joyce8/EMBER2024-capa huggingface dataset:
Function at 0x76cd20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x76cd58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x76cd60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x76cd94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x76cd94
push eax
push esi
call fcn.0076f20b
add esp, 8
pop esi
ret 0x10

Function at 0x76cda0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x76ce22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x76ce15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x785320
push ecx
mov dword [esp + 0x1c], 4
call fcn.0076edff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x76cdda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x76ce30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x76cec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x76ceb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x785320
push ecx
mov dword [esp + 0x1c], 4
call fcn.0076edff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x76ceab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x76ce6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x76d000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x76d131
push esi
call fcn.00770145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.0075f080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x76d131
push 0
push ebp
call fcn.0075f3a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.0075f260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x76d08b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.0075f2f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x76d121
push 0x785918
push edi
call fcn.0076e3f0
push eax
push ebx
push esi
call fcn.0076cf60
push 0x7858f8
push edi
call fcn.0076e3f0
push eax
push ebx
push esi
call fcn.0076cf60
push 0x7858d8
push edi
call fcn.0076e3f0
push eax
push ebx
push esi
call fcn.0076cf60
push 0x7858c0
push edi
call fcn.0076e3f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.0076cf60
push 0x7858a0
push edi
call fcn.0076e3f0
push eax
push ebx
push esi
call fcn.0076cf60
push 0x785888
push edi
call fcn.0076e3f0
push eax
push ebx
push esi
call fcn.0076cf60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x76e1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.0076e140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.0076e140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.0076e140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.0076e140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x76ebfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x76ec50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x78087c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x76ec43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x76ec52
xor eax, eax
pop esi
leave
ret 4
Function at 0x5e9378
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
pushal
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
test eax, eax
je 0x5e9416
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
test eax, eax
jne 0x5e9416
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
cmp word [eax], 0x5a4d
jne 0x5e9416
mov ebx, dword [eax + 0x3c]
add eax, ebx
cmp dword [eax], 0x4550
jne 0x5e9416
mov ebx, dword [eax + 0x34]
mov dword [ebp - 0xc], ebx
mov ebx, dword [eax + 0x50]
mov dword [ebp - 8], ebx
push edi
push 4
push 0x2000
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [edi + 0x122d244b]
pop edi
test eax, eax
jne 0x5e9409
push edi
push 4
push 0x2000
push dword [ebp - 8]
push 0
call dword [edi + 0x122d244b]
pop edi
test eax, eax
je 0x5e9416
mov ebx, dword [ebp + 8]
mov dword [ebx + 0x14], eax
mov dword [ebp - 0x10], 1
popal
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x5e949b
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
pushal
mov eax, dword [ebp + 8]
mov ebx, dword [eax + 0x14]
mov dword [ebp - 8], ebx
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov ebx, dword [eax + 0x3c]
add eax, ebx
lea ebx, [eax + 0x18]
movzx ecx, word [eax + 0x14]
add ebx, ecx
movzx ecx, word [eax + 6]
test ecx, ecx
je 0x5e9547
push ecx
mov ecx, dword [ebx + 8]
mov edx, dword [ebx + 0x10]
cmp ecx, edx
jae 0x5e94dc
mov ecx, edx
mov dword [ebp - 4], ecx
mov eax, dword [ebx + 0xc]
add eax, dword [ebp - 8]
push ecx
push edi
push 4
push 0x1000
push dword [ebp - 4]
push eax
call dword [edi + 0x122d244b]
pop edi
pop ecx
test eax, eax
je 0x5e953a
push edi
mov edi, eax
xor eax, eax
push ecx
push edi
rep stosb byte es:[edi], al
pop edi
pop ecx
mov edx, dword [ebx + 0x10]
cmp ecx, edx
jl 0x5e951a
mov ecx, edx
mov esi, dword [ebx + 0x14]
add esi, dword [ebp - 0xc]
lea eax, [ebx + 0x10]
cmp dword [eax + 4], 0
je 0x5e952f
rep movsb byte es:[edi], byte [esi]
pop edi
add ebx, 0x28
pop ecx
dec ecx
jmp 0x5e94c3
pop ecx
mov dword [ebp - 0x10], 0
jmp 0x5e954e
mov dword [ebp - 0x10], 1
popal
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x5e9768
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
mov dword [ebp - 0x18], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x14], eax
mov ebx, dword [eax + 0x3c]
add eax, ebx
lea ebx, [eax + 0x18]
movzx ecx, word [eax + 0x14]
add ebx, ecx
movzx ecx, word [eax + 6]
test ecx, ecx
je 0x5e97e2
push ecx
mov ecx, dword [ebx + 0xc]
add ecx, dword [ebp - 0x14]
mov edx, dword [ebx + 0x24]
push edx
call fcn.005e970d
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
mov eax, dword [ebx + 8]
mov dword [ebp - 8], eax
push edi
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [edi + 0x124782ae]
pop edi
test eax, eax
jne 0x5e97d8
pop ecx
jmp 0x5e97e9
add ebx, 0x28
pop ecx
dec ecx
jmp 0x5e9791
mov dword [ebp - 0x18], 1
popal
mov eax, dword [ebp - 0x18]
leave
ret 4
Function at 0x5e998f
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [ebp + 0x18], 0
jne 0x5e9ae3
cmp dword [ebp + 0xc], 0
jne 0x5e9ae3
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [eax + 8]
cmp eax, 0xffffffff
je 0x5e99d6
sub eax, dword [ebp + 0x10]
js 0x5e9ae3
je 0x5e9ae3
cmp eax, dword [ebp + 0x14]
jl 0x5e9ae3
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
cmp word [eax], 0x5a4d
jne 0x5e9ae3
mov ebx, dword [eax + 0x3c]
add eax, ebx
cmp dword [eax], 0x4550
jne 0x5e9ae3
mov ebx, dword [eax + 0x50]
push edi
push 4
push 0x1000
push ebx
push 0
call dword [edi + 0x122d244b]
pop edi
test eax, eax
je 0x5e9ae3
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], eax
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x14], ebx
pop ebx
lea eax, [ebp - 0x18]
push edi
push eax
lea eax, [edi + 0x124add46]
push eax
call fcn.005e89f7
pop edi
test eax, eax
je 0x5e9ae3
lea eax, [ebp - 0x18]
push edi
push eax
lea eax, [edi + 0x124add4a]
push eax
call fcn.005e89f7
pop edi
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
mov ebx, dword [eax + 0x3c]
add eax, ebx
mov eax, dword [eax + 0x54]
mov dword [ebp - 0xc], eax
push edi
mov ecx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x1c]
mov esi, dword [esi + 4]
rep movsb byte es:[edi], byte [esi]
pop edi
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
mov dword [ebp - 4], eax
mov ebx, dword [eax + 0x3c]
add eax, ebx
lea ebx, [eax + 0x18]
movzx ecx, word [eax + 0x14]
add ebx, ecx
movzx ecx, word [eax + 6]
test ecx, ecx
je 0x5e9ad6
push ecx
mov ecx, dword [ebx + 8]
mov eax, dword [ebx + 0xc]
add eax, dword [ebp - 8]
test eax, eax
je 0x5e9ae3
push edi
mov edi, eax
xor eax, eax
push ecx
push edi
rep stosb byte es:[edi], al
pop edi
pop ecx
mov edx, dword [ebx + 0x10]
