joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10036ff0
Capabilities:
Create pipe

Disassembly:
sub esp, 0x24
push esi
or eax, 0xffffffff
push 0x100000
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
xor esi, esi
push edx
mov dword [esp + 0x1c], 0xc
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], 1
call dword [sym.imp.kernel32.dll_CreatePipe]
test eax, eax
je 0x10037084
mov eax, dword [esp + 4]
cdq
mov dword [esp + 0x18], eax
mov eax, dword [esp + 8]
mov dword [esp + 0x1c], edx
cdq
push edi
mov edi, dword [esp + 0x30]
mov dword [esp + 0x24], eax
mov eax, dword [edi]
push 2
mov dword [esp + 0x2c], edx
mov ecx, dword [eax + 0x2d0]
push edi
call ecx
mov esi, eax
test esi, esi
je 0x1003707c
mov edx, dword [edi]
mov ecx, dword [edx + 0x350]
lea eax, [esp + 0x1c]
push eax
push 2
push 0
push esi
push edi
call ecx
mov eax, esi
pop edi
pop esi
add esp, 0x24
ret 8
mov eax, esi
pop esi
add esp, 0x24
ret 8

Function at 0x10037090
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi]
mov ecx, dword [eax + 0x398]
push edi
push ebx
push esi
call ecx
mov edx, dword [esi]
push ebx
mov edi, eax
mov eax, dword [edx + 0x39c]
push esi
call eax
mov dword [esp + 0x10], 0
test edi, edi
jne 0x100370ca
pop edi
pop esi
or eax, 0xffffffff
pop ebx
ret 0x14
mov edx, dword [esp + 0x18]
push 0
lea ecx, [esp + 0x14]
push ecx
push eax
push edi
push edx
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
mov eax, 0xfffffffe
je 0x100370eb
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
ret 0x14

Function at 0x10037100
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x14]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x398]
call eax
mov dword [esp + 4], 0
test eax, eax
jne 0x10037126
or eax, 0xffffffff
ret 0x18
push esi
mov esi, dword [esp + 0x1c]
test esi, esi
jne 0x10037136
lea eax, [esi - 2]
pop esi
ret 0x18
push edi
mov edi, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x10]
push ecx
push esi
push eax
push edi
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
jne 0x10037159
pop edi
mov eax, 0xfffffffd
pop esi
ret 0x18
push edi
call dword [sym.imp.kernel32.dll_FlushFileBuffers]
mov eax, esi
sub eax, dword [esp + 0xc]
pop edi
neg eax
sbb eax, eax
and eax, 0xfffffffc
pop esi
ret 0x18

Function at 0x1003779c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1004f860]
jne 0x100377a6
repz ret
jmp fcn.10037e92
Function at 0x40688e
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push esi
push edi
mov eax, 0x1a1
cmp eax, 0x24
ja 0x40689c
call 0x856685f
mov al, byte [0x8b640041]
cmp eax, 0x30
call dword [sym.imp.KERNEL32.dll_FreeConsole]
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [0x44ee30], eax
sub eax, eax
je 0x4068c1
call 0xa8cf5181
invalid
call 0x401154
call 0x406651
pop edi
xor eax, eax
pop esi
ret

