joyce8/EMBER2024-capa huggingface dataset:
Function at 0x65bfd0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x18f000]
lea eax, [edi + 0x1d8ef0]
push dword [eax]
mov dword [eax], 0xe18485b2
push eax
push edi
jmp 0x65bffa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x65c001
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x65bff0
mov eax, 1
add ebx, ebx
jne 0x65c013
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x65c024
jne 0x65c043
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x65c043
dec eax
add ebx, ebx
jne 0x65c030
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x65c008
add ebx, ebx
jne 0x65c03f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x65c095
xor ecx, ecx
sub eax, 3
jb 0x65c05b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x65c0ca
sar eax, 1
mov ebp, eax
jmp 0x65c066
add ebx, ebx
jne 0x65c066
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x65c034
inc ecx
add ebx, ebx
jne 0x65c074
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x65c034
add ebx, ebx
jne 0x65c081
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x65c076
jne 0x65c092
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x65c076
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x65c0b4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x65c0a6
jmp 0x65bff6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x65c0b4
add edi, ecx
jmp 0x65bff6
pop esi
pop edi
pop eax
mov dword [edi], eax
mov edi, esi
mov ecx, 0xcac5
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x65c0d6
cmp byte [edi], 0x24
jne 0x65c0d6
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x65c0db
lea edi, [esi + 0x248000]
mov eax, dword [edi]
or eax, eax
je 0x65c153
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2871cc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x287354]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x65c108
mov ecx, edi
jns 0x65c137
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x28735c]
or eax, eax
je 0x65c14d
mov dword [ebx], eax
add ebx, 4
jmp 0x65c125
call dword [esi + 0x287358]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x65c184
cmp al, 0xef
ja 0x65c177
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x65c159
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x65c166
mov ebp, dword [esi + 0x287360]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x237]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x65c1b8
sub esp, 0xffffff80
jmp 0x53b4e6
Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x3c9c046b
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..text_1
nop
mov ebx, 0x42f314
mov ecx, 0x345b7b5b
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x432084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x57061f80
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x2a7e06a1
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x402a90
Capabilities:
Get hostname
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa1c
mov eax, dword [0x4efa64]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 0x4f05e3
push 0x4f05e4
call fcn.0040dc10
add esp, 0xc
mov dword [ebp - 0xa1c], eax
cmp dword [ebp - 0xa1c], 0
je 0x402b04
mov eax, dword [ebp - 0xa1c]
add eax, 0x288
push eax
push str.LICENSE__s
lea ecx, [ebp - 0x110]
push ecx
call fcn.00404080
add esp, 0xc
mov edx, dword [ebp - 0xa1c]
add edx, 0x288
push edx
lea eax, [ebp - 0xac]
push eax
call fcn.004789e0
add esp, 8
jmp 0x402b2c
mov ecx, dword [0x4f05b4]
add ecx, 1
mov dword [0x4f05b4], ecx
push str.ERROR_initializing_RLM_n
call fcn.00404040
add esp, 4
mov edx, dword [0x4f05b4]
push edx
call fcn.004791f0
