joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402460
Capabilities:
Get common file path

Disassembly:
sub esp, 0x23c
mov eax, dword [0x468400]
xor eax, esp
mov dword [esp + 0x234], eax
push esi
push edi
lea eax, [esp + 0x28]
push eax
push 0x104
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [esp + 0x28]
call fcn.00402380
test al, al
je 0x4024c4
push 0x104
lea ecx, [esp + 0x2c]
push ecx
add esi, 0x78
push esi
call fcn.00436c10
add esp, 0xc
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x234]
xor ecx, esp
call fcn.00436724
add esp, 0x23c
ret
call fcn.00411cd0
mov edi, eax
test edi, edi
je 0x402505
mov ecx, edi
call fcn.00402380
test al, al
je 0x402505
push 0x104
push edi
add esi, 0x78
push esi
call fcn.00436c10
add esp, 0xc
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x234]
xor ecx, esp
call fcn.00436724
add esp, 0x23c
ret
test esi, esi
jne 0x40250d
xor eax, eax
jmp 0x402510
mov eax, dword [esi + 0x20]
push 0x40
push 0x45ac88
push 0x45ac90
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
test esi, esi
jne 0x40254f
mov dword [esp + 8], esi
jmp 0x402556
mov edx, dword [esi + 0x20]
mov dword [esp + 8], edx
lea eax, [esp + 8]
push eax
mov dword [esp + 0x18], 0x45acc8
mov dword [esp + 0x1c], 1
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderA]
test eax, eax
je 0x4025ca
lea ecx, [esp + 0x130]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
je 0x4025ca
lea ecx, [esp + 0x130]
call fcn.00402380
test al, al
je 0x4025ca
push 0x104
lea edx, [esp + 0x134]
push edx
add esi, 0x78
push esi
call fcn.00436c10
add esp, 0xc
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x234]
xor ecx, esp
call fcn.00436724
add esp, 0x23c
ret
mov ecx, dword [esp + 0x23c]
pop edi
pop esi
xor ecx, esp
xor al, al
call fcn.00436724
add esp, 0x23c
ret
Function at 0x4025f0
Capabilities:
Set current directory
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x4527cb
mov eax, dword fs:[0]
push eax
sub esp, 0xcc
mov eax, dword [0x468400]
xor eax, esp
mov dword [esp + 0xc8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x468400]
xor eax, esp
push eax
lea eax, [esp + 0xe0]
mov dword fs:[0], eax
mov edi, ecx
lea esi, [edi + 0x78]
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
call fcn.00411c60
lea eax, [esp + 0x14]
push eax
call fcn.004132a0
mov dword [esp + 0xe8], 0
mov eax, dword [esp + 0x34]
add eax, 8
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.00413370
test al, al
jne 0x4026c7
test edi, edi
je 0x40266e
mov edi, dword [edi + 0x20]
push 0x10
push 0x45ac14
push 0x45ace4
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [esp + 0xe8], 0xffffffff
mov eax, dword [esp + 0x48]
mov dword [esp + 0x14], vtable.TiXmlDocument.0
cmp eax, 0x46c740
je 0x4026b7
push eax
call fcn.00419a12
add esp, 4
lea ecx, [esp + 0x14]
call fcn.00412a30
xor al, al
jmp 0x402807
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x4026f3
nop
mov edx, dword [esi]
mov eax, dword [edx + 0x18]
mov ecx, esi
call eax
test eax, eax
jne 0x4026e6
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x4026d0
jmp 0x4026f3
mov edx, dword [esi]
mov eax, dword [edx + 0x18]
mov ecx, esi
call eax
test eax, eax
jne 0x40271c
test edi, edi
jne 0x402708
push 0x10
push 0x45ac14
push 0x45ad04
jmp 0x40267a
mov edi, dword [edi + 0x20]
push 0x10
push 0x45ac14
push 0x45ad04
jmp 0x40267a
call fcn.00412b90
test eax, eax
jne 0x40274e
test edi, edi
jne 0x40273a
push 0x10
push 0x45ac14
push 0x45ad2c
jmp 0x40267a
mov edi, dword [edi + 0x20]
push 0x10
push 0x45ac14
push 0x45ad2c
jmp 0x40267a
mov eax, dword [eax + 0x18]
mov eax, dword [eax + 0x20]
lea esi, [edi + 0x184]
push esi
lea ebx, [edi + 0x180]
push ebx
lea ebp, [edi + 0x17c]
push ebp
add eax, 8
push str._d._d._d
push eax
call fcn.00436a28
add esp, 0x14
cmp eax, 3
je 0x4027a3
mov ecx, str.update.xml
mov eax, edi
call fcn.004020b0
lea ecx, [esp + 0x14]
mov dword [esp + 0xe8], 0xffffffff
call fcn.004012b0
xor al, al
jmp 0x402807
mov edx, dword [esi]
mov eax, dword [ebx]
mov ecx, dword [ebp]
mov esi, ecx
push edx
mov ebx, eax
shl esi, 8
and ebx, 0xff
add esi, ebx
push eax
push ecx
mov ebx, edx
shl esi, 0x10
and ebx, 0xffff
lea ecx, [esp + 0x68]
push str._d._02d._03d
add esi, ebx
push ecx
mov dword [edi + 0x188], esi
call fcn.00436790
add esp, 0x14
lea edx, [esp + 0x5c]
push edx
lea ecx, [edi + 0x2a4]
call fcn.0042279d
lea ecx, [esp + 0x14]
mov dword [esp + 0xe8], 0xffffffff
call fcn.004012b0
mov al, 1
mov ecx, dword [esp + 0xe0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xc8]
xor ecx, esp
call fcn.00436724
add esp, 0xd8
ret
Function at 0x403590
Capabilities:
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
push 0xffffffffffffffff
push 0x4524eb
mov eax, dword fs:[0]
push eax
sub esp, 0x25c
mov eax, dword [0x468400]
xor eax, esp
mov dword [esp + 0x258], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x468400]
xor eax, esp
push eax
lea eax, [esp + 0x270]
mov dword fs:[0], eax
push 0x45b0b4
lea eax, [esp + 0x18]
push str.NYCSClient.exe
xor ebx, ebx
push eax
mov esi, ecx
mov dword [esp + 0x20], ebx
call fcn.00436bb3
mov eax, dword [esp + 0x20]
add esp, 0xc
cmp eax, ebx
je 0x403782
push eax
call fcn.004375bd
lea eax, [esi + 0x1e0]
add esp, 4
cmp dword [eax + 0x18], 0x10
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], eax
jb 0x403618
mov eax, dword [eax + 4]
jmp 0x40361b
add eax, 4
push 0x45b0b4
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.00436bb3
mov eax, dword [esp + 0x20]
add esp, 0xc
cmp eax, ebx
je 0x403644
push eax
call fcn.004375bd
add esp, 4
jmp 0x403782
push ebx
push 6
mov dword [esp + 0x44], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [esp + 0x18], eax
cmp eax, 0xffffffff
jne 0x403690
cmp esi, ebx
jne 0x403665
xor esi, esi
jmp 0x403668
mov esi, dword [esi + 0x20]
push 0x10
push 0x45ac14
push 0x45b0c8
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor al, al
jmp 0x403784
lea edx, [esp + 0x3c]
push edx
push eax
call sub.KERNEL32.dll_Process32FirstW
cmp eax, ebx
je 0x403782
mov ebp, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea esp, [esp]
push ebx
push ebx
push ebx
push ebx
push 0x104
lea eax, [esp + 0x74]
push eax
push ebx
push ebx
call ebp
mov edi, eax
push edi
call fcn.00419a07
add esp, 4
push ebx
push ebx
push edi
mov esi, eax
push esi
push 0x104
lea ecx, [esp + 0x74]
push ecx
push ebx
push ebx
call ebp
mov eax, esi
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4036f6
sub eax, edx
push eax
push esi
lea ecx, [esp + 0x28]
call fcn.00404b10
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x20]
mov dword [esp + 0x278], ebx
call fcn.00405700
test al, al
je 0x403738
mov edx, dword [esp + 0x44]
push edx
push ebx
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call fcn.00419a12
add esp, 4
lea edi, [esp + 0x20]
call fcn.00403820
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x3c]
push eax
push ecx
call sub.KERNEL32.dll_Process32NextW
mov dword [esp + 0x278], 0xffffffff
cmp dword [esp + 0x38], 0x10
mov esi, eax
jb 0x40377a
mov edx, dword [esp + 0x24]
push edx
call fcn.00419a12
add esp, 4
cmp esi, ebx
jne 0x4036b0
mov al, 1
mov ecx, dword [esp + 0x270]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x258]
xor ecx, esp
call fcn.00436724
add esp, 0x268
ret
Function at 0x404d70
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x45217b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x468400]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00450470
push 4
mov dword [esp + 0x20], 0
call fcn.004199d8
mov edi, eax
add esp, 4
test edi, edi
je 0x404dee
call fcn.00450271
mov dword [edi], eax
call fcn.0045009f
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.004503c1
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x404de3
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.004503e9
jmp 0x404df0
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4

Function at 0x4061a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x452b03
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x468400]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
push esi
call fcn.00406970
lea eax, [esi + 0x18]
push eax
mov dword [esp + 0x18], 0
call fcn.00406970
lea ecx, [esi + 0x30]
push ecx
mov byte [esp + 0x18], 1
call fcn.00406d00
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4

Function at 0x406350
Capabilities:
Read file on windows

Disassembly:
push ecx
push esi
push edi
mov esi, eax
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406358
sub eax, edx
push eax
push esi
mov ecx, ebx
call fcn.00404b10
push 0x45ac20
lea eax, [esp + 0xc]
push esi
push eax
call fcn.00436bb3
add esp, 0xc
test eax, eax
je 0x406387
xor al, al
pop edi
pop esi
pop ecx
ret
mov ecx, dword [esp + 8]
push ecx
call fcn.00437876
add esp, 4
push eax
call fcn.00437777
add esp, 4
push ebx
mov edi, eax
call fcn.00406410
mov esi, dword [ebx + 0x1c]
lea edx, [edi + 1]
push edx
mov eax, esi
call fcn.00406a50
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
jne 0x4063c0
call fcn.00436e91
mov ecx, dword [esp + 8]
mov edx, dword [esi + 0xc]
push ecx
push 1
push edi
push edx
call fcn.00437141
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
add esp, 0x10
cmp edi, eax
jb 0x4063e3
call fcn.00436e91
mov ecx, dword [esi + 0xc]
mov byte [edi + ecx], 0
mov ecx, esi
call fcn.00405f10
mov edx, dword [esp + 8]
push edx
call fcn.004375bd
add esp, 4
pop edi
mov al, 1
pop esi
pop ecx
ret
Function at 0x409800
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, 0xf
jmp 0x409810
mov esi, dword [eax + 8]
mov dl, byte [ecx]
imul esi, esi, 0x343fd
add esi, 0x269ec3
mov dword [eax + 8], esi
mov ebx, esi
mov esi, dword [eax]
shr ebx, 0x10
add bl, byte [esi + eax + 4]
inc ecx
xor byte [ecx - 1], bl
mov esi, dword [eax]
add byte [esi + eax + 4], dl
mov edx, dword [eax]
lea esi, [esi + eax + 4]
inc edx
and edx, 3
sub edi, 1
mov dword [eax], edx
jne 0x409810
pop edi
pop esi
pop ebx
ret
Function at 0x40a930
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x2c
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
push edi
mov dword [esp + 0x3c], esi
cmp dword [esp + 0x44], esi
jbe 0x40a9d5
lea ebx, [ebx]
mov eax, dword [esi + ebx]
push 1
push eax
mov eax, dword [esp + 0x48]
push eax
add esi, 4
call fcn.00437470
mov ecx, dword [esp + 0x4c]
mov edi, dword [esi + ebx]
push ecx
push edi
add esi, 4
lea edx, [esi + ebx]
push 1
push edx
call fcn.004387c6
add esp, 0x1c
cmp eax, edi
jne 0x40aa32
mov ecx, dword [esp + 0x4c]
add esi, edi
mov eax, esi
sub eax, dword [esp + 0x48]
add eax, ebx
mov dword [esp + 0xc], eax
fild dword [esp + 0xc]
fild dword [esp + 0x4c]
test ecx, ecx
jge 0x40a9a9
fadd qword [0x45c708]
fdivp st(1)
fmul qword [0x45c700]
call fcn.0043d410
mov edx, dword [ebp + 8]
push eax
mov eax, dword [ebp + 4]
push 0x68
push edx
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
inc dword [esp + 0x3c]
cmp esi, dword [esp + 0x44]
jb 0x40a950
mov eax, dword [esp + 0x3c]
push eax
push 0x45b750
mov eax, ebp
call fcn.0040c7c0
lea ecx, [esp + 0x14]
push ecx
call fcn.00438896
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x24]
push eax
call fcn.00437abb
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x38]
push edx
mov edx, dword [esp + 0x40]
push eax
push ecx
push edx
push str.____02d__02d__02d_:__02d_:__02d_____n
mov eax, ebp
call fcn.0040c7c0
add esp, 0x2c
pop edi
pop esi
mov al, 1
pop ebp
add esp, 0x2c
ret 0x14
push 0x45b730
mov eax, ebp
call fcn.0040c7c0
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 4]
add esp, 4
push 0
push 0x69
push ecx
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop esi
xor al, al
pop ebp
add esp, 0x2c
ret 0x14
Function at 0x40aa60
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x5c
push ebx
push ebp
push esi
mov ebx, eax
xor esi, esi
push edi
cmp dword [ebx + 0x18], esi
je 0x40aa97
mov ecx, dword [ebx + 0x14]
mov eax, dword [ecx]
mov dword [ecx], ecx
mov ecx, dword [ebx + 0x14]
mov dword [ecx + 4], ecx
mov dword [ebx + 0x18], esi
cmp eax, dword [ebx + 0x14]
je 0x40aa97
mov edi, dword [eax]
push eax
call fcn.00419a12
add esp, 4
mov eax, edi
cmp edi, dword [ebx + 0x14]
jne 0x40aa85
xor ebp, ebp
mov dword [esp + 0x14], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
cmp dword [esp + 0x7c], esi
ja 0x40ab14
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 0x70]
push edx
push 0x45b750
mov eax, esi
call fcn.0040c7c0
lea eax, [esp + 0x30]
push eax
call fcn.00438896
add esp, 0xc
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x48]
push edx
call fcn.00437abb
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x50]
mov edx, dword [esp + 0x54]
push eax
mov eax, dword [esp + 0x5c]
push ecx
mov ecx, dword [esp + 0x64]
push edx
push eax
push ecx
push str.____02d__02d__02d_:__02d_:__02d_____n
mov eax, esi
call fcn.0040c7c0
add esp, 0x20
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5c
ret 0x18
mov ebp, dword [esp + 0x18]
mov eax, dword [esp + 0x78]
mov edi, dword [esi + eax]
mov ecx, dword [esp + 0x74]
push 1
push edi
push ecx
add esi, 4
call fcn.00437470
mov eax, dword [esp + 0x84]
mov edx, dword [esp + 0x80]
add esp, 0xc
add ebp, edi
mov edi, dword [esi + eax]
push edx
push edi
add esi, 4
add eax, esi
mov dword [esp + 0x28], ebp
push 1
add ebp, edi
push eax
mov dword [esp + 0x34], edi
mov dword [esp + 0x28], ebp
call fcn.004387c6
add esp, 0x10
cmp eax, edi
jne 0x40ac2c
mov eax, dword [ebx + 0x14]
mov ecx, dword [eax]
add esi, edi
mov edi, dword [ebx]
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], ecx
test edi, edi
je 0x40ab82
mov edx, dword [edi]
jmp 0x40ab84
xor edx, edx
mov ebp, dword [edx]
test edi, edi
je 0x40ab8e
mov edx, dword [edi]
jmp 0x40ab90
xor edx, edx
mov edx, dword [edx]
push eax
push ebp
push ecx
push edx
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x48]
push edx
call fcn.004115d0
mov ecx, dword [eax]
mov ebp, dword [eax + 4]
add esp, 0x18
cmp edi, ecx
je 0x40abb6
call fcn.00436e91
mov eax, dword [esp + 0x28]
push ebp
push eax
lea ecx, [esp + 0x44]
push ecx
lea edx, [esp + 0x2c]
call fcn.0040dbd0
mov eax, dword [esp + 0x84]
mov edx, esi
sub edx, dword [esp + 0x80]
add edx, dword [esp + 0x78]
mov dword [esp + 0x1c], edx
fild dword [esp + 0x1c]
fild dword [esp + 0x84]
test eax, eax
jge 0x40abf7
fadd qword [0x45c708]
fdivp st(1)
fmul qword [0x45c700]
call fcn.0043d410
push eax
mov eax, dword [esp + 0x74]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
push 0x68
push ecx
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
inc dword [esp + 0x14]
cmp esi, dword [esp + 0x7c]
jb 0x40ab10
jmp 0x40aaab
mov esi, dword [esp + 0x70]
push 0x45b730
mov eax, esi
call fcn.0040c7c0
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
add esp, 4
push 0
push 0x69
push eax
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x5c
ret 0x18
Function at 0x40c7c0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
push 0x2000
push 0
push 0x46d4f8
mov esi, eax
call fcn.00439a00
add esp, 0xc
cmp byte [esi + 0x144], 0
je 0x40c867
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
push ecx
push 0x2000
push 0x46d4f8
call fcn.00438647
add esp, 0x10
cmp dword [esi + 0x140], 0x10
mov dword [esp + 4], 0
jb 0x40c81a
mov esi, dword [esi + 0x12c]
jmp 0x40c820
add esi, 0x12c
push 0x45baf4
lea edx, [esp + 8]
push esi
push edx
call fcn.00436bb3
mov esi, dword [esp + 0x10]
add esp, 0xc
test esi, esi
je 0x40c867
mov eax, 0x46d4f8
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c843
push esi
sub eax, edx
push eax
push 1
push 0x46d4f8
call fcn.004387c6
mov eax, dword [esp + 0x14]
push eax
call fcn.004375bd
add esp, 0x14
pop esi
pop ecx
ret
Function at 0x40c8c0
Capabilities:
Check if file exists
Delete file
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x452990
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x468400]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebp
push esi
push edi
mov eax, dword [0x468400]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov eax, dword [esp + 0x60]
push ebx
mov edi, str..ofif.csv
lea esi, [esp + 0x34]
mov dword [esp + 0x14], eax
call fcn.00408580
add esp, 4
mov dword [esp + 0x58], 0
mov eax, dword [esp + 0x34]
mov ebp, 0x10
cmp dword [esp + 0x48], ebp
jae 0x40c926
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
cmp eax, 1
jne 0x40c981
mov eax, dword [esp + 0x34]
cmp dword [esp + 0x48], ebp
jae 0x40c940
lea eax, [esp + 0x34]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [esp + 0x34]
cmp dword [esp + 0x48], ebp
jae 0x40c95a
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0x34]
cmp dword [esp + 0x48], ebp
jae 0x40c96f
lea eax, [esp + 0x34]
push eax
mov eax, dword [esp + 0x14]
push 0x45bb20
call fcn.0040c7c0
add esp, 8
push ebx
mov edi, str..csv
lea esi, [esp + 0x18]
call fcn.00408580
add esp, 4
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0x64], 1
call fcn.004043f0
cmp dword [esp + 0x2c], ebp
jb 0x40c9b9
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00419a12
add esp, 4
mov eax, dword [esp + 0x34]
cmp dword [esp + 0x48], ebp
jae 0x40c9c7
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
cmp eax, 1
jne 0x40ca22
mov eax, dword [esp + 0x34]
cmp dword [esp + 0x48], ebp
jae 0x40c9e1
lea eax, [esp + 0x34]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [esp + 0x34]
cmp dword [esp + 0x48], ebp
jae 0x40c9fb
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0x34]
cmp dword [esp + 0x48], ebp
jae 0x40ca10
lea eax, [esp + 0x34]
push eax
mov eax, dword [esp + 0x14]
push 0x45bb38
call fcn.0040c7c0
add esp, 8
cmp dword [esp + 0x48], ebp
jb 0x40ca35
mov edx, dword [esp + 0x34]
push edx
call fcn.00419a12
add esp, 4
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.00436724
add esp, 0x4c
ret 4
Function at 0x40ca60
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x50
push ebx
push ebp
mov ebp, dword [esp + 0x60]
xor ebx, ebx
push edi
cmp dword [esi + 0x1c], ebx
je 0x40ca93
mov eax, dword [esi + 0x18]
mov ecx, dword [eax + 4]
push ecx
mov ecx, esi
call fcn.0040e2b0
mov eax, dword [esi + 0x18]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x18]
mov dword [esi + 0x1c], ebx
mov dword [eax], eax
mov eax, dword [esi + 0x18]
mov dword [eax + 8], eax
push ebx
push ebx
mov edi, 0x57444650
push ebp
mov dword [esp + 0x40], edi
mov byte [esp + 0x44], bl
call fcn.00437470
add esp, 0xc
push ebp
push 1
lea edx, [esp + 0x3c]
push 0x10
push edx
call fcn.00437141
add esp, 0x10
lea ecx, [esp + 0x34]
lea eax, [esp + 0xc]
mov dword [esp + 0x10], 0xdeadbeef
mov dword [esp + 0x14], 0xbeefdead
mov dword [esp + 0xc], ebx
call fcn.00409800
cmp dword [esp + 0x34], edi
je 0x40cb00
mov eax, dword [esp + 0x60]
push 0x45bb4c
call fcn.0040c7c0
add esp, 4
xor al, al
pop edi
pop ebp
pop ebx
add esp, 0x50
ret 8
mov eax, dword [esp + 0x40]
push ebx
push eax
push ebp
call fcn.00437470
add esp, 0xc
xor edi, edi
cmp dword [esp + 0x3c], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
jle 0x40cb96
push ebp
xor eax, eax
push 1
lea ecx, [esp + 0x2c]
push 0x10
push ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
call fcn.00437141
add esp, 0x10
lea ecx, [esp + 0x24]
lea eax, [esp + 0xc]
call fcn.00409800
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x4c], edx
lea edx, [esp + 0x44]
mov dword [esp + 0x50], eax
push edx
lea eax, [esp + 0x1c]
push eax
mov ebx, esi
mov dword [esp + 0x5c], ecx
call fcn.0040dc50
inc edi
xor ebx, ebx
cmp edi, dword [esp + 0x3c]
jl 0x40cb27
push ebx
push ebx
push ebp
call fcn.00437470
add esp, 0xc
pop edi
pop ebp
mov al, 1
pop ebx
add esp, 0x50
ret 8