Function at 0x407515
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x407554
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x407554
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x407554
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x407554
cmp dword [ecx + 0x74], 0xe
jbe 0x407554
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40d5eb
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41c2c8
push 0x41c2c0
push str.FlsAlloc
push 0x1e
call fcn.0040d4ac
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d61f
push dword [ebp + 8]
mov ecx, esi
call dword [0x41a120]
call esi
jmp 0x40d625
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40d669
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41c2d8
push 0x41c2d0
push str.FlsGetValue
push 0x20
call fcn.0040d4ac
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d6a0
push dword [ebp + 8]
mov ecx, esi
call dword [0x41a120]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x418a50
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x418a7d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x418a7d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x402e00
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0x40d029], eax
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push str.Marmimo
push str.Mimoclass
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x402e48
xor eax, eax
jmp 0x402e63
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x405413
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404305
and dword [ebp - 4], 0
cmp dword [0x40ea48], 0
mov ebx, eax
jne 0x4054c4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x405575
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x405575
push eax
call fcn.00404293
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40ea48], eax
call esi
push eax
call fcn.00404293
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40ea4c], eax
call esi
push eax
call fcn.00404293
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40ea50], eax
call esi
push eax
call fcn.00404293
pop ecx
mov dword [0x40ea58], eax
test eax, eax
je 0x4054c4
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404293
pop ecx
mov dword [0x40ea54], eax
mov eax, dword [0x40ea54]
cmp eax, ebx
je 0x40551c
cmp dword [0x40ea58], ebx
je 0x40551c
push eax
call fcn.0040430e
push dword [0x40ea58]
mov esi, eax
call fcn.0040430e
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40551c
test edi, edi
je 0x40551c
call esi
test eax, eax
je 0x405513
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x405513
test byte [ebp - 0xc], 1
jne 0x40551c
or dword [ebp + 0x10], 0x200000
jmp 0x405555
mov eax, dword [0x40ea4c]
cmp eax, ebx
je 0x405555
push eax
call fcn.0040430e
pop ecx
test eax, eax
je 0x405555
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x405555
mov eax, dword [0x40ea50]
cmp eax, ebx
je 0x405555
push eax
call fcn.0040430e
pop ecx
test eax, eax
je 0x405555
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40ea48]
call fcn.0040430e
pop ecx
test eax, eax
je 0x405575
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x405577
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40727e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40dac8]
jne 0x407288
repz ret
jmp fcn.004089a5
Function at 0x401192
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4011a7
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x4011b9
xor eax, eax
jmp 0x4011eb
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x4011dd
cmp esi, eax
jae 0x4011b5
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4011cf
cmp esi, eax
jae 0x4011b5
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop ebp
