joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4199a0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00410803
xor ebx, ebx
cmp dword [0x42aed4], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x419a76
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x419b56
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x419b56
push eax
call fcn.00410795
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x42aed4], eax
call esi
push eax
call fcn.00410795
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42aed8], eax
call esi
push eax
call fcn.00410795
mov dword [0x42aedc], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00413ed4
test eax, eax
pop ecx
pop ecx
je 0x419a44
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040d812
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x419a76
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00410795
cmp eax, ebx
pop ecx
mov dword [0x42aee4], eax
je 0x419a76
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00410795
pop ecx
mov dword [0x42aee0], eax
mov eax, dword [0x42aee0]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x419afb
cmp dword [0x42aee4], ecx
je 0x419afb
push eax
call fcn.0041080c
push dword [0x42aee4]
mov esi, eax
call fcn.0041080c
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x419afb
cmp edi, ebx
je 0x419afb
call esi
cmp eax, ebx
je 0x419ac8
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x419ac8
test byte [ebp - 0x18], 1
jne 0x419afb
lea eax, [ebp - 0x10]
push eax
call fcn.00413f0b
test eax, eax
pop ecx
je 0x419ae3
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040d812
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x419af2
or dword [ebp + 0x10], 0x200000
jmp 0x419b36
or dword [ebp + 0x10], 0x40000
jmp 0x419b36
mov eax, dword [0x42aed8]
cmp eax, dword [ebp - 8]
je 0x419b36
push eax
call fcn.0041080c
cmp eax, ebx
pop ecx
je 0x419b36
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x419b36
mov eax, dword [0x42aedc]
cmp eax, dword [ebp - 8]
je 0x419b36
push eax
call fcn.0041080c
cmp eax, ebx
pop ecx
je 0x419b36
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42aed4]
call fcn.0041080c
cmp eax, ebx
pop ecx
je 0x419b56
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x419b58
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4a28cf
Capabilities:
Encode data using xor

Disassembly:
rcl edx, cl
sbb cl, byte [eax]
xlatb
frstor dword [esi - 0x1b]
dec esi
cmp edi, dword [eax - 0x25774bce]
in al, 0x68
xor eax, edx
test dword [ebx + 0x4855d7eb], ebx
mov bl, 0xc3
outsd dx, dword [esi]
mov bh, ch
mov dl, byte [edx]
mov byte [ecx + 0x66], al
and byte [edi], 0x22
jbe 0x4a291b
daa
and dh, byte [esi + 0x24]
cmp byte [ebx + 5], 0x6f
inc ebx
mov ah, 0x2d
aam 1
lodsd eax, dword [esi]
sub byte [edi], dl
mov cl, byte [esi + edx - 0x51]
dec edi
test al, 0xbd
sub dl, byte [edi]
out 0xd8, eax
dec esi
enter 0x3d0a, 0x31
add dword [ebp + 0x6a], edx
sti
xchg ebp, eax
xor ecx, dword [ecx - 0x73]
xchg esi, eax
jae 0x4a28f3
lea edx, [esi - 0x22bb2b8d]
or dword [ebp - 0x1a2fce23], esp
inc esp
fisttp qword [ecx]
movsd dword es:[edi], dword [esi]
fnsave dword [ecx]
shl ch, 1
retf 0x88e7

Function at 0x4b9b5f
Capabilities:
Encode data using xor

Disassembly:
and eax, 0x41903051
nop
sbb bh, byte [esi]
cwde
xchg esi, eax
sar byte [ecx], cl
mov ch, 0x6c
jl 0x4b9bac
dec byte [eax + 0x25]
les esp, [eax - 0x1ee88f0e]
pop ds
pop ebp
inc ebx
call 0xad590adb
dec ebp
add dword [ebp + 9], ecx
or eax, 0x931d1ddc
mov ebp, 0xb711c3a9
scasb al, byte es:[edi]
sub eax, 0xe098a705
invalid
sub ebp, esi
push edi
movsb byte es:[edi], byte [esi]
aad 0xb4
das
adc esp, dword [ecx - 0x5f]
sub eax, 0xc8ff3e2c
out 0x11, eax
test dl, dl
movsd dword es:[edi], dword [esi]
sbb al, byte [ebp + 0x23]
or esp, ebx
in eax, dx
sbb esp, dword [esi + 0x1c]
shr al, 1
push eax
or eax, 0xdf35eb42
lcall 0x874c, 0x540ff5d6
mov ebx, 0x7d0f1394
call 0xeb8da8d2
xor eax, 0xf5d69adf
andps xmm1, xmmword [edi + eax*4 - 0x45]
xchg esp, eax
adc ecx, dword [edi]
jge 0x4b9b28
