joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002b2ca
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1002b367
push ebx
push esi
call fcn.1002b293
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1002a0f0
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1002b314
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1002b366
push edi
push eax
call fcn.1002245c
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1002b334
call fcn.10022422
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1002b365
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1002a0f0
add esp, 0x20
test eax, eax
jne 0x1002b353
push edi
call fcn.10022422
jmp 0x1002b35b
push ebx
call fcn.10022422
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1002effb
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.100236bf
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1002f06a
cmp esi, dword [ebp - 4]
je 0x1002f065
cmp dword [ebp + 0xc], 0
je 0x1002f065
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1002f042
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.1002eb4d
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x1002f06c
xor eax, eax
inc eax
jmp 0x1002f06c
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x1002f0d1
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1003f080]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.100236bf
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.100236bf
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x1002f148
cmp word [ecx], dx
je 0x1002f148
mov eax, dword [0x10038544]
push edi
dec eax
push eax
push 0x10038430
call fcn.1002f070
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x1002f1bb
cmp word [eax], dx
je 0x1002f1bb
mov eax, dword [edi]
test eax, eax
je 0x1002f16c
cmp word [eax], dx
je 0x1002f16c
lea eax, [ebp - 0x10]
push eax
call fcn.1002ea53
jmp 0x1002f175
lea eax, [ebp - 0x10]
push eax
call fcn.1002eaee
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x1002f1e5
mov eax, dword [0x1003842c]
push dword [ebp - 0x14]
dec eax
push eax
push 0x10038120
call fcn.1002f070
add esp, 0xc
test al, al
je 0x1002f1e5
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x1002f1b0
cmp word [eax], di
je 0x1002f1b0
lea eax, [ebp - 0x10]
push eax
call fcn.1002ea53
pop ecx
jmp 0x1002f1e7
lea eax, [ebp - 0x10]
push eax
call fcn.1002eaee
jmp 0x1002f1ad
mov eax, dword [edi]
test eax, eax
je 0x1002f1d2
cmp word [eax], dx
je 0x1002f1d2
lea eax, [ebp - 0x10]
push eax
call fcn.1002ea08
pop ecx
jmp 0x1002f1e5
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x1002f2b0
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.1002eef5
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x1002f2b0
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x1002f2b0
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x1002f2b0
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1002f23d
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.100258ea
test ebx, ebx
je 0x1002f2ab
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.100258ea
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1002f2b0
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1002f2b0
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.100312e2
add esp, 0x10
xor eax, eax
inc eax
jmp 0x1002f2b2
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10017013
leave
ret
Function at 0x100314d3
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.1003144f
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x10031642
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x10031642
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x100315f7
jg 0x1003152f
test eax, eax
je 0x100315ed
push 1
push 0x1000
call fcn.100252b3
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x10031552
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x100315e4
push 0x8000
push ebx
call fcn.10031380
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x1003157b
jg 0x10031576
cmp ecx, 0x1000
jb 0x1003157b
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.10026a10
add esp, 0x10
cmp eax, 0xffffffff
je 0x100315c0
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x10031576
jl 0x100315a7
test ecx, ecx
jne 0x10031568
push dword [ebp - 0xc]
push ebx
call fcn.10031380
push esi
call fcn.10022422
add esp, 0xc
xor ebx, ebx
jmp 0x10031650
cmp byte [edi + 0x24], 0
je 0x100315d7
cmp dword [edi + 0x20], 5
jne 0x100315d7
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x100315e2
mov ebx, dword [edi + 0x18]
jmp 0x100315e4
xor ebx, ebx
push esi
call fcn.10022422
pop ecx
jmp 0x10031650
test ecx, ecx
jg 0x100315b9
jl 0x100315f7
test eax, eax
jae 0x100315b9
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.10026e32
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x10031617
cmp byte [edi + 0x1c], 0
je 0x100315b9
jmp 0x10031648
push ebx
call fcn.1001e105
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x100315b9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x10031650
cmp byte [edi + 0x1c], 0
je 0x1003164d
mov ebx, dword [edi + 0x18]
jmp 0x10031650
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.10026e32
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10032d20
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10032d4d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10032d4d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4011ca
Capabilities:
Check if file exists
Get common file path
Get file attributes
Read .ini file

