joyce8/EMBER2024-capa huggingface dataset:
Function at 0x710432f0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x4c]
push ebx
lea esi, [ebp - 0x48]
sub esp, 0x7c
mov dword [edx], 1
mov ebx, dword [sym.imp.ntdll.dll_NtQuerySystemInformationEx]
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x68], edx
mov dword [ebp - 0x48], 0xffff
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 4
mov dword [esp + 4], esi
mov dword [esp], 0x6b
call ebx
sub esp, 0x18
cmp eax, 0xc0000004
jne 0x71043430
mov ecx, dword [ebp - 0x4c]
mov dword [esp], ecx
mov dword [ebp - 0x5c], ecx
call dword [sym.imp.ucrtbase.dll_malloc]
mov ecx, dword [ebp - 0x5c]
test eax, eax
je 0x7104346e
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov dword [ebp - 0x5c], eax
mov dword [esp + 8], 4
mov dword [esp + 4], esi
mov dword [esp], 0x6b
call ebx
mov edx, dword [ebp - 0x5c]
sub esp, 0x18
test eax, eax
mov edi, eax
jne 0x71043420
mov ecx, dword [ebp - 0x4c]
xor eax, eax
mov dword [ebp - 0x60], 0
xor esi, esi
mov dword [ebp - 0x5c], ecx
test ecx, ecx
jne 0x710433d7
jmp 0x710434a8
add esi, 1
test byte [ecx + 8], 1
mov ebx, 1
cmovne edi, ebx
add eax, dword [ecx + 4]
cmp dword [ebp - 0x5c], eax
jbe 0x710433f4
lea ecx, [edx + eax]
mov ebx, dword [ecx]
test ebx, ebx
je 0x710433c0
cmp ebx, 3
sete bl
add eax, dword [ecx + 4]
movzx ebx, bl
add dword [ebp - 0x60], ebx
cmp dword [ebp - 0x5c], eax
ja 0x710433d7
mov dword [esp], edx
call dword [sym.imp.ucrtbase.dll_free]
mov eax, dword [ebp - 0x64]
test eax, eax
je 0x71043406
mov dword [eax], esi
mov eax, dword [ebp - 0x68]
test edi, edi
mov edx, dword [ebp - 0x60]
mov dword [eax], edx
lea eax, [esi + esi]
cmovne esi, eax
mov eax, esi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], edx
call dword [sym.imp.ucrtbase.dll_free]
lea esi, [esi]
lea eax, [ebp - 0x44]
mov dword [esp + 0xc], 0
mov esi, 1
mov dword [esp + 8], 0x2c
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
sub esp, 0x10
test eax, eax
jne 0x71043416
movzx esi, byte [ebp - 0x1c]
lea esp, [ebp - 0xc]
pop ebx
mov eax, esi
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x44]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x2c
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
sub esp, 0x10
test eax, eax
je 0x71043460
mov esi, 1
jmp 0x71043416
mov dword [esp], edx
call dword [sym.imp.ucrtbase.dll_free]
mov eax, dword [ebp - 0x64]
test eax, eax
je 0x710434be
mov dword [eax], 0
mov eax, dword [ebp - 0x68]
mov dword [eax], 0
jmp 0x71043416
Function at 0x7104ecb0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
push ebx
sub esp, 0x3c
mov dword [ebp - 0x1c], eax
movzx ecx, word [edx]
test esi, esi
je 0x7104ee20
mov eax, dword [ebp + 8]
test eax, eax
je 0x7104ed90
test cx, cx
je 0x7104ee10
mov ebx, edx
nop
add ebx, 2
cmp word [ebx], 0
jne 0x7104ece0
sub ebx, edx
sar ebx, 1
cmp word [esi], 0
je 0x7104ed07
mov eax, esi
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x7104ecf8
sub eax, esi
sar eax, 1
add ebx, eax
mov eax, dword [ebp + 8]
cmp word [eax], 0
je 0x7104ed20
add eax, 2
cmp word [eax], 0
jne 0x7104ed10
sub eax, dword [ebp + 8]
sar eax, 1
add ebx, eax
add ebx, 0x4a
mov dword [ebp - 0x20], edx
lea eax, [ebx + ebx]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov edx, dword [ebp - 0x20]
test eax, eax
mov edi, eax
je 0x7104ee8a
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edx
mov dword [esp + 8], str.SELECT__FROM___QUALIFIERS_WHERE_Class_s_AND_Member_s_AND_Name_s
mov dword [esp + 4], ebx
mov dword [esp + 0x14], eax
mov dword [esp], edi
call fcn.7104ec60
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], edi
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call fcn.71051500
mov dword [esp], edi
mov ebx, eax
call dword [sym.imp.ucrtbase.dll_free]
add esp, 0x3c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
test esi, esi
je 0x7104ee20
test cx, cx
je 0x7104ee77
mov eax, edx
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x7104eda8
