joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b7e0
Capabilities:
Hash data using sha256

Disassembly:
sub esp, 0x74
push esi
mov esi, ecx
cmp dword [esi], 0x3f
jne 0x40b846
xor eax, eax
cmp dword [esi + 4], eax
jbe 0x40b800
mov cl, byte [esi + eax + 8]
mov byte [esi + eax + 0x20], cl
inc eax
cmp eax, dword [esi + 4]
jb 0x40b7f2
xor ecx, ecx
cmp dword [esi + 0x1c], ecx
jbe 0x40b821
cmp eax, 0x20
jae 0x40b949
mov edx, dword [esi + 0x18]
mov dl, byte [ecx + edx]
mov byte [eax + esi + 0x20], dl
inc ecx
inc eax
cmp ecx, dword [esi + 0x1c]
jb 0x40b807
cmp eax, 0x20
jae 0x40b949
mov edx, 0x20
sub edx, eax
push edx
lea ecx, [eax + esi + 0x20]
push 0
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
pop esi
add esp, 0x74
ret
mov eax, dword [esi + 4]
mov ecx, dword [esi + 0x1c]
push ebx
push ebp
lea eax, [eax + ecx + 8]
xor ebp, ebp
xor ebx, ebx
push edi
mov dword [esp + 0x10], eax
cmp eax, ebp
je 0x40b86a
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov ebx, eax
mov edx, dword [esi + 4]
push edx
lea eax, [esi + 8]
push eax
push ebx
call sub.MSVCRT.dll_memcpy
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 0x18]
mov eax, dword [esi + 4]
push ecx
push edx
add eax, ebx
push eax
call sub.MSVCRT.dll_memcpy
mov edi, dword [esi + 4]
add edi, ebx
add edi, dword [esi + 0x1c]
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov ecx, dword [esi]
add esp, 0x18
mov eax, 1
xor edx, edx
mov dword [esp + 0x1c], 0x6a09e667
mov dword [esp + 0x20], 0xbb67ae85
mov dword [esp + 0x24], 0x3c6ef372
mov dword [esp + 0x28], 0xa54ff53a
mov dword [esp + 0x2c], 0x510e527f
mov dword [esp + 0x30], 0x9b05688c
mov dword [esp + 0x34], 0x1f83d9ab
mov dword [esp + 0x38], 0x5be0cd19
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x40], ebp
call fcn.00416330
mov ebp, eax
mov dword [esp + 0x18], edx
lea esp, [esp]
mov ecx, dword [esp + 0x10]
push ecx
mov edx, ebx
lea ecx, [esp + 0x20]
call fcn.0040b320
xor eax, eax
inc byte [eax + edi]
jne 0x40b91d
inc eax
cmp eax, 8
jb 0x40b912
mov eax, dword [esp + 0x18]
add ebp, 0xffffffff
adc eax, 0xffffffff
mov edx, ebp
or edx, eax
mov dword [esp + 0x18], eax
jne 0x40b900
lea edx, [esi + 0x20]
lea ecx, [esp + 0x1c]
call fcn.0040b5d0
push ebx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x74
ret
Function at 0x40de3b
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40de61
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40de61
xor al, al
jmp 0x40de76
mov edx, dword [ebp - 4]
xor eax, eax
xor ecx, ecx
add ecx, esi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4
Function at 0x415d70
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov eax, edx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x41dc60], ecx
inc edx
cmp edx, 0x100
jb 0x415d72
cmp edx, 0x800
jae 0x415e49
lea esp, [esp]
mov eax, dword [edx*4 + 0x41d860]
mov ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x41dc60]
inc edx
mov dword [edx*4 + 0x41dc5c], eax
cmp edx, 0x800
jb 0x415e20
mov eax, 0x416620
mov dword [0x41dc5c], eax
mov dword [0x41fc60], eax
mov dword [0x41dc58], 0x416540
call fcn.00416050
test eax, eax
jne 0x415e75
mov dword [0x41fc60], 0x416540
ret
Function at 0x7ffe5493
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0x30]
call 0x7ffe549e
pop edx
xor dx, dx
add edx, 0xd5e0
xor ecx, ecx
mov cl, 0x1e
xor byte [ecx + edx], 0x78
loop 0x7ffe54ac
push dword fs:[0x24]
pop dword [edx + 0xa]
mov cl, 0xff
push edx
loop 0x7ffe54be
mov dword [edx + 0x11], 0xffffacbb
mov ecx, dword [eax + 0x2c]
mov dword [edx + 0x1b], ecx
mov dword [edx + 0x100], ecx
mov dword [eax + 0x2c], esp
push 0
push 0
push 0
push 0
cld
nop
push 0x30
clc
cld
push 0x20
cld
push 0
push 0
push es
pop ds
cld
add edx, 0xffff7f39
nop
cld
push edx
clc
push edx
push 0
push edx
cdq
pop edx
call dword [edx + 0x820a]
nop
cld
add esp, 0x3f8
cld
xor eax, eax
inc eax
add al, 0
clc
ret 0xc

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x14971772
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x30ec2c7f
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x411c80
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c5408
mov eax, dword fs:[0]
push eax
sub esp, 0x1a4
mov eax, dword [0x642490]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1a8], ecx
mov ecx, dword [ebp - 0x1a8]
call fcn.0047667f
push 0
mov ecx, dword [ebp - 0x1a8]
call fcn.00412e40
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 0
je 0x411d4b
push 4
lea ecx, [ebp - 0x14]
call fcn.00408390
lea ecx, [ebp - 0x14]
call fcn.00413980
mov dword [ebp - 4], 0
push 0x65
lea ecx, [ebp - 0x14]
call fcn.00413480
mov dword [ebp - 0x1b0], eax
lea ecx, [ebp - 0x14]
call fcn.00412e10
movzx eax, al
test eax, eax
jne 0x411d3c
push 0
push 0
push 0x800
mov ecx, dword [ebp - 0x1ac]
call fcn.00412e90
lea ecx, [ebp - 0x14]
call fcn.00405bf0
push eax
push 0x10
push 0
mov ecx, dword [ebp - 0x1ac]
call fcn.00412e90
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004139c0
push 1
mov ecx, dword [ebp - 0x1a8]
mov edx, dword [ecx + 0xbc]
push edx
mov ecx, dword [ebp - 0x1a8]
call fcn.00412de0
push 0
mov eax, dword [ebp - 0x1a8]
mov ecx, dword [eax + 0xbc]
push ecx
mov ecx, dword [ebp - 0x1a8]
call fcn.00412de0
lea edx, [ebp - 0x1a4]
push edx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ecx, dword [ebp - 0x1a8]
call fcn.00411b30
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00588661
mov esp, ebp
pop ebp
ret

Function at 0x413160
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x413184
xor eax, eax
jmp 0x413204
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x41319b
xor eax, eax
jmp 0x413204
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x4131e7
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jae 0x4131e7
mov edx, dword [ebp - 4]
movzx eax, word [edx]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x4131be
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x4131f3
xor eax, eax
jmp 0x413204
mov edx, dword [ebp - 4]
movzx eax, word [edx]
test eax, eax
jne 0x413201
xor eax, eax
jmp 0x413204
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x422710
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c65f8
mov eax, dword fs:[0]
push eax
sub esp, 0x3ec
mov eax, dword [0x642490]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea eax, [ebp - 0x3f8]
push eax
lea ecx, [ebp + 8]
call fcn.004067b0
push eax
call fcn.00430160
add esp, 8
lea ecx, [ebp - 0x3f8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00406730
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00588661
mov esp, ebp
pop ebp
ret
Function at 0x424650
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c6978
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x642490]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0xc
lea ecx, [ebp - 0x1c]
call fcn.00408390
lea ecx, [ebp - 0x1c]
call fcn.00409f60
mov dword [ebp - 4], 0
lea eax, [ebp - 0x1c]
push eax
call fcn.004525d0
add esp, 4
lea ecx, [ebp - 0x1c]
call fcn.0040b920
test eax, eax
jne 0x4246bc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0040b8a0
jmp 0x4246f8
cmp dword [0x6436f4], 1
jne 0x4246ca
call fcn.00423e50
cmp dword [0x651f80], 0
je 0x4246e2
mov ecx, dword [0x651f80]
push ecx
call fcn.00422790
add esp, 4
push 0
call fcn.00589ca0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0040b8a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00588661
mov esp, ebp
pop ebp
ret
Function at 0x427250
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c6ef3
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x642490]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x94], 0
push 0x614cc9
lea ecx, [ebp - 0x58]
call fcn.004066a0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x98]
push eax
lea ecx, [ebp - 0x70]
push ecx
call fcn.00430200
add esp, 8
mov byte [ebp - 4], 1
push 0xc
lea ecx, [ebp - 0x28]
call fcn.00408390
lea ecx, [ebp - 0x28]
call fcn.00409f60
mov byte [ebp - 4], 2
push 0x615808
lea ecx, [ebp - 0x88]
call fcn.004066a0
mov byte [ebp - 4], 3
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0x70]
push ecx
call fcn.0042fc80
add esp, 0xc
push 0xc
lea ecx, [ebp - 0x1c]
call fcn.00408390
lea ecx, [ebp - 0x1c]
call fcn.00409f60
mov byte [ebp - 4], 4
mov dword [ebp - 0x8c], 0
jmp 0x42732e
mov edx, dword [ebp - 0x8c]
add edx, 1
mov dword [ebp - 0x8c], edx
lea ecx, [ebp - 0x28]
call fcn.0041cfd0
cmp dword [ebp - 0x8c], eax
jae 0x4273a7
mov eax, dword [ebp - 0x8c]
push eax
lea ecx, [ebp - 0x28]
call fcn.00409fb0
push eax
lea ecx, [ebp - 0x40]
call fcn.00406610
mov byte [ebp - 4], 5
push 0x614cca
lea ecx, [ebp - 0x40]
push ecx
call fcn.0041eb30
add esp, 8
movzx edx, al
test edx, edx
je 0x427396
push 0x61580c
lea eax, [ebp - 0x40]
push eax
call fcn.0041eb30
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x427396
lea edx, [ebp - 0x40]
push edx
lea ecx, [ebp - 0x1c]
call fcn.0041cff0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x40]
call fcn.00406730
jmp 0x42731f
mov dword [ebp - 0x90], 0
jmp 0x4273c2
mov eax, dword [ebp - 0x90]
add eax, 1
mov dword [ebp - 0x90], eax
lea ecx, [ebp - 0x1c]
call fcn.0041cfd0
cmp dword [ebp - 0x90], eax
jae 0x4273d4
jmp 0x4273b3
lea ecx, [ebp - 0x1c]
call fcn.0041cfd0
cmp eax, 2
jb 0x4273f4
push 1
lea ecx, [ebp - 0x1c]
call fcn.00409fb0
push eax
lea ecx, [ebp - 0x58]
call fcn.00407150
lea ecx, [ebp - 0x58]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004066e0
mov edx, dword [ebp - 0x94]
or edx, 1
mov dword [ebp - 0x94], edx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1c]
call fcn.00409f90
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x88]
call fcn.00406730
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.00409f90
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x70]
call fcn.00406730
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.00406730
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00588661
mov esp, ebp
pop ebp
ret
Function at 0x436e70
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c7efb
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x642490]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24c], 0
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0x615bd8
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 0x250], eax
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x230]
push edx
call fcn.00430200
add esp, 8
mov dword [ebp - 4], 0
push 0x614ddb
lea eax, [ebp - 0x230]
push eax
call fcn.0040a1b0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x436f0c
push 0x615be8
lea ecx, [ebp - 0x230]
call fcn.00408bc0
jmp 0x436f37
lea ecx, [ebp - 0x230]
call fcn.004067b0
push eax
call fcn.0043d130
add esp, 4
movzx edx, al
test edx, edx
jne 0x436f37
push 0x615bec
lea ecx, [ebp - 0x230]
call fcn.00408bc0
push 1
push 0
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x230]
call fcn.00430730
lea ecx, [ebp - 0x248]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004066e0
mov edx, dword [ebp - 0x24c]
or edx, 1
mov dword [ebp - 0x24c], edx
lea ecx, [ebp - 0x248]
call fcn.00406730
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.00406730
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00588661
mov esp, ebp
pop ebp
ret
Function at 0x43cee0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0xc], 0
cmp dword [ebp + 8], 0
jne 0x43cefa
xor eax, eax
jmp 0x43cfe9
mov eax, dword [ebp + 8]
push eax
call fcn.0058a666
add esp, 4
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x14]
mov cl, byte [eax]
mov byte [ebp - 1], cl
add dword [ebp - 0x14], 1
cmp byte [ebp - 1], 0
jne 0x43cf18
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0xc], 0
jmp 0x43cf4b
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 0x20]
jge 0x43cfb4
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0xc]
movsx ecx, byte [eax]
cmp ecx, 0x5c
je 0x43cf6f
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0xc]
movsx eax, byte [edx]
cmp eax, 0x2f
jne 0x43cfb2
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0xc]
mov byte [ecx], 0
push 0
mov edx, dword [ebp - 8]
push edx
call fcn.0058a6b6
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x43cfa9
mov eax, dword [ebp - 8]
push eax
call fcn.0058a716
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x43cfa9
or eax, 0xffffffff
jmp 0x43cfe9
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0xc]
mov byte [ecx], 0x2f
jmp 0x43cf42
push 0
mov edx, dword [ebp - 8]
push edx
call fcn.0058a6b6
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x43cfda
mov eax, dword [ebp - 8]
push eax
call fcn.0058a716
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.00588ea4
add esp, 4
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x43d130
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x43d14b
xor al, al
jmp 0x43d159
mov ecx, dword [ebp - 4]
and ecx, 0x10
je 0x43d157
mov al, 1
jmp 0x43d159
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x4407a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c89a8
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x642490]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0x40], 0
je 0x4407e0
mov ecx, dword [ebp - 0x30]
movzx edx, byte [ecx + 0x45]
test edx, edx
jne 0x4407ec
mov al, 1
jmp 0x44098f
mov dword [ebp - 0x54], 8
call fcn.00405010
push eax
mov eax, dword [ebp - 0x30]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x30]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x40], eax
call fcn.00405010
mov dword [ebp - 0x44], eax
lea ecx, [ebp - 0x40]
push ecx
lea edx, [ebp - 0x44]
push edx
call fcn.00404fe0
add esp, 8
movzx eax, al
test eax, eax
je 0x44082f
xor al, al
jmp 0x44098f
push 0
push 8
lea ecx, [ebp - 0x28]
call fcn.00407110
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x58]
push edx
lea ecx, [ebp - 0x28]
call fcn.0040f740
mov ecx, eax
call fcn.0040ba70
mov esi, eax
lea ecx, [ebp - 0x28]
call fcn.00406bd0
add esi, eax
push esi
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x28]
call fcn.0040f740
mov ecx, eax
call fcn.0040ba70
push eax
mov ecx, dword [ebp - 0x30]
add ecx, 0x48
push ecx
mov edx, dword [ebp - 0x30]
mov ecx, dword [edx + 0x40]
call fcn.00440d30
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
je 0x4408aa
cmp dword [ebp - 0x3c], 1
je 0x4408b1
cmp dword [ebp - 0x3c], 3
je 0x44094b
jmp 0x440963
mov eax, dword [ebp - 0x30]
mov byte [eax + 0x45], 0
lea ecx, [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x28]
call fcn.0040f740
mov ecx, eax
call fcn.0040ba70
mov edx, dword [ebp - 0x2c]
sub edx, eax
mov dword [ebp - 0x38], edx
je 0x440914
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0x50]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 1
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x28]
call fcn.0040f740
mov ecx, eax
call fcn.0040ba70
push eax
call fcn.0058b3db
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x440914
mov byte [ebp - 0x34], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00406730
mov al, byte [ebp - 0x34]
jmp 0x44098f
mov ecx, dword [ebp - 0x30]
movzx edx, byte [ecx + 0x45]
test edx, edx
jne 0x440937
mov byte [ebp - 0x31], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00406730
mov al, byte [ebp - 0x31]
jmp 0x44098f
cmp dword [ebp - 0x38], 0
jne 0x440949
push 0
push 8
lea ecx, [ebp - 0x28]
call fcn.004346c0
jmp 0x44097b
mov byte [ebp - 0x33], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00406730
mov al, byte [ebp - 0x33]
jmp 0x44098f
mov byte [ebp - 0x32], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00406730
mov al, byte [ebp - 0x32]
jmp 0x44098f
jmp 0x440842
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00588661
mov esp, ebp
pop ebp
ret
Function at 0x443720
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c8c00
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x642490]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0x20]
call fcn.00427fe0
mov byte [ebp - 0x25], 0
lea ecx, [ebp + 8]
call fcn.004067b0
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x44380c
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x2c]
cmp dword [ecx + edx*4], 0
je 0x44380a
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ecx + edx*4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov edx, dword [eax]
mov dword [ebp - 0x24], edx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x20], ecx
mov edx, dword [eax + 8]
mov dword [ebp - 0x1c], edx
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x18], ecx
mov edx, dword [eax + 0x10]
mov dword [ebp - 0x14], edx
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x48]
call fcn.004066a0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
push ecx
mov ecx, dword [ebp + 0x20]
call fcn.00431ac0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.00406730
mov byte [ebp - 0x25], 1
xor edx, edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0x2c], eax
jmp 0x44377e
jmp 0x443810
mov byte [ebp - 0x25], 0
mov cl, byte [ebp - 0x25]
mov byte [ebp - 0x26], cl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00406730
mov al, byte [ebp - 0x26]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00588661
mov esp, ebp
pop ebp
ret
Function at 0x445d20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c8e83
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x642490]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 8], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x10
call fcn.00406670
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 0x2a], 0
mov edx, dword [ebp - 0x10]
mov dword [edx], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 8], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0xc], 0xffffffff
lea eax, [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x10
call fcn.00407150
mov ecx, dword [ebp - 0x10]
mov dx, word [ebp + 0x20]
mov word [ecx + 0x28], dx
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x2a], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x2c], 0x1f40
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x30], 0x1f40
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x34], 0xf
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x38], 0xf
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x3c], 0x1388
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x40], 0x12c
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 0x44], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00406730
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x1c