joyce8/EMBER2024-capa huggingface dataset:
Function at 0x481130
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d6648
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x508164]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0x10]
cmp eax, 0xffffffff
je 0x481178
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4812fc
mov dword [edi + 0x10], 0xffffffff
mov eax, dword [edi + 0x18]
xorps xmm0, xmm0
movlpd qword [ebp - 0x24], xmm0
mov dword [ebp - 0x18], 0xffffffff
test eax, eax
je 0x4811c8
mov edx, dword [edi + 0x14]
mov ecx, dword [ebp + 8]
push eax
call fcn.004667d0
add esp, 4
test eax, eax
jne 0x481301
mov edx, dword [edi + 0x14]
or ecx, 0xffffffff
push 0x50ff20
push dword [edi + 0x18]
call dword [0x50ff00]
mov ebx, dword [edi + 0x18]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
jmp 0x4811d1
mov eax, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
cmp byte [edi + 0x2c], 0
mov dword [ebp - 0x10], ebx
je 0x4812a4
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
mov dword [ebp - 4], 0
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x20], esi
cmp esi, 0xffffffff
je 0x4812d4
mov eax, dword [ebp - 0x14]
cmp eax, dword [edi + 0x24]
ja 0x481297
jb 0x481221
cmp ebx, dword [edi + 0x20]
jae 0x481297
push 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
push eax
push 0x100000
push dword [edi + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4812d4
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x481294
mov edx, dword [edi + 0x14]
mov ecx, dword [ebp + 8]
push ebx
call fcn.004667d0
add esp, 4
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x4812cf
mov edx, dword [edi + 0x14]
mov ecx, dword [ebp - 0x18]
push 0x50ff20
push ebx
call dword [0x50ff00]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
add eax, ebx
mov dword [ebp - 0x10], eax
adc ecx, 0
mov dword [ebp - 0x14], ecx
cmp ecx, dword [edi + 0x24]
jb 0x481221
ja 0x481294
cmp eax, dword [edi + 0x20]
jb 0x481221
mov ebx, dword [ebp - 0x10]
cmp esi, 0xffffffff
je 0x4812a4
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call eax
mov eax, dword [ebp - 0x18]
cmp dword [edi + 0x28], eax
jne 0x4812fc
cmp ebx, dword [edi + 0x20]
jne 0x4812fc
mov eax, dword [ebp - 0x14]
cmp eax, dword [edi + 0x24]
jne 0x4812fc
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x1c]
jmp 0x4812d9
mov edi, 0x80004005
cmp esi, 0xffffffff
je 0x4812e6
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, 0x80004005
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x48c150
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d7523
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x508164]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.boost::exception_detail::clone_base.0
mov ebx, dword [ebp + 8]
lea eax, [esi + 8]
xorps xmm0, xmm0
mov dword [esi + 4], vtable.std::exception.0
push eax
movq qword [eax], xmm0
lea eax, [ebx + 8]
mov dword [ebp - 4], 0
push eax
call fcn.004a4efe
mov dword [esi + 4], vtable.boost::system::system_error.0
add esp, 8
movq xmm0, qword [ebx + 0x10]
movq qword [esi + 0x10], xmm0
mov eax, dword [ebx + 0x18]
mov dword [esi + 0x18], eax
mov dword [esi + 4], vtable.boost::lock_error.0
lea edi, [esi + 0x1c]
mov byte [ebp - 4], 1
mov dword [edi], vtable.boost::exception.0
mov ecx, dword [ebx + 0x20]
mov dword [ebp + 8], edi
mov dword [edi + 4], ecx
test ecx, ecx
je 0x48c1e6
mov eax, dword [ecx]
call dword [eax + 0xc]
mov eax, dword [ebx + 0x24]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0x28]
mov dword [edi + 0xc], eax
mov eax, dword [ebx + 0x2c]
mov dword [edi + 0x10], eax
mov eax, dword [ebx + 0x30]
mov dword [edi + 0x14], eax
mov eax, esi
mov dword [esi], vtable.boost::wrapexcept_class_boost::lock_error_.0
mov dword [esi + 4], vtable.boost::wrapexcept_class_boost::lock_error_.1.0
mov dword [edi], vtable.boost::wrapexcept_class_boost::lock_error_.2.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x48d5c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d7688
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x508164]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x508148]
cmp eax, 0xffffffff
jne 0x48d5f4
xor ebx, ebx
jmp 0x48d5fd
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x48d6f7
mov eax, dword [ebx + 0x18]
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [ebx + 0xc]
test eax, eax
jne 0x48d627
test esi, esi
je 0x48d6b4
test esi, esi
je 0x48d673
nop dword [eax + eax]
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x48d65d
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
push eax
call edi
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call edi
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x48d630
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x48d618
mov esi, dword [ebx + 0x14]
mov esi, dword [esi]
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x48d694
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x48d694
push eax
mov eax, dword [esi + 0x14]
push ecx
call eax
add esp, 8
push esi
lea ecx, [ebx + 0x14]
call fcn.0040a600
push 0x20
push eax
call fcn.0048d8eb
mov eax, dword [ebx + 0x18]
add esp, 8
test eax, eax
jne 0x48d677
jmp 0x48d612
push 0x48ca60
push 0x50c46c
call fcn.0048c7e0
mov eax, dword [0x508148]
add esp, 8
cmp eax, 0xffffffff
je 0x48d6d9
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x48d6f7
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax]
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48d710
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push esi
mov esi, ecx
mov edx, dword [esi]
lea eax, [edx + 0x10]
push eax
push 4
push edx
push 0x48d770
push 0
push 0
call fcn.004b3b90
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x48d739
pop esi
xor al, al
pop ebx
ret
mov eax, dword [esi]
push edi
add eax, 4
lock inc dword [eax]
mov edi, dword [esi]
mov eax, dword [edi + 8]
test eax, eax
je 0x48d757
cmp eax, 0xffffffff
je 0x48d757
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 8], ebx
mov eax, dword [esi]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
mov al, 1
pop ebx
ret

Function at 0x48fb1f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x4c21d2
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004c2051

Function at 0x4c741f
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004c6d8d

Function at 0x4c742a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004c6fc8
Function at 0x4176fa
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041756b

Function at 0x417af4
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0040a3e0
mov eax, dword [0x5c1a00]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.004156fd
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x417b36
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x417c92
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00420910
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x5c4070]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.00418893
mov ecx, dword [esi*4 + 0x5c4070]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x417c8b
cmp eax, dword [edi + ecx + 0x24]
jne 0x417c8b
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x417c8b
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00418893
add esp, 0x14
test edx, edx
jl 0x417c8b
jg 0x417c01
test eax, eax
jb 0x417c8b
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x417c8b
jl 0x417c1b
cmp dword [ebp - 0x1008], eax
ja 0x417c8b
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x417c39
test ebx, ebx
je 0x417c72
cmp ecx, edi
jae 0x417c72
mov al, byte [ecx]
cmp al, 0xd
jne 0x417c53
lea eax, [edi - 1]
cmp ecx, eax
jae 0x417c5f
cmp byte [ecx + 1], 0xa
jne 0x417c5f
inc ecx
jmp 0x417c5f
movzx eax, al
movsx eax, byte [eax + 0x5c1cd0]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x417c39
cmp edx, ebx
jne 0x417c39
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x417c90
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00409a3b
leave
ret
Function at 0x417d31
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x5c4070]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x417d71
cmp byte [ebx], 0xa
jne 0x417d71
or byte [eax + edi + 0x28], 4
jmp 0x417d76
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x417e74
mov al, byte [edx]
cmp al, 0x1a
je 0x417e56
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x417da5
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x417dca
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x417dd4
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x417d87
jmp 0x417e74
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x417e51
cmp dword [ebp - 0xc], 0
je 0x417e51
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x5c4070]
test byte [eax + edi + 0x28], 0x48
je 0x417e2b
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x417e16
mov byte [esi], dl
jmp 0x417e27
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x5c4070]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x417e74
cmp byte [ebp - 1], 0xa
jne 0x417e3a
cmp esi, ebx
jne 0x417e3a
mov byte [esi], 0xa
jmp 0x417e73
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.004188b1
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x417e74
mov byte [esi], 0xd
jmp 0x417e73
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x5c4070]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x417e70
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x417e74
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x417e7d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x5c4070]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x417ec0
cmp word [esi], dx
jne 0x417ec0
or byte [edi + eax + 0x28], 4
jmp 0x417ec5
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x418018
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x417ff8
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x417f07
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x417f3d
cmp eax, edx
jae 0x417f49
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x417edf
jmp 0x418018
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x417ff4
cmp dword [ebp - 0x14], 0
je 0x417ff4
mov eax, dword [ebx*4 + 0x5c4070]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x417fcc
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x417f95
mov word [esi], cx
jmp 0x417fc8
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x5c4070]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x5c4070]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x5c4070]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x418018
pop ebx
cmp word [ebp - 4], bx
jne 0x417fdd
cmp esi, dword [ebp + 0xc]
jne 0x417fdd
mov word [esi], bx
jmp 0x418015
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.004188b1
add esp, 0x10
cmp word [ebp - 4], bx
je 0x418018
push 0xd
jmp 0x418011
mov ecx, dword [ebx*4 + 0x5c4070]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x41800f
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x418018
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x402272
Capabilities:
Create process on windows
Delete file
Extract resource via kernel32 functions
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42e7b6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x120
mov dword [ebp - 0x12c], ecx
mov dword [ebp - 4], 0
push 0x43c678
push 0xd2
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0
jne 0x4022d2
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004245aa
jmp 0x40245a
mov eax, dword [ebp - 0x128]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x120], eax
mov ecx, dword [ebp - 0x128]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
jne 0x402319
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004245aa
jmp 0x40245a
mov edx, dword [ebp - 0x120]
push edx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x402345
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004245aa
jmp 0x40245a
mov eax, dword [ebp - 0x120]
push eax
mov ecx, dword [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
mov edx, dword [ebp - 0x10]
push edx
call fcn.00414c40
add esp, 0xc
lea eax, [ebp - 0x114]
push eax
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0x43c67c
lea ecx, [ebp - 0x114]
push ecx
call fcn.00414aa0
add esp, 8
lea edx, [ebp - 0x114]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0
jne 0x4023d8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004245aa
jmp 0x40245a
push 0
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x120]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x124]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0x124]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x440ea0
lea ecx, [ebp + 8]
call fcn.00402c30
push eax
lea eax, [ebp - 0x114]
push eax
push 0x43c688
mov ecx, dword [ebp - 0x12c]
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
je 0x40242f
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004245aa
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x403a2b
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
mov ecx, dword [0x440ea4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [0x440ea4]
mov dword [ebp - 4], edx
mov dword [ebp - 8], 0
jmp 0x403a68
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 5
jge 0x403a81
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov al, byte [edx + 0x43c778]
mov byte [ecx], al
jmp 0x403a5f
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0xc]
push edx
push 5
mov eax, dword [0x440ea4]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret

Function at 0x403a9b
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
mov ecx, dword [0x440ea4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [0x440ea4]
mov dword [ebp - 4], edx
mov dword [ebp - 8], 0
jmp 0x403ad8
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 5
jge 0x403af1
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov al, byte [edx + 0x43c780]
mov byte [ecx], al
jmp 0x403acf
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0xc]
push edx
push 5
mov eax, dword [0x440ea4]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret

Function at 0x405333
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 5
push 0
push 0
mov ecx, dword [ebp - 8]
add ecx, 0x54
call fcn.00402c30
push eax
push 0x43c800
mov ecx, dword [ebp - 8]
call fcn.00405790
mov ecx, eax
call fcn.004056c0
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x20
jg 0x405384
push 0
push 0
push 0x43c808
call fcn.00428311
xor eax, eax
jmp 0x405389
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x405980
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ec8e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x108
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x110], 0
mov dword [ebp - 4], 3
mov ecx, dword [ebp - 0x114]
add ecx, 4
call fcn.00402c30
push eax
push 0x100
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp + 0x14]
call fcn.00402c30
push eax
lea ecx, [ebp + 0x10]
call fcn.00402c30
push eax
lea ecx, [ebp + 0xc]
call fcn.00402c30
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0x10c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00424618
mov edx, dword [ebp - 0x110]
or edx, 1
mov dword [ebp - 0x110], edx
mov byte [ebp - 4], 2
lea ecx, [ebp + 0xc]
call fcn.004245aa
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x10]
call fcn.004245aa
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x14]
call fcn.004245aa
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x405a46
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ecaa
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
add ecx, 4
call fcn.00402c30
push eax
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp + 0xc]
call fcn.00402c30
push eax
lea ecx, [ebp + 8]
call fcn.00402c30
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.004245aa
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.004245aa
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x406403
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
cmp dword [ebp + 8], 0xffffffff
je 0x40642a
cmp dword [ebp + 0xc], 0
je 0x40642a
cmp dword [ebp + 0x10], 0
je 0x40642a
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov cl, byte [eax + 0x54]
test ecx, ecx
jne 0x406431
xor al, al
jmp 0x4064cb
push 0x1020
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0
push 0x14
push 0
mov edx, dword [ebp - 0x10]
push edx
call fcn.00414a30
add esp, 0xc
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x10]
add edx, 0x1c
push edx
call fcn.00414320
add esp, 0xc
mov eax, dword [ebp - 0x10]
add eax, 0x1c
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x18], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 0x10]
mov dword [edx + 0x14], eax
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 0x101c], 1
push 0
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 1
mov edx, dword [ebp - 0x10]
add edx, 0x14
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_WSASend]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4064c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x4064c9
xor al, al
jmp 0x4064cb
mov al, 1
mov esp, ebp
pop ebp
ret 0xc