ret

Function at 0x401866
Capabilities:
Initialize winsock library
Terminate process

Disassembly:
mov eax, 0x42f5c5
call fcn.00410a44
sub esp, 0x520
mov eax, dword [0x4407f0]
xor eax, dword [ebp + 4]
push esi
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x52c]
push eax
push 2
mov esi, ecx
call dword [sym.imp.WSOCK32.dll_WSAStartup]
lea ecx, [ebp - 0x39c]
call fcn.00401749
and dword [ebp - 4], 0
lea eax, [ebp - 0x39c]
lea ecx, [ebp - 0x39c]
mov dword [esi + 0xa4], eax
call fcn.0041da8d
push 0
call fcn.00410c1c
int3

Function at 0x401a7c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x42f70c
call fcn.00410a44
push ecx
push ecx
push ebx
xor ebx, ebx
push edi
mov dword [ebp - 0x14], ebx
call fcn.00422fd3
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push 0x17
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
cmp edi, ebx
je 0x401b08
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
cmp esi, ebx
je 0x401b07
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
je 0x401b07
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, ebx
mov dword [ebp - 0x14], eax
je 0x401b07
lea eax, [esi + 1]
push eax
lea ecx, [ebp - 0x10]
call fcn.0040171f
push esi
push dword [ebp - 0x14]
mov edi, eax
push edi
call fcn.00410df0
add esp, 0xc
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
mov byte [edi + esi], bl
call fcn.00401518
pop esi
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.00401557
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040121d
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x401fe4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x42f635
call fcn.00410a44
sub esp, 0x40c
mov eax, dword [0x4407f0]
xor eax, dword [ebp + 4]
and byte [ebp - 0x418], 0
and dword [ebp - 0x14], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], eax
xor eax, eax
mov ecx, 0xff
lea edi, [ebp - 0x417]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x400
lea eax, [ebp - 0x418]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
jmp 0x402058
lea ecx, [ebp + eax - 0x418]
cmp byte [ecx], 0x5c
je 0x40205b
and byte [ecx], 0
dec eax
jns 0x402049
mov ebx, 0x3ff
sub ebx, eax
push ebx
lea edi, [ebp + eax - 0x417]
push str.remotelyanywhere_manual.pdf
push edi
call fcn.004116c0
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
and byte [ebp - 0x19], 0
add esp, 0xc
lea eax, [ebp - 0x418]
push eax
call esi
cmp eax, 0xffffffff
je 0x40209f
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x418]
push eax
call fcn.00401e9e
push ebx
push str.remotelyanywhere_gettingstarted.pdf
push edi
call fcn.004116c0
and byte [ebp - 0x19], 0
add esp, 0xc
lea eax, [ebp - 0x418]
push eax
call esi
cmp eax, 0xffffffff
mov ebx, dword [ebp + 8]
je 0x4020d1
lea eax, [ebp - 0x418]
push eax
mov ecx, ebx
call fcn.00401e9e
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
cmp dword [ecx - 0xc], 0
je 0x40213d
mov ecx, dword [ebx]
cmp dword [ecx - 0xc], 0
je 0x40213d
push eax
mov esi, str.file:__
xor edi, edi
lea eax, [ebp - 0x18]
push esi
inc edi
push eax
mov dword [ebp - 0x14], edi
call fcn.00401d41
add esp, 0xc
mov ecx, dword [ebp + 0xc]
and dword [ebp - 4], 0
push eax
call fcn.00401e32
mov ecx, dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.0040121d
push ebx
lea eax, [ebp + 0xc]
push esi
push eax
call fcn.00401d41
add esp, 0xc
push eax
mov ecx, ebx
mov dword [ebp - 4], edi
call fcn.00401e32
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.0040121d
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
xor ecx, dword [ebp + 4]
pop edi
pop esi
pop ebx
call fcn.00410a94
leave
ret
Function at 0x402c00
Capabilities:
Check mutex on windows

Disassembly:
mov eax, 0x42f70c
call fcn.00410a44
push ecx
push ebx
push esi
mov esi, ecx
push str.RAAboutMutex
lea ecx, [ebp - 0x10]
call fcn.00402bb5
push dword [esi + 0x44]
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00401e79
push dword [ebp - 0x10]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ebx, eax
test ebx, ebx
je 0x402c90
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x402c69
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push dword [esi + 0xa0]
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x402c90
push str.main
push dword [esi + 0x44]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
mov ecx, esi
jne 0x402c84
call fcn.00401866
jmp 0x402c89
call fcn.004014b2
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040121d
mov ecx, dword [ebp - 0xc]
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x402c0c
Capabilities:
Check mutex on windows

Disassembly:
mov eax, 0x42f70c
call fcn.00410a44
push ecx
push ebx
push esi
mov esi, ecx
push str.RAAboutMutex
lea ecx, [ebp - 0x10]
call fcn.00402bb5
push dword [esi + 0x44]
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00401e79
push dword [ebp - 0x10]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ebx, eax
test ebx, ebx
je 0x402c90
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x402c69
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push dword [esi + 0xa0]
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x402c90
push str.main
push dword [esi + 0x44]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
mov ecx, esi
jne 0x402c84
call fcn.00401866
jmp 0x402c89
call fcn.004014b2
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040121d
mov ecx, dword [ebp - 0xc]
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x402f5a
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x4407f0]
xor eax, dword [ebp + 4]
push ebx
push esi
push edi
mov esi, 0x432450
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, 0x432448
lea edi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], eax
mov ebx, ecx
movsw word es:[edi], word [esi]
call fcn.00404ac9
xor edi, edi
cmp eax, edi
je 0x402fa4
mov cl, byte [eax]
mov byte [ebp - 0x1a], cl
mov byte [ebp - 0x13], cl
mov al, byte [eax + 2]
mov byte [ebp - 0x19], al
mov byte [ebp - 0x12], al
push 0x100
mov dword [ebx + 0xc], 0x43226c
mov dword [ebx + 4], edi
mov dword [ebx + 8], 0x40
call fcn.00410d74
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebx], eax
pop ecx
lea eax, [ebp - 0x14]
push eax
call esi
push dword [0x43f0b8]
mov dword [ebp - 0x24], eax
call esi
mov esi, 0x104
push esi
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x130]
push edi
push eax
call fcn.00411d70
add esp, 0xc
push esi
lea eax, [ebp - 0x130]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x403022
push str._template.rab
lea eax, [ebp - 0x130]
push 0x5c
push eax
call fcn.00411d40
pop ecx
pop ecx
push eax
call fcn.00411c40
pop ecx
pop ecx
push edi
push edi
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x130]
push str.messages.xml
push eax
call fcn.00404dee
add esp, 0x18
test eax, eax
je 0x403059
push 8
call fcn.00410d74
mov dword [ebx], eax
mov dword [eax], edi
mov eax, dword [ebx]
mov dword [eax + 4], edi
jmp 0x403156
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x28]
and byte [eax + ecx - 1], 0
push str._cat_name_RAGUI__
push dword [ebp - 0xc]
call fcn.00411930
mov esi, eax
push str.__cat_
push esi
call fcn.00411930
add esp, 0x10
cmp eax, edi
je 0x403088
and byte [eax], 0
push str._msg_name_
push esi
call fcn.00411930
cmp eax, edi
pop ecx
pop ecx
mov dword [ebp - 8], eax
je 0x40314e
jmp 0x4030a4
xor edi, edi
add dword [ebp - 8], 0xb
push str.__msg_
push dword [ebp - 8]
call fcn.00411930
cmp eax, edi
pop ecx
pop ecx
je 0x40314e
and byte [eax], 0
push 0x22
push dword [ebp - 8]
add eax, 6
mov dword [ebp - 0x2c], eax
call fcn.00411b80
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x403134
and byte [edi], 0
lea eax, [ebp - 0x14]
push eax
inc edi
push edi
call fcn.00411930
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x4030f9
add esi, dword [ebp - 0x24]
lea eax, [ebp - 0x1c]
push eax
jmp 0x403116
push dword [0x43f0b8]
push edi
call fcn.00411930
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x403134
add esi, dword [ebp - 0x20]
push dword [0x43f0b4]
push esi
call fcn.00411930
test eax, eax
pop ecx
pop ecx
je 0x403134
and byte [eax], 0
test esi, esi
je 0x403134
push esi
push dword [ebp - 8]
mov ecx, ebx
call fcn.00402ddf
push str._msg_name_
push dword [ebp - 0x2c]
call fcn.00411930
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 8], eax
jne 0x4030a2
push dword [ebp - 0xc]
call fcn.00410c5c
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop edi
pop esi
mov eax, ebx
pop ebx
call fcn.00410a94
leave
ret
Function at 0x4032a7
Capabilities:
Hash data using crc32b

Disassembly:
xor edx, edx
cmp dword [0x441be0], edx
jne 0x4032ec
push esi
push edi
mov ecx, 0x4417e0
mov esi, 0x100
mov eax, edx
push 8
shl eax, 0x18
pop edi
test eax, eax
jns 0x4032d2
add eax, eax
xor eax, 0x4c11db7
jmp 0x4032d4
shl eax, 1
dec edi
jne 0x4032c5
mov dword [ecx], eax
inc edx
add ecx, 4
dec esi
jne 0x4032bd
pop edi
mov dword [0x441be0], 1
pop esi
ret

