joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4052e0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
push edi
mov esi, eax
xor edi, edi
push edi
lea eax, [esp + 0x10]
push eax
push 1
push esi
push ebx
call ebp
test eax, eax
je 0x405330
mov edi, edi
cmp dword [esp + 0xc], 0
je 0x405338
mov al, byte [esi]
cmp al, 0xa
je 0x40533c
cmp al, 0xd
je 0x40531f
add edi, 1
cmp edi, 0x200
jae 0x40531f
add esi, 1
push 0
lea ecx, [esp + 0x10]
push ecx
push 1
push esi
push ebx
call ebp
test eax, eax
jne 0x405300
pop edi
pop esi
or eax, 0xffffffff
pop ebp
pop ecx
ret
test edi, edi
je 0x405330
mov eax, edi
pop edi
mov byte [esi], 0
pop esi
pop ebp
pop ecx
ret

Function at 0x4053b0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Get socket status

Disassembly:
sub esp, 0x11c
push esi
mov esi, eax
test esi, esi
push edi
mov edi, ecx
je 0x40543b
mov eax, dword [esi]
test eax, eax
je 0x40543b
mov ecx, dword [0x40f048]
lea edx, [esp + 0x10]
push edx
push 0
mov dword [esp + 0x24], eax
push 0
lea eax, [esp + 0x24]
push eax
push 0
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 1
call sub.WSOCK32.dll_select
test eax, eax
mov dword [esp + 0xc], eax
je 0x405420
cmp eax, 0xffffffff
je 0x405420
mov edx, dword [esi]
lea ecx, [esp + 0xc]
push ecx
push edi
push edx
mov dword [esp + 0x18], 0x10
call sub.WSOCK32.dll_accept
mov edi, eax
jmp 0x405422
xor edi, edi
mov eax, dword [esi]
push eax
call sub.WSOCK32.dll_closesocket
mov dword [esi], 0
mov eax, edi
pop edi
pop esi
add esp, 0x11c
ret
push 6
push 1
push 2
call sub.WSOCK32.dll_socket
push 0x10
mov esi, eax
push edi
push esi
call sub.WSOCK32.dll_connect
test eax, eax
je 0x405466
push esi
call sub.WSOCK32.dll_closesocket
xor eax, eax
pop edi
pop esi
add esp, 0x11c
ret
pop edi
mov eax, esi
pop esi
add esp, 0x11c
ret

Function at 0x4054f0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x114
push ebp
push esi
mov esi, eax
mov eax, dword [0x40f044]
xor ebp, ebp
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebp
lea esp, [esp]
lea ecx, [esp + 8]
push ecx
push 0
push 0
lea edx, [esp + 0x1c]
push edx
push 0
mov dword [esp + 0x28], edi
mov dword [esp + 0x24], 1
call sub.WSOCK32.dll_select
cmp eax, 0xffffffff
je 0x40557b
test eax, eax
je 0x40557b
push 0
push 1
push esi
push edi
call sub.WSOCK32.dll_recv
cmp eax, 0xffffffff
je 0x40557b
test eax, eax
je 0x40557b
mov al, byte [esi]
cmp al, 0xd
jne 0x405559
mov byte [esi], 0
jmp 0x40555d
cmp al, 0xa
je 0x40556d
cmp ebp, 0x1ff
jae 0x405568
add esi, 1
add ebp, 1
jmp 0x405510
mov byte [esi], 0
mov eax, ebp
pop esi
pop ebp
add esp, 0x114
ret
pop esi
or eax, 0xffffffff
pop ebp
add esp, 0x114
ret

Function at 0x405590
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, edx
push esi
lea esi, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x405596
push 0
sub eax, esi
push eax
mov eax, dword [esp + 0x10]
push edx
push eax
call sub.WSOCK32.dll_send
cmp eax, 0xffffffff
setne al
pop esi
ret 4
Function at 0x405720
Capabilities:
Get socket status
Read and send data from client to server
Read file on windows
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
sub esp, 0x6d0
mov eax, dword [0x40f01c]
xor eax, esp
mov dword [esp + 0x6cc], eax
push ebx
push ebp
mov ebp, dword [esp + 0x6e0]
push esi
mov esi, edx
xor ebx, ebx
cmp esi, ebx
push edi
mov edi, ecx
mov dword [esp + 0x18], ebp
je 0x40574f
