joyce8/EMBER2024-capa huggingface dataset:
Function at 0x71d9d4
Capabilities:
Get graphical window text

Disassembly:
push 0x150
mov eax, 0x7b08d4
call fcn.00772fd1
mov ebx, ecx
xor eax, eax
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x154], eax
push 0x49
pop ecx
mov esi, str.OHbQjBfA8lQKFvGDdGRnvSuy8atM3jtBGslQMNkZNOPC4eB0IwHrBWhfhBw2d08H3Gv9mfROaKf84NZ1dZ2953f7xg2h1RWtzctDi2Vhpzt3d5CpNLKP3MM46OUXhtPg9HqEcqERARL2tjmLETdImKUDCM6XrIXh5MLRWjiuIryyceCPOWnPWJbVrpMglTGR17pcuEsg7bXVbq0QrvoCEMQYm2lGKyLU2lGfINo5JGQBeYWV9DyguKvDFqXli4AfEHxXxMA5smQ6bD4GhoSgxPEFONA9zjQpVd0GyR
mov dword [ebp - 4], eax
lea edi, [ebp - 0x138]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x138]
push eax
lea ecx, [ebp - 0x150]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.00405a50
lea eax, [ebp - 0x150]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x15c]
call fcn.004082f0
push 0
push 1
lea ecx, [ebp - 0x150]
mov byte [ebp - 4], 0
call fcn.004096c0
cmp byte [ebx + 0x24], 0
je 0x71daae
cmp dword [ebx + 0x1c], 0
je 0x71daae
call fcn.006ecca5
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea esi, [eax + 1]
lea eax, [esi + esi]
call fcn.00773080
mov edi, esp
test edi, edi
je 0x71daae
push esi
push edi
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebx + 0x1c]
push edi
add ecx, 0x1bc
call fcn.006f2f57
call fcn.006f115d
mov ecx, dword [ebx + 0x1c]
xor eax, eax
push eax
push eax
push eax
mov eax, dword [ecx]
push str.textchanged
push ecx
call dword [eax + 0x2c]
mov ecx, eax
call fcn.006f835b
lea ecx, [ebp - 0x15c]
call fcn.006ec102
xor eax, eax
lea esp, [ebp - 0x16c]
call fcn.00772f7b
ret 0x10
Function at 0x725080
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 8]
and edi, 7
je 0x7250a4
cmp dword [esi + 8], edi
jge 0x72509c
push esi
call fcn.0072335d
pop ecx
mov ecx, edi
shr dword [esi + 0xc], cl
sub dword [esi + 8], edi
mov edx, dword [esi + 8]
xor ecx, ecx
test edx, edx
jle 0x7250cd
mov edi, dword [esi + 0xc]
mov al, byte [esi + 0xc]
sub edx, 8
mov byte [ebp + ecx + 8], al
inc ecx
shr edi, 8
mov dword [esi + 0xc], edi
test edx, edx
jg 0x7250b0
mov dword [esi + 8], edx
cmp ecx, 4
jge 0x7250ea
mov edx, dword [esi]
cmp edx, dword [esi + 4]
jb 0x7250d8
xor eax, eax
jmp 0x7250e0
mov al, byte [edx]
inc edx
mov dword [esi], edx
movzx eax, al
mov byte [ebp + ecx + 8], al
inc ecx
cmp ecx, 4
jl 0x7250cf
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xb]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp + 0xa]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
je 0x72511f
push str.zlib_corrupt
call fcn.00723218
add esp, 4
jmp 0x72515c
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x72512f
push str.read_past_buffer
jmp 0x725115
mov eax, dword [esi + 0x10]
add eax, edi
cmp eax, dword [esi + 0x18]
jbe 0x725146
push edi
push esi
call fcn.00723227
pop ecx
pop ecx
test eax, eax
je 0x72515c
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.0074f6a0
add dword [esi], edi
xor eax, eax
add dword [esi + 0x10], edi
add esp, 0xc
inc eax
pop edi
pop esi
pop ebp
ret
Function at 0x728ac0
Capabilities:
Check if file exists
Create directory

Disassembly:
push 0x260
mov eax, 0x7b0d8e
call fcn.00772fd1
push 0x4d
pop ecx
mov esi, str.ya2p3Choh214RUWPbdEqH7rLIru4BGZFQhhtNAkzQdzE7fPyG3lerBKN671Yy3a38eqH8RI7axD5HX6SwpPEobacnTZxc30U4RJXvxgv2KvbVKuHBnFCFcBvCvlPWr7WEBKpWBX5CSsw6S3rhSuQ5WexaJLouocMXbXxKJFbbPMvs9k4y52wpn2SSkM3ryZWUSwb6RZTAfzCexqfhcItfNJ52WXcVk2sFjyu1FkLKHeDOJJJWtP1kOcXXLpnGiXzn7jNiJmHvPtAinIun3zQBOs04n6MSNcrrOYhH0gVkZ1NRtCR2AwrfQ
mov ebx, dword [ebp + 8]
lea edi, [ebp - 0x240]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
push 0x3d
pop ecx
mov dword [ebp - 0x26c], eax
movsw word es:[edi], word [esi]
mov dword [ebp - 0x268], eax
mov dword [ebp - 0x264], eax
movsb byte es:[edi], byte [esi]
mov esi, str.lHO1JvUSR33BUP8NUAS85nS9vIWPANz0hvOfl71TiYJNrdR0F9ABQgg0FEFglXYGlB4v1fiw3KdIsn4myVdrmzjx0sRYesvzDGj60p7GEy5nC8fDM0RpGfBS8JZJrfXTJb4Ew12LvrsPvyEENE8KUFWPG6scrasnLzL4IEGAg6xFjJ7E9JLKCj5WNsdUwSmZ32VTSud6y24LI1O9oqI2zCQPvsgYiAzm5uYNSmRf47KksNEkhLTDG
lea edi, [ebp - 0x108]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x258]
lea eax, [ebp - 0x240]
push eax
call fcn.00405a50
xor eax, eax
lea ecx, [ebp - 0x26c]
inc eax
mov dword [ebp - 0x25c], eax
mov byte [ebp - 4], al
lea eax, [ebp - 0x258]
push eax
call fcn.004082f0
xor ecx, ecx
mov byte [ebp - 4], 0
inc ecx
push 0
push ecx
lea ecx, [ebp - 0x258]
call fcn.004096c0
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x258]
call fcn.00405a50
push 2
pop eax
mov byte [ebp - 4], al
lea ecx, [ebp - 0x26c]
lea eax, [ebp - 0x258]
push eax
call fcn.004082f0
push 0
push 1
lea ecx, [ebp - 0x258]
mov byte [ebp - 4], 0
call fcn.004096c0
push ebx
call fcn.0075fe99
mov dword [ebp - 0x260], eax
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.006e70fd
mov esi, eax
push ebx
push esi
call fcn.0075fe77
add esp, 0x10
call fcn.00402330
mov ebx, dword [ebp - 0x260]
xor edi, edi
test ebx, ebx
js 0x728c0f
push 0x5c
pop eax
cmp word [esi + edi*2], ax
jne 0x728c01
xor eax, eax
push esi
mov word [esi + edi*2], ax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x728bfa
call fcn.006edd05
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x728c08
push 0x5c
pop eax
mov word [esi + edi*2], ax
inc edi
cmp edi, ebx
jle 0x728bd1
jmp 0x728c0f
mov byte [ebp - 0x25c], 0
push esi
call fcn.006e7106
pop ecx
lea ecx, [ebp - 0x26c]
call fcn.006ec102
mov ecx, dword [ebp - 0x25c]
movzx eax, cl
call fcn.00772f7b
ret
Function at 0x729cec
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7b10f8
mov eax, dword fs:[0]
push eax
mov eax, 0x1724
call fcn.006e70d0
mov eax, dword [0x8ca144]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x16e4]
xor esi, esi
push 0x1000
push esi
push eax
mov dword [ebp - 0x172c], esi
call fcn.0074fc20
add esp, 0xc
call fcn.00402330
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ecx, [ebp - 0x171c]
push ecx
push 8
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [ebp - 0x1728], esi
mov dword [ebp - 0x1724], esi
mov dword [ebp - 0x1720], esi
mov dword [ebp - 4], esi
lea edi, [ebp - 0x138]
push 0x49
pop ecx
mov esi, str.CCek7PQ4oMfeU7CwAoPVlWpIAYcJnEDeYKAN8IzeorOW4AR5EiDtuXQhzkHV4QE9It5DuNDqygn6O09Cdmz2rXWxqtsr4GDIpy5rfunOk8FHjvHU6c0l3RLUSKbAgToqg2h7TvRPXRWmj0xlCXgrpPYMxaF3s8HOy5hQF41IsGn76ZxUJGSMXRdpAi0VzOcWLofvlLTw9IlV4ejYlP68aa5Nhf67Lefpf7yN9sossMDlu49zAcE7JdOXZPRVpIYtAJFysqc2QpM8aGiVIMddK844T6ls6viujvYh3
lea eax, [ebp - 0x138]
rep movsd dword es:[edi], dword [esi]
push eax
lea ecx, [ebp - 0x16fc]
movsw word es:[edi], word [esi]
call fcn.00405a50
lea eax, [ebp - 0x16fc]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x1728]
call fcn.004082f0
xor esi, esi
lea ecx, [ebp - 0x16fc]
push esi
push 1
call fcn.004096c0
lea eax, [ebp - 0x1718]
push eax
push 0x400
lea eax, [ebp - 0x6e4]
push eax
push 1
push dword [ebp - 0x171c]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x1730]
push eax
lea eax, [ebp - 0x1718]
push eax
lea eax, [ebp - 0xee4]
push eax
lea eax, [ebp - 0x1718]
push eax
lea eax, [ebp - 0x16e4]
push eax
push dword [ebp - 0x6e4]
push esi
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
mov dword [ebp - 0x16f0], esi
mov dword [ebp - 0x16ec], esi
mov dword [ebp - 0x16e8], esi
push 0x6a
pop ecx
mov esi, str.P1bj4qZYcgVIy8LbFyPxJ50fgxF8249FR8KGV1GMEKWeh2qAhoxyvtDmAr86177y8I8Vxbjaw489zQ008Zb4o14Oj18ihugPnaVnb2DZVv6CHQ8qgYWvdZrxoCopAcgoetYV34EaYd1fJpbrB6ZwqlRGtnt9zmgO8bDD8RarJkzUIofP9f3d6zC06vn7ntpqIJah1jsfnLIBBrbyMtU0jkpFC2ldB2c3JWPHo5izlKXcRaAEkYflHxXnjKkoEE6fAdkXSJiMqnu7CqNVRL5SzZaU5bUGZjn6nIj4Ap7RAEmpTBNWX0rY8KXRbZwlnUQThslwhmOeq7IIJvcDFDOFu2TNzhHvQUOwTwBb4ihmldBgLsTMbNofQwLYutIU5CDfdcT6Rf3e1AfMgKhBMWfTWfOYULU15qSAO3qnbvD3M
mov byte [ebp - 4], 2
lea edi, [ebp - 0x2e4]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x2e4]
push eax
lea ecx, [ebp - 0x1714]
movsw word es:[edi], word [esi]
call fcn.00405a50
lea eax, [ebp - 0x1714]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x16f0]
call fcn.004082f0
push 0
push 1
lea ecx, [ebp - 0x1714]
mov byte [ebp - 4], 2
call fcn.004096c0
lea eax, [ebp - 0x16e4]
mov ecx, ebx
push eax
call fcn.004026c0
lea ecx, [ebp - 0x16f0]
call fcn.006ec102
lea ecx, [ebp - 0x1728]
call fcn.006ec102
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006e70bb
mov esp, ebp
pop ebp
ret
Function at 0x72c3c4
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc28
mov eax, dword [0x8ca144]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, dword [ebp + 0xc]
push 0x208
mov dword [ebp - 0xc24], eax
lea eax, [ebp - 0x20c]
push ebx
push eax
mov dword [ebp - 0xc28], ebx
mov dword [ebp - 0xc18], ebx
call fcn.0074fc20
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push ebx
jmp 0x72c4be
lea eax, [ebp - 0xc18]
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x72c4b0
push 0x208
push eax
lea eax, [ebp - 0x414]
mov dword [ebp - 0xc1c], 0x104
push eax
call fcn.0074fc20
add esp, 0xc
mov dword [ebp - 0xc20], 1
lea eax, [ebp - 0xc1c]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0xc20]
push eax
push 0
push str.DisplayName
push dword [ebp - 0xc18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x72c4a4
push dword [ebp - 0xc24]
lea eax, [ebp - 0x414]
push eax
call fcn.0074efd5
pop ecx
pop ecx
test eax, eax
jne 0x72c4ec
push dword [ebp - 0xc18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x104
lea eax, [ebp - 0x20c]
inc ebx
push eax
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x72c41e
push 0x8b08c8
mov ecx, esi
call fcn.004026c0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006e70bb
mov esp, ebp
pop ebp
ret
push 0x800
lea eax, [ebp - 0xc14]
push 0
push eax
call fcn.0074fc20
add esp, 0xc
mov dword [ebp - 0xc1c], 0x400
lea eax, [ebp - 0xc1c]
push eax
lea eax, [ebp - 0xc14]
push eax
lea eax, [ebp - 0xc20]
push eax
push 0
push str.UninstallString
push dword [ebp - 0xc18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0xc14]
push eax
jmp 0x72c4d2
Function at 0x72c741
Capabilities:
Set registry value

Disassembly:
push 0x30c
mov eax, 0x7b17ea
call fcn.00772fd1
push 0x57
pop ecx
mov eax, dword [ebp + 8]
lea edi, [ebp - 0x16c]
mov esi, str.yUpt7DSs4lBJkX88IiLu6fAYSStdM3lFXdaniMPwcylw9BDJwB8yUCFVFVG9SKq3DcS3T4dTjKB6uj4fQIZ8KcCXxNqlE6s8J5PxurhEn0SrvSvpuDWrsurxZyMohUbSpFVL6kDwxCcQ9RCCtdDQTmyQUAsmD8Met7a4HHjYmhp4mniKdKL57VMiYuoOKbdPW9Be59JBIoFSgHLsqSeyG4KEmGj8JUnIIqGUDLPblhs62bFPaNM4VRzrJ7O4dsBvxr7L5EKBV3FJoOa6hD3BUXontHZq8GUHopLRffIoFp6UmlMuSSm95Is3JAaY1qEPpNYZhHxroUr04FYrDdTMMmTwCqt
mov ebx, dword [ebp + 0x14]
rep movsd dword es:[edi], dword [esi]
push 0x5b
pop ecx
mov esi, str.lyry4tWWPzajONL8WYeUOVMBLDSRR21084jrNgZCdM7KRzakRXY0smHTjcb5ShbISxKQpLfI892Ni4AZHnvMdjePCECgldr9ZtdEGhNf6QhffkB760lO6pE4uSbhkJ9lN3kf4ITI512EiIpRwUid0BR269FJBSkDJqbcufRoEp0jKlxZdpGwuxjBWZXCiTeeXD05nXmtrt71xcb5YH8NWg3YMxl580DabCNupWpUafvEmsPvIOUKc1TvwoBpD67mxkRPIgO03sO9GWWyjBKT2xPrUoErvcBJ7O9S0f71pLF8S0U20i8MsZ8OJU0iDyt3YahDG3CAa5CHiXtgUMKFBhL8d9F6lH71o5mVZU0WaWDgoY
mov dword [ebp - 0x304], eax
mov eax, dword [ebp + 0xc]
lea edi, [ebp - 0x2dc]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x308], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30c], eax
xor eax, eax
movsw word es:[edi], word [esi]
mov dword [ebp - 0x318], eax
mov dword [ebp - 0x314], eax
mov dword [ebp - 0x310], eax
movsb byte es:[edi], byte [esi]
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x2f4]
lea eax, [ebp - 0x16c]
push eax
call fcn.00405a50
lea eax, [ebp - 0x2f4]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x318]
call fcn.004082f0
push 0
push 1
lea ecx, [ebp - 0x2f4]
mov byte [ebp - 4], 0
call fcn.004096c0
lea eax, [ebp - 0x2dc]
push eax
lea ecx, [ebp - 0x2f4]
call fcn.00405a50
lea eax, [ebp - 0x2f4]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x318]
call fcn.004082f0
push 0
push 1
lea ecx, [ebp - 0x2f4]
call fcn.004096c0
lea eax, [ebp - 0x300]
xor ecx, ecx
push eax
mov edi, 0xf013f
mov dword [ebp - 0x300], ecx
push edi
push ecx
push str.SoftWare
push reloc.WS2_32.dll_accept
mov dword [ebp - 0x2fc], ecx
mov dword [ebp - 0x2f8], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x72c904
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x2fc]
xor ecx, ecx
push ecx
push eax
push ecx
push edi
push ecx
push ecx
push ecx
push dword [ebp - 0x304]
push dword [ebp - 0x300]
call esi
test eax, eax
je 0x72c889
push dword [ebp - 0x300]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x72c904
xor ecx, ecx
lea eax, [ebp - 0x2f8]
push ecx
push eax
push ecx
push edi
push ecx
push ecx
push ecx
push dword [ebp - 0x308]
push dword [ebp - 0x2fc]
call esi
test eax, eax
je 0x72c8c0
push dword [ebp - 0x2fc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x2f8]
jmp 0x72c902
push ebx
call fcn.0075fe99
pop ecx
lea eax, [eax*2 + 2]
push eax
push ebx
push 1
push 0
push dword [ebp - 0x30c]
push dword [ebp - 0x2f8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x2f8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x2fc]
call esi
push dword [ebp - 0x300]
call esi
lea ecx, [ebp - 0x318]
call fcn.006ec102
call fcn.00772f7b
ret
Function at 0x7301e0
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x7b2b80
call fcn.00772fd1
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x7302e0
cmp byte [ebx + 0x3d], 0
je 0x7302e0
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x73021a
xor al, al
jmp 0x7302e2
xor eax, eax
mov dword [ebp - 0x14], 0xf
push eax
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.0073086a
and dword [ebp - 4], 0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
lea esi, [ebp - 0x28]
cmovae edi, edx
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x730278
sub eax, 1
je 0x73027c
dec eax
sub eax, 1
je 0x7302ce
xor bl, bl
jmp 0x7302d0
mov byte [ebx + 0x3d], 0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae eax, edx
sub esi, eax
je 0x7302b4
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, edx
push 1
push eax
call fcn.00757c71
add esp, 0x10
cmp esi, eax
jne 0x730274
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x28]
cmp byte [ebx + 0x3d], 0
je 0x7302ce
test esi, esi
jne 0x73023e
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.00730809
jmp 0x730238
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.004096c0
mov al, bl
jmp 0x7302e2
mov al, 1
call fcn.00772f7b
ret
Function at 0x730d84
Capabilities:
Write file on windows

Disassembly:
push 0x34
mov eax, 0x7b2177
call fcn.00772fd1
mov esi, ecx
mov dword [ebp - 0x30], esi
mov ecx, dword [ebp + 8]
or ebx, 0xffffffff
cmp ecx, ebx
sete al
test al, al
je 0x730db0
xor eax, eax
cmp ecx, ebx
cmovne eax, ecx
jmp 0x730f11
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x730dde
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x730dde
mov eax, dword [ebp + 8]
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], al
jmp 0x730f11
cmp dword [esi + 0x4c], 0
je 0x730f0f
mov ecx, esi
call fcn.00730776
xor ecx, ecx
cmp dword [esi + 0x38], ecx
jne 0x730e0e
push dword [esi + 0x4c]
mov esi, dword [ebp + 8]
push esi
call fcn.0072c966
test al, al
pop ecx
pop ecx
cmovne ebx, esi
jmp 0x730f0f
mov eax, dword [ebp + 8]
push ecx
mov dword [ebp - 0x18], ecx
mov byte [ebp - 0x28], cl
lea ecx, [ebp - 0x28]
push 8
mov byte [ebp - 0x2c], al
mov dword [ebp - 0x14], 0xf
call fcn.0073086a
and dword [ebp - 4], 0
lea eax, [esi + 0x40]
mov dword [ebp - 0x34], eax
mov edi, dword [ebp - 0x14]
mov esi, dword [esi + 0x38]
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
cmp edi, 0x10
lea edx, [ebp - 0x28]
mov edi, dword [esi]
cmovae ecx, dword [ebp - 0x28]
cmovae edx, dword [ebp - 0x28]
add eax, ecx
push eax
push edx
lea eax, [ebp - 0x40]
mov ecx, esi
push eax
lea eax, [ebp - 0x2b]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x34]
call dword [edi + 0x1c]
test eax, eax
js 0x730f03
cmp eax, 1
jg 0x730ee8
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
cmp edi, 0x10
mov edx, dword [ebp - 0x38]
mov esi, dword [ebp - 0x30]
cmovae eax, ecx
sub edx, eax
mov dword [ebp - 0x3c], edx
je 0x730eb9
push dword [esi + 0x4c]
cmp edi, 0x10
lea eax, [ebp - 0x28]
push edx
cmovae eax, ecx
push 1
push eax
call fcn.00757c71
mov edx, dword [ebp - 0x3c]
add esp, 0x10
cmp edx, eax
jne 0x730f03
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 0x2c]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x40], eax
jne 0x730ee3
test edx, edx
jne 0x730e39
cmp dword [ebp - 0x18], 0x20
jae 0x730f03
push edx
push 8
lea ecx, [ebp - 0x28]
call fcn.00730809
jmp 0x730e36
mov ebx, dword [ebp + 8]
jmp 0x730f03
cmp eax, 3
jne 0x730f03
mov eax, dword [ebp - 0x30]
push dword [eax + 0x4c]
push dword [ebp - 0x2c]
call fcn.0072c966
test al, al
pop ecx
cmovne ebx, dword [ebp + 8]
pop ecx
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.004096c0
mov eax, ebx
call fcn.00772f7b
ret 4
Function at 0x731991
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ecx, ecx
xor edx, edx
xor esi, esi
test edi, edi
jle 0x731ac4
mov ebx, dword [ebp + 8]
mov eax, edi
mov dword [ebp - 4], eax
cmp eax, 2
jl 0x7319ce
movzx eax, byte [esi + ebx]
cmp eax, 0x2f72
jne 0x7319ce
movzx eax, byte [esi + ebx + 1]
cmp eax, 0x2f6e
je 0x731a06
mov al, byte [esi + ebx]
movzx edi, al
mov dword [ebp - 8], edi
cmp edi, 0x2f6e
mov edi, dword [ebp + 0xc]
je 0x731a06
cmp al, 0x3d
jne 0x7319ec
inc edx
cmp edx, 2
jg 0x731a30
cmp al, 0x7f
ja 0x731a30
mov eax, dword [ebp - 8]
mov al, byte [eax + 0x88ff40]
cmp al, 0x7f
je 0x731a30
cmp al, 0x40
jae 0x731a05
test edx, edx
jne 0x731a30
inc ecx
mov eax, dword [ebp - 4]
inc esi
dec eax
mov dword [ebp - 4], eax
cmp esi, edi
jl 0x7319b2
test ecx, ecx
je 0x731ac4
mov edi, dword [ebp + 0x14]
imul eax, ecx, 6
add eax, 7
sar eax, 3
cmp dword [edi], eax
jge 0x731a38
mov dword [edi], eax
push 0xfffffffffffffff0
jmp 0x731a32
push 0xffffffffffffffee
pop eax
jmp 0x731ac6
mov edx, dword [ebp + 0x10]
xor ebx, ebx
and dword [ebp - 8], ebx
push 3
pop ecx
mov dword [ebp + 0xc], ecx
test esi, esi
jle 0x731abf
mov eax, dword [ebp + 8]
mov edi, dword [ebp - 8]
movzx ecx, byte [eax]
cmp ecx, 0x2f72
je 0x731ab3
cmp ecx, 0x2f6e
je 0x731ab3
mov cl, byte [ecx + 0x88ff40]
xor eax, eax
cmp cl, 0x40
sete al
shl ebx, 6
sub dword [ebp + 0xc], eax
movzx eax, cl
and eax, 0x3f
or ebx, eax
inc edi
cmp edi, 4
jne 0x731ab0
mov ecx, dword [ebp + 0xc]
xor edi, edi
test ecx, ecx
jle 0x731a96
mov eax, ebx
shr eax, 0x10
mov byte [edx], al
inc edx
cmp ecx, 1
jle 0x731aa3
mov eax, ebx
shr eax, 8
mov byte [edx], al
inc edx
mov eax, dword [ebp + 8]
cmp ecx, 2
jle 0x731ab3
mov byte [edx], bl
inc edx
jmp 0x731ab3
mov eax, dword [ebp + 8]
dec esi
inc eax
mov dword [ebp + 8], eax
test esi, esi
jg 0x731a50
mov edi, dword [ebp + 0x14]
sub edx, dword [ebp + 0x10]
mov dword [edi], edx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x73628e
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x8ca144]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0074fc20
lea eax, [ebp - 0x20c]
push str.C:loghost.log
push eax
call fcn.0075fe77
add esp, 0x14
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
xor ecx, ebp
neg eax
call fcn.006e70bb
mov esp, ebp
pop ebp
ret

Function at 0x7362e9
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x8ca144]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0074fc20
lea eax, [ebp - 0x20c]
push str.C:logxzq.log
push eax
call fcn.0075fe77
add esp, 0x14
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
xor ecx, ebp
neg eax
call fcn.006e70bb
mov esp, ebp
pop ebp
ret
Function at 0x736730
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2034
call fcn.006e70d0
mov eax, dword [0x8ca144]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, 0x208
lea eax, [ebp - 0x61c]
push edi
xor esi, esi
push esi
push eax
call fcn.0074fc20
push str.C:log_
mov ebx, 0x104
lea eax, [ebp - 0x61c]
push ebx
push eax
call fcn.0075ffff
push 0x800
lea eax, [ebp - 0x1024]
push esi
push eax
call fcn.0074fc20
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push str._sxzq.log
push eax
call fcn.00736252
push edi
lea eax, [ebp - 0x824]
push esi
push eax
call fcn.0074fc20
push edi
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0074fc20
add esp, 0x48
lea eax, [ebp - 0x20c]
push ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.0074ef34
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop ecx
pop ecx
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x414]
push eax
call edi
test eax, eax
je 0x73695d
lea eax, [ebp - 0x20c]
push eax
call fcn.0075fe99
lea ecx, [ebp - 0x20a]
lea eax, [ecx + eax*2]
push eax
lea eax, [ebp - 0x824]
push ebx
push eax
call fcn.0075ffff
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push str._s_s.txt
push eax
call fcn.00736252
lea eax, [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x1024]
push 0x3ff
push 0x400
push eax
call fcn.004050b0
push esi
call fcn.00757d6d
mov dword [ebp - 0x2034], eax
lea eax, [ebp - 0x2034]
push eax
mov dword [ebp - 0x2030], edx
call fcn.0076183a
add esp, 0x40
lea ecx, [ebp - 0x1024]
push ecx
push dword [eax]
mov ecx, dword [eax + 0x10]
push dword [eax + 4]
inc ecx
push dword [eax + 8]
push dword [eax + 0xc]
mov eax, dword [eax + 0x14]
push ecx
add eax, 0x76c
push eax
lea eax, [ebp - 0x2024]
push str.__d__d__d__d__d__d_:_s
push eax
call fcn.00736270
xor eax, eax
add esp, 0x24
mov word [ebp - 0x826], ax
lea eax, [ebp - 0x414]
push eax
call edi
xor ebx, ebx
inc ebx
test eax, eax
lea eax, [ebp - 0x414]
push 0x8917dc
push eax
cmovne esi, ebx
call fcn.00756eab
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x73695d
test esi, esi
jne 0x736903
push edi
push 2
lea eax, [ebp - 0x202c]
mov dword [ebp - 0x202c], 0xfeff
push ebx
push eax
call fcn.00757c71
add esp, 0x10
lea eax, [ebp - 0x2024]
push eax
call fcn.0075fe99
push edi
add eax, eax
push eax
lea eax, [ebp - 0x2024]
push ebx
push eax
call fcn.00757c71
push edi
push 2
lea eax, [ebp - 0x2028]
mov dword [ebp - 0x2028], 0xd
push ebx
push eax
call fcn.00757c71
push edi
push 2
lea eax, [ebp - 0x2028]
mov dword [ebp - 0x2028], 0xa
push ebx
push eax
call fcn.00757c71
push edi
call fcn.00756c7e
add esp, 0x38
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006e70bb
mov esp, ebp
pop ebp
ret