joyce8/EMBER2024-capa huggingface dataset:
Function at 0x69ce06
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor ebx, ebx
cmp dword [esi + 0x118], ebx
jle 0x69ce64
lea eax, [ebp + 8]
push ebx
push eax
push ebx
push dword [esi]
call fcn.0069ce92
add esp, 0x10
cmp dword [ebp + 8], ebx
je 0x69ce64
mov eax, dword [esi + 0x118]
mov ecx, 0x400
cmp eax, ecx
jl 0x69ce3f
mov eax, ecx
lea edi, [esi + 0x114]
push ebx
push eax
push dword [edi]
push dword [esi]
call sub.wsock32.dll_send
cmp eax, ebx
je 0x69ce64
cmp eax, 0xffffffff
je 0x69ce64
push eax
push edi
call fcn.0069ce69
pop ecx
pop ecx
jmp 0x69ce11
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x69ce92
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x31c
push ebx
push esi
push edi
xor ecx, ecx
cmp dword [ebp + 0xc], ecx
push 1
pop esi
je 0x69cebf
mov eax, dword [ebp + 8]
mov dword [ebp - 0x218], esi
mov dword [ebp - 0x214], eax
lea edi, [ebp - 0x218]
jmp 0x69cec4
mov eax, dword [ebp + 8]
xor edi, edi
cmp dword [ebp + 0x10], ecx
je 0x69cee0
lea edx, [ebp - 0x114]
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x114], esi
mov dword [ebp - 4], edx
jmp 0x69cee3
mov dword [ebp - 4], ecx
cmp dword [ebp + 0x14], ecx
je 0x69ceff
mov dword [ebp - 0x318], eax
lea eax, [ebp - 0x31c]
mov dword [ebp - 0x31c], esi
mov dword [ebp - 8], eax
jmp 0x69cf02
mov dword [ebp - 8], ecx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ecx
push eax
mov dword [ebp - 0xc], ecx
push dword [ebp - 8]
push dword [ebp - 4]
push edi
push 0x40
call sub.wsock32.dll_select
mov ebx, eax
cmp ebx, 0xffffffff
je 0x69cf87
cmp dword [ebp + 0xc], 0
je 0x69cf45
test ebx, ebx
jle 0x69cf3f
push edi
push dword [ebp + 8]
call sub.wsock32.dll___WSAFDIsSet
test eax, eax
je 0x69cf3f
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
jmp 0x69cf45
mov eax, dword [ebp + 0xc]
and dword [eax], 0
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x69cf66
test ebx, ebx
jle 0x69cf63
push dword [ebp - 4]
push dword [ebp + 8]
call sub.wsock32.dll___WSAFDIsSet
test eax, eax
je 0x69cf63
mov dword [edi], esi
jmp 0x69cf66
and dword [edi], 0
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x69cf87
test ebx, ebx
jle 0x69cf84
push dword [ebp - 8]
push dword [ebp + 8]
call sub.wsock32.dll___WSAFDIsSet
test eax, eax
je 0x69cf84
mov dword [edi], esi
jmp 0x69cf87
and dword [edi], 0
pop edi
pop esi
pop ebx
leave
ret
Function at 0x69cf8c
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
lea eax, [ebp + 8]
push edi
push edi
push eax
push dword [esi]
call fcn.0069ce92
add esp, 0x10
cmp dword [ebp + 8], edi
je 0x69d01f
lea ebx, [esi + 0x108]
push 0x1000
push ebx
call fcn.0069d024
pop ecx
test eax, eax
pop ecx
je 0x69d01f
mov edi, dword [ebx]
push 0
add edi, dword [esi + 0x10c]
push 0x1000
push edi
push dword [esi]
call sub.wsock32.dll_recv
test eax, eax
mov dword [ebp - 4], eax
jle 0x69d013
cmp dword [esi + 0x120], 0
je 0x69cffc
lea ecx, [esi + 0x124]
push ecx
push eax
push edi
call fcn.006a0fdc
add esp, 0xc
mov eax, dword [ebp - 4]
mov ecx, dword [ebx]
add dword [esi + 0x10c], eax
mov eax, dword [esi + 0x10c]
and byte [ecx + eax], 0
jmp 0x69cf96
call sub.wsock32.dll_WSAGetLastError
mov dword [esi + 4], 2
pop edi
pop esi
pop ebx
leave
ret

Function at 0x6a0fdc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 0x10]
and dword [ebp - 8], 0
cmp dword [ebp + 0xc], 0
mov al, byte [ecx + 0x100]
mov dl, byte [ecx + 0x101]
jle 0x6a1074
push ebx
push esi
push edi
movzx esi, al
movzx edi, dl
jmp 0x6a1009
mov edi, dword [ebp - 0xc]
lea eax, [esi + 1]
mov esi, 0x100
cdq
idiv esi
movzx esi, dl
mov byte [ebp + 0x13], dl
mov bl, byte [esi + ecx]
movzx eax, bl
add eax, edi
mov edi, 0x100
cdq
idiv edi
movzx eax, dl
mov dword [ebp - 0xc], eax
mov byte [ebp - 1], dl
mov edx, dword [ebp - 8]
lea edi, [eax + ecx]
mov al, byte [eax + ecx]
mov byte [esi + ecx], al
mov eax, dword [ebp + 8]
mov byte [edi], bl
lea edi, [edx + eax]
movzx eax, byte [esi + ecx]
movzx edx, bl
add eax, edx
mov ebx, 0x100
cdq
idiv ebx
movzx eax, dl
mov al, byte [eax + ecx]
xor byte [edi], al
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
jl 0x6a1006
mov al, byte [ebp + 0x13]
mov dl, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov byte [ecx + 0x100], al
mov byte [ecx + 0x101], dl
leave
ret

Function at 0x6affb0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [esp + 0xc]
push esi
mov ecx, dword [esp + 0xc]
mov eax, dword [eax]
mov esi, dword [ecx]
mov edx, esi
dec esi
test edx, edx
je 0x6affea
mov edx, dword [esp + 8]
xor ecx, ecx
mov cl, byte [edx]
inc edx
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x6d8918]
xor ecx, eax
mov eax, ecx
mov ecx, esi
dec esi
test ecx, ecx
jne 0x6affc8
pop esi
ret
Function at 0x8e6a90
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x20]
push ebx
push ebp
push esi
mov ebx, dword [eax]
push edi
push 0x800
push 0x40
mov dword [esp + 0x1c], ebx
call dword [ebx + 0x2c]
mov edi, eax
test edi, edi
jne 0x8e6abc
pop edi
pop esi
pop ebp
xor ax, ax
pop ebx
add esp, 0xc
ret
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x20]
push 0
push 0
push ecx
push edx
call dword [ebx + 0x24]
mov eax, dword [esp + 0x2c]
mov ebp, 0x39f2b5d9
test eax, eax
je 0x8e6b80
jmp 0x8e6ae4
mov eax, dword [esp + 0x2c]
cmp eax, 0x800
jb 0x8e6af0
mov eax, 0x800
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x10]
push 0
push ecx
push eax
push edi
push edx
call dword [ebx + 0x14]
test eax, eax
je 0x8e6b90
mov edx, dword [esp + 0x10]
test edx, edx
je 0x8e6bd2
xor esi, esi
test edx, edx
jle 0x8e6b57
mov ecx, ebp
xor ecx, 0xe3a19d27
mov eax, ecx
mov ebx, ecx
shr eax, 0x18
shr ebx, 0x10
xor al, bl
mov ebx, ecx
shr ebx, 8
xor al, bl
mov bl, byte [esi + edi]
xor al, bl
xor al, cl
mov byte [esi + edi], al
and eax, 0xff
shl ebp, 8
add ebp, eax
inc esi
cmp esi, edx
jl 0x8e6b1b
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x18]
push 0
push eax
push edx
push edi
push ecx
call dword [ebx + 0x18]
test eax, eax
je 0x8e6bb2
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x2c]
sub eax, edx
mov dword [esp + 0x2c], eax
jne 0x8e6ae0
push edi
call dword [ebx + 0x30]
pop edi
pop esi
pop ebp
mov ax, 1
pop ebx
add esp, 0xc
ret
push 0
call dword [ebx + 0x78]
push eax
mov eax, dword [esp + 0x38]
push eax
call fcn.008e7800
add esp, 0xc
push edi
call dword [ebx + 0x30]
pop edi
pop esi
pop ebp
xor ax, ax
pop ebx
add esp, 0xc
ret
call dword [ebx + 0x78]
mov ecx, dword [esp + 0x30]
push eax
push ecx
call fcn.008e7870
add esp, 8
push edi
call dword [ebx + 0x30]
pop edi
pop esi
pop ebp
xor ax, ax
pop ebx
add esp, 0xc
ret
push 0
call dword [ebx + 0x78]
mov edx, dword [esp + 0x34]
push eax
push edx
call fcn.008e7800
add esp, 0xc
push edi
call dword [ebx + 0x30]
pop edi
pop esi
pop ebp
xor ax, ax
pop ebx
add esp, 0xc
ret

Function at 0x8e7670
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
push edi
mov al, byte [ecx]
xor edi, edi
mov byte [esi], al
mov al, byte [ecx]
test al, al
je 0x8e76aa
mov edx, esi
push ebx
sub edx, ecx
mov al, byte [ecx + 1]
mov bl, byte [edx + ecx]
inc edi
inc ecx
dec al
xor al, bl
mov byte [edx + ecx], al
mov al, byte [ecx]
test al, al
jne 0x8e768b
mov byte [edi + esi], 0
pop ebx
mov eax, esi
pop edi
pop esi
ret
mov byte [edi + esi], 0
mov eax, esi
pop edi
pop esi
ret
Function at 0xe80058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00e801a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xe8007e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xe8006a
add dl, dl
jne 0xe80089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xe800dc
xor eax, eax
add dl, dl
jne 0xe80096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xe8017d
add dl, dl
jne 0xe800a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xe800b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xe800bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xe800c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xe800d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xe80075
mov eax, 1
add dl, dl
jne 0xe800ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xe800f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xe800e1
sub eax, ebx
mov ebx, 1
jne 0xe80128
mov ecx, 1
add dl, dl
jne 0xe8010e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xe80119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xe80105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xe80075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xe8013f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xe8014a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xe80136
cmp eax, 0x7d00
jae 0xe8016d
cmp eax, 0x500
jb 0xe80168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xe80075
cmp eax, 0x7f
ja 0xe80170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xe80075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xe8019e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xe80075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0xdbd608
Capabilities:
Encode data using xor

Disassembly:
jmp 0xdbd612
pushal
call 0xdbd618
pop ebp
sub ebp, 0x10
sub ebp, 0x9bd608
jmp 0xdbd62e
mov eax, 0x9bd608
add eax, ebp
add eax, 0x4c
mov ecx, 0x5ad
mov edx, 0x186b89a7
xor byte [eax], dl
inc eax
dec ecx
jne 0xdbd645
jmp 0xdbd658
sub al, 0x6a
sub al, 0x2e
wait
cmpsd dword [esi], dword es:[edi]
cmpsd dword [esi], dword es:[edi]
cmpsd dword [esi], dword es:[edi]
pop di
cmpsd dword [esi], dword es:[edi]
cmpsd dword [esi], dword es:[edi]
cmpsd dword [esi], dword es:[edi]
movsb byte es:[edi], byte [esi]
push 0x1f
mov byte [0x1da7a7a7], al
invalid
Function at 0x40249a
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x41caa5
call fcn.00419e78
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
call fcn.004032e0
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.00402451
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x402738
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x41cb86
push eax
mov dword fs:[0], esp
push esi
mov esi, ecx
lea ecx, [esi + 0xa8]
call fcn.004027df
lea ecx, [esi + 0x78]
call fcn.004027df
push dword [esi + 0x30]
call fcn.00419e72
push dword [esi + 0x24]
call fcn.00419e72
push dword [esi + 0x18]
call fcn.00419e72
add esp, 0xc
and dword [ebp - 4], 0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x402792
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 8]
mov dword [ebp - 4], 1
test ecx, ecx
je 0x4027a6
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 4]
mov dword [ebp - 4], 2
test ecx, ecx
je 0x4027ba
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi]
mov dword [ebp - 4], 3
test ecx, ecx
je 0x4027cd
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
leave
ret

Function at 0x4027f6
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x41ca10
push eax
mov dword fs:[0], esp
push esi
mov esi, ecx
call fcn.0040b394
lea ecx, [esi + 0x30]
call fcn.004027df
push dword [esi + 0x24]
call fcn.00419e72
pop ecx
lea ecx, [esi + 0xc]
call fcn.00401ccd
mov ecx, esi
call fcn.004026fe
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
leave
ret

Function at 0x402eaf
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push 0
push dword [ebp + 0xc]
mov esi, ecx
push dword [ebp + 8]
lea ecx, [esi + 0x68]
call fcn.004029ee
mov edx, 0xce4
lea ecx, [ebp - 0x10]
call fcn.00406376
push dword [ebp - 0x10]
push dword [esi + 0x6c]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [ebp - 0x10]
call fcn.00419e72
pop ecx
push 1
push dword [esi + 0x6c]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
leave
ret 8
Function at 0x4047ff
Capabilities:
Create directory

Disassembly:
mov eax, 0x41cd82
call fcn.00419e78
sub esp, 0x38
push ebx
push esi
xor ebx, ebx
mov esi, ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x404822
mov al, 1
jmp 0x404868
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x404833
xor al, al
jmp 0x404868
lea ecx, [ebp - 0x44]
call fcn.00404e50
lea ecx, [ebp - 0x1c]
call fcn.004032e0
push ebx
push esi
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], ebx
call fcn.00404fe7
test al, al
je 0x40485d
mov ebx, dword [ebp - 0x24]
shr ebx, 4
and bl, 1
push dword [ebp - 0x1c]
call fcn.00419e72
pop ecx
mov al, bl
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4049f7
Capabilities:
Delete file
Set file attributes

Disassembly:
push esi
mov esi, ecx
call fcn.00405531
cmp eax, 0xffffffff
je 0x404a1f
test al, 0x10
jne 0x404a1f
test al, 1
je 0x404a1f
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x404a1f
xor al, al
pop esi
ret
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
pop esi
setne al
ret
Function at 0x404beb
Capabilities:
Set file attributes

Disassembly:
push ebp
sub esp, 0x58
mov eax, 0x41cdd4
call fcn.00419e78
sub esp, 0x38
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x44]
push edi
mov dword [ebp + 0x38], esi
call fcn.00404e50
lea ecx, [ebp - 0x1c]
call fcn.004032e0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x44]
push 0
push dword [esi]
call fcn.00404fe7
test al, al
je 0x404c3f
mov ebx, dword [ebp - 0x24]
mov eax, ebx
shr eax, 4
test al, 1
jne 0x404c5c
push 0x10b
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp - 0x1c]
call fcn.00419e72
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add ebp, 0x5c
leave
ret
push dword [ebp - 0x1c]
or dword [ebp - 4], 0xffffffff
shr ebx, 0xa
call fcn.00419e72
pop ecx
and bl, 1
jne 0x404d96
push esi
lea ecx, [ebp + 0x50]
call fcn.0040323f
lea ecx, [ebp + 0x50]
mov dword [ebp - 4], 1
call fcn.00401d36
mov eax, dword [ebp + 0x54]
or dword [ebp + 0x40], 0xffffffff
mov dword [ebp + 0x3c], eax
lea ecx, [ebp + 0x44]
mov byte [ebp - 4], 2
call fcn.004032e0
lea eax, [ebp + 0x50]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp + 0x40]
call fcn.0040564e
lea ecx, [ebp]
call fcn.00404e50
lea ecx, [ebp + 0x28]
call fcn.004032e0
lea eax, [ebp]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp + 0x40]
xor edi, edi
call fcn.004055d0
test al, al
je 0x404d73
mov esi, dword [ebp + 0x3c]
cmp esi, dword [ebp + 0x54]
jae 0x404cf1
mov eax, dword [ebp + 0x50]
xor ecx, ecx
mov dword [ebp + 0x54], esi
mov word [eax + esi*2], cx
lea eax, [ebp + 0x28]
push eax
lea ecx, [ebp + 0x50]
call fcn.004034b5
mov eax, dword [ebp + 0x20]
shr eax, 4
test al, 1
je 0x404d1d
lea ecx, [ebp + 0x50]
call fcn.00404beb
test al, al
jne 0x404d33
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov bl, 1
jmp 0x404d31
mov ecx, dword [ebp + 0x50]
call fcn.004049f7
test al, al
jne 0x404d33
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor bl, bl
mov edi, eax
lea eax, [ebp]
push eax
lea ecx, [ebp + 0x40]
call fcn.004055d0
test al, al
jne 0x404ce0
mov esi, dword [ebp + 0x38]
test bl, bl
je 0x404d73
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp + 0x28]
call fcn.00419e72
push dword [ebp + 0x44]
call fcn.00419e72
pop ecx
pop ecx
lea ecx, [ebp + 0x40]
call fcn.00404e71
push dword [ebp + 0x50]
jmp 0x404c42
push dword [ebp + 0x28]
call fcn.00419e72
push dword [ebp + 0x44]
call fcn.00419e72
pop ecx
pop ecx
lea ecx, [ebp + 0x40]
call fcn.00404e71
push dword [ebp + 0x50]
call fcn.00419e72
pop ecx
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x404c48
mov ecx, dword [esi]
call fcn.00404bde
jmp 0x404c4a

Function at 0x405531
Capabilities:
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, eax
mov eax, ecx
ret
Function at 0x4056de
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x405708
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x405708
xor al, al
jmp 0x40571c
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
add ecx, esi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4

Function at 0x4096f7
Capabilities:
Get process heap force flags

Disassembly:
mov eax, 0x41d093
call fcn.00419e78
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
mov dword [ebp - 0x10], ebx
push edi
mov ecx, dword [esi]
mov dword [ebx], ecx
test ecx, ecx
je 0x40971b
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
mov ecx, dword [esi + 4]
and dword [ebp - 4], 0
mov dword [ebx + 4], ecx
test ecx, ecx
je 0x40972f
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
mov ecx, dword [esi + 8]
mov byte [ebp - 4], 1
mov dword [ebx + 8], ecx
test ecx, ecx
je 0x409743
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
mov ecx, dword [esi + 0xc]
mov byte [ebp - 4], 2
mov dword [ebx + 0xc], ecx
test ecx, ecx
je 0x409757
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
mov al, byte [esi + 0x10]
lea ecx, [ebx + 0x18]
mov byte [ebx + 0x10], al
mov al, byte [esi + 0x11]
mov byte [ebx + 0x11], al
mov al, byte [esi + 0x12]
mov byte [ebx + 0x12], al
mov al, byte [esi + 0x13]
mov byte [ebx + 0x13], al
mov al, byte [esi + 0x14]
mov byte [ebx + 0x14], al
mov al, byte [esi + 0x15]
mov byte [ebx + 0x15], al
mov al, byte [esi + 0x16]
mov byte [ebx + 0x16], al
mov al, byte [esi + 0x17]
mov byte [ebx + 0x17], al
lea eax, [esi + 0x18]
push eax
mov byte [ebp - 4], 3
call fcn.0040323f
lea eax, [esi + 0x24]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebx + 0x24]
call fcn.0040323f
lea eax, [esi + 0x30]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebx + 0x30]
call fcn.0040323f
mov eax, dword [esi + 0x3c]
lea edi, [ebx + 0x44]
mov dword [ebx + 0x3c], eax
mov eax, dword [esi + 0x40]
add esi, 0x44
mov dword [ebx + 0x40], eax
mov byte [ebp - 4], 6
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x50]
mov ecx, dword [esi + 0x54]
mov dword [ebx + 0x50], eax
mov dword [ebx + 0x54], ecx
mov eax, dword [esi + 0x58]
mov ecx, dword [esi + 0x5c]
mov dword [ebx + 0x58], eax
mov dword [ebx + 0x5c], ecx
mov al, byte [esi + 0x60]
mov byte [ebx + 0x60], al
mov eax, dword [esi + 0x68]
mov ecx, dword [esi + 0x6c]
mov dword [ebx + 0x68], eax
mov dword [ebx + 0x6c], ecx
mov eax, dword [esi + 0x70]
mov ecx, dword [esi + 0x74]
mov dword [ebx + 0x70], eax
lea eax, [esi + 0x78]
mov dword [ebx + 0x74], ecx
lea ecx, [ebx + 0x78]
push eax
call fcn.004098dc
lea eax, [esi + 0xa8]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebx + 0xa8]
call fcn.004098dc
mov eax, dword [esi + 0xd8]
mov ecx, dword [esi + 0xdc]
pop edi
mov dword [ebx + 0xd8], eax
mov eax, ebx
mov dword [ebx + 0xdc], ecx
pop esi
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x409856
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x41d093
call fcn.00419e78
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 3
mov dword [esi + 0x11], ebx
mov word [esi + 0x15], bx
mov byte [esi + 0x17], bl
call fcn.004032e0
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 4
call fcn.004032e0
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 5
call fcn.004032e0
xor eax, eax
mov byte [ebp - 4], 6
lea ecx, [esi + 0x78]
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], eax
call fcn.00402451
lea ecx, [esi + 0xa8]
mov byte [ebp - 4], 7
call fcn.00402451
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x409953
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x41d0e6
call fcn.00419e78
push ecx
push ecx
push esi
push edi
mov edi, ecx
xor eax, eax
mov dword [ebp - 0x10], edi
mov dword [edi + 0x10], eax
mov dword [edi], 0x41ebf0
mov dword [edi + 4], 0x41ec04
mov dword [edi + 8], 0x41ec18
mov dword [edi + 0xc], 0x41ec28
mov word [edi + 0x14], ax
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], eax
mov dword [edi + 0x20], eax
mov dword [ebp - 4], eax
mov dword [edi + 0x24], eax
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], eax
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], eax
mov dword [edi + 0x38], eax
lea ecx, [edi + 0x44]
mov byte [ebp - 4], 2
mov dword [edi + 0x3c], eax
mov dword [edi + 0x40], eax
call fcn.004032e0
lea ecx, [edi + 0x50]
mov byte [ebp - 4], 3
call fcn.004032e0
lea esi, [edi + 0x60]
mov byte [ebp - 4], 4
mov ecx, esi
mov dword [ebp - 0x14], esi
call fcn.00404e50
lea ecx, [esi + 0x28]
call fcn.004032e0
lea ecx, [edi + 0x98]
mov byte [ebp - 4], 5
call fcn.00408557
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x414950
Capabilities:
Check os version
Get common file path

Disassembly:
sub esp, 0x2d0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp ax, 6
je 0x41498c
push str.SetDefaultDllDirectories
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41498c
push 0xc00
call eax
test eax, eax
jne 0x414a1b
push 0x106
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, eax
test ecx, ecx
je 0x414a1b
cmp ecx, 0x104
ja 0x414a1b
cmp word [esp + ecx*2 - 2], 0x5c
je 0x4149bc
mov eax, 0x5c
mov word [esp + ecx*2], ax
inc ecx
mov al, byte [str.userenv]
push esi
mov esi, str.userenv
test al, al
je 0x414a1a
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push ebp
push edi
lea edi, [esp + 0x10]
lea edi, [edi + ecx*2]
nop dword [eax + eax]
mov ecx, edi
inc esi
movzx eax, al
lea ecx, [ecx + 2]
mov word [ecx - 2], ax
mov al, byte [esi]
inc esi
test al, al
jne 0x4149e3
xor eax, eax
mov dword [ecx], 0x64002e
push 8
push eax
mov word [ecx + 8], ax
lea eax, [esp + 0x18]
push eax
mov dword [ecx + 4], 0x6c006c
call ebx
mov al, byte [esi]
test al, al
jne 0x4149e0
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x2d0
ret