mov eax, dword [ebp - 0xa1c]
add eax, 0x288
push eax
call fcn.004047e0
add esp, 4
push 0xff
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.WS2_32.dll_gethostname]
push 0x3ff
lea edx, [ebp - 0xa14]
push edx
call fcn.00413d00
add esp, 8
push 0x4db2fc
push 0x4db30c
push 0x4db318
push 0x4f05e8
call fcn.00404080
add esp, 0x10
push 0x4f05e8
call fcn.00491630
add esp, 4
call fcn.00407360
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.004789e0
add esp, 8
push 0x4db320
push 0x4db324
call fcn.00413c90
add esp, 8
mov dword [ebp - 0xa18], eax
cmp dword [ebp - 0xa18], 0
je 0x402c75
mov ecx, dword [0x4da010]
push ecx
lea edx, [ebp - 0x48]
push edx
mov eax, dword [0x4da018]
push eax
push str.HOST__s__s__d_n
mov ecx, dword [ebp - 0xa18]
push ecx
call fcn.00404000
add esp, 0x14
lea edx, [ebp - 0xac]
push edx
lea eax, [ebp - 0xa14]
push eax
lea ecx, [ebp - 0xac]
push ecx
push str.ISV__s___s_s.exe__rlmtests.ts_opt_n
mov edx, dword [ebp - 0xa18]
push edx
call fcn.00404000
add esp, 0x14
lea eax, [ebp - 0x110]
push eax
push str._s_d_10.000_permanent_1000000_key_n
lea ecx, [ebp - 0x614]
push ecx
call fcn.00404080
add esp, 0xc
lea edx, [ebp - 0x614]
push edx
lea eax, [ebp - 0x48]
push eax
mov ecx, dword [ebp - 0xa1c]
push ecx
call fcn.00403f00
add esp, 0xc
lea edx, [ebp - 0x614]
push edx
push 0x4db38c
mov eax, dword [ebp - 0xa18]
push eax
call fcn.00404000
add esp, 0xc
mov ecx, dword [ebp - 0xa18]
push ecx
call fcn.0046aa00
add esp, 4
jmp 0x402c96
mov edx, dword [0x4f05b4]
add edx, 1
mov dword [0x4f05b4], edx
push str.rlmtests.ts_lic
push str.Cannot_create_license_file__s_n
call fcn.00404040
add esp, 8
push 0x4db3c0
push 0x4db3c4
call fcn.00413c90
add esp, 8
mov dword [ebp - 0xa18], eax
cmp dword [ebp - 0xa18], 0
je 0x402d09
push str.rlmtests.ts_rpt
push str.REPORTLOG__s_detailed_n
mov eax, dword [ebp - 0xa18]
push eax
call fcn.00404000
add esp, 0xc
push str.NOLOG_out_n
mov ecx, dword [ebp - 0xa18]
push ecx
call fcn.00404000
add esp, 8
push str.NOLOG_in_n
mov edx, dword [ebp - 0xa18]
push edx
call fcn.00404000
add esp, 8
mov eax, dword [ebp - 0xa18]
push eax
call fcn.0046aa00
add esp, 4
jmp 0x402d2a
mov ecx, dword [0x4f05b4]
add ecx, 1
mov dword [0x4f05b4], ecx
push str.rlmtests.ts_opt
push str.Cannot_create_option_file__s_n
call fcn.00404040
add esp, 8
mov edx, dword [ebp - 0xa1c]
push edx
call fcn.0040d830
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464bf6
mov esp, ebp
pop ebp
ret
Function at 0x4035b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x160
mov eax, dword [0x4efa64]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x44
push 0
lea eax, [ebp - 0x150]
push eax
call fcn.00465af0
add esp, 0xc
mov dword [ebp - 0x150], 0x44
mov dword [ebp - 0x124], 1
xor ecx, ecx
mov word [ebp - 0x120], cx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [section..data]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x4db22c
mov edx, dword [ebp + 0xc]
push edx
push str._s__s__d__d__d
lea eax, [ebp - 0x108]
push eax
call fcn.00404080
add esp, 0x1c
lea ecx, [ebp - 0x160]
push ecx
lea edx, [ebp - 0x150]
push edx
push 0
push 0
push 0x20
push 0
push 0
push 0
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
jne 0x403684
mov ecx, dword [0x4f05b4]
add ecx, 1
mov dword [0x4f05b4], ecx
lea edx, [ebp - 0x108]
push edx
push str.perf_tests_client_startup_failed_with_command_line___s__n
push 2
call fcn.0046a210
add esp, 4
push eax
call fcn.00404000
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464bf6
mov esp, ebp
pop ebp
ret
Function at 0x404af0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x460
mov eax, dword [0x4efa64]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x40c], 0
push 0x44
push 0
lea eax, [ebp - 0x460]
push eax
call fcn.00465af0
add esp, 0xc
mov dword [ebp - 0x460], 0x44
mov dword [ebp - 0x434], 1
xor ecx, ecx
mov word [ebp - 0x430], cx
cmp dword [ebp + 8], 0
je 0x404b67
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
test eax, eax
je 0x404b67
mov ecx, dword [ebp + 8]
push ecx
push str.rlmutil_rlmdown_RLM__q__c__s
lea edx, [ebp - 0x404]
push edx
call fcn.00404080
add esp, 0xc
jmp 0x404b7b
push str.rlmutil_rlmdown_RLM__q
lea eax, [ebp - 0x404]
push eax
call fcn.004789e0
add esp, 8
lea ecx, [ebp - 0x41c]
push ecx
lea edx, [ebp - 0x460]
push edx
push 0
push 0
push 0x20
push 0
push 0
push 0
lea eax, [ebp - 0x404]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 0
jne 0x404bcb
push str.shutdown_server_failed_n
push 2
call fcn.0046a210
add esp, 4
push eax
call fcn.00404000
add esp, 8
push 0xa
call fcn.00407820
add esp, 4
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], 0
jne 0x404c32
lea ecx, [ebp - 0x41c]
push ecx
lea edx, [ebp - 0x460]
push edx
push 0
push 0
push 0x20
push 0
push 0
push 0
push str..._cloudbin_rlm_shutdown
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 0
jne 0x404c32
push str.FORCE_shutdown_server_failed_n
push 2
call fcn.0046a210
add esp, 4
push eax
call fcn.00404000
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464bf6
mov esp, ebp
pop ebp
ret
Function at 0x4078f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1e4
mov eax, dword [0x4efa64]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0
jne 0x40791f
mov dword [ebp - 0x17c], 0x3c
push str.TS_RUN_WEB
call fcn.00482fd0
add esp, 4
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 0
je 0x407948
cmp dword [ebp + 8], 0
jne 0x407948
mov dword [ebp + 8], 0x13be
cmp dword [ebp + 8], 0
je 0x407965
mov ecx, dword [ebp + 8]
push ecx
push str._ws__d
lea edx, [ebp - 0x74]
push edx
call fcn.00404080
add esp, 0xc
jmp 0x407976
push str._nows
lea eax, [ebp - 0x74]
push eax
call fcn.004789e0
add esp, 8
cmp dword [ebp + 0x20], 0
je 0x4079a7
mov ecx, 1
imul edx, ecx, 0
mov dword [ebp - 0x180], edx
cmp dword [ebp - 0x180], 0xa
jae 0x407995
jmp 0x40799a
call fcn.00464b1b
mov eax, dword [ebp - 0x180]
mov byte [ebp + eax - 0x10], 0
jmp 0x4079b8
push str._noudp
lea ecx, [ebp - 0x10]
push ecx
call fcn.004789e0
add esp, 8
push 0x44
push 0
lea edx, [ebp - 0x1d4]
push edx
call fcn.00465af0
add esp, 0xc
mov dword [ebp - 0x1d4], 0x44
mov dword [ebp - 0x1a8], 1
xor eax, eax
mov word [ebp - 0x1a4], ax
cmp dword [ebp + 0x14], 0
je 0x4079fa
mov dword [ebp - 0x184], str._dat
jmp 0x407a04
mov dword [ebp - 0x184], 0x4f0e6f
cmp dword [ebp + 0xc], 0
je 0x407a16
mov dword [ebp - 0x188], 0x4f0f88
jmp 0x407a20
mov dword [ebp - 0x188], str._x_rlmremove
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x184]
push eax
mov ecx, dword [ebp - 0x188]
push ecx
lea edx, [ebp - 0x74]
push edx
mov eax, dword [ebp + 0x18]
push eax
push str._s__s__s__s__s__dlog__s
lea ecx, [ebp - 0x178]
push ecx
call fcn.00404080
add esp, 0x20
lea edx, [ebp - 0x1e4]
push edx
lea eax, [ebp - 0x1d4]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
lea ecx, [ebp - 0x178]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0
jne 0x407aa9
lea edx, [ebp - 0x178]
push edx
push str.start_server_failed_with_command_line___s__n
push 2
call fcn.0046a210
add esp, 4
push eax
call fcn.00404000
add esp, 0xc
cmp dword [ebp + 0x2c], 0
je 0x407ac2
mov eax, dword [ebp + 0x24]
push eax
mov ecx, dword [ebp - 0x17c]
push ecx
call fcn.004076d0
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464bf6
mov esp, ebp
pop ebp
ret
Function at 0x412980
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc5c
mov eax, dword [0x4efa64]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc5c], 0
push 0x401
push 0
lea eax, [ebp - 0x44c]
push eax
call fcn.00465af0
add esp, 0xc
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x44], 0
jne 0x4129c3
xor eax, eax
jmp 0x412ac5
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x44]
add eax, 4
push eax
push 0x5c
mov ecx, dword [ebp + 0xc]
push ecx
push 0x5c
push 0
call fcn.00414790
add esp, 4
push eax
push 0x4e21ac
lea edx, [ebp - 0xc50]
push edx
call fcn.00404080
add esp, 0x1c
push 0x4e21bc
lea eax, [ebp - 0xc50]
push eax
call fcn.00484010
add esp, 8
mov dword [ebp - 0xc54], eax
cmp dword [ebp - 0xc54], 0
je 0x412abf
mov ecx, 1
imul edx, ecx, 0
mov dword [ebp - 0xc58], edx
cmp dword [ebp - 0xc58], 0x401
jae 0x412a37
jmp 0x412a3c
call fcn.00464b1b
mov eax, dword [ebp - 0xc58]
mov byte [ebp + eax - 0x44c], 0
mov ecx, dword [ebp - 0xc54]
push ecx
push 0x400
push 1
lea edx, [ebp - 0x44c]
push edx
call fcn.00484710
add esp, 0x10
push 0x4e21c0
lea eax, [ebp - 0x44c]
push eax
call fcn.004789f0
add esp, 8
lea ecx, [ebp - 0x48]
push ecx
lea edx, [ebp - 0xc5c]
push edx
mov eax, dword [ebp + 0x14]
push eax
push str._x__d____n_
lea ecx, [ebp - 0x44c]
push ecx
call fcn.004088c0
add esp, 0x14
push 0x40
lea edx, [ebp - 0x48]
push edx
mov eax, dword [ebp + 0x10]
push eax
call fcn.0041a010
add esp, 0xc
mov ecx, dword [ebp - 0xc54]
push ecx
call fcn.0046aa00
add esp, 4
mov eax, dword [ebp - 0xc5c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464bf6
mov esp, ebp
pop ebp
ret

Function at 0x413b20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 1
imul ecx, eax, 0
movsx edx, byte [ecx + 0x4f13c8]
test edx, edx
jne 0x413b70
push 1
push 0x23
push 0x4f13c8
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jl 0x413b70
push str.Reprise
push 0x4e2230
push 0x4f13c8
call fcn.004822f0
add esp, 4
add eax, 0x4f13c8
push eax
call fcn.00404080
add esp, 0xc
mov eax, 0x4f13c8
pop ebp
ret
Function at 0x413fc0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x318
mov eax, dword [0x4efa64]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x314], 0x101
lea eax, [ebp - 0x30c]
mov dword [ebp - 0x318], eax
mov ecx, dword [ebp - 0x314]
push ecx
push 0
lea edx, [ebp - 0x30c]
push edx
call fcn.00465af0
add esp, 0xc
lea eax, [ebp - 0x314]
push eax
mov ecx, dword [ebp - 0x318]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push 0x101
lea edx, [ebp - 0x108]
push edx
lea eax, [ebp - 0x30c]
push eax
call fcn.004147f0
add esp, 0xc
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0041a010
add esp, 0xc
mov ecx, dword [ebp + 8]
add ecx, dword [ebp + 0xc]
mov byte [ecx - 1], 0
mov edx, dword [ebp + 8]
mov dword [ebp - 0x310], edx
jmp 0x41406b
mov eax, dword [ebp - 0x310]
add eax, 1
mov dword [ebp - 0x310], eax
mov ecx, dword [ebp - 0x310]
movsx edx, byte [ecx]
test edx, edx
je 0x414144
mov eax, dword [ebp - 0x310]
movsx ecx, byte [eax]
and ecx, 0xff
push ecx
call fcn.004822b0
add esp, 4
test eax, eax
je 0x4140b7
mov edx, dword [ebp - 0x310]
movsx eax, byte [edx]
and eax, 0xff
push eax
call fcn.00486c70
add esp, 4
mov ecx, dword [ebp - 0x310]
mov byte [ecx], al
mov edx, dword [ebp - 0x310]
movsx eax, byte [edx]
and eax, 0xff
push eax
call fcn.00482290
add esp, 4
test eax, eax
je 0x4140dd
mov ecx, dword [ebp - 0x310]
mov byte [ecx], 0x5f
jmp 0x41413f
mov edx, dword [ebp - 0x310]
movsx eax, byte [edx]
cmp eax, 0x26
jne 0x4140f6
mov ecx, dword [ebp - 0x310]
mov byte [ecx], 0x41
jmp 0x41413f
mov edx, dword [ebp - 0x310]
movsx eax, byte [edx]
cmp eax, 0x22
jne 0x41410f
mov ecx, dword [ebp - 0x310]
mov byte [ecx], 0x51
jmp 0x41413f
mov edx, dword [ebp - 0x310]
movsx eax, byte [edx]
cmp eax, 0x3e
jne 0x414128
mov ecx, dword [ebp - 0x310]
mov byte [ecx], 0x47
jmp 0x41413f
mov edx, dword [ebp - 0x310]
movsx eax, byte [edx]
cmp eax, 0x3c
jne 0x41413f
mov ecx, dword [ebp - 0x310]
mov byte [ecx], 0x4c
jmp 0x41405c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464bf6
mov esp, ebp
pop ebp
ret

Function at 0x414330
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push eax
call fcn.004822f0
add esp, 4
add eax, 1
push eax
push 0
call fcn.004166d0
add esp, 8
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.004789e0
add esp, 8
cmp dword [ebp - 4], 0
jne 0x41436b
jmp 0x4143aa
mov eax, dword [ebp - 4]
push eax
call fcn.004822f0
add esp, 4
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax - 1]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
movsx ecx, byte [eax]
cmp ecx, 0x5c
jne 0x414392
mov edx, dword [ebp - 8]
mov byte [edx], 0
mov eax, dword [ebp - 4]
push eax
call fcn.004895a0
add esp, 4
mov ecx, dword [ebp - 4]
push ecx
call fcn.004166b0
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x4143b0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call fcn.004895a0
add esp, 4
pop ebp
ret
Function at 0x414930
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push 0x44
push 0
lea eax, [ebp - 0x58]
push eax
call fcn.00465af0
add esp, 0xc
mov dword [ebp - 0x58], 0x44
mov dword [ebp - 0x2c], 1
xor ecx, ecx
mov word [ebp - 0x28], cx
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x58]
push eax
push 0
push 0
push 0x8000000
push 1
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 4], eax
push 0x2710
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
jne 0x4149b0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x41b200
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
push eax
push 4
push 1
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00484710
add esp, 0x10
lea edx, [ebp - 4]
push edx
push 0x4e2638
mov eax, dword [ebp + 0x10]
push eax
call fcn.004088c0
add esp, 0xc
cmp dword [ebp - 4], 0xc8
jle 0x41b259
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x21c], 0xffffff85
mov edx, dword [ebp + 8]
mov dword [edx + 0x238], 0xffffffe8
mov eax, 0xffffff85
jmp 0x41b2c9
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 1
mov edx, dword [ebp + 0x10]
push edx
call fcn.00484710
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
je 0x41b29d
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x21c], 0xffffff85
mov edx, dword [ebp + 8]
mov dword [edx + 0x238], 0xffffffe7
mov eax, 0xffffff85
jmp 0x41b2c9
mov eax, dword [ebp + 8]
mov dword [eax + 0x21c], 0
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0041b0d0
add esp, 0xc
mov ecx, dword [ebp + 0x10]
add ecx, dword [ebp - 4]
mov byte [ecx], 0
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x41b340
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x4efa64]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
je 0x41b379
mov eax, dword [ebp + 0xc]
push eax
push 0x5c
mov ecx, dword [ebp + 8]
push ecx
push 0x4e263c
lea edx, [ebp - 0x808]
push edx
call fcn.00404080
add esp, 0x14
jmp 0x41b38c
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x808]
push ecx
call fcn.004789e0
add esp, 8
lea edx, [ebp - 0x808]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0xffffffff
je 0x41b3ba
mov eax, dword [ebp - 0x80c]
and eax, 0x10
je 0x41b3ba
mov eax, 1
jmp 0x41b3bc
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464bf6
mov esp, ebp
pop ebp
ret