joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002b2d9
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x1007c060]
xor eax, ebp
mov dword [ebp + 0x18c], eax
and dword [ebp - 0x80], 0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x7c], ax
lea eax, [ebp - 0x7a]
push eax
call fcn.1004e1c0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.Logs_accelerator
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x7c]
mov ecx, esi
call fcn.10002e30
mov ecx, dword [ebp + 0x18c]
xor ecx, ebp
mov eax, esi
call fcn.1004a172
add ebp, 0x190
leave
ret

Function at 0x1002b34f
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x1007c060]
xor eax, ebp
mov dword [ebp + 0x18c], eax
and dword [ebp - 0x80], 0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x7c], ax
lea eax, [ebp - 0x7a]
push eax
call fcn.1004e1c0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.Logsignored
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x7c]
mov ecx, esi
call fcn.10002e30
mov ecx, dword [ebp + 0x18c]
xor ecx, ebp
mov eax, esi
call fcn.1004a172
add ebp, 0x190
leave
ret

Function at 0x1002b3c5
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x224
lea ebp, [esp - 4]
mov eax, dword [0x1007c060]
xor eax, ebp
mov dword [ebp + 0x224], eax
push 4
mov eax, 0x10061eb3
call fcn.1004b051
mov edi, dword [ebp + 0x230]
mov esi, dword [ebp + 0x238]
xor eax, eax
xor ebx, ebx
push 0x206
mov word [ebp + 0x1c], ax
lea eax, [ebp + 0x1e]
push ebx
push eax
mov dword [ebp - 0x10], ebx
call fcn.1004e1c0
add esp, 0xc
push 0x104
lea eax, [ebp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
cmp dword [ebp + 0x234], 1
jne 0x1002b431
push str.projonepodlp
jmp 0x1002b43f
cmp dword [ebp + 0x234], 2
jne 0x1002b45d
push str.projonepotcm
lea eax, [ebp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp esi, ebx
je 0x1002b458
push esi
lea eax, [ebp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp + 0x1c]
jmp 0x1002b4ad
cmp dword [ebp + 0x234], ebx
jne 0x1002b4a8
push ebx
lea eax, [ebp]
push 2
push eax
call fcn.1002b3c5
add esp, 0xc
mov dword [ebp - 4], ebx
cmp dword [ebp + 0x18], 8
mov eax, dword [ebp + 4]
jae 0x1002b483
lea eax, [ebp + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
push esi
test eax, eax
je 0x1002b4a4
push 2
push edi
call fcn.1002b3c5
add esp, 0xc
lea esi, [ebp]
call fcn.10009500
jmp 0x1002b4b4
push 1
jmp 0x1002b491
mov eax, 0x1006a9e0
mov ecx, edi
call fcn.10002e30
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x224]
xor ecx, ebp
call fcn.1004a172
add ebp, 0x228
leave
ret
Function at 0x1002bca0
Capabilities:
Get file version info

Disassembly:
push ebp
lea ebp, [esp - 0x20a0]
mov eax, 0x2120
call fcn.10055c00
mov eax, dword [0x1007c060]
xor eax, ebp
mov dword [ebp + 0x209c], eax
mov eax, dword [ebp + 0x20a8]
push ebx
push esi
push edi
xor ebx, ebx
push 0x1fff
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x63]
mov esi, ecx
push ebx
mov dword [ebp - 0x6c], ebx
push eax
mov dword [ebp - 0x70], esi
mov edi, edx
mov byte [ebp - 0x64], bl
call fcn.1004e1c0
add esp, 0xc
lea eax, [ebp - 0x64]
push eax
push 0x2000
push ebx
push edi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x1002bd13
mov eax, 0x1006a9e0
mov ecx, esi
call fcn.10002e30
mov eax, esi
jmp 0x1002be0b
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x7c]
push eax
push str.VarFileInfoTranslation
lea eax, [ebp - 0x64]
push eax
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x68], ebx
call sub.VERSION.dll_VerQueryValueW
mov edi, dword [sym.imp.SHLWAPI.dll_wnsprintfW]
test eax, eax
je 0x1002bda6
test dword [ebp - 0x68], 0xfffffffc
mov esi, dword [ebp - 0x7c]
mov dword [ebp - 0x74], ebx
jbe 0x1002bda6
mov eax, dword [ebp - 0x74]
push dword [ebp - 0x80]
shl eax, 2
movzx ecx, word [eax + esi + 2]
movzx eax, word [eax + esi]
push ecx
push eax
push str.StringFileInfo_04x_04x_s
lea eax, [ebp + 0x1f9c]
push 0x80
push eax
call edi
add esp, 0x18
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x1f9c]
push eax
lea eax, [ebp - 0x64]
push eax
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x1002be23
mov eax, dword [ebp - 0x68]
inc dword [ebp - 0x74]
shr eax, 2
cmp dword [ebp - 0x74], eax
jb 0x1002bd48
mov dword [ebp - 0x78], 0x40904b0
mov dword [ebp - 0x74], 0x40904e4
xor esi, esi
push dword [ebp - 0x80]
lea eax, [ebp + 0x1f9c]
push dword [ebp + esi*4 - 0x78]
push str.StringFileInfo_08x_s
push 0x80
push eax
call edi
add esp, 0x14
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x1f9c]
push eax
lea eax, [ebp - 0x64]
push eax
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x1002be23
inc esi
cmp esi, 2
jb 0x1002bdb6
mov ecx, dword [ebp - 0x70]
mov eax, 0x1006a9e0
call fcn.10002e30
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp + 0x209c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004a172
add ebp, 0x20a0
leave
ret
push dword [ebp - 0x68]
mov edi, dword [ebp - 0x70]
push dword [ebp - 0x6c]
call fcn.1002bc33
pop ecx
pop ecx
mov eax, edi
jmp 0x1002be0b
Function at 0x10032c30
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x1007c060]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push edi
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 3
push 0xc0000000
mov edi, str..gxdte_cd
push edi
call esi
cmp eax, 0xffffffff
jne 0x10032d17
xor eax, eax
push 0x206
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push ebx
push eax
call fcn.1004e1c0
add esp, 0xc
call fcn.10032bb8
mov ebx, eax
push 0x104
lea eax, [ebp - 0x210]
push eax
xor ecx, ecx
call fcn.10025e24
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10032cdd
cmp word [0x100806e8], ax
je 0x10032cdd
push 0x100806e8
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push ebx
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
call fcn.10025fa9
mov ebx, str.gxdte64.sys
test eax, eax
jne 0x10032cf0
mov ebx, str.gxdte32.sys
call fcn.10027bb8
push ebx
lea ecx, [ebp - 0x210]
call fcn.100435ff
call fcn.10027b57
xor eax, eax
push eax
push eax
push 3
push eax
push 3
push 0xc0000000
push edi
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004a172
leave
ret

Function at 0x100343bc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [eax + 0x18], 0x10
jb 0x100343cd
mov eax, dword [eax + 4]
jmp 0x100343d0
add eax, 4
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 8]
push ecx
push eax
push str.Softwareprojonepodlpkeyrule_secClass_
push 0x80000002
mov dword [ebp - 4], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x10034403
cmp dword [ebp - 8], 4
jne 0x10034403
mov eax, dword [ebp - 0xc]
leave
ret
xor eax, eax
leave
ret

Function at 0x10034d3e
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100666e2
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push esi
push edi
mov eax, dword [0x1007c060]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
lea eax, [esp + 0x2c]
push eax
call fcn.100349b0
pop ecx
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x30]
push eax
push dword [ebp + 8]
xor edi, edi
mov dword [esp + 0x5c], edi
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], edi
call fcn.1004577f
or dword [esp + 0x5c], 0xffffffff
add esp, 0xc
lea esi, [esp + 0x2c]
call fcn.1003630d
push dword [esp + 0x2c]
call fcn.1004a7e9
pop ecx
cmp dword [esp + 0x10], edi
je 0x10034dc9
xor eax, eax
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x14]
push eax
call fcn.10034732
pop ecx
mov dword [esp + 0x50], 1
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x20]
test eax, 0xffffffe0
jne 0x10034e02
lea esi, [esp + 0x14]
call fcn.1003630d
push dword [esp + 0x14]
call fcn.1004a7e9
pop ecx
mov eax, edi
jmp 0x10034db7
lea eax, [esp + 0x14]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10045998
add esp, 0xc
mov edi, eax
jmp 0x10034deb
Function at 0x10034e70
Capabilities:
Check if file exists
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1007c060]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 1
mov esi, ecx
push ebx
push esi
mov dword [ebp - 0x24], esi
call edi
test eax, eax
jne 0x10034f34
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x10034ec5
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10034ebd
and eax, 0xfffffffe
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 1
push ebx
push esi
call edi
jmp 0x10034f37
call fcn.100261f3
push eax
push ebx
push str._s._08x
lea esi, [ebp - 0x20]
call fcn.100275a7
mov eax, dword [ebp - 0x1c]
add esp, 0xc
cmp dword [ebp - 8], 8
jae 0x10034ee8
lea eax, [ebp - 0x1c]
push 1
push eax
push ebx
call edi
test eax, eax
je 0x10034f30
push 1
push ebx
push dword [ebp - 0x24]
call edi
test eax, eax
je 0x10034f1e
cmp dword [ebp - 8], 8
mov esi, dword [ebp - 0x1c]
jae 0x10034f0a
lea esi, [ebp - 0x1c]
call fcn.10025d6a
xor edi, edi
inc edi
lea esi, [ebp - 0x20]
call fcn.10009500
mov eax, edi
jmp 0x10034f37
cmp dword [ebp - 8], 8
mov eax, dword [ebp - 0x1c]
jae 0x10034f2a
lea eax, [ebp - 0x1c]
push 1
push ebx
push eax
call edi
xor edi, edi
jmp 0x10034f12
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1004a172
leave
ret

Function at 0x10034f65
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1007c060]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
xor esi, esi
cmp ebx, esi
je 0x10035018
push ebx
call fcn.10035703
pop ecx
test eax, eax
je 0x10035018
xor eax, eax
push 0x206
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push esi
push eax
call fcn.1004e1c0
add esp, 0xc
call fcn.100261f3
push eax
push ebx
push str._s._08x
lea eax, [ebp - 0x210]
push 0x104
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x14
push ebx
call fcn.10034f45
pop ecx
lea eax, [ebp - 0x210]
push eax
push ebx
call fcn.10034d3e
pop ecx
pop ecx
test eax, eax
je 0x1003500b
lea ecx, [ebp - 0x210]
call fcn.10034e70
test eax, eax
jne 0x10035028
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 5
jl 0x10034fee
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1004a172
leave
ret
xor eax, eax
inc eax
jmp 0x1003501a
Function at 0x10035130
Capabilities:
Delete file
Get common file path

Disassembly:
push 0x478
mov eax, 0x100666aa
call fcn.1004b0ba
mov esi, ecx
push esi
mov dword [ebp - 0x42c], esi
call fcn.1003502d
pop ecx
test eax, eax
je 0x1003539e
push esi
call fcn.10035073
pop ecx
test eax, eax
je 0x1003539e
and dword [ebp - 0x428], 0
xor eax, eax
mov edi, 0x206
push edi
push eax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push eax
call fcn.1004e1c0
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.100261f3
push eax
push str.___08x
lea esi, [ebp - 0x450]
call fcn.100275a7
cmp dword [eax + 0x18], 8
pop ecx
pop ecx
jb 0x100351c0
mov eax, dword [eax + 4]
jmp 0x100351c3
add eax, 4
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push eax
lea eax, [ebp - 0x21c]
push eax
call ebx
lea esi, [ebp - 0x450]
call fcn.10009500
lea esi, [ebp - 0x21c]
call fcn.100257dd
test eax, eax
je 0x1003538a
mov ecx, dword [ebp - 0x42c]
xor esi, esi
push esi
lea edx, [ebp - 0x21c]
call fcn.10042f53
pop ecx
test eax, eax
jne 0x1003538a
mov eax, dword [ebp + 8]
mov dword [ebp - 0x434], eax
push esi
lea eax, [ebp - 0x428]
push esi
mov dword [ebp - 0x430], eax
lea eax, [ebp - 0x434]
push eax
push 0x100353a6
push 1
lea eax, [ebp - 0x21c]
push eax
call fcn.100252d5
cmp dword [ebp - 0x428], esi
je 0x1003538a
xor eax, eax
push edi
mov word [ebp - 0x424], ax
lea eax, [ebp - 0x422]
push esi
push eax
call fcn.1004e1c0
add esp, 0xc
push dword [ebp - 0x42c]
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [ebp - 0x42c]
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov edi, eax
cmp edi, esi
je 0x1003529f
push str..rar
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1003529f
mov edi, str..zip
push edi
call fcn.100261f3
push eax
push str..._08x._s
lea esi, [ebp - 0x450]
call fcn.100275a7
add esp, 0xc
cmp dword [eax + 0x18], 8
jb 0x100352c4
mov eax, dword [eax + 4]
jmp 0x100352c7
add eax, 4
push eax
lea eax, [ebp - 0x424]
push eax
call ebx
lea esi, [ebp - 0x450]
call fcn.10009500
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x468]
push eax
call fcn.10025690
and dword [ebp - 4], 0
lea eax, [ebp - 0x484]
push eax
lea ecx, [ebp - 0x468]
call fcn.10036f6a
add esp, 0xc
mov ecx, eax
lea ebx, [ebp - 0x424]
mov byte [ebp - 4], 1
call fcn.10042b1c
mov ebx, eax
neg ebx
sbb bl, bl
lea edi, [ebp - 0x484]
inc bl
mov byte [ebp - 4], 0
call fcn.10028284
push dword [ebp - 0x484]
call fcn.1004a7e9
pop ecx
test bl, bl
je 0x10035374
xor esi, esi
mov ebx, dword [ebp - 0x42c]
lea ecx, [ebp - 0x424]
call fcn.10034e70
test eax, eax
jne 0x1003537b
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 5
jl 0x10035342
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1003537b
and dword [ebp - 0x428], 0
or dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x468]
call fcn.10003370
lea eax, [ebp - 0x21c]
push eax
call fcn.10025d98
mov eax, dword [ebp - 0x428]
jmp 0x100353a0
xor eax, eax
call fcn.1004b13d
ret
Function at 0x100353c7
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
mov eax, dword [0x1007c060]
xor eax, esp
mov dword [esp + 0x218], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x10]
test ebx, ebx
je 0x100354cc
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100354cc
and dword [esp + 0x10], 0
xor eax, eax
push 0x206
push eax
mov word [esp + 0x20], ax
lea eax, [esp + 0x22]
push eax
call fcn.1004e1c0
add esp, 0xc
call fcn.100261f3
push eax
push ebx
push str._s._08x
lea eax, [esp + 0x24]
push 0x104
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x14
push ebx
call fcn.10034f45
pop ecx
lea eax, [esp + 0x18]
push eax
push ebx
call fcn.10034e19
xor esi, esi
pop ecx
inc esi
pop ecx
test eax, eax
je 0x1003549f
and dword [esp + 0x14], 0
lea ecx, [esp + 0x18]
call fcn.10034e70
test eax, eax
jne 0x10035481
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 5
jl 0x1003545f
jmp 0x1003549f
cmp dword [ebp + 0xc], 2
mov dword [esp + 0x10], esi
jne 0x1003549f
push 2
mov ecx, ebx
call fcn.10035130
pop ecx
test eax, eax
je 0x1003549f
test edi, edi
je 0x1003549f
mov dword [edi], esi
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp + 0xc], esi
jne 0x100354c6
push esi
mov ecx, ebx
call fcn.10035130
pop ecx
test eax, eax
je 0x100354c6
mov dword [esp + 0x10], esi
test edi, edi
je 0x100354c6
mov dword [edi], esi
mov eax, dword [esp + 0x10]
jmp 0x100354ce
xor eax, eax
mov ecx, dword [esp + 0x224]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1004a172
mov esp, ebp
pop ebp
ret
Function at 0x10041f34
Capabilities:
Initialize winsock library
Send data
Send data on socket

Disassembly:
push 0x1e0
mov eax, 0x10065986
call fcn.1004b0ba
mov eax, dword [ebp + 8]
push eax
lea ebx, [ebp - 0x5c]
call fcn.1003aa8d
xor esi, esi
push esi
push esi
push str.t_auto_encdec_log
mov ecx, ebx
mov dword [ebp - 4], esi
call fcn.10041707
add esp, 0xc
test eax, eax
jne 0x10041f81
xor edi, edi
or dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x5c]
call fcn.1003ac21
mov eax, edi
call fcn.1004b13d
ret 4
cmp dword [0x1007f5ec], esi
je 0x10041fce
push 0x190
lea eax, [ebp - 0x1ec]
push esi
push eax
call fcn.1004e1c0
add esp, 0xc
lea eax, [ebp - 0x1ec]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
push esi
push 2
push 2
call sub.WS2_32.dll_socket
mov dword [0x1007f5f0], eax
cmp eax, 0xffffffff
jne 0x10041fc8
xor edi, edi
inc edi
jmp 0x10041f6b
mov dword [0x1007f5ec], esi
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x40]
call fcn.1003bfa0
cmp dword [ebp - 0x28], 0x10
push 2
pop eax
mov word [ebp - 0x24], ax
mov eax, 0xe832
mov word [ebp - 0x22], ax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x20], 0x100007f
jae 0x10041ffd
lea eax, [ebp - 0x3c]
push 0x10
lea ecx, [ebp - 0x24]
push ecx
push esi
push dword [ebp - 0x2c]
push eax
push dword [0x1007f5f0]
call sub.WS2_32.dll_sendto
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov esi, ecx
lea ecx, [ebp - 0x40]
call fcn.10002e00
mov edi, esi
jmp 0x10041f6b

Function at 0x100420b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
or eax, 0xffffffff
test edx, edx
je 0x100420d4
push esi
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x1007d958]
dec edx
inc ecx
test edx, edx
jne 0x100420b8
pop esi
not eax
ret
Function at 0x10042222
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0x130
mov eax, dword [0x1007c060]
xor eax, ebp
mov dword [ebp + 0x68], eax
mov eax, dword [ebp + 0x74]
and dword [ebp - 0xc4], 0
push esi
push edi
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp + 0x78]
push 0x3f
mov dword [ebp - 0xc0], eax
lea eax, [ebp - 0x3f]
push 0
push eax
mov byte [ebp - 0x40], 0
call fcn.1004e1c0
mov esi, 0x1006cc50
lea edi, [ebp - 0x40]
movsd dword es:[edi], dword [esi]
add esp, 0xc
movsb byte es:[edi], byte [esi]
xor ecx, ecx
mov al, byte [ebp + ecx - 0x40]
mov dl, al
xor dl, 0x36
xor al, 0x5c
mov byte [ebp + ecx - 0x9c], dl
mov byte [ebp + ecx], al
inc ecx
cmp ecx, 0x40
jb 0x10042272
lea eax, [ebp - 0x5c]
call fcn.1004944a
lea eax, [ebp - 0x9c]
push eax
push 0x40
pop eax
lea esi, [ebp - 0x5c]
call fcn.10049475
push dword [ebp - 0xc0]
mov eax, dword [ebp + 0x7c]
call fcn.10049475
lea eax, [ebp + 0x54]
push eax
mov ecx, esi
call fcn.1004950d
lea eax, [ebp - 0xb8]
call fcn.1004944a
lea eax, [ebp]
push eax
push 0x40
pop eax
lea esi, [ebp - 0xb8]
call fcn.10049475
lea eax, [ebp + 0x54]
push eax
push 0x14
pop eax
call fcn.10049475
lea eax, [ebp + 0x40]
push eax
mov ecx, esi
call fcn.1004950d
mov esi, dword [ebp - 0xbc]
add esp, 0x18
push 0x14
lea eax, [ebp + 0x40]
push eax
call fcn.10027d63
mov ecx, dword [ebp + 0x68]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1004a172
add ebp, 0x6c
leave
ret
Function at 0x1004231c
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x1007c060]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x144], 0
push esi
push edi
mov dword [ebp - 0x140], eax
mov eax, dword [ebp + 0xc]
push 0x3f
mov dword [ebp - 0x13c], eax
lea eax, [ebp - 0xa7]
push 0
push eax
mov esi, ecx
mov byte [ebp - 0xa8], 0
call fcn.1004e1c0
add esp, 0xc
cmp dword [ebp + 0x14], 0x40
ja 0x10042381
push dword [ebp + 0x14]
lea eax, [ebp - 0xa8]
push esi
push eax
call fcn.1004e6f0
add esp, 0xc
jmp 0x100423ba
lea eax, [ebp - 0x138]
call fcn.100495ce
mov eax, dword [ebp + 0x14]
push esi
lea ecx, [ebp - 0x138]
call fcn.1004960e
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x138]
call fcn.1004969a
pop ecx
pop ecx
push 0x10
pop ecx
lea esi, [ebp - 0x28]
lea edi, [ebp - 0xa8]
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
mov al, byte [ebp + ecx - 0xa8]
mov dl, al
xor dl, 0x36
xor al, 0x5c
mov byte [ebp + ecx - 0x48], dl
mov byte [ebp + ecx - 0x110], al
inc ecx
cmp ecx, 0x40
jb 0x100423bc
lea eax, [ebp - 0xd0]
call fcn.100495ce
lea eax, [ebp - 0x48]
push eax
push 0x40
pop eax
lea ecx, [ebp - 0xd0]
call fcn.1004960e
push dword [ebp - 0x13c]
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0xd0]
call fcn.1004960e
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0xd0]
call fcn.1004969a
lea eax, [ebp - 0xd0]
call fcn.100495ce
lea eax, [ebp - 0x110]
push eax
push 0x40
pop eax
lea ecx, [ebp - 0xd0]
call fcn.1004960e
lea eax, [ebp - 0x28]
push eax
push 0x20
pop eax
lea ecx, [ebp - 0xd0]
call fcn.1004960e
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0xd0]
call fcn.1004969a
mov esi, dword [ebp - 0x140]
add esp, 0x18
push 0x20
lea eax, [ebp - 0x68]
push eax
call fcn.10027d63
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1004a172
leave
ret

Function at 0x100426d3
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push esi
push esi
push 3
push esi
push 3
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp eax, esi
je 0x10042729
cmp eax, 0xffffffff
je 0x10042729
push esi
lea ecx, [ebp - 4]
push ecx
push 4
lea ecx, [ebp - 8]
push ecx
push eax
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10042729
cmp dword [ebp - 4], 4
jne 0x10042729
cmp dword [ebp - 8], 0x21726152
jne 0x10042729
inc esi
lea eax, [ebp - 0xc]
call fcn.1002509f
mov eax, esi
pop esi
leave
ret
Function at 0x10042b1c
Capabilities:
Check if file exists

Disassembly:
push 0x6c
mov eax, 0x10061e86
call fcn.1004b0ba
lea eax, [ebp - 0x5c]
push eax
mov esi, ecx
call fcn.10027de0
and dword [ebp - 4], 0
mov eax, dword [esi + 0x14]
mov ecx, dword [eax]
mov dword [ebp - 0x34], ecx
mov ecx, dword [esi]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], ecx
jmp 0x10042b86
lea esi, [ebp - 0x38]
call fcn.10027e40
cmp dword [eax + 0x18], 8
jb 0x10042b5f
mov eax, dword [eax + 4]
jmp 0x10042b62
add eax, 4
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10042b7e
lea esi, [ebp - 0x38]
call fcn.10027e40
push eax
lea eax, [ebp - 0x5c]
call fcn.10027e27
lea esi, [ebp - 0x38]
call fcn.10027e6b
lea edi, [ebp - 0x40]
lea esi, [ebp - 0x38]
call fcn.10027e9a
test al, al
jne 0x10042b4c
cmp dword [ebp - 0x44], 0
jne 0x10042bb9
mov esi, 0x44e
lea edi, [ebp - 0x5c]
call fcn.10028284
push dword [ebp - 0x5c]
call fcn.1004a7e9
pop ecx
mov eax, esi
call fcn.1004b13d
ret
mov edi, ebx
call fcn.100256d3
mov esi, ebx
call fcn.10025d6a
push ebx
push 0x1006f420
push 0x1006f42c
lea esi, [ebp - 0x30]
call fcn.100275a7
add esp, 0xc
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x5c]
mov ecx, dword [eax]
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], eax
jmp 0x10042c43
lea esi, [ebp - 0x38]
call fcn.10027e40
cmp dword [eax + 0x18], 8
jb 0x10042c0a
mov eax, dword [eax + 4]
jmp 0x10042c0d
add eax, 4
push eax
push str.___s_
lea esi, [ebp - 0x78]
call fcn.100275a7
pop ecx
pop ecx
push 0
push eax
or eax, 0xffffffff
lea esi, [ebp - 0x30]
mov byte [ebp - 4], 2
call fcn.10004e80
lea esi, [ebp - 0x78]
mov byte [ebp - 4], 1
call fcn.10009500
lea esi, [ebp - 0x38]
call fcn.10027e6b
lea edi, [ebp - 0x40]
lea esi, [ebp - 0x38]
call fcn.10027e9a
test al, al
jne 0x10042bf7
mov esi, dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push ebx
call esi
test eax, eax
je 0x10042c80
push 0x1006e08c
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x10042c80
lea eax, [ebp - 0x30]
push eax
mov eax, str.__md1M
call fcn.100124f0
push 0
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x60], 0xf
call fcn.10004da0
mov byte [ebp - 4], 4
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x10042ca1
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x78]
push ecx
push eax
call fcn.10042667
pop ecx
pop ecx
lea ecx, [ebp - 0x78]
mov edi, eax
call fcn.10002e00
test edi, edi
je 0x10042cc2
mov esi, ebx
call fcn.10025d6a
lea esi, [ebp - 0x30]
call fcn.10009500
mov esi, edi
jmp 0x10042ba0