joyce8/EMBER2024-capa huggingface dataset:
Function at 0x64058570
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0x28
lea ecx, [esp]
push ebx
push ebp
push esi
push edi
push 1
call dword [0x640b0760]
lea ecx, [esp + 0x1c]
call dword [0x640b0df8]
mov esi, dword [0x640b098c]
lea ecx, [esp + 0x18]
push 0x36
push 0x40
call esi
push 0x5c
push 0x40
lea ecx, [esp + 0x1c]
call esi
lea ecx, [esp + 0x10]
call dword [0x640b09bc]
mov esi, dword [esp + 0x40]
mov ebp, dword [0x640b0768]
mov eax, dword [esi]
cmp dword [eax + 4], 0x40
jle 0x640585eb
push esi
lea ecx, [esp + 0x14]
call ebp
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x14]
call dword [0x640b0dd8]
push eax
mov ecx, esi
call dword [0x640b034c]
lea ecx, [esp + 0x40]
call dword [0x640b0df0]
push 1
push 0
push 0x40
lea eax, [esp + 0x4c]
mov ecx, esi
push eax
call dword [0x640b0998]
push eax
mov ecx, esi
call dword [0x640b034c]
lea ecx, [esp + 0x40]
call dword [0x640b0df0]
mov eax, dword [esi]
xor edi, edi
cmp dword [eax + 4], edi
jle 0x64058673
nop word [eax + eax]
push edi
lea eax, [esp + 0x24]
mov ecx, esi
push eax
call dword [0x640b05dc]
mov ecx, eax
call dword [0x640b05e0]
mov bl, al
lea ecx, [esp + 0x18]
push edi
lea eax, [esp + 0x2c]
push eax
call dword [0x640b05dc]
mov ecx, eax
call dword [0x640b05e0]
xor al, bl
lea ecx, [esp + 0x18]
push eax
push edi
lea eax, [esp + 0x38]
push eax
call dword [0x640b05dc]
mov ecx, eax
call dword [0x640b09a4]
mov eax, dword [esi]
inc edi
cmp edi, dword [eax + 4]
jl 0x64058620
xor edi, edi
cmp dword [eax + 4], edi
jle 0x640586d3
nop word [eax + eax]
push edi
lea eax, [esp + 0x34]
mov ecx, esi
push eax
call dword [0x640b05dc]
mov ecx, eax
call dword [0x640b05e0]
mov bl, al
lea ecx, [esp + 0x14]
push edi
lea eax, [esp + 0x2c]
push eax
call dword [0x640b05dc]
mov ecx, eax
call dword [0x640b05e0]
xor al, bl
lea ecx, [esp + 0x14]
push eax
push edi
lea eax, [esp + 0x28]
push eax
call dword [0x640b05dc]
mov ecx, eax
call dword [0x640b09a4]
mov eax, dword [esi]
inc edi
cmp edi, dword [eax + 4]
jl 0x64058680
push dword [esp + 0x44]
mov esi, dword [0x640b0368]
lea ecx, [esp + 0x1c]
call esi
lea ecx, [esp + 0x10]
call dword [0x640b09bc]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x14]
call ebp
mov ebx, dword [0x640b0dd8]
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x14]
call ebx
push eax
lea ecx, [esp + 0x20]
call dword [0x640b034c]
lea ecx, [esp + 0x40]
call dword [0x640b0df0]
mov edi, dword [esp + 0x3c]
mov ecx, edi
call dword [0x640b0df8]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x18]
call esi
lea ecx, [esp + 0x10]
call dword [0x640b09bc]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
call ebp
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x14]
call ebx
push eax
mov ecx, edi
call dword [0x640b034c]
lea ecx, [esp + 0x40]
call dword [0x640b0df0]
lea ecx, [esp + 0x14]
call dword [0x640b0df0]
lea ecx, [esp + 0x18]
call dword [0x640b0df0]
lea ecx, [esp + 0x1c]
call dword [0x640b0df0]
lea ecx, [esp + 0x10]
call dword [0x640b0764]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
Function at 0x64068710
Capabilities:
Get networking parameters

Disassembly:
sub esp, 0x258
mov eax, dword [0x640f0ebc]
xor eax, esp
mov dword [esp + 0x254], eax
push esi
push edi
mov edi, dword [esp + 0x264]
lea eax, [esp + 8]
push eax
lea esi, [esp + 0x18]
mov dword [esp + 0xc], 0x248
mov eax, esi
push eax
call dword [sym.imp.IPHLPAPI.DLL_GetNetworkParams]
cmp eax, 0x6f
jne 0x64068783
push dword [esp + 8]
call dword [0x640b0ec0]
mov esi, eax
add esp, 4
test esi, esi
je 0x64068779
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.IPHLPAPI.DLL_GetNetworkParams]
test eax, eax
je 0x64068783
push esi
call dword [0x640b0ec4]
add esp, 4
mov ecx, edi
call dword [0x640b0de0]
jmp 0x640687dc
push 0xffffffffffffffff
lea eax, [esi + 0x84]
push eax
lea ecx, [esp + 0x14]
call dword [0x640b0d0c]
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
call dword [0x640b03e0]
add esp, 8
lea ecx, [esp + 0xc]
call dword [0x640b0df0]
lea eax, [esp + 0x14]
cmp esi, eax
je 0x640687c5
push esi
call dword [0x640b0ec4]
add esp, 4
lea eax, [esp + 0x10]
mov ecx, edi
push eax
call dword [0x640b0d8c]
lea ecx, [esp + 0x10]
call dword [0x640b0d94]
mov ecx, dword [esp + 0x25c]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.640ae828
add esp, 0x258
ret
Function at 0x6407eddd
Capabilities:
Get socket status

Disassembly:
sub esp, 0x328
mov eax, dword [0x640f0ebc]
xor eax, esp
mov dword [esp + 0x324], eax
mov eax, dword [esp + 0x32c]
push ebx
mov bl, byte [esp + 0x334]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x33c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x340]
mov dword [esp + 0x10], eax
push esi
mov esi, ecx
push edi
test bl, bl
je 0x6407ee08
mov ecx, dword [esi + 0x68]
test ecx, ecx
je 0x6407ee08
call dword [0x640b0b14]
test al, al
je 0x6407ee08
mov ecx, dword [esi + 0x68]
push 0
mov byte [esp + 0x13], 1
call dword [0x640b0b18]
jmp 0x6407ee0d
mov byte [esp + 0xf], 0
push 0x104
lea eax, [esp + 0x12c]
push 0
push eax
call fcn.640af6fe
add esp, 0xc
test bl, bl
je 0x6407ee3d
mov eax, dword [esi + 0x64]
mov dword [esp + 0x128], 1
mov dword [esp + 0x12c], eax
mov ebx, dword [esi + 0x64]
lea eax, [esp + 0x22c]
push 0x104
push 0
push eax
mov edi, ebx
call fcn.640af6fe
add esp, 0xc
mov dword [esp + 0x24], 0
cmp byte [esp + 0x340], 0
je 0x6407ee89
mov dword [esp + 0x22c], 1
mov dword [esp + 0x230], edi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], 1
mov ebx, dword [esp + 0x10]
mov eax, 0x10624dd3
imul ebx
mov ecx, ebx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x1c], eax
imul eax, eax, 0x3e8
sub ecx, eax
imul eax, ecx, 0x3e8
xor ecx, ecx
test ebx, ebx
mov dword [esp + 0x20], eax
lea eax, [esp + 0x1c]
cmovs eax, ecx
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x234]
push eax
lea eax, [esp + 0x134]
push eax
lea eax, [edi + 1]
push eax
call dword [sym.imp.WS2_32.dll_select]
mov edi, eax
test edi, edi
jle 0x6407eef9
lea eax, [esp + 0x24]
push eax
push dword [esi + 0x64]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x6407eef9
dec edi
cmp byte [esp + 0xf], 0
je 0x6407ef0b
mov ecx, dword [esi + 0x68]
push 1
call dword [0x640b0b18]
test edi, edi
jle 0x6407ef45
lea eax, [esp + 0x128]
push eax
push dword [esi + 0x64]
call sub.WS2_32.dll___WSAFDIsSet
mov ecx, dword [esp + 0x14]
test eax, eax
setne al
mov byte [ecx], al
lea eax, [esp + 0x22c]
push eax
push dword [esi + 0x64]
call sub.WS2_32.dll___WSAFDIsSet
mov ecx, dword [esp + 0x18]
test eax, eax
setne al
mov byte [ecx], al
mov ecx, dword [esp + 0x330]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.640ae828
add esp, 0x328
ret 0x14
Function at 0x64083730
Capabilities:
Get geographical location

Disassembly:
mov eax, dword [esp + 0xc]
cmp eax, 8
ja case.default.0x64083739
jmp dword [eax*4 + 0x640837a8]
push str.Organization
jmp 0x6408377d
push str.CommonName
jmp 0x6408377d
push str.CountryName
jmp 0x6408377d
push str.LocalityName
jmp 0x6408377d
push str.OrganizationalUnitName
jmp 0x6408377d
push str.StateOrProvinceName
jmp 0x6408377d
push str.DistinguishedNameQualifier
jmp 0x6408377d
push str.SerialNumber
jmp 0x6408377d
push str.EmailAddress
lea ecx, [esp + 0xc]
call dword [0x640b0404]
mov ecx, dword [esp + 4]
lea eax, [esp + 8]
push eax
call dword [0x640b03f4]
lea ecx, [esp + 8]
call dword [0x640b03f8]
mov eax, dword [esp + 4]
ret
Function at 0x415940
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x118], 0x114
push 0x110
push 0
lea eax, [ebp - 0x114]
push eax
call fcn.0063a460
add esp, 0xc
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
je 0x4159a4
cmp dword [ebp - 0x114], 6
jb 0x4159a4
mov dword [ebp - 0x11c], 1
jmp 0x4159ae
mov dword [ebp - 0x11c], 0
mov al, byte [ebp - 0x11c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret

Function at 0x4160b0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
call fcn.00414cc0
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov ecx, dword [ebp - 4]
mov edx, dword [eax + 0x40]
call edx
cmp dword [ebp - 0xc], 1
jne 0x41624d
mov eax, dword [ebp - 4]
cmp dword [eax + 0x68], 0
je 0x41624d
lea ecx, [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.004168d0
mov ecx, dword [ebp - 4]
call fcn.004155d0
mov dword [ebp - 0x10], eax
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
mov ecx, dword [eax + 0xf4]
call ecx
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x416145
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [eax + 0x84]
call edx
test eax, eax
je 0x41624d
mov dword [ebp - 0xc], 2
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
je 0x416165
mov dword [ebp - 0x14], 1
jmp 0x41616c
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0x14], 0
je 0x4161a5
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x58], 0
jne 0x4161a5
mov edx, dword [ebp - 4]
mov dword [edx + 0x58], 1
mov eax, dword [ebp - 4]
mov dword [eax + 0x5c], 0
push 1
push 0
push 0x3401
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.00416590
jmp 0x4161cb
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x58], 0
je 0x4161cb
mov edx, dword [ebp - 4]
cmp dword [edx + 0x5c], 0
jne 0x4161cb
mov eax, dword [ebp - 4]
mov dword [eax + 0x58], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x5c], 1
push 2
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx edx, ax
and edx, 0x8000
je 0x4161e7
mov dword [ebp - 0x18], 1
jmp 0x4161ee
mov dword [ebp - 0x18], 0
cmp dword [ebp - 0x18], 0
je 0x416227
mov eax, dword [ebp - 4]
cmp dword [eax + 0x60], 0
jne 0x416227
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x60], 1
mov edx, dword [ebp - 4]
mov dword [edx + 0x5c], 0
push 1
push 1
push 0x3401
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.00416590
jmp 0x41624d
mov eax, dword [ebp - 4]
cmp dword [eax + 0x60], 0
je 0x41624d
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x5c], 0
jne 0x41624d
mov edx, dword [ebp - 4]
mov dword [edx + 0x60], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x5c], 1
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 8
Function at 0x4172a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4172c4
xor eax, eax
jmp 0x417344
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4172db
xor eax, eax
jmp 0x417344
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x417327
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jae 0x417327
mov edx, dword [ebp - 4]
movzx eax, word [edx]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x4172fe
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x417333
xor eax, eax
jmp 0x417344
mov edx, dword [ebp - 4]
movzx eax, word [edx]
test eax, eax
jne 0x417341
xor eax, eax
jmp 0x417344
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x41ea80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0x10c], ecx
mov eax, dword [ebp - 0x10c]
cmp dword [eax + 0xa0], 0
je 0x41eacd
mov ecx, dword [ebp - 0x10c]
add ecx, 4
call fcn.004159d0
test eax, eax
je 0x41eacd
mov ecx, dword [ebp - 0x10c]
add ecx, 4
call fcn.004159f0
test eax, eax
jne 0x41ead2
jmp 0x41ec57
lea ecx, [ebp - 0x118]
call fcn.00413220
call fcn.005e2270
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
je 0x41eb90
cvtsi2sd xmm0, dword [ebp + 8]
sub esp, 8
movsd qword [esp], xmm0
call fcn.005e2210
add esp, 8
push eax
push 0x684a0c
mov ecx, dword [ebp - 0x110]
push ecx
call fcn.005e2130
add esp, 0xc
mov edx, dword [ebp - 0x110]
push edx
call fcn.005e2520
add esp, 4
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
je 0x41eb81
push 0xfde9
mov eax, dword [ebp - 0x114]
push eax
lea ecx, [ebp - 0x108]
call fcn.004214f0
mov ecx, eax
call fcn.0040d3c0
push eax
lea ecx, [ebp - 0x118]
call fcn.00413a70
lea ecx, [ebp - 0x108]
call fcn.00421ba0
mov ecx, dword [ebp - 0x114]
push ecx
call fcn.0063e41a
add esp, 4
mov edx, dword [ebp - 0x110]
push edx
call fcn.005e2350
add esp, 4
lea ecx, [ebp - 0x118]
call fcn.0040d3c0
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x120], 0
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x12c], 0x41e5c0
mov dword [ebp - 0x128], 0
mov ecx, dword [ebp - 0x12c]
mov dword [ebp - 0x134], ecx
mov edx, dword [ebp - 0x128]
mov dword [ebp - 0x130], edx
sub esp, 0x28
mov esi, esp
sub esp, 0x10
mov eax, esp
push 0x6847f7
push 0x6847f6
lea ecx, [ebp - 0x11c]
push ecx
lea edx, [ebp - 0x134]
push edx
push eax
call fcn.00420f50
add esp, 0x14
mov ecx, esi
call fcn.0041fc40
lea eax, [ebp - 0x120]
push eax
push 1
lea ecx, [ebp - 0x124]
push ecx
push str.batch
mov ecx, dword [ebp - 0x10c]
add ecx, 0x8c
call fcn.005d2470
mov edx, dword [ebp + 8]
push edx
push str.notify_CStaticMinPage_NotifyBatch_action_d
call fcn.005564a0
add esp, 8
lea ecx, [ebp - 0x118]
call fcn.00413870
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret 4
Function at 0x41ed10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0x118], ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x11c], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x124], ecx
lea ecx, [ebp - 0x114]
call fcn.00413220
call fcn.005e2270
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
je 0x41ee40
mov edx, dword [ebp - 0x11c]
push edx
lea eax, [ebp - 0x120]
push eax
call fcn.0055bc10
add esp, 8
mov ecx, eax
call fcn.0040d3c0
push eax
call fcn.005e22a0
add esp, 4
push eax
push 0x684a8c
mov ecx, dword [ebp - 0x10c]
push ecx
call fcn.005e2130
add esp, 0xc
lea ecx, [ebp - 0x120]
call fcn.00413870
cvtsi2sd xmm0, dword [ebp - 0x124]
sub esp, 8
movsd qword [esp], xmm0
call fcn.005e2210
add esp, 8
push eax
push 0x684a90
mov edx, dword [ebp - 0x10c]
push edx
call fcn.005e2130
add esp, 0xc
mov eax, dword [ebp - 0x10c]
push eax
call fcn.005e2520
add esp, 4
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
je 0x41ee31
push 0
mov ecx, dword [ebp - 0x110]
push ecx
lea ecx, [ebp - 0x108]
call fcn.004214f0
mov ecx, eax
call fcn.0040d3c0
push eax
lea ecx, [ebp - 0x114]
call fcn.00413a70
lea ecx, [ebp - 0x108]
call fcn.00421ba0
mov edx, dword [ebp - 0x110]
push edx
call fcn.0063e41a
add esp, 4
mov eax, dword [ebp - 0x10c]
push eax
call fcn.005e2350
add esp, 4
lea ecx, [ebp - 0x114]
call fcn.0040d3c0
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x12c], 0
mov ecx, dword [ebp - 0x118]
mov dword [ebp - 0x128], ecx
mov dword [ebp - 0x13c], 0x41e5a0
mov dword [ebp - 0x138], 0
mov edx, dword [ebp - 0x13c]
mov dword [ebp - 0x144], edx
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x140], eax
sub esp, 0x28
mov esi, esp
sub esp, 0x10
mov ecx, esp
push 0x6847f7
push 0x6847f6
lea edx, [ebp - 0x128]
push edx
lea eax, [ebp - 0x144]
push eax
push ecx
call fcn.00420f50
add esp, 0x14
mov ecx, esi
call fcn.0041fc40
lea ecx, [ebp - 0x12c]
push ecx
push 1
lea edx, [ebp - 0x130]
push edx
push 0x684a98
mov ecx, dword [ebp - 0x118]
add ecx, 0x8c
call fcn.005d2470
mov dword [ebp - 0x134], 0
lea ecx, [ebp - 0x114]
call fcn.00413870
mov eax, dword [ebp - 0x134]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret 0x10
Function at 0x423650
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
mov dword [ebp - 0x14], 0
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x423733
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov edx, dword [ebp + 0x10]
cmp dword [edx], 0
jle 0x423722
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
add ecx, 8
push ecx
call fcn.00613615
add esp, 4
mov dword [ebp - 0xc], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0xc]
mov dword [edx], eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
add edx, 8
push edx
push 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ecx
call fcn.0063a460
add esp, 0xc
push 0
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, dword [edx]
jne 0x423715
mov dword [ebp - 8], 1
jmp 0x42371c
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x423735
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x425f20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c0
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0x298], ecx
mov eax, dword [ebp - 0x298]
cmp dword [eax + 0xd4], 0
je 0x425f61
mov ecx, dword [ebp - 0x298]
add ecx, 0xc8
call fcn.0040dd70
movzx ecx, al
test ecx, ecx
je 0x425f66
jmp 0x4261b3
lea ecx, [ebp - 0x2a4]
call fcn.00413220
call fcn.005e2270
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 0
je 0x4260f0
push 0xfde9
mov ecx, dword [ebp - 0x298]
add ecx, 0xc8
call fcn.0040d3c0
push eax
lea ecx, [ebp - 0x88]
call fcn.00421730
mov ecx, eax
call fcn.0040d3c0
push eax
call fcn.005e22a0
add esp, 4
push eax
push str.wp_type
mov edx, dword [ebp - 0x29c]
push edx
call fcn.005e2130
add esp, 0xc
lea ecx, [ebp - 0x88]
call fcn.00421ba0
push 0xfde9
mov ecx, dword [ebp - 0x298]
add ecx, 0xcc
call fcn.0040d3c0
push eax
lea ecx, [ebp - 0x10c]
call fcn.00421730
mov ecx, eax
call fcn.0040d3c0
push eax
call fcn.005e22a0
add esp, 4
push eax
push 0x686228
mov eax, dword [ebp - 0x29c]
push eax
call fcn.005e2130
add esp, 0xc
lea ecx, [ebp - 0x10c]
call fcn.00421ba0
push 0xfde9
mov ecx, dword [ebp - 0x298]
add ecx, 0xd0
call fcn.0040d3c0
push eax
lea ecx, [ebp - 0x190]
call fcn.00421730
mov ecx, eax
call fcn.0040d3c0
push eax
call fcn.005e22a0
add esp, 4
push eax
push str.diy_type
mov ecx, dword [ebp - 0x29c]
push ecx
call fcn.005e2130
add esp, 0xc
lea ecx, [ebp - 0x190]
call fcn.00421ba0
mov edx, dword [ebp - 0x29c]
push edx
call fcn.005e2520
add esp, 4
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 0
je 0x4260e1
push 0xfde9
mov eax, dword [ebp - 0x2a0]
push eax
lea ecx, [ebp - 0x294]
call fcn.004214f0
mov ecx, eax
call fcn.0040d3c0
push eax
lea ecx, [ebp - 0x2a4]
call fcn.00413a70
lea ecx, [ebp - 0x294]
call fcn.00421ba0
mov ecx, dword [ebp - 0x2a0]
push ecx
call fcn.0063e41a
add esp, 4
mov edx, dword [ebp - 0x29c]
push edx
call fcn.005e2350
add esp, 4
lea ecx, [ebp - 0x2a4]
call fcn.0040d3c0
mov dword [ebp - 0x2b0], eax
mov dword [ebp - 0x2ac], 0
mov eax, dword [ebp - 0x298]
mov dword [ebp - 0x2a8], eax
mov dword [ebp - 0x2b8], 0x4261d0
mov dword [ebp - 0x2b4], 0
mov ecx, dword [ebp - 0x2b8]
mov dword [ebp - 0x2c0], ecx
mov edx, dword [ebp - 0x2b4]
mov dword [ebp - 0x2bc], edx
sub esp, 0x28
mov esi, esp
sub esp, 0x10
mov eax, esp
push 0x686169
push 0x686168
lea ecx, [ebp - 0x2a8]
push ecx
lea edx, [ebp - 0x2c0]
push edx
push eax
call fcn.00420f50
add esp, 0x14
mov ecx, esi
call fcn.00426cb0
lea eax, [ebp - 0x2ac]
push eax
push 1
lea ecx, [ebp - 0x2b0]
push ecx
push str.on_diy
mov ecx, dword [ebp - 0x298]
add ecx, 0x8c
call fcn.005d2470
push str.CDiyWnd::OnCallDIYTask
call fcn.005564a0
add esp, 4
lea ecx, [ebp - 0x2a4]
call fcn.00413870
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret
Function at 0x42b0e0
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
mov dword [eax], vtable.CImageCache.0
mov ecx, dword [ebp - 0x18]
add ecx, 4
call fcn.00413220
mov ecx, dword [ebp - 0x18]
add ecx, 8
call fcn.005497e0
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x18]
add ecx, 4
call fcn.0040d360
push 0
mov ecx, dword [ebp - 0x18]
add ecx, 8
call fcn.00549ba0
push 1
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x18]
add ecx, 8
call fcn.0054a150
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
mov ecx, dword [ebp + 8]
call fcn.0040d3c0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x42b1a3
cmp dword [ebp - 0x1c], 0xffffffff
je 0x42b1a3
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp - 0x24]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret 4
Function at 0x436660
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x288
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x288], ecx
mov dword [ebp - 0x278], 0
lea ecx, [ebp - 0x280]
call fcn.00413220
lea ecx, [ebp - 0x27c]
call fcn.00413220
lea eax, [ebp - 0x284]
push eax
call fcn.00429650
add esp, 4
lea ecx, [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea edx, [ebp - 0x284]
push edx
lea ecx, [ebp - 0x280]
call fcn.0040d360
push 0x687720
lea ecx, [ebp - 0x280]
call fcn.004318c0
lea eax, [ebp - 0x274]
push eax
lea ecx, [ebp - 0x280]
call fcn.0040d3c0
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 0
je 0x436705
cmp dword [ebp - 0x278], 0xffffffff
jne 0x43672b
lea ecx, [ebp - 0x284]
call fcn.00413870
lea ecx, [ebp - 0x27c]
call fcn.00413870
lea ecx, [ebp - 0x280]
call fcn.00413870
jmp 0x436802
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x260]
push edx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movzx eax, word [ebp - 0xe]
movzx ecx, word [ebp - 0x1e]
cmp eax, ecx
jne 0x436760
movzx edx, word [ebp - 0x12]
movzx eax, word [ebp - 0x22]
cmp edx, eax
jne 0x436760
movzx ecx, word [ebp - 0x14]
movzx edx, word [ebp - 0x24]
cmp ecx, edx
je 0x4367af
lea eax, [ebp - 0x284]
push eax
lea ecx, [ebp - 0x27c]
call fcn.0040d360
lea ecx, [ebp - 0x248]
push ecx
lea ecx, [ebp - 0x27c]
call fcn.004318c0
lea edx, [ebp - 0x248]
push edx
call fcn.00641e0e
add esp, 4
cmp eax, 4
jbe 0x4367af
push ecx
mov ecx, esp
lea eax, [ebp - 0x27c]
push eax
call fcn.00421650
call fcn.005b03e0
add esp, 4
lea ecx, [ebp - 0x274]
push ecx
mov edx, dword [ebp - 0x278]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x43672b
cmp dword [ebp - 0x278], 0
je 0x4367e1
mov eax, dword [ebp - 0x278]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x284]
call fcn.00413870
lea ecx, [ebp - 0x27c]
call fcn.00413870
lea ecx, [ebp - 0x280]
call fcn.00413870
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret