joyce8/EMBER2024-capa huggingface dataset:
Function at 0x300027e8
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, dword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x3000282f
push eax
call edi
test eax, eax
je 0x3000280c
inc esi
mov al, byte [esi + 1]
inc esi
cmp al, 0x22
je 0x3000281a
test al, al
je 0x3000281b
jmp 0x30002804
inc esi
mov al, byte [esi]
test al, al
je 0x30002841
cmp al, 0x20
ja 0x30002841
push eax
call edi
test eax, eax
je 0x3000281a
inc esi
jmp 0x3000281a
cmp al, 0x20
jbe 0x3000281b
push eax
call edi
test eax, eax
je 0x3000283b
inc esi
mov al, byte [esi + 1]
inc esi
jmp 0x3000282f
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
xor eax, eax
cmp dword [ebp - 0x2c], 0xffffffff
sete al
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x3000290b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push 0x300028da
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x30002952
push esi
push esi
push esi
push esi
push 0x30002902
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
push dword [ebp - 4]
neg esi
sbb esi, esi
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret

Function at 0x30002f83
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x49c
push esi
call fcn.3000395c
test eax, eax
jne 0x30003058
mov eax, dword [0x300022c4]
push 0xf06
push 0xa
call dword [eax + 0xec]
test eax, eax
je 0x30003058
lea eax, [ebp - 0x49c]
push 7
xor esi, esi
push eax
mov eax, dword [0x300022c4]
push esi
push esi
push 0x55
call dword [eax + 0xe8]
test eax, eax
je 0x30003058
lea eax, [ebp - 0x15c]
push edi
push eax
lea eax, [ebp - 0x49c]
push eax
mov eax, dword [0x300022c4]
call dword [eax + 0x14]
lea eax, [ebp - 0x294]
push eax
lea eax, [ebp - 0x15c]
push eax
mov eax, dword [0x300022c4]
call dword [eax + 0x24]
push eax
mov eax, dword [0x300022c4]
push 0x30002f7c
call dword [eax + 0x24]
xor eax, eax
lea edi, [ebp - 0x54]
push 0x11
pop ecx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x54], 0x44
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push 0x4000020
push esi
push esi
lea eax, [ebp - 0x294]
push esi
push eax
lea eax, [ebp - 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
pop edi
jne 0x30003058
push 0x10
pop edx
push 0xa
pop ecx
call fcn.300045a4
pop esi
leave
ret
Function at 0x3000379c
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
push ebx
push edi
xor edi, edi
mov ebx, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call fcn.30003537
push edi
call dword [sym.imp.ole32.dll_OleInitialize]
test eax, eax
jne 0x3000394d
push esi
lea eax, [ebp - 0x220]
mov esi, 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x11c]
push eax
push edi
lea eax, [ebp - 0x220]
push 0x3000378e
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [ebp - 0x428]
push esi
push eax
lea eax, [ebp - 0x11c]
push 0xffffffffffffffff
push eax
push 1
push edi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x10]
push eax
push edi
lea eax, [ebp - 0x428]
push 0x11022
push eax
call dword [sym.imp.ole32.dll_StgCreateDocfile]
test eax, eax
je 0x30003834
mov dword [ebp - 0x10], edi
mov eax, dword [ebp - 0x10]
cmp eax, edi
je 0x30003858
mov ecx, dword [eax]
lea edx, [ebp - 0x18]
push edx
push edi
push edi
push 0x1012
push 0x30003792
push eax
call dword [ecx + 0xc]
test eax, eax
je 0x30003858
mov dword [ebp - 0x18], edi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.ole32.dll_CreateFileMoniker]
test eax, eax
je 0x30003870
mov dword [ebp - 0xc], edi
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.ole32.dll_GetRunningObjectTable]
test eax, eax
je 0x30003882
mov dword [ebp - 4], edi
push 8
call fcn.30005930
cmp eax, edi
pop ecx
je 0x30003899
mov ecx, eax
call fcn.300033fc
mov esi, eax
jmp 0x3000389b
xor esi, esi
mov eax, dword [ebp - 4]
cmp eax, edi
je 0x300038b8
mov ecx, dword [eax]
lea edx, [ebp - 8]
push edx
push dword [ebp - 0xc]
push esi
push edi
push eax
call dword [ecx + 0xc]
test eax, eax
je 0x300038b8
mov dword [ebp - 8], edi
lea eax, [ebp - 0x14]
push eax
push 1
push 4
push esi
push 0x300070a0
call dword [sym.imp.ole32.dll_CoRegisterClassObject]
test eax, eax
je 0x300038d3
mov dword [ebp - 0x14], edi
push esi
push ebx
call dword [sym.imp.ole32.dll_RegisterDragDrop]
test eax, eax
pop esi
jne 0x300038e7
push ebx
call dword [sym.imp.ole32.dll_RevokeDragDrop]
cmp dword [ebp - 0x14], edi
je 0x300038f5
push dword [ebp - 0x14]
call dword [sym.imp.ole32.dll_CoRevokeClassObject]
mov eax, dword [ebp - 4]
cmp eax, edi
je 0x30003913
cmp dword [ebp - 8], edi
je 0x3000390d
push dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0xc]
cmp eax, edi
je 0x30003920
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x18]
cmp eax, edi
je 0x3000392d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
cmp eax, edi
je 0x3000393a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call dword [sym.imp.ole32.dll_OleUninitialize]
pop edi
pop ebx
leave
ret
Function at 0x30004532
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
lea eax, [ebp - 4]
push esi
push eax
push esi
push 0x10
mov dword [ebp - 4], esi
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
cmp dword [ebp - 4], esi
jne 0x3000457e
push 7
pop edx
push 9
pop ecx
call fcn.300045a4
call dword [sym.imp.KERNEL32.dll_GetVersion]
shr eax, 0x10
test ah, 0x80
push 1
je 0x30004577
push 0x30004506
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x300045a1
push 0x3000451e
jmp 0x3000456f
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push 0xf140
push 0x112
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
pop esi
leave
ret
Function at 0x30005648
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
push ebx
and dword [ebp - 8], 0
push esi
push edi
mov edi, edx
or ebx, 0xffffffff
mov edx, ecx
xor eax, eax
mov ecx, ebx
lea esi, [ebp - 0x11c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 4], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 4]
push 0x20
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x11c]
mov ecx, ebx
repne scasb al, byte es:[edi]
dec edi
mov esi, 0x30005646
movsw word es:[edi], word [esi]
mov edi, edx
mov ecx, ebx
repne scasb al, byte es:[edi]
lea esi, [ebp - 0x11c]
not ecx
mov eax, esi
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, eax
mov ecx, ebx
xor eax, eax
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x1a4]
mov ecx, edx
push eax
and ecx, 3
lea eax, [ebp - 0x11c]
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_OpenFile]
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x30005733
xor edi, edi
lea ecx, [ebp - 8]
push edi
push ecx
lea ecx, [ebp - 0x18]
push 0x10
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor esi, esi
cmp dword [0x300073f0], edi
jbe 0x3000572a
mov eax, dword [0x300073f4]
add eax, edi
push dword [eax + 8]
lea edx, [eax + 0xc]
mov eax, dword [eax + 4]
lea ecx, [ebp + eax - 0x18]
call fcn.30005772
test eax, eax
je 0x3000573c
inc esi
add edi, 0x1c
cmp esi, dword [0x300073f0]
jb 0x30005701
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
imul esi, esi, 0x1c
mov eax, dword [0x300073f4]
mov ecx, ebx
push dword [ebp - 4]
mov edi, dword [esi + eax]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [ebp + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop eax
jmp 0x30005735
Function at 0x30005818
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
xor ebx, ebx
lea edi, [esi + 0x2ba]
cmp edi, ebx
je 0x30005928
cmp word [edi], bx
je 0x30005928
cmp word [esi + 0xb2], bx
lea eax, [esi + 0xb2]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
je 0x30005863
push eax
mov eax, dword [0x300022c4]
call dword [eax + 0x4c]
mov dword [ebp - 0xc], eax
cmp word [esi + 0x4c2], bx
lea eax, [esi + 0x4c2]
je 0x3000587e
push eax
mov eax, dword [0x300022c4]
call dword [eax + 0x4c]
mov dword [ebp - 8], eax
add esi, 0x502
cmp word [esi], bx
je 0x300058b3
mov eax, dword [0x300022c4]
push esi
call dword [eax + 0x4c]
cmp word [esi], bx
mov dword [ebp - 4], eax
je 0x300058b3
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
push eax
call fcn.300052f0
test eax, eax
je 0x300058b3
mov dword [ebp - 0x10], 1
jmp 0x300058f3
mov eax, dword [0x300022c4]
push edi
call dword [eax + 0x4c]
mov edi, eax
push 1
push edi
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x1f
jbe 0x300058ea
cmp word [esi], bx
je 0x300058e3
push dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
call fcn.300052f0
test eax, eax
je 0x300058ea
mov dword [ebp - 0x10], 1
mov eax, dword [0x300022c4]
push edi
call dword [eax + 0x28]
cmp dword [ebp - 4], ebx
je 0x30005903
push dword [ebp - 4]
mov eax, dword [0x300022c4]
call dword [eax + 0x28]
cmp dword [ebp - 8], ebx
je 0x30005913
push dword [ebp - 8]
mov eax, dword [0x300022c4]
call dword [eax + 0x28]
cmp dword [ebp - 0xc], ebx
je 0x30005923
push dword [ebp - 0xc]
mov eax, dword [0x300022c4]
call dword [eax + 0x28]
mov eax, dword [ebp - 0x10]
jmp 0x3000592a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..idata
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x431072
nop
nop
nop
mov ebx, 0x40915c
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x5810c45
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x431060
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4310d2
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x54561ae7
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x4017a8
Capabilities:
Create directory

Disassembly:
push ebp
sub esp, 0x7c
lea ebp, [esp - 4]
mov eax, dword [0x42c648]
xor eax, ebp
mov dword [ebp + 0x7c], eax
push 0x170
mov eax, 0x422308
call fcn.0041273b
xor ebx, ebx
mov edi, ecx
mov dword [ebp - 4], ebx
push 0x4262b0
lea ecx, [ebp + 0x44]
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x10], ebx
call fcn.0040219b
xor esi, esi
inc esi
push 0x4262b8
lea ecx, [ebp + 0x28]
mov dword [ebp - 4], esi
call fcn.0040219b
lea eax, [ebp + 0xc]
push eax
mov byte [ebp - 4], 2
call fcn.004044b1
push eax
push edi
lea edx, [ebp + 0x44]
lea ecx, [ebp + 0x28]
mov byte [ebp - 4], 3
call main
add esp, 0xc
push ebx
push esi
lea ecx, [ebp + 0xc]
mov dword [ebp - 0x10], esi
call fcn.00402da4
push ebx
push esi
lea ecx, [ebp + 0x28]
call fcn.00402da4
push ebx
push esi
lea ecx, [ebp + 0x44]
mov byte [ebp - 4], bl
call fcn.00402da4
cmp dword [edi + 0x14], 0x10
jb 0x401845
mov eax, dword [edi]
jmp 0x401847
mov eax, edi
push eax
lea ecx, [ebp + 0x60]
call fcn.0040219b
lea ecx, [ebp + 0x60]
mov dword [ebp - 4], 4
call main
push ebx
push esi
lea ecx, [ebp + 0x60]
mov byte [ebp - 4], bl
call fcn.00402da4
mov ebx, str.D:_A__FA___BA_
lea esi, [ebp - 0xe4]
call fcn.0040151b
mov ecx, esi
lea edx, [ebp - 0x38]
mov dword [ebp - 4], 5
call fcn.0040be07
mov eax, esi
mov byte [ebp - 4], 7
call fcn.00401592
mov eax, dword [ebp - 0x38]
and dword [ebp - 0x14], 0
cmp dword [edi + 0x14], 0x10
mov dword [ebp - 0x1c], 0xc
mov dword [ebp - 0x18], eax
jb 0x4018b3
mov eax, dword [edi]
jmp 0x4018b5
mov eax, edi
mov esi, dword [sym.imp.kernel32.dll_CreateDirectoryA]
lea ecx, [ebp - 0x1c]
push ecx
push eax
call esi
test eax, eax
jne 0x40196d
push 0x426388
mov dword [ebp - 0x28], str.c:_ade_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u241_331_install_src_windows_wrappers_wrapper4wrapper_wrapper4wrapper.cpp
mov dword [ebp - 0x24], str._anonymous_namespace::createSecureDirectory
mov dword [ebp - 0x20], 0x22
lea ebx, [ebp - 0x28]
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push esi
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x3c], esp
push edi
call fcn.0040217a
lea eax, [ebp - 0x17c]
push eax
mov byte [ebp - 4], 8
call fcn.004024e5
lea eax, [ebp - 0x17c]
push 0x426398
push eax
mov byte [ebp - 4], 9
call fcn.004038bf
pop ecx
pop ecx
lea esi, [ebp - 0x17c]
mov byte [ebp - 4], 0xa
call fcn.004037f7
mov esi, eax
push 0x4263ac
push esi
call fcn.004038bf
pop ecx
pop ecx
mov ecx, esi
lea edi, [ebp - 0x4c]
call fcn.00406994
lea ecx, [ebp]
push ecx
mov esi, ebx
mov ecx, eax
mov byte [ebp - 4], 0xb
call fcn.00403827
lea eax, [ebp]
mov dword [esp], 0x428d3c
push eax
call main
cmp dword [ebp - 0x38], 0
je 0x40197c
push dword [ebp - 0x38]
call main
pop ecx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x7c]
xor ecx, ebp
call fcn.0040d6f4
sub ebp, 0xffffff80
leave
ret
Function at 0x4044b1
Capabilities:
Get common file path

Disassembly:
push 0x38
mov eax, 0x420eb7
call fcn.004127a4
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x40], eax
mov eax, 0x104
lea esi, [ebp - 0x3c]
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
call fcn.00404736
mov dword [ebp - 4], ebx
mov esi, dword [ebp - 0x38]
push dword [ebp - 0x3c]
sub esi, dword [ebp - 0x3c]
mov edi, dword [sym.imp.kernel32.dll_GetTempPathA]
push esi
call edi
cmp eax, esi
jbe 0x40450b
lea esi, [ebp - 0x3c]
call fcn.00404736
mov eax, dword [ebp - 0x38]
push dword [ebp - 0x3c]
sub eax, dword [ebp - 0x3c]
push eax
call edi
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x2c]
call fcn.0040219b
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00406ebb
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.00402da4
lea esi, [ebp - 0x3c]
call fcn.00402f46
mov eax, dword [ebp - 0x40]
call fcn.00412827
ret

Function at 0x406c53
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [eax + 0x14], 0x10
jb 0x406c5b
mov eax, dword [eax]
push eax
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne al
ret

Function at 0x406c6b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [eax + 0x14], 0x10
jb 0x406c73
mov eax, dword [eax]
push eax
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x406c87
test al, 0x10
je 0x406c87
xor eax, eax
inc eax
ret
xor eax, eax
ret
Function at 0x407468
Capabilities:
Create directory

Disassembly:
push 0xe4
mov eax, 0x422279
call fcn.004127a4
mov eax, dword [ebp + 0x24]
mov edi, ecx
mov dword [ebp - 0x3c], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0x1c], 0x10
mov eax, dword [ebp + 8]
jae 0x407490
lea eax, [ebp + 8]
mov esi, dword [sym.imp.kernel32.dll_CreateDirectoryA]
push edi
push eax
call esi
test eax, eax
je 0x407572
cmp dword [0x42eb64], ebx
jg 0x407548
sub esp, 0x1c
lea eax, [ebp + 8]
mov esi, esp
mov dword [ebp - 0x40], esp
push eax
call fcn.0040217a
lea eax, [ebp - 0xf0]
push eax
mov byte [ebp - 4], 1
call fcn.004024e5
lea eax, [ebp - 0xf0]
push 0x426b7c
push eax
mov byte [ebp - 4], 2
call fcn.004038bf
pop ecx
pop ecx
lea esi, [ebp - 0xf0]
mov byte [ebp - 4], 3
call fcn.004037f7
mov esi, eax
push 0x426c34
push esi
call fcn.004038bf
pop ecx
pop ecx
lea eax, [ebp - 0x2c]
push eax
mov ecx, esi
call main
push 0x426c40
push 0x1ce
push 0x426b08
push ebx
mov edx, eax
mov ecx, 0x42eb64
mov byte [ebp - 4], 4
call fcn.0040af44
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.00402da4
lea eax, [ebp - 0xf0]
mov byte [ebp - 4], bl
call fcn.00401592
mov edi, dword [ebp - 0x3c]
cmp edi, ebx
je 0x40758b
lea edx, [ebp + 8]
lea eax, [ebp - 0x2c]
call fcn.00406ebb
mov ecx, eax
mov byte [ebp - 4], 5
call fcn.00403279
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.00402da4
jmp 0x40758b
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [ebp - 0x3c], eax
cmp edi, ebx
jne 0x40759c
lea eax, [ebp + 8]
call fcn.00406c6b
test al, al
je 0x40759c
push ebx
push 1
lea ecx, [ebp + 8]
call fcn.00402da4
call fcn.00412827
ret
push 0x426388
push dword [ebp - 0x3c]
lea eax, [ebp + 8]
push esi
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x40], esp
push eax
mov dword [ebp - 0x4c], 0x426b08
mov dword [ebp - 0x48], 0x426c40
mov dword [ebp - 0x44], 0x1d7
lea ebx, [ebp - 0x4c]
call fcn.0040217a
lea eax, [ebp - 0xf0]
push eax
mov byte [ebp - 4], 6
call fcn.004024e5
lea eax, [ebp - 0xf0]
push 0x426398
push eax
mov byte [ebp - 4], 7
call fcn.004038bf
pop ecx
pop ecx
lea esi, [ebp - 0xf0]
mov byte [ebp - 4], 8
call fcn.004037f7
mov esi, eax
push 0x4263ac
push esi
call fcn.004038bf
pop ecx
pop ecx
mov ecx, esi
lea edi, [ebp - 0x58]
call fcn.00406994
lea ecx, [ebp - 0x38]
push ecx
mov esi, ebx
mov ecx, eax
mov byte [ebp - 4], 9
call fcn.00403827
lea eax, [ebp - 0x38]
mov dword [esp], 0x428d3c
push eax
call main
int3
Function at 0x407c26
Capabilities:
Delete file

Disassembly:
push 0xbc
mov eax, 0x4219a9
call fcn.004127a4
cmp dword [edi + 0x14], 0x10
jb 0x407c3f
mov eax, dword [edi]
jmp 0x407c41
mov eax, edi
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
test eax, eax
setne al
test al, al
je 0x407d00
cmp dword [0x42eb64], 0
jg 0x407cfc
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x30], esp
push edi
call fcn.0040217a
and dword [ebp - 4], 0
lea eax, [ebp - 0xc8]
push eax
call fcn.004024e5
lea eax, [ebp - 0xc8]
push 0x426d14
push eax
mov byte [ebp - 4], 1
call fcn.004038bf
pop ecx
pop ecx
lea esi, [ebp - 0xc8]
mov byte [ebp - 4], 2
call fcn.004037f7
mov esi, eax
push 0x426b90
push esi
call fcn.004038bf
pop ecx
pop ecx
lea eax, [ebp - 0x2c]
push eax
mov ecx, esi
call main
push 0x426d20
push 0x25e
push 0x426b08
push 0
mov edx, eax
mov ecx, 0x42eb64
mov byte [ebp - 4], 3
call fcn.0040af44
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00402da4
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0xc8]
call fcn.00401592
mov al, 1
jmp 0x407d0f
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.00407c11
add esp, 4
call fcn.00412827
ret
Function at 0x409141
Capabilities:
Write file on windows

Disassembly:
push 0x34
mov eax, 0x420d82
call fcn.004127a4
mov eax, dword [ebp + 8]
mov ebx, ecx
mov dword [ebp - 0x38], ebx
cmp eax, 0xffffffff
jne 0x409164
xor eax, eax
call fcn.00412827
ret 4
mov ecx, dword [ebx + 0x24]
mov edx, dword [ecx]
xor esi, esi
cmp edx, esi
je 0x40918a
mov ecx, dword [ebx + 0x34]
mov edi, dword [ecx]
add edi, edx
cmp edx, edi
jae 0x40918a
dec dword [ecx]
mov ebx, dword [ebx + 0x24]
mov ecx, dword [ebx]
lea edx, [ecx + 1]
mov dword [ebx], edx
mov byte [ecx], al
jmp 0x40915c
cmp dword [ebx + 0x54], esi
jne 0x409194
or eax, 0xffffffff
jmp 0x40915c
mov eax, ebx
call fcn.00409c00
cmp dword [ebx + 0x44], esi
jne 0x4091b9
movsx eax, byte [ebp + 8]
push dword [ebx + 0x54]
push eax
call fcn.0040fd16
pop ecx
pop ecx
cmp eax, 0xffffffff
je 0x40918f
mov eax, dword [ebp + 8]
jmp 0x40915c
mov al, byte [ebp + 8]
push esi
push 8
pop edi
lea esi, [ebp - 0x2c]
mov byte [ebp - 0x2d], al
call fcn.0040979e
and dword [ebp - 4], 0
lea eax, [ebx + 0x4c]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x409276
lea eax, [ebp - 0x2c]
mov edx, eax
mov ecx, dword [ebx + 0x44]
mov esi, dword [ecx]
lea edi, [ebp - 0x34]
push edi
mov edi, dword [ebp - 0x1c]
add edi, eax
push edi
push edx
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x2d]
push eax
push dword [ebp - 0x40]
call dword [esi + 0x14]
test eax, eax
js 0x40929e
cmp eax, 1
jg 0x40927e
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x409222
lea eax, [ebp - 0x2c]
mov esi, dword [ebp - 0x34]
sub esi, eax
je 0x409248
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x409235
lea eax, [ebp - 0x2c]
push dword [ebx + 0x54]
push esi
push 1
push eax
call fcn.00410860
add esp, 0x10
cmp esi, eax
jne 0x40929e
lea eax, [ebp - 0x2d]
mov byte [ebx + 0x49], 1
cmp dword [ebp - 0x3c], eax
jne 0x409299
test esi, esi
jne 0x4091d5
cmp dword [ebp - 0x1c], 0x20
jae 0x40929e
push esi
push 8
pop ebx
lea esi, [ebp - 0x2c]
call fcn.00404793
mov ebx, dword [ebp - 0x38]
jmp 0x4091d5
mov edx, dword [ebp - 0x2c]
jmp 0x4091e7
cmp eax, 3
jne 0x40929e
movsx eax, byte [ebp - 0x2d]
push dword [ebx + 0x54]
push eax
call fcn.0040fd16
or esi, 0xffffffff
pop ecx
pop ecx
cmp eax, esi
je 0x4092a1
mov esi, dword [ebp + 8]
jmp 0x4092a1
or esi, 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00402da4
mov eax, esi
jmp 0x40915c
Function at 0x409b08
Capabilities:
Write file on windows

Disassembly:
push 0x2c
mov eax, 0x420d55
call fcn.004127a4
mov ebx, ecx
cmp dword [ebx + 0x44], 0
mov dword [ebp - 0x34], ebx
je 0x409bf8
cmp byte [ebx + 0x49], 0
je 0x409bf8
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x409b40
xor al, al
jmp 0x409bfa
push 0
push 8
pop edi
lea esi, [ebp - 0x2c]
call fcn.0040979e
and dword [ebp - 4], 0
lea eax, [ebx + 0x4c]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x409b97
lea eax, [ebp - 0x2c]
mov edx, eax
add eax, dword [ebp - 0x1c]
mov ecx, dword [ebx + 0x44]
mov esi, dword [ecx]
lea edi, [ebp - 0x30]
push edi
push eax
push edx
push dword [ebp - 0x38]
call dword [esi + 0x18]
xor edi, edi
sub eax, edi
je 0x409b9c
dec eax
je 0x409ba0
dec eax
dec eax
je 0x409bf4
xor bl, bl
push edi
push 1
lea ecx, [ebp - 0x2c]
call fcn.00402da4
mov al, bl
jmp 0x409bfa
mov edx, dword [ebp - 0x2c]
jmp 0x409b65
mov byte [ebx + 0x49], 0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x409bac
lea eax, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, eax
je 0x409bd2
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x409bbf
lea eax, [ebp - 0x2c]
push dword [ebx + 0x54]
push esi
push 1
push eax
call fcn.00410860
add esp, 0x10
cmp esi, eax
jne 0x409b86
cmp byte [ebx + 0x49], 0
je 0x409bf4
cmp esi, edi
jne 0x409b57
push edi
push 8
pop ebx
lea esi, [ebp - 0x2c]
call fcn.00404793
mov ebx, dword [ebp - 0x34]
jmp 0x409b57
mov bl, 1
jmp 0x409b88
mov al, 1
call fcn.00412827
ret