xchg dword [ebx + 0x7d0f1394], edi
xchg edi, eax
sub bh, byte [edi]
daa
in al, 0x8c
mul esp
jge 0x4b9b7d
mov al, 0x89
out dx, al
add ah, bh
invalid
lock sub ecx, dword [0xb34e06ef]
adc byte [ecx + edi*8], ah
scasd eax, dword es:[edi]
inc edi
paddusb mm0, qword [edx]
enter 0xffffffffffffc379, 0xffffffffffffffa1
lds ebx, [ecx - 0x15]
jns 0x4b9b8a
xor edi, dword [edi]
xchg esi, eax
rol byte [esi], cl
insd dword es:[edi], dx
fcomp qword [ecx + ecx*2]
inc edi
xchg ebx, eax
ror dword [edx - 0x7c6aaf26], 1
aas
imul esp, dword [ebp + 0x7aefca47], 0x13
invalid
Function at 0x4bb79d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c33c0
cmp edx, dword [eax]
je 0x4bb7bf
add eax, 8
inc ecx
cmp eax, 0x4c3450
jl 0x4bb7b0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c33c0]
jne 0x4bb8ed
mov eax, dword [0x4c8df0]
cmp eax, 1
je 0x4bb8c7
test eax, eax
jne 0x4bb7f0
cmp dword [0x4c32e8], 1
je 0x4bb8c7
cmp edx, 0xfc
je 0x4bb8ed
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bb827
lea eax, [ebp - 0x1a4]
push 0x4c09d0
push eax
call fcn.004bc180
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bc610
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bb86a
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bc610
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c09cc
push edi
call fcn.004be4e0
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4c09b0
push eax
call fcn.004bc180
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bc190
lea eax, [ebp - 0xa0]
push 0x4c09ac
push eax
call fcn.004bc190
push dword [esi + 0x4c33c4]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bc190
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4c0984
push eax
call fcn.004be454
add esp, 0x2c
pop edi
jmp 0x4bb8ed
lea eax, [ebp + 8]
lea esi, [esi + 0x4c33c4]
push 0
push eax
push dword [esi]
call fcn.004bc610
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4031d4
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.WS2_32.dll_gethostbyname
push ecx
mov esi, eax
test eax, eax
je 0x40322d
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
mov dword [esp], ebx
call fcn.00409bfc
mov word [ebx], 2
mov eax, dword [esi + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebx + 4], eax
movzx eax, word [ebp + 0xc]
mov dword [esp], eax
call sub.WS2_32.dll_htons
push edx
mov word [ebx + 2], ax
mov al, 1
jmp 0x40322f
xor eax, eax
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x403236
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x40
mov ebx, dword [ebp + 8]
test byte [ebp + 0xc], 1
je 0x403268
mov dword [ebp - 0x18], 1
lea eax, [ebp - 0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x8004667e
mov dword [esp], ebx
call sub.WS2_32.dll_ioctlsocket
sub esp, 0xc
test byte [ebp + 0xc], 2
je 0x4032ff
mov byte [ebp - 0x18], 1
mov dword [esp + 0x10], 1
lea esi, [ebp - 0x18]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 8
mov dword [esp + 4], 0xffff
mov dword [esp], ebx
call sub.WS2_32.dll_setsockopt
sub esp, 0x14
test eax, eax
jne 0x4032ff
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x10], 0x2bf20
mov dword [ebp - 0xc], 0x1388
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xc
lea eax, [ebp - 0x14]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x98000004
mov dword [esp], ebx
call sub.WS2_32.dll_WSAIoctl
sub esp, 0x24
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x403a0d
Capabilities:
Get socket status
Receive data
Receive data on socket
Send data
Send data on socket
Send http request

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x20
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov esi, dword [ebx]
cmp esi, 1
je 0x403a4a
jb 0x403a36
cmp esi, 2
je 0x403a5e
cmp esi, 3
jne 0x403a92
jmp 0x403a7e
mov dword [ebp + 0x10], ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 8], eax
add esp, 0x20
pop ebx
pop esi
pop ebp
jmp fcn.00403306
mov dword [ebp + 0x10], ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 8], eax
add esp, 0x20
pop ebx
pop esi
pop ebp
jmp fcn.0040349b
lea esi, [ebx + 0x68]
