joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49dfd0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Get socket status
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x535b70]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x49e01e
push str.socket_failed_n
push 0
push 0xa
call fcn.0048b8c0
add esp, 0xc
or eax, esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a55ed
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 1
push eax
push 0x8004667e
push esi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
inc eax
neg eax
push 0x10
sbb eax, eax
neg eax
push edi
dec eax
push esi
mov dword [ebp - 0x210], eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x49e071
call fcn.0049df20
sub eax, 0x70
je 0x49e071
sub eax, 0x1c
je 0x49e071
push str.error_connecting_to_HTTP_server
jmp 0x49e197
mov eax, dword [0x535848]
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x218], 0
push eax
lea eax, [ebp - 0x108]
mov dword [ebp - 0x104], esi
push eax
push 0
lea eax, [esi + 1]
mov dword [ebp - 0x108], 1
push eax
mov dword [ebp - 0x208], esi
mov dword [ebp - 0x20c], 1
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x49e192
test eax, eax
je 0x49e18b
lea eax, [ebp - 0x108]
push eax
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x49e104
lea eax, [ebp - 0x20c]
push eax
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x49e104
push str.select_failed_n
jmp 0x49e197
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 4
push eax
lea eax, [ebp - 0x210]
push eax
push 0x1007
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jns 0x49e138
push str.getsockopt_failed_n
jmp 0x49e197
cmp dword [ebp - 0x210], 0
je 0x49e179
push str.Error_connecting_to_remote_host
push 0
push 0xa
call fcn.0048b8c0
add esp, 0xc
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
call fcn.004ce60a
mov ecx, dword [ebp - 0x210]
pop edi
pop esi
mov dword [eax], ecx
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a55ed
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a55ed
mov esp, ebp
pop ebp
ret
push str.Connect_attempt_timed_out
jmp 0x49e197
push str.Connect_failed
push 0
push 0xa
call fcn.0048b8c0
add esp, 0xc
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
xor ecx, ebp
pop esi
call fcn.004a55ed
mov esp, ebp
pop ebp
ret
Function at 0x49f930
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x535b70]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
mov dword [ebp - 0x10c], ecx
push edi
test byte [ebx + 0x18], 1
mov edi, dword [ebp + 0x10]
je 0x49fa12
test ecx, ecx
je 0x49fa12
test edi, edi
jle 0x49fa12
push 0
mov eax, edi
sub eax, esi
push eax
lea eax, [ecx + esi]
push eax
push dword [ebx + 0x14]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x49f98d
add esi, eax
jmp 0x49f9ea
cmp eax, 0xffffffff
jne 0x49f9a8
call fcn.0049df20
cmp eax, 0xb
je 0x49f9a8
call fcn.0049df20
cmp eax, 0x8c
jne 0x49f9f9
mov eax, dword [0x535848]
lea ecx, [ebp - 0x114]
push ecx
push 0
mov dword [ebp - 0x114], eax
lea ecx, [ebp - 0x108]
mov eax, dword [ebx + 0x14]
push ecx
mov dword [ebp - 0x104], eax
inc eax
push 0
push eax
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x108], 1
call dword [sym.imp.WS2_32.dll_select]
cmp esi, edi
jge 0x49fa12
mov ecx, dword [ebp - 0x10c]
jmp 0x49f971
push str.send_failed_n
push 0
push 0xa
call fcn.0048b8c0
or eax, 0xffffffff
add esp, 0xc
test esi, esi
cmove esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a55ed
mov esp, ebp
pop ebp
ret
Function at 0x4a1700
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x535b70]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
test esi, esi
je 0x4a17a1
test edi, edi
jne 0x4a172c
cmp dword [esi + 0xc], edi
je 0x4a17a1
push esi
call fcn.004a13c0
add esp, 4
mov dword [esi + 0x30], eax
cmp eax, 0xffffffff
je 0x4a17a1
push str.TYPE_I_r_n
lea eax, [ebp - 0x130]
push 0x12c
push eax
call fcn.0044ad40
lea ecx, [ebp - 0x130]
add esp, 0xc
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a1760
push 0
sub ecx, edx
lea eax, [ebp - 0x130]
push ecx
push eax
push dword [esi + 0x2c]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x4a17b4
push str.send_failed
push 0
push 9
call fcn.0048b8c0
add esp, 0xc
push dword [esi + 0x30]
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 0x30], 0xffffffff
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a55ed
mov esp, ebp
pop ebp
ret
push esi
call fcn.004a1aa0
add esp, 4
cmp eax, 2
jne 0x4a1791
test edi, edi
jne 0x4a17c9
mov edi, dword [esi + 0xc]
push edi
push str.RETR__s_r_n
lea eax, [ebp - 0x130]
push 0x12c
push eax
call fcn.0044ad40
lea ecx, [ebp - 0x130]
mov byte [ebp - 5], 0
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a17f0
push 0
sub ecx, edx
lea eax, [ebp - 0x130]
push ecx
push eax
push dword [esi + 0x2c]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
js 0x4a1780
push esi
call fcn.004a1aa0
mov ecx, dword [esi + 0x30]
add esp, 4
cmp eax, 1
je 0x4a182b
push ecx
jmp 0x4a1794
mov eax, ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004a55ed
mov esp, ebp
pop ebp
ret

Function at 0x4a1840
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x535b70]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x542094], 0
jne 0x4a1915
lea eax, [ebp - 0x194]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x4a1915
push str.no_proxy
mov dword [0x54209c], 0x15
call fcn.004cf73e
add esp, 4
test eax, eax
je 0x4a18a0
cmp byte [eax], 0x2a
jne 0x4a18a0
cmp byte [eax + 1], 0
je 0x4a1915
push str.ftp_proxy
call fcn.004cf73e
add esp, 4
test eax, eax
jne 0x4a18c2
push str.FTP_PROXY
call fcn.004cf73e
add esp, 4
test eax, eax
je 0x4a18cb
push eax
call fcn.004a1cb0
add esp, 4
push str.ftp_proxy_user
call fcn.004cf73e
add esp, 4
test eax, eax
je 0x4a18eb
push eax
call dword [0x5351e0]
add esp, 4
mov dword [0x5420a0], eax
push str.ftp_proxy_password
call fcn.004cf73e
add esp, 4
test eax, eax
je 0x4a190b
push eax
call dword [0x5351e0]
add esp, 4
mov dword [0x5420a4], eax
mov dword [0x542094], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a55ed
mov esp, ebp
pop ebp
ret
Function at 0x4a1aa0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x4a1c9f
cmp dword [ebx + 0x2c], 0xffffffff
je 0x4a1c9f
nop dword [eax]
cmp dword [ebx + 0x2c], 0xffffffff
je 0x4a1c9f
mov ecx, dword [ebx + 0x440]
cmp ecx, 0x400
ja 0x4a1c9f
mov eax, dword [ebx + 0x444]
cmp eax, 0x400
ja 0x4a1c9f
cmp ecx, eax
jg 0x4a1c9f
mov esi, eax
mov dword [ebp - 4], esi
test ecx, ecx
jle 0x4a1b36
sub eax, ecx
push eax
lea eax, [ebx + 0x3c]
add eax, ecx
push eax
lea eax, [ebx + 0x3c]
push eax
call fcn.004bd670
mov eax, dword [ebx + 0x440]
add esp, 0xc
sub dword [ebx + 0x444], eax
xor ecx, ecx
mov eax, dword [ebx + 0x444]
mov esi, eax
mov dword [ebx + 0x440], 0
mov dword [ebp - 4], eax
mov edx, 0x400
sub edx, eax
jne 0x4a1b43
xor eax, eax
jmp 0x4a1b77
push 0
push edx
lea eax, [ebx + 0x3c]
add eax, ecx
push eax
push dword [ebx + 0x2c]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
js 0x4a1c7e
add dword [ebx + 0x444], eax
mov ecx, dword [ebx + 0x444]
mov byte [ecx + ebx + 0x3c], 0
mov esi, dword [ebx + 0x444]
mov dword [ebp - 4], esi
test esi, esi
jne 0x4a1b83
test eax, eax
je 0x4a1c9f
mov eax, dword [ebx + 0x440]
add esi, 0x3c
add eax, 0x3c
add esi, ebx
add eax, ebx
cmp eax, esi
jae 0x4a1ac0
nop dword [eax + eax]
mov ecx, esi
sub ecx, eax
cmp ecx, 3
jl 0x4a1c00
mov dl, byte [eax]
mov cl, dl
sub cl, 0x30
cmp cl, 9
ja 0x4a1c00
mov ch, byte [eax + 1]
mov cl, ch
movsx edx, dl
sub cl, 0x30
cmp cl, 9
ja 0x4a1c00
mov cl, byte [eax + 2]
mov byte [ebp + 0xb], cl
sub cl, 0x30
cmp cl, 9
ja 0x4a1c00
movsx ecx, ch
lea edx, [edx + edx*4]
lea ecx, [ecx + edx*2]
lea edx, [ecx + ecx*4]
movsx ecx, byte [ebp + 0xb]
lea ecx, [ecx + edx*2]
add ecx, 0xffffeb30
mov edx, ecx
neg edx
cmp byte [eax + 3], 0x2d
cmovne edx, ecx
test edx, edx
jg 0x4a1c22
nop dword [eax + eax]
cmp byte [eax], 0xa
je 0x4a1c18
inc eax
cmp eax, esi
jb 0x4a1c00
mov eax, dword [ebp - 4]
mov dword [ebx + 0x440], eax
jmp 0x4a1ac0
inc eax
cmp eax, esi
jb 0x4a1ba0
jmp 0x4a1ac0
add eax, 3
mov ecx, eax
sub ecx, ebx
sub ecx, 0x3c
mov dword [ebx + 0x448], ecx
cmp eax, esi
jae 0x4a1c40
cmp byte [eax], 0xa
je 0x4a1c40
inc eax
cmp eax, esi
jb 0x4a1c36
mov cl, byte [eax]
mov byte [ebp + 0xb], cl
cmp cl, 0xa
jne 0x4a1c51
mov cl, byte [eax + 1]
inc eax
mov byte [ebp + 0xb], cl
cmp byte [ebp + 0xb], 0xd
lea ecx, [eax + 1]
pop edi
cmovne ecx, eax
mov eax, 0x51eb851f
imul edx
sub ecx, ebx
sar edx, 5
sub ecx, 0x3c
mov eax, edx
mov dword [ebx + 0x440], ecx
shr eax, 0x1f
pop esi
add eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
push str.recv_failed
push 0
push 9
call fcn.0048b8c0
add esp, 0xc
push dword [ebx + 0x2c]
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [ebx + 0x2c], 0xffffffff
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a76d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x4de4aa
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004de320
Function at 0x401540
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x1c
mov dword [0x40db54], eax
push esi
push 0
push section..text
push 0
push 0x65
push eax
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov esi, eax
test esi, esi
jne 0x401572
push str.CreateDialog
call fcn.004015e0
add esp, 4
mov eax, dword [esp + 0x30]
push eax
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push 0
push 0
lea ecx, [esp + 0xc]
push 0
push ecx
call esi
test eax, eax
je 0x4015cf
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
push edi
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [esp + 0xc]
push edx
call edi
lea eax, [esp + 0xc]
push eax
call ebx
push 0
push 0
lea ecx, [esp + 0x14]
push 0
push ecx
call esi
test eax, eax
jne 0x4015a3
mov eax, dword [esp + 0x14]
pop edi
pop ebx
pop esi
add esp, 0x1c
ret 0x10
mov eax, dword [esp + 0xc]
pop esi
add esp, 0x1c
ret 0x10

Function at 0x4015e0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x50
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [esp + 0x58]
push esi
push eax
lea ecx, [esp + 0xc]
push str._s_failed:_GetLastError_returned__u_n
push ecx
call fcn.00402cdf
add esp, 0x10
lea edx, [esp + 4]
push 0
push str.Error
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x4071d9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40d840
cmp edx, dword [eax]
je 0x4071fb
add eax, 8
inc ecx
cmp eax, 0x40d8d0
jl 0x4071ec
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40d840]
jne 0x407329
mov eax, dword [0x40e18c]
cmp eax, 1
je 0x407303
test eax, eax
jne 0x40722c
cmp dword [0x40b2ac], 1
je 0x407303
cmp edx, 0xfc
je 0x407329
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x407263
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004084c0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004042c0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4072a6
lea eax, [ebp - 0x1a4]
push eax
call fcn.004042c0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x409624
push edi
call fcn.00408640
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004084c0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004084d0
lea eax, [ebp - 0xa0]
push 0x409604
push eax
call fcn.004084d0
push dword [esi + 0x40d844]
lea eax, [ebp - 0xa0]
push eax
call fcn.004084d0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004085b0
add esp, 0x2c
pop edi
jmp 0x407329
lea eax, [ebp + 8]
lea esi, [esi + 0x40d844]
push 0
push eax
push dword [esi]
call fcn.004042c0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x41b7a0
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x808
mov eax, dword [0x41f004]
xor eax, esp
mov dword [esp + 0x804], eax
mov eax, dword [0x4222a4]
imul eax, eax, 0x343fd
cmp dword [0x22c4e8c], 0x139e
mov dword [0x4222a4], eax
jne 0x41b7f3
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTapePosition]
mov eax, dword [esp]
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_GetAce]
mov eax, dword [0x4222a4]
add eax, 0x269ec3
push esi
mov dword [0x4222a4], eax
movzx esi, word [0x4222a6]
and esi, 0x7fff
cmp dword [0x22c4e8c], 0x8e7
jne 0x41b828
push 0
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ecx, dword [esp + 0x808]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00401000
add esp, 0x808
ret

Function at 0x41b8b0
Capabilities:
Create pipe

Disassembly:
sub esp, 0x24
mov eax, dword [0x41f004]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [0x4201f0]
push ebx
mov ebx, dword [0x22c4830]
push edi
mov edi, dword [0x22c4e8c]
call fcn.0041b840
cmp dword [0x22c4e8c], 0x2f
jne 0x41b915
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
call fcn.0041b870
mov ecx, dword [esp + 0x24]
pop edi
pop ebx
xor ecx, esp
call fcn.00401000
add esp, 0x24
ret
Function at 0x41bc70
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1818
call fcn.00409150
mov eax, dword [0x41f004]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
jmp 0x41bc99
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xbbe2aa2
jge 0x41bd41
cmp dword [0x22c4e8c], 0xa5f
jne 0x41bce5
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
push 0
lea ecx, [ebp - 0x818]
push ecx
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
lea edx, [ebp - 0x1018]
push edx
push str.keminivefayosexerukugufebaponif
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
cmp dword [ebp - 4], 0x84526b
jne 0x41bd0a
mov eax, dword [0x421010]
mov dword [0x22c4e8c], eax
mov ecx, dword [0x22c4e8c]
add ecx, 0xa231
mov dword [0x22c4e8c], ecx
cmp dword [0x22c4e8c], 0x141
jne 0x41bd3c
push str.renej_luwoyisawopab_dadabayegutenecisufoba_wozonotuwugewiropoxu_vogiwipeladoxakanahotucucuwi
lea edx, [ebp - 0x1818]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov dword [0x4222a8], 0xec58acac
mov dword [0x4222ac], 0xffffffff
jmp 0x41bc90
call fcn.0041b930
jmp dword [0x22c4830]
Function at 0x1000d76c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x1000d77b
pop dword [ebp - 0x44]
mov eax, 0x90cca1ca
add eax, 0x7f3435b1
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x3e397
push 0
mov eax, 0x66fd77f0
sub eax, 0x56fc06b0
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0x6cbe295a
sub ecx, 0x6cbdd13b
xor esi, esi
add esi, eax
mov edx, 0x6b7037ac
sub edx, 0x5b6de3ac
add edx, dword [ebp - 0x44]
mov ebx, 0x14805424
add ebx, 0x9bd6b06
xor dword [ebp - 0x18], ebx
mov edi, dword [edx]
sub dword [ebp - 0x10], 0x472b443d
xor edi, ebx
add dword [ebp - 8], 0x7597177c
mov dword [esi], edi
add dword [ebp - 0x40], 0x49a90c7d
add esi, 0xd02805f6
add esi, 0x2fd7fa0e
add edx, 0x43cbd9a1
sub edx, 0x43cbd99d
loop 0x1000d7dc
add eax, 0x1534f
xor ebx, ebx
add ebx, eax
add eax, 0xe382360d
add eax, 0x1c7dc9f8
mov ecx, 0x10000000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x4010d4
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, 0x4065cc
cmp dword [esi], 0
jne 0x40111a
push 0x644
push 0
call sub.KERNEL32.DLL_ReadFile
mov ecx, eax
test ecx, ecx
jne 0x4010f7
xor eax, eax
pop esi
pop ebx
ret
mov eax, dword [0x4065c8]
mov dword [ecx], eax
mov dword [0x4065c8], ecx
xor edx, edx
mov eax, edx
add eax, eax
lea eax, [ecx + eax*8 + 4]
mov ebx, dword [esi]
mov dword [eax], ebx
mov dword [esi], eax
inc edx
cmp edx, 0x64
jne 0x401106
mov eax, dword [esi]
mov edx, dword [eax]
mov dword [esi], edx
pop esi
pop ebx
ret

Function at 0x401760
Capabilities:
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
push ebp
push 0x401816
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x4065b0
call sub.KERNEL32.DLL_Sleep
cmp byte [0x406035], 0
je 0x40178e
push 0x4065b0
call sub.KERNEL32.DLL_TerminateProcess
mov eax, 0x4065d0
call fcn.00401124
mov eax, 0x4065e0
call fcn.00401124
mov eax, 0x40660c
call fcn.00401124
push 0xff8
push 0
call sub.KERNEL32.DLL_ReadFile
mov dword [0x406608], eax
cmp dword [0x406608], 0
je 0x4017f5
mov eax, 3
mov edx, dword [0x406608]
xor ecx, ecx
mov dword [edx + eax*4 - 0xc], ecx
inc eax
cmp eax, 0x401
jne 0x4017cb
mov eax, 0x4065f0
mov dword [eax + 4], eax
mov dword [eax], eax
mov dword [0x4065fc], eax
mov byte [0x4065a8], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40181d
cmp byte [0x406035], 0
je 0x401815
push 0x4065b0
call sub.KERNEL32.DLL_UnmapViewOfFile
ret

Function at 0x401824
Capabilities:
Set file attributes
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
cmp byte [0x4065a8], 0
je 0x401901
xor edx, edx
push ebp
push 0x4018fa
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [0x406035], 0
je 0x401856
push 0x4065b0
call sub.KERNEL32.DLL_TerminateProcess
mov byte [0x4065a8], 0
mov eax, dword [0x406608]
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
xor eax, eax
mov dword [0x406608], eax
mov ebx, dword [0x4065d0]
jmp 0x401889
push 0x8000
push 0
mov eax, dword [ebx + 8]
push eax
call sub.KERNEL32.DLL_SizeofResource
mov ebx, dword [ebx]
cmp ebx, 0x4065d0
jne 0x401877
mov eax, 0x4065d0
call fcn.00401124
mov eax, 0x4065e0
call fcn.00401124
mov eax, 0x40660c
call fcn.00401124
mov eax, dword [0x4065c8]
test eax, eax
je 0x4018cf
mov edx, dword [eax]
mov dword [0x4065c8], edx
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
mov eax, dword [0x4065c8]
test eax, eax
jne 0x4018b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x401901
cmp byte [0x406035], 0
je 0x4018ef
push 0x4065b0
call sub.KERNEL32.DLL_UnmapViewOfFile
push 0x4065b0
call sub.KERNEL32.DLL_WriteFile
ret
pop ebx
pop ebp
ret
Function at 0x401e4c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, eax
cmp byte [0x4065a8], 0
jne 0x401e69
call fcn.00401760
test al, al
je 0x401e71
cmp ebx, 0x7ffffff8
jle 0x401e7b
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x401fcf
xor ecx, ecx
push ebp
push 0x401fc8
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x406035], 0
je 0x401e9c
push 0x4065b0
call sub.KERNEL32.DLL_TerminateProcess
add ebx, 7
and ebx, 0xfffffffc
cmp ebx, 0xc
jge 0x401eac
mov ebx, 0xc
cmp ebx, 0x1000
jg 0x401f4b
mov eax, ebx
test eax, eax
jns 0x401ec1
add eax, 3
sar eax, 2
mov edx, dword [0x406608]
mov edx, dword [edx + eax*4 - 0xc]
test edx, edx
je 0x401f4b
mov esi, edx
mov eax, esi
add eax, ebx
and dword [eax], 0xfffffffe
mov eax, dword [edx + 4]
cmp edx, eax
jne 0x401efc
mov eax, ebx
test eax, eax
jns 0x401eeb
add eax, 3
sar eax, 2
mov ecx, dword [0x406608]
xor edi, edi
mov dword [ecx + eax*4 - 0xc], edi
jmp 0x401f22
mov ecx, ebx
test ecx, ecx
jns 0x401f05
add ecx, 3
sar ecx, 2
mov edi, dword [0x406608]
mov dword [edi + ecx*4 - 0xc], eax
mov ecx, dword [edx]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, esi
mov edx, dword [edx + 8]
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x40659c]
sub ebx, 4
add dword [0x4065a0], ebx
call fcn.004029bc
jmp 0x401fcf
cmp ebx, dword [0x406600]
jg 0x401f9d
sub dword [0x406600], ebx
cmp dword [0x406600], 0xc
jge 0x401f6f
add ebx, dword [0x406600]
xor eax, eax
mov dword [0x406600], eax
mov eax, dword [0x406604]
add dword [0x406604], ebx
mov edx, ebx
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x40659c]
sub ebx, 4
add dword [0x4065a0], ebx
call fcn.004029bc
jmp 0x401fcf
mov eax, ebx
call fcn.00401d58
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x401fcf
cmp byte [0x406035], 0
je 0x401fc7
push 0x4065b0
call sub.KERNEL32.DLL_UnmapViewOfFile
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret