joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408627
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004082e7

Function at 0x4659a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x457015
lea edi, [esi - 0x56015]
push edi
or ebp, 0xffffffff
jmp 0x4659c2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4659c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4659b8
mov eax, 1
add ebx, ebx
jne 0x4659db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4659d0
jne 0x4659ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4659d0
xor ecx, ecx
sub eax, 3
jb 0x465a00
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x465a72
mov ebp, eax
add ebx, ebx
jne 0x465a0b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x465a18
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x465a3c
inc ecx
add ebx, ebx
jne 0x465a28
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x465a1d
jne 0x465a39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x465a1d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x465a5c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x465a4d
jmp 0x4659be
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x465a5c
add edi, ecx
jmp 0x4659be
pop esi
mov edi, esi
mov ecx, 0x33e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x465a7a
cmp byte [edi], 0
jne 0x465a7a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x465a7f
lea edi, [esi + 0x63000]
mov eax, dword [edi]
or eax, eax
je 0x465aee
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x651f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x65254]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x465aac
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x65258]
or eax, eax
je 0x465ae8
mov dword [ebx], eax
add ebx, 4
jmp 0x465ac9
call dword [esi + 0x6525c]
popal
jmp 0x40da18
Function at 0x1001b7c
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 0xc]
lea ecx, [ebp - 0x244]
call dword [sym.imp.ulib.dll_public:_void___thiscall_PATH::constructor_void_]
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x1001bd7
cmp edi, ebx
mov eax, dword [esi]
je 0x1001bc6
push edi
push 0x1001254
push 1
push dword [ebp + 8]
push esi
call dword [eax + 8]
add esp, 0x14
jmp 0x1001bd7
push 0x1001253
push 1
push dword [ebp + 8]
push esi
call dword [eax + 8]
add esp, 0x10
cmp byte [esi + 0x90], bl
je 0x1001bff
mov eax, dword [esi + 0x98]
cmp eax, ebx
jne 0x1001bf1
push ebx
push 0x5221
jmp 0x1001c0f
push eax
push 0x1001250
push ebx
push 0x521f
jmp 0x1001c24
mov eax, dword [esi + 0x9c]
cmp eax, ebx
jne 0x1001c18
push ebx
push 0x5220
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
jmp 0x1001c2d
push eax
push 0x1001250
push ebx
push 0x521e
mov ecx, dword [esi]
push esi
call dword [ecx + 8]
add esp, 0x14
push dword [ebp + 0x10]
call dword [sym.imp.msvcrt.dll_exit]
int3

Function at 0x100211d
Capabilities:
Copy file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [eax + 0x21c]
mov esi, ecx
lea edi, [edi + edi + 2]
cmp edi, dword [esi + 0xb0]
jbe 0x1002153
push edi
lea ebx, [esi + 0xac]
push dword [ebx]
call dword [sym.imp.ulib.dll_void____stdcall_UlibRealloc_void___unsigned_long_int_]
mov dword [ebx], eax
mov dword [esi + 0xb0], edi
mov eax, dword [ebp + 0xc]
mov ebx, dword [eax + 0x21c]
lea ebx, [ebx + ebx + 2]
cmp ebx, dword [esi + 0xb8]
jbe 0x100217f
push ebx
lea edi, [esi + 0xb4]
push dword [edi]
call dword [sym.imp.ulib.dll_void____stdcall_UlibRealloc_void___unsigned_long_int_]
mov dword [edi], eax
mov dword [esi + 0xb8], ebx
xor ebx, ebx
cmp dword [esi + 0xac], ebx
je 0x1002191
cmp dword [esi + 0xb4], ebx
jne 0x10021a0
push 8
push ebx
push 0x5241
mov ecx, esi
call fcn.01001b7c
mov eax, dword [esi + 0xb0]
mov ecx, dword [ebp + 8]
mov edi, dword [sym.imp.ulib.dll_public:_unsigned_short_int____thiscall_WSTRING::QueryWSTR_unsigned_long_int__unsigned_long_int__unsigned_short_int___unsigned_long_int__unsigned_char_const]
push 1
shr eax, 1
push eax
push dword [esi + 0xac]
add ecx, 0x210
push 0xffffffffffffffff
push ebx
call edi
mov eax, dword [esi + 0xb8]
mov ecx, dword [ebp + 0xc]
push 1
shr eax, 1
push eax
push dword [esi + 0xb4]
add ecx, 0x210
push 0xffffffffffffffff
push ebx
call edi
push ebx
push dword [esi + 0xb4]
push dword [esi + 0xac]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x1002209
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call fcn.01001c3c
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret 8
Function at 0x10026ec
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 0xa4]
call dword [sym.imp.ulib.dll_public:_void___thiscall_FSN_FILTER::constructor_void_]
lea edi, [esi + 0xa4]
push edi
lea eax, [esi + 0xa0]
push eax
push dword [esi + 0x88]
mov ecx, esi
call fcn.01001e9c
lea eax, [ebp - 0xa8]
push eax
push dword [esi + 0x8c]
mov ecx, esi
call fcn.01001fb1
xor ebx, ebx
cmp byte [esi + 0x95], bl
je 0x10027d7
mov eax, dword [esi]
push ebx
push 0x5222
mov ecx, esi
call dword [eax + 0xc]
mov ecx, esi
call fcn.01001c8f
mov ecx, dword [esi + 0xbc]
call dword [sym.imp.ulib.dll_public:_unsigned_char___thiscall_KEYBOARD::DisableLineMode_void_]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x18]
mov edx, dword [eax]
push ebx
lea ecx, [ebp - 0xac]
push ecx
mov ecx, eax
call dword [edx + 0x14]
mov ecx, dword [esi + 0xbc]
call dword [sym.imp.ulib.dll_public:_unsigned_char___thiscall_KEYBOARD::EnableLineMode_void_]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
push dword [ebp - 0xac]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x28]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
mov edx, dword [eax]
push 0xd
mov ecx, eax
call dword [edx + 0x28]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
mov edx, dword [eax]
push 0xa
mov ecx, eax
call dword [edx + 0x28]
cmp word [ebp - 0xac], 3
jne 0x10027d7
push 3
call dword [sym.imp.msvcrt.dll_exit]
push dword [edi]
mov ecx, esi
push dword [esi + 0xa0]
call fcn.01001ff4
cmp byte [esi + 0x93], bl
mov edi, dword [ebp - 0xa8]
push ebx
push edi
mov dword [esi + 0xa8], eax
push esi
je 0x1002836
call fcn.010026b8
lea ecx, [ebp - 0xa4]
call dword [sym.imp.ulib.dll_public:_unsigned_char___thiscall_FSN_FILTER::Initialize_void_]
push ebx
push ebx
push 0x10
lea ecx, [ebp - 0xa4]
call dword [sym.imp.ulib.dll_public:_unsigned_char___thiscall_FSN_FILTER::SetAttributes_unsigned_long_int__unsigned_long_int__unsigned_long_int_]
push fcn.010026b8
push ebx
lea eax, [ebp - 0xa4]
push eax
push esi
mov ecx, edi
call dword [sym.imp.ulib.dll_public:_unsigned_char___thiscall_FSN_DIRECTORY::Traverse_void___class_FSN_FILTER___class_PATH___unsigned_char____stdcall___void___class_FSNODE___class_PATH___const]
jmp 0x100283b
call fcn.010026b8
cmp edi, ebx
je 0x1002847
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax]
lea ecx, [ebp - 0xa4]
call dword [sym.imp.ulib.dll_public_virtual:_void___thiscall_FSN_FILTER::destructor_void_]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.01002b90
leave
ret
Function at 0x4038f7
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
add ecx, 4
mov dword [0x4040f6], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x404650], eax
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x4045e4], eax
mov dword [0x4040ee], eax
mov dword [0x4045d0], 0x30
mov dword [0x4045d4], 2
jmp 0x40393c
mov dword [0x4045d8], 0x40321a
mov dword [0x4045dc], 0
mov dword [0x4045e0], 0
mov dword [0x4045f8], 0x40454d
mov dword [0x4045f0], 0xf
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x4045e8], eax
mov dword [0x4045fc], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x4045ec], eax
push 0x4045d0
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x4040ee]
push 0
push 0
push 0x1e5
push 0x203
push 0xfffff98e
push 0xfffff9c0
push 0xcf0000
push str.lofegaswer_huijd
push str.lisclass
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x404648], eax
push 5
push dword [0x404648]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x404648]
call dword [sym.imp.user32.dll_UpdateWindow]
xor edi, edi
lea ebx, [0x404600]
jmp 0x403a10
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x403a02
mov eax, dword [0x404608]
jmp 0x403a2b
call 0x402c21
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d6a
sub eax, 0x403d10
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
jmp fcn.00401219
Function at 0x4010a0
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x48d4c4]
push esi
push 0x41b8a8
push eax
call fcn.0040f7ae
mov ecx, dword [0x48d4c4]
push ecx
call fcn.0040f648
add esp, 0x10
pop esi
ret

Function at 0x401140
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push eax
push str.ERROR:__s_n
push 0x4201a0
call fcn.0040f560
push 0x4201a0
call fcn.004010a0
push str.usage:_sdi_sp_pm_..._n
push 0x4201a0
call fcn.0040f560
push 0x4201a0
call fcn.004010a0
mov eax, dword [0x41b0b8]
add esp, 0x1c
test eax, eax
je 0x4011cc
push esi
mov esi, 0x41b0b8
mov eax, dword [esi + 0x10]
test eax, eax
je 0x40119e
mov ecx, dword [esi + 0x18]
mov edx, dword [esi]
push ecx
push edx
push str._____s____s__IGNORED__legacy_support__n
jmp 0x4011aa
mov eax, dword [esi + 0x18]
mov ecx, dword [esi]
push eax
push ecx
push str._____s____s_n
push 0x4201a0
call fcn.0040f560
push 0x4201a0
call fcn.004010a0
mov eax, dword [esi + 0x1c]
add esi, 0x1c
add esp, 0x14
test eax, eax
jne 0x401189
pop esi
push 1
call fcn.0040f817
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x402560
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [esp + 4]
push esi
push 0x41bbb8
push str.output
mov dword [0x48d560], eax
call fcn.0040fa1a
add esp, 8
mov dword [0x48d4c4], eax
test eax, eax
jne 0x402599
push str.Cannot_open_output_file_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 1
pop esi
ret 0x10
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00405470
mov esi, eax
add esp, 4
test esi, esi
jne 0x4025ce
push str.Could_not_parse_command_line_n
call fcn.004010a0
mov edx, dword [0x48d4c4]
push edx
call fcn.0040f90a
add esp, 8
mov eax, 1
pop esi
ret 0x10
push str.placeHolder
push 0
push esi
call fcn.00405850
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push eax
push ecx
call fcn.00401790
push esi
call fcn.00405420
mov edx, dword [0x48d4c4]
push edx
call fcn.0040f90a
add esp, 0x1c
xor eax, eax
pop esi
ret 0x10

Function at 0x4029e0
Capabilities:
Print debug messages
Query or enumerate registry value

Disassembly:
sub esp, 0x50c
push ebx
push ebp
push esi
push edi
mov ebx, dword [esp + 0x524]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
mov ebp, 1
push eax
push ebp
push 0
push str.SOFTWARESDI
push closesocket
mov byte [ebx], 0
mov dword [esp + 0x28], 0x100
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402b10
lea ecx, [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x524]
lea eax, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x18]
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402a77
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x402a79
xor ebp, ebp
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebp, ebp
jne 0x402ac0
mov edx, dword [esp + 0x520]
push edx
call fcn.0040ffe3
add esp, 4
test eax, eax
je 0x402ac0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
mov ebp, 1
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp byte [ebx], 0
je 0x402ad7
mov eax, ebx
cmp byte [eax], 0x5c
jne 0x402acf
mov byte [eax], 0x2f
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x402ac7
mov ecx, dword [esp + 0x520]
push ebx
push ecx
lea edx, [esp + 0x124]
push str.query_registry:_e_:_s:_s:_n
push edx
call fcn.0040f560
add esp, 0x10
lea eax, [esp + 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x50c
ret
xor ebp, ebp
jmp 0x402a88
Function at 0x403300
Capabilities:
Get session user name

