joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4187b6
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x427014]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.0040fab1
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.0040fab1
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x41882d
cmp word [ecx], dx
je 0x41882d
mov eax, dword [0x42098c]
push edi
dec eax
push eax
push 0x420878
call fcn.00418755
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x4188a0
cmp word [eax], dx
je 0x4188a0
mov eax, dword [edi]
test eax, eax
je 0x418851
cmp word [eax], dx
je 0x418851
lea eax, [ebp - 0x10]
push eax
call fcn.00418138
jmp 0x41885a
lea eax, [ebp - 0x10]
push eax
call fcn.004181d3
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x4188ca
mov eax, dword [0x420874]
push dword [ebp - 0x14]
dec eax
push eax
push 0x420568
call fcn.00418755
add esp, 0xc
test al, al
je 0x4188ca
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x418895
cmp word [eax], di
je 0x418895
lea eax, [ebp - 0x10]
push eax
call fcn.00418138
pop ecx
jmp 0x4188cc
lea eax, [ebp - 0x10]
push eax
call fcn.004181d3
jmp 0x418892
mov eax, dword [edi]
test eax, eax
je 0x4188b7
cmp word [eax], dx
je 0x4188b7
lea eax, [ebp - 0x10]
push eax
call fcn.004180ed
pop ecx
jmp 0x4188ca
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x418995
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.004185da
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x418995
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x418995
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x418995
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x418922
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.00410430
test ebx, ebx
je 0x418990
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.00410430
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x418995
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x418995
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.0041a666
add esp, 0x10
xor eax, eax
inc eax
jmp 0x418997
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040485a
leave
ret
Function at 0x403220
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x40324c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x403274
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x40327a
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x4032e2
jg 0x403291
test esi, esi
je 0x4032e2
test ecx, ecx
jl 0x4032dd
jg 0x40329b
test eax, eax
je 0x4032dd
cmp edi, ecx
jg 0x4032af
jl 0x4032a5
cmp esi, eax
jae 0x4032af
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x4032e5
mov ecx, dword [ebp + 8]
jmp 0x4032ef
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x403309
jg 0x4032ef
test esi, esi
je 0x403309
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x403309
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x403320
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], esi
test eax, eax
jg 0x40334c
jl 0x403340
test ecx, ecx
jne 0x40334c
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x403365
push eax
push ecx
push esi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, ecx
mov eax, dword [eax]
mov dword [ebp - 8], eax
test eax, eax
je 0x4033b3
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [ebp - 0xc], edx
mov eax, dword [eax]
test eax, eax
je 0x4033b9
mov edi, dword [ebp - 4]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [ebp - 8]
push edi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [ebp - 4], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp - 4]
jmp 0x4033b9
lea eax, [ebx + 0x2c]
mov dword [ebp - 0xc], eax
cmp dword [ebx + 0x4c], 0
je 0x403426
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x4033e2
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x403414
nop
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x403426
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x4033f0
test edi, edi
je 0x403426
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4037a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x46a36c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x4037d0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00457aa1
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x40380c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x40380c
lea ecx, [edi - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00457aa1
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x4038e3
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x403834
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x403840
movsx eax, bl
jmp 0x403878
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x4038a2
sub eax, 1
je 0x4038a2
sub eax, 2
jne 0x4038e3
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmove ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00457aa1
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x4038c0
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x4038e3
lea ecx, [ebp - 0x25]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 0x30], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00457aa1
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00457aa1
mov esp, ebp
pop ebp
ret 4
Function at 0x404010
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x46a36c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x4040cc
cmp byte [esi + 0x3d], 0
je 0x4040cc
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x4040ba
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x404081
sub eax, 1
je 0x404085
sub eax, 2
jne 0x4040ba
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00457aa1
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x4040a3
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x4040ba
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00457aa1
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00457aa1
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.00457aa1
mov esp, ebp
pop ebp
ret
Function at 0x40db10
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x40db9c
push esi
call fcn.0041f7c0
add esp, 4
test al, al
jne 0x40db9c
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x40db33
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.0042aff0
add esp, 0xc
test eax, eax
je 0x40db67
sub eax, esi
push eax
push 0x2e
push esi
call fcn.0042aff0
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x40db69
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
mov ebx, 0x1505
add edi, esi
cmp esi, edi
jae 0x40db95
mov al, byte [esi]
push eax
call fcn.0041c510
movsx ecx, al
inc esi
mov eax, ebx
add esp, 4
shl eax, 5
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp esi, edi
jb 0x40db77
pop edi
movzx eax, bl
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x412830
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x18
push ebx
push ebp
mov ebp, dword [esp + 0x24]
mov eax, 0x180
mov edx, 0x140
push esi
push edi
cmp dword [ebp], 0x46a050
mov ecx, dword [ebp + 8]
cmovne eax, edx
mov dword [esp + 0x20], ecx
add eax, dword [ebp + 0xc]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x412868
mov byte [eax], 0
mov ebx, dword [esp + 0x30]
mov esi, dword [ebx + 0x8d8]
test esi, esi
je 0x412a1c
push dword [ecx + 8]
mov edi, dword [esi + 0x14]
call dword [0x46a00c]
add esp, 4
mov dword [esp + 0x30], eax
test eax, eax
je 0x4128c1
mov eax, dword [ebp + 0xc]
cmp byte [eax + 0x1c9], 0
je 0x4128ce
push dword [eax + 0x64]
call dword [0x46a00c]
mov ecx, eax
add esp, 4
mov dword [esp + 0x10], ecx
test ecx, ecx
jne 0x4128d6
mov edi, dword [esp + 0x30]
push edi
call dword [0x46a004]
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 0x1b
pop ebx
add esp, 0x18
ret
mov dword [esp + 0x10], 0
mov eax, dword [ebp + 0xc]
cmp byte [eax + 0x1ca], 0
je 0x4128ee
mov ecx, dword [eax + 0x440]
mov dword [esp + 0x14], ecx
jmp 0x4128f6
mov dword [esp + 0x14], 0xffffffff
mov eax, dword [ebx + 0x78]
test eax, eax
je 0x41290c
test byte [eax + 4], 0x10
je 0x41290c
lea edx, [eax + 0x78]
mov dword [esp + 0x2c], edx
jmp 0x412916
lea eax, [ebx + 0x8dc]
mov dword [esp + 0x2c], eax
mov eax, dword [ebx + 0x4a4]
mov ecx, 1
cmp eax, ecx
jbe 0x412963
mov eax, dword [ebx + 0x8d8]
add eax, 0x74
nop
cmp dword [eax - 8], 0
mov edx, edi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], edi
je 0x41295d
mov edi, dword [eax]
lea esi, [eax - 0x14]
cmp edi, edx
cmovge esi, dword [esp + 0x1c]
inc ecx
add eax, 0x60
cmp edi, edx
cmovge edi, edx
cmp ecx, dword [ebx + 0x4a4]
jb 0x412930
mov eax, dword [ebx + 0x4a4]
cmp ecx, eax
jne 0x412972
push esi
call fcn.004132b0
add esp, 4
jmp 0x41297e
lea esi, [ecx + ecx*2]
shl esi, 5
add esi, dword [ebx + 0x8d8]
mov eax, dword [esp + 0x34]
push dword [esi]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x3c]
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x30]
mov eax, dword [eax]
mov dword [esi + 0x14], eax
call dword [0x46a004]
push dword [esi + 4]
call dword [0x46a004]
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x38]
mov ebx, dword [esp + 0x18]
mov dword [esi + 0x1c], eax
mov eax, dword [esp + 0x28]
mov dword [esi], edi
mov dword [esi + 4], ebx
mov eax, dword [eax + 0x30]
mov dword [esi + 0x18], eax
mov eax, dword [ebp + 0xc]
lea ebp, [esi + 0x20]
push ebp
push dword [esp + 0x30]
mov eax, dword [eax + 0x1e0]
mov eax, dword [eax]
mov dword [esi + 8], eax
call fcn.00412050
add esp, 0x10
test al, al
jne 0x412a11
push ebp
call fcn.004122d0
push edi
mov dword [esi + 0xc], 0
call dword [0x46a004]
push ebx
call dword [0x46a004]
add esp, 0xc
mov eax, 0x1b
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x412a1c
mov byte [eax], 1
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
Function at 0x412ff0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
mov ecx, dword [esp + 0x14]
push ebx
push ebp
mov ebp, dword [esp + 0x20]
mov ebx, 0x180
mov eax, dword [ecx]
cmp eax, 0x46a050
mov edx, dword [ecx + 8]
push esi
mov esi, 0x140
mov dword [esp + 0x10], edx
cmovne ebx, esi
mov byte [esp + 0xf], 1
add ebx, dword [ecx + 0xc]
mov esi, 0x3cc
cmp eax, 0x46a050
mov dword [esp + 0x18], ebx
mov eax, dword [esp + 0x28]
mov ecx, 0x434
cmovne ecx, esi
mov dword [eax], 0
add ecx, ebp
je 0x41318d
cmp byte [ecx + 0x3c], 0
je 0x41318d
cmp dword [ebp + 0x8d8], 0
je 0x41318d
mov eax, dword [ebp + 0x78]
test eax, eax
je 0x413072
test byte [eax + 4], 0x10
je 0x413072
add eax, 0x78
jmp 0x413078
lea eax, [ebp + 0x8dc]
push edi
xor edi, edi
mov dword [esp + 0x18], eax
cmp dword [ebp + 0x4a4], edi
jbe 0x413156
xor ebx, ebx
nop dword [eax]
mov esi, dword [ebp + 0x8d8]
add esi, ebx
cmp dword [esi + 0xc], 0
je 0x413146
push dword [esi]
push dword [edx + 8]
call fcn.0041c650
add esp, 8
test eax, eax
je 0x413142
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 0xc]
mov eax, dword [esi + 4]
cmp byte [ecx + 0x1c9], 0
jne 0x4130d0
test eax, eax
je 0x4130e4
jmp 0x413142
test eax, eax
je 0x413142
push eax
push dword [ecx + 0x64]
call fcn.0041c650
add esp, 8
test eax, eax
je 0x413142
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 0xc]
mov eax, dword [esi + 0x1c]
cmp byte [ecx + 0x1ca], 0
jne 0x4130fe
cmp eax, 0xffffffff
je 0x41310b
jmp 0x413142
cmp eax, 0xffffffff
je 0x413142
cmp dword [ecx + 0x440], eax
jne 0x413142
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 0x30]
cmp eax, dword [esi + 0x18]
jne 0x413146
mov eax, dword [ecx + 0x1e0]
push dword [esi + 8]
push dword [eax]
call fcn.0041c650
add esp, 8
test eax, eax
je 0x413142
lea eax, [esi + 0x20]
push eax
push dword [esp + 0x20]
call fcn.00412c20
add esp, 8
test al, al
jne 0x413162
mov edx, dword [esp + 0x14]
inc edi
add ebx, 0x60
cmp edi, dword [ebp + 0x4a4]
jb 0x413090
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x2c]
inc dword [eax]
mov eax, dword [eax]
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0xc]
mov dword [ecx], eax
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x413183
mov eax, dword [esi + 0x10]
mov dword [ecx], eax
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x10
ret
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x10
ret
Function at 0x4189e0
Capabilities:
Write file on windows

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp byte [edi + 0x6cf], 0
je 0x418a7f
cmp dword [edi + 0x1a4], 0
je 0x418a37
push edi
call fcn.004089c0
push 1
push edi
mov byte [esp + 0x14], al
call fcn.00408c40
push dword [edi + 0x154]
mov eax, dword [edi + 0x1a4]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push edi
call eax
push dword [esp + 0x28]
push edi
call fcn.00408c40
add esp, 0x28
pop edi
ret
mov ecx, dword [esp + 0xc]
mov eax, ecx
sub eax, 0
je 0x418a4c
sub eax, 1
je 0x418a4c
sub eax, 1
jne 0x418a7f
push dword [edi + 0x150]
lea eax, [ecx*2 + 0x45ab5c]
push 1
add eax, ecx
push 2
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push dword [edi + 0x150]
push 1
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x20
pop edi
ret

Function at 0x41a830
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
push edi
push str.kernel32
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
jne 0x41a84a
pop edi
pop ebx
pop ecx
ret
push ebp
push esi
push str.LoadLibraryExA
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [esp + 0x18]
mov ebp, eax
push 0x45ad78
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strpbrk]
add esp, 8
test eax, eax
je 0x41a893
test ebp, ebp
je 0x41a884
push 8
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
test ebp, ebp
je 0x41a8b9
push str.AddDllDirectory
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41a8b9
push 0x800
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, eax
mov dword [esp + 0x10], edx
test edx, edx
je 0x41a96f
mov ecx, esi
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41a8d6
sub ecx, ebx
lea eax, [ecx + 1]
add eax, edx
push eax
call dword [section..data]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x41a965
push dword [esp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x41a965
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41a908
sub ecx, edx
mov eax, 0x5c
mov word [ecx + ebx], ax
mov ecx, ebx
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41a920
sub ecx, edx
sub ecx, esi
add ecx, ebx
nop dword [eax]
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x41a930
test ebp, ebp
je 0x41a95c
push 8
push 0
push ebx
call ebp
push ebx
mov edi, eax
call dword [0x46a004]
add esp, 4
mov eax, edi
pop esi
pop ebp
pop edi
pop ebx
pop ecx
ret
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push ebx
call dword [0x46a004]
add esp, 4
pop esi
pop ebp
mov eax, edi
pop edi
pop ebx
pop ecx
ret
Function at 0x41f960
Capabilities:
Create udp socket

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x41f99e
mov eax, dword [esi + 0x70]
cmp byte [eax + 0xf8], 0
jne 0x41f98f
push 0
call fcn.0041f960
add esp, 4
test al, al
mov eax, dword [esi + 0x70]
setne cl
inc cl
mov byte [eax + 0xf8], cl
mov eax, dword [esi + 0x70]
pop esi
cmp byte [eax + 0xf8], 2
sete al
ret
push 0
push 2
push 0x17
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
jne 0x41f9b3
xor al, al
pop esi
ret
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov al, 1
pop esi
ret
Function at 0x42b750
Capabilities:
Move file

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
call fcn.0040de90
push dword [esp + 0x38]
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
movups xmm0, xmmword [eax]
movups xmmword [esp + 0x18], xmm0
call esi
push dword [esp + 0x40]
mov edi, eax
call esi
mov ebp, dword [sym.imp.KERNEL32.dll_MoveFileExA]
add esp, 0xc
mov esi, eax
push 1
push esi
push edi
call ebp
test eax, eax
jne 0x42b7e5
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
nop dword [eax + eax]
lea eax, [esp + 0x20]
push eax
call fcn.0040de90
movups xmm0, xmmword [esp + 0x14]
sub esp, 0xc
mov ecx, esp
sub esp, 0x10
movups xmmword [ecx], xmm0
mov ecx, esp
movups xmm0, xmmword [eax]
movups xmmword [ecx], xmm0
call fcn.0040df40
add esp, 0x20
test edx, edx
ja 0x42b809
jb 0x42b7d7
cmp eax, 0x3e8
ja 0x42b809
push 1
call ebx
push 1
push esi
push edi
call ebp
test eax, eax
je 0x42b7a0
mov ebx, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test edi, edi
je 0x42b7f5
push edi
call ebx
add esp, 4
test esi, esi
je 0x42b7ff
push esi
call ebx
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
mov ebx, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test edi, edi
je 0x42b819
push edi
call ebx
add esp, 4
test esi, esi
je 0x42b823
push esi
call ebx
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x20
ret