joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410bd2
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x464
push ebx
push esi
push edi
lea eax, [ebp - 0x460]
xor ebx, ebx
push eax
mov byte [ebp - 1], bl
call fcn.00410bb1
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x460]
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x410c32
push eax
call dword [sym.imp.kernel32.dll_FindClose]
cmp dword [ebp - 0x238], ebx
jbe 0x410c26
cmp dword [ebp - 0x23c], ebx
jne 0x410c26
mov al, 1
jmp 0x410ce7
lea eax, [ebp - 0x460]
push eax
call fcn.0040df8d
lea eax, [ebp - 0x258]
push eax
mov edi, 0x4122d0
push edi
call dword [sym.imp.kernel32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x410ce4
push eax
call dword [sym.imp.kernel32.dll_FindClose]
cmp dword [ebp - 0x238], ebx
ja 0x410c65
cmp dword [ebp - 0x23c], ebx
jbe 0x410ce4
mov eax, dword [0x411a6c]
push dword [eax + 0x20]
push ebx
push 0x4124d8
call dword [sym.imp.kernel32.dll_CreateMutexW]
cmp eax, ebx
je 0x410c88
mov esi, eax
call fcn.0040f565
mov esi, eax
jmp 0x410c8a
xor esi, esi
mov eax, dword [0x411a6c]
push ebx
push ebx
push ebx
push ebx
push 8
push dword [eax + 0x2c]
call fcn.00409a9b
cmp dword [ebp - 0x23c], ebx
jbe 0x410cad
push edi
call fcn.0040df8d
jmp 0x410ccb
cmp dword [ebp - 0x238], ebx
jbe 0x410ccb
push 3
lea eax, [ebp - 0x460]
push eax
push edi
call dword [sym.imp.kernel32.dll_MoveFileExW]
test eax, eax
setne byte [ebp - 1]
mov eax, dword [0x411a6c]
push ebx
push ebx
push ebx
push ebx
push 7
push dword [eax + 0x2c]
call fcn.00409a9b
push esi
call fcn.0040f586
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10004770
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
cmp eax, 0
mov eax, 0xb18fa1c5
mov eax, ecx
nop
inc eax
mov eax, ebx
cmp eax, 0xffffffed
cmp eax, 0x6f
mov eax, 0x83d89e73
mov eax, 0xecc495fd
cmp eax, 0x71212cbf
mov eax, ebx
cmp eax, 0xffffffa8
mov eax, ebx
push 3
push 2
push 1
call fcn.1000c200
add esp, 0xc
nop
mov eax, 0x4b1c1bb
cmp eax, 0x9578f5e6
cmp eax, 0x61
mov eax, 0x881411fb
cmp eax, 0x96aec3f1
mov eax, ebx
mov eax, ecx
mov eax, ebx
mov eax, ebx
mov eax, ebx
cmp eax, 0xffffffd2
cmp eax, 0x8e09eeb9
push 3
push 2
push 1
call fcn.1000c200
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
nop
inc eax
inc eax
cmp eax, 0x69b4c64f
inc eax
inc eax
mov eax, ebx
nop
mov eax, 0x35d8d728
cmp eax, 0x7c
mov eax, ebx
mov eax, ebx
cmp eax, 0xffffffbe
inc eax
mov eax, ebx
mov eax, ecx
mov eax, 0x83fbb0d2
mov eax, ebx
mov eax, ecx
push 3
push 2
push 1
call fcn.1000c200
add esp, 0xc
push 0x1002beb4
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp eax, 0x14
nop
mov eax, ecx
nop
nop
mov eax, ebx
mov eax, ecx
cmp eax, 0xe174e0e5
cmp eax, 0xffffffd2
cmp eax, 0x16e8ea0e
mov eax, ebx
mov eax, ebx
nop
cmp eax, 0xf60f9f8d
mov eax, ecx
cmp eax, 0xd56a3bd8
push 3
push 2
push 1
call fcn.1000c200
add esp, 0xc
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x1003e22c], eax
mov eax, ebx
mov eax, 0xe9aecc88
cmp eax, 0x55
mov eax, 0x8d098e14
cmp eax, 0x3f
mov eax, 0x16e3bc18
nop
mov eax, 0x101c8b76
mov eax, ecx
mov eax, ecx
mov eax, ecx
mov eax, 0x6875e32d
mov eax, ecx
push 3
push 2
push 1
call fcn.1000c200
add esp, 0xc
cmp dword [0x1003e22c], 0
jne 0x1000491f
push 0x41030
push str.DllWrap
push str.miss
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
inc eax
cmp eax, 0xfffffff4
inc eax
inc eax
mov eax, 0x17e95f94
cmp eax, 0x4610ef68
mov eax, 0x5debb58c
