joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4041b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov al, byte [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
push 0x10
mov byte [edi + 0x60], al
call fcn.00427d78
mov esi, eax
add esp, 4
test esi, esi
je 0x40421b
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 4
push 0x2000
push 0x80000
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0x10000
mov byte [esi + 0xc], 0
call ebx
mov ecx, dword [esi + 8]
push 4
push 0x1000
push ecx
push eax
mov dword [esi], eax
call ebx
mov edx, dword [esi + 8]
add dword [0x47cdf0], edx
jmp 0x40421d
xor esi, esi
lea eax, [edi + 0x48]
push eax
mov dword [esp + 0x10], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [edi + 0x3c]
mov ecx, dword [esi + 4]
lea eax, [esp + 0xc]
push eax
push ecx
push esi
call fcn.00403660
lea ecx, [edi + 0x38]
mov ebx, eax
call fcn.00404470
mov dword [esi + 4], ebx
mov edx, dword [ebx + 4]
lea eax, [edi + 0x48]
push eax
mov dword [edx], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
push 0
push edi
push 0x403e20
push 0
push 0
mov byte [edi + 0x44], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x404700
Capabilities:
Clear file content
Delete file
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x38]
cmp eax, 0xffffffff
je 0x404723
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov eax, dword [esi + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x38], 0xffffffff
cmp dword [esi + 0x20], 0x10
jb 0x40472e
mov eax, dword [esi + 0xc]
jmp 0x404731
lea eax, [esi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
and eax, 0xfffffffe
cmp dword [esi + 0x20], 0x10
jb 0x404746
mov ecx, dword [esi + 0xc]
jmp 0x404749
lea ecx, [esi + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cmp dword [esi + 0x20], 0x10
jb 0x404763
mov esi, dword [esi + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop esi
ret
add esi, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop esi
ret
Function at 0x4047e0
Capabilities:
Get disk size

Disassembly:
push 0xffffffffffffffff
push 0x43ebbb
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x47ac60]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
mov eax, dword [0x47ac60]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor ebx, ebx
cmp dword [0x47cdfc], ebx
jne 0x40488f
push 3
push ebx
push esi
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.00401c40
cmp dword [esp + 0x28], 0x10
mov eax, dword [esp + 0x14]
jae 0x404845
lea eax, [esp + 0x14]
push ebx
push ebx
lea ecx, [esp + 0x14]
push ecx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
mov eax, dword [esp + 0xc]
cmp eax, ebx
mov dword [0x47cdfc], eax
jne 0x40486b
mov dword [0x47cdfc], 0x1000
cmp dword [esp + 0x28], 0x10
jb 0x40487f
mov edx, dword [esp + 0x14]
push edx
call fcn.00427b4b
add esp, 4
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], ebx
mov byte [esp + 0x14], bl
push 0x50
call fcn.00427d78
add esp, 4
mov dword [esp + 0xc], eax
cmp eax, ebx
mov dword [esp + 0x38], ebx
je 0x4048b8
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
push ecx
push edx
push esi
push eax
call fcn.004048e0
jmp 0x4048ba
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.00427b50
add esp, 0x34
ret

Function at 0x4048e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x43eb88
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x47ac60]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
xor ebx, ebx
push 0xffffffffffffffff
lea ecx, [esi + 8]
mov dword [esi], vtable.FileWriter.0
push ebx
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], bl
call fcn.00401c40
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], edx
mov byte [esi + 0x30], bl
mov dword [esp + 0x14], ebx
mov dword [esi], vtable.FileWriterASync.0
mov dword [esi + 0x38], 0xffffffff
call fcn.00404450
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 0x10
Function at 0x404c20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [esi + 0x40]
push ebx
push edi
mov edi, dword [eax + 4]
cmp edi, eax
jne 0x404c37
call fcn.004285f7
cmp edi, dword [esi + 0x40]
jne 0x404c41
call fcn.004285f7
mov edi, dword [edi + 8]
mov ebx, dword [edi + 4]
test ebx, ebx
jle 0x404ce5
mov eax, dword [esi + 0x48]
mov dword [edi + 0x14], eax
mov eax, dword [esi + 0x48]
mov edx, dword [esi + 0x4c]
mov cl, 0x20
call fcn.0042c9f0
cmp byte [ebp + 8], 0
mov ecx, dword [0x47cdfc]
mov dword [edi + 0x18], eax
je 0x404c77
lea eax, [ebx + ecx - 1]
jmp 0x404c7e
mov eax, ebx
sub eax, ecx
add eax, 1
cdq
idiv ecx
mov edx, dword [edi]
mov ebx, eax
mov eax, dword [esi + 0x38]
imul ebx, ecx
lea ecx, [edi + 0xc]
push ecx
push 0
push ebx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x404cb6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x404cb6
or eax, 0xffffffff
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi + 4]
mov ecx, eax
sub ecx, ebx
jns 0x404cd2
cdq
xor ecx, ecx
add dword [esi + 0x48], eax
mov eax, ecx
adc dword [esi + 0x4c], edx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, ebx
cdq
add dword [esi + 0x48], eax
mov eax, ecx
adc dword [esi + 0x4c], edx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [edi]
mov ecx, dword [edi + 8]
sub dword [0x47cdf8], ecx
push 0x8000
push 0
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [edi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.00427b4b
mov eax, dword [esi + 0x40]
mov edi, dword [eax + 4]
add esp, 4
cmp edi, eax
jne 0x404d20
call fcn.004285f7
cmp edi, dword [esi + 0x40]
jne 0x404d2f
call fcn.004285f7
cmp edi, dword [esi + 0x40]
je 0x404d4b
mov ecx, dword [edi + 4]
mov edx, dword [edi]
mov dword [ecx], edx
mov eax, dword [edi]
mov ecx, dword [edi + 4]
push edi
mov dword [eax + 4], ecx
call fcn.00427b4b
add esp, 4
add dword [esi + 0x44], 0xffffffff
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4050e0
Capabilities:
Clear file content
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ebx
push ebp
push esi
mov ebx, ecx
mov eax, dword [ebx + 0x38]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CancelIo]
mov ecx, dword [ebx + 0x40]
mov ebp, dword [ecx]
lea edi, [ebx + 0x3c]
mov edi, edi
cmp edi, edi
mov esi, dword [edi + 4]
je 0x40510c
call fcn.004285f7
cmp ebp, esi
je 0x40515c
cmp ebp, dword [edi + 4]
jne 0x40511a
call fcn.004285f7
mov esi, dword [ebp + 8]
test esi, esi
je 0x40514d
mov eax, dword [esi]
mov edx, dword [esi + 8]
sub dword [0x47cdf8], edx
push 0x8000
push 0
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov ecx, dword [esi + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.00427b4b
add esp, 4
cmp ebp, dword [edi + 4]
jne 0x405157
call fcn.004285f7
mov ebp, dword [ebp]
jmp 0x405100
mov ecx, dword [edi + 4]
mov eax, dword [ecx]
mov dword [ecx], ecx
mov ecx, dword [edi + 4]
mov dword [ecx + 4], ecx
cmp eax, dword [edi + 4]
mov dword [edi + 8], 0
je 0x405187
mov esi, dword [eax]
push eax
call fcn.00427b4b
add esp, 4
cmp esi, dword [edi + 4]
mov eax, esi
jne 0x405175
mov eax, dword [ebx + 0x38]
cmp eax, 0xffffffff
je 0x4051a7
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov edx, dword [ebx + 0x38]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x38], 0xffffffff
mov esi, 0x10
cmp dword [ebx + 0x20], esi
jb 0x4051b6
mov eax, dword [ebx + 0xc]
jmp 0x4051b9
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
and eax, 0xfffffffe
cmp dword [ebx + 0x20], esi
jb 0x4051cd
mov ecx, dword [ebx + 0xc]
jmp 0x4051d0
lea ecx, [ebx + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cmp dword [ebx + 0x20], esi
jb 0x4051ef
mov ebx, dword [ebx + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
add ebx, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x405d90
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
je 0x405daf
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
call edx
test al, al
jne 0x405e16
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x14]
call edx
mov eax, dword [esi]
mov edx, dword [eax + 8]
push ebx
push edi
mov ecx, esi
call edx
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, dword [esp + 0x10]
test ebx, ebx
mov edi, eax
jne 0x405dd2
or edi, 1
jmp 0x405dda
cmp ebx, 1
jne 0x405dda
and edi, 0xfffffffe
mov eax, dword [esi]
mov edx, dword [eax + 8]
mov ecx, esi
call edx
mov eax, dword [eax]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x405e11
mov eax, dword [esi]
mov edx, dword [eax + 8]
mov ecx, esi
call edx
mov eax, dword [eax]
mov ecx, dword [esp + 0x14]
push eax
push str.chmod
call fcn.0040e9c0
pop edi
pop ebx
pop esi
ret 8
pop edi
mov dword [esi + 8], ebx
pop ebx
pop esi
ret 8
Function at 0x40ad50
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x18
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0x28]
mov edx, dword [eax + 4]
mov eax, dword [eax]
lea ecx, [esp + 0x28]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push edx
push eax
mov dword [esp + 0x38], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x40adaa
push str.create_key
push str.registry
lea ecx, [esp + 0x14]
call fcn.0040e9c0
cmp dword [esp + 0xc], 1
jle 0x40adc0
lea ecx, [esp + 0xc]
call fcn.00407ac0
xor eax, eax
add esp, 0x18
ret
mov eax, dword [esp + 0x24]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edi
mov edi, dword [esp + 0x24]
lea ecx, [esp + 8]
push ecx
push 0
lea edx, [esp + 0x14]
push edx
push 0
push edi
push eax
call ebx
test eax, eax
je 0x40ae09
cmp eax, 0xea
je 0x40ae09
mov ecx, dword [esp + 0x2c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x14]
call fcn.00407ac0
pop edi
xor eax, eax
pop ebx
add esp, 0x18
ret
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 0x2c]
cmp eax, dword [esi + 8]
mov dword [esi + 4], eax
jle 0x40ae23
push 0
mov ecx, esi
call fcn.004066e0
mov eax, dword [esi]
lea edx, [esp + 0xc]
push edx
mov edx, dword [esp + 0x34]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0
push edi
push edx
call ebx
mov eax, dword [esp + 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x18]
call fcn.00407ac0
pop esi
pop edi
mov eax, 1
pop ebx
add esp, 0x18
ret
Function at 0x40af10
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x6c
push ebx
xor ebx, ebx
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x80]
mov edx, dword [eax + 4]
mov eax, dword [eax]
lea ecx, [esp + 0x80]
push ecx
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push edx
push eax
mov dword [esp + 0x40], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x40af63
push str.create_key
push str.registry
lea ecx, [esp + 0x1c]
call fcn.0040e9c0
cmp dword [esp + 0x14], 1
jle 0x40af7a
lea ecx, [esp + 0x14]
call fcn.00407ac0
xor eax, eax
pop ebx
add esp, 0x6c
ret
push esi
push ebx
push 0xffffffffffffffff
lea ecx, [esp + 0x2c]
call fcn.00416d20
mov edx, dword [esp + 0x78]
mov eax, edx
mov dword [esp + 0x24], vtable.CharSetCvtUTF816.0
lea esi, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x40af98
push ebp
push edi
push ebx
sub eax, esi
push eax
push edx
lea ecx, [esp + 0x38]
call fcn.00416510
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
mov edi, eax
mov eax, dword [esp + 0x94]
push ebx
push edi
push eax
call ebp
cmp eax, ebx
je 0x40afee
cmp eax, 0xea
je 0x40afee
mov ecx, dword [esp + 0x88]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40b095
mov eax, dword [esp + 0x10]
add eax, 1
xor ecx, ecx
shr eax, 1
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00427d78
mov edx, dword [esp + 0x8c]
add esp, 4
mov esi, eax
lea eax, [esp + 0x10]
push eax
push esi
lea ecx, [esp + 0x1c]
push ecx
push ebx
push edi
push edx
call ebp
mov eax, esi
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40b030
sub eax, edx
sar eax, 1
push ebx
lea eax, [eax + eax + 2]
push 0xffffffffffffffff
lea ecx, [esp + 0x5c]
mov dword [esp + 0x18], eax
call fcn.00416d20
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
push edx
push esi
lea ecx, [esp + 0x60]
mov dword [esp + 0x60], vtable.CharSetCvtUTF168.0
call fcn.00416510
push esi
mov edi, eax
call fcn.00427b4b
mov eax, dword [esp + 0x8c]
add esp, 4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebx
jne 0x40b0b1
lea ecx, [esp + 0x54]
call fcn.00416330
lea ecx, [esp + 0x2c]
call fcn.00416330
lea ecx, [esp + 0x20]
call fcn.00407ac0
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
add esp, 0x6c
ret
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x84]
push edx
push edi
mov dword [ecx + 4], ebx
call fcn.00406750
lea ecx, [esp + 0x54]
call fcn.00416330
lea ecx, [esp + 0x2c]
call fcn.00416330
lea ecx, [esp + 0x20]
call fcn.00407ac0
pop edi
pop ebp
pop esi
mov eax, 1
pop ebx
add esp, 0x6c
ret
Function at 0x413570
Capabilities:
Get hostname

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, 0x40
cmp dword [esi + 8], eax
mov dword [esi + 4], eax
jge 0x41358b
push 0
mov ecx, esi
call fcn.004066e0
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push eax
push ecx
call sub.WSOCK32.dll_gethostname
test eax, eax
jl 0x4135b7
mov eax, dword [esi]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4135a0
sub eax, edx
mov dword [esi + 4], eax
mov eax, 1
pop esi
ret 4
mov eax, dword [esi + 4]
lea ecx, [esp + 8]
mov dword [esp + 8], eax
mov eax, dword [esi]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x4135ec
mov eax, dword [esi]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4135d5
sub eax, edx
mov dword [esi + 4], eax
mov eax, 1
pop esi
ret 4
push str.COMPUTERNAME
call fcn.0042aa1e
add esp, 4
test eax, eax
je 0x413615
push eax
mov ecx, esi
mov dword [esi + 4], 0
call fcn.004067a0
mov eax, 1
pop esi
ret 4
xor eax, eax
pop esi
ret 4

Function at 0x413620
Capabilities:
Get session user name

Disassembly:
sub esp, 0x234
mov eax, dword [0x47ac60]
xor eax, esp
mov dword [esp + 0x230], eax
push ebp
mov ebp, dword [esp + 0x240]
push esi
mov esi, dword [esp + 0x240]
push edi
xor edi, edi
test ebp, ebp
jne 0x413668
push 0x28
call fcn.00427d78
add esp, 4
test eax, eax
je 0x413664
mov ecx, eax
call fcn.0040aee0
mov edi, eax
jmp 0x413666
xor edi, edi
mov ebp, edi
push str.USERNAME
mov ecx, ebp
call fcn.0040b6b0
test eax, eax
je 0x4136a5
push eax
mov ecx, esi
mov dword [esi + 4], 0
call fcn.004067a0
test edi, edi
je 0x41369b
mov ecx, edi
call fcn.0040b990
push edi
call fcn.00427b4b
add esp, 4
mov eax, 1
jmp 0x413755
mov ecx, ebp
call fcn.0040ae60
cmp eax, 1
jne 0x41376f
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x3c]
push ecx
mov dword [esp + 0x14], 0x101
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x41373f
push 0
push 0xffffffffffffffff
lea ecx, [esp + 0x18]
call fcn.00416d20
mov edx, dword [esp + 0xc]
push 0
lea eax, [edx + edx - 2]
push eax
lea ecx, [esp + 0x40]
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], vtable.CharSetCvtUTF168.0
call fcn.00416510
test eax, eax
je 0x413736
push eax
mov ecx, esi
mov dword [esi + 4], 0
call fcn.004067a0
test edi, edi
je 0x413726
mov ecx, edi
call fcn.0040b990
push edi
call fcn.00427b4b
add esp, 4
lea ecx, [esp + 0x10]
call fcn.00416330
mov eax, 1
jmp 0x413755
lea ecx, [esp + 0x10]
call fcn.00416330
test edi, edi
je 0x413753
mov ecx, edi
call fcn.0040b990
push edi
call fcn.00427b4b
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x23c]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00427b50
add esp, 0x234
ret 8
mov eax, 0x80
cmp dword [esi + 8], eax
mov dword [esi + 4], eax
jge 0x413785
push 0
mov ecx, esi
call fcn.004066e0
mov eax, dword [esi]
mov edx, dword [esi + 4]
lea ecx, [esp + 0xc]
push ecx
push eax
mov dword [esp + 0x14], edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x41373f
mov eax, dword [esi]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4137a3
sub eax, edx
mov dword [esi + 4], eax
jmp 0x413687
Function at 0x4137c0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x338
mov eax, dword [0x47ac60]
xor eax, esp
mov dword [esp + 0x334], eax
push ebp
push esi
mov esi, dword [esp + 0x348]
xor ebp, ebp
test esi, esi
push edi
mov edi, dword [esp + 0x348]
jne 0x413808
push 0x28
call fcn.00427d78
add esp, 4
test eax, eax
je 0x413804
mov ecx, eax
call fcn.0040aee0
mov esi, eax
jmp 0x413806
xor esi, esi
mov ebp, esi
push str.USERPROFILE
mov ecx, esi
call fcn.0040b6b0
test eax, eax
je 0x41382c
push eax
mov ecx, edi
mov dword [edi + 4], 0
call fcn.004067a0
jmp 0x4138c2
mov ecx, esi
call fcn.0040ae60
cmp eax, 1
je 0x413861
push 0x104
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x413861
lea ecx, [esp + 0x34]
push ecx
mov ecx, edi
mov dword [edi + 4], 0
call fcn.004067a0
jmp 0x4138c2
push 0x104
lea edx, [esp + 0x13c]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov esi, eax
test esi, esi
je 0x4138c2
push 0
push 0xffffffffffffffff
lea ecx, [esp + 0x14]
call fcn.00416d20
push 0
lea eax, [esi + esi]
push eax
lea ecx, [esp + 0x140]
push ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], vtable.CharSetCvtUTF168.0
call fcn.00416510
test eax, eax
je 0x4138b9
push eax
mov ecx, edi
mov dword [edi + 4], 0
call fcn.004067a0
lea ecx, [esp + 0xc]
call fcn.00416330
cmp dword [edi + 4], 0
je 0x4138d4
push str.p4tickets.txt
mov ecx, edi
call fcn.004067a0
test ebp, ebp
je 0x4138e8
mov ecx, ebp
call fcn.0040b990
push ebp
call fcn.00427b4b
add esp, 4
mov ecx, dword [esp + 0x340]
xor eax, eax
cmp dword [edi + 4], eax
pop edi
pop esi
setne al
pop ebp
xor ecx, esp
call fcn.00427b50
add esp, 0x338
ret 8

Function at 0x414490
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push esi
push edi
mov esi, ecx
mov ecx, dword [esp + 0xc]
mov edx, dword [esi + 0x2c]
push eax
push ecx
push edx
call fcn.00439213
mov edi, eax
add esp, 0xc
test edi, edi
jge 0x4144cc
mov eax, dword [esi]
mov edx, dword [eax + 8]
mov ecx, esi
call edx
mov eax, dword [eax]
mov ecx, dword [esp + 0x14]
push eax
push str.read
call fcn.0040e9c0
mov eax, edi
pop edi
pop esi
ret 0xc
Function at 0x414810
Capabilities:
Delete file

Disassembly:
sub esp, 0x28
cmp dword [esp + 0x2c], 0
push esi
je 0x41488e
push 0
push 0xffffffffffffffff
lea ecx, [esp + 0xc]
call fcn.00416d20
mov eax, edi
mov dword [esp + 4], vtable.CharSetCvtUTF816.0
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x414835
push 0
sub eax, edx
push eax
push edi
lea ecx, [esp + 0x10]
call fcn.00416510
lea ecx, [esp + 4]
mov esi, eax
call fcn.00416350
test eax, eax
jne 0x414885
push esi
call fcn.0042c571
mov esi, eax
add esp, 4
test esi, esi
jge 0x414875
call fcn.0042b332
cmp dword [eax], 2
je 0x414885
lea ecx, [esp + 4]
call fcn.00416330
mov eax, esi
pop esi
add esp, 0x28
ret
lea ecx, [esp + 4]
call fcn.00416330
pop esi
add esp, 0x28
mov dword [esp + 4], edi
jmp 0x42c542
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x42c52e
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x42c530
xor eax, eax
test eax, eax
je 0x42c53f
push eax
call fcn.0042b358
pop ecx
or eax, 0xffffffff
ret
xor eax, eax
ret
jmp 0x42c518

Function at 0x416e90
Capabilities:
Hash data with md5

Disassembly:
mov eax, ecx
xor ecx, ecx
mov dword [eax + 0xc], 0x67452301
mov dword [eax + 0x10], 0xefcdab89
mov dword [eax + 0x14], 0x98badcfe
mov dword [eax + 0x18], 0x10325476
mov dword [eax + 8], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
ret

Function at 0x418410
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x404
mov eax, dword [0x47ac60]
xor eax, esp
mov dword [esp + 0x400], eax
push ebx
mov ebx, dword [esp + 0x414]
push ebp
mov ebp, dword [esp + 0x410]
push esi
push edi
mov edi, dword [esp + 0x424]
mov esi, ecx
nop
mov ecx, dword [esi + 4]
cmp ecx, ebx
mov eax, ebx
jge 0x41844b
mov eax, ecx
mov ecx, dword [esi + 0x14]
mov edx, dword [esi]
mov eax, dword [edx + eax*8 + 4]
sub eax, dword [ecx + 0x1c]
push edi
sub eax, dword [ecx + 4]
add eax, dword [ecx + 8]
push eax
push 0x400
lea eax, [esp + 0x1c]
push eax
call fcn.004179f0
test eax, eax
je 0x418485
push ebp
push eax
lea ecx, [esp + 0x18]
push 1
push ecx
call fcn.004291c3
add esp, 0x10
jmp 0x418440
mov ecx, dword [esp + 0x410]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00427b50
add esp, 0x404
ret 0x10

Function at 0x41a6b0
Capabilities:
Set socket configuration

Disassembly:
push esi
mov esi, dword [esp + 8]
mov al, byte [esi]
xor edx, edx
test al, al
mov ecx, esi
je 0x41a6d6
nop
cmp al, 0x2e
jne 0x41a6c7
add edx, 1
mov al, byte [ecx + 1]
add ecx, 1
test al, al
jne 0x41a6c0
cmp edx, 3
je 0x41a6dc
xor eax, eax
pop esi
ret 8
push esi
call dword [sym.imp.WSOCK32.dll_inet_addr]
cmp eax, 0xffffffff
je 0x41a6d6
mov ecx, dword [esp + 0xc]
mov dword [ecx], eax
mov eax, 1
pop esi
ret 8
Function at 0x41a770
Capabilities:
Resolve dns

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x1c]
mov dword [esi], 0
push ecx
mov byte [eax], 0
call dword [sym.imp.WSOCK32.dll_gethostbyname]
mov ecx, eax
test ecx, ecx
mov dword [esp + 0x1c], ecx
je 0x41a814
cmp word [ecx + 8], 2
push ebx
push ebp
push edi
jne 0x41a7e5
cmp word [ecx + 0xa], 4
jne 0x41a7e5
mov edi, dword [ecx + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x41a7e5
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
lea esp, [esp]
mov edx, dword [eax]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebx
push ebp
call fcn.0041a700
test eax, eax
mov dword [esi], eax
je 0x41a808
add edi, 4
lea esi, [eax + 0x1c]
mov eax, dword [edi]
test eax, eax
jne 0x41a7c0
mov ecx, dword [esp + 0x28]
mov ecx, dword [ecx]
mov edx, dword [esp + 0x24]
push 0x400
push ecx
push 0x401
push edx
call fcn.0042cfe3
add esp, 0x10
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
ret 0x18
pop edi
pop ebp
pop ebx
mov eax, 8
pop esi
ret 0x18
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
add eax, 0xffffd507
cmp eax, 3
ja case.0x41a824.11001
jmp dword [eax*4 + 0x41a848]
mov eax, 0x2af9
pop esi
ret 0x18
mov eax, 0x2afa
pop esi
ret 0x18
mov eax, 0x2afb
pop esi
ret 0x18