joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a484
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
setge dl
mov eax, dword [ebp - 4]
call fcn.0041a148
cmp dword [ebp - 8], 1
jne 0x41a4b8
mov eax, dword [ebp - 4]
mov byte [eax + 0xe], 0
pop ecx
pop ecx
pop ebp
ret

Function at 0x41b4e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405290
push eax
call sub.kernel32.dll_GetFileAttributesA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x41b50a
test byte [ebp - 0xc], 0x10
sete byte [ebp - 5]
jmp 0x41b53b
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
je 0x41b532
cmp dword [ebp - 0x10], 3
je 0x41b532
cmp dword [ebp - 0x10], 0x7b
je 0x41b532
push ebp
mov eax, dword [ebp - 4]
call fcn.0041b494
pop ecx
test al, al
jne 0x41b536
xor eax, eax
jmp 0x41b538
mov al, 1
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret

Function at 0x41b544
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405290
push eax
call sub.kernel32.dll_GetFileAttributesA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x41b56a
test byte [ebp - 0xc], 0x10
jne 0x41b56e
xor eax, eax
jmp 0x41b570
mov al, 1
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret

Function at 0x41b5a4
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0041b57c
test al, al
je 0x41b5fd
cmp dword [ebp - 8], 0
je 0x41b5fd
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SystemTimeToFileTime
test eax, eax
je 0x41b5fd
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x14]
push eax
call sub.kernel32.dll_LocalFileTimeToFileTime
test eax, eax
je 0x41b5fd
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetFileTime
test eax, eax
jne 0x41b601
xor eax, eax
jmp 0x41b603
mov al, 1
mov byte [ebp - 9], al
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret
Function at 0x41bef0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
shl dword [ebp - 8], 2
cmp dword [ebp - 8], 4
jbe 0x41bf9e
mov eax, dword [ebp - 8]
and eax, 3
test eax, eax
jne 0x41bf9e
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.004054c4
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
call fcn.00403240
mov eax, dword [ebp - 0xc]
call fcn.004052f0
mov edx, dword [ebp - 8]
lea eax, [eax + edx - 4]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00405290
mov dword [ebp - 0x14], eax
xor eax, eax
mov al, byte [str.wW_r1_X]
sub dword [ebp - 0x18], eax
sub dword [ebp - 8], 4
mov eax, dword [ebp - 0x18]
and eax, 3
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
sub dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
xor dword [eax], edx
add dword [ebp - 0x10], 4
add dword [ebp - 0x14], 4
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 8]
jb 0x41bf79
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.004054c4
jmp 0x41bfa6
mov eax, dword [ebp - 0xc]
call fcn.00404de4
mov esp, ebp
pop ebp
ret

Function at 0x41c130
Capabilities:
Query service configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
call fcn.00404de4
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.00405290
push eax
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x41c1eb
push 1
mov eax, dword [ebp - 4]
call fcn.00405290
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x41c1e2
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_QueryServiceConfigA
mov eax, dword [ebp - 0x1c]
call fcn.00402fc8
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_QueryServiceConfigA
test eax, eax
je 0x41c1c6
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0xc]
call fcn.00404fdc
cmp dword [ebp - 0x18], 0
je 0x41c1d9
mov edx, 0x24
mov eax, dword [ebp - 0x18]
call fcn.00402ffc
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_CloseServiceHandle
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseServiceHandle
mov esp, ebp
pop ebp
ret
Function at 0x41c1f0
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov dword [ebp - 0x34], 1
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.00405290
push eax
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x41c2aa
push 0x14
mov eax, dword [ebp - 4]
call fcn.00405290
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x41c2a1
xor eax, eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_StartServiceA
test eax, eax
je 0x41c298
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x41c298
jmp 0x41c292
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_Sleep_2
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x41c298
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x18]
jb 0x41c298
cmp dword [ebp - 0x34], 4
jne 0x41c26a
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_CloseServiceHandle
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseServiceHandle
cmp dword [ebp - 0x34], 4
sete byte [ebp - 9]
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret
Function at 0x41c2bc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
xor edx, edx
mov dword [ebp - 0x12c], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x41c41a
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x12c]
mov eax, 0x4462c8
mov edx, 0xf
call fcn.0041bef0
mov edx, dword [ebp - 0x12c]
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 4]
call fcn.00405118
push 0x105
lea eax, [ebp - 0x125]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
call fcn.00405290
push eax
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
sete byte [ebp - 5]
cmp byte [ebp - 5], 0
je 0x41c3f4
lea eax, [ebp - 0x125]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x41c375
mov eax, dword [ebp - 0x20]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0x18]
mov eax, 0x4462a0
mov edx, 5
call fcn.0041bef0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x1c]
push eax
push 2
push 0
mov eax, dword [ebp - 0x18]
call fcn.00405290
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
jne 0x41c3e7
lea ecx, [ebp - 0x18]
mov eax, 0x4462b4
mov edx, 5
call fcn.0041bef0
push 4
push 0x446304
push 4
push 0
mov eax, dword [ebp - 0x18]
call fcn.00405290
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
sete byte [ebp - 5]
jmp 0x41c3eb
mov byte [ebp - 5], 0
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41c421
lea eax, [ebp - 0x12c]
call fcn.00404de4
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00404e08
ret

Function at 0x41c428
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x41c4b2
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov eax, 0x4462c8
mov edx, 0xf
call fcn.0041bef0
mov eax, dword [ebp - 0x10]
call fcn.00405290
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
mov eax, dword [ebp - 0x14]
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x41c498
mov eax, dword [ebp - 4]
call fcn.00405290
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete byte [ebp - 5]
jmp 0x41c49c
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41c4b9
lea eax, [ebp - 0x10]
call fcn.00404de4
ret
Function at 0x41c648
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x41c796
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x4c], 0
je 0x41c780
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xa
ja 0x41c69c
cmp byte [ebp - 5], 0
je 0x41c780
cmp dword [ebp - 0x18], 0
jbe 0x41c780
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x48]
call fcn.00404e7c
lea eax, [ebp - 0xc]
mov edx, 0x41c7ac
call fcn.00404e7c
push 0
push 0x8000000
push 4
push 0
push 1
push 0xc0000000
mov eax, dword [ebp - 0xc]
call fcn.00405290
push eax
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x41c780
cmp dword [ebp - 0x10], 0xffffffff
je 0x41c780
xor eax, eax
push ebp
push 0x41c779
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x41c721
mov eax, dword [ebp - 0x1c]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
push 2
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x41c757
push 0
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
call fcn.004052f0
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_WriteFile_1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
mov edx, dword [eax]
call dword [edx + 0x44]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41c780
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41c79d
lea eax, [ebp - 0xc]
call fcn.00404de4
ret

Function at 0x41c7c0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov al, byte [ebp - 9]
sub al, 3
jb 0x41c7da
sub al, 1
jne 0x41c7e5
xor eax, eax
mov al, byte [ebp - 9]
mov word [ebp - 0x16], ax
jmp 0x41c7eb
mov word [ebp - 0x16], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00405290
push eax
push 0
call sub.advapi32.dll_OpenEventLogA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x41c839
mov eax, dword [ebp - 8]
call fcn.00405290
mov dword [ebp - 0x14], eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push 1
push 0
push 1
push 0
mov ax, word [ebp - 0x16]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_ReportEventA
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseEventLog
mov esp, ebp
pop ebp
ret
Function at 0x41cde8
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 8]
add eax, 0xfffffedb
push eax
push 1
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x1c]
movzx eax, byte [eax + 0x45]
mov eax, dword [eax*4 + 0x446308]
push eax
push 0x10
push 0xf01ff
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x1c]
mov eax, dword [eax + 0xc]
call fcn.00405290
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x1c]
mov eax, dword [eax + 8]
call fcn.00405290
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x14]
push eax
call sub.advapi32.dll_CreateServiceA
mov edx, dword [ebp + 8]
mov dword [edx - 0x20], eax
mov eax, dword [ebp + 8]
cmp dword [eax - 0x20], 0
setne byte [ebp - 1]
mov al, byte [ebp - 1]
pop ecx
pop ebp
ret

Function at 0x41ce5c
Capabilities:
Get hostname
Query service status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
mov dword [ebp - 0x12c], edx
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x20], eax
push 0x105
lea eax, [ebp - 0x125]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA_1
mov dword [ebp - 0x134], 0x10
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x10]
push eax
call sub.kernel32.dll_GetComputerNameA
push ebp
call fcn.0041cd38
pop ecx
test al, al
je 0x41cf8a
xor eax, eax
push ebp
push 0x41cf83
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
call fcn.0041cd64
pop ecx
test al, al
je 0x41cf4e
push ebp
call fcn.0041cd8c
pop ecx
mov byte [ebp - 0x12d], al
cmp dword [ebp - 0x12c], 0
jne 0x41cf26
cmp byte [ebp - 0x12d], 0
je 0x41cf4e
lea eax, [ebp - 0x150]
push eax
mov eax, dword [ebp - 0x20]
push eax
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x41cf4e
cmp dword [ebp - 0x14c], 1
jne 0x41cf4e
push ebp
call fcn.0041cdc8
pop ecx
test al, al
je 0x41cf4e
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 8]
call fcn.0041c428
jmp 0x41cf4e
cmp dword [ebp - 0x12c], 1
jne 0x41cf4e
cmp byte [ebp - 0x12d], 0
jne 0x41cf4e
push ebp
call fcn.0041cde8
pop ecx
test al, al
je 0x41cf4e
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 8]
call fcn.0041c2bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41cf8a
cmp dword [ebp - 0x20], 0
je 0x41cf6a
mov eax, dword [ebp - 0x20]
push eax
call sub.advapi32.dll_CloseServiceHandle
cmp dword [ebp - 0x18], 0
je 0x41cf79
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_UnlockServiceDatabase
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
mov esp, ebp
pop ebp
ret
Function at 0x42775c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
xor eax, eax
push ebp
push 0x42789f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xbb8
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x1c]
mov eax, 0x446508
mov edx, 0xa
call fcn.0041bef0
mov dword [ebp - 0xc], 1
lea ecx, [ebp - 0x20]
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
call fcn.0041b980
mov eax, dword [ebp - 0x20]
call fcn.00405290
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x427884
xor eax, eax
push ebp
push 0x42787d
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x20]
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
call fcn.0041b980
mov eax, dword [ebp - 0x20]
call fcn.00405290
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x42785b
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x34]
shl eax, 3
lea eax, [eax + eax*2]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
call fcn.00402fe0
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov edx, dword [ebp - 0x14]
call fcn.004036d8
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 0
push 0
push 0xb
call dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x42785b
mov eax, dword [ebp - 0x10]
cmp dword [eax + 4], 0
jbe 0x42785b
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x427884
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
call fcn.00402ffc
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4278a6
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00404e08
ret
Function at 0x42faf8
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x42fc27
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
call fcn.00404de4
mov eax, dword [ebp - 0xc]
call fcn.0041b4e0
test al, al
je 0x42fc05
mov al, byte [ebp - 5]
sub al, 2
jae 0x42fbc7
lea eax, [ebp - 0x18]
xor edx, edx
mov dl, byte [ebp - 5]
mov ecx, dword [0x446c0c]
mov edx, dword [ecx + edx*4]
call fcn.00404fdc
mov edx, dword [ebp - 0x18]
lea ecx, [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.0040b1c8
mov eax, dword [ebp - 0x14]
call fcn.0041b4e0
test al, al
je 0x42fb86
mov eax, dword [ebp - 0x14]
call fcn.00405290
push eax
call sub.kernel32.dll_DeleteFileA
mov eax, dword [ebp - 0x14]
call fcn.00405290
push eax
mov eax, dword [ebp - 0xc]
call fcn.00405290
push eax
call sub.kernel32.dll_MoveFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x42fbc7
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
call fcn.0040e8bc
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
call fcn.00404e38
jmp 0x42fc0c
cmp byte [ebp - 5], 2
jne 0x42fc0c
mov eax, dword [ebp - 0xc]
call fcn.00405290
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x42fc0c
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0x10]
call fcn.0040e8bc
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp + 8]
call fcn.00404e38
jmp 0x42fc0c
mov dword [ebp - 0x10], 2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42fc2e
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00404e08
ret
Function at 0x431ff8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4320f2
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.0040ac5c
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x43203d
mov eax, dword [ebp - 0x24]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 9
jne 0x4320d8
mov eax, dword [ebp + 8]
call fcn.004052f0
add eax, 2
push eax
lea eax, [ebp - 0x14]
call fcn.004052f0
mov ecx, 9
pop edx
call fcn.00403240
push 1
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetFilePointer
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
add eax, 2
mov dword [ebp - 0x18], eax
push 0
push 0
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x4320c6
push 0
lea eax, [ebp - 0x1c]
push eax
push 9
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
je 0x4320c6
push 0
push 0
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetFilePointer
cmp eax, 0xffffffff
jne 0x4320d2
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x14], 0x1d
jmp 0x4320d8
mov byte [ebp - 0xd], 1
jmp 0x4320dc
mov byte [ebp - 0xd], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4320f9
lea eax, [ebp - 0x14]
call fcn.00404de4
ret

Function at 0x432104
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
dec dword [eax + 8]
push 1
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetFilePointer
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x432177
push 0
lea eax, [ebp - 0x14]
push eax
push 1
push 0x4468a0
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
je 0x432177
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetFilePointer
cmp eax, 0xffffffff
jne 0x432183
mov eax, dword [ebp - 8]
mov dword [eax + 0x14], 0x1d
jmp 0x43218b
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x14], edx
mov esp, ebp
pop ebp
ret
Function at 0x432d78
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0xffffffff
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 8], 0
je 0x432ed7
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x44]
xor eax, eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x432ed0
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
mov eax, dword [ebp - 4]
call fcn.00405290
push eax
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x432e9d
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetFileSize
xor edx, edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 0
jne 0x432e04
cmp dword [ebp - 0x18], 0xffffffff
je 0x432e9d
cmp dword [ebp - 0x14], 0
jne 0x432e1a
cmp dword [ebp - 0x18], 0
je 0x432e9d
mov dl, 1
mov eax, dword [0x415aa4]
call fcn.00403fb0
mov dword [ebp - 0x20], eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
call fcn.0041870c
push 1
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_SetFilePointer
mov dword [ebp - 0x1c], eax
push 0
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 4]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x432e9d
mov dl, 1
mov eax, dword [0x4157a0]
call fcn.00403fb0
mov dword [ebp - 0x24], eax
push 0
push 0
mov eax, dword [ebp - 0x20]
call fcn.00418694
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x6c]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x24]
call fcn.00432a94
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x432ed7
lea eax, [ebp - 0x20]
call fcn.0041b40c
lea eax, [ebp - 0x24]
call fcn.0041b40c
mov eax, dword [ebp - 0x10]
call fcn.0041b57c
test al, al
je 0x432ecf
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
ret
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret