joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x406058], 1
mov dword [0x406054], 1
mov dword [0x406050], 1
jne 0x401056
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010b0
mov dword [0x40600c], eax
mov eax, dword [0x406064]
test eax, eax
je 0x4010a0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x406078]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x406060]
mov dword [eax], edx
call dbg._setargv
cmp dword [0x403014], 1
je 0x4010e0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x401070
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x4010f8
cmp dx, 0x20b
jne 0x401056
cmp dword [ecx + 0x84], 0xe
jbe 0x401056
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401056
mov dword [esp], dbg._matherr
call dbg.__mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401056
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401056

Function at 0x40174d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
mov eax, 0x1fc4
call fcn.00402b60
sub esp, eax
mov dword [ebp - 0x1fac], 0x696e494b
mov dword [ebp - 0x1fa8], 0x47466943
mov dword [ebp - 0x1fa4], 0x6f4c4347
mov dword [ebp - 0x1fa0], 0x49634a4e
mov dword [ebp - 0x1f9c], 0x6c6c6474
mov dword [ebp - 0x1f98], 0x55626549
mov dword [ebp - 0x1f94], 0x70794356
mov dword [ebp - 0x1f90], 0x4c726741
mov dword [ebp - 0x1f8c], 0x54477653
mov dword [ebp - 0x1f88], 0x73457345
mov dword [ebp - 0x1f84], 0x6a6b6356
mov dword [ebp - 0x1f80], 0x64504156
mov dword [ebp - 0x1f7c], 0x675a
lea edx, [ebp - 0x1f78]
mov eax, 0
mov ecx, 0x7db
mov edi, edx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x1fac]
mov dword [esp], eax
call sym._strupr
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._strlwr
mov edi, dword [ebp - 4]
leave
ret

Function at 0x401814
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
jmp 0x401879
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp - 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.WSOCK32.DLL_recv]
call eax
sub esp, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
add dword [ebp - 0xc], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x401879
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._wUdnCuih
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0x10]
jl 0x401830
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x4018b0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 2
mov eax, dword [sym.imp.WSOCK32.DLL_socket]
call eax
sub esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x4018eb
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._wUdnCuih
mov dword [esp], str.192.168.15.78
mov eax, dword [sym.imp.WSOCK32.DLL_gethostbyname]
call eax
sub esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x401910
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._wUdnCuih
mov eax, dword [ebp - 0x10]
movzx eax, word [eax + 0xa]
movsx edx, ax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
lea eax, [ebp - 0x20]
add eax, 4
mov dword [esp], eax
call sym._memcpy
mov word [ebp - 0x20], 2
mov dword [esp], 0x539
mov eax, dword [sym.imp.WSOCK32.DLL_htons]
call eax
sub esp, 4
mov word [ebp - 0x1e], ax
mov dword [esp + 8], 0x10
lea eax, [ebp - 0x20]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.WSOCK32.DLL_connect]
call eax
sub esp, 0xc
test eax, eax
je 0x401981
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._wUdnCuih
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x405523
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0x41c040]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x41c380], 0
push ebx
push esi
push edi
mov esi, edx
je 0x4056dc
mov eax, dword [esi + 4]
xor ebx, ebx
dec eax
mov dword [ebp - 0x414], ebx
mov dword [ebp - 0x410], ebx
mov ecx, 0x402819
mov dword [ebp - 0x40c], ebx
cmp eax, 0x10
ja case.0x40556c.16
jmp dword [eax*4 + 0x4056ef]
mov ecx, 0x40169c
jmp case.0x40556c.16
mov ecx, 0x4016a8
jmp case.0x40556c.16
mov ecx, 0x4016b4
jmp case.0x40556c.16
mov ecx, 0x4016c0
jmp case.0x40556c.16
mov ecx, 0x4016d0
jmp case.0x40556c.16
mov ecx, 0x4016dc
jmp case.0x40556c.16
mov ecx, 0x4016e8
jmp case.0x40556c.16
mov ecx, 0x4016f8
jmp case.0x40556c.16
mov ecx, 0x40170c
jmp case.0x40556c.16
mov ecx, 0x401718
jmp case.0x40556c.16
mov ecx, 0x401724
jmp case.0x40556c.16
mov ecx, 0x401730
jmp case.0x40556c.16
mov ecx, 0x401740
jmp case.0x40556c.16
mov ecx, 0x401750
jmp case.0x40556c.16
mov ecx, 0x401764
jmp case.0x40556c.16
mov ecx, 0x401778
push ecx
push dword [esi + 8]
lea eax, [ebp - 0x408]
push dword [esi + 0xc]
push dword [esi]
push 0x8b9
push dword [0x41c37c]
push dword [0x41c378]
push 0x401788
push 0x400
push eax
call dword [sym.imp.ntdll.dll_sprintf_s]
add esp, 0x28
lea ecx, [esi + 0x10]
lea edx, [ebp - 0x414]
mov edi, eax
call fcn.0041817c
mov esi, dword [ebp - 0x414]
or eax, 0xffffffff
cmp esi, eax
jbe 0x40563a
mov esi, eax
mov dword [ebp - 0x414], esi
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x41c], eax
cmp edi, eax
je 0x4056ba
push ebx
lea eax, [ebp - 0x420]
push eax
push edi
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x428]
push eax
push ebx
push ebx
push ebx
push dword [0x41c380]
call dword [sym.imp.ntdll.dll_NtWriteFile]
push ebx
lea eax, [ebp - 0x420]
push eax
push esi
push dword [ebp - 0x40c]
lea eax, [ebp - 0x428]
push eax
push ebx
push ebx
push ebx
push dword [0x41c380]
call dword [sym.imp.ntdll.dll_NtWriteFile]
push ebx
lea eax, [ebp - 0x420]
push eax
push 2
push 0x4017a8
lea eax, [ebp - 0x428]
push eax
push ebx
push ebx
push ebx
push dword [0x41c380]
call dword [sym.imp.ntdll.dll_NtWriteFile]
lea esi, [ebp - 0x414]
lea edi, [ebp - 0x434]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp dword [ebp - 0x40c], ebx
je 0x4056dc
lea ecx, [ebp - 0x434]
call fcn.0041a38f
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041ba49
mov esp, ebp
pop ebp
ret
Function at 0x405738
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x41c040]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [0x41c380], 0
mov eax, dword [ebp + 8]
push esi
je 0x4057a3
push eax
push edx
push ecx
push dword [0x41c37c]
mov esi, 0x41c3e0
push dword [0x41c378]
push 0x4017ac
push 0x400
push esi
call dword [sym.imp.ntdll.dll_sprintf_s]
add esp, 0x20
or dword [ebp - 0x14], 0xffffffff
or dword [ebp - 0x10], 0xffffffff
lea ecx, [ebp - 0x14]
xor edx, edx
push edx
push ecx
push eax
push esi
lea eax, [ebp - 0x1c]
push eax
push edx
push edx
push edx
push dword [0x41c380]
call dword [sym.imp.ntdll.dll_NtWriteFile]
mov ecx, dword [ebp - 8]
xor ecx, ebp
pop esi
call fcn.0041ba49
mov esp, ebp
pop ebp
ret 4

Function at 0x4057b9
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41c040]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x41c380], 0
push esi
mov esi, ecx
je 0x405825
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ntdll.dll_NtQuerySystemTime]
push esi
push dword [ebp - 0xc]
mov esi, 0x41c7e0
push dword [ebp - 0x10]
push 0x4017cc
push 0x400
push esi
call dword [sym.imp.ntdll.dll_sprintf_s]
add esp, 0x18
or dword [ebp - 0x18], 0xffffffff
or dword [ebp - 0x14], 0xffffffff
lea ecx, [ebp - 0x18]
xor edx, edx
push edx
push ecx
push eax
push esi
lea eax, [ebp - 0x20]
push eax
push edx
push edx
push edx
push dword [0x41c380]
call dword [sym.imp.ntdll.dll_NtWriteFile]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0041ba49
mov esp, ebp
pop ebp
ret

Function at 0x405839
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41c040]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x41c380], 0
push esi
mov esi, ecx
je 0x4058ad
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ntdll.dll_NtQuerySystemTime]
push dword [esi + 4]
movzx eax, word [esi]
mov esi, 0x41cbe0
shr eax, 1
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 0x4017e8
push 0x400
push esi
call dword [sym.imp.ntdll.dll_sprintf_s]
add esp, 0x1c
or dword [ebp - 0x18], 0xffffffff
or dword [ebp - 0x14], 0xffffffff
lea ecx, [ebp - 0x18]
xor edx, edx
push edx
push ecx
push eax
push esi
lea eax, [ebp - 0x20]
push eax
push edx
push edx
push edx
push dword [0x41c380]
call dword [sym.imp.ntdll.dll_NtWriteFile]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0041ba49
mov esp, ebp
pop ebp
ret
Function at 0x4058c1
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x41c040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
movzx eax, word [esi]
cmp eax, 0x1f4
ja 0x4059bc
push eax
push dword [esi + 4]
push 0x41cfec
call sub.ntdll.dll_memcpy
movzx eax, word [esi]
add esp, 0xc
shr eax, 1
push 0x2e
lea ecx, [eax*2 + 0x41cfec]
pop eax
mov word [ecx], ax
add ecx, 2
mov edx, dword [0x41c378]
xor ebx, ebx
mov edi, dword [0x41c37c]
cmp ecx, 0x41d1e0
jae 0x405945
mov eax, edi
shr eax, 0x1c
and eax, 0xf
shld edi, edx, 4
shl edx, 4
movsx ax, byte [eax + 0x402830]
mov word [ecx], ax
add ecx, 2
inc ebx
cmp ebx, 0x10
jb 0x40591a
movzx eax, word [esi]
add eax, 0x22
mov byte [0x41cfe0], 1
mov dword [0x41cfe8], eax
xor eax, eax
push 0x4060
mov dword [0x41cfe4], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0xc]
push 7
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0x18
push eax
push 0x100100
lea eax, [ebp - 0x10]
mov dword [ebp - 0x1c], 0x40
push eax
mov dword [ebp - 0x20], esi
call dword [sym.imp.ntdll.dll_NtOpenFile]
test eax, eax
js 0x4059bc
push 0xb
push 0x200
push 0x41cfe0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
push dword [ebp - 0x10]
call dword [sym.imp.ntdll.dll_NtClose]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041ba49
mov esp, ebp
pop ebp
ret
Function at 0x407706
Capabilities:
Get file attributes
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x41c040]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, dword [ecx + 4]
lea eax, [ebp - 0x2c]
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push ebx
push ebx
push 0x60
push 1
push eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 0xc], ebx
push eax
push 0x120089
lea eax, [ebp - 0xc]
mov dword [ebp - 0x4c], 0x18
push eax
push dword [ecx + 0x50]
mov ecx, esi
mov dword [ebp - 0x48], ebx
push 1
mov dword [ebp - 0x40], 0x40
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
call dword [0x41e158]
call esi
mov esi, eax
test esi, esi
js 0x407826
push 5
push 0x18
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov esi, eax
test esi, esi
js 0x407826
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
cmp eax, ebx
jg 0x4077b6
jl 0x40779f
cmp ecx, ebx
jae 0x4077ab
mov edi, 0x730
mov esi, 0xc00000e5
jmp 0x4077c0
cmp eax, ebx
jl 0x4077fb
jg 0x4077b6
cmp ecx, 0xffffffff
jbe 0x4077fb
mov edi, 0x738
mov esi, 0xc000042b
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x50], esi
test eax, eax
je 0x4077d9
cmp eax, 0xffffffff
je 0x4077d9
push eax
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ntdll.dll_NtClose]
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0x401670
push eax
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x30], 0x4021a8
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], ebx
call fcn.00408a15
jmp 0x40783c
mov edx, edi
call fcn.0041a303
mov esi, eax
test esi, esi
js 0x407826
push ebx
push ebx
push dword [edi + 4]
lea eax, [ebp - 0x2c]
push dword [edi + 8]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0xc]
call dword [sym.imp.ntdll.dll_NtReadFile]
mov esi, eax
test esi, esi
jns 0x407840
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x40783c
cmp eax, 0xffffffff
je 0x40783c
push eax
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, esi
jmp 0x40785d
mov eax, dword [ebp - 0x28]
mov dword [edi], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x40785b
cmp eax, 0xffffffff
je 0x40785b
push eax
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ntdll.dll_NtClose]
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041ba49
mov esp, ebp
pop ebp
ret 4
Function at 0x4098e4
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
mov eax, dword [0x41c040]
xor eax, esp
mov dword [esp + 0x48], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], ecx
mov ecx, dword [ebp + 0x28]
push ebx
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x18], ecx
mov ecx, dword [ebp + 0x2c]
push esi
mov esi, dword [ebp + 0x30]
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x18], ecx
xor ecx, ecx
mov dword [esp + 0x24], eax
mov ebx, ecx
mov eax, dword [ebp + 0x20]
mov dword [esp + 0x20], eax
mov dword [esp + 0x34], esi
mov dword [esp + 0xc], ecx
push edi
mov edi, dword [ebp + 0x1c]
mov dword [esp + 0x3c], edi
test esi, esi
je 0x40994e
mov dword [esi], ecx
push dword [ebp + 0x24]
mov dword [edi], ecx
push ecx
push eax
mov dword [edi + 4], ecx
call sub.ntdll.dll_memset
add esp, 0xc
push dword [esp + 0x1c]
push dword [esp + 0x24]
push dword [ebp + 0x24]
push dword [esp + 0x30]
push edi
push dword [esp + 0x3c]
push dword [esp + 0x44]
push dword [esp + 0x4c]
push dword [esp + 0x54]
call dword [sym.imp.ntdll.dll_NtReadFile]
mov edi, eax
test edi, edi
jns 0x409a57
mov eax, dword [esp + 0x18]
cmp byte [eax], 0
je 0x409a24
mov ecx, dword [esp + 0x10]
mov eax, ebx
or eax, ecx
jne 0x409a0e
mov edx, dword [0x7ffe0004]
mov ebx, 0x7ffe0324
mov dword [esp + 0x10], edx
mov ecx, dword [ebx]
lea eax, [ebx - 4]
mov eax, dword [eax]
mov dword [esp + 0x14], eax
lea eax, [ebx + 4]
mov eax, dword [eax]
cmp ecx, eax
je 0x4099e8
lea edx, [ebx - 4]
lea esi, [ebx + 4]
pause
mov ecx, dword [ebx]
mov eax, dword [edx]
mov dword [esp + 0x14], eax
mov eax, dword [esi]
cmp ecx, eax
jne 0x4099d0
mov esi, dword [esp + 0x38]
mov edx, dword [esp + 0x10]
mov eax, ecx
mul edx
mov ebx, eax
mov ecx, edx
mov eax, dword [esp + 0x14]
mul dword [esp + 0x10]
shld ecx, ebx, 8
shrd eax, edx, 0x18
shl ebx, 8
shr edx, 0x18
add ebx, eax
adc ecx, edx
mov dword [esp + 0x10], ecx
push ecx
push ecx
mov ecx, dword [esp + 0x20]
push ebx
push edi
call fcn.004092ff
mov edi, dword [esp + 0x3c]
jmp 0x409960
mov dword [esp + 0x40], edi
and dword [esp + 0x50], 0
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x44]
mov dword [esp + 0x48], 0x402b4c
mov dword [esp + 0x4c], 0x402c14
mov dword [esp + 0x50], 0x188
call fcn.00408a15
mov eax, edi
jmp 0x409a63
test esi, esi
je 0x409a61
mov dword [esi], 1
xor eax, eax
mov ecx, dword [esp + 0x54]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041ba49
mov esp, ebp
pop ebp
ret 0x2c
Function at 0x409a7c
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x54
mov eax, dword [0x41c040]
xor eax, esp
mov dword [esp + 0x50], eax
mov eax, dword [ebp + 0x18]
mov edx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0x20]
mov dword [esp + 0x20], ebx
mov ebx, dword [ebp + 0x28]
mov dword [esp + 0x1c], ebx
mov ebx, dword [ebp + 0x2c]
push esi
mov esi, dword [ebp + 0x30]
mov dword [esp + 0x1c], ebx
xor ebx, ebx
and dword [esp + 8], ebx
mov dword [esp + 0x18], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], edx
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], esi
push edi
mov edi, dword [ebp + 0x14]
mov dword [esp + 0x44], edi
test esi, esi
je 0x409ae4
and dword [esi], ebx
and dword [eax], ebx
and dword [eax + 4], ebx
mov dword [esp + 0x30], 0x7ffe0324
mov dword [esp + 0x10], 0x7ffe0320
mov dword [esp + 0x14], 0x7ffe0328
push dword [esp + 0x20]
push dword [esp + 0x28]
push dword [ebp + 0x24]
push dword [esp + 0x34]
push eax
push dword [esp + 0x40]
push edi
push edx
push ecx
call dword [sym.imp.ntdll.dll_NtWriteFile]
mov edi, eax
test edi, edi
jns 0x409bfe
mov eax, dword [esp + 0x1c]
cmp byte [eax], 0
je 0x409bcb
mov ecx, dword [esp + 0xc]
mov eax, ebx
or eax, ecx
jne 0x409ba9
mov ebx, dword [esp + 0x30]
mov eax, dword [esp + 0x10]
mov edx, dword [0x7ffe0004]
mov dword [esp + 0xc], edx
mov ecx, dword [ebx]
mov eax, dword [eax]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
cmp ecx, eax
je 0x409b83
mov edx, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
pause
mov ecx, dword [ebx]
mov eax, dword [edx]
mov dword [esp + 0x18], eax
mov eax, dword [esi]
cmp ecx, eax
jne 0x409b6b
mov esi, dword [esp + 0x34]
mov edx, dword [esp + 0xc]
mov eax, ecx
mul edx
mov ebx, eax
mov ecx, edx
mov eax, dword [esp + 0x18]
mul dword [esp + 0xc]
shld ecx, ebx, 8
shrd eax, edx, 0x18
shl ebx, 8
shr edx, 0x18
add ebx, eax
adc ecx, edx
mov dword [esp + 0xc], ecx
push ecx
push ecx
mov ecx, dword [esp + 0x24]
push ebx
push edi
call fcn.004092ff
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x40]
mov edi, dword [esp + 0x44]
jmp 0x409b01
mov dword [esp + 0x48], edi
and dword [esp + 0x58], 0
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x4c]
mov dword [esp + 0x50], 0x402b4c
mov dword [esp + 0x54], 0x402c2c
mov dword [esp + 0x58], 0x1c7
call fcn.00408a15
mov eax, edi
jmp 0x409c0a
test esi, esi
je 0x409c08
mov dword [esi], 1
xor eax, eax
mov ecx, dword [esp + 0x5c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041ba49
mov esp, ebp
pop ebp
ret 0x2c
Function at 0x409c23
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
mov eax, dword [0x41c040]
xor eax, esp
mov dword [esp + 0x30], eax
mov eax, dword [ebp + 0xc]
xor edx, edx
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0x20]
mov dword [esp + 0x14], ecx
mov ecx, dword [ebp + 0x14]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], esi
mov dword [esp + 0xc], edx
mov dword [esp + 8], edx
push edi
test esi, esi
je 0x409c6c
mov dword [esi], edx
mov dword [ebx], edx
mov dword [ebx + 4], edx
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push ecx
push ebx
push eax
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov edi, eax
test edi, edi
jns 0x409d78
mov eax, dword [esp + 0x18]
cmp byte [eax], 0
je 0x409d45
mov ecx, dword [esp + 0x10]
mov eax, ecx
or eax, dword [esp + 0xc]
jne 0x409d27
mov edx, dword [0x7ffe0004]
mov eax, 0x7ffe0324
mov dword [esp + 0x10], edx
mov ecx, dword [eax]
add eax, 0xfffffffc
mov eax, dword [eax]
mov dword [esp + 0x14], eax
mov eax, 0x7ffe0328
mov eax, dword [eax]
cmp ecx, eax
je 0x409cf3
mov edx, 0x7ffe0324
lea esi, [edx - 4]
lea ebx, [edx + 4]
pause
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [esp + 0x14], eax
mov eax, dword [ebx]
cmp ecx, eax
jne 0x409cd7
mov esi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
mov eax, ecx
mul edx
mov ecx, eax
mov eax, edx
shld eax, ecx, 8
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x14]
mul dword [esp + 0x10]
shl ecx, 8
shrd eax, edx, 0x18
shr edx, 0x18
add ecx, eax
mov eax, dword [esp + 0xc]
adc eax, edx
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
jmp 0x409d2b
mov eax, dword [esp + 0xc]
push ecx
push eax
push ecx
mov ecx, dword [esp + 0x24]
push edi
call fcn.004092ff
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
jmp 0x409c71
mov dword [esp + 0xc], edi
and dword [esp + 0x38], 0
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], 0x402b4c
mov dword [esp + 0x34], 0x402c44
mov dword [esp + 0x38], 0x1fe
call fcn.00408a15
mov eax, edi
jmp 0x409d8c
mov eax, dword [ebp + 0x18]
cmp eax, dword [ebx + 4]
jb 0x409da0
test esi, esi
je 0x409d8a
mov dword [esi], 1
xor eax, eax
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041ba49
mov esp, ebp
pop ebp
ret 0x1c
call fcn.00408a2d
int3
Function at 0x409dab
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
mov eax, dword [0x41c040]
xor eax, esp
mov dword [esp + 0x30], eax
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0x20]
push esi
push edi
xor edi, edi
mov dword [esp + 0x18], ecx
mov ecx, dword [ebp + 0xc]
xor esi, esi
inc edi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], edx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], esi
test ebx, ebx
je 0x409df7
mov dword [ebx], esi
mov dword [eax], esi
mov dword [eax + 4], esi
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push edx
push eax
push ecx
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
mov esi, eax
cmp esi, 0xc0000043
jne 0x409e3a
test byte [ebp + 8], 1
je 0x409e74
push 2
pop edi
test ebx, ebx
je 0x409e24
mov dword [ebx], edi
xor eax, eax
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041ba49
mov esp, ebp
pop ebp
ret 0x1c
cmp esi, 0xc0000121
jne 0x409e4c
test byte [ebp + 8], 2
je 0x409e74
push 3
jmp 0x409e1d
cmp esi, 0xc0000101
jne 0x409e5e
test byte [ebp + 8], 4
je 0x409e74
push 4
jmp 0x409e1d
cmp esi, 0xc00000d4
jne 0x409e70
test byte [ebp + 8], 8
je 0x409e74
push 5
jmp 0x409e1d
test esi, esi
jns 0x409e1e
mov eax, dword [esp + 0x18]
cmp byte [eax], 0
je 0x409f2e
mov ecx, dword [esp + 0x10]
mov eax, ecx
or eax, dword [esp + 0xc]
jne 0x409f0c
mov edx, dword [0x7ffe0004]
mov eax, 0x7ffe0324
mov dword [esp + 0x10], edx
mov ecx, dword [eax]
add eax, 0xfffffffc
mov eax, dword [eax]
mov dword [esp + 0x14], eax
mov eax, 0x7ffe0328
mov eax, dword [eax]
cmp ecx, eax
je 0x409ed8
mov edx, 0x7ffe0324
lea ebx, [edx - 4]
lea edi, [edx + 4]
pause
mov ecx, dword [edx]
mov eax, dword [ebx]
mov dword [esp + 0x14], eax
mov eax, dword [edi]
cmp ecx, eax
jne 0x409ebd
mov ebx, dword [esp + 0x1c]
xor edi, edi
mov edx, dword [esp + 0x10]
inc edi
mov eax, ecx
mul edx
mov ecx, eax
mov eax, edx
shld eax, ecx, 8
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x14]
mul dword [esp + 0x10]
shl ecx, 8
shrd eax, edx, 0x18
shr edx, 0x18
add ecx, eax
mov eax, dword [esp + 0xc]
adc eax, edx
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
jmp 0x409f10
mov eax, dword [esp + 0xc]
push ecx
push eax
push ecx
mov ecx, dword [esp + 0x24]
push esi
call fcn.004092ff
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
jmp 0x409dfc
mov dword [esp + 0xc], esi
and dword [esp + 0x38], 0
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], 0x402b4c
mov dword [esp + 0x34], 0x402c68
mov dword [esp + 0x38], 0x24b
call fcn.00408a15
mov eax, esi
jmp 0x409e26