joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402252
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push edi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0x401c52
mov edi, eax
call fcn.00402475
lea ecx, [ebp - 8]
push ecx
push 0
push dword [ebp + 8]
push eax
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov edi, eax
test edi, edi
je 0x4022a6
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop edi
leave
ret 4

Function at 0x4022ae
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [section..data], ebx
je 0x402319
push ebx
push ebx
push 0x12
push dword [0x405010]
call dword [sym.imp.USER32.dll_PostThreadMessageA]
push 0x7530
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 4]
push eax
push ebx
push 0x1e
mov dword [section..data], ebx
call fcn.004034d1
mov al, byte [eax]
cmp byte [0x40506c], bl
jne 0x40230e
cmp byte [0x405060], bl
je 0x402319
test al, 4
je 0x402319
xor eax, eax
jmp 0x40239e
push esi
cmp byte [0x405058], bl
jne 0x402359
push dword [0x405008]
mov esi, 0x405100
push esi
call fcn.00403527
cmp byte [0x405014], bl
jne 0x402341
mov byte [0x405060], bl
cmp byte [0x405060], bl
jne 0x40237e
inc dword [0x405068]
mov eax, dword [0x405068]
cmp eax, dword [ebp + 8]
jb 0x40235d
xor eax, eax
jmp 0x40239d
mov eax, dword [0x405008]
mov byte [eax], bl
push dword [0x405008]
push esi
call fcn.00403527
mov byte [0x405014], 1
mov byte [0x405060], 1
push 0x405010
push ebx
push ebx
push 0x402ab6
push ebx
push ebx
mov dword [0x405064], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [section..data], eax
pop esi
pop ebx
leave
ret 4

Function at 0x4023c1
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov al, byte [esi + 0x1b44]
test al, 1
jne 0x402466
or al, 1
mov byte [esi + 0x1b44], al
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x70]
push ebx
mov dword [esi + 0x1b48], eax
push edi
lea eax, [esi + 0x1b18]
push eax
mov dword [esi + 0x1b14], ecx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventA]
xor edi, edi
push edi
push edi
push 1
push edi
call ebx
push edi
push edi
push 1
push edi
mov dword [esi + 0x1b40], eax
call ebx
mov dword [esi + 0x1b10], eax
cmp dword [esi + 0x1b40], edi
je 0x40245e
cmp eax, edi
je 0x40245e
cmp dword [ebp + 0x10], edi
je 0x40244d
lea eax, [ebp + 0xc]
push eax
push edi
push esi
push dword [ebp + 0x10]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x1b0c], eax
cmp eax, edi
je 0x40245e
push dword [ebp + 0x14]
push dword [esi + 0x1b0c]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
jmp 0x402464
push esi
call fcn.004021ae
pop edi
pop ebx
movzx eax, byte [esi + 0x1b44]
and eax, 1
pop esi
pop ebp
ret 0x10
Function at 0x4024c8
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x402528
cmp dword [ebp + 0xc], 0
je 0x4024e4
push 0x7fffffff
push esi
call fcn.00401ad3
push esi
call fcn.00402494
mov eax, dword [esi + 0x3ba4]
test eax, eax
je 0x402521
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x402515
push 0
push dword [esi + 0x3ba4]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0x3ba4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop esi
pop ebp
ret 8

Function at 0x40297d
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
push ebx
push esi
push edi
mov ebx, 0x80
push ebx
xor edi, edi
push edi
lea eax, [ebp - 0x8c]
push eax
call fcn.00403805
mov dword [ebp - 4], 3
dec dword [ebp - 4]
mov eax, dword [ebp - 4]
dec eax
mov dword [ebp - 8], edi
je 0x402a05
dec eax
jne 0x402a8e
mov edx, dword [ebp + 8]
mov eax, dword [edx]
lea ecx, [eax + 6]
cmp dword [0x405086], edi
je 0x4029cd
mov ecx, 0x405086
push dword [edx + 4]
add eax, 2
push eax
push ecx
lea eax, [ebp - 0x8c]
push eax
call fcn.00401554
test eax, eax
jle 0x402a8e
push edi
push 0x12
push 0x12
push edi
lea eax, [ebp - 0xa8]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x4029a5
jmp 0x402a8e
push 0x4464
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
cmp esi, edi
je 0x402a7c
or dword [esi + 0x70], 0xffffffff
or byte [esi + 0x5c], 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi + 0x3ba8], eax
push ebx
lea eax, [ebp - 0x8c]
push eax
lea eax, [esi + 0x3c58]
push eax
call fcn.004037ec
lea eax, [ebp - 0xc]
push eax
push edi
push esi
push 0x40347a
push edi
push edi
mov dword [esi + 0x6c], 3
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x3ba4], eax
cmp eax, edi
je 0x402a7c
push 0xfffffffffffffff1
mov dword [ebp - 0x58], edi
push dword [esi + 0x3ba4]
mov dword [ebp - 8], 1
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push dword [ebp - 8]
push esi
call fcn.004024c8
cmp dword [ebp - 8], edi
jne 0x4029a5
lea eax, [ebp - 0x8c]
push eax
call fcn.004014da
push 2
push 1
push 0x400
push dword [0x405044]
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x402ae5
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, 0x40500c
xor eax, eax
cmp dword [esi], eax
jne 0x402b21
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [ebp + 8]
jecxz 0x402b30
cmp eax, ecx
je 0x402b30
mov dword [esi], ecx
push eax
push dword [0x401244]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, sym.rpcnetp.exe_rpcnetp
pop eax
jne 0x402b30
call fcn.00402b91
mov eax, 1
mov dword [0x40504c], eax
pop esi
leave
ret 0xc
mov dword [esi], eax
pop esi
leave
jmp fcn.00402810
Function at 0x402d08
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
xor edi, edi
cmp dword [0x405074], edi
jne 0x402d3b
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x4011dc
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
xor eax, eax
inc eax
jmp 0x402dc3
push esi
mov esi, dword [ebp + 8]
push 0x401300
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test edi, edi
je 0x402d53
mov byte [esi + 0x29], 0
lea eax, [ebp - 4]
push eax
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x402db0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x402d9b
push 0x40137c
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetBinaryTypeA]
test eax, eax
je 0x402db0
cmp dword [ebp - 8], 0
je 0x402dbb
test edi, edi
jne 0x402dc0
mov edi, 0x401178
jmp 0x402d3f
xor eax, eax
inc eax
jmp 0x402dc2
xor eax, eax
pop esi
pop edi
leave
ret 8
Function at 0x40313f
Capabilities:
Copy file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push 0x104
lea eax, [ebp - 0x108]
push eax
push dword [0x40500c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x40323e
cmp dword [ebp + 0xc], 0
mov dword [ebp - 4], 0x401370
je 0x40317c
mov dword [ebp - 4], 0x4012b0
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push dword [ebp - 4]
lea ebx, [eax + edi - 3]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x40323b
push dword [ebp - 4]
push ebx
call esi
xor esi, esi
push esi
push edi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x40323b
push esi
push esi
push 3
push esi
push 3
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40323b
mov eax, dword [0x40500c]
mov ecx, dword [eax + 0x3c]
add ecx, eax
mov edx, ecx
sub edx, eax
add edx, 0x16
mov dword [ebp + 8], edx
cmp dword [ebp + 0xc], esi
jne 0x403208
mov eax, 0x2000
or ax, word [ecx + 0x16]
jmp 0x403214
mov ax, word [ecx + 0x16]
mov ecx, 0xdfff
and ax, cx
push esi
push esi
push edx
push edi
mov word [ebp + 0xc], ax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
lea eax, [ebp + 8]
push eax
push 2
lea eax, [ebp + 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x403242
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
lea eax, [ebp - 8]
push eax
push 0x401250
push 0x80000002
mov dword [ebp - 4], 0x80
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4032be
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x405080
xor esi, esi
push esi
push esi
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
push 0x20
pop ebx
jmp 0x403299
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push esi
push esi
push esi
push esi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x28]
push eax
push esi
push dword [ebp - 8]
mov dword [ebp - 4], ebx
call edi
test eax, eax
je 0x40328c
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4032c0
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0x18]
push esi
push edi
mov edi, dword [ebp + 0x14]
xor esi, esi
push esi
push esi
push dword [ebp + 0x10]
mov dword [ebp - 8], esi
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
push esi
push esi
push dword [ebp + 8]
mov dword [ebx], esi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 8], eax
cmp eax, esi
je 0x40332f
cmp dword [ebp + 0x1c], esi
jne 0x4032ff
mov dword [ebx], 1
jmp 0x403324
push 0xffffffffffffffff
lea eax, [ebp - 8]
push esi
push eax
cmp edi, esi
je 0x40330e
push 2
jmp 0x403310
push 1
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, esi
jne 0x403324
push ebx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x403339
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop edi
pop esi
pop ebx
leave
ret 0x18

Function at 0x40356c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor esi, esi
push esi
push esi
xor ebx, ebx
inc ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0x402b9c
push 0x40139c
mov dword [0x405048], eax
mov dword [0x405134], 0x10
mov dword [0x405140], 0x42a
mov dword [0x405144], ebx
call dword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerA]
mov dword [0x405070], eax
cmp eax, esi
je 0x403666
push edi
push esi
push 0x1388
push 2
pop edi
push edi
mov dword [0x40513c], ebx
call fcn.00402b4a
push esi
push esi
push 4
mov dword [0x40513c], 5
call fcn.00402b4a
call fcn.00403242
lea eax, [ebp - 8]
push eax
push esi
push esi
push 0x4025b3
push esi
push esi
mov dword [0x405140], esi
mov dword [0x405144], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
cmp eax, esi
jne 0x40361a
mov dword [0x405144], edi
jmp 0x403651
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push dword [0x405048]
call edi
mov eax, dword [0x405044]
cmp eax, esi
je 0x40363e
push esi
push esi
push 0x11
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
push 0x7530
push dword [ebp - 4]
call edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x405048]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push esi
push ebx
call fcn.00402b4a
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x40399f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor ebx, ebx
mov word [esi + 0x1a], bx
push 0x7e
push esi
call fcn.00401eae
mov edi, dword [ebp + 0x10]
mov dword [ebp - 8], ebx
jmp 0x403a25
cmp ebx, dword [esi]
jl 0x4039cb
cmp ebx, edi
jge 0x4039cb
mov edi, ebx
mov eax, ebx
sub eax, edi
je 0x4039e8
dec eax
je 0x4039e3
dec eax
je 0x4039de
add ebx, dword [ebp + 0xc]
mov bl, byte [ebx]
jmp 0x4039f7
mov bl, byte [esi + 0x1a]
jmp 0x403a01
mov bl, byte [esi + 0x1b]
jmp 0x403a01
mov bl, byte [esi + 0x18]
test edi, edi
je 0x4039f7
cmp edi, dword [ebp + 0x10]
jne 0x4039f7
or bl, 8
movzx eax, bl
push eax
push esi
call fcn.00403978
movzx eax, bl
bt dword [0x405198], eax
jae 0x403a18
push 0x7d
push esi
call fcn.00401eae
xor bl, 0x20
movzx eax, bl
push eax
push esi
call fcn.00401eae
inc dword [ebp - 8]
lea eax, [edi + 3]
cmp dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
jl 0x4039c1
push 0x7e
push esi
call fcn.00401eae
push esi
call fcn.00401ba6
movzx ecx, byte [esi + 0x18]
shr ecx, 4
and cl, 7
mov edi, ecx
lea eax, [esi + 0x18]
push eax
call fcn.00403788
mov eax, dword [ebp + 0xc]
mov dword [esi + edi*4 + 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + edi*4 + 0x3c], eax
lea eax, [ebx - 3]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x51eb60
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xdc000]
push edi
jmp 0x51eb7a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x51eb81
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51eb70
mov eax, 1
add ebx, ebx
jne 0x51eb93
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x51eba4
jne 0x51ebc3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51ebc3
dec eax
add ebx, ebx
jne 0x51ebb0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x51eb88
add ebx, ebx
jne 0x51ebbf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x51ec15
xor ecx, ecx
sub eax, 3
jb 0x51ebdb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x51ec4a
sar eax, 1
mov ebp, eax
jmp 0x51ebe6
add ebx, ebx
jne 0x51ebe6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51ebb4
inc ecx
add ebx, ebx
jne 0x51ebf4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51ebb4
add ebx, ebx
jne 0x51ec01
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x51ebf6
jne 0x51ec12
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x51ebf6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x51ec34
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x51ec26
jmp 0x51eb76
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x51ec34
add edi, ecx
jmp 0x51eb76
pop esi
mov edi, esi
mov ecx, 0x377e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x51ec52
cmp byte [edi], 0x11
jne 0x51ec52
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x51ec57
lea edi, [esi + 0x11a000]
mov eax, dword [edi]
or eax, eax
je 0x51eccf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x18c7f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x18c944]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x51ec84
mov ecx, edi
jns 0x51ecb3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x18c948]
or eax, eax
je 0x51ecc9
mov dword [ebx], eax
add ebx, 4
jmp 0x51eca1
call dword [esi + 0x18c958]
mov ebp, dword [esi + 0x18c94c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x51ed03
sub esp, 0xffffff80
jmp 0x416310
Function at 0x403870
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x34], 0
je 0x403893
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push eax
push 0
push ecx
call fcn.00549e40
add esp, 0xc
pop esi
ret 0xc
push ebx
mov ebx, dword [esp + 0x14]
test ebx, ebx
jbe 0x403971
push ebp
mov ebp, dword [esp + 0x14]
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebp
push edi
lea esp, [esp]
cmp dword [esi + 8], 0
jne 0x4038ec
mov eax, dword [esi + 0x30]
mov ecx, dword [esi]
push 0
lea edx, [esp + 0x20]
push edx
push 0x10000
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x403976
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x403992
mov edx, dword [esi + 0x30]
mov dword [esi + 4], edx
mov dword [esi + 8], eax
cmp dword [esi + 0x38], 0
je 0x403924
mov edi, dword [esi + 0x18]
mov eax, dword [esi + 8]
cmp edi, eax
jbe 0x4038fe
mov edi, eax
mov eax, dword [esi + 4]
mov ecx, dword [esi + 0x14]
push edi
push eax
push ecx
call fcn.00549ad0
add dword [esi + 4], edi
add dword [esi + 0x14], edi
sub dword [esi + 8], edi
add esp, 0xc
sub dword [esi + 0x18], edi
jne 0x4038b0
pop edi
pop ebp
pop ebx
pop esi
ret 0xc
lea edx, [esi + 4]
push edx
call fcn.0052a8d0
test eax, eax
je 0x403936
cmp eax, 4
jne 0x4039b2
cmp dword [esi + 0x18], 0
je 0x40396f
cmp eax, 4
jne 0x4038b0
push eax
push str.BZ2_bzDecompress__:__d:_Unexpected_EOF_in_decompression_stream._n
call fcn.0048f0d0
add esp, 8
lea eax, [esi + 4]
push eax
call fcn.0052a9c0
push ebx
push 0
push ebp
mov dword [esi + 0x34], 1
call fcn.00549e40
add esp, 0xc
pop edi
pop ebp
pop ebx
pop esi
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ReadFile__:__d:_Failed_to_read._n
call fcn.0048f0d0
add esp, 8
cmp dword [esi + 0x38], 0
jne 0x40395c
jmp 0x403953
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ReadFile__:__d:_Failed_to_read._n
call fcn.0048f0d0
add esp, 8
cmp dword [esi + 0x38], 0
jne 0x40395c
lea ecx, [esi + 4]
push ecx
jmp 0x403957
push eax
push str.BZ2_bzDecompress__:__d:_Failed_to_decompress._n
call fcn.0048f0d0
add esp, 8
lea edx, [esi + 4]
push edx
jmp 0x403957
Function at 0x41de20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
mov edi, dword [esp + 0xc]
push str.db_rebuild
push edi
call fcn.0040c5d0
xor ebx, ebx
cmp dword [0x598104], ebx
jne 0x41e23e
push ebp
push esi
mov esi, dword [esp + 0x18]
push esi
push str.create_db__d_n
call fcn.0048f0d0
push str.save_run_history_n
call fcn.0048f0d0
add esp, 0xc
push edi
call fcn.004556e0
cmp esi, ebx
je 0x41de7a
push str.set_ood_n
call fcn.0048f0d0
add esp, 4
push edi
call fcn.0040c150
push str.clear_queries_n
call fcn.0048f0d0
mov esi, dword [edi + 0x294]
add esp, 4
cmp esi, ebx
je 0x41df3a
push esi
call fcn.004526e0
lea eax, [esi + 4]
push eax
call fcn.004013d0
lea ecx, [esi + 0x1c]
push ecx
call fcn.004013d0
lea edx, [esi + 0x34]
push edx
call fcn.004013d0
lea eax, [esi + 0x4c]
push eax
call fcn.004013d0
lea ecx, [esi + 0x64]
push ecx
call fcn.004013d0
lea edx, [esi + 0x7c]
push edx
call fcn.004013d0
push esi
call fcn.00442d70
push esi
push 0x442d90
call fcn.00496c90
push esi
push 0x442dd0
call fcn.00496c90
push esi
push fcn.00442df0
call fcn.00496c90
mov eax, dword [esi + 0x254]
invalid
Function at 0x434310
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x3c
mov ecx, dword [esp + 0x50]
mov eax, dword [esp + 0x4c]
push esi
mov esi, dword [esp + 0x44]
push edi
mov edi, dword [esp + 0x4c]
lea edx, [esp + 0x14]
push edx
push 0x42e980
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 0x14]
mov dword [esp + 0x28], eax
lea eax, [esi + 0x2a4]
push edx
push eax
mov dword [esp + 0x28], edi
call fcn.004017c0
test eax, eax
je 0x43435f
pop edi
xor eax, eax
pop esi
add esp, 0x3c
ret 0x2c
mov eax, dword [esp + 0x50]
push ebx
mov ebx, dword [esp + 0x60]
push ebp
mov ebp, dword [esp + 0x68]
lea ecx, [esp + 0x1c]
push ecx
push 0x42e820
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x24]
mov dword [esp + 0x2c], eax
lea eax, [esi + 0x48]
push ecx
push eax
mov dword [esp + 0x30], edi
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebp
call fcn.004017c0
mov edi, eax
test edi, edi
je 0x434419
mov edx, dword [esp + 0x60]
mov eax, dword [esp + 0x5c]
push edx
push eax
push ebp
push ebx
push str.folder_name__t_found__yet_FRN_0x_016I64x_does_not_exists_n
push 0xffff0000
call fcn.0048f0f0
mov ecx, dword [esp + 0x6c]
add esp, 0x18
push edi
push esi
mov dword [esp + 0x3c], ecx
invalid
Function at 0x436cd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x3c
mov eax, dword [esp + 0x4c]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
push ebx
push ebp
mov ebp, dword [esp + 0x4c]
mov dword [esp + 0x18], ecx
mov ecx, dword [eax + 8]
push esi
mov esi, dword [esp + 0x4c]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x24], edx
mov edx, dword [eax + 0xc]
lea eax, [esi + 0x2bc]
push 0x42ea20
push eax
mov dword [esp + 0x24], ebp
mov dword [esp + 0x34], edx
call fcn.00401610
mov edx, dword [esp + 0x54]
mov ebx, eax
test ebx, ebx
mov dword [esp + 0x58], ebx
je 0x43716a
push edi
push edx
push ebp
push esi
call fcn.00432050
mov edi, eax
test edi, edi
je 0x437135
mov eax, dword [edi]
push ebx
push edi
mov dword [esp + 0x58], eax
call fcn.00432240
test eax, eax
jne 0x43711a
mov al, byte [edi + 4]
cmp al, 0xff
jne 0x436d5d
mov ecx, dword [edi - 4]
jmp 0x436d60
movzx ecx, al
mov edx, dword [esp + 0x64]
cmp ecx, edx
mov dword [esp + 0x10], ecx
jge 0x436d6e
mov edx, ecx
test edx, edx
lea ebx, [edi + 5]
invalid
Function at 0x48e4c0
Capabilities:
Enumerate pe sections
Read file on windows
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
je 0x48e4d5
mov dword [esp + 4], eax
jmp fcn.004a6180
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov ecx, dword [ecx]
push eax
mov eax, dword [esp + 0x10]
push edx
mov edx, dword [ecx + 0x2d8]
push eax
push edx
call fcn.004b9660
ret 0x14

Function at 0x48e550
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
je 0x48e565
mov dword [esp + 4], eax
jmp fcn.004b5ae0
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov ecx, dword [ecx]
push eax
mov eax, dword [esp + 0x10]
push edx
mov edx, dword [ecx + 0x2d8]
push eax
push edx
call fcn.004b96b0
ret 0x14
Function at 0x4927a0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_send]
push edi
jmp 0x4927b0
cmp dword [esi + 0x174], 0
jne 0x4927cc
mov eax, dword [esi + 0x16c]
test eax, eax
je 0x49281e
mov eax, dword [eax + 4]
mov dword [esi + 0x174], eax
mov ecx, dword [esi + 0x16c]
mov eax, dword [esi + 0x174]
mov edx, dword [ecx + 4]
push 0
push eax
sub edx, eax
lea eax, [edx + ecx + 8]
mov ecx, dword [esi + 8]
push eax
push ecx
call ebx
cmp eax, 0xffffffff
je 0x492838
test eax, eax
je 0x492833
sub dword [esi + 0x174], eax
jne 0x4927b0
mov edx, dword [esi + 0x16c]
mov edi, dword [edx]
mov eax, edx
push eax
call fcn.004a4a00
test edi, edi
mov dword [esi + 0x16c], edi
jne 0x4927b0
mov dword [esi + 0x170], edi
jmp 0x4927b0
cmp dword [esi + 0xc0], 0
je 0x492845
mov ecx, dword [esi + 8]
push 1
push ecx
call dword [sym.imp.WS2_32.dll_shutdown]
pop edi
xor eax, eax
pop ebx
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x492833
pop edi
mov eax, 1
pop ebx
ret