mov eax, 0xd2f0b94f
cmp eax, 0x7112b87d
mov eax, ecx
mov eax, ecx
nop
mov eax, ecx
nop
cmp eax, 0x49
push 3
push 2
push 1
call fcn.1000c200
add esp, 0xc
cmp dword [0x1003e22c], 0
je 0x10004931
mov dword [ebp - 4], 1
jmp 0x10004938
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x4041f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
mov dword [esp + 0x10], eax
lea eax, [ebp - 8]
mov dword [esp + 8], eax
lea eax, [ebp - 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x10]
mov dword [esp], eax
mov dword [esp + 0xc], 0
call sub.msvcrt.dll___getmainargs
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.msvcrt.dll___set_app_type
mov eax, dword [ebp - 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.004042b0
mov dword [esp], eax
call sub.msvcrt.dll_exit
nop
nop
nop
nop
push ebp
mov ebp, esp
call sub.msvcrt.dll___iob_func
mov edx, dword [ebp + 8]
pop ebp
shl edx, 5
add eax, edx
ret
Function at 0x4031f2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x10]
push ebx
push 1
push 0
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
js 0x40322a
push edi
push 0
push str.SCRIPT
push 0xa
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov edi, eax
test edi, edi
jne 0x4757d3
pop edi
pop esi
pop ebx
leave
ret
push edi
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x403229
push edi
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x403229
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x403229
mov ecx, dword [ebx]
push 0
mov edx, dword [ecx]
push edi
push eax
push ecx
call dword [edx + 0x10]
mov eax, dword [ebx]
xor edx, edx
mov ecx, dword [eax]
push edx
push edx
push edx
push edx
push eax
call dword [ecx + 0x14]
mov byte [esi + 0x14], 1
jmp 0x403229
Function at 0x401972
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [0x4c80b8]
mov edi, ecx
mov esi, dword [eax]
test esi, esi
je 0x401a54
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
mov ebx, eax
cmp eax, 1
ja 0x401a4a
je 0x401a48
test edi, edi
je 0x4019d1
mov eax, dword [edi]
mov ecx, dword [edi + 4]
mov edx, dword [edi + 8]
and dword [edi + 4], 0
and dword [edi], 0
or ecx, eax
je 0x4019d1
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 0x14]
mov edi, dword [edi + 0x10]
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
jmp 0x4019f7
lea edi, [esp + 0x10]
xorps xmm0, xmm0
movaps xmmword [edi], xmm0
push 0x10
push edi
call dword [sym.imp.bcryptprimitives.dll_ProcessPrng]
mov eax, dword [edi]
mov edx, dword [edi + 4]
mov ecx, dword [edi + 0xc]
mov edi, dword [edi + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
push 8
pop ecx
push 0x18
pop edx
call fcn.0040298f
test eax, eax
je 0x401a62
mov ebx, eax
mov eax, dword [esp + 0xc]
mov dword [ebx], eax
mov eax, dword [esp + 4]
mov dword [ebx + 4], eax
mov eax, dword [esp + 8]
mov dword [ebx + 8], edi
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], esi
push esi
call sub.kernel32.dll_TlsGetValue
mov edi, eax
push ebx
push esi
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x401a4a
push 8
push 0x18
push edi
call fcn.004069c0
add esp, 0xc
jmp 0x401a4a
xor ebx, ebx
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call fcn.004693f0
pop ecx
mov esi, eax
jmp 0x401990
push 0x18
push 8
call fcn.0048c1f0

Function at 0x401ad5
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00401972

Function at 0x406bb5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push eax
lea edi, [ebp - 0xc]
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
and dword [edi], 0
push edi
push 0
push 0
push eax
call sub.shell32.dll_SHGetKnownFolderPath
test eax, eax
mov eax, dword [edi]
je 0x406be6
push eax
call sub.ole32.dll_CoTaskMemFree
mov dword [esi], 0x80000000
jmp 0x406c01
push eax
call sub.kernel32.dll_lstrlenW
push eax
push dword [ebp - 0xc]
push esi
call fcn.0044c7b0
add esp, 0xc
push dword [ebp - 0xc]
call sub.ole32.dll_CoTaskMemFree
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebp
ret
Function at 0x40c29a
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x120
lea edx, [esp + 0x90]
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
lea ecx, [esp + 0x1c]
lea esi, [esp + 0x30]
and dword [edx + 0x40], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x10], 0xc3d2e1f0
movaps xmmword [edx], xmm0
movaps xmmword [edx + 0x10], xmm0
movaps xmmword [edx + 0x20], xmm0
movaps xmmword [edx + 0x30], xmm0
push ecx
push 0
push 0
push eax
push edx
push esi
call fcn.0040c6ca
add esp, 0x18
lea edx, [esp + 0x38]
push 0x11
pop ecx
lea eax, [esp + 0xd8]
mov esi, edx
mov edi, eax
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 8]
movsd xmm0, qword [edx + 0x44]
movsd xmm1, qword [edx + 0x4c]
mov ecx, dword [edx - 8]
mov esi, dword [edx - 4]
mov edx, dword [edx + 0x54]
movsd qword [edi], xmm0
movsd qword [edi + 8], xmm1
mov dword [edi + 0x10], edx
push eax
push esi
push ecx
push edi
push ebx
call fcn.0040dab7
add esp, 0x14
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x415f5e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xd4
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ecx, dword [eax]
test ecx, ecx
je 0x4160a1
cmp ecx, 1
jne 0x4160fa
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx + 0x24]
test eax, eax
je 0x416124
lea ebx, [ebp - 0x28]
mov edi, eax
lea edx, [ebp - 0x10]
mov dword [ebx + 0xc], ecx
and dword [ebx], 0
xor ecx, ecx
test eax, eax
mov dword [ebx + 4], 0x58d78a
mov dword [ebx + 8], 0x11
setle cl
neg edi
cmovs edi, eax
lea ecx, [ecx + ecx + 0x2b]
mov eax, edi
mov dword [edx], ecx
cdq
push 0x3c
pop ecx
idiv ecx
mov ecx, eax
mov eax, edi
mov edi, 0xe10
cdq
idiv edi
lea edx, [ebp - 0x18]
lea edi, [ebp - 0x10]
mov dword [edx], eax
imul eax, eax, 0xffffffc4
add eax, ecx
lea ecx, [ebp - 0x14]
mov dword [ecx], eax
lea eax, [ebp - 0x48]
mov dword [eax], ebx
mov dword [eax + 4], fcn.00415f5e
mov dword [eax + 8], edi
mov dword [eax + 0xc], fcn.0049c840
mov dword [eax + 0x10], edx
mov edx, fcn.004a7ff0
mov dword [eax + 0x14], edx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], edx
push 2
pop edx
lea ecx, [ebp - 0xe0]
mov dword [ecx], edx
mov dword [ecx + 8], edx
push 0x20
pop edi
mov bl, 3
mov dword [ecx + 0x10], edi
and dword [ecx + 0x14], 0
and dword [ecx + 0x18], 0
mov byte [ecx + 0x1c], bl
mov dword [ecx + 0x20], edx
mov dword [ecx + 0x28], edx
mov dword [ecx + 0x30], edi
mov dword [ecx + 0x34], 1
and dword [ecx + 0x38], 0
mov byte [ecx + 0x3c], bl
mov dword [ecx + 0x40], edx
and dword [ecx + 0x48], 0
mov dword [ecx + 0x4c], edx
mov dword [ecx + 0x50], edi
mov dword [ecx + 0x54], edx
push 8
pop edi
mov dword [ecx + 0x58], edi
mov byte [ecx + 0x5c], bl
mov dword [ecx + 0x60], edx
and dword [ecx + 0x68], 0
mov dword [ecx + 0x6c], edx
push 0x20
pop edx
mov dword [ecx + 0x70], edx
lea edx, [ebp - 0x60]
mov dword [ecx + 0x74], 3
mov dword [ecx + 0x78], edi
mov byte [ecx + 0x7c], bl
mov dword [edx], 0x58d79c
push 4
pop edi
mov dword [edx + 4], edi
mov dword [edx + 0x10], ecx
mov ecx, esi
mov dword [edx + 0x14], edi
mov dword [edx + 8], eax
mov dword [edx + 0xc], edi
call fcn.004156a7
jmp 0x416147
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
mov ebx, dword [eax + 0xc]
lea edi, [ebp - 0xe0]
add edx, ecx
mov dword [edi], ecx
mov dword [edi + 4], edx
mov ecx, edi
call fcn.00415e8e
cmp eax, 0x25
je 0x4160d9
cmp eax, 0x110000
je 0x416152
push eax
push esi
call fcn.0049c400
pop ecx
pop edx
jmp 0x4160f2
mov ecx, edi
call fcn.00415e8e
cmp eax, 0x110000
je 0x416156
mov ecx, esi
mov edx, eax
push ebx
call fcn.004162f5
pop ecx
test al, al
je 0x4160b7
mov al, 1
jmp 0x416147
lea edi, [ebp - 0xe0]
push dword [eax + 0xc]
push edi
call fcn.0041920f
pop eax
pop ecx
lea eax, [ebp - 0x48]
mov dword [eax + 0xc], edi
and dword [eax], 0
mov dword [eax + 4], 0x58e040
mov dword [eax + 8], 2
jmp 0x41613e
lea eax, [ebp - 0xe0]
mov dword [eax + 0xc], ecx
and dword [eax], 0
mov dword [eax + 4], str._Y__m__dT_H:_M:_SZ_Y__m__dT_H:_M:_S:
mov dword [eax + 8], 0x12
push esi
push eax
call fcn.00415f5e
pop ecx
pop edx
add esp, 0xd4
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
jmp 0x416147
push 0x58d768
call fcn.004978f0
Function at 0x430c40
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x420
call fcn.00430c54
Function at 0x43f9b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x428
mov esi, 0x200
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 2
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x1c], 2
cmp esi, 0x201
jae 0x43fa10
jmp 0x43f9fe
jbe 0x43fa80
cmp esi, 0x201
jae 0x43fa10
mov dword [ebp - 0x20], 0x200
lea edi, [ebp - 0x434]
mov ebx, esi
jmp 0x43fa3a
mov ebx, dword [ebp - 0x24]
sub esi, ebx
je 0x43fa2e
mov edx, ebx
lea ecx, [ebp - 0x18]
push esi
call fcn.0042af00
add esp, 4
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
push 0
call sub.kernel32.dll_SetLastError
push edi
push ebx
call sub.kernel32.dll_GetCurrentDirectoryW
mov esi, eax
test eax, eax
jne 0x43fa57
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x43fad0
cmp esi, ebx
jne 0x43f9f0
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x43faee
lea esi, [ebx + ebx]
test ebx, ebx
mov eax, 0xffffffff
cmovs esi, eax
cmp esi, 0x201
jb 0x43f9fe
jmp 0x43fa10
mov eax, dword [ebp - 0x20]
cmp esi, eax
ja 0x43fb04
lea eax, [ebp - 0x34]
push esi
push edi
push eax
call fcn.0044c7b0
add esp, 0xc
movsd xmm0, qword [ebp - 0x34]
mov eax, dword [ebp + 8]
movsd xmm1, qword [ebp - 0x2c]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x43fac2
add eax, eax
push 2
push eax
push dword [ebp - 0x14]
call fcn.004069c0
add esp, 0xc
mov eax, dword [ebp + 8]
add esp, 0x428
pop esi
pop edi
pop ebx
pop ebp
ret
call sub.kernel32.dll_GetLastError
mov ecx, dword [ebp + 8]
mov byte [ecx + 4], 0
mov dword [ecx + 8], eax
mov dword [ecx], 0x80000000
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x43fab2
jmp 0x43fac2
push 0x592f10
push 0x28
push str.internal_error:_entered_unreachable_code
call fcn.00497b20
add esp, 0xc
jmp 0x43fb13
push 0x592f00
push eax
push esi
call fcn.0049d4b0
add esp, 0xc
ud2
Function at 0x44d820
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov dword [ebp - 0x14], ecx
mov ecx, edx
mov edi, edx
call fcn.0044d290
mov ecx, dword [edi + 4]
cmp eax, ecx
ja 0x44d93b
mov edx, dword [edi]
mov ebx, edx
lea esi, [edx + eax]
movzx edx, byte [edi + 8]
mov edi, eax
sub edi, ecx
mov byte [ebp - 0xd], dl
jne 0x44d867
mov ebx, dword [ebp - 0x14]
xor edi, edi
movzx edx, byte [ebp - 0xd]
sub ecx, eax
jne 0x44d8e3
jmp 0x44d8c1
cmp dl, 3
mov dword [ebp - 0x18], esi
jae 0x44d88f
mov edx, ebx
lea esi, [ecx + ebx - 1]
mov ebx, dword [ebp - 0x14]
mov edi, eax
sub edi, ecx
nop dword [eax]
cmp byte [esi], 0x5c
je 0x44d925
dec esi
inc edi
jne 0x44d880
jmp 0x44d8b4
mov edx, ebx
lea esi, [ecx + ebx - 1]
nop word cs:[eax + eax]
nop
movzx ebx, byte [esi]
cmp ebx, 0x2f
je 0x44d8c5
cmp ebx, 0x5c
je 0x44d8c5
dec esi
inc edi
jne 0x44d8a0
mov ebx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
xor edi, edi
movzx edx, byte [ebp - 0xd]
sub ecx, eax
jne 0x44d8e3
mov al, 0xa
jmp 0x44d910
mov ebx, dword [ebp - 0x14]
not edi
lea eax, [eax + edi + 1]
cmp eax, ecx
ja 0x44d92f
add edx, eax
mov edi, 1
mov esi, edx
movzx edx, byte [ebp - 0xd]
sub ecx, eax
je 0x44d8c1
mov al, 9
cmp ecx, 2
je 0x44d902
cmp ecx, 1
jne 0x44d910
cmp byte [esi], 0x2e
jne 0x44d910
xor eax, eax
cmp dl, 3
setae al
lea eax, [eax + eax*2 + 7]
jmp 0x44d910
cmp byte [esi], 0x2e
jne 0x44d910
cmp byte [esi + 1], 0x2e
sete al
xor al, 9
add edi, ecx
mov dword [ebx], edi
mov byte [ebx + 4], al
mov dword [ebx + 8], esi
mov dword [ebx + 0xc], ecx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
not edi
lea eax, [eax + edi + 1]
cmp eax, ecx
jbe 0x44d8d2
push 0x591138
push ecx
push eax
call fcn.0049d450
push 0x591128
push ecx
push eax
call fcn.0049d450
nop word [eax + eax]
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x14
mov edi, dword [ebp + 8]
lea esi, [ebp - 0x1c]
push 4
push str.Iter
push dword [ebp + 0xc]
push esi
call fcn.0049be40
add esp, 0x10
push edi
call fcn.0044d3e0
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
lea eax, [ebp - 0x10]
push 0x59116c
push eax
push esi
call fcn.00498520
add esp, 0xc
push eax
call fcn.00498620
add esp, 0x18
pop esi
pop edi
pop ebp
ret
Function at 0x453230
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov esi, ecx
lea eax, [ebp - 0x20]
push dword [ebp + 8]
push edx
push eax
call fcn.0048ca50
add esp, 0xc
mov eax, dword [ebp - 0x20]
cmp eax, 0x80000000
jne 0x4532a7
mov edi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
xorps xmm0, xmm0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x40]
movups xmmword [ebp - 0x40], xmm0
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x38], 1
push eax
push ecx
push 0
push edi
call sub.ws2_32.dll_getaddrinfo
test eax, eax
je 0x4532d3
call sub.ws2_32.dll_WSAGetLastError
mov dword [esi + 8], eax
mov eax, 1
mov dword [esi + 4], 0
test ebx, ebx
mov dword [esi], eax
mov byte [edi], 0
jne 0x4532f3
jmp 0x4532ff
mov ecx, dword [0x5916c0]
mov edx, dword [0x5916c4]
test eax, eax
mov dword [esi + 8], edx
mov dword [esi + 4], ecx
mov dword [esi], 1
je 0x4532ff
push 1
push eax
push dword [ebp - 0x1c]
call fcn.004069c0
add esp, 0x40
jmp 0x453302
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
mov eax, dword [eax]
movzx eax, word [eax]
mov dword [esi + 4], ecx
mov dword [esi + 8], ecx
mov word [esi + 0xc], ax
xor eax, eax
test ebx, ebx
mov dword [esi], eax
mov byte [edi], 0
je 0x4532ff
push 1
push ebx
push edi
call fcn.004069c0
add esp, 0xc
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x453d10
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1024
call fcn.004addd0
mov esi, edx
mov edi, ecx
lea ebx, [ebp - 0x1030]
push 0x1000
push 0
push ebx
call sub.msvcrt.dll_memset
add esp, 0xc
xorps xmm0, xmm0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x30]
push 0x45e0b0
push eax
push 0x1000
push ebx
mov dword [ebp - 0x10], edi
push edi
call sub.kernel32.dll_ReadFileEx
test eax, eax
je 0x453e35
push 1
push 0xffffffffffffffff
call sub.kernel32.dll_SleepEx
cmp dword [ebp - 0x1c], 0
je 0x453d6e
cmp dword [ebp - 0x18], 0
jne 0x453e3c
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x453e3c
cmp ebx, 0x1000
ja 0x453e66
xor edi, edi
mov eax, ebx
sub eax, edi
jb 0x453e55
xorps xmm0, xmm0
lea edx, [ebp - 0x1c]
lea ecx, [ebp + edi - 0x1030]
mov dword [ebp - 0x1c], 0
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x20], edx
push 0x45e0b0
lea edx, [ebp - 0x30]
push edx
push eax
push ecx
push esi
call sub.kernel32.dll_WriteFileEx
test eax, eax
je 0x453e37
nop word [eax + eax]
push 1
push 0xffffffffffffffff
call sub.kernel32.dll_SleepEx
cmp dword [ebp - 0x1c], 0
je 0x453de0
cmp dword [ebp - 0x18], 0
jne 0x453e3c
add edi, dword [ebp - 0x14]
cmp edi, ebx
jne 0x453da0
xorps xmm0, xmm0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x20], eax
push 0x45e0b0
lea eax, [ebp - 0x30]
push eax
push 0x1000
lea eax, [ebp - 0x1030]
push eax
push dword [ebp - 0x10]
call sub.kernel32.dll_ReadFileEx
test eax, eax
jne 0x453d6e
jmp 0x453e37
call sub.kernel32.dll_GetLastError
push dword [ebp - 0x10]
call sub.kernel32.dll_CloseHandle
push esi
call sub.kernel32.dll_CloseHandle
add esp, 0x1024
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x59288c
push ebx
push edi
call fcn.0049d510
add esp, 0xc
jmp 0x453e79
push 0x59288c
push 0x1000
push ebx
call fcn.0049d4b0
add esp, 0xc
ud2
Function at 0x458be0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, ecx
lea ecx, [ebp - 0x24]
push dword [ebp + 8]
call fcn.00465420
add esp, 4
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
cmp edx, 0x80000000
je 0x458c34
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x30]
push 1
call fcn.00467780
add esp, 4
mov edi, dword [ebp - 0x18]
cmp edi, 0x80000000
jne 0x458c41
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov dword [esi], eax
mov dword [esi + 4], ecx
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebx, dword [ebp - 0x14]
push 0
push ebx
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
je 0x458c59
mov byte [esi], 4
test edi, edi
jne 0x458c68
jmp 0x458c39
call sub.kernel32.dll_GetLastError
mov byte [esi], 0
mov dword [esi + 4], eax
test edi, edi
je 0x458c39
add edi, edi
push 2
push edi
push ebx
call fcn.004069c0
add esp, 0x30
jmp 0x458c3c

Function at 0x459050
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
lea ecx, [ebp - 0x24]
push dword [ebp + 0x10]
call fcn.00465420
add esp, 4
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
cmp edx, 0x80000000
je 0x4590a8
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x30]
push 1
call fcn.00467780
add esp, 4
mov edi, dword [ebp - 0x18]
cmp edi, 0x80000000
jne 0x4590b7
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov dword [esi], eax
mov dword [esi + 4], ecx
mov eax, esi
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebx, dword [ebp - 0x14]
push ebx
call sub.kernel32.dll_DeleteFileW
test eax, eax
je 0x4590cd
mov byte [esi], 4
test edi, edi
jne 0x4590dc
jmp 0x4590ad
call sub.kernel32.dll_GetLastError
mov byte [esi], 0
mov dword [esi + 4], eax
test edi, edi
je 0x4590ad
add edi, edi
push 2
push edi
push ebx
call fcn.004069c0
add esp, 0xc
jmp 0x4590ad