sub eax, edx
sar eax, 1
cmp word [esi], 0
je 0x7104edcf
mov ecx, esi
lea esi, [esi]
add ecx, 2
cmp word [ecx], 0
jne 0x7104edc0
sub ecx, esi
sar ecx, 1
add eax, ecx
lea ebx, [eax + 0x3c]
mov dword [ebp - 0x20], edx
lea eax, [ebx + ebx]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov edi, eax
test eax, eax
je 0x7104ee8a
mov edx, dword [ebp - 0x20]
mov dword [esp + 0x10], esi
mov dword [esp + 8], str.SELECT__FROM___QUALIFIERS_WHERE_Class_s_AND_Member_s
mov dword [esp + 4], ebx
mov dword [esp], eax
mov dword [esp + 0xc], edx
call fcn.7104ec60
jmp 0x7104ed62
xor ebx, ebx
jmp 0x7104eced
mov eax, edx
test cx, cx
je 0x7104ee7e
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x7104ee30
sub eax, edx
mov ecx, eax
add eax, 0x58
sar ecx, 1
lea ebx, [ecx + 0x2c]
mov dword [ebp - 0x20], edx
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov edi, eax
test eax, eax
je 0x7104ee8a
mov edx, dword [ebp - 0x20]
mov dword [esp + 8], str.SELECT__FROM___QUALIFIERS_WHERE_Class_s
mov dword [esp + 4], ebx
mov dword [esp], eax
mov dword [esp + 0xc], edx
call fcn.7104ec60
jmp 0x7104ed62
xor eax, eax
jmp 0x7104edb5
mov eax, 0x58
mov ebx, 0x2c
jmp 0x7104ee45
mov ebx, 0x8007000e
jmp 0x7104ed83
Function at 0x7104fd00
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x3c]
push ebx
lea esi, [ebp - 0x38]
sub esp, 0x4c
mov dword [ebp - 0x3c], 0x10
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetComputerNameW]
sub esp, 8
test eax, eax
je 0x7104fd70
movzx eax, word [ebp - 0x38]
test ax, ax
je 0x7104fd54
mov ebx, dword [sym.imp.ucrtbase.dll_towupper]
mov edi, esi
lea esi, [esi]
nop
mov dword [esp], eax
add edi, 2
call ebx
mov word [edi - 2], ax
movzx eax, word [edi]
test ax, ax
jne 0x7104fd40
mov dword [esp], esi
call dword [sym.imp.oleaut32.dll_SysAllocString]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x71057a10
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
lea eax, [ebp + 0x14]
sub esp, 0x20
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], str.SELECT__FROM__s_WHERE__s
mov dword [esp], 4
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
call dword [sym.imp.ucrtbase.dll___stdio_common_vswprintf]
leave
ret
Function at 0x7105a770
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov edi, dword [ebp + 8]
mov edx, dword [edi + 8]
mov esi, dword [edi + 4]
test edx, edx
mov dword [ebp - 0x1c], edx
je 0x7105a7d0
add esi, dword [edi + 0xc]
add esi, 0x1a
lea eax, [esi + esi]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov ebx, eax
test eax, eax
je 0x7105a7c2
mov edx, dword [ebp - 0x1c]
mov dword [esp + 0x10], edx
mov eax, dword [edi]
mov dword [esp + 8], str.SELECT__FROM__s_WHERE__s
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0xc], eax
call fcn.71057a10
add esp, 0x3c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esi + esi + 0x1e]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov ebx, eax
test eax, eax
je 0x7105a7c2
xor eax, eax
mov edx, 0x53
jmp 0x7105a7f7
movzx edx, word [eax + str.SELECT__FROM]
mov word [ebx + eax], dx
add eax, 2
test dx, dx
jne 0x7105a7f0
cmp word [ebx], 0
mov edx, ebx
mov esi, dword [edi]
je 0x7105a819
lea esi, [esi]
add edx, 2
cmp word [edx], 0
jne 0x7105a810
xor eax, eax
lea esi, [esi]
nop
movzx ecx, word [esi + eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x7105a820
add esp, 0x3c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x71060900
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x22c
mov eax, dword [0x710700e0]
test eax, eax
je 0x710609b8
mov dword [esp], ebx
call eax
sub esp, 4
test eax, eax
mov dword [ebx + 8], eax
jns 0x71060940
mov eax, dword [ebx]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [ebp - 0x220]
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.MODULE
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], str.SystemRoot
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.SystemRoot
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
jmp 0x7106092c
mov dword [esp], str.atl100.dll
call dword [sym.imp.kernel32.dll_LoadLibraryW]
sub esp, 4
test eax, eax
je 0x710609ed
mov dword [esp + 4], 0x7106f038
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
sub esp, 8
mov dword [0x710700e0], eax
test eax, eax
jne 0x7106091d
mov dword [ebx + 8], 0x80004002
xor eax, eax
jmp 0x7106092e
Function at 0x4019f0
Capabilities:
Create process on windows
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x210
mov eax, dword [0x41a038]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push edi
mov edi, dword [ebp + 8]
push 0x64
push 0x41beb8
push 0x67
push edi
call esi
push 0x64
push 0x41bdf0
push 0x6d
push edi
call esi
mov ecx, edi
call fcn.00401b90
push 0
push edi
push 0
push 0
push 0
push connect
push 0
push connect
push 0xcf0000
push 0x41beb8
push 0x41bdf0
push 0
mov dword [0x41bf80], edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
jne 0x401a82
mov ecx, dword [esp + 0x214]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.00405da4
mov esp, ebp
pop ebp
ret 0x10
push 0x6d
push edi
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x7d0
call esi
push 0x41af08
call fcn.00402b50
add esp, 4
call fcn.00402110
test eax, eax
je 0x401abb
call fcn.00403780
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.00401470
test eax, eax
je 0x401a6a
call fcn.00401740
mov eax, dword [0x41ce20]
test eax, eax
je 0x401af6
cmp word [0x41ce24], 0
jbe 0x401af6
push 0x41aef8
push eax
call fcn.004044d0
mov ax, word [0x41ce24]
add esp, 8
mov word [0x41aef4], ax
xor ecx, ecx
jmp 0x401b00
movzx eax, word [ecx + 0x418a64]
mov word [ecx + 0x41c1a0], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x401b00
call fcn.00404580
xor eax, eax
push 0x206
push eax
mov word [esp + 0x10], ax
lea eax, [esp + 0x12]
push eax
call fcn.00409990
add esp, 0xc
lea eax, [esp + 8]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x41c1a0
lea eax, [esp + 0xc]
push 0x104
push eax
call fcn.00405f45
add esp, 0xc
push 0x1f4
call esi
push 1
push 0
push 0x418a7c
lea eax, [esp + 0x14]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x401e40
Capabilities:
Get common file path
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x41a038]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
test edi, edi
je 0x401f63
test esi, esi
je 0x401f63
mov ecx, esi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401e70
sub ecx, edx
xor eax, eax
sar ecx, 1
je 0x401f65
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.00409990
add esp, 0xc
cmp dword [ebp + 0xc], 0
jne 0x401edf
cmp dword [0x41af08], 3
jne 0x401edf
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x418a9c
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00405f45
add esp, 0xc
jmp 0x401ef1
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push esi
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00405f45
push 0x418aa0
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x210]
push eax
mov dword [ebp - 0x210], 0
call fcn.0040613c
mov eax, dword [ebp - 0x210]
add esp, 0x18
test eax, eax
je 0x401f63
push eax
push 1
push 0x200
push edi
call fcn.0040640e
push dword [ebp - 0x210]
call fcn.00406526
add esp, 0x14
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405da4
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00405da4
mov esp, ebp
pop ebp
ret

Function at 0x402020
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x41a038]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
xor edx, edx
jmp 0x402040
not byte [esi + edx]
inc edx
cmp edx, 0x200
jb 0x402040
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.00409990
add esp, 0xc
mov dword [ebp - 0x214], 0
test esi, esi
je 0x4020f5
lea eax, [ebp - 0x210]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x418ac0
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.00405f45
push 0x418adc
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.0040613c
mov eax, dword [ebp - 0x214]
add esp, 0x18
test eax, eax
je 0x4020e1
push eax
