joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001de00
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10026ae3
mov eax, dword fs:[0]
push eax
sub esp, 0x53c
push ebx
push esi
push edi
lea edi, [ebp - 0x548]
mov ecx, 0x14f
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x10032420]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x40], 0x20
mov esi, esp
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
cmp esi, esp
call fcn.100226a0
lea ecx, [ebp + 8]
call fcn.10002410
mov esi, esp
push eax
lea eax, [ebp - 0x530]
push eax
call fcn.1001d1b0
add esp, 4
mov dword [ebp - 0x544], eax
mov ecx, dword [ebp - 0x544]
mov dword [ebp - 0x548], ecx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x548]
call fcn.10002410
push eax
push str.Hacking_PC_Name_:__s_Msg_:__s_n
lea edx, [ebp - 0x448]
push edx
call dword [sym.imp.MSVCR100D.dll_sprintf]
add esp, 0x10
cmp esi, esp
call fcn.100226a0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x530]
call fcn.10002320
sub esp, 0x20
mov ecx, esp
mov dword [ebp - 0x53c], esp
lea eax, [ebp - 0x448]
push eax
call fcn.10002270
mov dword [ebp - 0x544], eax
mov ecx, 0x10034ea8
call fcn.1001bbe0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.10002320
push edx
mov ecx, ebp
push eax
lea edx, [0x1001df3c]
call fcn.100226d0
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100228c0
add esp, 0x548
cmp ebp, esp
call fcn.100226a0
mov esp, ebp
pop ebp
ret
Function at 0x1001ed30
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10026d57
mov eax, dword fs:[0]
push eax
sub esp, 0x294
push ebx
push esi
push edi
lea edi, [ebp - 0x2a0]
mov ecx, 0xa5
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x10032420]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x29c], 0
push 0x10028b8b
lea ecx, [ebp - 0x34]
call fcn.10002270
mov dword [ebp - 4], 1
mov dword [ebp - 0xd4], 0x20
mov esi, esp
lea eax, [ebp - 0xd4]
push eax
lea ecx, [ebp - 0xc8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
cmp esi, esp
call fcn.100226a0
mov esi, esp
lea eax, [ebp - 0x1d0]
push eax
call dword [sym.imp.ADVAPI32.dll_GetCurrentHwProfileW]
cmp esi, esp
call fcn.100226a0
mov esi, esp
lea eax, [ebp - 0x1cc]
push eax
lea ecx, [ebp - 0xc8]
push ecx
push str._ls____ls
lea edx, [ebp - 0xa0]
push edx
call dword [sym.imp.MSVCR100D.dll_sprintf]
add esp, 0x10
cmp esi, esp
call fcn.100226a0
lea eax, [ebp - 0xa0]
push eax
mov ecx, dword [ebp + 8]
call fcn.10002270
mov ecx, dword [ebp - 0x29c]
or ecx, 1
mov dword [ebp - 0x29c], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
call fcn.10002320
mov eax, dword [ebp + 8]
push edx
mov ecx, ebp
push eax
lea edx, [0x1001ee60]
call fcn.100226d0
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100228c0
add esp, 0x2a0
cmp ebp, esp
call fcn.100226a0
mov esp, ebp
pop ebp
ret
Function at 0x1001eee0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10026d93
mov eax, dword fs:[0]
push eax
sub esp, 0x2b0
push ebx
push esi
push edi
lea edi, [ebp - 0x2bc]
mov ecx, 0xac
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x10032420]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov byte [0x1003241d], 0
mov ecx, 0x10034ea8
call fcn.1001cb30
movzx eax, al
test eax, eax
jne 0x1001ef45
mov eax, 1
test eax, eax
je 0x1001f113
sub esp, 0x20
mov ecx, esp
mov dword [ebp - 0x2b4], esp
push str._HardWarIDLogger
call fcn.10002270
mov dword [ebp - 0x2bc], eax
call fcn.1001d360
add esp, 0x20
mov esi, esp
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.100226a0
lea eax, [ebp - 0x34]
push eax
mov ecx, 0x10034ea8
call fcn.1001c250
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x34]
call fcn.10002450
add eax, 1
push eax
call fcn.10020190
add esp, 4
mov dword [ebp - 0x2a8], eax
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x34]
call fcn.10002410
push eax
mov eax, dword [ebp - 0x40]
push eax
call sub.MSVCR100D.dll_strcpy
add esp, 8
mov esi, esp
lea eax, [ebp - 0x1a8]
push eax
call dword [sym.imp.ADVAPI32.dll_GetCurrentHwProfileW]
cmp esi, esp
call fcn.100226a0
mov esi, esp
lea eax, [ebp - 0x1a4]
push eax
push 0x10028754
lea ecx, [ebp - 0xac]
push ecx
call dword [sym.imp.MSVCR100D.dll_sprintf]
add esp, 0xc
cmp esi, esp
call fcn.100226a0
lea eax, [ebp - 0x1d0]
push eax
call fcn.1001ed30
add esp, 4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1d0]
call fcn.10002410
mov esi, esp
push eax
push str.Hacking_opened_Blocked_HWID_:__ls_connection_refused
push 0x10034ac0
call dword [sym.imp.MSVCR100D.dll_sprintf]
add esp, 0xc
cmp esi, esp
call fcn.100226a0
lea ecx, [ebp - 0x34]
call fcn.1000f480
cmp eax, 3
jbe 0x1001f0f5
lea ecx, [ebp - 0x34]
call fcn.10002410
mov esi, esp
push eax
lea ecx, [ebp - 0x1d0]
call fcn.10002410
push eax
call dword [sym.imp.MSVCR100D.dll_strstr]
add esp, 8
cmp esi, esp
call fcn.100226a0
test eax, eax
jne 0x1001f099
push 0
lea ecx, [ebp - 0x1d0]
call fcn.10002410
push eax
lea ecx, [ebp - 0x34]
call fcn.100024e0
cmp eax, dword [0x100286fc]
je 0x1001f0f5
push 0x1d
push str.XeonansePlayerAreaBitFunction
push 0x513146
call fcn.1001d060
add esp, 0xc
sub esp, 0x20
mov ecx, esp
mov dword [ebp - 0x29c], esp
push 0x10034ac0
call fcn.10002270
mov dword [ebp - 0x2bc], eax
call fcn.1001d360
add esp, 0x20
push 0x1d
push str.XeonansePlayerAreaBitFunction
push 0x513146
call fcn.1001d060
add esp, 0xc
mov esi, esp
push 0
call dword [sym.imp.MSVCR100D.dll_exit]
cmp esi, esp
call fcn.100226a0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1d0]
call fcn.10002320
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.10002320
push edx
mov ecx, ebp
push eax
lea edx, [0x1001f150]
call fcn.100226d0
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100228c0
add esp, 0x2bc
cmp ebp, esp
call fcn.100226a0
mov esp, ebp
pop ebp
ret
Function at 0x100206d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002b0d8
push 0x10023472
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffcc
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x1c
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
xor ecx, ecx
mov cx, word [eax]
cmp ecx, 0x5a4d
je 0x10020736
mov byte [ebp - 0x3d], 0
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x3d]
jmp 0x100207bf
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
cmp dword [ecx], 0x4550
je 0x1002075d
mov byte [ebp - 0x3e], 0
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x3e]
jmp 0x100207bf
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
add eax, dword [edx + 0xd8]
cmp dword [ebp + 0xc], eax
jb 0x10020798
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x38]
add edx, dword [ecx + 0xd8]
mov eax, dword [ebp - 0x3c]
add edx, dword [eax + 0xdc]
cmp dword [ebp + 0xc], edx
jae 0x10020798
mov byte [ebp - 0x3f], 1
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x3f]
jmp 0x100207bf
mov byte [ebp - 0x40], 0
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x40]
jmp 0x100207bf
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100208a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10035318]
mov dword [ebp - 4], eax
jmp 0x100208b9
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x100208d6
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x100208b0
mov esp, ebp
pop ebp
ret
Function at 0x100208e0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x10035328], eax
je 0x100208fe
mov eax, 0x10dd
jmp 0x100209e0
mov eax, dword [0x10035338]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1002097d
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x10]
xor eax, eax
mov al, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
jne 0x1002095b
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x10], 0
je 0x1002095b
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x10]
push eax
call fcn.10020a50
add esp, 4
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
call sub.MSVCR100D.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x10020906
mov dword [0x10035338], 0
call fcn.100209f0
mov ecx, dword [0x10035334]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
je 0x100209ca
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call sub.MSVCR100D.dll_void___cdecl_operator_delete_void__
add esp, 4
mov edx, dword [ebp - 0x14]
mov dword [ebp - 4], edx
jmp 0x10020995
mov dword [0x10035334], 0
mov dword [0x10035328], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10020f50
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x10020f65
xor eax, eax
jmp 0x10020fda
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
add edx, 0x10000
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
jmp 0x10020f92
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0x38d
jae 0x10020fd5
mov edx, dword [ebp - 0xc]
imul edx, edx, 0x48
mov eax, dword [ebp - 0x10]
cmp dword [eax + edx + 0x40], 0
je 0x10020fd3
mov ecx, dword [ebp - 0xc]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 8]
jb 0x10020fcf
mov ecx, dword [ebp - 0xc]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 4]
jb 0x10020fd3
xor eax, eax
jmp 0x10020fda
jmp 0x10020f89
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x10021090
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x1003532c], 0
je 0x100210a9
mov eax, dword [0x1003532c]
jmp 0x10021149
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x100210bb
xor eax, eax
jmp 0x10021149
push 8
call sub.MSVCR100D.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10021111
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x100210fa
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call sub.MSVCR100D.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x1003532c], eax
mov dword [0x10035330], 0
mov eax, dword [ebp - 8]
jmp 0x10021149
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x1002112b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x100210db
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x10035334]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x10035334], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x10021990
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10021a60
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x10021a4c
cmp dword [ebp - 4], 0x50000000
jb 0x100219cc
cmp dword [ebp - 4], 0x80000000
ja 0x100219cc
mov dword [ebp - 4], 0x80010000
jmp 0x100219a5
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call sub.MSVCR100D.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x100219f2
jmp 0x10021a4c
cmp dword [ebp - 0x10], 0x10000
jne 0x10021a35
cmp dword [ebp - 0x14], 0x10000
jb 0x10021a35
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x10021a28
mov eax, dword [ebp - 0x24]
jmp 0x10021a4e
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10021a47
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x14]
push ecx
call fcn.10021a60
add esp, 4
mov dword [ebp - 4], eax
jmp 0x100219a5
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10021aa0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10021b70
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x10021b64
cmp dword [ebp - 4], 0x50000000
jb 0x10021ae1
cmp dword [ebp - 4], 0x80000000
ja 0x10021ae1
mov dword [ebp - 4], 0x4fff0000
jmp 0x10021aba
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call sub.MSVCR100D.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10021b07
jmp 0x10021b64
cmp dword [ebp - 0x10], 0x10000
jne 0x10021b4a
cmp dword [ebp - 0x14], 0x10000
jb 0x10021b4a
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x10021b3d
mov eax, dword [ebp - 0x24]
jmp 0x10021b66
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10021b5f
mov ecx, dword [ebp - 0x1c]
sub ecx, 0x10000
push ecx
call fcn.10021b70
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10021aba
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x100228c0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10032420]
jne 0x100228ca
repz ret
jmp fcn.10023c90
Function at 0x403434
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 8], esi
test edi, edi
jne 0x403451
mov dword [ebp - 8], 0x8000
and dword [ebp - 4], 0
mov ebx, edi
test edi, edi
jne 0x403460
mov ebx, 0x4101d8
mov eax, dword [ebp + 8]
test eax, eax
jl 0x403475
mov ecx, dword [0x425cb8]
add ecx, eax
push ecx
call fcn.00403626
lea eax, [ebp + 0x14]
push 4
push eax
call fcn.00403610
test eax, eax
je 0x4035c7
test byte [ebp + 0x17], 0x80
je 0x4035b0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x40c148
mov dword [ebp - 0xc], eax
call fcn.00406c36
and dword [ebp + 0x14], 0x7fffffff
mov eax, dword [ebp + 0x14]
mov dword [ebp + 8], eax
jle 0x403606
mov esi, 0x4000
cmp dword [ebp + 0x14], esi
jge 0x4034c5
mov esi, dword [ebp + 0x14]
mov edi, 0x40c1d8
push esi
push edi
call fcn.00403610
test eax, eax
je 0x4035c7
sub dword [ebp + 0x14], esi
mov dword [0x40c160], edi
mov dword [0x40c164], esi
mov eax, dword [ebp - 8]
mov ecx, 0x40c148
mov dword [0x40c168], ebx
mov dword [0x40c16c], eax
call fcn.00406c56
test eax, eax
mov dword [ebp - 0x10], eax
jl 0x4035a8
mov esi, dword [0x40c168]
sub esi, ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test byte [0x425d14], 1
mov edi, eax
je 0x403567
sub eax, dword [ebp - 0xc]
cmp eax, 0xc8
ja 0x403534
cmp dword [ebp + 0x14], 0
jne 0x403567
mov eax, dword [ebp + 8]
push dword [ebp + 8]
sub eax, dword [ebp + 0x14]
push 0x64
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
push eax
lea eax, [ebp - 0x50]
push str....__d__
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x50]
push eax
push 0
call fcn.004055cc
mov dword [ebp - 0xc], edi
test esi, esi
je 0x40359c
cmp dword [ebp + 0x10], 0
jne 0x403584
push esi
push ebx
push dword [ebp + 0xc]
call fcn.0040616f
test eax, eax
je 0x4035ac
add dword [ebp - 4], esi
jmp 0x403590
add dword [ebp - 4], esi
sub dword [ebp - 8], esi
mov ebx, dword [0x40c168]
cmp dword [ebp - 0x10], 1
jne 0x4034e8
jmp 0x403606
cmp dword [ebp + 0x14], 0
jg 0x4034b8
jmp 0x403606
push 0xfffffffffffffffc
jmp 0x4035c9
push 0xfffffffffffffffe
jmp 0x4035c9
test edi, edi
je 0x4035fb
cmp dword [ebp + 0x14], esi
jge 0x4035bc
mov esi, dword [ebp + 0x14]
push esi
push edi
call fcn.00403610
test eax, eax
jne 0x403603
push 0xfffffffffffffffd
pop eax
jmp 0x403609
mov esi, dword [ebp - 8]
cmp dword [ebp + 0x14], esi
jge 0x4035d7
mov esi, dword [ebp + 0x14]
mov edi, 0x40c1d8
push esi
push edi
call fcn.00403610
test eax, eax
je 0x4035c7
push esi
push edi
push dword [ebp + 0xc]
call fcn.0040616f
test eax, eax
je 0x4035ac
add dword [ebp - 4], esi
sub dword [ebp + 0x14], esi
cmp dword [ebp + 0x14], 0
jg 0x4035cc
jmp 0x403606
mov dword [ebp - 4], esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x405ac7
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, 0x40838c
and byte [ebp - 0x1f], 0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
and dword [ebp - 0x14], 0
and dword [ebp - 4], 0
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push esi
push eax
mov byte [ebp - 0x20], 1
push dword [ebp + 8]
mov word [ebp - 0x1e], 4
mov dword [ebp - 0x10], 0x40837c
mov dword [ebp - 0xc], 0xc
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x405b18
xor eax, eax
jmp 0x405b3f
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0xb7
jne 0x405b3f
lea eax, [ebp - 0x20]
push eax
push 0x80000007
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityA]
test eax, eax
jne 0x405b14
call esi
pop esi
leave
ret 4

Function at 0x405b79
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [0x422e20], 0x44
push eax
xor eax, eax
push 0x422e20
push eax
push eax
push 0x4000000
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x405bb8
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x405bbc
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
and dword [eax + 0x24], 0
mov dword [eax], 0x3c
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
ret 4

Function at 0x405c5a
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push esi
call fcn.004060a3
mov edi, eax
cmp edi, 0xffffffff
je 0x405c9b
test byte [esp + 0x10], 1
push esi
je 0x405c7d
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x405c83
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x405c8c
xor eax, eax
inc eax
jmp 0x405c9d
test byte [esp + 0x10], 4
jne 0x405c9b
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
xor eax, eax
pop edi
pop esi
ret 8
Function at 0x405fb5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x422a20
push esi
call fcn.0040652f
push esi
call fcn.00405f60
mov edi, eax
test edi, edi
jne 0x405fd6
xor eax, eax
jmp 0x406028
push edi
call fcn.00406799
test byte [0x425c5c], 0x80
je 0x405fef
mov al, byte [edi]
test al, al
je 0x405fd2
cmp al, 0x5c
je 0x405fd2
sub edi, esi
jmp 0x406007
call fcn.00406a7c
test eax, eax
je 0x406001
test byte [eax], 0x10
je 0x405fd2
push esi
call fcn.00405f0e
push esi
call sub.KERNEL32.dll_lstrlenA
cmp eax, edi
push esi
jg 0x405ff3
call fcn.00405ec7
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x4060a3
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4060c2
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, esi
pop esi
ret 4

Function at 0x4060c8
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x4060f7
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
mov eax, dword [0x40abbc]
dec edi
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x40613c
test edi, edi
jne 0x406102
and byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x406136