mov dword [esi], ebx
mov eax, dword [esp + 0x6ec]
sub eax, 1
je 0x4057fb
sub eax, 1
jne 0x4058d0
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, edi
mov eax, dword [0x40f048]
mov esi, dword [esp + 0x6e4]
lea ecx, [esp + 0x18]
push ecx
push ebx
push ebx
lea edx, [esp + 0x2c]
push edx
push ebx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ebx
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], 1
call sub.WSOCK32.dll_select
cmp eax, 0xffffffff
je 0x4057c4
cmp eax, ebx
je 0x4057c4
push ebx
push 0x5ac
lea eax, [esp + 0x130]
push eax
push esi
call sub.WSOCK32.dll_recv
cmp eax, 0xffffffff
jne 0x4057c7
or eax, 0xffffffff
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
je 0x4058d0
cmp eax, ebx
je 0x4058c6
push ebx
lea ecx, [esp + 0x18]
push ecx
push eax
lea edx, [esp + 0x134]
push edx
push ebp
call edi
test eax, eax
jne 0x405770
jmp 0x4058d0
push ebx
lea eax, [esp + 0x18]
push eax
push 0x5ac
lea ecx, [esp + 0x134]
push ecx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
call ebp
test eax, eax
je 0x4058d0
mov ebx, dword [sym.imp.MSVCR80.dll__stricmp]
jmp 0x405830
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4058c6
push 0
push eax
mov eax, dword [esp + 0x6ec]
lea edx, [esp + 0x130]
push edx
push eax
call sub.WSOCK32.dll_send
cmp eax, 0xffffffff
je 0x4058d0
lea ecx, [esp + 0x14]
push ecx
push 0x4004667f
push edi
call sub.WSOCK32.dll_ioctlsocket
cmp dword [esp + 0x14], 0
je 0x4058a1
lea eax, [esp + 0x128]
call fcn.004054f0
lea edx, [esp + 0x128]
push str.ABOR
push edx
call ebx
add esp, 8
test eax, eax
je 0x4058ca
push 0
push 0x30
push str.500_Only_command_allowed_at_this_time_is_ABOR._r_n
push edi
call sub.WSOCK32.dll_send
mov edx, dword [esp + 0x18]
push 0
lea eax, [esp + 0x18]
push eax
push 0x5ac
lea ecx, [esp + 0x134]
push ecx
push edx
call ebp
test eax, eax
jne 0x405830
jmp 0x4058d0
mov al, 1
jmp 0x4058d2
mov dword [esi], 1
xor al, al
mov ecx, dword [esp + 0x6dc]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00403339
add esp, 0x6d0
ret 0xc
Function at 0x405a50
Capabilities:
Get hostname
Resolve dns
Set socket configuration

Disassembly:
sub esp, 0x204
mov eax, dword [0x40f01c]
xor eax, esp
mov dword [esp + 0x200], eax
push esi
mov esi, dword [sym.imp.MSVCR80.dll__stricmp]
push edi
mov edi, ecx
push 0x40aba8
push edi
call esi
add esp, 8
test eax, eax
jne 0x405a9b
mov dword [0x40f45c], eax
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.00403339
add esp, 0x204
ret
push str.Local
push edi
call esi
add esp, 8
test eax, eax
jne 0x405abb
push 0x7f000001
call sub.WSOCK32.dll_htonl
mov dword [0x40f45c], eax
jmp 0x405a82
push 0x40abb4
push edi
call esi
add esp, 8
test eax, eax
jne 0x405b5b
push 0x200
lea eax, [esp + 0xc]
push eax
mov dword [0x40f45c], 0xffffffff
call sub.WSOCK32.dll_gethostname
lea ecx, [esp + 8]
push ecx
call sub.WSOCK32.dll_gethostbyname
test eax, eax
je 0x405b28
mov edi, dword [eax + 0xc]
xor esi, esi
cmp dword [edi], esi
je 0x405b28
mov eax, edi
mov edx, dword [eax]
mov eax, dword [edx]
push eax
call fcn.00405180
cmp eax, 1
je 0x405b1d
add esi, 1
cmp dword [edi + esi*4], 0
lea eax, [edi + esi*4]
jne 0x405b00
jmp 0x405b28
mov ecx, dword [edi + esi*4]
mov edx, dword [ecx]
mov dword [0x40f45c], edx
cmp dword [0x40f45c], 0xffffffff
jne 0x405a82
push ebx
xor edi, edi
mov esi, str.BindInterface_directive_could_not_find_a_LAN_interface.
call fcn.004055c0
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.00403339
add esp, 0x204
ret
push 0x40abf0
push edi
call esi
add esp, 8
test eax, eax
jne 0x405bfb
push 0x200
lea eax, [esp + 0xc]
push eax
mov dword [0x40f45c], 0xffffffff
call sub.WSOCK32.dll_gethostname
lea ecx, [esp + 8]
push ecx
call sub.WSOCK32.dll_gethostbyname
test eax, eax
je 0x405bc8
mov edi, dword [eax + 0xc]
xor esi, esi
cmp dword [edi], esi
je 0x405bc8
mov eax, edi
mov edx, dword [eax]
mov eax, dword [edx]
push eax
call fcn.00405180
cmp eax, 2
je 0x405bbd
add esi, 1
cmp dword [edi + esi*4], 0
lea eax, [edi + esi*4]
jne 0x405ba0
jmp 0x405bc8
mov ecx, dword [edi + esi*4]
mov edx, dword [ecx]
mov dword [0x40f45c], edx
cmp dword [0x40f45c], 0xffffffff
jne 0x405a82
push ebx
xor edi, edi
mov esi, str.BindInterface_directive_could_not_find_a_WAN_interface.
call fcn.004055c0
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.00403339
add esp, 0x204
ret
push edi
call sub.WSOCK32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [0x40f45c], eax
jne 0x405a82
push ebx
mov esi, str.BindInterface_directive_does_not_recognize_argument___s_.
call fcn.004055c0
mov ecx, dword [esp + 0x208]
pop edi
pop esi
xor ecx, esp
xor al, al
call fcn.00403339
add esp, 0x204
ret
Function at 0x408f40
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xcc
mov eax, dword [0x40f01c]
xor eax, esp
mov dword [esp + 0xc8], eax
push ebx
push esi
push edi
xor edi, edi
push edi
mov dword [esp + 0x10], 0x40a360
mov dword [esp + 0x14], 0x408eb0
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x40f434], eax
lea eax, [esp + 0x38]
push eax
mov dword [esp + 0x3c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x48], 2
sete cl
mov byte [0x40f428], cl
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push str._service
push eax
call dword [sym.imp.MSVCR80.dll_strstr]
add esp, 8
test eax, eax
je 0x40900b
cmp byte [0x40f428], 0
je 0x408fdd
lea edx, [esp + 0xc]
push edx
mov byte [0x40f429], 1
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
jmp 0x40906b
push str.KERNEL32.DLL
mov byte [0x40f429], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
push str.RegisterServiceProcess
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
push edi
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x409012
mov byte [0x40f429], 0
call fcn.00408c30
test al, al
je 0x409061
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push edi
push edi
push edi
lea eax, [esp + 0x28]
push eax
call esi
test eax, eax
je 0x40906b
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x409040
lea ecx, [esp + 0x1c]
push ecx
call edi
lea edx, [esp + 0x1c]
push edx
call ebx
push 0
push 0
push 0
lea eax, [esp + 0x28]
push eax
call esi
test eax, eax
jne 0x409040
jmp 0x40906b
push 0x40a3a0
call fcn.00404fd0
call fcn.00408b60
mov ecx, dword [esp + 0xd4]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00403339
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4071d0
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40726d
push ebx
push esi
call fcn.00407199
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.004070e2
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40721a
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40726c
push edi
push eax
call fcn.00407a48
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40723a
call fcn.00405cf1
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40726b
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.004070e2
add esp, 0x20
test eax, eax
jne 0x407259
push edi
call fcn.00405cf1
jmp 0x407261
push ebx
call fcn.00405cf1
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x408155
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x40ff68
push 0x40ff60
push str.FlsAlloc
push 0x1e
call fcn.00408073
mov esi, eax
add esp, 0x10
test esi, esi
je 0x408189
push dword [ebp + 8]
mov ecx, esi
call dword [0x40e10c]
call esi
jmp 0x40818f
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4081d3
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x40ff78
push 0x40ff70
push str.FlsGetValue
push 0x20
call fcn.00408073
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40820a
push dword [ebp + 8]
mov ecx, esi
call dword [0x40e10c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x40d0f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40d11d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40d11d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x408494
Capabilities:
Set file attributes
Terminate process

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
jmp 0x4084b7
lea eax, [ebx + 0x20]
push eax
mov eax, dword [ebx + 0x1c]
push eax
call sub.KERNEL32.DLL_CloseHandle
test eax, eax
jne 0x4084b7
call sub.KERNEL32.DLL_FindClose
mov esi, eax
jmp 0x408510
mov eax, dword [ebx + 0x20]
and eax, dword [ebx + 0x18]
jne 0x40849d
push esp
lea eax, [ebx + 0x34]
push eax
call sub.KERNEL32.DLL_TerminateProcess
push ebx
lea eax, [ebx + 2]
push eax
lea eax, [esp + 8]
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
mov eax, dword [ebx + 0x40]
xor edx, edx
push edx
push eax
mov eax, dword [ebx + 0x3c]
xor edx, edx
mov edx, eax
xor eax, eax
or eax, dword [esp]
or edx, dword [esp + 4]
add esp, 8
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], edx
mov eax, dword [ebx + 0x20]
mov dword [ebx + 0x10], eax
lea eax, [ebx + 0x14]
lea edx, [ebx + 0x4c]
mov ecx, 0x104
call fcn.00404f60
xor esi, esi
mov eax, esi
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x408518
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
mov edi, eax
not edx
and edx, 0x16
mov dword [ebx + 0x18], edx
lea eax, [ebx + 0x20]
push eax
mov eax, edi
call fcn.0040515c
push eax
call sub.KERNEL32.DLL_WinExec
mov esi, eax
mov dword [ebx + 0x1c], esi
cmp esi, 0xffffffff
je 0x408558
mov eax, ebx
call fcn.00408494
mov esi, eax
test esi, esi
je 0x40855f
mov eax, ebx
call fcn.0040858c
jmp 0x40855f
call sub.KERNEL32.DLL_FindClose
mov esi, eax
mov eax, esi
pop edi
pop esi
pop ebx
ret

Function at 0x40c31c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
add edi, 0xffffffec
push edi
push 0
call sub.KERNEL32.DLL_ReadFile
xor esi, esi
jmp 0x40c35f
movzx eax, byte [edi + esi + 6]
movzx ebx, byte [edi + esi + 7]
sub bl, al
jb 0x40c35c
inc ebx
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
movzx eax, al
bts dword [0x41a800], eax
inc byte [ebp - 1]
dec bl
jne 0x40c347
add esi, 2
cmp esi, 0xc
jge 0x40c36f
movzx eax, byte [edi + esi + 6]
or al, byte [edi + esi + 7]
jne 0x40c335
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x413118
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, 0x41f9d4
push 0x41f9d8
call sub.KERNEL32.DLL_ResumeThread
xor edx, edx
push ebp
push 0x413179
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [esi]
call fcn.00405d28
mov ebx, eax
dec ebx
cmp ebx, 0
jl 0x413161
mov eax, dword [esi]
mov eax, dword [eax + ebx*4]
cmp eax, dword [0x41aa20]
je 0x41315b
call fcn.00403f04
dec ebx
cmp ebx, 0xffffffff
jne 0x413149
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413180
push 0x41f9d8
call sub.KERNEL32.DLL_lstrlenA
ret
Function at 0x4133bc
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp dword [0x41f9d4], 0
je 0x4133de
cmp bx, 0x100
jb 0x4133de
cmp bx, 0x7ff
jbe 0x4133e2
xor eax, eax
jmp 0x4133e4
mov al, 1
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x41346b
push 0x41f9d8
call sub.KERNEL32.DLL_ResumeThread
xor eax, eax
push ebp
push 0x413464
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x41f9d4]
call fcn.00405d28
movzx edi, bx
mov edx, edi
sub edx, 0x100
cmp eax, edx
setg byte [ebp - 1]
cmp byte [ebp - 1], 0
je 0x41344c
mov eax, dword [0x41f9d4]
mov eax, dword [eax + edi*4 - 0x400]
mov dword [esi], eax
cmp dword [esi], 0
je 0x413443
mov eax, dword [esi]
cmp eax, dword [0x41aa20]
jne 0x413447
xor eax, eax
jmp 0x413449
mov al, 1
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41346b
push 0x41f9d8
call sub.KERNEL32.DLL_lstrlenA
ret
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x413f18
Capabilities:
Resume thread

Disassembly:
add eax, 8
push eax
call sub.KERNEL32.DLL_ResumeThread
ret

Function at 0x414304
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
lea eax, [ebx + 8]
push eax
call sub.KERNEL32.DLL_ResumeThread
mov eax, dword [ebx + 4]
pop ebx
ret
Function at 0x414cc8
Capabilities:
Clear file content
Resume thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov ebx, eax
call sub.KERNEL32.DLL_SetEndOfFile
mov edx, dword [0x41ad20]
cmp eax, dword [edx]
je 0x414d0b
call sub.KERNEL32.DLL_SetEndOfFile
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
lea eax, [ebp - 0x14]
push eax
push 0
mov ecx, dword [0x41ac5c]
mov dl, 1
mov eax, dword [0x413b7c]
call fcn.0040b6e8
call fcn.0040469c
test ebx, ebx
jle 0x414d18
mov eax, ebx
call fcn.00414c88
jmp 0x414d1d
call fcn.00414c7c
xor eax, eax
mov dword [ebp - 0xc], eax
push 0x41fa10
call sub.KERNEL32.DLL_ResumeThread
xor eax, eax
push ebp
push 0x414e8d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push 0x41aaa0
call sub.KERNEL32.DLL_GetStdHandle
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x414e6e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0
je 0x414d68
mov eax, dword [ebp - 0xc]
cmp dword [eax + 8], 0
jg 0x414d6c
xor eax, eax
jmp 0x414d6e
mov al, 1
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x414e58
jmp 0x414e4b
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.00414124
mov dword [ebp - 8], eax
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.00414038
push 0x41fa10
call sub.KERNEL32.DLL_lstrlenA
xor eax, eax
push ebp
push 0x414e11
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x414dd2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
mov eax, dword [ebx + 0xc]
call dword [ebx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x414df9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x414e18
push 0x41fa10
call sub.KERNEL32.DLL_ResumeThread
ret
mov eax, dword [ebp - 0xc]
cmp dword [eax + 8], 0
jg 0x414d80
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x414e75
mov eax, dword [ebp - 0xc]
call fcn.00403f04
ret

Function at 0x415154
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
push 0x41fa10
call sub.KERNEL32.DLL_ResumeThread
xor eax, eax
push ebp
push 0x415206
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x41aaa0], 0
je 0x4151ee
mov eax, dword [0x41aaa0]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4151ee
mov edx, esi
mov eax, dword [0x41aaa0]
call fcn.00414124
mov ebx, eax
cmp dword [ebx + 8], 0
jne 0x4151e8
test edi, edi
je 0x4151a9
mov eax, dword [ebx]
cmp edi, dword [eax]
je 0x4151c4
cmp word [ebp + 0xa], 0
je 0x4151e8
mov eax, dword [ebx]
mov eax, dword [eax + 8]
cmp eax, dword [ebp + 8]
jne 0x4151e8
mov eax, dword [ebx]
mov eax, dword [eax + 0xc]
cmp eax, dword [ebp + 0xc]
jne 0x4151e8
mov edx, esi
mov eax, dword [0x41aaa0]
call fcn.00414038
mov eax, dword [ebx]
mov edx, 0x18
call fcn.00402e00
mov edx, 0xc
mov eax, ebx
call fcn.00402e00
dec esi
cmp esi, 0xffffffff
jne 0x41518b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41520d
push 0x41fa10
call sub.KERNEL32.DLL_lstrlenA
ret
Function at 0x415214
Capabilities:
Clear file content
Get thread local storage value
Resume thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
mov byte [ebp - 5], cl
mov dword [ebp - 4], edx
call sub.KERNEL32.DLL_SetEndOfFile
mov edx, dword [0x41ad20]
cmp eax, dword [edx]
jne 0x41523e
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call dword [ebx + 8]
jmp 0x4153ab
cmp byte [ebp - 5], 0
je 0x415253
mov eax, 0xc
call fcn.00402de4
mov dword [ebp - 0xc], eax
jmp 0x415259
lea eax, [ebp - 0x18]
mov dword [ebp - 0xc], eax
movzx ebx, byte [ebp - 5]
xor bl, 1
test bl, bl
je 0x415279
push 0
push 0
push 0xffffffffffffffff
push 0
call sub.KERNEL32.DLL_LeaveCriticalSection
mov edx, dword [ebp - 0xc]
mov dword [edx + 8], eax
jmp 0x415281
mov eax, dword [ebp - 0xc]
xor edx, edx
mov dword [eax + 8], edx
xor eax, eax
push ebp
push 0x41538a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x41fa10
call sub.KERNEL32.DLL_ResumeThread
xor eax, eax
push ebp
push 0x415363
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
movzx edx, byte [ebp - 5]
mov byte [eax + 4], dl
cmp dword [0x41aaa0], 0
jne 0x4152cb
mov dl, 1
mov eax, dword [0x4138b4]
call fcn.00403ed4
mov dword [0x41aaa0], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov dword [eax], edx
mov edx, dword [ebp - 0xc]
mov eax, dword [0x41aaa0]
call fcn.00413fec
call fcn.00414ca4
cmp word [0x41aa9a], 0
je 0x415302
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov edx, dword [eax]
mov eax, dword [0x41aa9c]
call dword [0x41aa98]
test bl, bl
je 0x41534b
push 0x41fa10
call sub.KERNEL32.DLL_lstrlenA
xor eax, eax
push ebp
push 0x415344
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffffffffffffffff
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
push eax
call sub.KERNEL32.DLL_TlsGetValue
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41534b
push 0x41fa10
call sub.KERNEL32.DLL_ResumeThread
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41536a
push 0x41fa10
call sub.KERNEL32.DLL_lstrlenA
ret
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x415800
Capabilities:
Get disk information
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 4]
test eax, eax
je 0x41582c
cmp byte [ebx + 0xc], 0
jne 0x415816
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_GetDriveTypeA
xor eax, eax
mov dword [ebx + 4], eax
lea eax, [ebx + 0x10]
call fcn.00404cf0
pop ebx
ret