joyce8/EMBER2024-capa huggingface dataset:
Function at 0x681a25d
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.0681a1d9
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x681a3cc
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x681a3cc
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x681a381
jg 0x681a2b9
test eax, eax
je 0x681a377
push 1
push 0x1000
call fcn.0680c492
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x681a2dc
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x681a36e
push 0x8000
push ebx
call fcn.0681a10a
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x681a305
jg 0x681a300
cmp ecx, 0x1000
jb 0x681a305
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.0680c276
add esp, 0x10
cmp eax, 0xffffffff
je 0x681a34a
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x681a300
jl 0x681a331
test ecx, ecx
jne 0x681a2f2
push dword [ebp - 0xc]
push ebx
call fcn.0681a10a
push esi
call fcn.068091e2
add esp, 0xc
xor ebx, ebx
jmp 0x681a3da
cmp byte [edi + 0x24], 0
je 0x681a361
cmp dword [edi + 0x20], 5
jne 0x681a361
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x681a36c
mov ebx, dword [edi + 0x18]
jmp 0x681a36e
xor ebx, ebx
push esi
call fcn.068091e2
pop ecx
jmp 0x681a3da
test ecx, ecx
jg 0x681a343
jl 0x681a381
test eax, eax
jae 0x681a343
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0680c735
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x681a3a1
cmp byte [edi + 0x1c], 0
je 0x681a343
jmp 0x681a3d2
push ebx
call fcn.06815e14
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x681a343
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x681a3da
cmp byte [edi + 0x1c], 0
je 0x681a3d7
mov ebx, dword [edi + 0x18]
jmp 0x681a3da
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.0680c735
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x681b990
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x681b9bd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x681b9bd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x402530
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
test edi, edi
je 0x4026cd
mov esi, dword [ebp + 8]
test esi, esi
je 0x4026cd
mov dword [esi + 0xf0], 0xa
mov ecx, dword [edi]
mov eax, ecx
rol ecx, 8
and ecx, 0xff00ff
ror eax, 8
and eax, 0xff00ff00
or eax, ecx
mov dword [esi], eax
lea eax, [esi + 4]
mov edx, dword [edi + 4]
mov ecx, edx
ror ecx, 8
and ecx, 0xff00ff00
rol edx, 8
and edx, 0xff00ff
or ecx, edx
mov dword [eax], ecx
mov edx, dword [edi + 8]
mov ecx, edx
ror ecx, 8
and ecx, 0xff00ff00
rol edx, 8
and edx, 0xff00ff
or ecx, edx
mov dword [esi + 8], ecx
mov ecx, dword [edi + 0xc]
mov edi, 0x602814
push ebx
mov ebx, ecx
rol ecx, 8
and ecx, 0xff00ff
ror ebx, 8
and ebx, 0xff00ff00
or ebx, ecx
mov ecx, ebx
mov dword [esi + 0xc], ebx
shr ecx, 0x10
and ecx, 0xff
mov edx, dword [ecx*4 + 0x603d40]
mov ecx, ebx
shr ecx, 8
xor edx, 0x1000000
and ecx, 0xff
and edx, 0xff000000
mov ecx, dword [ecx*4 + 0x603940]
and ecx, 0xff0000
xor edx, ecx
mov ecx, ebx
shr ecx, 0x18
movzx ecx, byte [ecx*4 + 0x604140]
xor edx, ecx
movzx ecx, bl
mov ecx, dword [ecx*4 + 0x604540]
and ecx, 0xff00
xor edx, ecx
mov ecx, dword [eax]
xor edx, dword [esi]
xor ecx, edx
mov dword [esi + 0x10], edx
mov edx, dword [esi + 8]
xor edx, ecx
mov dword [esi + 0x14], ecx
mov ecx, ebx
mov dword [esi + 0x18], edx
xor ecx, edx
mov dword [esi + 0x1c], ecx
pop ebx
mov edi, edi
mov edx, dword [eax + 0x18]
lea eax, [eax + 0x10]
mov ecx, edx
shr ecx, 8
and ecx, 0xff
mov esi, dword [ecx*4 + 0x603940]
mov ecx, edx
shr ecx, 0x10
and esi, 0xff0000
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x603d40]
and ecx, 0xff000000
xor esi, ecx
mov ecx, edx
shr ecx, 0x18