mov dword [esp + 0x10], esi
add ebx, 0x48
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0040366c
jmp 0x403a94
mov dword [ebp + 0x10], ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 8], eax
add esp, 0x20
pop ebx
pop esi
pop ebp
jmp fcn.0040394e
mov al, 1
add esp, 0x20
pop ebx
pop esi
pop ebp
ret
Function at 0x403ace
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x14c
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
test esi, esi
jne 0x403aed
mov dword [ebp + 0x14], 0
jmp 0x403b02
cmp dword [ebp + 0x14], 0xffffffff
jne 0x403b02
xor eax, eax
or ecx, 0xffffffff
mov edi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp + 0x14], ecx
mov eax, dword [ebp + 0x14]
add eax, 5
mov dword [ebp - 0x130], eax
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov edi, eax
test eax, eax
jne 0x403b24
or eax, 0xffffffff
jmp 0x403c78
mov eax, dword [ebp + 0x14]
test eax, eax
jle 0x403b71
cmp ebx, dword [0x410678]
lea edx, [edi + 5]
jne 0x403b61
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], edx
mov dword [esp + 8], esi
mov dword [esp + 4], 0x415bf4
mov eax, dword [0x415c04]
mov dword [esp], eax
call fcn.0040cf1f
jmp 0x403b71
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], edx
call fcn.00409cc0
inc dword [ebp + 0x14]
mov dword [esp + 8], 4
lea eax, [ebp + 0x14]
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.00409cc0
mov eax, dword [ebp + 0xc]
mov byte [edi + 4], al
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x12c], eax
xor esi, esi
or edx, 0xffffffff
jmp 0x403c62
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x11c], 1
mov dword [ebp - 0x124], 0xa
mov dword [ebp - 0x120], 0
lea eax, [ebp - 0x124]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
lea eax, [ebp - 0x11c]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
lea eax, [ebx + 1]
mov dword [esp], eax
mov dword [ebp - 0x134], edx
call sub.WS2_32.dll_select
sub esp, 0x14
test eax, eax
mov edx, dword [ebp - 0x134]
jle 0x403c6e
lea eax, [ebp - 0x11c]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.WS2_32.dll___WSAFDIsSet
push ecx
push ecx
test eax, eax
mov edx, dword [ebp - 0x134]
je 0x403c5a
mov dword [esp + 0xc], 0
mov eax, dword [ebp - 0x12c]
mov dword [esp + 8], eax
lea eax, [edi + esi]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.WS2_32.dll_send
sub esp, 0x10
mov edx, eax
cmp eax, 0xffffffff
je 0x403b1c
add esi, edx
sub dword [ebp - 0x12c], edx
cmp esi, dword [ebp - 0x130]
jb 0x403ba7
inc edx
je 0x403b1c
lea eax, [esi - 5]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x403fb6
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x130
lea esi, [ebp - 0x114]
lea ebx, [ebp - 0x10c]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x10c], 1
mov dword [ebp - 0x114], 0xa
mov dword [ebp - 0x110], 0
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
inc eax
mov dword [esp], eax
call sub.WS2_32.dll_select
sub esp, 0x14
cmp eax, 0
jne 0x404053
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 2
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00403ace
inc eax
jne 0x403fcd
lea eax, [ebp + 8]
mov dword [esp], eax
call fcn.00403c80
jmp 0x403fcd
jl 0x40406d
mov dword [esp + 4], ebx
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.WS2_32.dll___WSAFDIsSet
push edx
push edx
test eax, eax
setne al
jmp 0x40406f
xor eax, eax
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x40407f
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov dword [esp + 0xc], 0
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.WS2_32.dll_recv
sub esp, 0x10
mov ebx, eax
cmp eax, 0xffffffff
je 0x4040b7
test eax, eax
jne 0x4040d2
jmp 0x4040c3
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x4040d0
lea eax, [ebp + 8]
mov dword [esp], eax
call fcn.00403c80
jmp 0x4040d2
xor ebx, ebx
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x404138
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x81c
mov edi, dword [ebp + 8]
lea esi, [ebp - 0x818]
mov dword [esp + 4], esi
mov dword [esp], 0x800
call sub.KERNEL32.dll_GetLogicalDriveStringsA
push ecx
push ecx
xor ebx, ebx
test eax, eax
jne 0x40419d
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xf
jmp 0x4041b3
lea eax, [esi + ebx]
mov dword [esp], eax
call sub.KERNEL32.dll_GetDriveTypeA
push edx
mov byte [ebp + ebx - 0x816], al
mov byte [ebp + ebx - 0x815], 7
add ebx, 4
cmp byte [ebx + esi], 0
jne 0x40417f
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], 0xe
mov dword [esp], edi
call fcn.00403ace
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x404478
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe9c
mov dword [esp], 0x8003
call sub.KERNEL32.dll_SetErrorMode
push esi
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x4108de
mov dword [esp + 4], 0x204
lea ebx, [ebp - 0xd30]
mov dword [esp], ebx
call fcn.004099d7
inc eax
je 0x4046da
lea eax, [ebp - 0xe70]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.KERNEL32.dll_FindFirstFileA
push ebx
push ebx
mov esi, eax
cmp eax, 0xffffffff
je 0x404691
lea ebx, [ebp - 0xe44]
lea edi, [ebp - 0xb2c]
cmp dword [0x415284], 0
jne 0x4044ff
mov dword [esp], esi
call sub.KERNEL32.dll_FindClose
push ecx
jmp 0x404691
mov dword [esp + 4], 0x4108e2
mov dword [esp], ebx
call fcn.00409b1f
test eax, eax
je 0x404670
mov dword [esp + 4], 0x4108e4
mov dword [esp], ebx
call fcn.00409b1f
test eax, eax
je 0x404670
mov dword [esp + 4], ebx
mov eax, dword [ebp + 8]
add eax, 0x204
mov dword [esp], eax
call fcn.00409a7c
test al, al
je 0x4045fe
mov eax, dword [ebp - 0xe70]
test al, 0x10
mov edx, dword [ebp + 8]
je 0x40458a
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._d_a_s_a_s_a
mov dword [esp + 4], 0x800
lea edx, [ebp - 0x818]
mov dword [esp], edx
mov dword [ebp - 0xe7c], edx
call fcn.004099d7
jmp 0x4045ce
mov dword [esp + 0x1c], edx
mov edx, dword [ebp - 0xe50]
mov dword [esp + 0x14], edx
mov edx, dword [ebp - 0xe54]
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._d_a_s_a_I64u_a_s_a
mov dword [esp + 4], 0x800
lea edx, [ebp - 0x818]
mov dword [esp], edx
mov dword [ebp - 0xe7c], edx
call fcn.004099d7
cmp eax, 0xffffffff
mov edx, dword [ebp - 0xe7c]
je 0x404670
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
mov dword [esp + 4], 0x13
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x30c]
mov dword [esp], eax
call fcn.00403ace
test byte [ebp - 0xe70], 0x10
je 0x404670
mov dword [esp + 8], 0x104
mov eax, dword [ebp + 8]
add eax, 0x204
mov dword [esp + 4], eax
lea eax, [ebp - 0x928]
mov dword [esp], eax
call fcn.00409768
mov dword [esp + 0x10], ebx
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x4108e7
mov dword [esp + 4], 0x204
mov dword [esp], edi
call fcn.004099d7
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x308]
inc edx
mov dword [ebp - 0x824], edx
mov eax, dword [eax + 0x30c]
mov dword [ebp - 0x820], eax
mov dword [esp], edi
call fcn.00404478
lea eax, [ebp - 0xe70]
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.KERNEL32.dll_FindNextFileA
push edx
push edx
test eax, eax
jne 0x4044e8
jmp 0x4044f1
mov eax, dword [ebp + 8]
cmp dword [eax + 0x308], 0
jne 0x4046da
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x14
mov eax, dword [eax + 0x30c]
mov dword [esp], eax
call fcn.00403ace
mov eax, dword [ebp + 8]
cmp byte [eax + 0x310], 0
je 0x4046da
lea eax, [ebp + 8]
mov dword [esp], eax
call fcn.00405186
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4046e2
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x8cc
mov esi, dword [ebp + 0x10]
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov edx, dword [ebp + 0xc]
mov dword [esp], edx
call fcn.00409bfc
mov dword [esp + 4], 0x4108ed
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov ebx, eax
test eax, eax
je 0x4047d3
lea edi, [ebp - 0x8b0]
mov dword [esp], edi
call fcn.0040ecca
lea esi, [ebp - 0x818]
jmp 0x40474b
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], edi
call fcn.0040ecfb
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x800
mov dword [esp + 4], 1
mov dword [esp], esi
call sub.msvcrt.dll_fread
test eax, eax
je 0x404774
cmp dword [0x415280], 0
jne 0x40473b
cmp dword [0x415280], 0
jne 0x404787
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
jmp 0x4047ea
lea eax, [ebp - 0x8b0]
mov dword [esp + 4], eax
lea eax, [ebp - 0x8c0]
mov dword [esp], eax
call fcn.0040ed87
xor esi, esi
movzx eax, byte [ebp + esi - 0x8c0]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x4108f0
mov dword [esp + 4], 2
mov edx, dword [ebp + 0xc]
lea eax, [edx + esi*2]
mov dword [esp], eax
call fcn.004099d7
inc esi
cmp esi, 0x10
jne 0x4047a1
jmp 0x40477d
mov dword [esp + 8], str.Unable_to_Open_File__
mov dword [esp + 4], esi
mov edx, dword [ebp + 0xc]
mov dword [esp], edx
call fcn.004099d7
add esp, 0x8cc
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4047f5
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.SHELL32.DLL_ShellExecuteA
sub esp, 0x18
leave
ret

Function at 0x40486b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.KERNEL32.dll_GetFileAttributesA
push edx
cmp eax, 0xffffffff
je 0x40488d
shr eax, 4
xor eax, 1
and eax, 1
jmp 0x40488f
xor eax, eax
leave
ret

Function at 0x404891
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.KERNEL32.dll_GetFileAttributesA
push ecx
cmp eax, 0xffffffff
je 0x4048b0
shr eax, 4
and eax, 1
jmp 0x4048b2
xor eax, eax
leave
ret
Function at 0x4048b4
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov dword [esp + 4], 0x4108ed
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov esi, eax
test eax, eax
je 0x4049a5
mov dword [esp + 4], 0x41090b
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov edi, eax
test eax, eax
je 0x40498a
mov ecx, 9
mov ebx, 0x8000
mov dword [esp], ebx
mov dword [ebp - 0x1c], ecx
call sub.msvcrt.dll_malloc
mov edx, eax
test eax, eax
mov ecx, dword [ebp - 0x1c]
je 0x404979
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 1
mov dword [esp], edx
mov dword [ebp - 0x20], edx
call sub.msvcrt.dll_fread
test eax, eax
mov edx, dword [ebp - 0x20]
jg 0x404945
mov eax, dword [esi + 0xc]
and eax, 0x30
cmp eax, 0x10
sete bl
jmp 0x40496f
mov dword [esp + 0xc], edi
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
call sub.msvcrt.dll_fwrite
mov ecx, dword [ebp - 0x1c]
cmp ecx, eax
mov edx, dword [ebp - 0x20]
je 0x404915
xor ebx, ebx
mov dword [esp], edx
call sub.msvcrt.dll_free
jmp 0x404980
sar ebx, 1
dec ecx
jne 0x404901
xor ebx, ebx
mov dword [esp], edi
call sub.msvcrt.dll_fclose
jmp 0x40498c
xor ebx, ebx
mov dword [esp], esi
call sub.msvcrt.dll_fclose
test bl, bl
jne 0x4049a7
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.00404831
jmp 0x4049a7
xor ebx, ebx
mov al, bl
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40504d
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x42c
mov edi, dword [ebp + 0xc]
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0
lea ebx, [ebp - 0x418]
mov dword [esp], ebx
call fcn.00409bfc
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], edi
call fcn.00409bfc
call sub.KERNEL32.dll_GetCommandLineA
mov dword [esp + 8], 0x400
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.00409768
xor edx, edx
xor eax, eax
jmp 0x405120
cmp cl, 0x22
jne 0x4050e5
lea ecx, [eax + 1]
xor ebx, ebx
mov esi, edi
sub esi, eax
jmp 0x4050c6
mov byte [esi + ecx - 1], al
inc ebx
inc ecx
mov al, byte [ebp + ecx - 0x418]
test al, al
je 0x4050d5
cmp al, 0x22
jne 0x4050c0
mov byte [edi + ebx], 0
lea ebx, [edx + 1]
cmp dword [ebp + 8], edx
jne 0x40511b
mov al, 1
jmp 0x40512d
cmp cl, 0x20
je 0x4050f8
mov ecx, eax
mov ebx, edi
sub ebx, eax
mov dword [ebp - 0x41c], ebx
jmp 0x405105
inc eax
jmp 0x405120
mov esi, dword [ebp - 0x41c]
mov byte [esi + ecx], bl
inc ecx
mov esi, ecx
sub esi, eax
mov bl, byte [ebp + ecx - 0x418]
test bl, 0xdf
jne 0x4050fb
mov byte [edi + esi], 0
jmp 0x4050d9
lea eax, [ecx + 1]
mov edx, ebx
mov cl, byte [ebp + eax - 0x418]
test cl, cl
jne 0x4050b0
xor eax, eax
add esp, 0x42c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40514c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.msvcrt.dll__beginthreadex
leave
ret