push 1
push 0x200
push esi
call fcn.004066f4
push dword [ebp - 0x214]
call fcn.00406526
add esp, 0x14
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405da4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop esi
call fcn.00405da4
mov esp, ebp
pop ebp
ret
Function at 0x4029a0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x41a038]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.00409990
add esp, 0xc
lea eax, [ebp - 0x410]
push 0x200
push 0
push eax
call fcn.00409990
add esp, 0xc
lea ecx, [ebp - 0x410]
call fcn.00401f80
test eax, eax
je 0x402ad2
xor ecx, ecx
lea esp, [esp]
movzx eax, word [ecx + 0x418c28]
mov word [ecx + 0x41c018], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x402a00
xor ecx, ecx
jmp 0x402a20
movzx eax, word [ebp + ecx - 0x38a]
mov word [ecx + 0x41c120], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x402a20
xor ecx, ecx
lea esp, [esp]
movzx eax, word [ebp + ecx - 0x40c]
mov word [ecx + 0x41c0a0], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x402a40
cmp dword [0x41af08], 3
movzx eax, word [ebp - 0x38c]
mov word [0x41c098], ax
movzx eax, word [ebp - 0x2ea]
mov word [0x41c010], ax
lea eax, [ebp - 0x210]
mov dword [0x41c00c], 5
push eax
je 0x402a8f
push 1
jmp 0x402a91
push 0
call fcn.00403580
add esp, 8
lea eax, [ebp - 0x210]
push 0x418c44
push 0x104
push eax
call fcn.00405f45
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405da4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.00405da4
mov esp, ebp
pop ebp
ret

Function at 0x402b50
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x41a038]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x124], 0
xor ecx, ecx
mov word [ebp - 0x12c], cx
push 0x11c
push 0
lea edx, [ebp - 0x120]
push edx
call fcn.00409990
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x402c30
mov ecx, dword [ebp - 0x11c]
mov dword [ebp - 0x128], ecx
mov edx, dword [ebp - 0x118]
mov dword [ebp - 0x124], edx
mov ax, word [ebp - 0xc]
mov word [ebp - 0x12c], ax
cmp dword [ebp - 0x128], 5
jne 0x402c01
cmp dword [ebp - 0x124], 2
jae 0x402bf8
cmp dword [ebp - 0x124], 1
jne 0x402c01
mov ecx, dword [ebp + 8]
mov dword [ecx], 3
cmp dword [ebp - 0x128], 6
jne 0x402c30
cmp dword [ebp - 0x124], 0
jne 0x402c1e
mov edx, dword [ebp + 8]
mov dword [edx], 4
jmp 0x402c30
cmp dword [ebp - 0x124], 1
jne 0x402c30
mov eax, dword [ebp + 8]
mov dword [eax], 5
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405da4
mov esp, ebp
pop ebp
ret
Function at 0x402c40
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x41a038]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x20c], ax
push 0x206
push 0
lea ecx, [ebp - 0x20a]
push ecx
call fcn.00409990
add esp, 0xc
cmp dword [0x41af08], 3
jne 0x402ca8
push 0x104
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x418c5c
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.00405f45
add esp, 0xc
jmp 0x402cba
lea ecx, [ebp - 0x20c]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x20c]
push eax
push 0x418c60
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405da4
mov esp, ebp
pop ebp
ret

Function at 0x402fb0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x41a038]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x214], 0xffffffff
xor eax, eax
mov word [ebp - 0x20c], ax
push 0x206
push 0
lea ecx, [ebp - 0x20a]
push ecx
call fcn.00409990
add esp, 0xc
push 0x104
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov eax, 2
imul eax, eax, 0
movzx ecx, word [ebp + eax - 0x20c]
sub ecx, 0x41
mov dword [ebp - 0x218], ecx
lea edx, [ebp - 0x210]
push edx
mov eax, dword [ebp - 0x218]
push eax
call fcn.00403280
add esp, 8
mov ecx, dword [ebp - 0x210]
push ecx
call fcn.004033f0
add esp, 4
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0xffffffff
jne 0x403063
xor eax, eax
jmp 0x403076
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x214]
push eax
call fcn.00402dd0
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405da4
mov esp, ebp
pop ebp
ret

Function at 0x4031e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x41a038]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x1c], 0
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0xffffffff
jne 0x40321d
jmp 0x40326e
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], edx
push 0
push 0x200
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call fcn.0040dc10
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edx
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 0x10]
shl eax, 9
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405da4
mov esp, ebp
pop ebp
ret
Function at 0x403580
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x40359a
mov eax, dword [ebp + 0xc]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x4035bf
push 0x104
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x418ce4
push 0x104
mov edx, dword [ebp + 0xc]
push edx
call fcn.00405f45
add esp, 0xc
pop ebp
ret

Function at 0x4035d0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x41a038]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 8], 0
push 0x418ce8
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 8]
push ecx
call fcn.0040613c
add esp, 0xc
test eax, eax
je 0x40360e
xor eax, eax
jmp 0x4036ef
mov dword [ebp - 0x10], 0
push 2
push 0
mov edx, dword [ebp - 8]
push edx
call fcn.00406f10
add esp, 0xc
mov eax, dword [ebp - 8]
push eax
call fcn.004072e8
add esp, 4
mov dword [ebp - 0x10], eax
push 0
push 0
mov ecx, dword [ebp - 8]
push ecx
call fcn.00406f10
add esp, 0xc
mov edx, dword [ebp - 0x10]
add edx, dword [ebp + 0x10]
push edx
call fcn.00406db7
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
push eax
push 1
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.0040640e
add esp, 0x10
mov eax, dword [ebp - 8]
push eax
call fcn.00406526
add esp, 4
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 0x10]
push edx
call fcn.00403700
add esp, 8
push 0x418cf0
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 8]
push ecx
call fcn.0040613c
add esp, 0xc
test eax, eax
je 0x4036a8
xor eax, eax
jmp 0x4036ef
mov edx, dword [ebp - 0x10]
add edx, dword [ebp + 0x10]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
push eax
push 1
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.004066f4
add esp, 0x10
mov eax, dword [ebp - 8]
push eax
call fcn.00406526
add esp, 4
mov dword [ebp - 0x14], 1
cmp dword [ebp - 0xc], 0
je 0x4036ec
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00406e49
add esp, 4
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405da4
mov esp, ebp
pop ebp
ret
Function at 0x405be0
Capabilities:
Download and write a file
Receive and write data from server to client
Receive data
Receive data on socket
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.0040cb90
mov eax, dword [0x41a038]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x100c], 0
mov dword [ebp - 0x1010], 0
push 0x418da0
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x100c]
push ecx
call fcn.0040613c
add esp, 0xc
cmp dword [ebp - 0x100c], 0
jne 0x405c33
xor eax, eax
jmp 0x405ce8
push 0
push 4
lea edx, [ebp - 0x1008]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 4
je 0x405c56
xor eax, eax
jmp 0x405ce8
mov edx, dword [ebp - 0x1010]
cmp edx, dword [ebp - 0x1008]
jae 0x405cc2
push 0
push 0x1000
lea eax, [ebp - 0x1004]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 0x1014], eax
cmp dword [ebp - 0x1014], 0
jne 0x405c8f
jmp 0x405cc2
mov eax, dword [ebp - 0x100c]
push eax
mov ecx, dword [ebp - 0x1014]
push ecx
push 1
lea edx, [ebp - 0x1004]
push edx
call fcn.004066f4
add esp, 0x10
mov eax, dword [ebp - 0x1010]
add eax, dword [ebp - 0x1014]
mov dword [ebp - 0x1010], eax
jmp 0x405c56
mov ecx, dword [ebp - 0x100c]
push ecx
call fcn.00406526
add esp, 4
mov edx, dword [ebp - 0x1010]
cmp edx, dword [ebp - 0x1008]
jae 0x405ce3
xor eax, eax
jmp 0x405ce8
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405da4
mov esp, ebp
pop ebp
ret