cmp ecx, edx
jl 0x5e9ac3
mov ecx, edx
mov esi, dword [ebx + 0x14]
add esi, dword [ebp - 4]
rep movsb byte es:[edi], byte [esi]
pop edi
add ebx, 0x28
pop ecx
dec ecx
jmp 0x5e9a91
push dword [ebp + 8]
call fcn.005ea885
jmp 0x5e9aea
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
leave
ret 0x14
Function at 0x5e9e75
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
pushal
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x5e9f64
mov ecx, eax
mov ebx, dword [ecx + 0x3c]
add ecx, ebx
mov ecx, dword [ecx + 0x7c]
test ecx, ecx
je 0x5e9f64
mov dword [ebp - 4], ecx
mov ebx, eax
mov ecx, dword [ebx + 0x3c]
add ebx, ecx
mov ebx, dword [ebx + 0x78]
add ebx, eax
mov dword [ebp - 8], ebx
mov eax, dword [ebp + 0xc]
test eax, 0xffff0000
je 0x5e9f10
mov ecx, dword [ebx + 0x18]
test ecx, ecx
je 0x5e9f64
dec ecx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x20]
add eax, dword [ebp - 0xc]
push ecx
shl ecx, 2
add eax, ecx
mov eax, dword [eax]
add eax, dword [ebp - 0xc]
push edi
push dword [ebp + 0xc]
push eax
call dword [edi + 0x124adea6]
pop edi
pop ecx
test eax, eax
jne 0x5e9ec9
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x24]
add eax, dword [ebp - 0xc]
shl ecx, 1
add eax, ecx
movzx ecx, word [eax]
jmp 0x5e9f16
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebx + 0x10]
mov ebx, dword [ebp - 8]
mov eax, dword [ebx + 0x14]
cmp ecx, eax
jge 0x5e9f64
mov eax, dword [ebp - 0xc]
mov edx, dword [ebx + 0x1c]
add edx, eax
shl ecx, 2
add edx, ecx
cmp dword [edx], 0
je 0x5e9f64
mov ebx, dword [edx]
add eax, ebx
mov dword [ebp - 0x10], eax
cmp eax, dword [ebp - 8]
jle 0x5e9f64
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jge 0x5e9f64
push dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.005e9dbe
mov dword [ebp - 0x10], eax
popal
mov eax, dword [ebp - 0x10]
leave
ret 8
Function at 0x4012e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.0041345e
mov esi, eax
cmp esi, 0x100000
pop ecx
jbe 0x401306
xor eax, eax
jmp 0x4013c7
push edi
lea edi, [esi + 0x80]
push edi
call fcn.00410937
pop ecx
push ebx
push 0x80
push 3
push ebx
push 1
push connect
push dword [ebp + 8]
mov dword [0x44f76c], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
jne 0x401374
push dword [0x44f76c]
mov byte [0x44f768], bl
mov byte [0x44f769], bl
mov dword [0x44f774], ebx
call fcn.0041097e
push dword [0x44f770]
mov dword [0x44f76c], ebx
call fcn.0041097e
pop ecx
pop ecx
mov dword [0x44f770], ebx
xor eax, eax
jmp 0x4013c6
push ebx
lea ecx, [ebp - 4]
push ecx
push esi
push dword [0x44f76c]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
mov dword [0x44f774], esi
call fcn.00410937
push esi
push dword [0x44f76c]
mov dword [0x44f770], eax
push eax
call fcn.00421200
push esi
push dword [0x44f76c]
push dword [0x44f770]
call fcn.00421200
xor eax, eax
add esp, 0x1c
inc eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4013cb
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
xor ebx, ebx
cmp byte [0x44f780], bl
push esi
push edi
je 0x4013ec
xor ebp, ebp
inc ebp
mov byte [0x44f780], bl
mov byte [0x44f781], 1
jmp 0x4013fc
push 2
pop ebp
mov byte [0x44f781], bl
mov byte [0x44f780], 1
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1388
call esi
cmp ebp, 1
jne 0x401416
cmp dword [0x44f778], ebx
ja 0x401409
cmp ebp, 2
jne 0x401423
cmp dword [0x44f77c], ebx
ja 0x401409
push 0x3e8
call esi
push dword [esp + 0x18]
mov dword [esp + 0x14], ebx
call fcn.0041345e
pop ecx
push ebx
push 0x80
push 3
push ebx
push 1
push connect
push dword [esp + 0x30]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40149b
push dword [0x44f784]
mov byte [0x44f780], bl
mov dword [0x44f78c], ebx
mov byte [0x44f781], bl
mov dword [0x44f790], ebx
call fcn.0041097e
