joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44c2a0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x44c2d3
push esi
call fcn.0045a650
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x44c2cc
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x44c359
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x44c342
mov eax, dword [esi + 8]
test eax, eax
je 0x44c2f7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x44c33e
cmp eax, 2
je 0x44c342
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x44c2ea
cmp eax, 3
je 0x44c31d
cmp eax, 1
jne 0x44c2ea
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x44c2ea
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x44c2ea
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0044c380
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x44c368
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0044c380
add esp, 4
pop esi
ret

Function at 0x44cbf0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x44cc11
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x44cc11
mov eax, dword [eax + 0x44]
test eax, eax
je 0x44cc11
mov edx, dword [esp + 8]
push edx
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x469e90
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x469f33
test eax, eax
jbe 0x469f33
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x469f33
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x469ede
xor esi, esi
jmp 0x469ee4
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x469f0f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.0046e110
add esi, eax
push esi
mov ebx, esi
call fcn.0046e110
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x469ef0
pop ebp
test edi, edi
pop edi
jne 0x469f33
test ebx, ebx
je 0x469f33
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.0047e5c0
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc
Function at 0x46a055
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x46a16d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x46a16d
mov eax, dword [esi + 0x3c]
push eax
call fcn.0048f5bb
mov esi, eax
test esi, esi
je 0x46a16d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x46a16d
mov ecx, esi
call fcn.00469fe0
cmp edi, eax
jge 0x46a16d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x46a0f3
mov dword [esp + 0x34], 1
jmp 0x46a14e
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x46a16d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.00469580
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc

Function at 0x46e660
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push edi
push esi
sub esp, 0x100
mov edi, dword [esp + 0x118]
mov ebx, dword [esp + 0x114]
mov esi, dword [esp + 0x110]
xor ecx, ecx
mov byte [esi + ecx], cl
mov eax, ecx
xor edx, edx
div edi
movzx eax, byte [ebx + edx]
mov byte [esp + ecx], al
lea eax, [ecx + 1]
mov byte [esi + ecx + 1], al
xor edx, edx
div edi
movzx eax, byte [ebx + edx]
mov byte [esp + ecx + 1], al
add ecx, 2
cmp ecx, 0x100
jne 0x46e680
xor ecx, ecx
xor eax, eax
nop word cs:[eax + eax]
nop dword [eax]
movzx edx, byte [esi + eax]
add ecx, edx
mov edi, edx
movzx edx, byte [esp + eax]
add edx, ecx
movzx ecx, dl
movzx ebx, byte [esi + ecx]
mov byte [esi + eax], bl
mov ebx, edi
mov byte [esi + ecx], bl
movzx ebx, byte [esi + eax + 1]
add edx, ebx
movzx ecx, byte [esp + eax + 1]
add ecx, edx
movzx ecx, cl
movzx edx, byte [esi + ecx]
mov byte [esi + eax + 1], dl
mov byte [esi + ecx], bl
add eax, 2
cmp eax, 0x100
jne 0x46e6c0
add esp, 0x100
pop esi
pop edi
pop ebx
ret
Function at 0x46e710
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x46e76c
mov ebp, dword [esp + 0x14]
xor ebx, ebx
xor eax, eax
xor ecx, ecx
nop word cs:[eax + eax]
add ebx, 1
movzx ebx, bl
movzx esi, byte [ebp + ebx]
add ecx, esi
movzx ecx, cl
movzx edx, byte [ebp + ecx]
mov byte [ebp + ebx], dl
mov edx, esi
mov byte [ebp + ecx], dl
movzx edx, byte [ebp + ebx]
add edx, esi
movzx edx, dl
movzx edx, byte [ebp + edx]
mov esi, dword [esp + 0x18]
xor byte [esi + eax], dl
add eax, 1
cmp edi, eax
jne 0x46e730
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x48ff5e
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x48ff96
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0048e015
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0048dfed
jmp 0x48ffa2
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x491655
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x491697
call fcn.00497108
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x491697
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x49168e
xor eax, eax
jmp 0x49169f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004916a5
pop edi
pop esi
pop ebx
ret 4

Function at 0x497638
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x497666
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x497684
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0049759e
jmp 0x497684
mov eax, dword [esi + 0x14]
test eax, eax
je 0x497684
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0049759e
test edi, edi
mov eax, edi
jne 0x49766e
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4011e7
Capabilities:
Encode data using xor

Disassembly:
jmp 0x40120b
add si, 0xffad
call dword [0x401080]
and edx, esi
push ebp
not esi
mov ebx, 0x2ef4fdaa
xor edx, 0xfb7ba04d
mov ecx, dword [sym.imp.kernel32.dll_GetLastError]
ror ax, 0xc
call ecx
pop edx
mov eax, 0
add eax, 0x4010cb
mov esi, dword [eax + 0x3c]
add ecx, edx
xor eax, 0x7d3583bd
add edx, 1
ror di, 3
mov ecx, dword [edx]
xor eax, esi
sub ecx, esi
test ecx, ecx
jne 0x401242
sal esi, 0x1e
xchg edi, edx
rol ax, 3
add edi, 0xfffffff8
and ecx, 0x28c61fa5
mov dx, word [edi]
sub esi, 0xf26207d
mov ebx, edx
xor eax, eax
xor ecx, esi
push esp
pop edi
add ecx, dword [esp]
mov eax, dword [edi]
inc esi
push eax
pop edx
mov esi, 0x401042
and eax, edx
mov eax, dword [esi + 0x15]
rol si, 0xf
mov ecx, dword [edx]
sub di, 0xffef
inc edx
mov edi, ecx
sal esi, 8
xor edi, eax
neg ecx
test edi, edi
je 0x4012ad
sar esi, 0x18
jmp 0x401292
sub ax, 0x6f
xchg edx, ebp
ror cx, 3
or ecx, 0xaf09a98d
mov esi, 0x3f82c5
neg edi
mov eax, ebx
shl eax, 0x10
sar edi, 0x1d
shr eax, 0x10
add edx, eax
add esi, eax
ror edx, 0x1a
push esi
sar eax, 0xf
xor ecx, ecx
add edx, eax
mov eax, dword fs:[ecx]
sub di, 0xffa3
push eax
and esi, 0xb7c6fd95
mov edx, esp
add esi, edi
mov dword fs:[0], edx
xor eax, ebp
push ecx
sub edi, 0xd86072e5
mov eax, ebp
sub si, 0xffbe
mov ecx, dword [7]
push eax
add esi, dword [esp]
push 0x1c5dd6e
push ecx
inc eax
xor ecx, ecx
xor ecx, 5
add dword [ecx], esi
add eax, 0xe7ab42d5
call dword [sym.imp.comctl32.dll_ImageList_Destroy]
invalid
Function at 0x5d21e4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
pushal
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
test eax, eax
je 0x5d2282
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
test eax, eax
jne 0x5d2282
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
cmp word [eax], 0x5a4d
jne 0x5d2282
mov ebx, dword [eax + 0x3c]
add eax, ebx
cmp dword [eax], 0x4550
jne 0x5d2282
mov ebx, dword [eax + 0x34]
mov dword [ebp - 0xc], ebx
mov ebx, dword [eax + 0x50]
mov dword [ebp - 8], ebx
push edi
push 4
push 0x2000
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [edi + 0x122d2be0]
pop edi
test eax, eax
jne 0x5d2275
push edi
push 4
push 0x2000
push dword [ebp - 8]
push 0
call dword [edi + 0x122d2be0]
pop edi
test eax, eax
je 0x5d2282
mov ebx, dword [ebp + 8]
mov dword [ebx + 0x14], eax
mov dword [ebp - 0x10], 1
popal
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x5d2307
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
pushal
mov eax, dword [ebp + 8]
mov ebx, dword [eax + 0x14]
mov dword [ebp - 8], ebx
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov ebx, dword [eax + 0x3c]
add eax, ebx
lea ebx, [eax + 0x18]
movzx ecx, word [eax + 0x14]
add ebx, ecx
movzx ecx, word [eax + 6]
test ecx, ecx
je 0x5d23b3
push ecx
mov ecx, dword [ebx + 8]
mov edx, dword [ebx + 0x10]
cmp ecx, edx
jae 0x5d2348
mov ecx, edx
mov dword [ebp - 4], ecx
mov eax, dword [ebx + 0xc]
add eax, dword [ebp - 8]
push ecx
push edi
push 4
push 0x1000
push dword [ebp - 4]
push eax
call dword [edi + 0x122d2be0]
pop edi
pop ecx
test eax, eax
je 0x5d23a6
push edi
mov edi, eax
xor eax, eax
push ecx
push edi
rep stosb byte es:[edi], al
pop edi
pop ecx
mov edx, dword [ebx + 0x10]
cmp ecx, edx
jl 0x5d2386
mov ecx, edx
mov esi, dword [ebx + 0x14]
add esi, dword [ebp - 0xc]
lea eax, [ebx + 0x10]
cmp dword [eax + 4], 0
je 0x5d239b
rep movsb byte es:[edi], byte [esi]
pop edi
add ebx, 0x28
pop ecx
dec ecx
jmp 0x5d232f
pop ecx
mov dword [ebp - 0x10], 0
jmp 0x5d23ba
mov dword [ebp - 0x10], 1
popal
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x5d25d4
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
mov dword [ebp - 0x18], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x14], eax
mov ebx, dword [eax + 0x3c]
add eax, ebx
lea ebx, [eax + 0x18]
movzx ecx, word [eax + 0x14]
add ebx, ecx
movzx ecx, word [eax + 6]
test ecx, ecx
je 0x5d264e
push ecx
mov ecx, dword [ebx + 0xc]
add ecx, dword [ebp - 0x14]
mov edx, dword [ebx + 0x24]
push edx
call fcn.005d2579
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
mov eax, dword [ebx + 8]
mov dword [ebp - 8], eax
push edi
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [edi + 0x12440b16]
pop edi
test eax, eax
jne 0x5d2644
pop ecx
jmp 0x5d2655
add ebx, 0x28
pop ecx
dec ecx
jmp 0x5d25fd
mov dword [ebp - 0x18], 1
popal
mov eax, dword [ebp - 0x18]
leave
ret 4
Function at 0x5d27fb
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [ebp + 0x18], 0
jne 0x5d294f
cmp dword [ebp + 0xc], 0
jne 0x5d294f
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [eax + 8]
cmp eax, 0xffffffff
je 0x5d2842
sub eax, dword [ebp + 0x10]
js 0x5d294f
je 0x5d294f
cmp eax, dword [ebp + 0x14]
jl 0x5d294f
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
cmp word [eax], 0x5a4d
jne 0x5d294f
mov ebx, dword [eax + 0x3c]
add eax, ebx
cmp dword [eax], 0x4550
jne 0x5d294f
mov ebx, dword [eax + 0x50]
push edi
push 4
push 0x1000
push ebx
push 0
call dword [edi + 0x122d2be0]
pop edi
test eax, eax
je 0x5d294f
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], eax
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x14], ebx
pop ebx
lea eax, [ebp - 0x18]
push edi
push eax
lea eax, [edi + 0x12496bb2]
push eax
call fcn.005d1863
pop edi
test eax, eax
je 0x5d294f
lea eax, [ebp - 0x18]
push edi
push eax
lea eax, [edi + 0x12496bb6]
push eax
call fcn.005d1863
pop edi
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
mov ebx, dword [eax + 0x3c]
add eax, ebx
mov eax, dword [eax + 0x54]
mov dword [ebp - 0xc], eax
push edi
mov ecx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x1c]
mov esi, dword [esi + 4]
rep movsb byte es:[edi], byte [esi]
pop edi
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
mov dword [ebp - 4], eax
mov ebx, dword [eax + 0x3c]
add eax, ebx
lea ebx, [eax + 0x18]
movzx ecx, word [eax + 0x14]
add ebx, ecx
movzx ecx, word [eax + 6]
test ecx, ecx
je 0x5d2942
push ecx
mov ecx, dword [ebx + 8]
mov eax, dword [ebx + 0xc]
add eax, dword [ebp - 8]
test eax, eax
je 0x5d294f
push edi
mov edi, eax
xor eax, eax
push ecx
push edi
rep stosb byte es:[edi], al
pop edi
pop ecx
mov edx, dword [ebx + 0x10]
cmp ecx, edx
jl 0x5d292f
mov ecx, edx
mov esi, dword [ebx + 0x14]
add esi, dword [ebp - 4]
rep movsb byte es:[edi], byte [esi]
pop edi
add ebx, 0x28
pop ecx
dec ecx
jmp 0x5d28fd
push dword [ebp + 8]
call fcn.005d36f1
jmp 0x5d2956
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
leave
ret 0x14
Function at 0x5d2ce1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
pushal
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x5d2dd0
mov ecx, eax
mov ebx, dword [ecx + 0x3c]
add ecx, ebx
mov ecx, dword [ecx + 0x7c]
test ecx, ecx
je 0x5d2dd0
mov dword [ebp - 4], ecx
mov ebx, eax
mov ecx, dword [ebx + 0x3c]
add ebx, ecx
mov ebx, dword [ebx + 0x78]
add ebx, eax
mov dword [ebp - 8], ebx
mov eax, dword [ebp + 0xc]
test eax, 0xffff0000
je 0x5d2d7c
mov ecx, dword [ebx + 0x18]
test ecx, ecx
je 0x5d2dd0
dec ecx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x20]
add eax, dword [ebp - 0xc]
push ecx
shl ecx, 2
add eax, ecx
mov eax, dword [eax]
add eax, dword [ebp - 0xc]
push edi
push dword [ebp + 0xc]
push eax
call dword [edi + 0x12496d12]
pop edi
pop ecx
test eax, eax
jne 0x5d2d35
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x24]
add eax, dword [ebp - 0xc]
shl ecx, 1
add eax, ecx
movzx ecx, word [eax]
jmp 0x5d2d82
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebx + 0x10]
mov ebx, dword [ebp - 8]
mov eax, dword [ebx + 0x14]
cmp ecx, eax
jge 0x5d2dd0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebx + 0x1c]
add edx, eax
shl ecx, 2
add edx, ecx
cmp dword [edx], 0
je 0x5d2dd0
mov ebx, dword [edx]
add eax, ebx
mov dword [ebp - 0x10], eax
cmp eax, dword [ebp - 8]
jle 0x5d2dd0
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jge 0x5d2dd0
push dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.005d2c2a
mov dword [ebp - 0x10], eax
popal
mov eax, dword [ebp - 0x10]
leave
ret 8
Function at 0x403690
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x15c
test eax, eax
mov dword [ebp - 0x13c], eax
je 0x4036ab
cmp byte [eax], 0
jne 0x4036b3
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], eax
call sub.msvcrt.dll_strlen
add eax, 0x102
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov ebx, eax
mov eax, dword [ebp - 0x13c]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov eax, str._s.
mov dword [esp + 4], eax
call sub.msvcrt.dll_sprintf
mov dword [esp], ebx
lea ecx, [ebp - 0x138]
mov dword [esp + 4], ecx
call sub.msvcrt.dll__findfirst
mov dword [ebp - 0x140], eax
inc eax
je 0x4036ab
mov eax, 0x5c
mov dword [esp + 4], eax
lea eax, [ebp - 0x124]
mov dword [esp], eax
call sub.msvcrt.dll_strchr
test eax, eax
jne 0x40378b
nop
lea esi, [esi]
lea ecx, [ebp - 0x124]
mov edi, str._s_s
mov dword [esp + 0xc], ecx
mov eax, dword [ebp - 0x13c]
mov dword [esp + 4], edi
mov dword [esp], ebx
mov dword [esp + 8], eax
call sub.msvcrt.dll_sprintf
jmp 0x40379d
mov eax, ebx
call fcn.00403690
nop
lea ecx, [ebp - 0x138]
mov dword [esp + 4], ecx
mov eax, dword [ebp - 0x140]
mov dword [esp], eax
call sub.msvcrt.dll__findnext
test eax, eax
jne 0x40384c
mov eax, 0x5c
mov dword [esp + 4], eax
lea eax, [ebp - 0x124]
mov dword [esp], eax
call sub.msvcrt.dll_strchr
test eax, eax
je 0x403720
mov dword [esp], ebx
lea ecx, [ebp - 0x124]
mov dword [esp + 4], ecx
call sub.msvcrt.dll_strcpy
mov dword [esp], ebx
mov esi, 0x54e20d
mov dword [esp + 4], esi
call sub.msvcrt.dll_strstr
mov dword [ebp - 0x14c], eax
test eax, eax
je 0x4037e3
cld
mov esi, eax
mov eax, 3
mov edi, 0x54e20d
mov ecx, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x403750
mov esi, dword [ebp - 0x14c]
mov edi, 0x54e210
mov ecx, 4
repe cmpsb byte [esi], byte es:[edi]
je 0x403750
test byte [ebp - 0x138], 0x10
jne 0x403747
lea eax, [ebp - 0x124]
xor esi, esi
mov dword [esp], eax
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
mov edi, eax
lea esi, [esi]
lea edi, [edi]
mov dword [esp], ebx
call sub.msvcrt.dll__unlink
test eax, eax
je 0x403750
mov eax, esi
inc esi
cmp eax, 9
jg 0x403750
test edi, edi
je 0x403810
mov dword [esp], edi
call sub.KERNEL32.dll_FreeLibrary
sub esp, 4
mov dword [esp], ebx
call sub.msvcrt.dll__unlink
test eax, eax
jne 0x403820
jmp 0x403750
mov ecx, dword [ebp - 0x140]
mov dword [esp], ecx
call sub.msvcrt.dll__findclose
mov eax, dword [ebp - 0x13c]
mov dword [esp], eax
call sub.msvcrt.dll__rmdir
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x403870
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], esi
mov dword [esp], ebx
call fcn.004017e0
mov dword [esp], eax
call fcn.00401790
mov esi, eax
call fcn.00401a50
test eax, eax
je 0x4038c0
test ebx, ebx
je 0x4038c0
cmp byte [ebx], 0
je 0x4038c0
mov dword [esp], esi
mov eax, str.par_
mov dword [esp + 4], eax
call sub.msvcrt.dll_strstr
cmp eax, esi
je 0x4038ca
nop
lea esi, [esi]
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 4]
mov eax, ebx
mov ebx, dword [ebp - 8]
mov esp, ebp
pop ebp
jmp fcn.00403690

Function at 0x403a20
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x5c
lea ebx, [ebp - 0x58]
mov esi, dword [ebp + 8]
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.msvcrt.dll__lseek
mov dword [esp + 4], ebx
mov eax, 0x40
mov dword [esp + 8], eax
mov dword [esp], esi
call sub.msvcrt.dll__read
cmp word [ebp - 0x58], 0x5a4d
je 0x403a82
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov edi, str.MZ_magic_bytes
mov ecx, str.assertion_failed:__s_n
mov dword [esp + 8], edi
mov dword [esp + 4], ecx
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov edi, dword [ebp - 0x1c]
xor edx, edx
mov dword [esp + 8], edx
mov dword [esp], esi
mov dword [esp + 4], edi
call sub.msvcrt.dll__lseek
mov dword [esp + 4], ebx
mov eax, 0x1a
mov dword [esp + 8], eax
mov dword [esp], esi
call sub.msvcrt.dll__read
cmp dword [ebp - 0x58], 0x4550
je 0x403ad7
mov eax, str.PE_header
mov dword [esp + 8], eax
mov eax, str.assertion_failed:__s_n
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
movzx ecx, word [ebp - 0x44]
movzx ebx, word [ebp - 0x40]
cmp cx, 0xe0
setne al
cmp bx, 0x10b
setne dl
or eax, edx
test al, 1
je 0x403b0b
cmp cx, 0xf0
setne al
cmp bx, 0x20b
setne dl
or eax, edx
test al, 1
jne 0x403b28
mov dword [esp], esi
xor eax, eax
mov dword [esp + 8], eax
lea eax, [edi + 0x5c]
mov dword [esp + 4], eax
call sub.msvcrt.dll__lseek
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, str.IMAGE_NT_OPTIONAL_HDR_MAGIC
mov dword [esp + 8], eax
mov eax, str.assertion_failed:__s_n
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [esp], esi
xor eax, eax
mov dword [esp + 8], eax
lea eax, [edi + 0x5c]
mov dword [esp + 4], eax
call sub.msvcrt.dll__lseek
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x408b40
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x47
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push 0
lea edx, [ebp + 0x6f]
push 0
mov eax, dword [esi]
push edx
dec esi
push ebp
or byte [ecx + 0x4551f045], cl
cld
mov dword [ebp - 0xc], ecx
push eax
mov eax, dword [edx + 4]
lea ecx, [ebp - 0x25]
mov al, 0x67
push ecx
push eax
mov dword [ebp - 0x2e], 0x410000
mov dword [ebp - 8], 0x850000
call dword [sym.imp.WS2_32.dll_WSARecv]
cmp eax, 0xffffffff
jne 0x408bce
push edi
mov edi, dword [sym.imp.WSOCK32.dll_WSAGetLastError]
sbb edi, edx
mov dword [0x89ab750d], eax
push es
pop edi
pop esi
mov esp, ebp
ffree st(2)
or al, 0
call dword [edi]
mov dword [esi], 0
pop edi
add eax, 0x5a3080
pop esi
fiadd word [esi]
pop ebp
ret 0xd10c
nop
mov dword [0x51ec8b55], eax
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
lea eax, [ebp - 4]
movsb byte es:[edi], byte [esi]
push 0x8004667e
push ebp
mov dword [ebp - 4], 0
call dword [0xa3c1b4]
cmp eax, 0xffffffff
xchg ecx, eax
sub ebp, dword [esi + 0x55603557]
inc eax
add bh, bh
salc
test eax, eax
jne 0x408c05
mov byte [ebx - 0x73a21b], cl
salc
call esi
add eax, 0xe6fc80
pop esi
sbb eax, 0x33c33e9f
sar byte [esi + 0x4e], 0x5d
sub al, 0x61