joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a6f2f
Capabilities:
Encode data using xor

Disassembly:
rcl al, 3
clc
add esi, dword [ebp]
or cx, 0x93a9
cmc
sbb al, ah
shld cx, di, 8
mov al, byte [esi]
call fcn.004a5342
not eax
clc
cmp dh, bl
mov byte [esp + 4], 0x3f
push dword [esp + 8]
xor ebx, eax
call fcn.004a5d40
add byte [eax], al
add byte [eax], al
mov al, byte [pe_dos_header]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, bl
adc byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
jl 0x4a6f13
inc ebx
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
push es
add byte [eax], bl
add byte [eax], al
add byte [esi + 0x1c32a032], cl
xor ebp, dword [esp + esi + 0x353334fd]
push 0x3d733d
adc byte [esi], al
add byte [eax + eax], dl
add byte [eax], al
stosd dword es:[edi], eax
aaa
in al, 0x37
cmp dword [eax], edi
or dword [ecx], edi
ret
Function at 0x408ab0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d92ca
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x5400e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x28], esi
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x2c], esi
call fcn.004830cf
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x408b70
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], vtable.std::exception.0
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], str.bad_locale_name
xorps xmm0, xmm0
mov byte [ebp - 0x14], 1
push eax
movq qword [ebp - 0x20], xmm0
call fcn.004af66b
add esp, 8
mov dword [ebp - 0x24], vtable.std::runtime_error.0
lea eax, [ebp - 0x24]
push 0x53e620
push eax
call fcn.004b1e41
push edi
push esi
call fcn.0048342d
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004981af
mov esp, ebp
pop ebp
ret 4
Function at 0x4162e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4da9e8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5400e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x41640e
cmp byte [ebx + 0x3d], 0
je 0x41640e
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x416339
xor al, al
jmp 0x416410
push 0
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.00415b90
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x28]
cmovae edi, dword [ebp - 0x28]
lea esi, [ebp - 0x28]
cmovae esi, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x41639f
sub eax, 1
je 0x4163a3
mov ecx, dword [ebp - 0x14]
sub eax, 2
je 0x4163f6
xor bl, bl
jmp 0x4163f8
mov byte [ebx + 0x3d], 0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae eax, edx
sub esi, eax
je 0x4163d8
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, edx
push 1
push eax
call fcn.004b7bdc
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp esi, eax
jne 0x41639b
cmp byte [ebx + 0x3d], 0
je 0x4163f6
test esi, esi
jne 0x416361
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.00415e90
jmp 0x41635e
mov bl, 1
cmp ecx, 0x10
jb 0x41640a
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.00417790
mov al, bl
jmp 0x416410
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004981af
mov esp, ebp
pop ebp
ret
Function at 0x417c70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d9426
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5400e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004983e4
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0048332a
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41f600
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x41f619
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x41f656
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x41f652
nop word [eax + eax]
cmp esi, edx
jae 0x41f656
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x41f640
cmp esi, edx
jb 0x41f65d
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x41f880
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x5400e4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x544cd0], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
jne 0x41f8b1
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004981af
mov esp, ebp
pop ebp
ret 8
test eax, eax
je 0x41f89f
push esi
push edi
call fcn.0041f910
push 0
mov esi, eax
lea eax, [ebp - 8]
push eax
push 0
push 1
push esi
push 0x20000001
push 0
push 1
push dword [0x544cd0]
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
mov edi, eax
test esi, esi
je 0x41f8f4
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.004981af
mov esp, ebp
pop ebp
ret 8
Function at 0x42e910
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4da9e8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5400e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x42ea4d
cmp byte [ebx + 0x3e], 0
je 0x42ea4d
mov eax, dword [ebx]
push 0xffff
call dword [eax + 0xc]
movzx eax, ax
mov ecx, 0xffff
cmp cx, ax
sete al
test al, al
je 0x42e974
xor al, al
jmp 0x42ea4f
push 0
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.00415b90
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
nop dword [eax]
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x28]
cmovae edi, dword [ebp - 0x28]
lea esi, [ebp - 0x28]
cmovae esi, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x42e9de
sub eax, 1
je 0x42e9e2
mov ecx, dword [ebp - 0x14]
sub eax, 2
je 0x42ea35
xor bl, bl
jmp 0x42ea37
mov byte [ebx + 0x3e], 0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae eax, edx
sub esi, eax
je 0x42ea17
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, edx
push 1
push eax
call fcn.004b7bdc
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp esi, eax
jne 0x42e9da
cmp byte [ebx + 0x3e], 0
je 0x42ea35
test esi, esi
jne 0x42e9a0
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.00415e90
jmp 0x42e999
mov bl, 1
cmp ecx, 0x10
jb 0x42ea49
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.00417790
mov al, bl
jmp 0x42ea4f
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004981af
mov esp, ebp
pop ebp
ret
Function at 0x42efa0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d9426
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5400e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.004983e4
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0048332a
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4305d0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x5400e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
push ebx
lea ecx, [edi + 8]
call fcn.00427600
lea ecx, [edi + 0xc]
push esi
call fcn.00427600
mov eax, dword [ebp + 0x10]
mov ecx, 1
mov dword [edi + 0x14], eax
mov eax, dword [edi + 0x10]
mov dword [ebp - 8], 0x10
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, 0x10
or ecx, eax
jge 0x430629
push 0x10
lea ecx, [edi + 0x10]
call fcn.00427890
mov ecx, dword [edi + 0x10]
cmp dword [ecx - 8], 0x10
jl 0x43067a
mov dword [ecx - 0xc], 0x10
mov eax, dword [edi + 0x10]
mov byte [eax + 0x10], 0
lea eax, [ebp - 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push dword [edi + 0x10]
lea eax, [edi + 4]
push dword [edi + 0x14]
push dword [edi + 0xc]
push dword [ebx]
push str._s__s_HTTP_1.0_r_nContent_Length:__d_r_nX_Client_Computer_Name:__s_r_n_r_n
push eax
call fcn.00432dd0
mov ecx, dword [ebp - 4]
add esp, 0x18
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004981af
mov esp, ebp
pop ebp
ret 0xc
push 0x80070057
call fcn.0041f520
int3
Function at 0x4311b0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dc2ab
mov eax, dword fs:[0]
push eax
mov eax, 0x10010
call fcn.00498cc0
mov eax, dword [0x5400e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1001c], 0
call fcn.00409f90
mov ecx, eax
test ecx, ecx
jne 0x431206
push 0x80004005
call fcn.0041f520
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x10014], esi
push 0xfffe
lea eax, [ebp - 0x10010]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.004b17e0
add esp, 0xc
mov dword [ebp - 0x10018], 0x7fff
lea eax, [ebp - 0x10018]
push eax
lea eax, [ebp - 0x10010]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x4312a3
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], eax
cmp dword [edi + 0x14], 8
jb 0x431267
mov eax, dword [edi]
jmp 0x431269
mov eax, edi
xor ecx, ecx
push ecx
mov word [eax], cx
mov ecx, edi
push 0x4fa770
call fcn.00415540
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x431347
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
jmp 0x431347
cmp dword [ebx + 0x5c], 8
lea eax, [ebx + 0x48]
jb 0x4312ae
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
lea eax, [ebp - 0x10010]
push eax
lea eax, [ebp - 0x10014]
push str._s__d__s
push eax
call fcn.0042f180
mov dword [edi + 0x10], 0
add esp, 0x14
mov dword [edi + 0x14], 0
mov dword [edi + 0x14], 7
cmp dword [edi + 0x14], 8
mov dword [edi + 0x10], 0
jb 0x4312f7
mov eax, dword [edi]
jmp 0x4312f9
mov eax, edi
mov esi, dword [ebp - 0x10014]
xor ecx, ecx
mov word [eax], cx
cmp word [esi], cx
je 0x43131f
mov ecx, esi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x431310
sub ecx, edx
sar ecx, 1
push ecx
push esi
mov ecx, edi
call fcn.00415540
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x431347
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004981af
mov esp, ebp
pop ebp
ret 4
Function at 0x432e90
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
mov esi, ecx
push dword [esi + 0x10]
push 0
push 0
push 4
push dword [esi]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [esi + 0x10]
mov edi, eax
mov esi, dword [ebp + 0xc]
cmp ecx, esi
cmovb esi, ecx
test edi, edi
je 0x432eda
push esi
push edi
push dword [ebp + 8]
call fcn.004b1260
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
xor eax, eax
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x1c]
push 0x53e610
push eax
mov dword [ebp - 4], 7
mov dword [ebp - 8], 0
call fcn.004b1e41
int3

Function at 0x43ee50
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dd17e
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x5400e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov edi, ecx
mov dword [ebp - 0x14], 0
call fcn.00409f90
mov ecx, eax
test ecx, ecx
jne 0x43ee9b
push 0x80004005
call fcn.0041f520
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
mov esi, 0x1a
test edi, edi
je 0x43eed2
cmp edi, 1
jne 0x43eec0
lea esi, [edi + 0x22]
jmp 0x43eed2
cmp edi, 2
jne 0x43eeca
lea esi, [edi + 0x1a]
jmp 0x43eed2
xor ecx, ecx
cmp edi, 3
cmove esi, ecx
mov ecx, dword [eax - 8]
mov edx, 1
sub edx, dword [eax - 4]
sub ecx, 0x104
or ecx, edx
jge 0x43eef7
push 0x104
lea ecx, [ebp - 0x14]
call fcn.00420a10
mov eax, dword [ebp - 0x14]
push eax
push 0
push 0
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
push dword [ecx - 8]
push ecx
call fcn.004b99b3
mov edx, eax
add esp, 8
test edx, edx
js 0x43efad
mov ecx, dword [ebp - 0x14]
cmp edx, dword [ecx - 8]
jg 0x43efad
mov dword [ecx - 0xc], edx
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], cl
mov word [eax + edx*2], cx
mov eax, dword [ebp - 0x14]
cmp word [eax], cx
jne 0x43ef4b
xor edx, edx
jmp 0x43ef5f
mov edx, eax
lea esi, [edx + 2]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x43ef50
sub edx, esi
sar edx, 1
push edx
push eax
mov ecx, ebx
call fcn.00415540
test edi, edi
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x14]
setns bl
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x43ef8f
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004981af
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.0041f520
int3
Function at 0x43efc0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x5400e4]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
xor eax, eax
mov dword [esp + 0x28], 7
push 0xffffffffffffffff
push eax
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], 0
mov word [esp + 0x20], ax
call fcn.00415640
mov edi, dword [esp + 0x28]
lea ecx, [esp + 0x14]
mov ebx, dword [esp + 0x14]
cmp edi, 8
mov eax, dword [esp + 0x24]
cmovae ecx, ebx
lea eax, [ecx + eax*2]
lea ecx, [esp + 0x14]
mov esi, eax
cmovae ecx, ebx
xor edx, edx
sub esi, ecx
inc esi
shr esi, 1
cmp ecx, eax
cmova esi, edx
test esi, esi
je 0x43f049
lea eax, [edx + 0x5c]
cmp word [ecx], 0x2f
jne 0x43f039
mov word [ecx], ax
inc edx
add ecx, 2
cmp edx, esi
jne 0x43f030
mov edi, dword [esp + 0x28]
mov ebx, dword [esp + 0x14]
cmp edi, 8
lea eax, [esp + 0x14]
push 0
cmovae eax, ebx
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
je 0x43f078
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
je 0x43f078
cmp eax, 0xb7
je 0x43f078
xor bl, bl
jmp 0x43f07a
mov bl, 1
mov ecx, dword [esp + 0x28]
cmp ecx, 8
jb 0x43f092
inc ecx
push ecx
push dword [esp + 0x18]
lea ecx, [esp + 0x1c]
call fcn.00417730
mov ecx, dword [esp + 0x2c]
mov al, bl
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004981af
mov esp, ebp
pop ebp
ret
Function at 0x4406b0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dd288
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x5400e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
mov ecx, 0x545d98
push 0
push 0x4fa770
mov dword [0x5448d8], 0x67452301
mov dword [0x5448dc], 0xefcdab89
mov dword [0x5448e0], 0x98badcfe
mov dword [0x5448e4], 0x10325476
mov dword [0x5448e8], 0xc3d2e1f0
call fcn.00415540
sub esp, 0x18
xor eax, eax
mov ecx, esp
xorps xmm0, xmm0
movlpd qword [0x5448d0], xmm0
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp + 8]
push eax
call fcn.00415640
call fcn.0043f0b0
add esp, 0x18
mov ecx, esi
call fcn.0043f2a0
mov ecx, dword [ebp + 0x1c]
cmp ecx, 8
jb 0x44077f
inc ecx
push ecx
push dword [ebp + 8]
lea ecx, [ebp + 8]
call fcn.00417730
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x447820
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x5400e4]
xor eax, esp
mov dword [esp + 0x190], eax
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x447875
mov eax, dword [esp]
cmp al, 2
jne 0x44786f
shr eax, 8
cmp al, 2
jne 0x44786f
call fcn.004647d0
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.004981af
add esp, 0x194
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x190]
mov eax, 2
xor ecx, esp
call fcn.004981af
add esp, 0x194
ret
Function at 0x44fd80
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x44fd9c
cmp dword [esi + 0x6c], 0
je 0x44fd9c
push 2
push 3
push esi
call fcn.00447290
add esp, 0xc
push dword [esp + 0xc]
call fcn.0044f080
add esp, 4
test esi, esi
je 0x44fdbd
cmp dword [esi + 0x6c], 0
je 0x44fdbd
push 3
push esi
call fcn.004472d0
add esp, 8
pop esi
ret
Function at 0x45a600
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 4]
cmp byte [eax + 0x1ec], 0
je 0x45a61d
push eax
call fcn.0045ef90
add esp, 4
test eax, eax
jne 0x45a63f
xor al, al
ret
mov eax, dword [eax + 0x1a8]
cmp eax, 0xffffffff
je 0x45a61a
push 2
push 1
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jne 0x45a63f
xor al, al
ret
mov al, 1
ret