push dword [0x44f788]
mov dword [0x44f784], ebx
call fcn.0041097e
pop ecx
pop ecx
mov dword [0x44f788], ebx
xor eax, eax
jmp 0x40150b
cmp ebp, 1
jne 0x4014cf
push dword [0x44f784]
call fcn.0041097e
push esi
call fcn.00410937
pop ecx
pop ecx
push ebx
lea ecx, [esp + 0x14]
push ecx
push esi
push eax
push edi
mov dword [0x44f784], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [0x44f78c], esi
jmp 0x401501
cmp ebp, 2
jne 0x401501
push dword [0x44f788]
call fcn.0041097e
push esi
call fcn.00410937
pop ecx
pop ecx
push ebx
lea ecx, [esp + 0x14]
push ecx
push esi
push eax
push edi
mov dword [0x44f788], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [0x44f790], esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x4015bb
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push dword [ebp + 8]
xor ebx, ebx
mov byte [ebp - 1], bl
call fcn.0041345e
mov esi, eax
push esi
call fcn.00410937
pop ecx
pop ecx
push ebx
push 0x80
push 3
push ebx
push 1
push connect
push dword [ebp + 8]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40162b
push ebx
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push dword [ebp - 8]
call fcn.0040156c
test al, al
pop ecx
pop ecx
je 0x40162b
mov byte [ebp - 1], 1
push dword [ebp - 8]
call fcn.0041097e
mov al, byte [ebp - 1]
pop ecx
pop edi
pop esi
cmp al, bl
pop ebx
je 0x401645
mov byte [0x44f795], 1
leave
ret
Function at 0x401b8d
Capabilities:
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 8], 0
push ebx
push esi
push edi
push dword [ebp + 0xc]
mov byte [ebp - 1], 0
call fcn.00410937
push dword [ebp + 0xc]
mov ebx, eax
push dword [ebp + 8]
push ebx
call fcn.00421200
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.0041a106
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x1c
mov edi, 0x12c
push edi
call esi
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.0041a106
add esp, 0xc
push edi
call esi
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.0041a106
add esp, 0xc
push edi
call esi
cmp byte [ebx], 0x4d
jne 0x401c65
cmp byte [ebx + 1], 0x5a
jne 0x401c65
push 0x26
lea eax, [ebx + 0x4e]
push str.This_program_cannot_be_run_in_DOS_mode
push eax
call fcn.004215a0
add esp, 0xc
test eax, eax
jne 0x401c65
mov esi, 0x80
push esi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
push esi
push 2
push 0
push 2
push 0x40000000
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x401c5e
mov esi, dword [ebp + 0xc]
push 0
lea eax, [ebp - 8]
push eax
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 8], esi
jne 0x401c5e
mov byte [ebp - 1], 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call fcn.0041097e
mov al, byte [ebp - 1]
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401c74
Capabilities:
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
push 0x41
pop ecx
xor eax, eax
xor ebx, ebx
mov byte [ebp - 0x158], bl
lea edi, [ebp - 0x157]
rep stosd dword es:[edi], eax
push 0x458ff0
lea eax, [ebp - 0x158]
push eax
call esi
lea eax, [ebp - 0x158]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp + eax - 0x158]
push 0x27
push eax
call fcn.00413365
push 0x500000
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 8]
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call fcn.0040eab8
add esp, 0x1c
test al, al
je 0x401e23
push 0x10
pop ecx
xor eax, eax
push 0x3f
mov byte [ebp - 0x50], bl
lea edi, [ebp - 0x4f]
rep stosd dword es:[edi], eax
pop ecx
push dword [ebp + 0xc]
mov byte [ebp - 0x258], bl
lea edi, [ebp - 0x257]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x258]
push eax
call esi
lea eax, [ebp - 0x258]
push eax
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0041a106
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0041a235
push 0x40
push dword [ebp + 0xc]
lea eax, [ebp - 0x50]