Disassembly:
enter 0x228, 0
push ebx
push esi
push edi
push 0x40a047
push 0x401464
call fcn.004081d8
mov eax, dword [0x40b54c]
push dword [eax + 0x2c]
push 0x100
lea eax, [ebp - 0x105]
push eax
push 0
mov eax, dword [0x40b54c]
push dword [eax + 0x28]
push 0x40a033
call sub.kernel32.dll_GetPrivateProfileStringA
lea eax, [ebp - 0x105]
push eax
call fcn.004071a0
test eax, eax
je 0x401231
lea eax, [ebp - 0x105]
push eax
lea eax, [ebp - 0x105]
push eax
call fcn.00401112
push eax
call fcn.004071ca
lea eax, [ebp - 0x105]
push eax
call fcn.004071a0
test eax, eax
jne 0x401423
lea eax, [ebp - 0x105]
push eax
push 0x40b9a1
call fcn.004071ca
push 0x40b9a1
call fcn.004071a0
test eax, eax
jne 0x401275
lea eax, [ebp - 0x105]
push eax
push 0x40b89f
call fcn.004071ca
lea eax, [ebp - 0x206]
push eax
push 0x40a036
call fcn.004071ca
lea eax, [ebp - 0x212]
push eax
push 0
call fcn.00407bec
call fcn.0040794c
push 2
call fcn.0040793c
mov ecx, eax
add ecx, 3
and esi, 0
jmp 0x4012eb
lea eax, [ebp - 0x212]
push eax
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 0x212]
call fcn.00407c24
lea eax, [ebp - 0x218]
push eax
push 0x14
call fcn.0040793c
add eax, 0x41
push eax
call fcn.00407b20
pop eax
push dword [eax]
call fcn.00407c88
pop eax
push dword [eax]
call fcn.00407bec
inc esi
cmp ecx, esi
jge 0x4012aa
lea eax, [ebp - 0x206]
push eax
mov eax, dword [ebp - 0x212]
push eax
call fcn.0040721d
lea eax, [ebp - 0x212]
push eax
push 0x40a042
call fcn.00407bec
mov esi, 1
lea eax, [ebp - 0x212]
push eax
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 0x212]
call fcn.00407c24
lea eax, [ebp - 0x220]
push eax
push 0x14
call fcn.0040793c
add eax, 0x41
push eax
call fcn.00407b20
pop eax
push dword [eax]
call fcn.00407c88
pop eax
push dword [eax]
call fcn.00407bec
inc esi
cmp esi, 3
jle 0x401318
lea eax, [ebp - 0x206]
push eax
mov eax, dword [ebp - 0x212]
push eax
call fcn.0040721d
lea eax, [ebp - 0x105]
push eax
lea eax, [ebp - 0x206]
push eax
call fcn.0040721d
lea eax, [ebp - 0x105]
push eax
call fcn.004010e3
test al, al
jne 0x4013e7
lea eax, [ebp - 0x105]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 0x105]
push eax
lea eax, [ebp - 0x206]
push eax
call fcn.0040721d
lea eax, [ebp - 0x105]
push eax
call fcn.004010e3
test al, al
jne 0x4013e7
lea eax, [ebp - 0x105]
push eax
lea eax, [ebp - 0x206]
push eax
call fcn.004071ca
lea eax, [ebp - 0x105]
push eax
call fcn.004010e3
lea eax, [ebp - 0x206]
push eax
lea eax, [ebp - 0x105]
push eax
call fcn.00401112
push eax
call fcn.004071ca
mov eax, dword [0x40b54c]
push dword [eax + 0x2c]
lea eax, [ebp - 0x206]
push eax
mov eax, dword [0x40b54c]
push dword [eax + 0x28]
push 0x40a044
call sub.kernel32.dll_WritePrivateProfileStringA
jmp 0x401440
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x401440
lea eax, [ebp - 0x105]
push eax
call fcn.004010e3
lea eax, [ebp - 0x105]
mov dword [ebp - 0x228], eax
xor eax, eax
pop dword fs:[eax]
add esp, 8
push 0x40146b
push 0x40a047
call fcn.0040822c
ret
Function at 0x401476
Capabilities:
Check os version

Disassembly:
enter 0x7b0, 0
push ebx
push esi
push edi
push 0x40a0b4
push 0x4016f8
call fcn.004081d8
mov eax, dword [ebp + 8]
push eax
push 0
call fcn.00407bec
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
jne 0x4014b6
jmp 0x4016e0
mov eax, dword [ebp - 0x84]
dec eax
jne 0x4015a0
cmp dword [ebp - 0x90], 4
jne 0x401512
cmp word [ebp - 0x88], 0x3b6
jne 0x401512
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x198]
push eax
lea eax, [ebp - 0x194]
push eax
mov eax, dword [0x40b54c]
push dword [eax + 0x38]
call fcn.00407286
push 0x40a075
call fcn.00407a08
call fcn.00407b38
pop eax
push dword [eax]
call fcn.00407bec
jmp 0x40159b
cmp dword [ebp - 0x90], 4
jne 0x40155c
cmp dword [ebp - 0x8c], 0xa
jne 0x40155c
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x298]
push eax
mov eax, dword [0x40b54c]
push dword [eax + 0x38]
call fcn.00407286
push 0x40a078
call fcn.00407a08
call fcn.00407b38
pop eax
push dword [eax]
call fcn.00407bec
jmp 0x40159b
cmp dword [ebp - 0x8c], 0x5a
jne 0x40159b
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x3a0]
push eax
lea eax, [ebp - 0x39c]
push eax
mov eax, dword [0x40b54c]
push dword [eax + 0x38]
call fcn.00407286
push 0x40a07b
call fcn.00407a08
call fcn.00407b38
pop eax
push dword [eax]
call fcn.00407bec
jmp 0x4016e0
dec eax
jne 0x4016be
cmp dword [ebp - 0x90], 3
jne 0x4015eb
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x4a4]
push eax
lea eax, [ebp - 0x4a0]
push eax
mov eax, dword [0x40b54c]
push dword [eax + 0x38]
call fcn.00407286
push 0x40a07e
call fcn.00407a08
call fcn.00407b38
pop eax
push dword [eax]
call fcn.00407bec
jmp 0x4016bc
cmp dword [ebp - 0x90], 4
jne 0x40162f
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x5a8]
push eax
lea eax, [ebp - 0x5a4]
push eax
mov eax, dword [0x40b54c]
push dword [eax + 0x38]
call fcn.00407286
push 0x40a086
call fcn.00407a08
call fcn.00407b38
pop eax
push dword [eax]
call fcn.00407bec
jmp 0x4016bc
cmp dword [ebp - 0x90], 5
jne 0x4016bc
cmp dword [ebp - 0x8c], 0
jne 0x40167d
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x6ac]
push eax
lea eax, [ebp - 0x6a8]
push eax
mov eax, dword [0x40b54c]
push dword [eax + 0x38]
call fcn.00407286
push 0x40a08d
call fcn.00407a08
call fcn.00407b38
pop eax
push dword [eax]
call fcn.00407bec
jmp 0x4016bc
cmp dword [ebp - 0x8c], 1
jne 0x4016bc
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x7b0]
push eax
lea eax, [ebp - 0x7ac]
push eax
mov eax, dword [0x40b54c]
push dword [eax + 0x38]
call fcn.00407286
push 0x40a092
call fcn.00407a08
call fcn.00407b38
pop eax
push dword [eax]
call fcn.00407bec
jmp 0x4016e0
inc eax
inc eax
jne 0x4016d2
mov eax, dword [ebp + 8]
push eax
push 0x40a09d
call fcn.00407bec
jmp 0x4016e0
mov eax, dword [ebp + 8]
push eax
push 0x40a0ac
call fcn.00407bec
xor eax, eax
pop dword fs:[eax]
add esp, 8
push 0x4016ff
push 0x40a0b4
call fcn.0040822c
ret
Function at 0x401bf2
Capabilities:
Get disk information

Disassembly:
enter 0x528, 0
push ebx
push esi
push edi
push 0x40a23c
push 0x401db6
call fcn.004081d8
mov eax, dword [ebp + 0xc]
push eax
push 0
call fcn.00407bec
push 0x100
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x210]
push eax
push 0x100
lea eax, [ebp - 0x102]
push eax
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x401d9e
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x414]
push eax
push 0x40a220
call fcn.00407960
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x102]
push eax
call fcn.00407286
call fcn.00407a08
push 0x40a222
call fcn.00407a08
call fcn.00407b38
pop eax
push dword [eax]
call fcn.00407bec
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x401cac
mov eax, dword [eax - 4]
cmp eax, 0xe
jge 0x401cf0
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x401cbe
mov eax, dword [eax - 4]
cmp eax, 0xe
jge 0x401cf0
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x41c]
push eax
push dword [ebp - 0x214]
call fcn.00407c24
push 0x40a22c
call fcn.00407c88
pop eax
push dword [eax]
call fcn.00407bec
jmp 0x401cb1
lea eax, [ebp - 0x204]
push eax
call fcn.004071a0
cmp eax, 0xb
jge 0x401d25
lea eax, [ebp - 0x204]
push eax
call fcn.004071a0
cmp eax, 0xb
jge 0x401d25
lea eax, [ebp - 0x204]
push eax
push 0x40a22e
call fcn.0040721d
jmp 0x401d01
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x524]
push eax
push dword [ebp - 0x214]
call fcn.00407c24
lea eax, [ebp - 0x520]
push eax
lea eax, [ebp - 0x51c]
push eax
lea eax, [ebp - 0x204]
push eax
call fcn.00407286
call fcn.00407b38
pop eax
push dword [eax]
call fcn.00407c88
push 0x40a238
call fcn.00407c88
lea eax, [ebp - 0x528]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.00401ad2
pop eax
push dword [eax]
call fcn.00407c88
pop eax
push dword [eax]
call fcn.00407bec
mov eax, dword [ebp + 0xc]
push eax
push dword [ebp - 0x214]
call fcn.00407bec
xor eax, eax
pop dword fs:[eax]
add esp, 8
push 0x401dbd
push 0x40a23c
call fcn.0040822c
ret

Function at 0x401dc4
Capabilities:
Receive data
Receive data on socket

Disassembly:
enter 0x110, 0
push ebx
push esi
push edi
push 0x40a285
push 0x401e6d
call fcn.004081d8
mov al, 0
mov dword [ebp - 0x110], eax
push 0x40cba7
push 0x1002
push 0
call fcn.00407fd8
push 0
push 0x100
push 0x40cba7
push dword [0x40b799]
call sub.wsock32.dll_recv
cmp eax, 0xffffffff
je 0x401e55
cmp dword [ebp + 8], 0
je 0x401e55
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call fcn.00401000
pop eax
push dword [eax]
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x108]
push eax
push 0x40cba7
call fcn.00407286
call fcn.00407b38
pop eax
push dword [eax]
call fcn.00407e20
test eax, eax
je 0x401e55
mov al, 1
mov dword [ebp - 0x110], eax
xor eax, eax
pop dword fs:[eax]
add esp, 8
push 0x401e74
push 0x40a285
call fcn.0040822c
ret
Function at 0x402205
Capabilities:
Get file size

Disassembly:
push esi
push edi
push 1
call fcn.004011ca
push eax
call sub.kernel32.dll__lopen
mov esi, eax
push 0
push esi
call sub.kernel32.dll_GetFileSize
cmp eax, 0x1312d00
jle 0x40222d
push esi
push 0
call fcn.00406a00
push 2
push 0
push esi
call sub.kernel32.dll__llseek
mov eax, dword [0x40b779]
test eax, eax
je 0x402243
mov eax, dword [eax - 4]
test eax, eax
jle 0x402293
mov edi, dword [0x40b779]
test edi, edi
je 0x402254
mov edi, dword [edi - 4]
mov edx, 1
jmp 0x402276
mov eax, dword [0x40b779]
mov cl, byte [edx + eax - 1]
xor cl, 0x66
push 0x40b779
call fcn.00407ce8
mov byte [edx + eax - 1], cl
inc edx
cmp edi, edx
jge 0x40225b
mov eax, dword [0x40b779]
test eax, eax
je 0x402286
mov eax, dword [eax - 4]
push eax
mov eax, dword [0x40b779]
push eax
push esi
call sub.kernel32.dll__lwrite
push esi
call sub.kernel32.dll__lclose
push 0x40b779
push 0
call fcn.00407bec
and dword [0x40b56c], 0
pop edi
pop esi
ret

Function at 0x4022af
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns

Disassembly:
enter 0x11c, 0
push ebx
mov bl, 0
mov byte [ebp - 0x1a], 0
lea eax, [ebp - 0x11c]
push eax
push 0x40a327
call fcn.004071ca
cmp byte [ebp - 0x1a], 0
je 0x4022e0
lea eax, [ebp - 0x11c]
push eax
push dword [ebp + 0xc]
call fcn.004071ca
lea eax, [ebp - 0x11c]
push eax
push dword [ebp + 8]
call fcn.0040721d
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov dword [0x40b799], eax
cmp dword [0x40b799], 0xffffffff
jne 0x40230d
jmp 0x4023eb
lea eax, [ebp - 0x11c]
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 5], eax
cmp dword [ebp - 5], 0xffffffff
jne 0x402389
lea eax, [ebp - 0x11c]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
jne 0x40235c
cmp byte [ebp - 0x1a], 0
je 0x40233f
jmp 0x4023eb
cmp dword [0x40b799], 0
je 0x402353
push dword [0x40b799]
call sub.wsock32.dll_closesocket
mov byte [ebp - 0x1a], 1
jmp 0x4022ba
mov ecx, dword [eax + 0xc]
mov ecx, dword [ecx]
mov cl, byte [ecx]
mov byte [ebp - 0x15], cl
mov ecx, dword [eax + 0xc]
mov ecx, dword [ecx]
mov cl, byte [ecx + 1]
mov byte [ebp - 0x14], cl
mov ecx, dword [eax + 0xc]
mov ecx, dword [ecx]
mov cl, byte [ecx + 2]
mov byte [ebp - 0x13], cl
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov al, byte [eax + 3]
mov byte [ebp - 0x12], al
jmp 0x402398
lea eax, [ebp - 5]
push eax
lea eax, [ebp - 0x15]
push eax
push 4
call fcn.00407f7c
mov word [ebp - 0x19], 2
movzx eax, word [ebp + 0x10]
push eax
call sub.wsock32.dll_htons
mov word [ebp - 0x17], ax
push 0x10
lea eax, [ebp - 0x19]
push eax
push dword [0x40b799]
call sub.wsock32.dll_connect
cmp eax, 0xffffffff
jne 0x4023e9
cmp byte [ebp - 0x1a], 0
je 0x4023cc
jmp 0x4023eb
cmp dword [0x40b799], 0
je 0x4023e0
push dword [0x40b799]
call sub.wsock32.dll_closesocket
mov byte [ebp - 0x1a], 1
jmp 0x4022ba
mov bl, 1
mov al, bl
pop ebx
leave
ret 0xc
Function at 0x403289
Capabilities:
Delete file
Set file attributes

Disassembly:
push 0x20
call fcn.004011ca
push eax
call sub.kernel32.dll_SetFileAttributesA
call fcn.004011ca
push eax
call sub.kernel32.dll_DeleteFileA
push 1
call fcn.004018ea
ret
Function at 0x403794
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
push esi
mov eax, dword [ebp - 4]
mov cl, byte [eax - 0x5ef]
inc cl
mov eax, dword [ebp - 4]
mov byte [eax - 0x5ef], cl
mov eax, dword [ebp - 4]
cmp byte [eax - 0x5ef], 0x39
jbe 0x4037d3
mov eax, dword [ebp - 4]
mov cl, byte [eax - 0x5ee]
inc cl
mov eax, dword [ebp - 4]
mov byte [eax - 0x5ee], cl
mov eax, dword [ebp - 4]
mov byte [eax - 0x5ef], 0x30
mov eax, dword [ebp - 4]
mov dl, byte [eax - 0x5ef]
mov eax, dword [ebp - 4]
add eax, 0xfffffa13
push eax
call fcn.00407ce8
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx - 0x5ed]
test ecx, ecx
je 0x4037fa
mov ecx, dword [ecx - 4]
mov byte [ecx + eax - 1], dl
mov eax, dword [ebp - 4]
mov dl, byte [eax - 0x5ee]
mov eax, dword [ebp - 4]
add eax, 0xfffffa13
push eax
call fcn.00407ce8
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx - 0x5ed]
test ecx, ecx
je 0x403825
mov ecx, dword [ecx - 4]
dec ecx
mov byte [ecx + eax - 1], dl
mov eax, dword [ebp - 4]
add eax, 0xfffffa13
push eax
call fcn.00407ce8
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx - 0x5ed]
test ecx, ecx
je 0x403848
mov ecx, dword [ecx - 4]
dec ecx
dec ecx
mov byte [ecx + eax - 1], 0x7e
mov eax, dword [ebp - 4]
mov eax, dword [eax - 0x5ed]
push eax
call sub.kernel32.dll_GetFileAttributesA
mov esi, eax
push 0x20
mov eax, dword [ebp - 4]
mov eax, dword [eax - 0x5ed]
push eax
call sub.kernel32.dll_SetFileAttributesA
mov eax, dword [ebp - 4]
mov eax, dword [eax - 0x5ed]
push eax
call sub.kernel32.dll_DeleteFileA
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax - 0x5ed]
push eax
call sub.kernel32.dll_SetFileAttributesA
pop esi
ret