joyce8/EMBER2024-capa huggingface dataset:
Function at 0x465860
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
mov eax, dword [0x4b04dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x14c]
push ecx
push eax
mov eax, dword [ebp + 8]
push 0
push 0x141
lea edx, [ebp - 0x148]
push edx
push eax
mov dword [ebp - 0x14c], 0x10
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp eax, 0xffffffff
jne 0x4658b5
or eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00475dcc
mov esp, ebp
pop ebp
ret
mov cl, byte [ebp - 0x140]
mov eax, dword [ebp - 0x12b]
mov byte [esi], cl
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00475dcc
mov esp, ebp
pop ebp
ret

Function at 0x4658e0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
cmp eax, 2
jne 0x46592a
call fcn.00465680
test eax, eax
jne 0x465920
push str.www.baidu.com
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x465920
cmp dword [eax + 0xc], 0
je 0x465920
cmp word [eax + 0xa], 4
jl 0x465920
mov eax, 1
mov byte [esi + 4], al
pop esi
pop ebp
ret 4
xor eax, eax
mov byte [esi + 4], al
pop esi
pop ebp
ret 4
cmp eax, 1
jne 0x465941
call fcn.00465680
test eax, eax
sete al
mov byte [esi + 4], al
pop esi
pop ebp
ret 4
test eax, eax
jne 0x46596f
push str.www.baidu.com
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x46595e
xor al, al
mov byte [esi + 4], al
pop esi
pop ebp
ret 4
cmp dword [eax + 0xc], 0
je 0x465954
cmp word [eax + 0xa], 4
setge al
mov byte [esi + 4], al
mov al, byte [esi + 4]
pop esi
pop ebp
ret 4

Function at 0x466570
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
jne 0x466583
lea eax, [esi + 0xd]
pop esi
pop ebp
ret 0xc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
xor edi, edi
lea ecx, [ecx]
push esi
call ebx
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x466590
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push edi
push eax
mov eax, dword [edx]
push 7
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop ebx
pop esi
pop ebp
ret 0xc
Function at 0x4665c0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x4b04dc]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov eax, ecx
mov esi, dword [eax + 4]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x120]
push edx
xor edi, edi
or esi, 0x2001f
push esi
push edi
mov dword [ebp - 0x124], eax
mov eax, dword [eax]
push ecx
push eax
mov dword [ebp - 0x128], ecx
mov dword [ebp - 0x118], edi
mov dword [ebp - 0x114], edi
mov dword [ebp - 0x110], edi
mov dword [ebp - 0x120], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [ebp - 0x118]
mov ebx, eax
cmp ebx, edi
jne 0x466654
xor eax, eax
cmp ecx, edi
je 0x466636
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x120]
and esi, 0x300
mov ebx, eax
mov dword [ebp - 0x118], ecx
mov dword [ebp - 0x114], esi
cmp eax, edi
je 0x466674
cmp ecx, edi
je 0x46665f
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00475dcc
mov esp, ebp
pop ebp
ret 4
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
lea eax, [ebp - 0x130]
push eax
push edi
push edi
push edi
lea edx, [ebp - 0x11c]
push edx
lea eax, [ebp - 0x10c]
push eax
push edi
push ecx
mov dword [ebp - 0x11c], pe_nt_image_headers32
call esi
test eax, eax
jne 0x4666fc
jmp 0x4666b0
lea ecx, [ebp - 0x10c]
push ecx
lea ecx, [ebp - 0x118]
call fcn.004665c0
mov ebx, eax
cmp ebx, edi
jne 0x466752
lea edx, [ebp - 0x130]
push edx
mov edx, dword [ebp - 0x118]
push edi
push edi
push edi
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x10c]
push ecx
push edi
push edx
mov dword [ebp - 0x11c], pe_nt_image_headers32
call esi
test eax, eax
je 0x4666b0
mov eax, dword [ebp - 0x118]
cmp eax, edi
je 0x466713
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x118], edi
mov ebx, dword [ebp - 0x128]
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x114], edi
call fcn.004663d0
mov esi, eax
mov eax, dword [ebp - 0x118]
cmp eax, edi
je 0x46673d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00475dcc
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0x118]
cmp eax, edi
je 0x466763
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.00475dcc
mov esp, ebp
pop ebp
ret 4
Function at 0x4693d0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x490996
mov eax, dword fs:[0]
push eax
sub esp, 0xac
mov eax, dword [0x4b04dc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.___kskjf_s3298___7__mini.me.
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x469423
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00469580
call fcn.0046a3b0
test al, al
jne 0x469556
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
test eax, eax
js 0x469556
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea edi, [ebp - 0xb4]
mov dword [0x4b60d8], eax
call fcn.0043cb90
push eax
lea edi, [ebp - 0x70]
call fcn.00454470
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0xb4]
lea ecx, [ebp - 0xb0]
cmp eax, ecx
je 0x469486
push eax
call fcn.00476c90
add esp, 4
mov eax, dword [ebp - 0x70]
call fcn.0043ccd0
push 0x248
call fcn.004765f6
add esp, 4
mov dword [ebp - 0xb8], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x4694b4
mov esi, eax
call fcn.00469890
mov edi, eax
jmp 0x4694b6
xor edi, edi
mov byte [ebp - 4], 0
call fcn.0046a490
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
mov esi, eax
push 1
mov dword [edi + 0x240], esi
call ebx
push eax
push 0
call ebx
push eax
push 0
push 0
push 0x10
push 0xcf0000
push str.mini_web_show
push 0
mov eax, edi
call fcn.004355b0
mov ebx, eax
test ebx, ebx
je 0x469517
push esi
lea esi, [ebp - 0x2c]
call fcn.00469300
cmp dword [eax + 0x14], 0x10
jb 0x469507
mov eax, dword [eax]
push eax
push ebx
call dword [sym.imp.USER32.dll_SetWindowTextA]
lea ecx, [ebp - 0x2c]
call fcn.0046fe30
mov ecx, edi
call fcn.004358c0
call fcn.0043f290
mov eax, dword [ebp - 0x70]
lea edx, [ebp - 0x6c]
cmp eax, edx
je 0x469536
push eax
call fcn.00476c90
add esp, 4
mov eax, dword [0x4b5f84]
test eax, eax
je 0x469550
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4b5f84], 0
call dword [sym.imp.ole32.dll_OleUninitialize]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00475dcc
mov esp, ebp
pop ebp
ret 4
Function at 0x469a30
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
cmp eax, 0x113
jne 0x469b57
mov eax, dword [ebp + 0xc]
cmp eax, 0x2711
jne 0x469b12
push ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 0x234]
xor bl, bl
cmp eax, 0x493e0
jb 0x469a6a
mov bl, 1
mov eax, dword [esi + 0x238]
cmp eax, 3
jbe 0x469a77
mov bl, 1
test eax, eax
je 0x469a7d
mov bl, 1
push edi
mov edi, dword [esi + 0x240]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 0x23c]
cmp eax, dword [edi + 0x40]
pop edi
jae 0x469a9a
test bl, bl
je 0x469b0a
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x469ad2
mov eax, dword [esi + 0x240]
mov eax, dword [eax + 0x44]
test eax, eax
jne 0x469aba
mov eax, 1
mov ecx, dword [esi + 4]
imul eax, eax, 0x3e8
push 0
push eax
push 0x2712
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.USER32.dll_BringWindowToTop]
mov eax, dword [esi + 4]
push 0x2711
push eax
call dword [sym.imp.USER32.dll_KillTimer]
call fcn.00459850
test al, al
jne 0x469b0a
mov ecx, dword [esi + 4]
push 0x13
push 0
push 0
push 0
push 0
push 0
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
pop ebx
xor eax, eax
pop esi
pop ebp
ret 0x10
cmp eax, 0x2712
jne 0x469b0b
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x469b0b
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x469b41
mov eax, dword [esi + 4]
push 4
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 4]
push 0x2712
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
xor eax, eax
pop esi
pop ebp
ret 0x10
cmp eax, 2
jne 0x469b6b
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
xor eax, eax
pop esi
pop ebp
ret 0x10
cmp eax, 0x14
jne 0x469b0b
mov eax, 1
pop esi
pop ebp
ret 0x10

Function at 0x46a3b0
Capabilities:
Check mutex on windows

Disassembly:
push str.app_mtuxsf_kundsflsf43_
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x4b5f84], eax
test eax, eax
je 0x46a3d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x46a3d8
xor al, al
ret
push esi
push 0
push str.osjdfji43_kjdfkjdl3209r48Zsjhd
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
test esi, esi
je 0x46a410
push edi
push esi
call dword [sym.imp.USER32.dll_IsIconic]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x46a403
push 9
push esi
call edi
push 1
push esi
call edi
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
mov eax, dword [0x4b5f84]
pop esi
test eax, eax
je 0x46a42b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4b5f84], 0
mov al, 1
ret
Function at 0x46ea40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, eax
mov eax, dword [esi]
mov ecx, dword [esi + 8]
push eax
push 1
push ecx
push edi
call fcn.00477d95
mov ecx, dword [esi + 8]
add esp, 0x10
cmp eax, 1
mov eax, ecx
sete bl
cdq
idiv dword [esi + 0x18]
mov byte [ebp - 1], bl
mov dword [esi + 0x1c], eax
test bl, bl
je 0x46ebab
add dword [esi + 0x14], ecx
cmp dword [esi + 0x50], 0x10
push 0xffffffffffffffff
push eax
push 0x18
lea eax, [esi + 0x3c]
push ecx
mov ecx, esp
jb 0x46ea93
mov eax, dword [eax]
mov dword [ecx], eax
push ecx
mov eax, esp
mov dword [eax], str.read
lea eax, [esi + 0x20]
push eax
mov dword [ebp - 0xc], eax
call fcn.0046cfb0
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0x1c]
add esp, 0x18
xor ebx, ebx
xor eax, eax
cmp ecx, 1
sete byte [ebp - 2]
mov dword [ebp - 8], edx
test edx, edx
je 0x46eb53
dec dword [ebp - 8]
xor edx, edx
cmp byte [ebp - 2], dl
je 0x46ead7
cmp byte [edi], dl
jmp 0x46eada
cmp word [edi], dx
sete dl
test edx, edx
je 0x46eb04
test eax, eax
je 0x46eafd
cmp edi, eax
je 0x46eafd
imul ecx, ebx
mov edx, edi
sub edx, eax
push edx
push eax
sub eax, ecx
push eax
call fcn.00475f70
add esp, 0xc
mov ecx, dword [esi + 0x18]
lea eax, [ecx + edi]
inc ebx
add edi, ecx
cmp dword [ebp - 8], 0
jne 0x46eac9
test eax, eax
je 0x46eb29
cmp edi, eax
je 0x46eb29
mov ecx, dword [esi + 0x18]
imul ecx, ebx
sub edi, eax
push edi
push eax
sub eax, ecx
push eax
call fcn.00475f70
add esp, 0xc
test ebx, ebx
je 0x46eb53
mov edx, dword [ebp - 0xc]
push 0xffffffffffffffff
push ebx
push 1
push ecx
mov eax, esp
push ecx
mov dword [eax], 0
mov eax, esp
push edx
mov dword [eax], str.nulls_removed
call fcn.0046cfb0
add esp, 0x18
sub dword [esi + 0x1c], ebx
cmp dword [esi + 0x18], 1
jle 0x46eb9f
test byte [esi + 4], 0x80
je 0x46eb9f
mov esi, dword [esi + 0x1c]
test esi, esi
je 0x46eb7b
mov ecx, dword [ebp + 8]
movzx eax, word [ecx + esi*2 - 2]
dec esi
rol ax, 8
mov word [ecx + esi*2], ax
test esi, esi
jne 0x46eb66
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push ecx
mov eax, esp
mov dword [eax], 0
push ecx
mov eax, esp
mov dword [eax], str.endian_swap
mov eax, dword [ebp - 0xc]
push eax
call fcn.0046cfb0
add esp, 0x18
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push esi
call fcn.0046e830
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x46f4f0
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
mov esi, ecx
mov ecx, dword [esi + 0x18]
mov ebx, eax
mov eax, dword [esi + 0x1c]
imul ecx, eax
push edi
mov dword [esi + 8], ecx
test ebx, ebx
jne 0x46f509
mov ebx, edx
mov ecx, dword [esi + 4]
xor edi, edi
test cl, cl
jns 0x46f586
test edx, edx
jne 0x46f542
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00475963
mov edi, eax
mov eax, dword [esi + 0x1c]
add eax, eax
push eax
push ebx
push edi
call fcn.0047b540
add esp, 0x10
mov edx, edi
mov ebx, edi
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x46f562
lea esp, [esp]
movzx ecx, word [edx + eax*2 - 2]
dec eax
rol cx, 8
mov word [edx + eax*2], cx
test eax, eax
jne 0x46f550
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push ecx
mov eax, esp
push ecx
mov dword [eax], 0
mov eax, esp
lea ecx, [esi + 0x20]
push ecx
mov dword [eax], str.endian_swap
call fcn.0046cfb0
add esp, 0x18
mov edx, dword [esi]
mov eax, dword [esi + 8]
push edx
push 1
push eax
push ebx
call fcn.00477f09
add esp, 0x10
cmp eax, 1
sete bl
test edi, edi
je 0x46f5ab
push edi
call fcn.00476676
add esp, 4
test bl, bl
je 0x46f5e8
mov edx, dword [esi + 0x1c]
mov ecx, dword [esi + 8]
add dword [esi + 0x14], ecx
cmp dword [esi + 0x50], 0x10
push 0xffffffffffffffff
push edx
push 0x18
lea eax, [esi + 0x3c]
push ecx
mov ecx, esp
jb 0x46f5cb
mov eax, dword [eax]
push ecx
mov dword [ecx], eax
mov eax, esp
add esi, 0x20
push esi
mov dword [eax], str.write
call fcn.0046cfb0
add esp, 0x18
mov al, bl
pop edi
pop esi
pop ebx
ret
push esi
call fcn.0046e830
pop edi
pop esi
mov al, bl
pop ebx
ret
Function at 0x474960
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x47497a
pop esi
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 0xc]
push ecx
push 0x40
push 3
push esi
mov dword [ebp - 8], 0x40
call edi
test eax, eax
je 0x4749be
push 3
lea edx, [ebp - 4]
push edx
push esi
mov dword [ebp - 4], 0x48000cc2
call fcn.00475f70
mov ecx, dword [ebp - 0xc]
add esp, 0xc
lea eax, [ebp - 8]
push eax
push ecx
push 3
push esi
call edi
test eax, eax
jne 0x4749c7
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x475dcc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4b04dc]
jne 0x475dd6
repz ret
jmp fcn.0047f516
Function at 0x48925c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4b04dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0047f72f
and dword [ebp - 0x14], 0
cmp dword [0x4b5b6c], 0
mov dword [ebp - 0x18], eax
jne 0x48930f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4893b7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4893b7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4b5b6c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4b5b70], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4b5b74], eax
call edi
push eax
call esi
mov dword [0x4b5b7c], eax
test eax, eax
je 0x48930f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4b5b78], eax
mov eax, dword [0x4b5b78]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x489368
cmp dword [0x4b5b7c], ecx
je 0x489368
push eax
call esi
push dword [0x4b5b7c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x489368
test ebx, ebx
je 0x489368
call edi
test eax, eax
je 0x48935f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x48935f
test byte [ebp - 8], 1
jne 0x489368
or dword [ebp + 0x10], 0x200000
jmp 0x48939b
mov eax, dword [0x4b5b70]
cmp eax, dword [ebp - 0x18]
je 0x48939b
push eax
call esi
test eax, eax
je 0x48939b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x48939b
mov eax, dword [0x4b5b74]
cmp eax, dword [ebp - 0x18]
je 0x48939b
push eax
call esi
test eax, eax
je 0x48939b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4b5b6c]
call esi
test eax, eax
je 0x4893b7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4893b9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00475dcc
leave
ret
Function at 0x402180
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x46c3b6
mov eax, dword fs:[0]
push eax
sub esp, 0xac
push ebx
push esi
mov eax, dword [0x481524]
xor eax, esp
push eax
lea eax, [esp + 0xb8]
mov dword fs:[0], eax
mov esi, ecx
push 0xc9
push esi
call dword [sym.imp.USER32.dll_KillTimer]
xor ebx, ebx
push ebx
push 0xbb8
push 0xc8
push esi
call dword [sym.imp.USER32.dll_SetTimer]
push 0x3ea
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp eax, ebx
je 0x4021e5
push ebx
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
lea eax, [esp + 0x2c]
push eax
call fcn.00402ed0
mov dword [esp + 0xc0], ebx
push 0x471cf8
push ecx
mov ecx, dword [0x482d50]
push ecx
push ecx
lea edx, [esp + 0x44]
push str.http:__127.0.0.1:
push edx
call fcn.00408c70
add esp, 0xc
push eax
call fcn.00402770
add esp, 4
push eax
call fcn.00408c70
add esp, 8
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x30]
call fcn.00402fe0
mov byte [esp + 0xc0], 1
mov esi, 0x10
cmp dword [eax + 0x18], esi
jb 0x40224d
mov eax, dword [eax + 4]
jmp 0x402250
add eax, 4
push 5
push ebx
push ebx
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov byte [esp + 0xc0], bl
cmp dword [esp + 0x28], esi
jb 0x40227b
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0044afbb
add esp, 4
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], ebx
mov byte [esp + 0x14], bl
mov dword [esp + 0xc0], 0xffffffff
lea ecx, [esp + 0x80]
call fcn.00402f70
lea ecx, [esp + 0x80]
call fcn.00402910
mov ecx, dword [esp + 0xb8]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xb8
ret
Function at 0x40a8a0
Capabilities:
Delete file

Disassembly:
sub esp, 0x20c
mov eax, dword [0x481524]
xor eax, esp
mov dword [esp + 0x208], eax
push edi
lea edi, [esp + 4]
call fcn.0040a6a0
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x20c]
neg eax
sbb eax, eax
neg eax
pop edi
xor ecx, esp
dec eax
call fcn.0044aab8
add esp, 0x20c
ret

Function at 0x40a8f0
Capabilities:
Create directory

Disassembly:
sub esp, 0x310
mov eax, dword [0x481524]
xor eax, esp
mov dword [esp + 0x30c], eax
cmp byte [ecx], 0
push esi
mov esi, 0x104
lea eax, [esp + 4]
je 0x40a929
mov edx, eax
sub ecx, edx
cmp esi, 1
jbe 0x40a929
mov dl, byte [ecx + eax]
mov byte [eax], dl
inc eax
dec esi
cmp byte [ecx + eax], 0
jne 0x40a917
mov byte [eax], 0
lea eax, [esp + 4]
push eax
call fcn.0040a630
add esp, 4
push 0x208
lea ecx, [esp + 0x10c]
push ecx
push 0xffffffffffffffff
lea edx, [esp + 0x10]
push edx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
lea eax, [esp + 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [esp + 0x310]
neg eax
sbb eax, eax
neg eax
pop esi
xor ecx, esp
dec eax
call fcn.0044aab8
add esp, 0x310
ret

Function at 0x40aa20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x20c
mov eax, dword [0x481524]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
xor esi, esi
test ebx, ebx
jne 0x40aa5e
push 0xa0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.0044aab8
add esp, 0x20c
ret
push 0x358
call fcn.0044c7be
mov esi, eax
add esp, 4
test esi, esi
jne 0x40aa91
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.0044aab8
add esp, 0x20c
ret
push edi
lea edi, [esp + 8]
mov ecx, ebx
call fcn.0040a6a0
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
pop edi
cmp eax, 0xffffffff
je 0x40ab0f
test al, 0x10
je 0x40ab0f
lea eax, [esp + 4]
add eax, 0xfffffffe
jmp 0x40aac0
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x40aac0
mov ecx, dword [0x4726e0]
mov dx, word [0x4726e4]
mov dword [eax], ecx
mov word [eax + 4], dx
lea eax, [esi + 4]
push eax
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esi], eax
mov byte [esi + 0x254], 0
mov eax, esi
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.0044aab8
add esp, 0x20c
ret
push esi
call fcn.0044acdc
mov ecx, dword [esp + 0x210]
add esp, 4
pop esi
xor ecx, esp
xor eax, eax
call fcn.0044aab8
add esp, 0x20c
ret

Function at 0x40abe0
Capabilities:
Create thread

Disassembly:
push esi
push 0
push 0
push eax
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x40abfe
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
neg eax
sbb eax, eax
neg eax
dec eax
pop esi
ret