joyce8/EMBER2024-capa huggingface dataset:
Function at 0x538434
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x118], edx
mov dword [ebp - 0x11c], edx
mov dword [ebp - 0x120], edx
mov dword [ebp - 0x114], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5385f4
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [ebx + 0x105]
mov byte [ebx + 0x106], al
mov byte [ebx + 0x105], 0
call sub.user32.dll_GetForegroundWindow
mov esi, eax
test esi, esi
je 0x538533
lea eax, [ebp - 0x10]
push eax
push esi
call sub.user32.dll_GetWindowRect
test eax, eax
je 0x538520
mov eax, dword [0x542b58]
mov eax, dword [eax]
call fcn.0047c52c
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x10]
cmp eax, edx
jne 0x5384ca
mov eax, dword [0x542b58]
mov eax, dword [eax]
call fcn.0047c520
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0xc]
cmp eax, edx
je 0x5384ce
xor eax, eax
jmp 0x5384d0
mov al, 1
mov byte [ebx + 0x105], al
cmp byte [ebx + 0x105], 0
je 0x538520
push pe_nt_image_headers32
lea eax, [ebp - 0x110]
push eax
push esi
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 0x114]
lea edx, [ebp - 0x110]
mov ecx, pe_nt_image_headers32
call fcn.00404d84
mov eax, dword [ebp - 0x114]
mov edx, 0x53860c
call fcn.00404f20
jne 0x538520
mov byte [ebx + 0x105], 0
mov edi, dword [ebx + 0x108]
lea eax, [ebx + 0x108]
push eax
push esi
call sub.user32.dll_GetWindowThreadProcessId
cmp edi, dword [ebx + 0x108]
setne al
mov byte [ebx + 0x107], al
mov al, byte [ebx + 0x105]
cmp al, byte [ebx + 0x106]
je 0x5385cf
push 0x538624
mov eax, dword [ebx + 0x108]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x11c]
call fcn.0040b954
push dword [ebp - 0x11c]
push 0x538640
lea eax, [ebp - 0x120]
lea edx, [ebp - 0x110]
mov ecx, pe_nt_image_headers32
call fcn.00404d84
push dword [ebp - 0x120]
push 0x53864c
lea eax, [ebp - 0x118]
mov edx, 5
call fcn.00404e94
mov eax, dword [ebp - 0x118]
call fcn.0052b434
mov byte [ebx + 0x106], 1
cmp byte [ebx + 0x105], 0
je 0x5385d6
mov eax, dword [ebx + 0x108]
mov dword [ebx + 0x10c], eax
jmp 0x5385d6
mov byte [ebx + 0x106], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5385fb
lea eax, [ebp - 0x120]
mov edx, 4
call fcn.00404b38
ret
Function at 0x538650
Capabilities:
Get memory capacity

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
lea eax, [ebx + 8]
push eax
call sub.kernel32.dll_GlobalMemoryStatusEx
lea esi, [ebx + 8]
mov eax, dword [esi + 8]
mov dword [ebx + 0x88], eax
mov eax, dword [esi + 0xc]
mov dword [ebx + 0x8c], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x90], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x94], eax
mov eax, dword [esi + 8]
mov edx, dword [esi + 0xc]
sub eax, dword [esi + 0x10]
sbb edx, dword [esi + 0x14]
mov dword [ebx + 0x98], eax
mov dword [ebx + 0x9c], edx
push 0
push 0x400
push 0
push 0x400
mov eax, dword [ebx + 0x98]
mov edx, dword [ebx + 0x9c]
call fcn.00405e4c
call fcn.00405e4c
cmp edx, dword [ebx + 0xa4]
jne 0x5386d5
cmp eax, dword [ebx + 0xa0]
jbe 0x538707
jmp 0x5386d7
jle 0x538707
push 0
push 0x400
push 0
push 0x400
mov eax, dword [ebx + 0x98]
mov edx, dword [ebx + 0x9c]
call fcn.00405e4c
call fcn.00405e4c
mov dword [ebx + 0xa0], eax
mov dword [ebx + 0xa4], edx
cmp dword [ebx + 0x8c], 0
jne 0x53871b
cmp dword [ebx + 0x88], 0
jbe 0x53875a
jmp 0x53871d
jle 0x53875a
mov eax, dword [ebx + 0x88]
mov edx, dword [ebx + 0x8c]
sub eax, dword [ebx + 0x90]
sbb edx, dword [ebx + 0x94]
mov dword [esp], eax
mov dword [esp + 4], edx
fild qword [esp]
fild qword [ebx + 0x88]
fdivp st(1)
fmul dword [0x5387b0]
call fcn.004033c8
mov byte [ebx + 0xa8], al
jmp 0x538761
mov byte [ebx + 0xa8], 0
mov eax, dword [esi + 0x18]
mov dword [ebx + 0xb0], eax
mov eax, dword [esi + 0x1c]
mov dword [ebx + 0xb4], eax
mov eax, dword [esi + 0x20]
mov dword [ebx + 0xb8], eax
mov eax, dword [esi + 0x24]
mov dword [ebx + 0xbc], eax
mov eax, dword [ebx + 0xb0]
mov edx, dword [ebx + 0xb4]
sub eax, dword [ebx + 0xb8]
sbb edx, dword [ebx + 0xbc]
mov dword [ebx + 0xc0], eax
mov dword [ebx + 0xc4], edx
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x5387b4
Capabilities:
Get system information on windows

