0x4c
push 0x403060
call dword [sym.imp.MSVCRT.dll_fwrite]
call ebx
push eax
call edi
push 0x402144
call esi
add esp, 0x20
cmp byte [ebp - 1], 0x1b
jne 0x4013a0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4013f0
Capabilities:
Execute command
Read file on windows
Terminate process

Disassembly:
push ebx
push esi
push edi
push 0x40215c
push str.c:_file.ojs
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
jne 0x401413
push eax
call dword [sym.imp.MSVCRT.dll_exit]
push 0x402144
call dword [sym.imp.MSVCRT.dll_system]
mov edi, dword [sym.imp.MSVCRT.dll_fread]
add esp, 4
xor ebx, ebx
lea esp, [esp]
push esi
push 1
push 0x4c
push 0x403060
call edi
add esp, 0x10
cmp eax, 1
je 0x401430
inc ebx
cmp ebx, 0x4f
jl 0x401430
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x401460
Capabilities:
Delete file
Execute command
Move file
Read file on windows
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov esi, dword [sym.imp.MSVCRT.dll_fopen]
push edi
push 0x402160
push str.c:_temp.ojs
mov dword [ebp - 4], 1
call esi
mov edi, eax
add esp, 8
test edi, edi
jne 0x401491
push eax
call dword [sym.imp.MSVCRT.dll_exit]
push 0x40215c
push str.c:_file.ojs
call esi
mov esi, eax
add esp, 8
test esi, esi
jne 0x4014ad
push eax
call dword [sym.imp.MSVCRT.dll_exit]
push ebx
push 0x402144
call dword [sym.imp.MSVCRT.dll_system]
call dword [0x400000]
push eax
call dword [sym.imp.MSVCRT.dll_fflush]
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
push 0x4c
push 0x403060
call ebx
add esp, 0x18
cmp eax, 1
jne 0x401544
lea ecx, [ebp - 0x18]
mov eax, 0x403060
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401508
test dl, dl
je 0x401504
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401508
add eax, 2
add ecx, 2
test dl, dl
jne 0x4014e8
xor eax, eax
jmp 0x40150d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x401516
mov dword [ebp - 4], eax
jmp 0x401529
push edi
push 1
push 0x4c
push 0x403060
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
push esi
push 1
push 0x4c
push 0x403060
call ebx
add esp, 0x10
cmp eax, 1
je 0x4014e0
cmp dword [ebp - 4], 1
pop ebx
jne 0x40157e
push 0x402144
call dword [sym.imp.MSVCRT.dll_system]
push str.c:_file.ojs
call dword [sym.imp.MSVCRT.dll_remove]
push str.c:_file.ojs
push str.c:_temp.ojs
call dword [sym.imp.MSVCRT.dll_rename]
push esi
mov esi, dword [sym.imp.MSVCRT.dll_fclose]
call esi
push edi
call esi
add esp, 0x18
call fcn.00401100
push str.c:_file.ojs
call dword [sym.imp.MSVCRT.dll_remove]
push str.c:_file.ojs
push str.c:_temp.ojs
call dword [sym.imp.MSVCRT.dll_rename]
push 0x402144
call dword [sym.imp.MSVCRT.dll_system]
push esi
mov esi, dword [sym.imp.MSVCRT.dll_fclose]
call esi
push edi
call esi
add esp, 0x18
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4015c0
Capabilities:
Execute command
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0x402170
push str.c:_file.ojs
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
jne 0x4015e9
push eax
call dword [sym.imp.MSVCRT.dll_exit]
call dword [0x400000]
push eax
call dword [sym.imp.MSVCRT.dll_fflush]
mov edi, dword [sym.imp.MSVCRT.dll_system]
push 0x402144
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
push 0x4c
push 0x403060
call ebx
add esp, 0x18
cmp eax, 1
jne 0x401682
lea ecx, [ecx]
lea ecx, [ebp - 0x14]
mov eax, 0x403060
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401648
test dl, dl
je 0x401644
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401648
add eax, 2
add ecx, 2
test dl, dl
jne 0x401628
xor eax, eax
jmp 0x40164d
sbb eax, eax
sbb eax, 0xffffffff
push 0x402144
test eax, eax
je 0x40167d
call edi
push esi
push 1
push 0x4c
push 0x403060
call ebx
add esp, 0x14
cmp eax, 1
je 0x401620
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call edi
add esp, 4
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4016a0
Capabilities:
Execute command
Read file on windows
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0x402170
push str.c:_file.ojs
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
jne 0x4016c9
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov ebx, dword [sym.imp.MSVCRT.dll_system]
push 0x402144
call ebx
call dword [0x400000]
push eax
call dword [sym.imp.MSVCRT.dll_fflush]
mov edi, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
push 0x4c
push 0x403060
call edi
add esp, 0x18
cmp eax, 1
jne 0x401790
lea ecx, [ebp - 0x14]
mov eax, 0x403060
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401730
test dl, dl
je 0x40172c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401730
add eax, 2
add ecx, 2
test dl, dl
jne 0x401710
xor eax, eax
jmp 0x401735
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40175e
push esi
push 1
push 0x4c
push 0x403060
call edi
add esp, 0x10
cmp eax, 1
je 0x401701
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x402144
call ebx
call dword [0x400000]
push eax
call dword [sym.imp.MSVCRT.dll_fflush]
push 1
push 0xffffffffffffffb4
push esi
call dword [sym.imp.MSVCRT.dll_fseek]
push esi
push 1
push 0x4c
push 0x403060
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x24
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4017b0
Capabilities:
Execute command
Read file on windows
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x402170
push str.c:_file.ojs
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
jne 0x4017d9
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov ebx, dword [sym.imp.MSVCRT.dll_system]
push 0x402144
call ebx
call dword [0x400000]
push eax
call dword [sym.imp.MSVCRT.dll_fflush]
mov edi, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
push 0x4c
push 0x403060
call edi
add esp, 0x18
cmp eax, 1
jne 0x4018a0
lea ecx, [ebp - 0x18]
mov eax, 0x403060
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401840
test dl, dl
je 0x40183c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401840
add eax, 2
add ecx, 2
test dl, dl
jne 0x401820
xor eax, eax
jmp 0x401845
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40185f
push esi
push 1
push 0x4c
push 0x403060
call edi
add esp, 0x10
cmp eax, 1
je 0x401811
jmp 0x4018a0
push 0x402144
call ebx
call dword [0x400000]
push eax
call dword [sym.imp.MSVCRT.dll_fflush]
fld dword [0x4030a8]
fsub dword [ebp - 4]
push 1
push 0xffffffffffffffb4
push esi
fstp dword [0x4030a8]
call dword [sym.imp.MSVCRT.dll_fseek]
push esi
push 1
push 0x4c
push 0x403060
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x24
push 0x402144
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret