joyce8/EMBER2024-capa huggingface dataset:
Function at 0x461bb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
push 0xa
push ecx
push esi
mov dword [ebp - 4], edx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x461c2e
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 8], eax
test eax, eax
je 0x461c2e
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp eax, 0x104
ja 0x461c2e
push 0x104
push 0
push dword [ebp - 4]
call fcn.00470a00
add esp, 0xc
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.00478ab0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x464e90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4d1008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x4d3eb0
xor edx, edx
push esi
mov ecx, eax
push edi
mov edi, dword [ebp + 8]
cmp ecx, fcn.00464e90
je 0x464ecb
cmp dword [eax], 0x2f2a2a2f
je 0x464ec8
dec eax
cmp eax, fcn.00464e90
jne 0x464eb6
jmp 0x464ecb
lea edx, [eax + 4]
mov ecx, dword [edx]
movq xmm0, qword [edx + 4]
xor ecx, 0xfefefdfc
mov eax, dword [edx + 0xc]
mov esi, ecx
shr esi, 0x10
mov word [ebp - 0x18], si
movq qword [ebp - 0x10], xmm0
mov dword [ebp - 8], eax
cmp si, cx
je 0x464f03
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046e94e
mov esp, ebp
pop ebp
ret
mov al, byte [ebp - 0x18]
xor edx, edx
mov byte [ebp - 0x11], al
shr esi, 8
push ebx
mov ebx, 0xc
mov eax, esi
div ebx
lea eax, [esi + 1]
movzx ecx, byte [ebp + edx - 0x10]
xor edx, edx
div ebx
shl ecx, 8
movzx eax, byte [ebp + edx - 0x10]
xor edx, edx
or ecx, eax
lea eax, [esi + 2]
div ebx
shl ecx, 8
movzx eax, byte [ebp + edx - 0x10]
xor edx, edx
or ecx, eax
lea eax, [esi + 3]
div ebx
shl ecx, 8
movzx eax, byte [ebp + edx - 0x10]
or ecx, eax
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
mov ebx, 0x19810419
mov cl, byte [ebp - 0x11]
rol eax, cl
mov ecx, 4
xor al, bl
ror eax, 8
ror ebx, 8
loop 0x464f65
mov bl, al
rol eax, 8
mov bh, al
mov al, bl
ror eax, 8
mov al, bh
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
pop ebx
mov dword [edi], eax
xor ecx, ebp
pop edi
mov eax, 1
pop esi
call fcn.0046e94e
mov esp, ebp
pop ebp
ret

Function at 0x4662e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x4d1008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push ecx
mov esi, edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4663a9
push dword [esi + 0x34]
xorps xmm0, xmm0
mov dword [ebp - 8], 0
push dword [esi + 0x30]
lea eax, [ebp - 0x30]
push eax
movups xmmword [ebp - 0x28], xmm0
movups xmmword [ebp - 0x18], xmm0
call dword [sym.imp.PAL.dll_PalWindowGetPosCenter]
mov eax, dword [ebp - 0x2c]
add esp, 0xc
mov ecx, dword [ebp - 0x30]
mov dword [esi + 0x2c], eax
mov dword [ebp - 0x24], eax
mov eax, dword [esi + 0x30]
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 0x34]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x5c]
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 0x64]
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x60]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0x54]
push 0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x34]
push eax
push 0x24
lea eax, [ebp - 0x28]
mov dword [esi + 0x28], ecx
push eax
push edi
mov dword [ebp - 0x28], ecx
mov dword [ebp - 8], 1
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046e94e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.0046e94e
mov esp, ebp
pop ebp
ret
Function at 0x466690
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x4d1008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x110]
push 0x4d42c8
push str._s.
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp eax, 0xffffffff
jne 0x4666f4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046e94e
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, eax
nop dword [eax]
mov ecx, 0x4c29ac
lea eax, [ebp - 0x224]
nop dword [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x466730
test dl, dl
je 0x46672c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x466730
add eax, 2
add ecx, 2
test dl, dl
jne 0x466710
xor eax, eax
jmp 0x466735
sbb eax, eax
or eax, 1
test eax, eax
je 0x4667fa
mov eax, 0x4c29c0
lea ecx, [ebp - 0x224]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x466768
test dl, dl
je 0x466764
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x466768
add ecx, 2
add eax, 2
test dl, dl
jne 0x466748
xor eax, eax
jmp 0x46676d
sbb eax, eax
or eax, 1
test eax, eax
je 0x4667fa
test byte [ebp - 0x250], 0x10
jne 0x4667fa
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
sub eax, 4
lea esi, [ebp - 0x224]
add esi, eax
mov eax, dword [esi]
cmp eax, 0x7461642e
jne 0x4667c7
lea eax, [ebp - 0x224]
push eax
push 0x4d42c8
lea eax, [ebp - 0x110]
push str._s_s
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x110]
push eax
call ebx
mov eax, dword [esi]
cmp eax, 0x67706a2e
jne 0x4667f4
lea eax, [ebp - 0x224]
push eax
push 0x4d42c8
lea eax, [ebp - 0x110]
push str._s_s
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x110]
push eax
call ebx
mov esi, dword [ebp - 0x254]
lea eax, [ebp - 0x250]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x466700
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046e94e
mov esp, ebp
pop ebp
ret
Function at 0x466d90
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x4d1008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x877ed8], 0
je 0x466f27
push str.access.dat
push 0x4d42c8
lea eax, [ebp - 0x108]
push str._s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x108]
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x114], eax
cmp eax, 0xffffffff
je 0x466f27
push 0
push dword [edi + 0x877ed8]
call dword [sym.imp.PAL.dll_PalListGetDataCount]
add esp, 8
test eax, eax
je 0x466f04
mov esi, eax
shl esi, 5
add esi, eax
push 0
push esi
call dword [sym.imp.PAL.dll_PalMemoryAlloc]
mov ebx, eax
add esp, 8
mov dword [ebp - 0x10c], ebx
test ebx, ebx
je 0x466f27
push 0
push dword [edi + 0x877ed8]
call dword [sym.imp.PAL.dll_PalListFind]
mov edi, eax
add esp, 8
test edi, edi
je 0x466e82
push 0
push 0
push edi
call dword [sym.imp.PAL.dll_PalListGetData]
push 0x21
push eax
push ebx
call fcn.00478ab0
push edi
add ebx, 0x21
call dword [sym.imp.PAL.dll_PalListFindNext]
mov edi, eax
add esp, 0x1c
test edi, edi
jne 0x466e55
mov ebx, dword [ebp - 0x10c]
mov ecx, esi
mov dword [ebp - 0x110], esi
and ecx, 3
je 0x466e99
mov eax, esi
sub eax, ecx
mov dword [ebp - 0x110], eax
mov edi, dword [ebp - 0x10c]
mov cl, 4
mov edx, dword [ebp - 0x110]
mov eax, 0xff987dee
xor dword [edi], eax
mov eax, 0x84df873
xor dword [edi], eax
ror byte [edi], cl
add edi, 4
add cl, 1
and cl, 0xff
sub edx, 4
jne 0x466ea7
push 0
lea eax, [ebp - 0x118]
push eax
push esi
mov esi, dword [ebp - 0x114]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.PAL.dll_PalMemoryFree]
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046e94e
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x114]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046e94e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046e94e
mov esp, ebp
pop ebp
ret
Function at 0x467250
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x4d1008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push str.system.dat
push 0x4d42c8
lea eax, [ebp - 0x108]
mov esi, ecx
push str._s_s
push eax
mov dword [ebp - 0x114], esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x108]
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4672d2
push 0x4c2b70
call dword [sym.imp.PAL.dll_PalErrorLogPrintf]
add esp, 4
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046e94e
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.PAL.dll_PalCheckWindowMode]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
mov dword [esi + 8], eax
lea eax, [ebp - 0x110]
push eax
push 2
push 0x4bb284
push ebx
call edi
push 0
lea eax, [ebp - 0x110]
push eax
push 0x330
push esi
push ebx
call edi
push 0
lea eax, [ebp - 0x10c]
push eax
push 4
lea eax, [esi + 0x265c8]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x10c]
push eax
push 4
lea eax, [esi + 0x265cc]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x10c]
push eax
push 4
lea eax, [esi + 0x265d4]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x10c]
push eax
push 4
lea eax, [esi + 0x265d0]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x10c]
push eax
push 0xc
lea eax, [esi + 0x265d8]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x10c]
push eax
push 4
lea eax, [esi + 0x265e4]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x10c]
push eax
push 4
lea eax, [esi + 0x265e8]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x10c]
push eax
push 4
lea eax, [esi + 0x265f0]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x10c]
push eax
push 4
lea eax, [esi + 0x265ec]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x10c]
push eax
push 0xc
lea eax, [esi + 0x265f4]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x10c]
push eax
push 0xc
lea eax, [esi + 0x26760]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x10c]
push eax
push 0xb34
lea eax, [esi + 0x2676c]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x10c]
push eax
push 8
lea eax, [esi + 0x272a0]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x10c]
push eax
push 0x1000
lea eax, [esi + 0x44968]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x110]
add esi, 0x877ee8
push eax
push 4
push esi
push ebx
call edi
push 0
lea eax, [ebp - 0x110]
push eax
push dword [esi]
mov esi, dword [ebp - 0x114]
push dword [esi + 0x877ee0]
push ebx
call edi
push 0
lea eax, [ebp - 0x110]
add esi, 0x877ee4
push eax
push 4
push esi
push ebx
call edi
push 0
lea eax, [ebp - 0x110]
push eax
mov eax, dword [ebp - 0x114]
push dword [esi]
push dword [eax + 0x877edc]
push ebx
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046e94e
mov esp, ebp
pop ebp
ret
Function at 0x46a930
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
call dword [sym.imp.WINMM.dll_timeGetTime]
mov dword [edi + 4], eax
mov eax, dword [ebp + 0xc]
push 0
push eax
mov eax, dword [ebp + 8]
add eax, ebx
push eax
push dword [edi]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x46a98b
test eax, eax
je 0x46a979
mov esi, dword [edi + 8]
add ebx, eax
call dword [sym.imp.WINMM.dll_timeGetTime]
sub eax, dword [edi + 4]
cmp eax, esi
jae 0x46a982
mov eax, dword [ebp + 0xc]
cmp ebx, eax
jb 0x46a946
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
push 0x18
push str.HTTP:_recv_timeout_error
jmp 0x46a992
push 0x10
push str.HTTP:_recv_error
lea ecx, [edi + 0x18]
call fcn.0042e550
push dword [edi]
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
pop edi
pop esi
mov eax, 0x80004005
pop ebx
pop ebp
ret 8

Function at 0x46aa60
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a8
mov eax, dword [0x4d1008]
xor eax, esp
mov dword [esp + 0x1a4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [esp + 0x14]
push edi
mov edi, dword [0x6d9624]
push eax
push 0x101
mov dword [edi], 0xffffffff
mov dword [edi + 8], 0x2710
call dword [sym.imp.WS2_32.dll_WSAStartup]
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
test esi, esi
jne 0x46aae7
push 0x19
push str.HTTP:_gethostbyname_error
lea ecx, [edi + 0x18]
call fcn.0042e550
push dword [edi]
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 0x80004005
pop edi
pop esi
mov ecx, dword [esp + 0x1a4]
xor ecx, esp
call fcn.0046e94e
mov esp, ebp
pop ebp
ret 8
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [edi], eax
cmp eax, 0xffffffff
jne 0x46ab03
push 0x12
push str.HTTP:_socket_error
jmp 0x46aab6
mov eax, 2
mov word [esp + 8], ax
mov eax, dword [esi + 0xc]
push 0x50
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [esp + 0x10], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0xa], ax
lea eax, [esp + 8]
push 0x10
push eax
push dword [edi]
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x46ab44
push 0x13
push str.HTTP:_connect_error
jmp 0x46aab6
mov ecx, dword [esp + 0x1ac]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.0046e94e
mov esp, ebp
pop ebp
ret 8
Function at 0x46ced0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 4], 4
mov dword [ebp - 0x10], 0x84df873
mov dword [ebp - 0x14], 0xff987dee
and eax, 3
je 0x46cefa
sub edx, eax
mov dword [ebp - 8], edx
push edi
mov edi, dword [ebp - 0xc]
mov cl, byte [ebp - 4]
mov edx, dword [ebp - 8]
rol byte [edi], cl
add cl, 1
and cl, 0xff
mov eax, dword [ebp - 0x10]
xor dword [edi], eax
mov eax, dword [ebp - 0x14]
xor dword [edi], eax
add edi, 4
sub edx, 4
jne 0x46cf04
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x49b672
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0049ae4c

Function at 0x49b67d
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0049b087

Function at 0x49c322
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0049c0a9
Function at 0x401000
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x510
lea eax, [esp + 0x110]
push ebx
push esi
push edi
push eax
push str.SDI_OVERRIDE_HOME
call fcn.004025e0
add esp, 8
test eax, eax
je 0x40105a
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, 1
mov edx, ecx
mov esi, edi
mov edi, dword [esp + 0x520]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
add esp, 0x510
ret
lea eax, [esp + 0xc]
push eax
push 5
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x401151
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
test eax, eax
jne 0x401151
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x10]
mov edx, dword [eax]
push 0x8000
push ecx
push eax
call dword [edx + 0x2c]
test eax, eax
jne 0x401151
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x401102
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea edx, [esp + 0x11c]
push edx
push 0x400
call esi
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ebx, dword [esp + 0x520]
push ebx
push 0x104
call esi
lea ecx, [esp + 0x11c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push ebx
call fcn.004025a0
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x510
ret
cmp eax, 2
jne 0x401147
lea edi, [esp + 0x18]
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x520]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.004025a0
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x510
ret
mov eax, dword [esp + 0x520]
mov byte [eax], 0
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x510
ret
Function at 0x401160
Capabilities:
Create directory
Get hostname

Disassembly:
mov al, byte [0x4288c0]
sub esp, 0x80
test al, al
push ebx
push esi
push edi
jne 0x401279
lea eax, [esp + 0xc]
push 0x80
push eax
call sub.WSOCK32.dll_gethostname
push 0x4288c0
call fcn.00401000
add esp, 4
test eax, eax
jne 0x4011a0
pop edi
pop esi
pop ebx
add esp, 0x80
ret
mov edi, str._print_submit
or ecx, 0xffffffff
xor eax, eax
push 0x4288c0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x4288c0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00402820
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add esp, 4
test eax, eax
jne 0x4011fb
push 0
push 0x4288c0
call ebx
test eax, eax
jne 0x4011fb
pop edi
pop esi
pop ebx
add esp, 0x80
ret
mov edi, 0x423070
or ecx, 0xffffffff
xor eax, eax
push 0x4288c0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x4288c0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x10]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x4288c0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00402820
add esp, 4
test eax, eax
jne 0x401279
push eax
push 0x4288c0
call ebx
test eax, eax
jne 0x401279
pop edi
pop esi
pop ebx
add esp, 0x80
ret
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x80
ret

Function at 0x401290
Capabilities:
Print debug messages
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push eax
call esi
push 0x42318c
call esi
push str.usage:_sdi_api_results_fname_hostname_port_num__printers_n
call esi
push str.usage:_sdi_api_results_fname_hostname_port_num__cli_printer_profile_cgm_file_copies___o_output_file_name__n
call esi
push str.usage:_sdi_api_results_fname_hostname_port_num__direct_cgm_file_copies___o_output_file_name__n
call esi
push 1
call fcn.004141ed
pop esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x402820
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret

Function at 0x402840
Capabilities:
Create directory

Disassembly:
sub esp, 0x104
push ebx
mov ebx, dword [esp + 0x10c]
push ebp
xor ebp, ebp
mov al, byte [ebx]
push esi
test al, al
push edi
je 0x4028e2
cmp byte [ebx + ebp], 0x5c
jne 0x402886
cmp byte [ebx + ebp + 1], 0x5c
jne 0x402886
mov al, byte [ebx + 2]
mov ebp, 2
test al, al
je 0x402886
cmp al, 0x2f
je 0x402885
mov al, byte [ebx + ebp + 1]
inc ebp
test al, al
jne 0x402876
jmp 0x402886
inc ebp
cmp byte [ebx + ebp], 0x2f
jne 0x4028d5
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
mov byte [esp + ebp + 0x11], 0
push ecx
call fcn.00402820
add esp, 4
test eax, eax
jne 0x4028d5
lea edx, [esp + 0x10]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x40292c
mov al, byte [ebx + ebp + 1]
inc ebp
test al, al
jne 0x40285d
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
push ecx
call fcn.00402820
add esp, 4
test eax, eax
jne 0x402939
lea edx, [esp + 0x10]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x402939
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x104
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x104
ret

Function at 0x402990
Capabilities:
Move file

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push esi
call fcn.00402820
add esp, 4
test eax, eax
je 0x4029ab
push esi
call fcn.00402950
add esp, 4
mov eax, dword [esp + 8]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
pop esi
ret

Function at 0x402a90
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [0x42a0fc]
sub esp, 0x400
test eax, eax
jne 0x402ab4
push 0x42a0e0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x42a0fc], 1
push 0x42a0e0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [esp + 0x404]
lea eax, [esp + 0x408]
push eax
lea edx, [esp + 4]
push ecx
push edx
call fcn.00415054
add esp, 0xc
push 0x42a0e0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x400
ret
Function at 0x4032b0
Capabilities:
Print debug messages

Disassembly:
push esi
or edx, 0xffffffff
push edi
mov edi, 0x42ad90
mov ecx, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [0x423738], edx
mov eax, ecx
mov esi, edi
mov edi, 0x42ae90
mov dword [0x42af44], 0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0x42af14]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x423734]
pop edi
test eax, eax
mov dword [0x42a704], ecx
mov byte [0x42ad90], 0
mov dword [0x423734], edx
pop esi
je 0x403312
call fcn.0040be70
mov dword [0x42af14], 0
jmp 0x40a140
mov eax, dword [0x42fd28]
test eax, eax
je 0x40a171
call fcn.0040a180
test eax, eax
je 0x40a157
call fcn.0040a400
mov dword [0x42fd28], 0
call sub.WSOCK32.dll_WSACleanup
push str.client_cleanup:_WSACleanup__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
ret
Function at 0x4035a0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call fcn.00403610
add esp, 4
test eax, eax
jne 0x4035b4
pop esi
ret
mov eax, dword [0x42af10]
test eax, eax
jne 0x403605
push 0
push esi
push 0
push 0
push 0xc8
push 0x12c
push 0x32
push 0x32
push closesocket
push str.pm_api
push str.pm_api
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
test eax, eax
mov dword [0x42af10], eax
jne 0x4035fc
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
pop esi
ret
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
pop esi
ret