Disassembly:
push ebx
push ecx
mov ebx, eax
push esp
mov eax, dword [ebx + 0x78]
push eax
mov eax, dword [ebx + 0x48]
push eax
push 0x12
call sub.ntdll.dll_NtQuerySystemInformation
cmp eax, 0xc0000004
jne 0x5387f8
add dword [ebx + 0x78], 0x2000
lea eax, [ebx + 0x48]
mov edx, dword [ebx + 0x78]
call fcn.00402ebc
push esp
mov eax, dword [ebx + 0x78]
push eax
mov eax, dword [ebx + 0x48]
push eax
push 0x12
call sub.ntdll.dll_NtQuerySystemInformation
cmp eax, 0xc0000004
je 0x5387cf
test eax, eax
jne 0x538847
mov eax, dword [ebx + 0x48]
mov dword [ebx + 0x4c], eax
xor eax, eax
mov dword [ebx + 0xfc], eax
xor eax, eax
mov dword [ebx + 0x100], eax
mov eax, dword [ebx + 0x4c]
mov eax, dword [eax + 8]
shl eax, 2
shl eax, 0xa
add dword [ebx + 0xfc], eax
mov eax, dword [ebx + 0x4c]
mov eax, dword [eax + 4]
shl eax, 2
shl eax, 0xa
add dword [ebx + 0x100], eax
mov eax, dword [ebx + 0x4c]
mov eax, dword [eax]
test eax, eax
je 0x538847
add eax, dword [ebx + 0x4c]
mov dword [ebx + 0x4c], eax
jmp 0x538812
pop edx
pop ebx
ret
Function at 0x53896c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
test dl, dl
je 0x538980
add esp, 0xfffffff0
call fcn.0040407c
mov ebx, edx
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.00403cc0
mov eax, esi
call fcn.005388c4
mov byte [esi + 0x118], 0
xor eax, eax
mov dword [esi + 0x84], eax
mov dword [esi + 0x78], 0x800
mov dword [esi + 0x7c], 0x19000
mov eax, dword [esi + 0x78]
call fcn.0040af5c
mov dword [esi + 0x48], eax
lea eax, [esi + 0x50]
mov edx, 0x28
call fcn.00408404
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GetSystemInfo
mov al, byte [ebp - 0x10]
mov byte [esi + 0x124], al
cmp al, 1
jae 0x5389e6
mov byte [esi + 0x124], 1
mov eax, esi
test bl, bl
je 0x5389fb
call fcn.004040d4
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x450591
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x4505a0
pop dword [ebp - 0x3c]
mov eax, 0x5e3dea7e
sub eax, 0x5df8e4de
sub dword [ebp - 0x3c], eax
push 0x40
push 0x1000
push 0x36f56
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x3c]
call dword [eax]
mov ecx, 0x5f2a452f
sub ecx, 0x5f2a04e3
xor ebx, ebx
add ebx, eax
mov esi, 0x49c600
add esi, dword [ebp - 0x3c]
mov edi, 0xbd6cc9a5
sub dword [ebp - 0x30], edi
mov edx, dword [esi]
mov dword [ebp - 0x38], 0x223a4404
add edx, edi
xor dword [ebp - 0x34], ebx
mov dword [ebx], edx
xor dword [ebp - 0x14], ecx
add ebx, 4
add esi, 0x44ab2318
sub esi, 0x44ab2314
loop 0x4505f0
add eax, 0x705ec002
sub eax, 0x705dcbff
xor ebx, ebx
add ebx, eax
add eax, 0x979806da
add eax, 0x6867f92b
mov ecx, 0x6ce5967b
add ecx, 0x935a6985
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x428f20
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x808
mov eax, dword [0x42d004]
xor eax, esp
mov dword [esp + 0x804], eax
mov eax, dword [0x4302a4]
imul eax, eax, 0x343fd
cmp dword [0x81ec64], 0x139e
mov dword [0x4302a4], eax
jne 0x428f6f
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PrepareTape]
mov eax, dword [esp]
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_GetAce]
mov eax, dword [0x4302a4]
add eax, 0x269ec3
push esi
mov dword [0x4302a4], eax
movzx esi, word [0x4302a6]
and esi, 0x7fff
cmp dword [0x81ec64], 0x8e7
jne 0x428fa4
push 0
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ecx, dword [esp + 0x808]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00401000
add esp, 0x808
ret

Function at 0x428ff0
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
test ebx, ebx
jle 0x429004
call fcn.00428f20
xor byte [esi + edi], al
inc esi
cmp esi, ebx
jl 0x428ff7
pop esi
cmp ebx, 0x2d
jne 0x42901e
mov dword [0x81eff8], 0xa62e7790
mov dword [0x81effc], 0xffffffff
ret

Function at 0x429020
Capabilities:
Create pipe

Disassembly:
mov eax, dword [0x42e1e8]
sub esp, 0x14
push ebx
mov ebx, dword [0x81ec64]
push edi
mov edi, dword [0x81e930]
call fcn.00428fc0
cmp dword [0x81ec64], 0x2f
jne 0x42907a
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
call fcn.00428ff0
pop edi
pop ebx
add esp, 0x14
ret
Function at 0x4293a0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1818
call fcn.00409fb0
mov eax, dword [0x42d004]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
jmp 0x4293c9
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xbbe0392
jge 0x429471
cmp dword [0x81ec64], 0xa5f
jne 0x429415
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
push 0
lea ecx, [ebp - 0x818]
push ecx
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
lea edx, [ebp - 0x1018]
push edx
push str.pukayowifepokihevefisuvotilapu
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
cmp dword [ebp - 4], 0x845653
jne 0x42943a
mov eax, dword [0x42f008]
mov dword [0x81ec64], eax
mov ecx, dword [0x81ec64]
add ecx, 0xa231
mov dword [0x81ec64], ecx
cmp dword [0x81ec64], 0x141
jne 0x42946c
push str.dosexijo_galodiyugakuj_pusofawufumivetew_siwoseze_piguje
lea edx, [ebp - 0x1818]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov dword [0x4302a8], 0xec58acac
mov dword [0x4302ac], 0xffffffff
jmp 0x4293c0
call fcn.00429090
jmp dword [0x81e930]
Function at 0x64002970
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x6401c014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [0x6401cf28]
push edi
xor edi, edi
test esi, esi
jne 0x64002a70
push 0x104
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x20c]
push str._sdriversetchosts
push edx
call fcn.64004b03
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
lea esi, [ebp - 0x210]
call fcn.64002550
test eax, eax
jne 0x64002ab0
mov esi, dword [ebp - 0x210]
lea edx, [ebp - 0x210]
mov ecx, esi
call fcn.64001b20
test eax, eax
jne 0x64002a2b
mov edi, dword [ebp - 0x210]
call fcn.64001930
test eax, eax
je 0x64002a13
mov ecx, dword [0x6401cf28]
mov dword [edi + 0x10], ecx
mov dword [0x6401cf28], edi
jmp 0x64002a1a
mov eax, edi
call fcn.64001a60
lea edx, [ebp - 0x210]
mov ecx, esi
call fcn.64001b20
test eax, eax
je 0x640029f3
mov eax, dword [esi + 4]
test eax, eax
je 0x64002a42
push eax
call fcn.64003b3b
add esp, 4
mov dword [esi + 4], 0
mov eax, dword [esi + 8]
test eax, eax
je 0x64002a59
push eax
call fcn.640041a3
add esp, 4
mov dword [esi + 8], 0
push esi
call fcn.64003b3b
mov esi, dword [0x6401cf28]
add esp, 4
test esi, esi
je 0x64002a85
lea esp, [esp]
mov eax, dword [ebp + 8]
mov ecx, esi
call fcn.64001990
test eax, eax
jne 0x64002a99
mov esi, dword [esi + 0x10]
test esi, esi
jne 0x64002a70
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.64003b2c
mov esp, ebp
pop ebp
ret 4
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.64003b2c
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.64003b2c
mov esp, ebp
pop ebp
ret 4

Function at 0x64003b2c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6401c014]
jne 0x64003b36
repz ret
jmp fcn.64006f23

Function at 0x64009a90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sbb bh, bh
jne 0x64009aa8
call fcn.64008e59
add esp, 0xc
mov dword [ebp - 0x39c], eax
call fcn.64008e94
nop
test al, dl
inc byte [eax - 0x5135b]
in al, dx
cli
invalid
inc dword [eax]
and byte [ebp - 0x513], 0
mov byte [ebp - 0x512], 0xe3
and byte [ebp - 0x511], 0
invalid
invalid

Function at 0x64009dcc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [esi - 0x55000004], edx
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
invalid
invalid
movsb byte es:[edi], byte [esi]
cld
Function at 0x6400a339
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.64008e94
push esp
mov eax, dword [0x858d0020]
aam 0xf8
invalid

Function at 0x64011bf9
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x6401c014]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.64005994
and dword [ebp - 0x14], 0
cmp dword [0x6401dba8], 0
mov dword [ebp - 0x18], eax
jne 0x64011cac
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x64011d54
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x64011d54
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x6401dba8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x6401dbac], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x6401dbb0], eax
call edi
push eax
call esi
mov dword [0x6401dbb8], eax
test eax, eax
je 0x64011cac
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x6401dbb4], eax
mov eax, dword [0x6401dbb4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x64011d05
cmp dword [0x6401dbb8], ecx
je 0x64011d05
push eax
call esi
push dword [0x6401dbb8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x64011d05
test ebx, ebx
je 0x64011d05
call edi
test eax, eax
je 0x64011cfc
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x64011cfc
test byte [ebp - 8], 1
jne 0x64011d05
or dword [ebp + 0x10], 0x200000
jmp 0x64011d38
mov eax, dword [0x6401dbac]
cmp eax, dword [ebp - 0x18]
je 0x64011d38
push eax
call esi
test eax, eax
je 0x64011d38
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x64011d38
mov eax, dword [0x6401dbb0]
cmp eax, dword [ebp - 0x18]
je 0x64011d38
push eax
call esi
test eax, eax
je 0x64011d38
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x6401dba8]
call esi
test eax, eax
je 0x64011d54
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x64011d56
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.64003b2c
leave
ret
Function at 0x40112c
Capabilities:
Set thread local storage value

Disassembly:
push ebx
push esi
mov esi, 0x4065cc
cmp dword [esi], 0
jne 0x401172
push 0x644
push 0
call sub.KERNEL32.DLL_TlsSetValue
mov ecx, eax
test ecx, ecx
jne 0x40114f
xor eax, eax
pop esi
pop ebx
ret
mov eax, dword [0x4065c8]
mov dword [ecx], eax
mov dword [0x4065c8], ecx
xor edx, edx
mov eax, edx
add eax, eax
lea eax, [ecx + eax*8 + 4]
mov ebx, dword [esi]
mov dword [eax], ebx
mov dword [esi], eax
inc edx
cmp edx, 0x64
jne 0x40115e
mov eax, dword [esi]
mov edx, dword [eax]
mov dword [esi], edx
pop esi
pop ebx
ret

Function at 0x4012d0
Capabilities:
Delete file

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
cmp esi, 0x100000
jge 0x4012e6
mov esi, 0x100000
jmp 0x4012f2
add esi, 0xffff
and esi, 0xffff0000
mov dword [ebx + 4], esi
push 1
push 0x2000
push esi
push 0
call sub.KERNEL32.DLL_CreateFileA
mov edi, eax
mov dword [ebx], edi
test edi, edi
je 0x40132f
mov edx, ebx
mov eax, 0x4065d0
call fcn.00401184
test al, al
jne 0x40132f
push 0x8000
push 0
mov eax, dword [ebx]
push eax
call sub.KERNEL32.DLL_DeleteFileA
xor eax, eax
mov dword [ebx], eax
pop edi
pop esi
pop ebx
ret

Function at 0x401334
Capabilities:
Delete file

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, ecx
mov esi, edx
mov ebp, eax
mov dword [ebx + 4], 0x100000
push 4
push 0x2000
push 0x100000
push ebp
call sub.KERNEL32.DLL_CreateFileA
mov edi, eax
mov dword [ebx], edi
test edi, edi
jne 0x40137e
add esi, 0xffff
and esi, 0xffff0000
mov dword [ebx + 4], esi
push 4
push 0x2000
push esi
push ebp
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebx], eax
cmp dword [ebx], 0
je 0x4013a6
mov edx, ebx
mov eax, 0x4065d0
call fcn.00401184
test al, al
jne 0x4013a6
push 0x8000
push 0
mov eax, dword [ebx]
push eax
call sub.KERNEL32.DLL_DeleteFileA
xor eax, eax
mov dword [ebx], eax
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4013ac
Capabilities:
Delete file

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 8], 0xffffffff
xor edx, edx
mov dword [esp + 0xc], edx
mov ebp, eax
mov eax, dword [esp]
add eax, ebp
mov dword [esp + 0x10], eax
mov ebx, dword [0x4065d0]
jmp 0x40142c
mov edi, dword [ebx]
mov esi, dword [ebx + 8]
cmp ebp, esi
ja 0x40142a
mov eax, esi
add eax, dword [ebx + 0xc]
cmp eax, dword [esp + 0x10]
ja 0x40142a
cmp esi, dword [esp + 8]
jae 0x4013f9
mov dword [esp + 8], esi
mov eax, esi
add eax, dword [ebx + 0xc]
cmp eax, dword [esp + 0xc]
jbe 0x401408
mov dword [esp + 0xc], eax
push 0x8000
push 0
push esi
call sub.KERNEL32.DLL_DeleteFileA
test eax, eax
jne 0x401423
mov dword [0x4065ac], 1
mov eax, ebx
call fcn.004011b4
mov ebx, edi
cmp ebx, 0x4065d0
jne 0x4013db
mov eax, dword [esp + 4]
xor edx, edx
mov dword [eax], edx
cmp dword [esp + 0xc], 0
je 0x40145c
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov dword [eax], edx
mov eax, dword [esp + 0xc]
sub eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov dword [edx + 4], eax
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4014f8
Capabilities:
Delete file

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebx, eax
mov esi, ebx
add esi, 0xfff
and esi, 0xfffff000
mov dword [esp], esi
mov ebp, ebx
add ebp, edx
and ebp, 0xfffff000
mov eax, dword [esp]
mov dword [ecx], eax
mov eax, ebp
sub eax, dword [esp]
mov dword [ecx + 4], eax
mov esi, dword [0x4065d0]
jmp 0x401567
mov ebx, dword [esi + 8]
mov edi, dword [esi + 0xc]
add edi, ebx
cmp ebx, dword [esp]
jae 0x40153f
mov ebx, dword [esp]
cmp ebp, edi
jae 0x401545
mov edi, ebp
cmp edi, ebx
jbe 0x401565
push 0x4000
sub edi, ebx
push edi
push ebx
call sub.KERNEL32.DLL_DeleteFileA
test eax, eax
jne 0x401565
mov dword [0x4065ac], 2
mov esi, dword [esi]
cmp esi, 0x4065d0
jne 0x40152f
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x401ea4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, eax
cmp byte [0x4065a8], 0
jne 0x401ec1
call fcn.004017b8
test al, al
je 0x401ec9
cmp ebx, 0x7ffffff8
jle 0x401ed3
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x402027
xor ecx, ecx
push ebp
push 0x402020
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x406035], 0
je 0x401ef4
push 0x4065b0
call sub.KERNEL32.DLL_ReadFile
add ebx, 7
and ebx, 0xfffffffc
cmp ebx, 0xc
jge 0x401f04
mov ebx, 0xc
cmp ebx, 0x1000
jg 0x401fa3
mov eax, ebx
test eax, eax
jns 0x401f19
add eax, 3
sar eax, 2
mov edx, dword [0x406608]
mov edx, dword [edx + eax*4 - 0xc]
test edx, edx
je 0x401fa3
mov esi, edx
mov eax, esi
add eax, ebx
and dword [eax], 0xfffffffe
mov eax, dword [edx + 4]
cmp edx, eax
jne 0x401f54
mov eax, ebx
test eax, eax
jns 0x401f43
add eax, 3
sar eax, 2
mov ecx, dword [0x406608]
xor edi, edi
mov dword [ecx + eax*4 - 0xc], edi
jmp 0x401f7a
mov ecx, ebx
test ecx, ecx
jns 0x401f5d
add ecx, 3
sar ecx, 2
mov edi, dword [0x406608]
mov dword [edi + ecx*4 - 0xc], eax
mov ecx, dword [edx]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, esi
mov edx, dword [edx + 8]
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x40659c]
sub ebx, 4
add dword [0x4065a0], ebx
call fcn.00403258
jmp 0x402027
cmp ebx, dword [0x406600]
jg 0x401ff5
sub dword [0x406600], ebx
cmp dword [0x406600], 0xc
jge 0x401fc7
add ebx, dword [0x406600]
xor eax, eax
mov dword [0x406600], eax
mov eax, dword [0x406604]
add dword [0x406604], ebx
mov edx, ebx
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x40659c]
sub ebx, 4
add dword [0x4065a0], ebx
call fcn.00403258
jmp 0x402027
mov eax, ebx
call fcn.00401db0
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402027
cmp byte [0x406035], 0
je 0x40201f
push 0x4065b0
call sub.KERNEL32.DLL_SetFilePointer
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x402034
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
mov dword [0x4065ac], eax
cmp byte [0x4065a8], 0
jne 0x40206c
call fcn.004017b8
test al, al
jne 0x40206c
mov dword [0x4065ac], 8
mov dword [ebp - 4], 8
jmp 0x4021cd
xor ecx, ecx
push ebp
push 0x4021c6
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x406035], 0
je 0x40208d
push 0x4065b0
call sub.KERNEL32.DLL_ReadFile
mov esi, ebx
sub esi, 4
mov ebx, dword [esi]
test bl, 2
jne 0x4020a8
mov dword [0x4065ac], 9
jmp 0x40219d
dec dword [0x40659c]
mov eax, ebx
and eax, 0x7ffffffc
sub eax, 4
sub dword [0x4065a0], eax
test bl, 1
je 0x402108
mov eax, esi
sub eax, 0xc
mov edx, dword [eax + 8]
cmp edx, 0xc
jl 0x4020d8
test edx, 0x80000003
je 0x4020e7
mov dword [0x4065ac], 0xa
jmp 0x40219d
mov eax, esi
sub eax, edx
cmp edx, dword [eax + 8]
je 0x4020ff
mov dword [0x4065ac], 0xa
jmp 0x40219d
add ebx, edx
mov esi, eax
call fcn.0040195c
and ebx, 0x7ffffffc
mov eax, esi
add eax, ebx
mov edi, eax
cmp edi, dword [0x406604]
jne 0x402148
sub dword [0x406604], ebx
add dword [0x406600], ebx
cmp dword [0x406600], 0x3c00
jle 0x402139
call fcn.00401c4c
xor eax, eax
mov dword [ebp - 4], eax
call fcn.00403258
jmp 0x4021cd
mov edx, dword [eax]
test dl, 2
je 0x40216b
and edx, 0x7ffffffc
cmp edx, 4
jge 0x402166
mov dword [0x4065ac], 0xb
jmp 0x40219d
or dword [eax], 1
jmp 0x402194
mov eax, edi
cmp dword [eax + 4], 0
je 0x40217e
cmp dword [eax], 0
je 0x40217e
cmp dword [eax + 8], 0xc
jge 0x40218a
mov dword [0x4065ac], 0xb
jmp 0x40219d
mov edx, dword [eax + 8]
add ebx, edx
call fcn.0040195c
mov edx, ebx
mov eax, esi
call fcn.00401bc4
mov eax, dword [0x4065ac]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4021cd
cmp byte [0x406035], 0
je 0x4021c5
push 0x4065b0
call sub.KERNEL32.DLL_SetFilePointer
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret