joyce8/EMBER2024-capa huggingface dataset:
Function at 0x448ac8
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x448b20
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x448b05
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x448b03
push 0
push 0x6ecb
push 1
call fcn.0044959a
add esp, 0xc
jmp 0x448b1e
push 0
push 0
push 0
push 0
push 0
push 0
push 0x1ecb
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x448b41
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
push 1
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 0x372c
call fcn.0044597c
add esp, 0x10
mov esp, ebp
pop ebp
ret

Function at 0x448bac
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x448c42
lea eax, [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x448c22
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
push 2
mov ecx, dword [ebp - 0x20]
call fcn.004012ad
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
cmp dword [eax], ecx
jl 0x448c14
mov dword [ebp - 8], 1
jmp 0x448c18
and dword [ebp - 8], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
jmp 0x448c40
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x448c40
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x448c68
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
push 0
push 0x3d0e
push dword [ebp - 0x30]
push 0x4d9c
push dword [ebp - 0x34]
call fcn.00449c93
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x449fec
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x44a136
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x44a050
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x44a04b
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x44a134
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 4]
call fcn.004012ad
mov eax, dword [ebp - 8]
mov esi, dword [eax]
push 1
mov ecx, dword [ebp - 4]
call fcn.004012ad
cmp esi, dword [eax]
jge 0x44a0a9
mov dword [ebp - 0xc], 1
jmp 0x44a0ad
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 4]
call fcn.004012ad
mov esi, eax
push 1
mov ecx, dword [ebp - 4]
call fcn.004012ad
mov ecx, dword [esi]
imul ecx, dword [eax]
add ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
cmp ecx, dword [eax]
jne 0x44a0de
mov dword [ebp - 0x10], 1
jmp 0x44a0e2
and dword [ebp - 0x10], 0
cmp dword [ebp - 0x10], 0xdd9cd443
jne 0x44a0f4
mov dword [ebp - 0x14], 1
jmp 0x44a0f8
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
cmp dword [ebp - 0x14], eax
jl 0x44a10b
mov dword [ebp - 0x18], 1
jmp 0x44a10f
and dword [ebp - 0x18], 0
push 1
mov ecx, dword [ebp - 4]
call fcn.004012ad
mov esi, dword [ebp - 0x18]
imul esi, dword [eax]
push 1
mov ecx, dword [ebp - 4]
call fcn.004012ad
mov eax, dword [eax]
lea eax, [esi + eax + 1]
mov ecx, dword [ebp - 0x50]
mov dword [ecx], eax
jmp 0x44a150
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x54], eax
push 1
push 0x384a
push 0x19
push dword [ebp - 0x54]
call fcn.0044904e
add esp, 0x10
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4608a2
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x4608e4
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
push 0x3693
push dword [ebp - 0x10]
push 0x27e7
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 1
call fcn.004609a1
add esp, 0x18
jmp 0x46099d
lea eax, [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x460953
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x460934
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 3
jge 0x460951
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x30]
call fcn.004012ad
mov dword [eax], 6
jmp 0x460929
jmp 0x46099d
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], 0
jmp 0x460975
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0x12
jle 0x46099d
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x46099b
push 1
push 0x1b83
push 0x13e2
call dword [sym.imp.USER32.dll_AttachThreadInput]
jmp 0x46096a
mov esp, ebp
pop ebp
ret
Function at 0x46e671
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x474ac4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0046afb9
mov dword [ebp - 0x14], eax
cmp dword [0xa66f7c], esi
jne 0x46e764
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x46e6f1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x46e844
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x46e844
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x46e844
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0xa66f7c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0xa66f80], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0xa66f84], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0xa66f8c], eax
test eax, eax
je 0x46e761
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0xa66f88], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x46e789
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x46e77c
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x46e79e
push 4
pop eax
jmp 0x46e846
cmp dword [ebp - 0x14], esi
je 0x46e79e
push dword [0xa66f7c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x46e783
mov eax, dword [0xa66f88]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x46e7fc
cmp dword [0xa66f8c], edi
je 0x46e7fc
push eax
call ebx
push dword [0xa66f8c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x46e7fc
test eax, eax
je 0x46e7fc
call ecx
test eax, eax
je 0x46e7f1
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x46e7f1
test byte [ebp - 8], 1
jne 0x46e7fc
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x46e82c
mov eax, dword [0xa66f80]
cmp eax, edi
je 0x46e829
push eax
call ebx
test eax, eax
je 0x46e829
call eax
mov esi, eax
test esi, esi
je 0x46e829
mov eax, dword [0xa66f84]
cmp eax, edi
je 0x46e829
push eax
call ebx
test eax, eax
je 0x46e829
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0xa66f7c]
call ebx
test eax, eax
je 0x46e844
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x46e846
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004679bb
mov esp, ebp
pop ebp
ret
Function at 0x10012ee0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x10012eef
pop dword [ebp - 0x3c]
mov eax, 0x10012eef
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x1302d7f2
sub dword [ebp - 0x4c], 0xc4b092a7
mov dword [ebp - 0x48], 0xf246455d
add dword [ebp - 0x48], 0x3fed06e8
mov dword [ebp - 0x44], 0x12392150
sub dword [ebp - 0x44], 0xc5ecdd22
mov dword [ebp - 0x40], 0x67e9f738
add dword [ebp - 0x40], 0x981608c8
lea eax, [ebp - 0x4c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0xbb6bc0bc
add dword [ebp - 0x4c], 0xb906a89a
mov dword [ebp - 0x48], 0x58519da0
sub dword [ebp - 0x48], 0x16e53c2b
mov dword [ebp - 0x44], 0x18184d22
add dword [ebp - 0x44], 0x4b571f4a
mov dword [ebp - 0x40], 0x3b787537
sub dword [ebp - 0x40], 0x3b787537
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0xc667e23d
add eax, 0x499a6e3f
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3df4e
push 0
call eax
mov ecx, 0xc43eb3dc
add ecx, 0x3bc19ea5
xor esi, esi
add esi, eax
mov edi, 0x10030c00
add edi, dword [ebp - 0x3c]
mov edx, 0x7d6707a9
sub edx, 0x44bb3c31
sub dword [ebp - 0xc], ecx
mov ebx, dword [edi]
sub dword [ebp - 0x30], 0x1f8050e6
xor ebx, edx
xor dword [ebp - 0x1c], ecx
mov dword [esi], ebx
sub dword [ebp - 0x18], eax
add esi, 4
add edi, 0xda13cd69
add edi, 0x25ec329b
loop 0x10013003
add eax, 0x75aaa0fa
sub eax, 0x75a96423
xor ebx, ebx
add ebx, eax
add eax, 0x64a9703b
add eax, 0x9b568fca
mov ecx, 0xf72f3a33
sub ecx, 0xe72f3a33
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret

Function at 0x1001ca50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x2d], 0
jne 0x1001caeb
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push esi
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov esi, dword [ebp - 4]
cmp esi, ebx
je 0x1001caa2
mov byte [edi + 0x2d], 0xff
test esi, esi
je 0x1001caa2
cmp esi, ebx
jge 0x1001caa2
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [edi + 0x18], 0
je 0x1001cae5
add dword [edi + 0x1c], ebx
cmp dword [edi + 0x1c], 0xffff
jle 0x1001cae5
xor eax, eax
mov word [edi + 0x1e], ax
mov eax, dword [edi]
push edi
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x100252e0]
call esi
mov ecx, dword [edi + 0x18]
push 1
push dword [edi + 0x20]
mov esi, dword [ecx]
push eax
push ecx
mov ecx, dword [esi + 0xc]
call dword [0x100252e0]
call dword [esi + 0xc]
mov esi, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
jmp 0x1001cafd
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
pop edi
leave
ret 0xc
Function at 0x43e0b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x31000]
push edi
or ebp, 0xffffffff
jmp 0x43e0d2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x43e0d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x43e0c8
mov eax, 1
add ebx, ebx
jne 0x43e0eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x43e0e0
jne 0x43e0fc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x43e0e0
xor ecx, ecx
sub eax, 3
jb 0x43e110
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x43e182
mov ebp, eax
add ebx, ebx
jne 0x43e11b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x43e128
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x43e14c
inc ecx
add ebx, ebx
jne 0x43e138
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x43e12d
jne 0x43e149
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x43e12d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x43e16c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x43e15d
jmp 0x43e0ce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x43e16c
add edi, ecx
jmp 0x43e0ce
pop esi
mov edi, esi
mov ecx, 0x34
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x43e18a
cmp byte [edi], 0xb
jne 0x43e18a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x43e18f
lea edi, [esi + 0x3c000]
mov eax, dword [edi]
or eax, eax
je 0x43e207
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x3e9b0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x3e9ec]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x43e1bc
mov ecx, edi
jns 0x43e1eb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3e9f0]
or eax, eax
je 0x43e201
mov dword [ebx], eax
add ebx, 4
jmp 0x43e1d9
call dword [esi + 0x3e9f8]
mov ebp, dword [esi + 0x3e9f4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x43e23b
sub esp, 0xffffff80
jmp 0x401220
Function at 0x420880
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
mov ecx, dword [esi + 8]
call fcn.004206d0
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10]
test eax, eax
je 0x4208a9
mov ecx, dword [esi + 8]
mov dword [ecx + 0xc], eax
mov edi, dword [esi + 8]
lea eax, [ebp + 0x10]
push eax
push 0
push edi
push 0x420650
push 0
push 0
mov dword [ebp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x10], eax
test eax, eax
je 0x4208ed
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4208ed
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x10], 0
mov eax, dword [esi + 8]
pop edi
pop esi
mov al, byte [eax + 4]
pop ebp
ret 0xc
Function at 0x421130
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6f83a8
mov eax, dword fs:[0]
push eax
sub esp, 0x630
mov eax, dword [0x7ca418]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x638], edi
lea eax, [edi + 8]
mov dword [edi], 0
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], 0
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x63c], edi
jb 0x42118a
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
mov dword [ebp - 4], ecx
mov dword [edi + 0x34], 7
mov dword [edi + 0x30], ecx
cmp dword [edi + 0x34], 8
jb 0x4211a7
mov eax, dword [edi + 0x20]
jmp 0x4211aa
lea eax, [edi + 0x20]
xor ecx, ecx
mov word [eax], cx
lea eax, [edi + 0x38]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x4211c4
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [edi + 0x50]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x4211de
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
mov byte [ebp - 4], 3
push ecx
mov dword [edi + 0x68], ecx
mov dword [edi + 0x6c], ecx
call fcn.004f236c
push eax
call fcn.004fddf1
push 0x20c
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.004ea000
add esp, 0x14
lea eax, [ebp - 0x220]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x103
ja 0x421297
xor eax, eax
push 0x412
push eax
mov word [ebp - 0x16], ax
lea eax, [ebp - 0x634]
push eax
call fcn.004ea000
add esp, 0xc
lea eax, [ebp - 0x634]
push 0x208
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, 0x208
ja 0x421288
test eax, eax
je 0x421288
add eax, eax
cmp eax, 0x412
jae 0x421283
xor ecx, ecx
mov word [ebp + eax - 0x634], cx
lea eax, [ebp - 0x634]
jmp 0x42128e
call fcn.00458a40
lea eax, [ebp - 0x220]
push eax
lea ecx, [edi + 0x20]
call fcn.00420a50
mov eax, dword [edi + 0x30]
test eax, eax
je 0x4212c3
cmp dword [edi + 0x34], 8
jb 0x4212a9
mov ecx, dword [edi + 0x20]
jmp 0x4212ac
lea ecx, [edi + 0x20]
cmp word [ecx + eax*2 - 2], 0x5c
je 0x4212c3
push 1
push 0x794470
lea ecx, [edi + 0x20]
call fcn.00422710
cmp dword [edi + 0x30], 0
jne 0x4212d8
push 3
push 0x794474
lea ecx, [edi + 0x20]
call fcn.00420aa0
mov dword [edi + 4], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004584a2
mov esp, ebp
pop ebp
ret
Function at 0x421300
Capabilities:
Delete file

Disassembly:
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x48], 0
je 0x42131c
cmp dword [edi + 0x4c], 8
lea eax, [edi + 0x38]
jb 0x421315
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [edi + 0x68]
test eax, eax
je 0x421333
push eax
call fcn.0045862f
add esp, 4
mov dword [edi + 0x68], 0
mov eax, dword [edi + 0x64]
lea esi, [edi + 0x50]
cmp eax, 8
jb 0x421349
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.00420ba0
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x42135f
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
lea esi, [edi + 0x38]
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x42137a
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.00420ba0
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x421390
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
lea esi, [edi + 0x20]
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x4213ab
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.00420ba0
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x4213c1
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
mov eax, dword [edi + 0x1c]
cmp eax, 8
jb 0x4213db
inc eax
lea ecx, [edi + 8]
push eax
push dword [edi + 8]
call fcn.00420ba0
mov dword [edi + 0x1c], 7
cmp dword [edi + 0x1c], 8
mov dword [edi + 0x18], 0
jb 0x4213fa
mov eax, dword [edi + 8]
xor ecx, ecx
pop edi
pop esi
mov word [eax], cx
ret
xor eax, eax
mov word [edi + 8], ax
pop edi
pop esi
ret
Function at 0x42df10
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x81c
mov eax, dword [0x7ca418]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
push edi
push eax
mov eax, dword [ebx + 0x28]
call eax
mov edi, eax
add esp, 4
mov dword [ebp - 0x81c], edi
test edi, edi
je 0x42e08a
mov eax, dword [ebx + 0x38]
push esi
push edi
call eax
mov eax, dword [ebx + 0x34]
push edi
call eax
push 0x400
mov dword [ebp - 0x810], eax
lea eax, [ebp - 0x404]
push 0
push eax
call fcn.004ea000
push 0x400
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.004ea000
mov eax, dword [ebp - 0x810]
add esp, 0x20
xor esi, esi
test eax, eax
jle 0x42e077
nop
mov eax, dword [ebx + 0x98]
push esi
push edi
call eax
mov edi, eax
add esp, 8
test edi, edi
je 0x42e062
mov eax, dword [ebx + 0x8c]
push edi
call eax
mov dword [ebp - 0x80c], eax
mov eax, dword [ebx + 0x90]
push edi
mov dword [ebp - 0x808], edx
call eax
mov ecx, eax
mov dword [ebp - 0x814], edx
mov eax, dword [ebp - 0x80c]
add esp, 8
or eax, dword [ebp - 0x808]
mov dword [ebp - 0x818], ecx
jne 0x42dfea
mov eax, ecx
or eax, edx
je 0x42e062
push 0x400
lea eax, [ebp - 0x404]
push 0
push eax
call fcn.004ea000
push 0x400
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.004ea000
lea eax, [ebp - 0x404]
push eax
mov eax, dword [ebx + 0x7c]
push edi
call eax
push dword [ebp - 0x814]
lea eax, [ebp - 0x404]
push dword [ebp - 0x818]
push dword [ebp - 0x808]
push dword [ebp - 0x80c]
push eax
push str.ip___s_download_bytes___llu_upload_bytes___llu_n
lea eax, [ebp - 0x804]
push 0x400
push eax
call fcn.0042f640
add esp, 0x40
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [ebp - 0x810]
inc esi
mov edi, dword [ebp - 0x81c]
cmp esi, eax
jl 0x42df90
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004584a2
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop ebx
call fcn.004584a2
mov esp, ebp
pop ebp
ret 4