joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b8de0
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.004b8f30
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov dword [esi], eax
cmp eax, 0xffffffff
pop esi
jne 0x4b8e00
xor eax, eax
pop ecx
ret
lea ecx, [esp]
push 4
push ecx
push 0x1001
push 0xffff
push eax
mov dword [esp + 0x14], 0
call sub.WS2_32.dll_setsockopt
mov eax, 1
pop ecx
ret

Function at 0x4b8de1
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.004b8f30
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov dword [esi], eax
cmp eax, 0xffffffff
pop esi
jne 0x4b8e00
xor eax, eax
pop ecx
ret
lea ecx, [esp]
push 4
push ecx
push 0x1001
push 0xffff
push eax
mov dword [esp + 0x14], 0
call sub.WS2_32.dll_setsockopt
mov eax, 1
pop ecx
ret

Function at 0x4b8e30
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x10
xor eax, eax
push esi
push edi
mov dword [esp + 8], eax
mov edi, ecx
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x10], eax
push ecx
mov dword [esp + 0x18], eax
mov word [esp + 0xc], 2
call sub.WS2_32.dll_htons
mov esi, dword [esp + 0x1c]
mov word [esp + 0xa], ax
push esi
call sub.WS2_32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x4b8e87
push esi
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x4b8e9d
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
mov dword [esp + 0xc], ecx
lea edx, [esp + 8]
push 0x10
push edx
mov ecx, edi
call fcn.004b8ec0
pop edi
pop esi
add esp, 0x10
ret 8
push 0x2726
call sub.WS2_32.dll_WSASetLastError
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret 8

Function at 0x4b8ec0
Capabilities:
Connect socket

Disassembly:
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
mov eax, dword [ecx]
push edx
push eax
call sub.WS2_32.dll_connect
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret 8

Function at 0x4b8f50
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x4b8f99
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4
Function at 0x4b9410
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x509260
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.004b8fc0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.004b9040
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.004b9040
lea ecx, [esi + 0xc]
call fcn.004f605a
lea ecx, [esi + 0x10]
call fcn.004f605a
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.004bb870
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.004bb870
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.004bb870
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.004f60cf
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.004f60cf
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x4ba0b8
Capabilities:
Get hostname