movzx ecx, byte [ecx*4 + 0x604140]
xor esi, ecx
movzx ecx, dl
mov ecx, dword [ecx*4 + 0x604540]
and ecx, 0xff00
xor esi, ecx
xor esi, dword [eax - 4]
xor esi, dword [edi]
add edi, 4
mov dword [eax + 0xc], esi
mov ecx, dword [eax]
xor ecx, esi
mov dword [eax + 0x10], ecx
mov edx, dword [eax + 4]
xor edx, ecx
mov dword [eax + 0x14], edx
mov ecx, dword [eax + 8]
xor ecx, edx
mov dword [eax + 0x18], ecx
cmp edi, 0x602838
jne 0x402640
pop edi
xor eax, eax
pop esi
pop ebp
ret
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret
Function at 0x4026e0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call fcn.00402530
add esp, 4
test eax, eax
js 0x4028cc
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [eax + 0xf0]
xor ebx, ebx
shl edi, 2
test edi, edi
jle 0x402754
lea esi, [eax + 8]
add eax, 8
lea esi, [esi + edi*4]
mov edx, dword [eax - 8]
lea eax, [eax + 0x10]
mov ecx, dword [esi - 8]
lea esi, [esi - 0x10]
mov dword [eax - 0x18], ecx
add ebx, 4
mov ecx, dword [esi + 0xc]
sub edi, 4
mov dword [esi + 8], edx
mov edx, dword [eax - 0x14]
mov dword [eax - 0x14], ecx
mov ecx, dword [esi + 0x10]
mov dword [esi + 0xc], edx
mov edx, dword [eax - 0x10]
mov dword [eax - 0x10], ecx
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x10], edx
mov edx, dword [eax - 0xc]
mov dword [eax - 0xc], ecx
mov dword [esi + 0x14], edx
cmp ebx, edi
jl 0x402714
mov ebx, dword [ebp + 8]
mov edi, 1
cmp dword [ebx + 0xf0], edi
jle 0x4028c7
lea esi, [ebx + 2]
jmp 0x402770
mov edx, dword [esi + 0xe]
lea esi, [esi + 0x10]
mov eax, edx
inc edi
shr eax, 0x18
movzx ecx, byte [eax*4 + 0x604140]
movzx eax, byte [esi - 1]
mov ecx, dword [ecx*4 + 0x603540]
movzx eax, byte [eax*4 + 0x604140]
xor ecx, dword [eax*4 + 0x602d40]
movzx eax, dl
mov edx, dword [esi + 2]
movzx eax, byte [eax*4 + 0x604140]
xor ecx, dword [eax*4 + 0x602940]
movzx eax, byte [esi]
movzx eax, byte [eax*4 + 0x604140]
xor ecx, dword [eax*4 + 0x603140]
mov eax, edx
shr eax, 0x18
mov dword [esi - 2], ecx
movzx ecx, byte [eax*4 + 0x604140]
movzx eax, byte [esi + 3]
mov ecx, dword [ecx*4 + 0x603540]
movzx eax, byte [eax*4 + 0x604140]
xor ecx, dword [eax*4 + 0x602d40]
movzx eax, byte [esi + 4]
movzx eax, byte [eax*4 + 0x604140]
xor ecx, dword [eax*4 + 0x603140]
movzx eax, dl
mov edx, dword [esi + 6]
movzx eax, byte [eax*4 + 0x604140]
xor ecx, dword [eax*4 + 0x602940]
mov eax, edx
shr eax, 0x18
mov dword [esi + 2], ecx
movzx ecx, byte [eax*4 + 0x604140]
movzx eax, byte [esi + 7]
mov ecx, dword [ecx*4 + 0x603540]
movzx eax, byte [eax*4 + 0x604140]
xor ecx, dword [eax*4 + 0x602d40]
movzx eax, byte [esi + 8]
movzx eax, byte [eax*4 + 0x604140]
xor ecx, dword [eax*4 + 0x603140]
movzx eax, dl
mov edx, dword [esi + 0xa]
movzx eax, byte [eax*4 + 0x604140]
xor ecx, dword [eax*4 + 0x602940]
mov eax, edx
shr eax, 0x18
mov dword [esi + 6], ecx
movzx ecx, byte [eax*4 + 0x604140]
movzx eax, byte [esi + 0xb]
mov ecx, dword [ecx*4 + 0x603540]
movzx eax, byte [eax*4 + 0x604140]
xor ecx, dword [eax*4 + 0x602d40]
movzx eax, byte [esi + 0xc]
movzx eax, byte [eax*4 + 0x604140]
xor ecx, dword [eax*4 + 0x603140]
movzx eax, dl
movzx eax, byte [eax*4 + 0x604140]
xor ecx, dword [eax*4 + 0x602940]
mov dword [esi + 0xa], ecx
cmp edi, dword [ebx + 0xf0]
jl 0x402770
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x403990
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b425a
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x631490]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x18], esi
call fcn.00599cf6
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x403a36
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], str.bad_locale_name
push eax
lea ecx, [ebp - 0x24]