Function at 0x4032ed
Capabilities:
Encode data using xor

Disassembly:
call fcn.004032a7
mov edx, dword [esp + 8]
test edx, edx
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 4]
not eax
jbe 0x403322
push esi
push edi
movzx edi, byte [ecx]
mov esi, eax
shr esi, 0x18
xor esi, edi
mov esi, dword [esi*4 + 0x4417e0]
shl eax, 8
xor eax, esi
inc ecx
dec edx
jne 0x403306
pop edi
pop esi
not eax
ret
Function at 0x40337c
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [ebp + 0xc]
mov esi, eax
mov edi, ecx
call fcn.00411130
pop ecx
sub edi, eax
sub edi, 0x1b
push edi
push dword [ebp + 8]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x4034ff
push 0x5c
push dword [ebp + 8]
call fcn.00411d40
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
jne 0x4033bd
mov ebx, dword [ebp + 8]
push ebx
lea edi, [ebx + 6]
call fcn.00411130
inc eax
push eax
push ebx
push edi
call fcn.004112f0
push 6
push str.crash
push ebx
call fcn.004112f0
mov ebx, dword [ebp + 8]
and byte [edi], 0
add esp, 0x1c
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x403402
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x4034ff
push 0x2e
push ebx
mov byte [edi], 0x5c
call fcn.00411d40
pop ecx
pop ecx
mov ecx, eax
test ecx, ecx
jne 0x403420
push ebx
call fcn.00411130
pop ecx
mov ecx, eax
add ecx, ebx
mov byte [ecx], 0x2d
inc ecx
mov bl, 0x30
mov byte [ecx], bl
inc ecx
mov byte [ecx], 0x34
inc ecx
mov byte [ecx], 0x32
inc ecx
mov byte [ecx], 0x32
inc ecx
mov byte [ecx], 0x2d
movzx eax, word [esi]
cdq
push 0x64
pop edi
idiv edi
push 0xa
pop edi
inc ecx
push 0x64
movzx eax, ax
cdq
idiv edi
pop edi
push 0xa
add al, bl
mov byte [ecx], al
add dl, bl
inc ecx
mov byte [ecx], dl
movzx eax, word [esi]
cdq
idiv edi
pop edi
inc ecx
movzx eax, dx
cdq
idiv edi
add al, bl
mov byte [ecx], al
add dl, bl
inc ecx
mov byte [ecx], dl
movzx eax, word [esi + 2]
cdq
idiv edi
inc ecx
add al, bl
mov byte [ecx], al
movzx eax, word [esi + 2]
cdq
idiv edi
inc ecx
add dl, bl
mov byte [ecx], dl
movzx eax, word [esi + 6]
cdq
idiv edi
inc ecx
add al, bl
mov byte [ecx], al
movzx eax, word [esi + 6]
cdq
idiv edi
inc ecx
add dl, bl
mov byte [ecx], dl
inc ecx
mov byte [ecx], 0x2d
movzx eax, word [esi + 8]
cdq
idiv edi
inc ecx
add al, bl
mov byte [ecx], al
movzx eax, word [esi + 8]
cdq
idiv edi
inc ecx
add dl, bl
mov byte [ecx], dl
movzx eax, word [esi + 0xa]
cdq
idiv edi
inc ecx
push edi
add al, bl
mov byte [ecx], al
movzx eax, word [esi + 0xa]
cdq
idiv edi
inc ecx
add dl, bl
mov byte [ecx], dl
movzx eax, word [esi + 0xc]
cdq
idiv edi
inc ecx
add al, bl
mov byte [ecx], al
movzx eax, word [esi + 0xc]
cdq
pop esi
idiv esi
push dword [ebp + 0xc]
inc ecx
add dl, bl
mov byte [ecx], dl
inc ecx
push ecx
call fcn.00411c40
pop ecx
xor eax, eax
pop ecx
inc eax
jmp 0x403501
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4049a2
Capabilities:
Get common file path
Write file on windows

Disassembly:
mov eax, 0x42f75a
call fcn.00410a44
sub esp, 0x214
mov eax, dword [0x4407f0]
xor eax, dword [ebp + 4]
push ebx
push esi
mov dword [ebp - 0x10], eax
push edi
mov esi, ecx
lea eax, [ebp - 0x220]
push eax
xor ebx, ebx
push 0x208
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x404a5c
lea edi, [esi + 0xf0]
push edi
push ebx
push str.raabout.html
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x404a5c
push 0x207
push str..htm
push edi
call fcn.00412190
add esp, 0xc
push ebx
push ebx
push 2
push ebx
push ebx
push 0x40000000
push edi
mov byte [esi + 0x2f7], bl
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, ebx
mov dword [ebp - 0x14], eax
je 0x404a5c
cmp eax, 0xffffffff
je 0x404a5c
push ebx
lea ecx, [ebp - 0x18]
push ecx
mov ecx, dword [ebp + 8]
push dword [ecx - 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push ebx
push ebx
push ebx
push ebx
push edi
mov ecx, esi
call fcn.00406dbb
inc ebx
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0040121d
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
xor ecx, dword [ebp + 4]
pop edi
pop esi
mov eax, ebx
pop ebx
call fcn.00410a94
leave
ret 4