joyce8/EMBER2024-capa huggingface dataset:
Function at 0x548d44
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x548d75
dec al
je 0x548db0
dec al
je 0x548df5
dec al
je 0x548e5e
jmp 0x548ee8
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x548ee8
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x548d85
jmp 0x548ee8
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x548ee8
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x548dc0
jmp 0x548ee8
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x548ee8
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x548e24
xor ebp, ebp
jmp 0x548e34
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x548e3d
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x548e05
jmp 0x548ee8
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x548ee8
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x548eb7
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.00545e8c
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x548e72
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x406e80
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f67c8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x6817dc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov edx, dword [ebp + 0x1c]
mov eax, edx
mov ecx, dword [ebp + 0x18]
sub eax, ecx
cmp eax, 1
jb 0x406eec
cmp edx, 8
lea esi, [ebp + 8]
push 2
cmovae esi, dword [ebp + 8]
lea edi, [ecx + 1]
push 0x664eac
mov dword [ebp + 0x18], edi
lea eax, [esi + ecx*2]
push eax
call fcn.005c9d10
add esp, 0xc
xor eax, eax
mov word [esi + edi*2], ax
jmp 0x406f04
push 1
push 0x664eac
mov byte [ebp - 0x2c], 0
lea ecx, [ebp + 8]
push dword [ebp - 0x2c]
push 1
call fcn.0040dcd0
mov edx, dword [ebp + 0x1c]
lea ecx, [ebp + 8]
mov ebx, dword [ebp + 8]
cmp edx, 8
mov edi, dword [ebp + 0x18]
cmovae ecx, ebx
test edi, edi
je 0x406f32
mov eax, edi
mov esi, ecx
nop
cmp word [esi], 0x5c
je 0x406ff5
add esi, 2
sub eax, 1
jne 0x406f20
or esi, 0xffffffff
cmp esi, 0xffffffff
je 0x407010
xor eax, eax
mov dword [ebp - 0x18], 0
cmp edi, esi
mov word [ebp - 0x28], ax
mov ecx, esi
mov dword [ebp - 0x14], 7
cmovb ecx, edi
lea eax, [ebp + 8]
cmp edx, 8
push ecx
cmovae eax, ebx
lea ecx, [ebp - 0x28]
push eax
call fcn.00405d50
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, dword [ebp + 8]
lea ecx, [ebp + 8]
mov edi, dword [ebp + 0x18]
inc esi
cmp dword [ebp + 0x1c], 8
cmovae ecx, ebx
cmp esi, edi
jae 0x406fae
mov eax, edi
sub eax, esi
lea esi, [ecx + esi*2]
je 0x406fae
nop
cmp word [esi], 0x5c
je 0x407006
add esi, 2
sub eax, 1
jne 0x406fa0
or esi, 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x406fed
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x406fdd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40705c
push edx
push ecx
call fcn.0055e71a
mov edi, dword [ebp + 0x18]
add esp, 8
mov ebx, dword [ebp + 8]
mov edx, dword [ebp + 0x1c]
jmp 0x406f35
test esi, esi
je 0x406f32
sub esi, ecx
sar esi, 1
jmp 0x406f35
test esi, esi
je 0x406fae
sub esi, ecx
sar esi, 1
jmp 0x406fb1
cmp edx, 8
jb 0x407040
lea edx, [edx*2 + 2]
mov eax, ebx
cmp edx, 0x1000
jb 0x407036
mov ebx, dword [ebx - 4]
add edx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40705c
push edx
push ebx
call fcn.0055e71a
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055e6d4
mov esp, ebp
pop ebp
ret
call fcn.005ce7a3
int3
Function at 0x4078b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f685b
mov eax, dword fs:[0]
push eax
sub esp, 0xbc
push ebx
push esi
push edi
mov eax, dword [0x6817dc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0xc8]
push edx
mov eax, dword [ecx]
call dword [eax + 8]
push str.ckbox_agree
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.0041a974
lea ecx, [ebp - 0xc8]
mov dword [ebp - 4], 0xffffffff
mov bl, al
call fcn.0041a8bc
test bl, bl
je 0x407a90
mov dword [ebp - 0x28], 0xa1e5a1ee
xor ecx, ecx
mov dword [ebp - 0x24], 0xa1ffa1ed
mov dword [ebp - 0x20], 0xa1cda1e9
mov dword [ebp - 0x1c], 0xa1f3a1f2
mov dword [ebp - 0x18], 0xa1f3a1e7
mov dword [ebp - 0x14], 0xa1f2
mov byte [ebp - 0x10], 1
nop dword [eax + eax]
lea eax, [ecx - 0x5e73]
xor word [ebp + ecx*2 - 0x28], ax
inc ecx
cmp ecx, 0xb
jb 0x407950
lea eax, [ebp - 0x28]
mov byte [ebp - 0x10], 0
add esi, 0x2c
push eax
mov ecx, esi
call fcn.00414e05
mov ecx, eax
call fcn.00419bbb
mov bl, al
mov dword [ebp - 0x28], 0xa1e5a1ee
mov byte [ebp + 8], bl
xor ecx, ecx
mov dword [ebp - 0x24], 0xa1ffa1ed
mov dword [ebp - 0x20], 0xa1cda1e9
mov dword [ebp - 0x1c], 0xa1f3a1f2
mov dword [ebp - 0x18], 0xa1f3a1e7
mov dword [ebp - 0x14], 0xa1f2
mov byte [ebp - 0x10], 1
nop
lea eax, [ecx - 0x5e73]
xor word [ebp + ecx*2 - 0x28], ax
inc ecx
cmp ecx, 0xb
jb 0x4079b0
push 1
push dword [ebp + 8]
lea eax, [ebp - 0x28]
mov byte [ebp - 0x10], 0
push eax
mov ecx, esi
call fcn.00414e05
mov ecx, eax
call fcn.00413da4
test bl, bl
je 0x407a34
mov dword [ebp - 0x28], 0xa1faa1ef
xor edx, edx
mov dword [ebp - 0x24], 0xa1cfa1e1
mov dword [ebp - 0x20], 0xa1fca1f8
mov dword [ebp - 0x1c], 0xa1e0a1e0
mov dword [ebp - 0x18], 0xa1faa1f4
mov dword [ebp - 0x14], 0xa1fb
mov byte [ebp - 0x10], 1
lea eax, [edx - 0x5e73]
xor word [ebp + edx*2 - 0x28], ax
inc edx
cmp edx, 0xb
jb 0x407a10
lea eax, [ebp - 0x28]
mov byte [ebp - 0x10], 0
push eax
mov ecx, esi
call fcn.00414e05
push 1
jmp 0x407a86
mov dword [ebp - 0x44], 0xa1faa1ef
xor eax, eax
mov dword [ebp - 0x40], 0xa1cfa1e1
mov dword [ebp - 0x3c], 0xa1fca1f8
mov dword [ebp - 0x38], 0xa1e0a1e0
mov dword [ebp - 0x34], 0xa1faa1f4
mov dword [ebp - 0x30], 0xa1fb
mov byte [ebp - 0x2c], 1
lea ecx, [eax - 0x5e73]
xor word [ebp + eax*2 - 0x44], cx
inc eax
cmp eax, 0xb
jb 0x407a64
lea eax, [ebp - 0x44]
mov byte [ebp - 0x2c], 0
push eax
mov ecx, esi
call fcn.00414e05
push 0
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xe0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4084e0
Capabilities:
Encode data using xor
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f6930
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x6817dc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x664fb4
push 0x8a
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x4086c6
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 0
mov dword [ebp - 0x3c], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4086c6
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x40], eax
test eax, eax
je 0x4086c6
cmp dword [edi + 0x4cc], 8
lea edx, [edi + 0x4b8]
jb 0x408570
mov edx, dword [edx]
lea ecx, [ebp - 0x28]
call fcn.004063f0
mov dword [ebp - 4], 0
xor ecx, ecx
mov dword [ebp - 0x34], 0xfee0fdd1
mov dword [ebp - 0x30], 0xf1f8bcf6
mov word [ebp - 0x2c], 0xec
mov byte [ebp - 0x2a], 1
nop dword [eax]
lea eax, [ecx - 0x73]
xor byte [ebp + ecx - 0x34], al
inc ecx
cmp ecx, 9
jb 0x4085a0
push 9
lea eax, [ebp - 0x34]
mov byte [ebp - 0x2a], 0
push eax
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], 0
call fcn.004042b0
mov byte [ebp - 4], 1
lea edx, [ebp - 0x58]
mov ebx, dword [ebp - 0x44]
cmp ebx, 0x10
mov edi, dword [ebp - 0x58]
mov eax, dword [ebp - 0x14]
cmovae edx, edi
mov esi, dword [ebp - 0x18]
sub eax, esi
mov ecx, dword [ebp - 0x48]
push ecx
push edx
cmp ecx, eax
ja 0x40861a
cmp dword [ebp - 0x14], 0x10
lea eax, [ecx + esi]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
add esi, eax
push esi
call fcn.005c9d10
mov eax, dword [ebp - 0x48]
add esp, 0xc
mov byte [esi + eax], 0
jmp 0x408630
mov byte [ebp - 0x38], 0
push dword [ebp - 0x38]
push ecx
lea ecx, [ebp - 0x28]
call fcn.004055c0
mov ebx, dword [ebp - 0x44]
mov edi, dword [ebp - 0x58]
cmp ebx, 0x10
jb 0x408660
lea ecx, [ebx + 1]
mov eax, edi
cmp ecx, 0x1000
jb 0x408656
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4086e2
push ecx
push edi
call fcn.0055e71a
add esp, 8
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push 0x664fc4
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.005d3db0
mov esi, eax
add esp, 8
test esi, esi
je 0x408696
push esi
push 1
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
call fcn.005cdbc8
push esi
call fcn.005cd62e
add esp, 0x14
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x4086c6
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4086bc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4086e7
push edx
push ecx
call fcn.0055e71a
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055e6d4
mov esp, ebp
pop ebp
ret
call fcn.005ce7a3
call fcn.005ce7a3
int3
Function at 0x4095e0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, edx
push edi
mov edi, ecx
cmp byte [esi + 0xb], 0
je 0x409602
xor eax, eax
nop
lea edx, [eax + esi]
lea ecx, [eax - 0x73]
inc eax
xor byte [edx], cl
cmp eax, 0xa
jb 0x4095f0
mov byte [esi + 0xb], 0
lea ecx, [edi + 0x10]
mov edx, esi
call fcn.0040d740
mov eax, edi
pop edi
pop esi
ret

Function at 0x409620
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, edx
push edi
mov edi, ecx
cmp byte [esi + 9], 0
je 0x409642
xor eax, eax
nop
lea edx, [eax + esi]
lea ecx, [eax - 0x73]
inc eax
xor byte [edx], cl
cmp eax, 8
jb 0x409630
mov byte [esi + 9], 0
lea ecx, [edi + 0x10]
mov edx, esi
call fcn.0040d740
mov eax, edi
pop edi
pop esi
ret
Function at 0x40e9b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push dword [ebp + 8]
call fcn.00418cbb
push 0x528
call fcn.0055e6ea
push 0x528
mov esi, eax
push 0
push esi
call fcn.005c9930
add esp, 0x14
mov ecx, esi
call fcn.0041b3de
push 0x53
lea ecx, [esi + 0x14]
mov dword [esi + 0x10], vtable.DuiLib::CNotifyPump.0
call fcn.0041a856
lea ecx, [esi + 0x2c]
mov dword [esi], vtable.DuiLib::WindowImplBase.3.0
mov dword [esi + 0x10], vtable.DuiLib::WindowImplBase.4.0
mov dword [esi + 0x20], vtable.DuiLib::WindowImplBase.1.0
mov dword [esi + 0x24], vtable.DuiLib::WindowImplBase.2.0
mov dword [esi + 0x28], vtable.DuiLib::WindowImplBase.0
call fcn.00413db0
xor eax, eax
mov dword [esi], vtable.InstallWnd.1.0
lea ecx, [esi + 0x4b8]
mov dword [esi + 0x10], vtable.InstallWnd.0
mov dword [esi + 0x20], vtable.InstallWnd.2.0
mov dword [esi + 0x24], vtable.InstallWnd.4.0
mov dword [esi + 0x28], vtable.InstallWnd.3.0
push eax
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push 0x664bac
mov word [ecx], ax
call fcn.00405d50
mov dword [esi + 0x4e0], 0
lea ecx, [esi + 0x510]
mov dword [esi + 0x4e4], 7
xor eax, eax
mov word [esi + 0x4d0], ax
mov dword [esi + 0x4f8], eax
mov dword [esi + 0x4fc], 7
mov word [esi + 0x4e8], ax
mov dword [esi + 0x500], eax
mov dword [esi + 0x504], eax
mov dword [esi + 0x508], eax
mov dword [esi + 0x50c], eax
push eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], 7
push 0x664bac
mov word [ecx], ax
call fcn.00405d50
mov dword [ebp - 0x14], 0xf279d852
xor eax, eax
mov dword [ebp - 0x10], 0xfa19d226
mov dword [ebp - 0xc], 0xdb992954
mov dword [ebp - 8], 0xff1c
mov byte [ebp - 4], 1
nop
lea ecx, [eax - 0x5e73]
xor word [ebp + eax*2 - 0x14], cx
inc eax
cmp eax, 7
jb 0x40eaf0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x96c80000
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 0
push eax
push 0
mov ecx, esi
call fcn.0041b558
mov ecx, esi
call fcn.0041b3f7
push 1
push 1
mov ecx, esi
call fcn.0041b925
call fcn.00417a12
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4275b4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x694], edi
je 0x427620
cmp dword [ebp + 8], 0x100
jne 0x42760f
cmp word [ebp + 0xc], 0xd
jne 0x42760f
cmp byte [esi + 0x69a], 0
je 0x4275f4
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x42760f
cmp byte [esi + 0x69b], 0
jne 0x42760f
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x42760b
push 1
push edi
push edi
push edi
push str.return
push esi
call fcn.0041871d
xor eax, eax
jmp 0x427623
mov eax, dword [esi + 0x694]
pop edi
pop esi
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop ebp
jmp dword [eax + 0xc]
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
ret 0x10

Function at 0x4279fd
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x6817dc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x427ab7
movzx eax, word [esi]
test ax, ax
je 0x427ab7
push edi
mov edi, esi
mov ecx, esi
mov edx, eax
cmp dx, 0x2f
je 0x427a3f
cmp dx, 0x5c
jne 0x427a41
mov edi, ecx
add ecx, 2
movzx eax, word [ecx]
mov edx, eax
test ax, ax
jne 0x427a33
cmp edi, esi
je 0x427a8a
sub edi, esi
lea eax, [ebp - 0x20c]
sar edi, 1
push edi
push esi
push eax
call fcn.005d862a
add edi, edi
add esp, 0xc
cmp edi, 0x208
jae 0x427ac5
xor eax, eax
mov word [ebp + edi - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.004279fd
pop ecx
pop ecx
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.005d8809
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.005d87d8
add esp, 0x10
lea eax, [ebp - 0x414]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0055e6d4
leave
ret
call fcn.0055f22b
int3

Function at 0x428089
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
cmp dword [edi], 0
jne 0x428105
cmp dword [edi + 4], 0xffffffff
jne 0x428105
push esi
lea esi, [edi + 0x138]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x664eac
push esi
call fcn.005d87d8
cmp dword [ebp + 0x10], 1
pop ecx
pop ecx
pop esi
jne 0x4280d7
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x4280d7
mov eax, 0x2000000
jmp 0x42810a
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0042a5c8
add esp, 0x10
test eax, eax
jne 0x4280f5
mov eax, dword [ebp - 4]
jmp 0x42810a
push eax
call fcn.0042acea
mov dword [edi], eax
mov eax, dword [0x68b598]
pop ecx
jmp 0x42810a
mov eax, 0x1000000
pop edi
leave
ret 0xc
Function at 0x470570
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information
Receive data
Receive data on socket
Send data
Send data on socket
Set socket configuration
Start tcp server

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x6817dc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [sym.imp.WS2_32.dll_socket]
push edi
push 6
push 1
push 2
mov dword [ebp - 0x34], 0x10
mov dword [ebp - 0x30], 1
call esi
mov edi, eax
cmp edi, 0xffffffff
je 0x470741
xorps xmm0, xmm0
mov eax, 2
push 0x7f000001
movlpd qword [ebp - 0x24], xmm0
mov word [ebp - 0x2c], ax
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [ebp - 0x28], eax
xor eax, eax
push 4
mov word [ebp - 0x2a], ax
lea eax, [ebp - 0x30]
push eax
push 4
push 0xffff
push edi
mov dword [ebx + 4], 0xffffffff
mov dword [ebx], 0xffffffff
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x47072f
push 0x10
lea eax, [ebp - 0x2c]
push eax
push edi
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x47072f
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x2c]
push eax
push edi
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x47072f
push 1
push edi
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x47072f
push 0
push 1
push 2
call esi
mov dword [ebx], eax
cmp eax, 0xffffffff
je 0x47072f
push 0x10
lea ecx, [ebp - 0x2c]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x47072f
push 0
push 0
push edi
call dword [sym.imp.WS2_32.dll_accept]
mov dword [ebx + 4], eax
cmp eax, 0xffffffff
je 0x47072f
push ebx
push 0x66503c
lea eax, [ebp - 0x1c]
push 0xc
push eax
call fcn.0046e470
lea esi, [ebp - 0x1c]
add esp, 0x10
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x470696
push 0
sub esi, ecx
lea eax, [ebp - 0x1c]
push esi
push eax
push dword [ebx]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, esi
jne 0x47072f
push 0
push 0xc
lea eax, [ebp - 0x10]
push eax
push dword [ebx + 4]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, esi
jne 0x47072f
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x10]
sub esi, 4
jb 0x4706e3
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x4706e8
add ecx, 4
add edx, 4
sub esi, 4
jae 0x4706d2
cmp esi, 0xfffffffc
je 0x470715
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x47072f
cmp esi, 0xfffffffd
je 0x470715
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x47072f
cmp esi, 0xfffffffe
je 0x470715
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x47072f
cmp esi, 0xffffffff
je 0x470715
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x47072f
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055e6d4
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.WS2_32.dll_closesocket]
push edi
call esi
push dword [ebx]
call esi
push dword [ebx + 4]
call esi
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0055e6d4
mov esp, ebp
pop ebp
ret
Function at 0x49d970
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, 0x474
call fcn.0055f310
mov eax, dword [0x6817dc]
xor eax, esp
mov dword [esp + 0x470], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [esp + 0x44], ebx
test edi, edi
je 0x49daba
lea eax, [esp + 0x48]
push eax
push edi
call fcn.005dc5c1
add esp, 8
test eax, eax
js 0x49daba
lea eax, [ebx + 8]
call fcn.0055f310
xorps xmm0, xmm0
lea eax, [esp + 0x50]
movsd qword [esp], xmm0
push 0x30
push eax
call fcn.0049d690
mov esi, dword [ebp + 0xc]
add esp, 0x10
test esi, esi
je 0x49daba
push 0x665084
push edi
call fcn.005d3db0
add esp, 8
mov dword [esp + 0x40], eax
test eax, eax
je 0x49daa3
test dword [esp + 0x4e], 0x2000
je 0x49da22
push ebx
push 4
mov ecx, 0x800
cmp esi, 0xffffffff
push ebx
push eax
cmove esi, ecx
call fcn.005cdda6
mov eax, dword [esp + 0x50]
add esp, 0x10
mov edi, 0x400
test esi, esi
jle 0x49da30
cmp esi, edi
cmovl edi, esi
push eax
push edi
lea eax, [esp + 0x80]
push 1
push eax
call fcn.005ce1b3
mov ebx, eax
add esp, 0x10
test ebx, ebx
jle 0x49da84
movd xmm0, ebx
mov eax, 8
cvtdq2pd xmm0, xmm0
call fcn.0055f310
lea eax, [esp + 0x80]
movsd qword [esp], xmm0
push edi
push eax
call fcn.0049d690
add dword [esp + 0x54], ebx
add esp, 0x10
mov eax, dword [esp + 0x40]
test esi, esi
jle 0x49da22
sub esi, edi
test esi, esi
jg 0x49da22
push dword [esp + 0x40]
call fcn.005cd62e
lea eax, [esp + 0x7c]
push 0x400
push eax
call fcn.004a8a90
mov ebx, dword [esp + 0x50]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x470]
xor ecx, esp
call fcn.0055e6d4
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x47c]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0055e6d4
mov esp, ebp
pop ebp
ret
Function at 0x561924
Capabilities:
Move file

Disassembly:
push 0x3c
mov eax, 0x5f8cf6
call fcn.0055ef38
mov edi, edx
mov esi, ecx
xor eax, eax
mov ecx, edi
mov ebx, eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], ebx
cmp dword [edi + 0x14], 8
jb 0x561948
mov ecx, dword [edi]
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x561952
mov eax, dword [esi]
push 1
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x5619a4
cmp dword [edi + 0x14], 8
jb 0x561968
mov edi, dword [edi]
push edi
lea ecx, [ebp - 0x40]
call fcn.00405d00
and dword [ebp - 4], 0
xor ebx, ebx
inc ebx
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x44], ebx
jb 0x561983
mov esi, dword [esi]
push esi
lea ecx, [ebp - 0x28]
call fcn.00405d00
push 3
mov dword [ebp - 4], ebx
lea edx, [ebp - 0x40]
pop ebx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x44], ebx
call fcn.00561924
test al, al
je 0x5619a8
mov byte [ebp - 0x48], 1
test bl, 2
je 0x5619b8
lea ecx, [ebp - 0x28]
and ebx, 0xfffffffd
call fcn.00405c20
test bl, 1
je 0x5619c5
lea ecx, [ebp - 0x40]
call fcn.00405c20
mov al, byte [ebp - 0x48]
call fcn.0055eee2
ret

Function at 0x561d28
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [ecx + 0x14], 8
jb 0x561d30
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
ret

Function at 0x561d3e
Capabilities:
Copy file
Delete file

Disassembly:
push 0x3c
mov eax, 0x5f8dbf
call fcn.0055ef38
mov esi, ecx
cmp dword [esi + 0x10], 0
je 0x561df6
cmp dword [esi + 0x10], 0x104
ja 0x561df6
call fcn.00561d28
test al, al
jne 0x561d73
inc al
jmp 0x561df8
xor edi, edi
lea ecx, [ebp - 0x28]
push esi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
call fcn.0040bf90
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
push edi
add eax, 2
mov dword [ebp - 4], edi
push eax
call fcn.00412da0
push 0x1e
lea eax, [ebp - 0x48]
push edi
push eax
call fcn.005c9930
mov eax, dword [ebp - 0x38]
add esp, 0xc
and eax, 0xffbf
mov dword [ebp - 0x32], edi
or eax, 0x414
mov dword [ebp - 0x48], edi
cmp dword [ebp - 0x14], 8
mov word [ebp - 0x38], ax
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 0x2e], edi
mov dword [ebp - 0x44], 3
mov dword [ebp - 0x3c], edi
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebx, eax
lea ecx, [ebp - 0x28]
neg ebx
sbb bl, bl
inc bl
call fcn.00405c20
mov al, bl
jmp 0x561df8
xor al, al
call fcn.0055eee2
ret