joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425565
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.004254e1
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x4256d4
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x4256d4
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x425689
jg 0x4255c1
test eax, eax
je 0x42567f
push 1
push 0x1000
call fcn.004165ab
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x4255e4
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x425676
push 0x8000
push ebx
call fcn.00413f59
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x42560d
jg 0x425608
cmp ecx, 0x1000
jb 0x42560d
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.00418d3b
add esp, 0x10
cmp eax, 0xffffffff
je 0x425652
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x425608
jl 0x425639
test ecx, ecx
jne 0x4255fa
push dword [ebp - 0xc]
push ebx
call fcn.00413f59
push esi
call fcn.00416608
add esp, 0xc
xor ebx, ebx
jmp 0x4256e2
cmp byte [edi + 0x24], 0
je 0x425669
cmp dword [edi + 0x20], 5
jne 0x425669
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x425674
mov ebx, dword [edi + 0x18]
jmp 0x425676
xor ebx, ebx
push esi
call fcn.00416608
pop ecx
jmp 0x4256e2
test ecx, ecx
jg 0x42564b
jl 0x425689
test eax, eax
jae 0x42564b
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0041a507
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x4256a9
cmp byte [edi + 0x1c], 0
je 0x42564b
jmp 0x4256da
push ebx
call fcn.0041eebc
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x42564b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x4256e2
cmp byte [edi + 0x1c], 0
je 0x4256df
mov ebx, dword [edi + 0x18]
jmp 0x4256e2
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.0041a507
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x425b60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x425b8d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x425b8d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10001de8
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [edx + 0x48]
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x10001e01
push dword [esp + 8]
push dword [esp + 8]
push edx
call ecx
add esp, 0xc
ret
push dword [eax + 0x38]
push dword [esp + 0xc]
push 1
push dword [esp + 0x10]
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
ret

Function at 0x10005305
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x10005333
push esi
call fcn.10009b3e
cmp dword [esi + 0x40], 0
pop ecx
je 0x1000532c
xor eax, eax
mov dword [esi + 0x14], 0xcf
inc eax
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x100053a3
mov eax, dword [esi + 0x1b4]
cmp dword [eax + 0x10], 0
je 0x10005395
mov eax, dword [esi + 8]
test eax, eax
je 0x10005354
push esi
call dword [eax]
pop ecx
mov eax, dword [esi + 0x1b4]
push esi
call dword [eax]
pop ecx
test eax, eax
je 0x10005391
cmp eax, 2
je 0x10005395
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x10005349
cmp eax, 3
je 0x10005378
cmp eax, 1
jne 0x10005349
inc dword [ecx + 4]
mov ecx, dword [ecx + 4]
mov eax, dword [esi + 8]
cmp ecx, dword [eax + 8]
jl 0x10005349
mov ecx, dword [esi + 0x140]
add dword [eax + 8], ecx
jmp 0x10005349
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
mov dword [esi + 0x98], eax
jmp 0x100053c1
cmp eax, 0xcc
je 0x100053c1
mov eax, dword [esi]
mov dword [eax + 0x14], 0x14
mov eax, dword [esi]
mov ecx, dword [esi + 0x14]
mov dword [eax + 0x18], ecx
mov eax, dword [esi]
push esi
call dword [eax]
pop ecx
call fcn.100051d0
pop esi
ret

Function at 0x1001c020
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call edi
sub eax, dword [esi + 0x289c]
push 1
cdq
sub eax, edx
sar eax, 1
mov dword [esi + 0x292c], eax
call edi
sub eax, dword [esi + 0x28a0]
cdq
sub eax, edx
sar eax, 1
mov dword [esi + 0x2930], eax
mov eax, dword [esi + 0x2d50]
test eax, eax
je 0x1001c08f
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esi + 0x28a0]
push dword [esi + 0x289c]
push dword [esi + 0x2930]
push dword [esi + 0x292c]
push dword [esi + 0x2d50]
call dword [sym.imp.USER32.dll_MoveWindow]
push esi
call fcn.1001c895
pop ecx
pop edi
pop esi
ret
Function at 0x1001c895
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x1001c8a4
pop dword [ebp - 0x1c]
mov eax, 0x5483cd18
add eax, 0xbb7dfb8c
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xdf9ca193
add dword [ebp - 0x2c], 0x6eb5a3b8
mov dword [ebp - 0x28], 0xb23c0a87
add dword [ebp - 0x28], 0x7ff741be
mov dword [ebp - 0x24], 0x9a4b60cc
sub dword [ebp - 0x24], 0x4dff1c9e
mov dword [ebp - 0x20], 0x64bd7223
add dword [ebp - 0x20], 0x9b428ddd
lea eax, [ebp - 0x2c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0xd8e7bf82
sub dword [ebp - 0x2c], 0x6475562c
mov dword [ebp - 0x28], 0xc86fa1fc
sub dword [ebp - 0x28], 0x87034087
mov dword [ebp - 0x24], 0x18bc1898
add dword [ebp - 0x24], 0x4ab353d4
mov dword [ebp - 0x20], 0x4672991d
add dword [ebp - 0x20], 0xb98d66e3
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x349d2
push 0
call eax
mov ecx, 0x987f7d84
sub ecx, 0x987f46cf
xor edx, edx
add edx, eax
mov ebx, 0xd86a75c2
add ebx, 0x37987c3e
add ebx, dword [ebp - 0x1c]
mov edi, 0xc73ac53f
sub edi, 0x38ce84b2
xor dword [ebp - 0xc], eax
mov esi, dword [ebx]
mov dword [ebp - 0x10], 0xc8289022
xor esi, edi
add dword [ebp - 0x14], 0x4b9089f8
mov dword [edx], esi
xor dword [ebp - 4], 0xf632e822
add edx, 0xc18c1cf5
sub edx, 0xc18c1cf1
add ebx, 0x27105664
sub ebx, 0x27105660
loop 0x1001c9be
add eax, 0x695b9f5b
sub eax, 0x695ad1b4
xor ebx, ebx
add ebx, eax
add eax, 0x5e5adf79
add eax, 0xa1a5208c
mov ecx, 0x8f056cc2
sub ecx, 0x7f056cc2
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x1001e4ea
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10029008]
jne 0x1001e4f4
repz ret
jmp fcn.1001ea43
Function at 0x402db0
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004043ec
test esi, esi
jne 0x402de7
push 0x105
lea eax, [esp + 8]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [esp + 4]
mov eax, ebx
call fcn.004044dc
jmp 0x402e08
call sub.kernel32.dll_GetCommandLineA
mov dword [esp], eax
mov edx, ebx
mov eax, dword [esp]
call fcn.00402c4c
mov dword [esp], eax
test esi, esi
je 0x402e08
cmp dword [ebx], 0
je 0x402e08
dec esi
jmp 0x402def
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0x4030ec
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x45d008], 0x8088405
inc edx
mov dword [ebx + 0x45d008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403544
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x45d024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4035dc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4035bc
xor eax, eax
push ebp
push 0x4035b5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4035f8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4035bc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x45d024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x45d024], ax
mov esp, ebp
pop ebp
ret

Function at 0x4041e4
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x46204c], 0
je 0x404245
cmp word [0x462220], 0xd7b2
jne 0x40420d
cmp dword [0x462228], 0
jbe 0x40420d
mov eax, 0x46221c
call dword [0x462238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x45d070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40426c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x45d034], 0
jne 0x404261
push 0
push 0x45d068
push 0x45d070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4043a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402a18
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x46204d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404368
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x40654c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4065b2
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.0040465c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00403108
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x40659c
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4065b9
lea eax, [ebp - 0x10]
call fcn.004043ec
ret

Function at 0x40b538
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b571
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004044dc
jmp 0x40b57a
mov eax, ebx
mov edx, esi
call fcn.00404440
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b584
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b5a5
mov al, byte [esp]
jmp 0x40b5a7
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40bc3c
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40baa4
mov eax, dword [0x461b28]
cmp byte [eax], 0
je 0x40bcb8
mov eax, dword [0x4618d0]
call fcn.00402f1c
call fcn.00402b78
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408d40
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40bd00
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40bcee
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x46187c]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x462668]
call fcn.004059ac
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40cba0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40cc04
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.0040465c
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00408684
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cc0b
lea eax, [ebp - 0xc]
call fcn.004043ec
ret

Function at 0x40dc58
Capabilities:
Hash data with md5

Disassembly:
push ebx
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
mov edx, 0x40
lea ecx, [eax + 0x18]
mov byte [ecx], 0
inc ecx
dec edx
jne 0x40dc6b
mov edx, 0x10
lea ecx, [eax + 0x58]
xor ebx, ebx
mov dword [ecx], ebx
add ecx, 4
dec edx
jne 0x40dc7a
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebx
ret

Function at 0x40eb44
Capabilities:
Hash data with md5

Disassembly:
push ebx
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
mov edx, 0x40
lea ecx, [eax + 0x18]
mov byte [ecx], 0
inc ecx
dec edx
jne 0x40eb57
mov edx, 0x10
lea ecx, [eax + 0x58]
xor ebx, ebx
mov dword [ecx], ebx
add ecx, 4
dec edx
jne 0x40eb66
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebx
ret

Function at 0x41a8d8
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.0041a704
dec esi
jne 0x41a8fa
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret

Function at 0x41bc6c
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, eax
xor ebx, ebx
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x41bcd1
push 1
call sub.user32.dll_GetClipboardData
mov esi, eax
test esi, esi
je 0x41bccc
push esi
call sub.kernel32.dll_GlobalLock
mov dword [esp], eax
cmp dword [esp], 0
je 0x41bccc
push esi
call sub.kernel32.dll_GlobalSize
mov esi, eax
test esi, esi
je 0x41bcc3
mov eax, edi
mov edx, esi
call fcn.004049f8
mov eax, edi
call fcn.00404920
mov ecx, esi
mov edx, dword [esp]
call fcn.00406ef4
mov bl, 1
mov eax, dword [esp]
push eax
call sub.kernel32.dll_GlobalUnlock
call sub.user32.dll_CloseClipboard
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x425238
Capabilities:
Reference http user-agent string

Disassembly:
push ebx
push esi
push edi
test dl, dl
je 0x425247
add esp, 0xfffffff0
call fcn.00403938
mov ebx, edx
mov edi, eax
xor edx, edx
mov eax, edi
call fcn.00424980
mov dl, 1
mov eax, dword [0x4166d0]
call fcn.00403680
mov dword [edi + 0x2c], eax
mov dl, 1
mov eax, dword [0x4166d0]
call fcn.00403680
mov dword [edi + 0x64], eax
mov dl, 1
mov eax, dword [0x416a14]
call fcn.00403680
mov dword [edi + 0x30], eax
mov dl, 1
mov eax, dword [0x41f5b8]
call fcn.00423e98
mov esi, eax
mov dword [edi + 0x1c], esi
mov dword [esi + 0x1c4], edi
mov byte [esi + 0x88], 1
mov eax, esi
mov edx, 0x10000
call fcn.0042229c
mov eax, dword [edi + 0x1c]
mov edx, 0x10000
call fcn.004222c4
mov dword [edi + 0x10], 0x493e0
lea eax, [edi + 8]
mov edx, 0x425364
call fcn.00404440
lea eax, [edi + 0x48]
call fcn.004043ec
lea eax, [edi + 0x4c]
mov edx, 0x425370
call fcn.00404440
lea eax, [edi + 0x50]
call fcn.004043ec
lea eax, [edi + 0x54]
call fcn.004043ec
lea eax, [edi + 0x24]
call fcn.004043ec
lea eax, [edi + 0x28]
call fcn.004043ec
lea eax, [edi + 0x38]
mov edx, 0x425380
call fcn.00404440
mov byte [edi + 0x3c], 1
mov byte [edi + 0x44], 0
lea eax, [edi + 0x60]
mov edx, 0x42538c
call fcn.00404440
xor eax, eax
mov dword [edi + 0x68], eax
xor eax, eax
mov dword [edi + 0x6c], eax
mov byte [edi + 0x78], 1
mov dword [edi + 0x40], 0x12c
mov eax, edi
call fcn.00425444
mov eax, edi
test bl, bl
je 0x425354
call fcn.00403990
pop dword fs:[0]
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x4271a8
Capabilities:
Enumerate pe sections
Get file size
Read file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe8
xor edx, edx
mov dword [esp], edx
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push eax
call sub.kernel32.dll_CreateFileW
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x4271e3
push 0
push 0x4272dc
push 0x4272e0
push 0
call sub.user32.dll_MessageBoxA_1
push 0
push ebp
call sub.kernel32.dll_GetFileSize
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
call fcn.00402a18
mov ebx, eax
push 0
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push eax
push ebx
push ebp
call sub.kernel32.dll_ReadFile
test eax, eax
jne 0x427224
push 0
push 0x4272dc
push 0x4272e4
push 0
call sub.user32.dll_MessageBoxA_1
mov dword [esp + 0xc], ebx
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 0x3c]
add eax, ebx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x50]
call fcn.00402a18
mov dword [esp], eax
mov eax, dword [esp + 0x10]
mov edx, dword [eax + 0x50]
mov eax, dword [esp]
call fcn.00406efc
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x54]
mov edx, ebx
mov eax, dword [esp]
call fcn.00406ef4
mov eax, dword [esp + 0x10]
mov si, word [eax + 6]
dec esi
test si, si
jb 0x4272bd
inc esi
xor edi, edi
mov edx, dword [esp + 0xc]
mov edx, dword [edx + 0x3c]
mov eax, ebx
add edx, eax
add edx, 0xf8
movzx ecx, di
shl ecx, 3
lea ecx, [ecx + ecx*4]
add edx, ecx
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x14]
mov ecx, dword [edx + 0x10]
mov edx, dword [esp + 0x14]
mov edx, dword [edx + 0x14]
add edx, eax
push edx
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 0xc]
add eax, dword [esp + 4]
pop edx
call fcn.00406ef4
inc edi
dec si
jne 0x427275
mov edx, dword [esp + 4]
mov eax, ebx
call fcn.00402a48
push ebp
call sub.kernel32.dll_CloseHandle
mov eax, dword [esp]
add esp, 0x18
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x427354
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
add esp, 0xffffffd8
mov dword [esp], edx
mov esi, eax
xor eax, eax
mov dword [esp + 4], eax
mov edx, dword [esi + 0x3c]
mov eax, esi
add edx, eax
mov dword [esp + 8], edx
mov edx, dword [esp + 8]
add edx, 0x78
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0xc]
mov edx, dword [edx]
add edx, eax
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
mov edx, dword [edx + 0x1c]
add edx, eax
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x10]
mov edx, dword [edx + 0x20]
add edx, eax
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x10]
mov edx, dword [edx + 0x24]
add edx, eax
mov dword [esp + 0x20], edx
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
mov ebx, dword [eax + 0x18]
dec ebx
test ebx, ebx
jb 0x42743e
inc ebx
mov eax, dword [esp + 0x20]
movzx edx, word [eax]
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x18], ecx
cmp edx, eax
jbe 0x4273e1
add dword [esp + 0x18], 4
inc eax
cmp edx, eax
ja 0x4273d7
mov edx, dword [esp + 0xc]
mov edx, dword [edx]
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
cmp edx, eax
ja 0x4273fc
mov ecx, dword [esp + 0xc]
add edx, dword [ecx + 4]
cmp eax, edx
jb 0x427431
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
add eax, esi
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
call fcn.00427094
mov ecx, eax
mov edx, dword [esp + 0x24]
xor eax, eax
call fcn.004270a8
cmp eax, dword [esp]
jne 0x427431
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
add eax, esi
mov dword [esp + 4], eax
jmp 0x42743e
add dword [esp + 0x20], 2
add dword [esp + 0x1c], 4
dec ebx
jne 0x4273c2
mov eax, dword [esp + 4]
add esp, 0x28
pop esi
pop ebx
ret
Function at 0x42c98c
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x42ca57
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.00432e04
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov ecx, 0x42ca6c
call fcn.00404714
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004343e0
test al, al
jne 0x42ca3c
push 0x208
call sub.ole32.dll_CoTaskMemAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x42ca1d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 7
mov eax, dword [ebp - 8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.004053c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42ca24
mov eax, dword [ebp - 8]
push eax
call sub.ole32.dll_CoTaskMemFree
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42ca5e
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404410
ret

Function at 0x42cb8c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor edx, edx
mov dword [ebp - 0x24], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42cc05
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1e]
mov edx, 0x1e
call fcn.00406efc
xor eax, eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], 3
lea eax, [ebp - 0x24]
mov ecx, 0x42cc18
mov edx, ebx
call fcn.00404c98
mov eax, dword [ebp - 0x24]
call fcn.00404c1c
mov dword [ebp - 0x16], eax
mov word [ebp - 0xe], 0xc14
lea eax, [ebp - 0x1e]
push eax
call sub.shell32.dll_SHFileOperationW
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42cc0c
lea eax, [ebp - 0x24]
call fcn.00404a8c
ret

Function at 0x42cc20
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor edx, edx
mov dword [ebp - 0x24], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42cc99
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1e]
mov edx, 0x1e
call fcn.00406efc
xor eax, eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], 3
lea eax, [ebp - 0x24]
mov ecx, 0x42ccb0
mov edx, ebx
call fcn.00404714
mov eax, dword [ebp - 0x24]
call fcn.004048c8
mov dword [ebp - 0x16], eax
mov word [ebp - 0xe], 0xc14
lea eax, [ebp - 0x1e]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42cca0
lea eax, [ebp - 0x24]
call fcn.004043ec
ret