joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401870
Capabilities:
Create directory

Disassembly:
sub esp, 0x110
push str.logs
call dword [sym.imp.MSVCRT.dll__mkdir]
add esp, 4
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea ecx, [esp + 0x90]
push 0x80
push ecx
lea edx, [esp + 8]
push str.yyyy_MM_dd
push edx
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_GetDateFormatA]
lea eax, [esp + 0x10]
push 0x80
push eax
lea ecx, [esp + 8]
push str.hhmm
push ecx
push 8
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
lea edx, [esp + 0x10]
lea eax, [esp + 0x90]
push edx
push eax
push str.logs_crash__s__s.log
push 0x40b318
call dword [sym.imp.MSVCRT.dll_sprintf]
mov eax, 0x40b318
add esp, 0x120
ret

Function at 0x401980
Capabilities:
Print debug messages
Write file on windows

Disassembly:
mov eax, dword [0x40fb2c]
sub esp, 8
test eax, eax
jne 0x401991
call fcn.00401960
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push edi
push eax
push ecx
push 0x40bb24
call dword [sym.imp.MSVCRT.dll_vsprintf]
mov edi, 0x40bb24
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
mov eax, dword [0x40b718]
lea edx, [esp + 4]
not ecx
push 0
dec ecx
push edx
push ecx
push 0x40bb24
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x40bb24
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x40bb20]
test eax, eax
je 0x4019f0
push 0x40bb24
call eax
add esp, 4
mov edx, dword [0x40fb28]
test edx, edx
je 0x401a1c
lea ecx, [esp + 8]
push 0
push ecx
mov edi, 0x40bb24
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push 0x40bb24
push edx
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
pop edi
add esp, 8
ret

Function at 0x4040d0
Capabilities:
Read file on windows

Disassembly:
push edi
mov edi, dword [esp + 0x14]
push edi
call fcn.00404080
add esp, 4
test eax, eax
jne 0x4040fd
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push edi
push eax
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
pop edi
ret
push ebx
mov ebx, dword [esp + 0x10]
mov eax, dword [edi + 4]
push esi
mov esi, ebx
mov edx, dword [edi + 8]
imul esi, dword [esp + 0x18]
mov ecx, dword [eax + 0x10]
sub ecx, edx
cmp esi, ecx
jbe 0x40411b
mov esi, ecx
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x404144
mov eax, dword [esp + 0x10]
push esi
push eax
push edx
push edi
call fcn.00404190
mov eax, dword [edi + 8]
add esp, 0x10
add eax, esi
xor edx, edx
mov dword [edi + 8], eax
mov eax, esi
div ebx
pop esi
pop ebx
pop edi
ret
mov ecx, dword [eax + 8]
push 0
add ecx, edx
mov edx, dword [eax]
push ecx
mov eax, dword [edx]
push eax
call dword [sym.imp.MSVCRT.dll_fseek]
mov ecx, dword [edi + 4]
mov edx, dword [ecx]
mov ecx, dword [esp + 0x1c]
mov eax, dword [edx]
push eax
push esi
push 1
push ecx
call dword [sym.imp.MSVCRT.dll_fread]
mov esi, eax
mov eax, dword [edi + 8]
add eax, esi
add esp, 0x1c
mov dword [edi + 8], eax
mov eax, esi
xor edx, edx
pop esi
div ebx
pop ebx
pop edi
ret
Function at 0x404200
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
mov ecx, dword [ebx + 0x20]
test ecx, ecx
je 0x404226
mov edi, dword [ebx + 0x10]
mov esi, dword [ebx + 0x1c]
cmp edi, esi
je 0x404226
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebx + 0x18]
mov eax, dword [ebx + 0x20]
mov ecx, dword [ebx + 0x10]
mov edx, dword [ebx + 0x14]
sub esi, eax
mov eax, dword [ebx + 4]
mov dword [ebx + 0x1c], ecx
mov ecx, dword [eax + 0xc]
sub ecx, edx
cmp esi, ecx
jbe 0x404245
mov esi, ecx
test esi, esi
je 0x404289
mov ecx, dword [eax + 8]
push 0
add ecx, edx
mov edx, dword [eax]
push ecx
mov eax, dword [edx]
push eax
call dword [sym.imp.MSVCRT.dll_fseek]
mov ecx, dword [ebx + 4]
mov edx, dword [ecx]
mov ecx, dword [ebx + 0x10]
mov eax, dword [edx]
push eax
mov eax, dword [ebx + 0x20]
push esi
add ecx, eax
push 1
push ecx
call dword [sym.imp.MSVCRT.dll_fread]
mov edx, dword [ebx + 0x20]
mov ecx, dword [ebx + 0x14]
add esp, 0x1c
add edx, eax
add ecx, eax
mov dword [ebx + 0x20], edx
mov dword [ebx + 0x14], ecx
pop edi
pop esi
pop ebx
ret

Function at 0x404a30
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x4004
call fcn.00404ed0
push ebx
mov ebx, dword [esp + 0x400c]
push ebp
push esi
test ebx, ebx
push edi
je 0x404b14
mov esi, dword [sym.imp.MSVCRT.dll_fseek]
push 2
push 0
push ebx
call esi
push ebx
call dword [sym.imp.MSVCRT.dll_ftell]
mov edx, dword [esp + 0x402c]
add esp, 0x10
test edx, edx
jl 0x404b14
cmp edx, eax
jge 0x404b14
mov ecx, dword [esp + 0x4020]
cmp ecx, 0xffffffff
jne 0x404a8a
lea ecx, [eax - 1]
cmp ecx, edx
jl 0x404b14
cmp ecx, eax
jge 0x404b14
sub ecx, edx
mov edi, ecx
mov dword [esp + 0x10], edi
je 0x404b14
mov ebp, dword [esp + 0x4024]
push 0
push edx
push ebx
mov dword [ebp], 0xffffffff
call esi
add esp, 0xc
cmp edi, 0x4000
jl 0x404ac4
mov edi, 0x4000
push ebx
push 1
lea eax, [esp + 0x1c]
push edi
push eax
call dword [sym.imp.MSVCRT.dll_fread]
mov esi, eax
push 0
imul esi, edi
push ebp
lea ecx, [esp + 0x2c]
push esi
push ecx
call fcn.00404b30
add esp, 0x20
test al, al
je 0x404b14
mov eax, dword [esp + 0x10]
sub eax, esi
test eax, eax
mov dword [esp + 0x10], eax
jle 0x404aff
mov edi, eax
jmp 0x404ab7
mov edx, dword [ebp]
pop edi
not edx
mov dword [ebp], edx
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x4004
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x4004
ret
Function at 0x404b30
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, dword [esp + 8]
test ebp, ebp
push edi
je 0x404b91
mov edi, dword [esp + 0x10]
test edi, edi
je 0x404b91
mov al, byte [esp + 0x18]
push esi
mov esi, dword [esp + 0x18]
test al, al
je 0x404b55
mov dword [esi], 0xffffffff
push ebx
xor ecx, ecx
mov eax, dword [esi]
xor edx, edx
mov dl, byte [ecx + ebp]
mov ebx, eax
and ebx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x4095f8]
xor edx, eax
inc ecx
cmp ecx, edi
mov dword [esi], edx
jl 0x404b58
mov al, byte [esp + 0x20]
pop ebx
test al, al
je 0x404b8b
mov eax, edx
not eax
mov dword [esi], eax
pop esi
pop edi
mov al, 1
pop ebp
ret
pop edi
xor al, al
pop ebp
ret
Function at 0x20a7ab6
Capabilities:
Encode data using xor

Disassembly:
jb 0x20a7a80
mov dword [0x5f25214b], eax
or byte [ebp - 0x22], ch
push esi
dec ecx
jb 0x20a7ab9
mov esp, 0x57fbb7be
cwde
inc edi
xlatb
aam 0x82
pop eax
cmpsd dword [esi], dword es:[edi]
enter 0x4e8d, 0x77
pushal
mov byte [0x22aa82d4], al
insd dword es:[edi], dx
retf 0xa361
push esi
mov ecx, gs
dec ecx
je 0x20a7abc
aas
mov byte [ebx + 0x14], bh
sbb dword [ebp - 0x4d], esp
popal
movsd dword es:[edi], dword [esi]
in eax, 0xe6
pop esi
lahf
jb 0x20a7a91
loopne 0x20a7a7c
mov bl, 0x2b
jnp 0x20a7a4b
jne 0x20a7abe
leave
stc
xor dword [esi + 0x18], 0xffffffde
fist word [esi + 0x123c3a80]
add al, 0xe2
add al, 0xd2
pushfd
cmp cl, byte [eax]
or bl, byte [esp + esi*2]
daa
xchg esp, eax
outsb dx, byte [esi]
test eax, 0x648dfe41
lea esp, [esp + 0x30]
lea esp, [esp + 0x30]
xor byte [edi], cl
sbb byte [esi], 0xf6
jb 0x20b70de
push ds
test byte [eax], 0
add byte [eax], al
pushal
mov byte [esp + 4], 0x4f
call fcn.01ce58bc
add dh, ch
lodsd eax, dword [esi]
pop ebx
sal dword [eax + 0x71099c2b], cl
sbb al, 0x2b
adc eax, ebx
lahf
jg 0x20a7b4f
sub edx, dword [ebx]
ret
pop edi
add esi, ebx
or ebp, ebx
lds eax, [ebx + 0x4fe27eff]
push ebp
pop eax
rcl dword [eax + 0x46ba59ec], cl
loope 0x20a7a8e
dec edx
in eax, dx
mov dh, 0x32
lahf
mov edx, 0x7f074c06
add ch, ch
add eax, 0xd4779e3e
pushfd
call 0xd4d79bcd
mov dh, ah
jl 0x20a7ad6
ror byte [eax - 0x1935831a], cl
inc ecx
out 0x41, al
jae 0x20a7b07
sar dword [ebx + 0x36], 0x1f
dec eax
pop ss
out 0xea, al
das
push edi
fsubr qword [ecx + esi*2]
sub al, 0x71
xchg edi, eax
pop edx
sub al, 0x7d
xor al, 0x46
outsd dx, dword [esi]
adc dword [edi - 0x3b8d2a05], ecx
test eax, 0xe2927274
sbb edi, dword [eax - 0x1a7d1d4e]
jl 0x20a7b1b
dec edx
mov ch, 0x6d
push ebx
popal
sub dword [edi], 0xd8db2334
push ebx
add eax, 0x254fa5db
out 0xed, eax
jmp [ebp + 0x51479983]
push ecx
leave
daa
xchg esp, eax
outsd dx, dword [esi]
pop esi
inc esi
scasd eax, dword es:[edi]
aad 0xc8
insb byte es:[edi], dx
mov byte ss:[ebx + 0x257ee51b], 0x2c
adc al, 0xcc
cld
mov byte [eax + 0x60545068], cl
sub al, 0xe8
ficom dword [eax - 0x2e0a0e4]
fistp qword [edi]
div dword [eax + edx*2 + 0x749d7a0a]
mov ah, 0xcd
enter 0x924, 0x5e
xchg esi, eax
enter 0xffffffffffffeee6, 0x11
stc
pop edx
fstp qword [esi + 0x316ba32a]
sbb dword [esi - 0x1d4f8595], ecx
jmp 0x55787c54

Function at 0x20b5378
Capabilities:
Check for software breakpoints

Disassembly:
lea esp, [esp + 0x5c]
ja 0x20a56e4
call fcn.020b3f55
jmp 0x20a6b56
Function at 0x20b5e4c
Capabilities:
Check for software breakpoints

Disassembly:
lahf
mov esi, 0x63c4f8b8
adc ah, al
inc edx
mov esp, 0x2749d305
push 0xffffffffffffffc8
push ds
mov ebx, 0x57c1f4b6
push edi
dec esi
mov dh, 0xf2
lea esi, [ecx + 7]
xchg eax, ecx
xchg ebx, eax
jmp 0x20a56af
cmpsb byte [esi], byte es:[edi]
or byte [edx], 0x14
adc al, 0x3c
daa
xchg esp, eax
inc edx
loope 0x20a569a
add al, 0x60
pushal
cmc
stc
cmp ecx, dword [ebp - 4]
mov byte [esp + 4], ah
call fcn.0209deda
adc ch, cl
rcl dword [edi - 0x222e8f01]
add edx, eax
sub dword [ecx], edx
mov ch, 0x89
popal
jns 0x20a5741
xchg edi, edi
call dword [edx]
jmp 0x7309eeca
loope 0x20a56d7
std
cdq
xchg ecx, eax
outsd dx, dword [esi]
dec ecx
loop 0x20a577c
or byte [ebx + 0x1c07150e], cl
pushal
leave
dec ebp
sbb eax, 0xe5ed49ac
pop edi
adc edx, dword [esi + 0x71]
leave
add ah, byte [eax - 0x32]
jge 0x20a5732
add dh, byte [edi + edi - 0x53]
jbe 0x20a56f0
adc al, 0x36
in al, 0x3b
pop bx
adc dh, ch
out dx, al
test dword [ecx + 0x3229a165], 0x15adf98f
pop ebp
mov esp, 0x9e9adce7
cmp al, 0xcc
mov al, 0xdb
jae 0x20a576f
lcall 0x73db, 0xb0cc3c9e
imul eax, ebp, 0xc2ce9d03
imul eax, ebp, 0xc2ce9d03
mov ah, 0xfe
mov dl, byte [edx + 0x17]
sub dword [esp + ecx*2], ecx
jg 0x20a5778
iretd
xor al, 0x8f
xor byte [edi + 0x473d4f65], al
std
sal dword [ecx + 0x6f], cl
cmp dword [ebx], esp
sbb dword [edi], edi
and ebx, dword [ecx]
aas
stc
jno 0x20a57a9
xchg esp, eax
inc ebx
mov dh, 0x6e
iretd
xchg ecx, eax
test eax, 0xa7717fbc
push 0x7a
ret
lea esp, [esp + 0x4c]
ja 0x20a56e4
push ebx
call fcn.020b5a53
enter 0x59b1, 0x63
ret
Function at 0x10001022
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
push esi
mov esi, ecx
push edi
cmp dword [esi + 4], 1
je 0x100010c4
call fcn.100010e4
xor ebp, ebp
mov dword [esi], eax
cmp eax, ebp
jne 0x10001054
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebp
jne 0x100010e0
push 0x7e
pop eax
jmp 0x100010e0
push ebx
lea ebx, [esi + 8]
push 0x14
push ebp
push ebx
call fcn.10031550
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 0xc
push 0x200f
push dword [esi]
call edi
push 0x2010
mov dword [ebx], eax
push dword [esi]
call edi
push 0x2011
mov dword [esi + 0xc], eax
push dword [esi]
call edi
push 0x2016
mov dword [esi + 0x10], eax
push dword [esi]
call edi
push 0x2015
mov dword [esi + 0x14], eax
push dword [esi]
call edi
cmp dword [ebx], ebp
mov dword [esi + 0x18], eax
pop ebx
je 0x100010c8
cmp dword [esi + 0xc], ebp
je 0x100010c8
cmp dword [esi + 0x10], ebp
je 0x100010c8
cmp dword [esi + 0x14], ebp
je 0x100010c8
cmp eax, ebp
je 0x100010c8
mov dword [esi + 4], 1
xor eax, eax
jmp 0x100010e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, ebp
jne 0x100010d7
push 0x7f
pop edi
mov ecx, esi
call fcn.10001187
mov eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x100032c8
Capabilities:
Copy file
Set file attributes

Disassembly:
push 0x80
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
ret

Function at 0x100032ea
Capabilities:
Delete file
Set file attributes

Disassembly:
push 0x80
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
ret

Function at 0x100033a9
Capabilities:
Get file size

Disassembly:
push ebx
push esi
xor ebx, ebx
push edi
push ebx
push ebx
push 3
push ebx
push 1
push ebx
push dword [esp + 0x28]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x100033e1
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100033da
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebx
ret

Function at 0x10003689
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x100036a0
test al, 0x10
je 0x100036a0
push 1
pop eax
ret
xor eax, eax
ret
Function at 0x1000375f
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30c
test byte [ebp + 0xc], 0x10
push ebx
push esi
push edi
je 0x100038e0
push dword [ebp + 0x10]
mov esi, 0x104
lea eax, [ebp - 0x30c]
push dword [ebp + 8]
push esi
push eax
call fcn.100036db
add esp, 0x10
mov ebx, str.ahn.ui
lea eax, [ebp - 0x30c]
mov edi, 0x1004a050
push ebx
push eax
push edi
lea eax, [ebp - 0x208]
push esi
push eax
call fcn.10001426
lea eax, [ebp - 0x208]
push 0
push eax
call fcn.1000336b
add esp, 0x1c
test eax, eax
je 0x1000383d
lea eax, [ebp - 0x30c]
push str.ahn.bak
push eax
push edi
lea eax, [ebp - 0x104]
push esi
push eax
call fcn.10001426
lea eax, [ebp - 0x104]
push 0
push eax
call fcn.1000336b
add esp, 0x1c
test eax, eax
je 0x10003801
lea eax, [ebp - 0x104]
push eax
call fcn.100032ea
pop ecx
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x1000383d
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._AhnuiRenameForUNIX__move_file_error_errno_d__:__s_____s
push 1
call fcn.1000aeb9
add esp, 0x14
lea eax, [ebp - 0x30c]
push str.ahn.unix
push eax
push edi
lea eax, [ebp - 0x208]
push esi
push eax
call fcn.10001426
lea eax, [ebp - 0x208]
push 0
push eax
call fcn.1000336b
add esp, 0x1c
test eax, eax
je 0x100038e0
lea eax, [ebp - 0x30c]
push ebx
push eax
push edi
lea eax, [ebp - 0x104]
push esi
push eax
call fcn.10001426
lea eax, [ebp - 0x104]
push 0
push eax
call fcn.1000336b
add esp, 0x1c
test eax, eax
je 0x100038a4
lea eax, [ebp - 0x104]
push eax
call fcn.100032ea
pop ecx
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x100038e0
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._AhnuiRenameForUNIX__move_file_error_errno_d__:__s_____s
push 1
call fcn.1000aeb9
add esp, 0x14
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100041a3
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1148
call fcn.100318b0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push esi
mov dword [ebp - 8], ecx
push dword [ebp + 0xc]
call ebx
cmp eax, 0xffffffff
jne 0x100041cc
xor eax, eax
jmp 0x10004346
push dword [ebp + 8]
mov esi, 0x400
lea eax, [ebp - 0xd48]
push esi
push eax
call fcn.1000180e
push str..
lea eax, [ebp - 0xd48]
push esi
push eax
call fcn.100020b4
push dword [ebp + 0x10]
call fcn.10002fbc
pop ecx
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0xd48]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x10004245
lea eax, [ebp - 0xd48]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._ahnup.dll__BackupFiles____error:_d__FindFirstFile__s_
push 1
call fcn.1000aeb9
add esp, 0x10
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0xffffffffffffff9b
pop eax
jmp 0x10004346
push edi
mov edi, 0x1004a050
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x1148]
push dword [ebp + 8]
push edi
push esi
push eax
call fcn.100046c9
add esp, 0x14
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x948]
push dword [ebp + 0xc]
push edi
push esi
push eax
call fcn.100046c9
add esp, 0x14
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x548]
push dword [ebp + 0x10]
push edi
push esi
push eax
call fcn.100046c9
add esp, 0x14
test byte [ebp - 0x148], 0x10
je 0x100042d1
cmp byte [ebp - 0x11c], 0x2e
je 0x10004320
lea eax, [ebp - 0x548]
mov ecx, dword [ebp - 8]
push eax
lea eax, [ebp - 0x948]
push eax
lea eax, [ebp - 0x1148]
push eax
call fcn.100041a3
test eax, eax
jl 0x1000434c
jmp 0x10004320
lea eax, [ebp - 0x948]
push eax
call ebx
cmp eax, 0xffffffff
je 0x10004320
lea eax, [ebp - 0x548]
push eax
call ebx
cmp eax, 0xffffffff
je 0x10004308
lea eax, [ebp - 0x548]
push eax
call fcn.100032ea
pop ecx
lea eax, [ebp - 0x548]
push eax
call ebx
cmp eax, 0xffffffff
jne 0x10004350
lea eax, [ebp - 0x548]
push eax
lea eax, [ebp - 0x948]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
je 0x1000436b
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1000424b
xor esi, esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0xc
mov esi, eax
jmp 0x1000433a
lea eax, [ebp - 0x548]
push eax
push str._ahnup.dll__BackupFiles___Error_File_Exist_:__s
push 1
call fcn.1000aeb9
add esp, 0xc
push 0xffffffffffffff99
pop esi
jmp 0x1000433a
lea eax, [ebp - 0x548]
push eax
lea eax, [ebp - 0x948]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._ahnup.dll__BackupFiles____error:_d__MoveFile__s___s_
push 1
call fcn.1000aeb9
add esp, 0x14
push 0xffffffffffffff9a
jmp 0x10004368
Function at 0x10008bc0
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
test ebp, ebp
push edi
jbe 0x10008c4a
push ebp
call fcn.10008ac6
test eax, eax
je 0x10008c4a
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
push ebp
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x10008c4a
cmp ebx, 0x1e
je 0x10008c1d
push esi
call edi
push ebx
push str._AhnUpP2P__DuriAhnHangCheck_check_count_d
push 1
call fcn.1000b21a
add esp, 0xc
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0x1f
jl 0x10008bde
jmp 0x10008c4a
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, eax
test ebx, ebx
je 0x10008c30
xor eax, eax
jmp 0x10008c36
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push str._AhnUpP2P__DuriAhnHangCheck_maybe_duri.ahn_is_hang._so_TerminateProcess__d___d_
push 1
call fcn.1000b21a
add esp, 0x10
push esi
call edi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x10009408
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x10009445
cmp dword [ebp - 4], 0x103
jne 0x10009445
push 0x1388
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10009445
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
leave
ret 4
Function at 0x10009bd6
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30c
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
test eax, eax
je 0x10009bf8
cmp eax, 1
je 0x10009bf8
cmp eax, 2
jne 0x10009d07
shl eax, 5
mov eax, dword [eax + 0x1004cfd0]
test eax, eax
je 0x10009d2c
cmp byte [eax], 0
je 0x10009d2c
cmp dword [esi], 0
jne 0x10009d0b
push ebx
push eax
mov ebx, 0x104
push 0x100582d8
lea eax, [ebp - 0x30c]
push ebx
push eax
call fcn.10002f5f
and byte [ebp - 0x208], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x207]
and byte [ebp - 0x104], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, 0x100582d8
push str.wsock32.dll
push edi
lea eax, [ebp - 0x208]
push ebx
push eax
call fcn.10002f5f
push str.wsock32.bad
push edi
lea eax, [ebp - 0x104]
push ebx
push eax
call fcn.10002f5f
lea eax, [ebp - 0x208]
push 0
push eax
call fcn.1000336b
add esp, 0x38
test eax, eax
pop ebx
je 0x10009cd1
lea eax, [ebp - 0x104]
push eax
call fcn.100032ea
pop ecx
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
lea eax, [ebp - 0x104]
push eax
call fcn.100032ea
pop ecx
cmp dword [esi + 4], 0
jne 0x10009cde
mov ecx, esi
call fcn.10009d62
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea eax, [ebp - 0x30c]
push eax
call edi
test eax, eax
mov dword [esi], eax
jne 0x10009d0b
mov eax, dword [esi + 4]
shl eax, 5
push dword [eax + 0x1004cfd0]
call edi
test eax, eax
mov dword [esi], eax
jne 0x10009d0b
xor eax, eax
jmp 0x10009d4c
mov edi, dword [ebp + 8]
mov ecx, esi
push edi
call fcn.10009b54
test eax, eax
jne 0x10009d21
mov eax, dword [edi*4 + 0x1004d030]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x10009d4c
push dword [ebp + 8]
mov ecx, esi
call fcn.10009b54
test eax, eax
jne 0x10009d42
push 0x78
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp + 8]
mov ecx, esi
call fcn.10009b54
pop edi
pop esi
leave
ret 4
Function at 0x1001dc85
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
invalid
test dword [ecx + edi*8 - 1], ecx
invalid

Function at 0x1001f7cd
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
push edi
push esi
push esi
push 3
push esi
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x1001f802
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp + 8]
push str._AhnUp_GetCRC__Fail_to_open__s__d_.
jmp 0x1001f87f
cmp dword [ebp + 0x14], esi
je 0x1001f838
or eax, 0xffffffff
push 2
sub eax, dword [ebp + 0x10]
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x1001f838
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp + 8]
push str._AhnUp_GetCRC__Fail_to_set_file__s__pointer__d_.
push 1
call fcn.1000b21a
add esp, 0x10
jmp 0x1001f85e
lea eax, [ebp - 4]
push esi
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1001f869
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x1001f869
push 1
pop esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x1001f88b
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp + 8]
push str._AhnUp_GetCRC__Fail_to_read_CRC__s__d_.
push 1
call fcn.1000b21a
add esp, 0x10
xor eax, eax
pop edi
pop esi
leave
ret 0x10
Function at 0x100328cf
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x100328ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.100342cf
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x10032912
test byte [esp + 8], 2
je 0x10032912
call fcn.10034342
mov dword [eax], 0xd
call fcn.1003434b
mov dword [eax], 5
jmp 0x100328eb
xor eax, eax
ret