joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409520
Capabilities:
Enumerate process modules

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x46fdc4
push eax
mov eax, 0x1230
mov dword fs:[0], esp
call fcn.0044c000
push ebx
push ebp
push esi
push edi
mov ebp, ecx
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x240]
push eax
xor esi, esi
push 0x1000
push ecx
mov dword [esp + 0x1254], esi
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x409725
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x20], esi
shr eax, 2
mov dword [esp + 0x30], eax
je 0x409725
lea edx, [esp + 0x240]
mov bl, 2
mov dword [esp + 0x18], edx
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx]
test edx, edx
je 0x409709
mov eax, dword [str._unknown_]
mov ecx, dword [0x48c0a0]
mov dword [esp + 0x13c], eax
mov ax, word [0x48c0a4]
mov dword [esp + 0x140], ecx
mov word [esp + 0x144], ax
mov ecx, 0x3e
xor eax, eax
lea edi, [esp + 0x146]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [0x48fb24]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
push edx
push 0
push 0x410
mov byte [esp + 0x1254], bl
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4096e3
lea ecx, [esp + 0x34]
lea edx, [esp + 0x1c]
push ecx
push 4
push edx
push esi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x4096c6
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x13c]
push 0x104
push eax
push ecx
push esi
call sub.PSAPI.DLL_GetModuleBaseNameA
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x38]
push 0x104
push edx
push eax
push esi
mov byte [esp + 0x48], 0
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
jne 0x409656
mov byte [esp + 0x38], al
lea ecx, [esp + 0x38]
push 0x48c090
lea edx, [esp + 0x28]
push ecx
push edx
mov ecx, ebp
call fcn.004097a0
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x124c], 3
call fcn.004629d1
lea ecx, [esp + 0x24]
mov byte [esp + 0x1248], bl
call fcn.00462898
lea eax, [esp + 0x38]
push 0x48c080
lea ecx, [esp + 0x2c]
push eax
push ecx
mov ecx, ebp
call fcn.004097a0
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x124c], 4
call fcn.004629d1
lea ecx, [esp + 0x28]
mov byte [esp + 0x1248], bl
call fcn.00462898
mov edx, dword [esp + 0x1250]
lea ecx, [esp + 0x10]
push edx
call fcn.00461725
cmp eax, 0xffffffff
push esi
jne 0x409759
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x14]
mov byte [esp + 0x1248], 1
call fcn.00462898
lea ecx, [esp + 0x10]
mov byte [esp + 0x1248], 0
call fcn.00462898
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x20]
mov esi, dword [esp + 0x18]
inc ecx
add esi, 4
cmp ecx, eax
mov dword [esp + 0x20], ecx
mov dword [esp + 0x18], esi
jb 0x40958f
lea ecx, [esp + 0x1250]
mov dword [esp + 0x1248], 0xffffffff
call fcn.00462898
xor al, al
mov ecx, dword [esp + 0x1240]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x123c
ret 4
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x14]
mov byte [esp + 0x1248], 1
call fcn.00462898
lea ecx, [esp + 0x10]
mov byte [esp + 0x1248], 0
call fcn.00462898
lea ecx, [esp + 0x1250]
mov dword [esp + 0x1248], 0xffffffff
call fcn.00462898
mov al, 1
jmp 0x40973e
Function at 0x4097a0
Capabilities:
Get file version info

Disassembly:
push 0xffffffffffffffff
push 0x46fdf5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x190
push ebx
push ebp
push esi
push edi
push str.Unavailable
lea ecx, [esp + 0x14]
mov dword [esp + 0x1c], 0
call fcn.00462906
mov ebx, dword [esp + 0x1b4]
lea eax, [esp + 0x88]
mov ebp, 1
push eax
push ebx
mov dword [esp + 0x1b0], ebp
call fcn.00467d2a
test eax, eax
je 0x4098f3
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
jne 0x409828
mov esi, dword [esp + 0x1b0]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.0046260d
mov dword [esp + 0x18], ebp
jmp 0x40990a
push esi
call fcn.00463d8c
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x409875
lea edx, [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
push eax
push str.VarFileInfoTranslation
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x409862
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x409875
push edi
call fcn.00463db5
add esp, 4
lea ecx, [esp + 0x10]
push ecx
jmp 0x4098f8
mov eax, dword [esp + 0x14]
xor esi, esi
test eax, 0xfffffffc
jbe 0x4098ea
mov ebp, dword [esp + 0x1b8]
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [esp + 0x1c]
xor edx, edx
xor ecx, ecx
push ebp
mov dx, word [eax + esi*4 + 2]
mov cx, word [eax + esi*4]
push edx
push ecx
lea edx, [esp + 0x30]
push str.StringFileInfo_04x_04x_s
push edx
call ebx
add esp, 0x14
lea eax, [esp + 0x14]
lea ecx, [esp + 0x20]
lea edx, [esp + 0x24]
push eax
push ecx
push edx
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4098e5
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x10]
push eax
call fcn.00462a21
mov ecx, dword [esp + 0x14]
inc esi
shr ecx, 2
cmp esi, ecx
jb 0x40988f
mov ebp, 1
push edi
call fcn.00463db5
add esp, 4
lea edx, [esp + 0x10]
push edx
mov esi, dword [esp + 0x1b4]
mov ecx, esi
call fcn.0046260d
mov dword [esp + 0x18], ebp
lea ecx, [esp + 0x10]
mov byte [esp + 0x1a8], 0
call fcn.00462898
mov ecx, dword [esp + 0x1a0]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x19c
ret 0xc
Function at 0x40b2a0
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x4700a6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa08
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov dword [esp + 0xa20], ebx
mov eax, dword [0x48fb24]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov ebp, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [esp + 0xa20], 5
xor esi, esi
mov eax, dword [esp + 0xa34]
mov ecx, dword [esp + 0xa30]
mov edx, dword [esp + 0xa2c]
push eax
mov eax, dword [esp + 0xa2c]
push ecx
push edx
push eax
call ebp
test eax, eax
jne 0x40b31b
push 0x32
call edi
inc esi
cmp esi, 0xa
jl 0x40b2eb
cmp esi, 0xa
jne 0x40b32e
mov byte [esp + 0xa20], 4
lea ecx, [esp + 0x14]
jmp 0x40b394
mov ecx, dword [esp + 0xa34]
mov eax, dword [esp + 0xa2c]
push ecx
mov ecx, dword [esp + 0xa2c]
lea edx, [esp + 0x1c]
push 0xa00
push edx
push 0x491f08
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 0x18]
lea eax, [esp + 0x10]
push edx
push 0x48b480
push eax
call fcn.00461a66
mov ecx, dword [esp + 0xa3c]
mov edx, dword [esp + 0x1c]
push ecx
push edx
call fcn.0044bf3e
add esp, 0x14
mov byte [esp + 0xa20], 4
test eax, eax
lea ecx, [esp + 0x14]
je 0x40b403
call fcn.00462898
lea ecx, [esp + 0x10]
mov byte [esp + 0xa20], 3
call fcn.00462898
lea ecx, [esp + 0xa28]
mov byte [esp + 0xa20], 2
call fcn.00462898
lea ecx, [esp + 0xa2c]
mov byte [esp + 0xa20], 1
call fcn.00462898
lea ecx, [esp + 0xa30]
mov byte [esp + 0xa20], bl
call fcn.00462898
lea ecx, [esp + 0xa34]
mov dword [esp + 0xa20], 0xffffffff
call fcn.00462898
mov eax, 1
jmp 0x40b46d
call fcn.00462898
lea ecx, [esp + 0x10]
mov byte [esp + 0xa20], 3
call fcn.00462898
lea ecx, [esp + 0xa28]
mov byte [esp + 0xa20], 2
call fcn.00462898
lea ecx, [esp + 0xa2c]
mov byte [esp + 0xa20], 1
call fcn.00462898
lea ecx, [esp + 0xa30]
mov byte [esp + 0xa20], bl
call fcn.00462898
lea ecx, [esp + 0xa34]
mov dword [esp + 0xa20], 0xffffffff
call fcn.00462898
xor eax, eax
mov ecx, dword [esp + 0xa18]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xa14
ret
Function at 0x40baf0
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
sub esp, 0x104
push ebp
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [esp + 0x110]
test edi, edi
jne 0x40bb2e
lea eax, [esp + 8]
push 0x104
push eax
call fcn.0040bba0
add esp, 8
lea edi, [esp + 8]
push edi
call sub.WSOCK32.dll_inet_addr
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x40bb88
push ebx
push esi
mov esi, str.255.255.255.255
mov eax, edi
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x40bb6c
test cl, cl
je 0x40bb68
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x40bb6c
add eax, 2
add esi, 2
test cl, cl
jne 0x40bb44
xor eax, eax
jmp 0x40bb71
sbb eax, eax
sbb eax, 0xffffffff
pop esi
pop ebx
test eax, eax
je 0x40bb88
push edi
call sub.WSOCK32.dll_gethostbyname
test eax, eax
je 0x40bb88
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov ebp, dword [ecx]
push ebp
call sub.WSOCK32.dll_ntohl
pop edi
pop ebp
add esp, 0x104
ret

Function at 0x40bba0
Capabilities:
Get hostname
Resolve dns

Disassembly:
sub esp, 0x104
push ebx
mov ebx, dword [esp + 0x10c]
push esi
push edi
test ebx, ebx
je 0x40bc66
mov esi, dword [esp + 0x118]
test esi, esi
jbe 0x40bc66
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0xc]
push 0x104
push eax
call sub.WSOCK32.dll_gethostname
cmp eax, 0xffffffff
je 0x40bc6e
lea ecx, [esp + 0xc]
push ecx
call sub.WSOCK32.dll_gethostbyname
test eax, eax
je 0x40bc13
mov edx, dword [eax]
push 0x104
lea eax, [esp + 0x10]
push edx
push eax
call fcn.0044c5c0
add esp, 0xc
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, esi
jbe 0x40bc39
push 0x7a
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x104
ret
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov al, 1
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
add esp, 0x104
ret
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x104
ret
Function at 0x40bc80
Capabilities:
Get hostname
Resolve dns

Disassembly:
sub esp, 0x104
push ebp
mov ebp, dword [esp + 0x10c]
push esi
push edi
test ebp, ebp
je 0x40bd83
mov esi, dword [esp + 0x118]
test esi, esi
jbe 0x40bd83
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0xc]
push 0x104
push eax
call sub.WSOCK32.dll_gethostname
cmp eax, 0xffffffff
je 0x40bd8b
lea ecx, [esp + 0xc]
push ecx
call sub.WSOCK32.dll_gethostbyname
test eax, eax
je 0x40bd8b
mov edx, dword [eax + 0xc]
cmp dword [edx], 0
je 0x40bd8b
cmp word [eax + 0xa], 4
jl 0x40bd8b
mov byte [esp + 0xc], 0
mov eax, dword [eax + 0xc]
xor ecx, ecx
xor edx, edx
mov eax, dword [eax]
mov cl, byte [eax + 3]
mov dl, byte [eax + 2]
push ecx
push edx
xor ecx, ecx
xor edx, edx
mov cl, byte [eax + 1]
mov dl, byte [eax]
push ecx
push edx
lea eax, [esp + 0x1c]
push str._u._u._u._u
push eax
call fcn.0044c271
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x18
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, esi
jbe 0x40bd56
push 0x7a
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
xor al, al
pop ebp
add esp, 0x104
ret
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov al, 1
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
add esp, 0x104
ret
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
xor al, al
pop ebp
add esp, 0x104
ret
Function at 0x40be20
Capabilities:
Set socket configuration

Disassembly:
push 0xffffffffffffffff
push 0x470168
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
mov dword [esp + 0xc], ecx
call fcn.0040b960
test al, al
je 0x40be5e
pop esi
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 0x14
mov eax, dword [esp + 0x3c]
mov ebp, dword [esp + 0x38]
push 0
push eax
push ebp
call sub.WSOCK32.dll_socket
mov esi, eax
cmp esi, 0xffffffff
je 0x40bf98
mov bl, byte [esp + 0x40]
test bl, 4
je 0x40bec0
lea ecx, [esp + 0x38]
push 4
push ecx
push 4
push 0xffff
push esi
mov dword [esp + 0x4c], 1
call sub.WSOCK32.dll_setsockopt
cmp eax, 0xffffffff
jne 0x40bec0
push esi
call sub.WSOCK32.dll_closesocket
pop esi
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 0x14
cmp dword [esp + 0x3c], 2
jne 0x40bf09
test bl, 0x20
je 0x40bf09
lea edx, [esp + 0x38]
push 4
push edx
push 0x20
push 0xffff
push esi
mov dword [esp + 0x4c], 1
call sub.WSOCK32.dll_setsockopt
cmp eax, 0xffffffff
jne 0x40bf09
push esi
call sub.WSOCK32.dll_closesocket
pop esi
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 0x14
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
push ebp
push ecx
push edx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], eax
call fcn.0040b7e0
lea eax, [esp + 0x10]
push 0x10
push eax
push esi
call sub.WSOCK32.dll_bind
cmp eax, 0xffffffff
jne 0x40bf61
push esi
call sub.WSOCK32.dll_closesocket
pop esi
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 0x14
cmp dword [esp + 0x3c], 1
jne 0x40bf91
push 5
push esi
call sub.WSOCK32.dll_listen
cmp eax, 0xffffffff
jne 0x40bf91
push esi
call sub.WSOCK32.dll_closesocket
pop esi
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 0x14
mov ecx, dword [esp + 0xc]
mov dword [ecx + 4], esi
mov ecx, dword [esp + 0x20]
xor eax, eax
cmp esi, 0xffffffff
pop esi
pop ebp
pop ebx
setne al
mov dword fs:[0], ecx
add esp, 0x20
ret 0x14
Function at 0x40bfe0
Capabilities:
Connect socket

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x470188
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, ecx
call fcn.0040b960
test al, al
je 0x40c01c
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10
mov eax, dword [esp + 0x38]
mov edi, dword [esp + 0x34]
push 0
push eax
push edi
call sub.WSOCK32.dll_socket
mov esi, eax
cmp esi, 0xffffffff
je 0x40c0f2
xor ecx, ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
push edi
push 0x48b32c
mov dword [esp + 0x2c], ecx
push ecx
lea ecx, [esp + 0x18]
call fcn.0040b7e0
test al, al
jne 0x40c07e
push esi
call sub.WSOCK32.dll_closesocket
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10
lea edx, [esp + 0xc]
push 0x10
push edx
push esi
call sub.WSOCK32.dll_bind
cmp eax, 0xffffffff
jne 0x40c0ac
push esi
call sub.WSOCK32.dll_closesocket
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
push 2
push eax
push ecx
lea ecx, [esp + 0x18]
call fcn.0040b7e0
lea edx, [esp + 0xc]
push 0x10
push edx
push esi
call sub.WSOCK32.dll_connect
cmp eax, 0xffffffff
jne 0x40c0ef
push esi
call sub.WSOCK32.dll_closesocket
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10
mov dword [ebx + 4], esi
mov ecx, dword [esp + 0x1c]
xor eax, eax
cmp esi, 0xffffffff
pop edi
pop esi
pop ebx
setne al
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10

Function at 0x40c140
Capabilities:
Resume thread

Disassembly:
push ecx
push esi
push edi
mov edi, ecx
call fcn.0040b970
test al, al
jne 0x40c190
mov ecx, edi
call fcn.0040b960
test al, al
je 0x40c190
lea eax, [esp + 8]
mov dword [esp + 8], 0
push eax
push 4
push edi
push 0x40c9c0
push 0
push 0
call fcn.0044c79f
mov esi, eax
add esp, 0x18
test esi, esi
je 0x40c190
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [edi + 8], esi
pop edi
mov al, 1
pop esi
pop ecx
ret
pop edi
xor al, al
pop esi
pop ecx
ret
Function at 0x40c1a0
Capabilities:
Terminate thread

Disassembly:
push ebp
push esi
mov esi, ecx
call fcn.0040b960
test al, al
je 0x40c1b4
mov ecx, esi
call fcn.0040c110
mov ecx, esi
call fcn.0040b970
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
test al, al
je 0x40c1fe
push 1
push 0x64
call dword [sym.imp.KERNEL32.dll_SleepEx]
mov eax, dword [esi + 8]
push 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x40c1f1
mov ecx, dword [esi + 8]
push 1
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [esi + 8]
push edx
call ebp
mov dword [esi + 8], 0
mov eax, dword [esi + 0x18]
push ebx
test eax, eax
push edi
je 0x40c237
mov ebx, dword [esi + 0x14]
mov edi, dword [ebx]
cmp edi, ebx
je 0x40c237
mov eax, edi
mov edi, dword [edi]
push eax
mov ecx, dword [eax + 4]
mov edx, dword [eax]
mov dword [ecx], edx
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
call fcn.00463db5
mov ecx, dword [esi + 0x18]
add esp, 4
dec ecx
cmp edi, ebx
mov dword [esi + 0x18], ecx
jne 0x40c210
mov eax, dword [esi + 0x1c]
pop edi
test eax, eax
pop ebx
je 0x40c24a
push eax
call ebp
mov dword [esi + 0x1c], 0
pop esi
pop ebp
ret
Function at 0x40d4c0
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
push ebx
push esi
mov esi, ecx
push edi
mov ecx, 0x7a
xor eax, eax
lea edi, [esi + 0x3c]
mov dword [esp + 0xc], 0x94
rep stosd dword es:[edi], eax
mov ecx, 0x24
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
xor ebx, ebx
push eax
mov dword [esi + 0x224], ebx
mov dword [esi + 0x228], 1
mov dword [esi + 0x22c], 1
mov dword [esi + 0x26c], ebx
mov dword [esi + 0x270], 1
mov dword [esi + 0x230], ebx
mov dword [esi + 0x250], ebx
mov dword [esi + 0x268], ebx
mov dword [esi + 0x238], ebx
mov dword [esi + 0x274], ebx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x1c], 2
jne 0x40d562
cmp dword [esp + 0x10], 5
jb 0x40d562
mov eax, 1
pop edi
mov dword [esi + 0x234], eax
pop esi
pop ebx
add esp, 0x94
ret
mov dword [esi + 0x234], ebx
pop edi
pop esi
pop ebx
add esp, 0x94
ret

Function at 0x4257e0
Capabilities:
Create directory

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x11c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
mov dword [esp + 0x10], eax
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x14]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea ebx, [esp + ecx + 0x14]
mov esi, ebx
lea ecx, [esp + 0x14]
push 0
push ecx
call ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test edi, edi
jne 0x42586b
cmp eax, 3
jne 0x425864
cmp byte [esi], 0x5c
je 0x42585f
lea edx, [esp + 0x14]
cmp esi, edx
je 0x425888
mov al, byte [esi - 1]
dec esi
cmp al, 0x5c
jne 0x42584f
mov byte [esi], 0
jmp 0x42587a
cmp eax, 0xb7
jne 0x425888
cmp esi, ebx
je 0x425895
mov byte [esi], 0x5c
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x425872
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0xa
mov dword [esp + 0x10], eax
jl 0x425830
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x108
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x108
ret
Function at 0x439170
Capabilities:
Get file size

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x474708
push eax
mov dword fs:[0], esp
push esi
push edi
mov eax, dword [esp + 0x18]
push 0
push 0x80
push 3
push 0
push 0
push bind
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4391cb
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], eax
call fcn.00462898
xor eax, eax
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0xc
ret
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.00462898
mov ecx, dword [esp + 8]
mov eax, edi
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret
Function at 0x44c30f
Capabilities:
Get common file path
Set current directory
Set environment variable

Disassembly:
push 0x124
push 0x47b2c8
call fcn.0045022c
lea edi, [ebp - 0x134]
xor ebx, ebx
mov dword [ebp - 0x24], ebx
or dword [ebp - 0x20], 0xffffffff
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x44c3ee
mov eax, edi
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esi, eax
mov dword [ebp - 0x28], esi
cmp esi, 0x104
jle 0x44c3b1
mov dword [ebp - 4], ebx
lea eax, [esi + 1]
add eax, 3
and eax, 0xfffffffc
call fcn.0044c000
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x2c], edi
jmp 0x44c39e
or dword [ebp - 4], 0xffffffff
cmp esi, ebx
je 0x44c3ee
push edi
inc esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esi, eax
cmp esi, ebx
je 0x44c3ee
mov al, byte [edi]
cmp al, 0x5c
je 0x44c3bf
cmp al, 0x2f
jne 0x44c3c4
cmp al, byte [edi + 1]
je 0x44c3eb
mov byte [ebp - 0x1c], 0x3d
movzx eax, byte [edi]
push eax
call fcn.00452f0f
pop ecx
mov byte [ebp - 0x1b], al
mov byte [ebp - 0x1a], 0x3a
mov byte [ebp - 0x19], bl
push edi
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
je 0x44c3ee
mov dword [ebp - 0x20], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0044f6f0
pop ecx
cmp dword [ebp - 0x24], ebx
je 0x44c407
push edi
call fcn.0044d3dd
pop ecx
mov eax, dword [ebp - 0x20]
lea esp, [ebp - 0x140]
call fcn.00450267
ret

Function at 0x44c79f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
test edi, edi
jne 0x44c7bc
call fcn.0044f6ca
mov dword [eax], 0x16
xor eax, eax
jmp 0x44c825
xor ecx, ecx
push esi
mov edx, 0x8c
inc ecx
call fcn.004501ac
mov esi, eax
test esi, esi
je 0x44c810
push esi
call fcn.00450f7c
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
pop ecx
mov dword [esi + 0x4c], edi
jne 0x44c7ee
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x44c70a
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x44c824
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.0044d3dd
test ebx, ebx
pop ecx
je 0x44c822
push ebx
call fcn.0044f6f0
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret