joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d3750
Capabilities:
Get local ipv4 addresses

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d384d
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
xor ebx, ebx
mov esi, 6
lea eax, [ebp - 0x10]
push eax
push ebx
push 0
push 0
push 2
call sub.iphlpapi.dll_GetAdaptersAddresses
mov edi, eax
cmp edi, 0x6f
jne 0x4d37b6
test ebx, ebx
je 0x4d37a0
mov eax, ebx
call fcn.00404204
mov eax, dword [ebp - 0x10]
call fcn.004041e8
mov ebx, eax
test ebx, ebx
jne 0x4d37b3
call fcn.004185bc
dec esi
jne 0x4d377e
test edi, edi
jne 0x4d380b
mov esi, ebx
test esi, esi
je 0x4d382c
cmp dword [esi + 0x40], 0x18
je 0x4d37cc
cmp byte [esi + 0x44], 1
je 0x4d37d1
mov esi, dword [esi + 8]
jmp 0x4d3805
mov edi, dword [esi + 0x10]
test edi, edi
je 0x4d3802
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov ecx, dword [edi + 0xc]
mov ecx, dword [ecx + 4]
mov dword [eax + edx*4], ecx
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov eax, dword [eax + edx*4]
push eax
call sub.wsock32.dll_ntohl
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov dword [edx + ecx*4], eax
inc dword [ebp - 0xc]
mov esi, dword [esi + 8]
test esi, esi
jne 0x4d37c0
jmp 0x4d382c
lea edx, [ebp - 0x14]
mov eax, edi
call fcn.0041581c
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x388]
mov eax, dword [eax + 0x2a0]
mov ecx, dword [eax]
call dword [ecx + 0x38]
test ebx, ebx
je 0x4d3837
mov eax, ebx
call fcn.00404204
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d3854
lea eax, [ebp - 0x14]
call fcn.00406a18
ret
Function at 0x4d3860
Capabilities:
Connect socket
Connect udp socket
Create udp socket
Initialize winsock library
Send data
Send data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe3c
push ebx
push esi
mov ebx, ecx
mov esi, edx
lea eax, [ebp - 0x1a8]
push eax
push 2
call sub.wsock32.dll_WSAStartup
test eax, eax
jne 0x4d39f3
push 0
push 2
push 2
call sub.wsock32.dll_socket
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x4d39f3
xor edx, edx
push ebp
push 0x4d39ec
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x18]
xor ecx, ecx
mov edx, 0x10
call fcn.00404780
mov word [ebp - 0x18], 2
push 0x4e91
call sub.wsock32.dll_htons
mov word [ebp - 0x16], ax
push 0x4d39fc
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x14], eax
mov byte [ebp - 5], 1
push 4
lea eax, [ebp - 5]
push eax
push 0x20
push 0xffff
mov eax, dword [ebp - 4]
push eax
call sub.wsock32.dll_setsockopt
push 0x10
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.wsock32.dll_connect
test eax, eax
je 0x4d3912
call fcn.00405970
jmp 0x4d39f3
lea eax, [ebp - 0x1c4]
xor ecx, ecx
mov edx, 0x1c
call fcn.00404780
mov byte [ebp - 0x1c4], 0x55
mov byte [ebp - 0x1c3], 0xee
test bl, bl
je 0x4d3950
xor eax, eax
mov dword [ebp - 0x1c0], eax
xor eax, eax
mov dword [ebp - 0x1bc], eax
xor eax, eax
mov dword [ebp - 0x1b8], eax
jmp 0x4d397f
mov eax, esi
and eax, 0xff
mov ecx, 0x64
cdq
idiv ecx
inc edx
mov eax, esi
and eax, 0xffffff00
add edx, eax
mov dword [ebp - 0x1c0], edx
xor eax, eax
mov dword [ebp - 0x1bc], eax
xor eax, eax
mov dword [ebp - 0x1b8], eax
mov word [ebp - 0x1c2], 0x1c
mov dword [ebp - 0x1b4], esi
mov dword [ebp - 0x1b0], 0x4e90
mov word [ebp - 0x1ac], 0
lea eax, [ebp - 0x1c4]
mov dx, 0x1a
call fcn.004d3cc4
mov word [ebp - 0x1aa], ax
push 0
push 0x1c
lea eax, [ebp - 0x1c4]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.wsock32.dll_send
inc eax
jne 0x4d39d5
call fcn.00405970
jmp 0x4d39f3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d39f3
mov eax, dword [ebp - 4]
push eax
call sub.wsock32.dll_closesocket
ret
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d3a0c
Capabilities:
Connect socket
Connect udp socket
Create udp socket
Initialize winsock library
Send data
Send data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe18
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x1e8], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4d3c54
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1b8]
push eax
push 2
call sub.wsock32.dll_WSAStartup
test eax, eax
jne 0x4d3c3b
push 0
push 2
push 2
call sub.wsock32.dll_socket
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x4d3c3b
xor ecx, ecx
push ebp
push 0x4d3c34
push dword fs:[ecx]
mov dword fs:[ecx], esp
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x10
call fcn.00404780
mov word [ebp - 0x28], 2
push 0x4e91
call sub.wsock32.dll_htons
mov word [ebp - 0x26], ax
push 0x4d3c64
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x24], eax
mov byte [ebp - 5], 1
push 4
lea eax, [ebp - 5]
push eax
push 0x20
push 0xffff
mov eax, dword [ebp - 4]
push eax
call sub.wsock32.dll_setsockopt
push 0x10
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.wsock32.dll_connect
test eax, eax
je 0x4d3ad4
call fcn.00405970
jmp 0x4d3c3b
cmp bl, 1
jne 0x4d3b1d
lea eax, [ebp - 0xe]
xor ecx, ecx
mov edx, 8
call fcn.00404780
mov byte [ebp - 0xe], 0x55
mov byte [ebp - 0xd], 1
mov word [ebp - 0xc], 8
mov word [ebp - 0xa], 0
lea eax, [ebp - 0xe]
mov dx, 6
call fcn.004d3cc4
mov word [ebp - 8], ax
push 0
push 8
lea eax, [ebp - 0xe]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.wsock32.dll_send
cmp bl, 4
jne 0x4d3bc8
lea eax, [ebp - 0xe]
xor ecx, ecx
mov edx, 8
call fcn.00404780
mov byte [ebp - 0x1cc], 0x55
mov byte [ebp - 0x1cb], 4
mov word [ebp - 0x1ca], 0x14
mov word [ebp - 0x1bc], 0
lea edx, [ebp - 0x1e8]
mov eax, dword [esi + 0x48c]
call fcn.0047a744
mov eax, dword [ebp - 0x1e8]
call fcn.00406ab4
lea edx, [ebp - 0x1e4]
mov ecx, 0x18
call fcn.004043a0
xor edx, edx
lea eax, [ebp - 0x1c8]
mov ecx, edx
add ecx, ecx
movzx ecx, byte [ebp + ecx - 0x1e4]
mov byte [eax], cl
inc edx
inc eax
cmp edx, 0xc
jne 0x4d3b89
lea eax, [ebp - 0x1cc]
mov dx, 0x12
call fcn.004d3cc4
mov word [ebp - 0x1ba], ax
push 0
push 0x14
lea eax, [ebp - 0x1cc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.wsock32.dll_send
cmp bl, 0x5f
jne 0x4d3c13
lea eax, [ebp - 0x16]
xor ecx, ecx
mov edx, 8
call fcn.00404780
mov byte [ebp - 0x16], 0x55
mov byte [ebp - 0x15], 0x5f
mov word [ebp - 0x14], 8
mov byte [ebp - 0x12], 0
mov byte [ebp - 0x11], 0
lea eax, [ebp - 0x16]
mov dx, 6
call fcn.004d3cc4
mov word [ebp - 0x10], ax
push 0
push 8
lea eax, [ebp - 0x16]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.wsock32.dll_send
inc eax
jne 0x4d3c1d
call fcn.00405970
jmp 0x4d3c3b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d3c3b
mov eax, dword [ebp - 4]
push eax
call sub.wsock32.dll_closesocket
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d3c5b
lea eax, [ebp - 0x1e8]
call fcn.00406a18
ret
Function at 0x406304
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x406328
xor eax, eax
test eax, eax
je 0x40633a
cmp byte [ebp + eax - 0x121], 0x5c
je 0x40633a
xor ecx, ecx
jmp 0x40633d
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x409014]
lea eax, [ebp + eax - 0x120]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
leave
ret 4

Function at 0x406429
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42229c], 0
push esi
jne 0x406460
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x40643a
mov dword [ecx*4 + 0x422298], eax
inc ecx
cmp ecx, 0x100
jl 0x406435
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406491
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422298]
xor eax, esi
inc ecx
dec edx
jne 0x406473
pop edi
not eax
pop esi
ret 0xc

Function at 0x430002
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x4f6804d2
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, str.t_w
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e3d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x3f340ec7
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x4079d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], edi
test eax, eax
jg 0x4079fc
jl 0x4079f0
test ecx, ecx
jne 0x4079fc
pop edi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
push esi
je 0x407aae
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
nop dword [eax]
mov ecx, ebx
call fcn.00403610
mov esi, eax
mov eax, edx
mov dword [ebp - 0xc], eax
test eax, eax
jl 0x407a63
jg 0x407a28
test esi, esi
je 0x407a63
mov ecx, dword [ebp - 4]
cmp ecx, eax
jg 0x407a3d
mov eax, dword [ebp - 8]
jl 0x407a38
cmp eax, esi
jae 0x407a3d
mov esi, eax
mov dword [ebp - 0xc], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.004158b0
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
sub ecx, esi
sbb edx, dword [ebp - 0xc]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x407a82
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [ebp - 4]
cmp eax, 0xffffffff
je 0x407a98
mov ecx, dword [ebp - 8]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
test edx, edx
jg 0x407a10
jl 0x407a98
test ecx, ecx
jne 0x407a10
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp + 0x10]
pop esi
sbb ecx, edx
pop edi
mov edx, ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x407aeb
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x407aeb
mov edi, dword [ebp - 4]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push edi
call fcn.004158b0
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [ebp - 4], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
cmp dword [ebx + 0x4c], 0
mov ecx, edi
je 0x407b5b
mov esi, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [esi], eax
jne 0x407b11
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [esi], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov esi, dword [ebp - 4]
mov ecx, edi
cmp edi, 0xfff
jbe 0x407b44
nop
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.0041bab5
sub edi, eax
add esp, 0x10
add esi, eax
mov ecx, edi
cmp eax, 0xfff
jne 0x407b6f
cmp edi, eax
ja 0x407b20
test ecx, ecx
je 0x407b5b
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.0041bab5
mov ecx, edi
add esp, 0x10
sub ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, ecx
pop esi
pop edi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop esi
pop edi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x408f1e
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi], 3
jne 0x408f66
call fcn.0040d98f
test al, al
jne 0x408f66
lea ecx, [ebp - 0x130]
call fcn.0040e03e
lea esi, [edi + 8]
push esi
call fcn.00408c88
pop ecx
push esi
lea ecx, [ebp - 0x130]
call fcn.0040e1ce
lea ecx, [ebp - 0x130]
call fcn.00403b50
lea ebx, [edi + 8]
push ebx
call fcn.00408c88
pop ecx
lea eax, [ebp - 0x18]
lea esi, [edi + 0xc]
push eax
mov ecx, esi
call fcn.00409d7e
mov eax, dword [0x4450d0]
test eax, eax
je 0x408fac
lea ecx, [ebp - 0x18]
push ecx
push dword [edi + 0xa0]
push dword [edi + 0xa8]
push dword [edi + 0xa4]
push dword [edi]
call eax
add esp, 0x14
test al, al
jne 0x409088
test byte [0x444008], 2
je 0x408fc9
cmp dword [ebp - 4], 0x10
lea eax, [ebp - 0x18]
cmovae eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x408fce
cmp dword [edi], 2
jl 0x408fff
cmp dword [ebp - 4], 0x10
lea esi, [ebp - 0x18]
push 2
cmovae esi, dword [ebp - 0x18]
call fcn.0041b015
push eax
push 1
push dword [ebp - 8]
push esi
call fcn.0041c213
push 2
call fcn.0041b015
push eax
call fcn.0041b544
lea esi, [edi + 0xc]
add esp, 0x1c
test byte [0x444008], 1
je 0x409032
call fcn.0040974e
test al, al
je 0x409032
cmp dword [ebp - 4], 0x10
lea ecx, [ebp - 0x1c]
push 0
push ecx
push dword [ebp - 8]
lea eax, [ebp - 0x18]
cmovae eax, dword [ebp - 0x18]
push eax
push dword [0x4450c4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [edi], 3
jne 0x409088
push 0
push 0x400
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x18]
call fcn.00409c11
lea eax, [ebp - 0x434]
push eax
call fcn.0040dfdd
cmp dword [0x4450cc], 0
pop ecx
je 0x409083
lea eax, [ebp - 0x34]
mov ecx, esi
push eax
call fcn.00409d7e
lea eax, [ebp - 0x34]
push eax
call dword [0x4450cc]
pop ecx
lea ecx, [ebp - 0x34]
call fcn.00409afb
jmp 0x409088
call fcn.0040d99b
lea ecx, [ebp - 0x18]
call fcn.00409afb
push dword [edi + 0xac]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, ebx
call fcn.00402720
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4092e7
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf0
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
call fcn.0040bc99
mov esi, eax
push 0x433a20
mov ecx, esi
call fcn.0040be87
test al, al
jne 0x409323
push str.vmodule
mov ecx, esi
call fcn.0040be87
test al, al
je 0x4093ec
cmp dword [0x4450bc], ebx
je 0x409348
push str._g_vlog_info_prev
push 0x165
push str.D:_neox_jiyou_auto_build_root_auto_enginejy_masterNeoX_related_solutionxy2_preload_baselogging.cc
lea ecx, [ebp - 0xf0]
call fcn.00408dce
xor ebx, ebx
inc ebx
test bl, 1
je 0x40935b
lea ecx, [ebp - 0xf0]
and ebx, 0xfffffffe
call fcn.00408f1e
mov eax, dword [0x4450b8]
push 0x10
mov dword [0x4450bc], eax
call fcn.00413e9d
mov edi, eax
pop ecx
test edi, edi
je 0x4093c8
mov eax, str.vmodule
push eax
mov dword [ebp - 8], eax
call fcn.0041c9b0
mov dword [ebp - 4], eax
mov eax, 0x433a20
push eax
mov dword [ebp - 0x10], eax
call fcn.0041c9b0
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
mov ecx, esi
push 0x4450b4
lea eax, [ebp - 8]
or ebx, 6
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.0040bcf6
push eax
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0040bcf6
push eax
mov ecx, edi
call fcn.0040ee6f
jmp 0x4093ca
xor eax, eax
mov dword [0x4450b8], eax
test bl, 4
je 0x4093df
lea ecx, [ebp - 0x28]
and ebx, 0xfffffffb
call fcn.00409afb
test bl, 2
je 0x4093ec
lea ecx, [ebp - 0x40]
call fcn.00409afb
mov ebx, dword [ebp + 8]
mov ecx, dword [ebx]
mov dword [0x444008], ecx
test cl, 1
jne 0x409400
mov al, 1
jmp 0x409467
call fcn.0040946c
mov edi, dword [0x4450c0]
test edi, edi
jne 0x409435
push 0x18
call fcn.00413e9d
mov edi, eax
pop ecx
test edi, edi
je 0x40942d
and dword [edi], 0
and dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
jmp 0x40942f
xor edi, edi
mov dword [0x4450c0], edi
mov esi, dword [ebx + 4]
push esi
call fcn.0041c6d4
pop ecx
push eax
push esi
mov ecx, edi
call fcn.00406c60
cmp dword [ebx + 0xc], 0
jne 0x409462
mov eax, dword [0x4450c0]
cmp dword [eax + 0x14], 8
jb 0x40945b
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.0040974e
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40a3d8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 0xc], 0
push ebx
mov ebx, ecx
jge 0x40a3ec
or eax, 0xffffffff
jmp 0x40a449
lea ecx, [ebp - 0xc]
call fcn.0040f17f
call fcn.0040f1e4
test al, al
je 0x40a411
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0xc]
cdq
push edx
push eax
push ebx
push str.File::ReadAtCurrentPos
call fcn.0040f1b4
push esi
xor esi, esi
lea eax, [ebp - 4]
push esi
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40a430
mov esi, dword [ebp - 4]
jmp 0x40a43e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
je 0x40a43e
or esi, 0xffffffff
lea ecx, [ebp - 0xc]
call fcn.0040f198
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x40a4ed
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
call fcn.0040a2dd
test al, al
je 0x40a64f
mov eax, dword [ebp + 0xc]
xor esi, esi
xorps xmm0, xmm0
mov ebx, esi
movlpd qword [ebp - 0xc], xmm0
push 4
pop ecx
sub eax, esi
je 0x40a54c
sub eax, 1
je 0x40a548
sub eax, 1
je 0x40a538
sub eax, 1
jne 0x40a54f
push 3
mov ecx, edi
call fcn.0040a658
jmp 0x40a651
mov eax, dword [ebp + 8]
mov ebx, ecx
mov dword [ebp - 8], esi
mov eax, dword [eax + 8]
mov dword [ebp - 0xc], eax
jmp 0x40a54f
mov ebx, ecx
jmp 0x40a54f
push 2
pop ebx
push esi
push dword [ebp - 0xc]
mov ecx, edi
push dword [ebp - 8]
push ebx
push esi
call fcn.0040a2da
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
lea ecx, [edi + 0x30]
call fcn.0040a031
lea eax, [edi + 0x30]
cmp dword [eax], esi
je 0x40a64f
cmp dword [eax], 0xffffffff
je 0x40a64f
mov ecx, dword [ebp + 8]
xorps xmm0, xmm0
push 0x433928
movlpd qword [ebp - 0xc], xmm0
mov dword [ebp - 4], esi
call fcn.0040a798
test al, al
je 0x40a5d7
mov ecx, edi
call fcn.0040a280
mov dword [ebp + 8], eax
cmp edx, esi
jl 0x40a64f
jg 0x40a5bb
cmp eax, esi
jbe 0x40a64f
push edx
push eax
call fcn.0040a485
pop ecx
pop ecx
test eax, eax
jne 0x40a64f
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
jmp 0x40a622
lea eax, [ebp - 4]
mov dword [ebp + 0xc], esi
push eax
lea eax, [ebp + 0xc]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0xc]
movlpd qword [ebp - 0xc], xmm0
push eax
mov eax, dword [ebp + 8]
push dword [eax + 8]
push dword [eax + 4]
push dword [eax]
call fcn.0040a7be
mov eax, dword [ebp + 8]
add esp, 0x18
mov edx, dword [ebp - 8]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 4]
add eax, ecx
mov dword [ebp + 8], eax
cmp edx, esi
jl 0x40a64f
mov eax, dword [ebp - 0xc]
jg 0x40a61f
cmp eax, esi
jb 0x40a64f
mov esi, dword [ebp + 8]
push esi
push eax
push edx
push 2
pop eax
push 4
mov dword [edi + 0x2c], ecx
test bl, 2
pop ecx
cmovne eax, ecx
push eax
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [edi + 0x28], eax
test eax, eax
je 0x40a64f
add eax, dword [ebp - 4]
mov dword [edi + 0x28], eax
mov al, 1
jmp 0x40a651
xor al, al
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x40a658
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, ecx
call fcn.0040a2dd
test al, al
je 0x40a6c8
xor ebx, ebx
lea esi, [edi + 0x30]
push ebx
push ebx
push ebx
push 0x11000002
push ebx
mov ecx, edi
call fcn.0040a2da
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
mov ecx, esi
call fcn.0040a031
cmp dword [esi], ebx
je 0x40a6c8
cmp dword [esi], 0xffffffff
je 0x40a6c8
push ebx
push ebx
push ebx
push 4
push dword [esi]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [edi + 0x28], eax
test eax, eax
je 0x40a6c8
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0x43391c
mov dword [ebp - 4], eax
call fcn.004103f5
mov eax, dword [eax + 0x50]
mov dword [edi + 0x2c], eax
mov al, 1
jmp 0x40a6ca
xor al, al
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40beb8
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [0x4450d8], 0
je 0x40becb
xor al, al
leave
ret
push 0x20
call fcn.00413e9d
pop ecx
test eax, eax
je 0x40bee2
push 0
mov ecx, eax
call fcn.0040b7dd
jmp 0x40bee4
xor eax, eax
mov dword [0x4450d8], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x18]
call fcn.00408d77
mov ecx, dword [0x4450d8]
lea eax, [ebp - 0x18]
push eax
call fcn.0040c1cd
lea ecx, [ebp - 0x18]
call fcn.00409b21
mov al, 1
leave
ret

Function at 0x40c1cd
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
lea eax, [ebp - 0x20]
mov dword [ebp - 0xc], 7
push eax
push 3
push dword [ebp + 8]
xor esi, esi
mov edi, ecx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x10], esi
call fcn.0040e89e
add esp, 0xc
cmp dword [ebp - 0x10], esi
je 0x40c229
cmp dword [ebp - 0xc], 8
lea ecx, [ebp + 8]
lea eax, [ebp - 0x20]
mov dword [ebp + 8], esi
cmovae eax, dword [ebp - 0x20]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
mov ecx, edi
push esi
push dword [ebp + 8]
call fcn.0040c040
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0xc]
pop edi
pop esi
cmp eax, 8
jb 0x40c268
mov ecx, dword [ebp - 0x20]
lea eax, [eax*2 + 2]
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
cmp eax, 0x1000
jb 0x40c25f
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0040988c
mov eax, dword [ebp - 4]
pop ecx
pop ecx
mov ecx, dword [ebp - 8]
push eax
push ecx
call fcn.00413ecd
pop ecx
pop ecx
leave
ret 4

Function at 0x40d901
Capabilities:
Enumerate processes

Disassembly:
push esi
mov esi, ecx
push edi
lea edi, [esi + 0xc]
push edi
call fcn.0040d930
cmp byte [esi + 8], 0
push edi
push dword [esi + 4]
jne 0x40d923
mov byte [esi + 8], 1
call sub.KERNEL32.dll_Process32FirstW
jmp 0x40d928
call sub.KERNEL32.dll_Process32NextW
test eax, eax
pop edi
setne al
pop esi
ret