joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100bb650
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10170350
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x30
push esi
push edi
mov eax, dword [0x1023d090]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebx + 0xc]
xor esi, esi
mov eax, dword [ebx + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
lea edi, [eax + ecx*4]
cmp eax, edi
je 0x100bb6c2
mov edx, esi
mov ecx, esi
shr ecx, 2
shl edx, 6
add ecx, 0x9e3779b9
add edx, dword [eax]
add eax, 4
add ecx, edx
xor esi, ecx
cmp eax, edi
jne 0x100bb6a5
mov edi, dword [ebx + 0xc]
mov eax, esi
mov ecx, 0xcc9e2d51
mul ecx
xor edx, eax
lea eax, [ebp - 0x24]
mov esi, edx
shr esi, 4
xor esi, edx
and esi, 0xf
push edx
shl esi, 6
add esi, dword [ebp - 0x1c]
push edi
push eax
mov ecx, esi
mov dword [ebp - 0x18], esi
call fcn.100bc350
cmp byte [ebp - 0x20], 0
lea eax, [esi + 4]
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
je 0x100bb73e
mov esi, edx
shl esi, 5
add esi, dword [eax]
push ecx
mov dword [ebp - 4], 1
lea eax, [esi + 0xc]
push edi
mov ecx, esi
mov dword [esi], eax
mov dword [esi + 4], 0
mov dword [esi + 8], 3
call fcn.100eb0c0
mov eax, dword [edi + 0x18]
mov ecx, dword [edi + 0x1c]
mov edx, dword [ebp - 0x24]
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [esi + 0x1c], ecx
mov esi, dword [ebp - 0x18]
mov esi, dword [esi]
lea ecx, [esi + edx]
shl edx, 5
add edx, dword [eax]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], edx
add eax, 0x400
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x40], edx
mov edx, dword [edx + 0xc]
mov dword [ebp - 0x38], ecx
add edx, esi
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
movups xmm0, xmmword [ebp - 0x40]
mov dword [ebp - 0x2c], ecx
mov cl, byte [ebp - 0x20]
movups xmmword [eax], xmm0
mov dword [ebp - 0x30], edx
movq xmm0, qword [ebp - 0x30]
movq qword [eax + 0x10], xmm0
mov byte [eax + 0x18], cl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
Function at 0x100cd480
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10171405
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x28
push esi
push edi
mov eax, dword [0x1023d090]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebx + 8]
cmp edi, dword [ebx + 0xc]
je 0x100cd678
cmp dword [edi + 0x14], 0x10
mov edx, edi
jb 0x100cd4d1
mov edx, dword [edi]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edi + 0x10], ecx
jbe 0x100cd4f2
nop dword [eax]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edi + 0x10]
jb 0x100cd4e0
push esi
push edi
lea eax, [ebp - 0x20]
mov ecx, 0x1024f230
push eax
call fcn.100eb0c0
cmp dword [ebp - 0x1c], 0
jne 0x100cd66c
cmp dword [0x1024f238], 0x7ffffff
je 0x100cd68e
mov dword [ebp - 0x2c], 0x1024f234
mov dword [ebp - 4], 0
mov dword [ebp - 0x28], 0
push 0x20
lfence
call fcn.100eb0c0
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x28], eax
add eax, 8
mov ecx, eax
mov dword [ebp - 0x14], eax
push edi
call fcn.100eb0c0
mov dword [ebp - 4], 1
mov eax, dword [0x1024f238]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10222200]
mov eax, dword [0x1024f24c]
mov dword [ebp - 0x24], eax
cvtpd2ps xmm2, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x10222200]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
movss xmm0, dword [0x1024f230]
comiss xmm1, xmm0
seta al
test al, al
je 0x100cd60c
divss xmm2, xmm0
movaps xmm0, xmm2
call fcn.100eb0c0
call fcn.10165340
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebp - 0x24]
cmp eax, ecx
jae 0x100cd5e2
cmp eax, 0x200
jae 0x100cd5e0
shl eax, 3
cmp eax, ecx
jae 0x100cd5e2
mov eax, ecx
push eax
mov ecx, 0x1024f230
call fcn.100eb0c0
push esi
push dword [ebp - 0x14]
lea eax, [ebp - 0x34]
mov ecx, 0x1024f230
push eax
call fcn.100eb0c0
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
jmp 0x100cd60f
mov edx, dword [ebp - 0x20]
mov ecx, dword [edx + 4]
mov eax, dword [ebp - 0x18]
inc dword [0x1024f238]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x28], 0
mov dword [eax], edx
mov dword [eax + 4], ecx
mov dword [ecx], eax
mov dword [edx + 4], eax
and esi, dword [0x1024f248]
mov ecx, dword [0x1024f23c]
mov eax, dword [ecx + esi*8]
cmp eax, dword [0x1024f234]
mov eax, dword [ebp - 0x18]
jne 0x100cd64e
mov dword [ecx + esi*8], eax
jmp 0x100cd661
cmp dword [ecx + esi*8], edx
jne 0x100cd658
mov dword [ecx + esi*8], eax
jmp 0x100cd665
mov edx, dword [ebp - 0x14]
cmp dword [ecx + esi*8 + 4], edx
jne 0x100cd665
mov dword [ecx + esi*8 + 4], eax
mov dword [ebp - 4], 0xffffffff
add edi, 0x18
cmp edi, dword [ebx + 0xc]
jne 0x100cd4c7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
push str.unordered_map_set_too_long
call fcn.100eb0c0
int3
Function at 0x100eb0c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x100eb0cf
pop dword [ebp - 0x38]
mov eax, 0x100eb0cf
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x9210afda
add dword [ebp - 0x48], 0xbc419571
mov dword [ebp - 0x44], 0x1c46a968
sub dword [ebp - 0x44], 0xea135d23
mov dword [ebp - 0x40], 0xde0c2d17
sub dword [ebp - 0x40], 0x91bfe8e9
mov dword [ebp - 0x3c], 0x1e5f806d
add dword [ebp - 0x3c], 0xe1a07f93
lea eax, [ebp - 0x48]
push eax
mov eax, 0x935fdd8a
add eax, 0x7cb872a2
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x62a9d988
sub dword [ebp - 0x48], 0xee377032
mov dword [ebp - 0x44], 0x59e3a8d0
sub dword [ebp - 0x44], 0x1877475b
mov dword [ebp - 0x40], 0xe90b506d
sub dword [ebp - 0x40], 0x859be401
mov dword [ebp - 0x3c], 0x750e6917
sub dword [ebp - 0x3c], 0x750e6917
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0xb542e574
add eax, 0x5ad56abc
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x8ac8c
push 0
call eax
mov ecx, 0x3b9c
mov ebx, eax
mov edi, 0x10266a00
add edi, dword [ebp - 0x38]
mov edx, 0xe1d0d7e6
add edx, 0x8fbffabf
add dword [ebp - 4], 0x1db9f989
mov esi, dword [edi]
sub dword [ebp - 8], 0x62383dd2
xor esi, edx
xor dword [ebp - 0x24], ebx
mov dword [ebx], esi
sub dword [ebp - 0x20], 0x3212a72f
add ebx, 4
add edi, 4
loop 0x100eb1e0
add eax, 0xab1a6997
add eax, 0x54e677ac
mov ebx, eax
add eax, 0x79e3e35e
add eax, 0x861c1ca7
mov ecx, 0x86bf1b4f
sub ecx, 0x76bf1b4f
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x1015fd80
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x1015fd91
pop esi
ret
push ebx
push edi
push esi
call fcn.100eb0c0
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.100eb0c0
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x1015fdb9
push ebx
push esi
push edi
call fcn.1013ae70
add esp, 0xc
push 0
call fcn.100eb0c0
pop ecx
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x401be0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_GetSystemDefaultLangID]
movzx ebx, ax
mov ecx, 0x419
mov eax, 0x68
cmp bx, cx
jne 0x401c02
mov eax, 0x67
jmp 0x401c11
mov edx, 0x422
cmp bx, dx
jne 0x401c11
mov eax, 0x69
movzx eax, ax
push 0x446750
push eax
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov edi, eax
test edi, edi
je 0x401c60
push edi
push esi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov esi, eax
test esi, esi
je 0x401c5a
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
push ebx
push eax
push esi
call fcn.00402c20
add esp, 0xc
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_FreeResource]
mov eax, edi
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x4022e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
cmp ecx, eax
je 0x402338
push ebx
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push esi
push edi
jmp 0x402300
mov ecx, dword [ebp - 4]
mov edi, dword [ecx + 8]
xor esi, esi
add edi, 4
jmp 0x402310
mov eax, dword [edi]
test eax, eax
je 0x402326
mov edx, dword [eax]
push 0
push edx
call ebx
inc esi
add edi, 4
cmp esi, 0x20
jl 0x402310
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp eax, dword [ecx]
jne 0x402300
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x402850
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
mov ecx, dword [eax + 4]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esi + 8]
mov eax, dword [edx + 4]
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop esi
ret
Function at 0x403230
Capabilities:
Copy file
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43f43b
mov eax, dword fs:[0]
push eax
sub esp, 0x658
mov eax, dword [0x45407c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
push 0x208
mov dword [ebp - 0x644], eax
xor ebx, ebx
lea eax, [ebp - 0x218]
lea edi, [ecx + 4]
push ebx
push eax
mov dword [ebp - 0x640], edx
mov esi, edi
call fcn.0042bf70
push 0x208
lea ecx, [ebp - 0x420]
push ebx
push ecx
call fcn.0042bf70
add esp, 0x18
cmp word [esi], 0x7c
je 0x4032ad
add esi, 2
cmp word [esi], 0x7c
jne 0x4032a4
push edi
xor edx, edx
lea eax, [ebp - 0x218]
push 0x104
mov word [esi], dx
push eax
add esi, 2
call fcn.00428080
lea eax, [ebp - 0x218]
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4032d3
sub eax, edx
push esi
lea edx, [ebp - 0x420]
sar eax, 1
xor ecx, ecx
push 0x104
push edx
mov word [ebp + eax*2 - 0x216], cx
call fcn.00428080
xor eax, eax
add esp, 0xc
mov word [ebp - 0x63c], ax
push 6
mov eax, str.Copy_
lea esi, [ebp - 0x63c]
mov dword [ebp - 0x628], 7
mov dword [ebp - 0x62c], ebx
call fcn.004040e0
lea eax, [ebp - 0x218]
mov dword [ebp - 4], ebx
lea edx, [eax + 2]
jmp 0x403340
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x403340
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x218]
lea ecx, [ebp - 0x63c]
call fcn.00403db0
mov ecx, eax
push 6
mov eax, str._to_
call fcn.00403db0
mov ecx, eax
lea eax, [ebp - 0x420]
lea esi, [eax + 2]
lea ebx, [ebx]
mov dx, word [eax]
add eax, 2
cmp dx, bx
jne 0x403380
sub eax, esi
sar eax, 1
push eax
lea eax, [ebp - 0x420]
call fcn.00403db0
mov ecx, eax
push 1
mov eax, 0x446880
call fcn.00403db0
mov esi, 8
cmp dword [eax + 0x14], esi
jb 0x4033b5
mov eax, dword [eax]
mov ecx, dword [ebp - 0x640]
push eax
push str.INFO
call fcn.00404920
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x628], esi
jb 0x4033e4
mov ecx, dword [ebp - 0x63c]
push ecx
call fcn.00427715
add esp, 4
push ebx
lea edx, [ebp - 0x420]
push edx
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
lea eax, [ebp - 0x218]
mov dword [ebp - 0x65c], eax
lea eax, [ebp - 0x664]
lea ecx, [ebp - 0x420]
mov edx, 0xe14
push eax
mov dword [ebp - 0x664], ebx
mov dword [ebp - 0x660], 2
mov dword [ebp - 0x658], ecx
mov word [ebp - 0x654], dx
mov dword [ebp - 0x652], ebx
mov dword [ebp - 0x64e], ebx
mov dword [ebp - 0x64a], 0x446884
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov esi, eax
cmp esi, ebx
je 0x403497
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x644]
mov edi, dword [sym.imp.SHLWAPI.dll_wnsprintfW]
push esi
push 0x446858
push ecx
push edx
call edi
push esi
push str.Error_copy_file__err:__d
lea eax, [ebp - 0x620]
push 0x100
push eax
call edi
add esp, 0x20
lea ecx, [ebp - 0x620]
push ecx
mov ecx, dword [ebp - 0x640]
push str.INFO
call fcn.00404920
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004276fb
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4034c0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43f3fb
mov eax, dword fs:[0]
push eax
sub esp, 0x450
mov eax, dword [0x45407c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
push 0x208
mov esi, ecx
xor edi, edi
lea ecx, [ebp - 0x21c]
push edi
push ecx
mov dword [ebp - 0x43c], eax
call fcn.0042bf70
add esp, 0xc
add esi, 4
push esi
lea edx, [ebp - 0x21c]
push 0x104
push edx
call fcn.00428080
lea eax, [ebp - 0x21c]
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x403534
sub eax, edx
sar eax, 1
xor ecx, ecx
mov word [ebp + eax*2 - 0x21a], cx
xor edx, edx
push 7
mov eax, str.Delete
lea esi, [ebp - 0x438]
mov dword [ebp - 0x424], 7
mov dword [ebp - 0x428], edi
mov word [ebp - 0x438], dx
call fcn.004040e0
lea eax, [ebp - 0x21c]
mov dword [ebp - 4], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x403584
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x21c]
lea ecx, [ebp - 0x438]
call fcn.00403db0
mov esi, 8
cmp dword [eax + 0x14], esi
jb 0x4035b1
mov eax, dword [eax]
push eax
push str.INFO
mov ecx, ebx
call fcn.00404920
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x424], esi
jb 0x4035dc
mov eax, dword [ebp - 0x438]
push eax
call fcn.00427715
add esp, 4
lea eax, [ebp - 0x45c]
lea ecx, [ebp - 0x21c]
mov edx, 0xc14
push eax
mov dword [ebp - 0x45c], edi
mov dword [ebp - 0x458], 3
mov dword [ebp - 0x454], ecx
mov dword [ebp - 0x450], edi
mov word [ebp - 0x44c], dx
mov dword [ebp - 0x44a], edi
mov dword [ebp - 0x446], edi
mov dword [ebp - 0x442], edi
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov esi, eax
cmp esi, edi
je 0x403672
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x43c]
mov edi, dword [sym.imp.SHLWAPI.dll_wnsprintfW]
push esi
push 0x446858
push ecx
push edx
call edi
push esi
push str.Error_delete_file__err:__d
lea eax, [ebp - 0x41c]
push 0x100
push eax
call edi
add esp, 0x20
lea ecx, [ebp - 0x41c]
push ecx
push str.INFO
mov ecx, ebx
call fcn.00404920
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004276fb
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4038e0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x5410
call fcn.004372f0
mov eax, dword [0x45407c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
push 0x44695c
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x403b13
push 0
lea ecx, [ebp - 0x540c]
push ecx
push 0x5000
lea edx, [ebp - 0x5408]
push edx
push eax
mov dword [ebp - 0x540c], 0
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push 0x446948
mov edi, eax
lea ecx, [ebp - 0x208]
xor eax, eax
push 0x100
push ecx
mov word [ebp - 0x208], ax
call fcn.0042800b
add esp, 0xc
test edi, edi
je 0x403b0a
mov ebx, dword [sym.imp.SHLWAPI.dll_wnsprintfW]
mov edx, dword [ebp - 0x540c]
lea ecx, [ebp - 0x5408]
push ecx
shr edx, 1
xor eax, eax
push str.Receive_command_:__s
mov word [ebp + edx*2 - 0x5408], ax
lea edx, [ebp - 0x408]
push 0x100
push edx
call ebx
mov ecx, dword [esi + 4]
add esp, 0x10
lea eax, [ebp - 0x408]
push eax
push str.INFO
call fcn.00404920
mov eax, dword [ebp - 0x540c]
mov ecx, dword [esi + 8]
mov edx, dword [ecx]
mov edx, dword [edx]
push eax
lea eax, [ebp - 0x5408]
push eax
call edx
mov edi, eax
test edi, edi
je 0x403a25
lea eax, [ebp - 0x5408]
push eax
push str.execute_command:__s
lea ecx, [ebp - 0x408]
push 0x100
push ecx
call ebx
mov ecx, dword [esi + 4]
add esp, 0x10
lea edx, [ebp - 0x408]
push edx
push str.INFO
call fcn.00404920
mov ecx, dword [esi + 4]
mov eax, dword [edi]
mov eax, dword [eax + 4]
push ecx
push 0x100
lea edx, [ebp - 0x208]
push edx
mov ecx, edi
call eax
jmp 0x403a47
push str._9999
lea edx, [ebp - 0x208]
xor ecx, ecx
push 0x100
push edx
mov word [ebp - 0x208], cx
call fcn.0042800b
add esp, 0xc
lea eax, [ebp - 0x208]
push eax
push str.command_result:__s
lea ecx, [ebp - 0x408]
push 0x100
push ecx
call ebx
mov ecx, dword [esi + 4]
add esp, 0x10
lea edx, [ebp - 0x408]
push edx
push str.INFO
call fcn.00404920
lea eax, [ebp - 0x208]
mov dword [ebp - 0x5410], 0
lea edx, [eax + 2]
jmp 0x403a90
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x403a90
sub eax, edx
push 0
sar eax, 1
lea ecx, [ebp - 0x5410]
push ecx
mov ecx, dword [esi]
lea edx, [eax + eax]
push edx
lea eax, [ebp - 0x208]
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x403b0a
mov ecx, dword [esi]
push 0
lea edx, [ebp - 0x540c]
push edx
push 0x5000
lea eax, [ebp - 0x5408]
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push 0x446948
mov edi, eax
lea eax, [ebp - 0x208]
xor edx, edx
push 0x100
push eax
mov word [ebp - 0x208], dx
call fcn.0042800b
add esp, 0xc
test edi, edi
jne 0x403979
mov ecx, dword [esi]
push ecx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004276fb
mov esp, ebp
pop ebp
ret
Function at 0x403b90
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x928
mov eax, dword [0x45407c]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
test ecx, ecx
je 0x403c69
mov eax, dword [ecx]
mov eax, dword [eax + 8]
lea edx, [ebp - 0x920]
push edx
push 0x208
lea edx, [ebp - 0x91c]
push edx
mov dword [ebp - 0x920], 0
call eax
mov ebx, dword [sym.imp.SHLWAPI.dll_wnsprintfW]
lea ecx, [ebp - 0x91c]
push ecx
push str.send_command_:__s
lea edx, [ebp - 0x30c]
push 0x100
push edx
call ebx
mov ecx, dword [esi + 4]
add esp, 0x10
lea eax, [ebp - 0x30c]
push eax
push str.INFO
call fcn.00404920
mov edx, dword [ebp - 0x920]
push 0
lea ecx, [ebp - 0x928]
push ecx
lea eax, [edx + edx]
mov edx, dword [esi]
push eax
lea ecx, [ebp - 0x91c]
push ecx
push edx
mov dword [ebp - 0x928], 0
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
jne 0x403c7c
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.Failed_to_send_data__err:__d
lea eax, [ebp - 0x50c]
push 0x100
push eax
call ebx
add esp, 0x10
lea ecx, [ebp - 0x50c]
push ecx
mov ecx, dword [esi + 4]
push str.ERROR
call fcn.00404920
xor al, al
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004276fb
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esi]
push 0
lea edx, [ebp - 0x924]
push edx
push 0xfe
lea eax, [ebp - 0x10c]
push eax
push ecx
mov dword [ebp - 0x924], 0
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov edx, dword [ebp - 0x924]
shr edx, 1
xor eax, eax
mov word [ebp + edx*2 - 0x10c], ax
test edi, edi
je 0x403cce
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x10c]
push ecx
push edx
push edi
call fcn.00428080
add esp, 0xc
push edi
push str.command_result:__s
lea eax, [ebp - 0x30c]
push 0x100
push eax
call ebx
add esp, 0x10
lea ecx, [ebp - 0x30c]
push ecx
mov ecx, dword [esi + 4]
push str.INFO
call fcn.00404920
mov ecx, dword [ebp - 8]
xor ecx, ebp
mov al, 1
pop ebx
call fcn.004276fb
mov esp, ebp
pop ebp
ret 4
Function at 0x4044d0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push eax
push 0x446b64
add esi, 0x10
push 0x4000
push esi
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x10
lea ecx, [ebp - 0xc]
push ecx
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
mov dword [ebp - 0x10], edi
test edi, edi
je 0x4045aa
mov ebx, 1
cmp dword [ebp - 0xc], ebx
jle 0x4045aa
mov dword [ebp - 8], 2
jmp 0x404526
mov edi, dword [ebp - 0x10]
push 0x200
call fcn.0042770a
mov edx, dword [edi + ebx*4]
push edx
push 0x446b64
push eax
mov dword [ebp - 0x14], eax
xor esi, esi
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [ebp - 8]
add esp, 0x10
cmp eax, dword [ebp - 0xc]
jge 0x40457d
mov ecx, dword [edi + ebx*4 + 4]
cmp word [ecx], 0x2f
je 0x40457d
inc dword [ebp - 8]
push 0x208
inc ebx
call fcn.0042770a
mov edx, dword [edi + ebx*4]
push edx
mov esi, eax
push 0x446b64
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], esi
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
call fcn.00405740
mov ecx, esi
push eax
push ecx
lea esi, [ebp - 0x24]
call fcn.004047a0
inc dword [ebp - 8]
inc ebx
cmp ebx, dword [ebp - 0xc]
jl 0x404523
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x404920
Capabilities:
Delete file
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4002c
call fcn.004372f0
mov eax, dword [0x45407c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x40020], eax
mov eax, dword [ebp + 0xc]
mov esi, ecx
push edi
mov dword [ebp - 0x4001c], esi
mov dword [ebp - 0x40024], eax
test eax, eax
je 0x404b2b
mov edi, dword [sym.imp.KERNEL32.DLL_CreateFileW]
push 0
push 0
push 4
push 0
push 0
push 0x40000000
add esi, 4
push esi
call edi
mov ebx, eax
cmp ebx, 0xffffffff
je 0x404b2b
push 0
push ebx
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
cmp eax, 0xffffffff
je 0x4049be
and eax, 0xfffffc00
cmp eax, 0x32000
jbe 0x4049be
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
push 0
push 0
push 4
push 0
push 0
push 0x40000000
push esi
call edi
mov ebx, eax
cmp ebx, 0xffffffff
je 0x404b2b
lea ecx, [ebp - 0x40018]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetSystemTime]
mov eax, dword [ebp - 0x40020]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4049e0
sub eax, edx
sar eax, 1
mov edx, eax
mov eax, dword [ebp - 0x40024]
lea esi, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x404a00
sub eax, esi
sar eax, 1
lea edi, [eax + edx + 0x400]
xor ecx, ecx
mov eax, edi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00427771
mov ecx, dword [ebp - 0x40024]
mov edx, dword [ebp - 0x4001c]
push ecx
mov esi, eax
xor eax, eax
mov word [esi], ax
movzx ecx, word [ebp - 0x4000a]
mov eax, dword [ebp - 0x40020]
add edx, 0x20c
push edx
movzx edx, word [ebp - 0x4000c]
push eax
movzx eax, word [ebp - 0x4000e]
push ecx
movzx ecx, word [ebp - 0x40010]
push edx
movzx edx, word [ebp - 0x40012]
push eax
movzx eax, word [ebp - 0x40016]
push ecx
movzx ecx, word [ebp - 0x40018]
push edx
push eax
push ecx
push str.__d__d__d__d:_d:_d:_d___s_:___s__:__s_r_n
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x38
lea edx, [ebp - 0x4001c]
push edx
push 0
push 0x40000
lea eax, [ebp - 0x40008]
push eax
push 0xffffffffffffffff
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
cmp eax, 0x40000
jae 0x404acb
mov byte [ebp + eax - 0x40008], 0
jmp 0x404ad8
cmp byte [ebp - 9], 0
je 0x404ad8
mov byte [ebp - 0x40008], 0
lea eax, [ebp - 0x40008]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404ae1
push 2
push 0
push 0
sub eax, edx
push ebx
mov edi, eax
mov dword [ebp - 0x40028], 0
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
push 0
lea ecx, [ebp - 0x40028]
push ecx
push edi
lea edx, [ebp - 0x40008]
push edx
push ebx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push esi
call fcn.00427715
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004276fb
mov esp, ebp
pop ebp
ret 8