call fcn.00578316
push 0x62beec
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], vtable.std::runtime_error.0
push eax
call fcn.0057d705
push edi
push esi
call fcn.00599f8c
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00578263
mov esp, ebp
pop ebp
ret 4

Function at 0x403fd0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5b42e8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x631490]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
sub esp, 0x18
mov ecx, esp
push 0xffffffffffffffff
push 0
push dword [ebp + 0x10]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
call fcn.004047d0
push dword [ebp + 0xc]
lea eax, [esp + 0x28]
push dword [ebp + 8]
push eax
call fcn.00403f00
add esp, 0x24
mov dword [esp + 0x30], 0
cmp dword [eax + 0x14], 0x10
jb 0x404041
mov eax, dword [eax]
mov dword [esp + 8], eax
mov ecx, esi
lea eax, [esp + 8]
push eax
call fcn.00578316
cmp dword [esp + 0x20], 0x10
mov dword [esi], vtable.std::runtime_error.0
jb 0x40406a
push dword [esp + 0xc]
call fcn.00450388
add esp, 4
mov eax, dword [ebp + 8]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x10], eax
mov eax, esi
mov dword [esi], vtable.std::_System_error.0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x406020
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5b44c8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x631490]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov eax, dword [0x631490]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
lea edx, [edi + 0x10]
lea ecx, [esp + 0x18]
call fcn.004256b0
mov dword [esp + 0x40], 0
mov eax, dword [esp + 0x28]
add eax, 0xa
mov dword [edi], eax
add eax, 4
push eax
call fcn.0045038d
mov esi, eax
mov dword [esp + 0x14], 0xe
mov eax, dword [edi]
sub esp, 0x14
mov ecx, esp
mov dword [esi], eax
movzx eax, byte [edi + 4]
mov byte [esi + 4], al
movzx eax, byte [edi + 5]
mov byte [esi + 5], al
mov eax, dword [edi + 8]
mov dword [esi + 6], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xa], eax
lea eax, [esp + 0x30]
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.004047d0
lea eax, [esp + 0x28]
mov ecx, esi
push eax
call fcn.00405f80
mov ecx, dword [edi]
add esp, 0x1c
add ecx, 4
mov dword [ebx], esi
cmp dword [esp + 0x2c], 0x10
mov dword [ebx + 4], ecx
jb 0x4060fa
push dword [esp + 0x18]
call fcn.00450388
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00578263
mov esp, ebp
pop ebp
ret 4

Function at 0x4071d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b4698
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x631490]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
call fcn.0059a6a0
mov esi, dword [ebp + 8]
lea ecx, [edi + 0x28]
mov dword [ebp - 4], 0
mov dword [edi], vtable.std::_LaunchPad_class_std::_Bind_1__void__void____cdecl__const__struct_AgentPack::CreateAgentAppLinkPack___struct_AgentPack::CreateAgentAppLinkPack__.0
push 0xffffffffffffffff
mov eax, dword [esi]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 4]
mov dword [edi + 0x14], eax
movzx eax, byte [esi + 8]
mov byte [edi + 0x18], al
movzx eax, byte [esi + 9]
mov byte [edi + 0x19], al
mov eax, dword [esi + 0xc]
mov dword [edi + 0x1c], eax
movzx eax, byte [esi + 0x10]
mov byte [edi + 0x20], al
mov eax, dword [esi + 0x14]
mov dword [edi + 0x24], eax
lea eax, [esi + 0x18]
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.004047d0
mov ax, word [esi + 0x30]
mov word [edi + 0x40], ax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x40bc00
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5b4e4b
mov eax, dword fs:[0]
push eax
sub esp, 0x1a8
mov eax, dword [0x631490]
xor eax, esp
mov dword [esp + 0x1a0], eax
push ebx
push esi
push edi
mov eax, dword [0x631490]
xor eax, esp
push eax
lea eax, [esp + 0x1b8]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.00466227
push 0
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_GetSystemMenu]
push eax
call fcn.0046ab8b
mov edi, eax
mov dword [esp + 0x14], edi
test edi, edi
je 0x40bd03
call fcn.004671b0
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x40bc82
push 0x80004005
call fcn.0040cf50
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [esp + 0x18], esi
push 0x65
mov dword [esp + 0x1c4], 0
call fcn.0046a4a6
test eax, eax
je 0x40bcb6
push 0x65
push eax
lea ecx, [esp + 0x20]
call fcn.0040c8e0
mov esi, dword [esp + 0x18]
cmp dword [esi - 0xc], 0
je 0x40bcde
push 0
push 0
push 0x800
push dword [edi + 4]
mov edi, dword [sym.imp.USER32.dll_AppendMenuW]
call edi
mov eax, dword [esp + 0x14]
push esi
push 0x10
push 0
push dword [eax + 4]
call edi
add esi, 0xfffffff0
mov dword [esp + 0x1c0], 0xffffffff
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40bd03
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx + 0xbc]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 1
push 0x80
push dword [ebx + 0x20]
call esi
push dword [ebx + 0xbc]
push 0
push 0x80
push dword [ebx + 0x20]
call esi
lea eax, [esp + 0x1c]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ecx, ebx
call fcn.0040bac0
mov eax, 1
mov ecx, dword [esp + 0x1b8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1a0]
xor ecx, esp
call fcn.00578263
mov esp, ebp
pop ebp
ret

Function at 0x40c570
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
movzx eax, ax
mov dword [ebp + 8], eax
pop ebp
jmp fcn.00465aae

Function at 0x40c7b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40c7c5
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40c804
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x40c800
lea ebx, [ebx]
cmp esi, edx
jae 0x40c804
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x40c7f0
cmp esi, edx
jb 0x40c809
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret
Function at 0x40f660
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b530b
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x631490]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea edx, [edi + 0x30]
mov byte [edi + 0x1c], 0
mov dword [edx + 0x14], 0xf
mov dword [edx + 0x10], 0
mov byte [edx], 0
mov dword [ebp - 4], 0
mov esi, dword [ebp + 8]
mov ecx, esi
mov dword [ebp + 8], 0x2c
mov eax, dword [esi]
mov dword [edi], eax
movzx eax, byte [esi + 4]
mov byte [edi + 4], al
movzx eax, byte [esi + 5]
mov byte [edi + 5], al
movzx eax, word [esi + 6]
mov word [edi + 6], ax
movzx eax, word [esi + 8]
mov word [edi + 8], ax
movzx eax, word [esi + 0xa]
mov word [edi + 0xa], ax
movzx eax, word [esi + 0xc]
mov word [edi + 0xc], ax
movzx eax, word [esi + 0xe]
mov word [edi + 0xe], ax
movzx eax, word [esi + 0x10]
mov word [edi + 0x10], ax
movzx eax, word [esi + 0x12]
mov word [edi + 0x12], ax
movzx eax, word [esi + 0x14]
mov word [edi + 0x14], ax
movzx eax, word [esi + 0x16]
mov word [edi + 0x16], ax
movzx eax, word [esi + 0x18]
mov word [edi + 0x18], ax
movzx eax, word [esi + 0x1a]
mov word [edi + 0x1a], ax
movzx eax, byte [esi + 0x1c]
mov byte [edi + 0x1c], al
mov eax, dword [esi + 0x1d]
mov dword [edi + 0x20], eax
mov eax, dword [esi + 0x21]
mov dword [edi + 0x24], eax
movzx eax, byte [esi + 0x25]
mov byte [edi + 0x28], al
movzx eax, byte [esi + 0x26]
mov byte [edi + 0x29], al
movzx eax, byte [esi + 0x27]
mov byte [edi + 0x2a], al
mov eax, dword [esi + 0x28]
push eax
mov dword [edi + 0x2c], eax
lea eax, [ebp + 8]
push edx
push eax
call fcn.004082d0
mov ecx, dword [ebp + 8]
add esp, 0xc
mov eax, dword [ecx + esi]
mov dword [edi + 0x48], eax
movzx eax, word [ecx + esi + 4]
mov word [edi + 0x4c], ax
movzx eax, byte [ecx + esi + 6]
mov byte [edi + 0x4e], al
mov eax, dword [ecx + esi + 7]
mov dword [edi + 0x50], eax
mov eax, dword [ecx + esi + 0xb]
mov dword [edi + 0x54], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4189f0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3ec
mov eax, dword [0x631490]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x1c], 0x10
push ebx
push esi
lea esi, [ebp + 8]
cmovae esi, dword [ebp + 8]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x418a15
push 0
push 0
sub eax, edx
inc eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edx, eax
mov eax, esi
lea ebx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x418a36
push edx
sub eax, ebx
lea ecx, [ebp - 0x3ec]
push ecx
inc eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x3ec]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp + 0x1c], 0x10
pop esi
pop ebx
jb 0x418a74
push dword [ebp + 8]
call fcn.00450388
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00578263
mov esp, ebp
pop ebp
ret
Function at 0x418f70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5b6048
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x631490]
xor eax, esp
mov dword [esp + 0x50], eax
push esi
mov eax, dword [0x631490]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x40]
mov dword [esp + 0xc], 0
call fcn.00444ea0
push 0x605154
lea edx, [esp + 0x44]
mov dword [esp + 0x6c], 0
lea ecx, [esp + 0x2c]
call fcn.004099d0
add esp, 4
mov byte [esp + 0x68], 1
lea edx, [esp + 0x28]
cmp dword [esp + 0x3c], 0x10
lea ecx, [esp + 0x10]
cmovae edx, dword [esp + 0x28]
call fcn.00430d80
mov byte [esp + 0x68], 2
lea ecx, [esp + 0x10]
cmp dword [esp + 0x24], 0x10
mov edx, 0x604977
push 0
cmovae ecx, dword [esp + 0x14]
call fcn.00405ee0
add esp, 4
test eax, eax
jne 0x41903d
cmp dword [esp + 0x20], eax
setne al
test eax, eax
jne 0x41903d
push eax
mov dword [esi + 0x14], 0xf
mov ecx, esi
mov dword [esi + 0x10], eax
push 0x604985
mov byte [esi], al
call fcn.00404c00
jmp 0x419075
cmp dword [esp + 0x24], 0x10
lea eax, [esp + 0x10]
cmovae eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x419069
test al, 0x10
je 0x419069
lea eax, [esp + 0x10]
mov ecx, esi
push eax
call fcn.004044f0
jmp 0x419075
push 0x604986
mov ecx, esi
call fcn.00404490
cmp dword [esp + 0x24], 0x10
jb 0x419088
push dword [esp + 0x10]
call fcn.00450388
add esp, 4
cmp dword [esp + 0x3c], 0x10
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
jb 0x4190b0
push dword [esp + 0x28]
call fcn.00450388
add esp, 4
cmp dword [esp + 0x54], 0x10
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], 0
mov byte [esp + 0x28], 0
jb 0x4190d8
push dword [esp + 0x40]
call fcn.00450388
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.00578263
mov esp, ebp
pop ebp
ret
Function at 0x41aa10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b6388
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x631490]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0
call fcn.00445a10
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
test eax, 0xfffffffc
jne 0x41aaa0
test ecx, ecx
je 0x41aa87
push ecx
call fcn.00450388
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00578263
mov esp, ebp
pop ebp
ret
cmp dword [0x6326dc], 1
jne 0x41aaae
call fcn.0041a170
cmp dword [0x641360], 0
je 0x41aabc
call fcn.00418a90
push 0
call fcn.005798a0
int3
Function at 0x420560
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [ecx + 0x130]
sub eax, dword [ecx + 0x134]
cmp eax, 0x28
jge 0x420586
cmp byte [ecx + 0x61], 0
jne 0x420586
cmp byte [ecx + 0x60], 0
je 0x420586
mov byte [ecx + 0x60], 0
jmp fcn.0044ac60
ret