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x509488
push eax
mov dword fs:[0], esp
sub esp, 0x64
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
test eax, eax
je 0x4ba0c8
call fcn.004ba5e0
mov edi, dword [esp + 0x7c]
test edi, edi
je 0x4ba1ab
cmp byte [edi], 0
je 0x4ba1ab
mov eax, dword [esp + 0x8c]
test eax, eax
jg 0x4ba0ed
mov eax, 0x7d0
mov ecx, esi
mov dword [esi + 8], eax
call fcn.004b8de0
test eax, eax
jne 0x4ba10d
push 0x6097ec
lea ecx, [esi + 0x38]
call fcn.004f6258
jmp 0x4ba1ab
mov eax, dword [esp + 0x80]
mov ecx, esi
push eax
push edi
call fcn.004b8e30
test eax, eax
jne 0x4ba13c
mov ecx, esi
call fcn.004b8f30
push edi
add esi, 0x38
push 0x6097c8
push esi
call fcn.004f35d5
add esp, 0xc
jmp 0x4ba1ab
push 0xdc
mov ecx, esi
mov dword [esi + 4], 1
call fcn.004bae60
test eax, eax
je 0x4ba1a4
lea ecx, [esp + 8]
push 0x64
push ecx
call sub.WS2_32.dll_gethostname
mov eax, dword [esp + 0x88]
mov ecx, dword [esp + 0x84]
lea edx, [esp + 0x8c]
mov dword [esp + 0x8c], 1
push edx
push eax
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, esi
call fcn.004ba280
test eax, eax
jne 0x4ba1c0
push edi
lea eax, [esi + 0x38]
push 0x6097a4
push eax
call fcn.004f35d5
add esp, 0xc
mov ecx, esi
call fcn.004ba5e0
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x4ba268
mov ecx, dword [0x60e104]
mov dword [esp + 0x7c], ecx
lea edx, [esp + 8]
lea eax, [esp + 0x7c]
push edx
push str.HELO__s_r_n
push eax
mov dword [esp + 0x80], 0
call fcn.004f35d5
mov edx, dword [esp + 0x88]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
mov ecx, esi
call fcn.004b8ee0
test eax, eax
jne 0x4ba22a
push 0x609788
lea ecx, [esi + 0x38]
call fcn.004f6258
jmp 0x4ba23a
push 0xfa
mov ecx, esi
call fcn.004bae60
test eax, eax
jne 0x4ba257
mov ecx, esi
call fcn.004ba5e0
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.004f60cf
jmp 0x4ba1ab
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.004f60cf
mov ecx, dword [esp + 0x6c]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
Function at 0x4bf780
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
lea eax, [ebp - 0x28]
push ebx
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x10]
cmp eax, 0x182
je 0x4bf7bb
cmp eax, 0x1e6
je 0x4bf7bb
push eax
push ebx
push ecx
push edx
mov eax, 1
cpuid
mov dword [ebp - 4], edx
pop edx
pop ecx
pop ebx
pop eax
mov eax, dword [ebp - 4]
pop ebx
shr eax, 0x17
and eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x4bf810
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x509878
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
mov ebx, ecx
push esi
push edi
lea ecx, [esp + 0xc]
call fcn.004bfd00
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0xc]
push eax
mov dword [esp + 0x20], 0
call fcn.004bfdc0
test eax, eax
jge 0x4bf877
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.004bfd30
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret 0x10
lea ecx, [esp + 0xc]
call fcn.004bfd40
mov edi, eax
push edi
call fcn.004f5e10
mov esi, eax
add esp, 4
test esi, esi
jne 0x4bf8c1
lea ecx, [esp + 0xc]
call fcn.004bfd60
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.004bfd30
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret 0x10
push edi
push esi
lea ecx, [esp + 0x14]
call fcn.004bfde0
cmp edi, eax
je 0x4bf909
push esi
call fcn.004f5e39
add esp, 4
lea ecx, [esp + 0xc]
call fcn.004bfd60
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.004bfd30
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret 0x10
lea ecx, [esp + 0xc]
call fcn.004bfd60
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
push ecx
push edx
push esi
push edi
push eax
mov ecx, ebx
call fcn.004bfb00
push esi
mov edi, eax
call fcn.004f5e39
add esp, 4
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.004bfd30
mov ecx, dword [esp + 0x14]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 0x10
Function at 0x4bfb00
Capabilities:
Print debug messages

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x509914
push eax
mov eax, dword [esp + 0x20]
mov dword fs:[0], esp
sub esp, 0x144
push ebx
mov ebx, dword [esp + 0x15c]
push esi
xor esi, esi
push edi
mov edi, dword [esp + 0x168]
cmp eax, esi
jne 0x4bfb3d
push edi
push ebx
call fcn.004bf960
cmp eax, 5
ja case.default.0x4bfb46
jmp dword [eax*4 + 0x4bfce8]
push str.Error:_CDXImage___Unsupported_Image_type.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp case.default.0x4bfb46
lea ecx, [esp + 0xc]
call fcn.004c13c0
mov eax, dword [esp + 0x16c]
mov ecx, dword [esp + 0x160]
push eax
push edi
push ebx
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x168], esi
call fcn.004c1430
lea ecx, [esp + 0xc]
mov esi, eax
mov dword [esp + 0x158], 0xffffffff
call fcn.004c1400
jmp case.default.0x4bfb46
lea ecx, [esp + 0xc]
call fcn.004bfe30
mov edx, dword [esp + 0x16c]
mov eax, dword [esp + 0x160]
push edx
push edi
push ebx
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x168], 1
call fcn.004bff30
lea ecx, [esp + 0xc]
mov esi, eax
mov dword [esp + 0x158], 0xffffffff
call fcn.004bfe70
jmp case.default.0x4bfb46
lea ecx, [esp + 0xc]
call fcn.004c0e60
mov ecx, dword [esp + 0x16c]
mov edx, dword [esp + 0x160]
push ecx
push edi
push ebx
push edx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x168], 2
call fcn.004c0f10
lea ecx, [esp + 0xc]
mov esi, eax
mov dword [esp + 0x158], 0xffffffff
call fcn.004c0ea0
jmp case.default.0x4bfb46
lea ecx, [esp + 0xc]
call fcn.004c0b00
mov eax, dword [esp + 0x16c]
mov ecx, dword [esp + 0x160]
push eax
push edi
push ebx
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x168], 3
call fcn.004c0bf0
lea ecx, [esp + 0xc]
mov esi, eax
mov dword [esp + 0x158], 0xffffffff
call fcn.004c0b40
jmp case.default.0x4bfb46
lea ecx, [esp + 0xf0]
call fcn.004c08c0
mov edx, dword [esp + 0x16c]
mov eax, dword [esp + 0x160]
push edx
push edi
push ebx
push eax
lea ecx, [esp + 0x100]
mov dword [esp + 0x168], 4
call fcn.004c0950
lea ecx, [esp + 0xf0]
mov esi, eax
mov dword [esp + 0x158], 0xffffffff
call fcn.004c0900
mov ecx, dword [esp + 0x150]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x150
ret 0x14

Function at 0x4bfde0
Capabilities:
Read file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx + 4]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 8]
neg eax
sbb eax, eax
and eax, ecx
ret 8
Function at 0x4ebc40
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x50b2e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov al, byte [esp + 0x3c]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov byte [esp + 0x10], al
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x44]
push ebx
mov dword [esp + 0x40], ebx
mov byte [esp + 0x28], al
mov edx, dword [ecx]
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], edx
call fcn.004e0dae
mov eax, dword [0x5ea748]
lea ecx, [esp + 0x10]
push eax
push ebx
push ecx
lea ecx, [esp + 0x30]
call fcn.004e0ce0
lea edx, [esp + 0x20]
lea eax, [esp + 8]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x44], 1
call fcn.004ec6d0
mov esi, dword [eax]
mov ecx, dword [eax + 4]
mov eax, dword [esp + 0x28]
cmp eax, ebx
mov dword [esp + 0xc], ecx
je 0x4ebce7
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4ebcde
cmp al, 0xff
je 0x4ebcde
dec al
mov byte [ecx], al
jmp 0x4ebce7
push ecx
call fcn.004f5e39
add esp, 4
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], ebx
cmp eax, ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
je 0x4ebd18
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4ebd0f
cmp al, 0xff
je 0x4ebd0f
dec al
mov byte [ecx], al
jmp 0x4ebd18
push ecx
call fcn.004f5e39
add esp, 4
mov ecx, dword [esp + 0x34]
lea eax, [esi + 0x10]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 4
Function at 0x4f8529
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4f8561
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004f6576
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004f654e
jmp 0x4f856d
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4f9c17
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4f9c59
call fcn.004fff10
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4f9c59
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4f9c50
xor eax, eax
jmp 0x4f9c61
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004f9c67
pop edi
pop esi
pop ebx
ret 4

Function at 0x500440
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x50046e
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x50048c
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.005003a6
jmp 0x50048c
mov eax, dword [esi + 0x14]
test eax, eax
je 0x50048c
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.005003a6
test edi, edi
mov eax, edi
jne 0x500476
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4013d1
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x4380ec], 1
mov dword [0x4380f0], 1
mov dword [0x4380f4], 1
mov dword [ebp - 4], 0x400000
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x401412
mov eax, 0
jmp 0x4014ac
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x401435
mov eax, 0
jmp 0x4014ac
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
movzx eax, ax
cmp eax, 0x10b
je 0x401457
cmp eax, 0x20b
je 0x40147c
jmp 0x4014a7
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x5c]
cmp eax, 0xe
ja 0x401469
mov eax, 0
jmp 0x4014ac
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x4014ac
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x6c]
cmp eax, 0xe
ja 0x401494
mov eax, 0
jmp 0x4014ac
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x4014ac
mov eax, 0
leave
ret

Function at 0x402b10
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file
Terminate process

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [0x426044]
test eax, eax
je 0x402b49
mov dword [esp + 4], 0x1388
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
test eax, eax
jne 0x402b60
mov eax, dword [0x426044]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
cmp byte [0x436080], 0
jne 0x402b80
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [0x426044]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
sub esp, 8
jmp 0x402b38
mov edx, 0x414
lea edi, [esp + 0x12]
mov dword [esp + 0x12], 0
mov esi, dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov dword [esp + 0x16], 3
mov ebx, 0x14
mov dword [esp + 0x1a], 0x4360a0
mov dword [esp + 0x1e], 0x41e0e4
mov word [esp + 0x22], dx
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0x41e0e4
mov dword [esp], edi
call esi
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
sub esp, 4
jmp 0x402c53
test al, 0x10
je 0x402b52
mov dword [esp], 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 0x414
sub esp, 4
mov dword [esp + 0x12], 0
mov dword [esp + 0x16], 3
mov dword [esp + 0x1a], 0x4360a0
mov dword [esp + 0x1e], 0x41e0e4
mov word [esp + 0x22], ax
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0x41e0e4
mov dword [esp], edi
call esi
sub esp, 4
sub ebx, 1
je 0x402b52
mov dword [esp], 0x4360a0
call ebp
sub esp, 4
cmp eax, 0xffffffff
jne 0x402be8
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x414660
Capabilities:
Create directory

Disassembly:
push edi
push esi
push ebx
push eax
mov eax, 0x200c
call fcn.00416a30
sub esp, eax
mov eax, dword [esp + eax]
mov esi, eax
mov eax, dword [0x426040]
test eax, eax
je 0x414720
xor ebx, ebx
test eax, eax
jg 0x41469b
jmp 0x4146c8
add ebx, 1
cmp dword [0x426040], ebx
jle 0x4146c8
mov eax, dword [ebx*4 + 0x435080]
mov dword [esp], esi
mov dword [esp + 4], eax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x414690
mov eax, 1
add esp, 0x2010
pop ebx
pop esi
pop edi
ret
mov dword [esp], esi
call sub.msvcrt.dll_wcslen
cmp eax, 2
jne 0x4146dc
cmp word [esi + 2], 0x3a
je 0x4146b2
mov dword [esp + 4], 0
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
sub esp, 8
test eax, eax
je 0x414770
mov ebx, dword [0x426040]
cmp ebx, 0x3ff
jg 0x4146b2
mov dword [esp], esi
call sub.msvcrt.dll__wcsdup
add dword [0x426040], 1
mov dword [ebx*4 + 0x435080], eax
jmp 0x4146b2
lea ebx, [esp + 0x10]
mov dword [esp + 8], 0x1000
mov dword [esp + 4], str._HOME_
mov dword [esp], ebx
call fcn.00413fd0
test al, al
je 0x414788
mov dword [esp], ebx
mov edi, dword [0x426040]
call sub.msvcrt.dll__wcsdup
mov dword [edi*4 + 0x435080], eax
mov eax, dword [0x426040]
add eax, 1
mov dword [0x426040], eax
jmp 0x414682
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4146f4
xor eax, eax
jmp 0x4146b7
mov eax, str._HOME_
call fcn.00401ac0
lea esi, [esi]
lea esi, [esi]
Function at 0x415a80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [esp], 2
call fcn.0041bf0c
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov ebx, dword [ebp - 0xc]
mov dword [esp], 2
call fcn.0041bf0c
mov dword [esp + 8], ebx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort

Function at 0x416654
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x416673
mov eax, 0
jmp 0x4166b7
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x416696
mov eax, 0
jmp 0x4166b7
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x10b
je 0x4166b2
mov eax, 0
jmp 0x4166b7
mov eax, 1
leave
ret

Function at 0x4166b9
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0x18
mov dword [ebp - 4], eax
jmp 0x416718
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp dword [ebp + 0xc], eax
jb 0x416710
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x416710
mov eax, dword [ebp - 4]
jmp 0x41672c
add dword [ebp - 8], 1
add dword [ebp - 4], 0x28
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 8], eax
jb 0x4166ed
mov eax, 0
leave
ret
Function at 0x406740
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4889bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0047b2fe
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x4067c2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00478ce8
mov eax, dword [eax]
push 0x4acc98
push eax
call fcn.0046ab14
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0047b589
test bl, bl
je 0x4067c2
push 0x4acc98
lea ecx, [esp + 0xc]
call fcn.0047b965
push 0x4acca4
lea ecx, [esp + 0xc]
call fcn.0047b965
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x4067fe
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0047b589
jmp 0x4068c9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x406882
lea edx, [esp + 0x7c]
push 0x4acca0
push edx
call fcn.0046ab14
add esp, 8
test eax, eax
je 0x406882
lea eax, [esp + 0x7c]
push 0x4acc9c
push eax
call fcn.0046ab14
add esp, 8
test eax, eax
je 0x406882
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x406812
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0047b589
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x4070d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x407132
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc