joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7485c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
lea eax, [ebx + 0x134]
push edi
lea esi, [ebx + 0x34]
mov dword [esp + 0x14], eax
xor edi, edi
mov ecx, dword [ebx + 0x1c]
mov ebp, edi
and ebp, 0xff
mov al, byte [ecx + ebp + 1]
test al, 3
je 0x7485f0
mov byte [edi + esi], 2
jmp 0x748627
test al, 4
je 0x7485fa
mov byte [edi + esi], 0xd
jmp 0x748627
mov edx, dword [ebx + 0x240]
push edi
push ebx
call dword [edx + 4]
add esp, 8
cmp eax, 1
jle 0x748613
mov byte [edi + esi], 2
jmp 0x748627
mov eax, dword [ebx + 0x1c]
test byte [eax + ebp + 1], 0x17
jne 0x748623
mov byte [edi + esi], 0x19
jmp 0x748627
mov byte [edi + esi], 1
inc edi
cmp edi, 0x100
jb 0x7485d7
mov ecx, dword [esp + 0x14]
mov al, 7
mov byte [esi + 0x21], al
mov byte [esi + 0x3d], al
mov byte [esi + 0x3e], al
mov al, 0x10
mov byte [esi + 0x7c], al
mov byte [esi + 0x26], al
mov byte [esi + 0x24], 2
mov byte [esi + 0x5f], 2
mov byte [esi + 0x27], 9
mov byte [esi + 0x2e], 0xf
mov byte [esi + 0x3c], 8
mov byte [esi + 0x23], 0xa
mov byte [esi + 0x3b], 0x15
mov byte [esi + 0x3a], 0x16
mov byte [esi], 0x11
mov byte [esi + 0x5c], 0x12
mov byte [esi + 0x2f], 0x13
mov byte [esi + 0x2a], 0x14
mov byte [esi + 0x40], 0x17
mov byte [esi + 0x60], 0x1a
mov byte [esi + 0x22], 0x20
mov eax, esi
sub ecx, esi
mov edi, 0x100
mov dl, byte [eax]
cmp dl, 2
je 0x74869b
cmp dl, 0xd
je 0x74869b
xor edx, edx
jmp 0x7486a0
mov edx, 1
mov byte [ecx + eax], dl
inc eax
dec edi
jne 0x74868b
mov al, 0x1d
mov byte [esi + 0x58], al
mov byte [esi + 0x78], al
mov al, 0x1f
pop edi
mov byte [esi + 0x62], 0x1e
mov byte [esi + 0x4e], al
mov byte [esi + 0x6e], al
pop esi
pop ebp
pop ebx
ret

Function at 0x7486c0
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
push ebx
push 0x4000
call fcn.00746f80
mov esi, eax
add esp, 8
test esi, esi
jne 0x7486e1
pop edi
pop esi
xor al, al
pop ebx
ret
mov eax, dword [esp + 0x10]
push ebx
push 0
push eax
call fcn.00749d20
mov edi, eax
add esp, 0xc
test edi, edi
jge 0x748706
push esi
call fcn.00747010
add esp, 4
pop edi
pop esi
mov al, 1
pop ebx
ret
push ebp
push 0x4000
push esi
push edi
call fcn.0076935c
push ebx
push edi
mov ebp, eax
call fcn.00749d90
push 0x748740
push ebp
push esi
call fcn.0074b0c0
push esi
call fcn.00747010
add esp, 0x24
pop ebp
pop edi
pop esi
xor al, al
pop ebx
ret
Function at 0x749a50
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push esi
push 0x9ce120
xor bl, bl
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x9ce040]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x749acb
push 0x4c
push 1
call fcn.0075e6c5
mov esi, eax
add esp, 8
test esi, esi
jne 0x749a93
push 0x9ce120
mov bl, 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov al, bl
pop ebx
ret
mov ecx, dword [0x9ce040]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x9bf92c]
inc eax
lea edx, [esi + 0xc]
mov dword [0x9bf92c], eax
push edx
mov dword [esi + 0x30], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [esi + 4]
push 0
push eax
call fcn.0074d590
add esp, 8
mov byte [esi + 0x3c], 1
push 0x9ce120
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov al, bl
pop ebx
ret

Function at 0x749f50
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x1c], edi
call fcn.0075e29d
mov ebx, dword [esp + 0x14]
mov dword [eax], 0
mov eax, dword [esp + 0x18]
push edi
push eax
push ebx
call fcn.0076935c
mov esi, eax
add esp, 0xc
cmp esi, edi
je 0x74a04a
call fcn.0075e29d
cmp dword [eax], 0
je 0x749f97
call fcn.0075e29d
mov ebp, dword [eax]
jmp 0x749f9a
or ebp, 0xffffffff
call fcn.00749ae0
test esi, esi
mov dword [eax], ebp
jne 0x749faf
call fcn.0075e29d
cmp dword [eax], 4
je 0x749fff
mov eax, dword [esp + 0x20]
test al, 0x1a
je 0x749fe2
cmp esi, 0xffffffff
je 0x74a024
test al, 6
je 0x749fe2
call fcn.00749ae0
mov ecx, dword [eax]
push ecx
push ebx
call fcn.0074d5c0
add esp, 4
push eax
push 0x24
push 9
call fcn.0074a330
mov eax, dword [esp + 0x30]
add esp, 0x10
cmp esi, 0xffffffff
je 0x74a042
test al, 6
je 0x749ff0
test ah, 2
je 0x74a042
test esi, esi
jbe 0x74a04e
test ah, 2
je 0x74a04e
add dword [esp + 0x18], esi
sub edi, esi
call fcn.0075e29d
mov edx, dword [esp + 0x18]
push edi
push edx
push ebx
mov dword [eax], 0
call fcn.0076935c
mov esi, eax
add esp, 0xc
cmp esi, edi
je 0x74a04a
jmp 0x749f84
call fcn.00749ae0
mov eax, dword [eax]
push eax
push ebx
call fcn.0074d5c0
add esp, 4
push eax
push 0x24
push 2
call fcn.0074a330
add esp, 0x10
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
mov eax, dword [esp + 0x20]
test al, 6
je 0x74a05b
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
test ah, 2
je 0x74a064
mov esi, dword [esp + 0x1c]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret

Function at 0x760f2a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x760f4a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0075e22a
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x760f6d
test byte [esp + 8], 2
je 0x760f6d
call fcn.0075e29d
mov dword [eax], 0xd
call fcn.0075e2a6
mov dword [eax], 5
jmp 0x760f46
xor eax, eax
ret
Function at 0x774d38
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x774d70
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00772ddd
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00772db5
jmp 0x774d7c
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x776538
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x77657a
call fcn.0077cb9b
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x77657a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x776571
xor eax, eax
jmp 0x776582
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00776588
pop edi
pop esi
pop ebx
ret 4

Function at 0x77d0cb
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x77d0f9
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x77d117
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0077d031
jmp 0x77d117
mov eax, dword [esi + 0x14]
test eax, eax
je 0x77d117
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0077d031
test edi, edi
mov eax, edi
jne 0x77d101
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x51cb2bbe
nop
nop
nop
test eax, eax
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x54fe4233
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x40295c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00403dd8
test esi, esi
jne 0x402992
push 0x105
lea eax, [esp + 4]
push eax
push 0
call fcn.004011c8
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00403ec8
jmp 0x4029b0
call fcn.004011b8
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402800
mov edi, eax
test esi, esi
je 0x4029b0
cmp dword [ebx], 0
je 0x4029b0
dec esi
jmp 0x402999
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402fb0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x424020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403048
push 0x80000002
call fcn.00401220
test eax, eax
jne 0x403028
xor eax, eax
push ebp
push 0x403021
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403064
mov eax, dword [ebp - 4]
push eax
call fcn.00401228
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403028
mov eax, dword [ebp - 4]
push eax
call fcn.00401218
ret
movzx eax, word [0x424020]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x424020], ax
mov esp, ebp
pop ebp
ret

Function at 0x403c38
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x425044], 0
je 0x403c99
cmp word [0x425218], 0xd7b2
jne 0x403c61
cmp dword [0x425220], 0
jbe 0x403c61
mov eax, 0x425214
call dword [0x425230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x42406c
push 0xfffffffffffffff5
call fcn.00401160
push eax
call fcn.00401180
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403cc0
push 0xfffffffffffffff5
call fcn.00401160
push eax
call fcn.00401180
pop edx
ret
cmp byte [0x424030], 0
jne 0x403cb5
push 0
push 0x424064
push 0x42406c
push 0
call fcn.00401198
pop edx
ret
Function at 0x403cc4
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, 0x425630
mov edi, 0x425040
cmp byte [ebx + 0x28], 0
jne 0x403cec
cmp dword [edi], 0
je 0x403cec
mov eax, dword [edi]
mov esi, eax
xor eax, eax
mov dword [edi], eax
call esi
cmp dword [edi], 0
jne 0x403cdd
cmp dword [0x424004], 0
je 0x403d06
call fcn.00403ba4
call fcn.00403c38
xor eax, eax
mov dword [0x424004], eax
cmp byte [ebx + 0x28], 2
jne 0x403d1a
cmp dword [section.DATA], 0
jne 0x403d1a
xor eax, eax
mov dword [ebx + 0xc], eax
call fcn.00403a4c
cmp byte [ebx + 0x28], 1
jbe 0x403d2e
cmp dword [section.DATA], 0
je 0x403d51
mov edi, dword [ebx + 0x10]
test edi, edi
je 0x403d51
mov eax, edi
call fcn.00405328
mov ebp, dword [ebx + 0x10]
mov esi, dword [ebp + 0x10]
cmp esi, dword [ebp + 4]
je 0x403d51
test esi, esi
je 0x403d51
push esi
call fcn.004011b0
call fcn.00403a24
cmp byte [ebx + 0x28], 1
jne 0x403d5f
call dword [ebx + 0x24]
cmp byte [ebx + 0x28], 0
je 0x403d6a
call fcn.00403c08
cmp dword [ebx], 0
jne 0x403d89
cmp dword [0x425024], 0
je 0x403d7e
call dword [0x425024]
mov eax, dword [section.DATA]
push eax
call fcn.00401190
mov eax, dword [ebx]
mov esi, eax
mov edi, ebx
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
jmp 0x403d06
Function at 0x404fb8
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call fcn.004011c8
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4051e8
push 0x80000001
call fcn.00401220
test eax, eax
je 0x40503b
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4051e8
push 0x80000002
call fcn.00401220
test eax, eax
je 0x40503b
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405204
push 0x80000001
call fcn.00401220
test eax, eax
jne 0x4050c4
xor eax, eax
push ebp
push 0x4050bd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00404df4
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call fcn.00401228
test eax, eax
je 0x4050a2
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405224
mov eax, dword [ebp - 8]
push eax
call fcn.00401228
test eax, eax
je 0x4050a2
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4050c4
mov eax, dword [ebp - 8]
push eax
call fcn.00401218
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call fcn.00401200
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call fcn.004011e8
push eax
call fcn.004011c0
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4051de
cmp byte [ebp - 0xd], 0
jne 0x40510b
cmp byte [ebp - 0x12], 0
je 0x4051de
lea eax, [ebp - 0x11d]
push eax
call fcn.00401208
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405124
dec ebx
cmp byte [ebx], 0x2e
je 0x405133
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405123
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4051de
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405170
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call fcn.00401200
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call fcn.004011f0
mov esi, eax
test esi, esi
jne 0x4051de
cmp byte [ebp - 0xd], 0
je 0x4051de
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call fcn.00401200
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call fcn.004011f0
mov esi, eax
test esi, esi
jne 0x4051de
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call fcn.00401200
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call fcn.004011f0
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405878
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4058de
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call fcn.004011c0
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404048
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402bb8
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4058c8
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4058e5
lea eax, [ebp - 0x10]
call fcn.00403dd8
ret

Function at 0x4075d0
Capabilities:
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404298
push eax
call fcn.00405c40
pop ebx
ret

Function at 0x4075e4
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
push edi
mov eax, esi
call fcn.00404298
push eax
call fcn.00405d38
test eax, eax
jne 0x407606
call fcn.00405c58
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x409fe8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call fcn.00405c68
test eax, eax
jle 0x40a021
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403ec8
jmp 0x40a02a
mov eax, ebx
mov edx, esi
call fcn.00403e2c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40a034
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call fcn.00405c68
test eax, eax
jle 0x40a056
movzx eax, byte [esp]
jmp 0x40a058
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x413528
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x41358e
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call fcn.00405c68
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404048
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402bb8
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x413578
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413595
lea eax, [ebp - 0x10]
call fcn.00403dd8
ret
Function at 0x414428
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x78], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404288
xor eax, eax
push ebp
push 0x414591
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x20], 0xc
mov dword [ebp - 0x18], 0xffffffff
xor eax, eax
mov dword [ebp - 0x1c], eax
mov byte [ebp - 5], 0
push 0
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00405ba8
test eax, eax
je 0x414573
mov eax, 0x7d1
call fcn.00406e2c
mov ebx, eax
lea eax, [ebp - 0x64]
xor ecx, ecx
mov edx, 0x44
call fcn.00402b1c
mov dword [ebp - 0x64], 0x44
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x38], 0x101
mov word [ebp - 0x34], 0
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x64]
push eax
push 0
push 0
push 0x20
push 0xffffffffffffffff
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
call fcn.00404298
push eax
push 0
call fcn.00405bb0
test eax, eax
je 0x414548
push 0x64
mov eax, dword [ebp - 0x74]
push eax
call fcn.00405d60
cmp eax, 0x102
je 0x4144e9
xor eax, eax
mov dword [ebp - 0x14], eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0x7d0
push ebx
mov eax, dword [ebp - 0xc]
push eax
call fcn.00405d18
test esi, esi
je 0x41453b
mov eax, dword [ebp - 0x14]
mov byte [ebx + eax], 0
push ebx
push ebx
call fcn.00405de8
lea eax, [ebp - 0x78]
mov edx, ebx
call fcn.00403fd0
mov edx, dword [ebp - 0x78]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
cmp dword [ebp - 0x14], 0x7d0
jae 0x4144fb
mov byte [ebp - 5], 1
mov eax, ebx
call fcn.00402658
mov eax, dword [ebp - 0x74]
push eax
call fcn.00405b80
mov eax, dword [ebp - 0x70]
push eax
call fcn.00405b80
mov eax, dword [ebp - 0xc]
push eax
call fcn.00405b80
mov eax, dword [ebp - 0x10]
push eax
call fcn.00405b80
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x414598
lea eax, [ebp - 0x78]
call fcn.00403dd8
lea eax, [ebp - 4]
call fcn.00403dd8
ret
Function at 0x416880
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x416888
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x416a4d
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x416a1b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
add eax, 4
mov edx, ebx
call fcn.00403e2c
push 0
push 0x80
push 3
push 0
push 1
push 0xc0000000
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00404298
push eax
call fcn.00405b98
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 8], ebx
cmp ebx, 0xffffffff
jne 0x416934
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea edx, [ebp - 0x18]
mov eax, 0x41625c
call fcn.00405818
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x1c]
mov eax, 0x416264
call fcn.00405818
mov eax, dword [ebp - 0x1c]
mov ecx, 1
pop edx
call fcn.00416218
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call fcn.00405c48
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x1c], ebx
push 0
push ebx
push 0
push 4
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call fcn.00405ba0
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], esi
test esi, esi
jne 0x4169ae
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea edx, [ebp - 0x20]
mov eax, 0x416244
call fcn.00405818
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x24]
mov eax, 0x416264
call fcn.00405818
mov eax, dword [ebp - 0x24]
mov ecx, 1
pop edx
call fcn.00416218
push 0
push 0
push 0
push 2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
call fcn.00405d00
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], ebx
test ebx, ebx
jne 0x416a11
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea edx, [ebp - 0x28]
mov eax, 0x41624c
call fcn.00405818
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x2c]
mov eax, 0x416264
call fcn.00405818
mov eax, dword [ebp - 0x2c]
mov ecx, 1
pop edx
call fcn.00416218
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x416a32
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x416a54
lea eax, [ebp - 0x2c]
mov edx, 6
call fcn.00403dfc
ret
Function at 0x416bdc
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov byte [ebp - 9], cl
mov esi, edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x416cfb
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
mov edx, esi
mov eax, dword [ebp - 8]
call fcn.004141d0
mov byte [ebp - 0xa], al
cmp byte [ebp - 0xa], 0
jne 0x416ce5
lea eax, [ebp - 4]
mov edx, esi
call fcn.00403e70
mov eax, esi
call fcn.00407558
inc eax
setne bl
movzx eax, byte [ebp - 9]
and al, bl
mov byte [ebp - 9], al
test bl, bl
je 0x416c56
mov eax, esi
call fcn.004075d0
mov edi, eax
test edi, 1
je 0x416c56
mov edx, edi
dec edx
mov eax, esi
call fcn.004075e4
cmp byte [ebp - 9], 0
je 0x416c68
lea eax, [ebp - 4]
call fcn.00414104
test al, al
je 0x416ce5
mov eax, esi
call fcn.00404298
push eax
call fcn.00405bc0
mov eax, esi
call fcn.00407558
inc eax
jne 0x416cb4
mov eax, esi
call fcn.00404298
push eax
mov eax, dword [ebp - 8]
call fcn.00404298
push eax
call fcn.00405d08
mov eax, esi
call fcn.00407558
inc eax
je 0x416caf
mov eax, dword [ebp - 8]
call fcn.00407558
inc eax
setne al
xor al, 1
jmp 0x416cb1
xor eax, eax
mov byte [ebp - 0xa], al
test bl, bl
je 0x416ccb
mov eax, esi
call fcn.00407558
inc eax
je 0x416ccb
mov edx, edi
mov eax, esi
call fcn.004075e4
test byte [ebp - 9], bl
je 0x416ce5
mov eax, dword [ebp - 4]
call fcn.00407558
inc eax
je 0x416ce5
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.004075e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x416d02
lea eax, [ebp - 4]
call fcn.00403dd8
ret