push eax
call fcn.00421d71
add esp, 0x24
test eax, eax
jne 0x401e1a
push dword [ebp - 4]
call fcn.00410937
push dword [ebp - 4]
mov edi, eax
push dword [ebp - 8]
push edi
call fcn.00421200
push dword [ebp - 4]
push edi
call fcn.00401647
add esp, 0x18
test al, al
je 0x401e0f
push edi
call fcn.0041097e
pop ecx
mov esi, 0x80
push esi
lea eax, [ebp - 0x158]
push eax
xor edi, edi
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebx
push esi
push 2
push ebx
push 2
push 0x40000000
lea eax, [ebp - 0x158]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x401e1a
push ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 4]
jne 0x401e02
push 0x41
lea eax, [ebp - 0x50]
push eax
push 0x4594f3
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push dword [ebp - 8]
mov byte [0x4594f2], 1
call fcn.0041097e
pop ecx
mov al, 1
jmp 0x401e25
lea eax, [ebp - 0x158]
push eax
call fcn.00414987
pop ecx
cmp edi, ebx
je 0x401e1a
push edi
call fcn.0041097e
pop ecx
push dword [ebp - 8]
call fcn.0041097e
pop ecx
xor al, al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401e2a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push dword [ebp + 8]
xor ebx, ebx
mov byte [ebp - 1], bl
call fcn.0041345e
mov esi, eax
cmp esi, 0xc350
pop ecx
jae 0x401e4e
xor al, al
jmp 0x401eb9
push edi
push esi
call fcn.00410937
push esi
mov edi, eax
push ebx
push edi
call fcn.00421540
add esp, 0x10
push ebx
push 0x80
push 3
push ebx
push 1
push connect
push dword [ebp + 8]
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0xc], eax
je 0x401eae
push ebx
lea ecx, [ebp - 8]
push ecx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push edi
call fcn.00401647
test al, al
pop ecx
pop ecx
je 0x401eae
mov byte [ebp - 1], 1
push edi
call fcn.0041097e
mov al, byte [ebp - 1]
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401ebd
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push ebx
xor ebx, ebx
cmp byte [0x4594f2], bl
jne 0x401ed8
xor al, al
jmp 0x401f9a
push edi
push 0x41
pop ecx
xor eax, eax
mov byte [ebp - 0x14c], bl
lea edi, [ebp - 0x14b]
rep stosd dword es:[edi], eax
push 0x458ff0
lea eax, [ebp - 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp + eax - 0x14c]
push 0x27
push eax
call fcn.00413365
lea eax, [ebp - 0x14c]
push eax
call fcn.004136ca
add esp, 0xc
test eax, eax
je 0x401f97
push 0x10
xor eax, eax
pop ecx
mov byte [ebp - 0x44], bl
lea edi, [ebp - 0x43]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x14c]
push eax
call fcn.0041a2c3
test eax, eax
pop ecx
pop ecx
je 0x401f97
push 0x40
lea eax, [ebp - 0x44]
push 0x4594f3
push eax
call fcn.00421d71
add esp, 0xc
test eax, eax
jne 0x401f91
lea eax, [ebp - 0x14c]
push eax
call fcn.00401e2a
test al, al
pop ecx
je 0x401f91
push ebx
push dword [ebp + 8]
lea eax, [ebp - 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x401f91
mov al, 1
jmp 0x401f99
mov byte [0x4594f2], bl
xor al, al
pop edi
pop ebx
leave
ret
Function at 0x40245c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push dword [0x4594ac]
xor ebx, ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041489d
mov esi, eax
add esp, 0xc
cmp esi, ebx
jne 0x402484
xor al, al
jmp 0x4024ed
push edi
push 7
pop ecx
xor eax, eax
mov byte [ebp - 0x20], bl
lea edi, [ebp - 0x1f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00411e7c
add esp, 0xc
push ebx
push 0xa
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.WS2_32.dll_send]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push esi
call fcn.004032d6
cmp eax, 1
pop ecx
pop ecx
pop edi
jne 0x4024e4
push ebx
push 0x44f798
push esi
call fcn.00402936
add esp, 0xc
test eax, eax
je 0x4024e4
mov bl, 1
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov al, bl
pop esi
pop ebx
leave
ret