Disassembly:
push ecx
mov eax, dword [0x421cf4]
test eax, eax
je 0x40330f
call fcn.00403720
mov eax, dword [0x421cc4]
push esi
test eax, eax
push edi
jne 0x403368
lea eax, [esp + 8]
mov byte [0x421b40], 0
push eax
push 0x4218b4
mov dword [esp + 0x10], 0x80
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov edi, 0x4218b4
or ecx, 0xffffffff
xor eax, eax
mov dword [0x421cc4], 1
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x421bc0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0x421938]
push eax
call fcn.00403440
add esp, 4
test eax, eax
jne 0x40338d
push str.Cannot_create_invisible_window
call fcn.00402c30
add esp, 4
xor eax, eax
pop edi
pop esi
pop ecx
ret
mov ecx, dword [0x421b3c]
push ecx
call fcn.0040d250
push 0
push 1
push 0x4212ac
push 0
push str.pm_api
call fcn.0040e660
add esp, 0x18
test eax, eax
jne 0x4033c8
push str.could_not_establish_home_directory
call fcn.00402c30
add esp, 4
xor eax, eax
pop edi
pop esi
pop ecx
ret
push 0x42193c
mov dword [0x421cc0], 1
call fcn.0040d010
add esp, 4
test eax, eax
jne 0x40342e
mov edi, 0x4212ac
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x42193c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x42193c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
dec ecx
js 0x40342e
mov al, byte [ecx + 0x42193c]
cmp al, 0x2f
je 0x403424
cmp al, 0x5c
jne 0x40342b
mov byte [ecx + 0x42193c], 0
dec ecx
jns 0x403416
pop edi
mov eax, 1
pop esi
pop ecx
ret

Function at 0x403440
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call fcn.004034a0
add esp, 4
test eax, eax
jne 0x403454
pop esi
ret
push 0
push esi
push 0
push 0
push 0xc8
push 0x12c
push 0x32
push 0x32
push closesocket
push str.pm_api
push str.pm_api
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
test eax, eax
mov dword [0x421b3c], eax
jne 0x40348b
pop esi
ret
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
pop esi
ret

Function at 0x403770
Capabilities:
Print debug messages

Disassembly:
push esi
or edx, 0xffffffff
push edi
mov edi, 0x421b40
mov ecx, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [0x41bc00], edx
mov eax, ecx
mov esi, edi
mov edi, 0x421c40
mov dword [0x421cec], 0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0x421cc0]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x41bbfc]
pop edi
test eax, eax
mov dword [0x4214b0], ecx
mov byte [0x421b40], 0
mov dword [0x41bbfc], edx
pop esi
je 0x4037d2
call fcn.0040efe0
mov dword [0x421cc0], 0
jmp 0x40d2d0
mov eax, dword [0x48c390]
test eax, eax
je 0x40d301
call fcn.0040d310
test eax, eax
je 0x40d2e7
call fcn.0040d590
mov dword [0x48c390], 0
call sub.WSOCK32.dll_WSACleanup
push str.client_cleanup:_WSACleanup__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
ret
Function at 0x40c100
Capabilities:
Terminate process

Disassembly:
push esi
push 1
push 0xc
call fcn.00410081
mov esi, eax
add esp, 8
test esi, esi
jne 0x40c12c
push str.plot_model_db_create:Calloc_Failure_A_n
push 0x41d1d0
call fcn.0040f7ae
add esp, 8
push 1
call fcn.0040f817
mov eax, dword [esp + 8]
test eax, eax
mov dword [esi + 4], eax
je 0x40c162
push eax
push 0x3c
call fcn.00410081
add esp, 8
mov dword [esi + 8], eax
test eax, eax
jne 0x40c162
push str.plot_model_db_create:Calloc_Failure_B_n
push 0x41d1d0
call fcn.0040f7ae
add esp, 8
push 1
call fcn.0040f817
mov eax, esi
pop esi
ret

Function at 0x40d010
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret

Function at 0x40d120
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x510
lea eax, [esp]
push ebx
push esi
push eax
push 5
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x40d21f
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
test eax, eax
jne 0x40d21f
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0xc]
mov edx, dword [eax]
push 0x8000
push ecx
push eax
call dword [edx + 0x2c]
test eax, eax
jne 0x40d21f
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x40d1cf
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea edx, [esp + 0x118]
push edx
push 0x400
call esi
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ebx, dword [esp + 0x51c]
push ebx
push 0x104
call esi
lea ecx, [esp + 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push ebx
call fcn.0040f540
add esp, 4
mov eax, 1
pop esi
pop ebx
add esp, 0x510
ret
cmp eax, 2
jne 0x40d215
push edi
lea edi, [esp + 0x18]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov ebx, dword [esp + 0x520]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
push ebx
call fcn.0040f540
add esp, 4
mov eax, 1
pop esi
pop ebx
add esp, 0x510
ret
mov eax, dword [esp + 0x51c]
mov byte [eax], 0
pop esi
xor eax, eax
pop ebx
add esp, 0x510
ret

Function at 0x40d250
Capabilities:
Initialize winsock library
Print debug messages

Disassembly:
mov ecx, dword [0x48c390]
xor eax, eax
cmp ecx, eax
je 0x40d26c
mov eax, dword [esp + 4]
push eax
call fcn.0040d230
add esp, 4
xor eax, eax
ret
mov ecx, dword [esp + 4]
push 0x48b9a8
push 2
mov dword [0x48c390], 1
mov dword [0x48bf40], 0xffffffff
mov dword [0x48bf44], eax
mov dword [0x48bf48], eax
mov dword [0x48bf50], eax
mov dword [0x48bf54], eax
mov dword [0x48bf58], eax
mov dword [0x48bf5c], eax
mov dword [0x48bf88], ecx
call sub.WSOCK32.dll_WSAStartup
push str.client_init:_WSAStartup__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 1
ret
Function at 0x40de20
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x48bf40]
sub esp, 0x400
cmp eax, 0xffffffff
push ebx
push ebp
push esi
push edi
jne 0x40de41
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x400
ret
mov ebp, dword [esp + 0x414]
or ecx, 0xffffffff
mov edi, ebp
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x40de73
mov ebx, dword [esp + 0x418]
lea eax, [esp + 0x10]
push ebx
push ebp
push str._s__s
push eax
call fcn.0040f560
add esp, 0x10
jmp 0x40de9d
mov ebx, dword [esp + 0x418]
or ecx, 0xffffffff
mov edi, ebx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x10]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
push 0x41cedc
push ecx
call fcn.0040fa1a
xor esi, esi
add esp, 8
cmp eax, esi
mov dword [0x48bf70], eax
jne 0x40dec7
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x400
ret
mov eax, dword [0x48bf5c]
mov dword [0x48bf50], esi
push eax
mov dword [0x48bf48], eax
call fcn.0040d630
mov dword [0x48bf54], eax
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
mov dword [0x48bf80], esi
repne scasb al, byte es:[edi]
not ecx
push ecx
call fcn.0040d630
mov edx, eax
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
mov dword [0x48bf74], edx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
push ecx
call fcn.0040d630
mov edx, eax
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov dword [0x48bf78], edx
push 2
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, dword [0x48bf70]
mov ecx, dword [esp + 0x430]
push edx
mov dword [0x48bf7c], ecx
call fcn.0041076f
mov eax, dword [0x48bf70]
push eax
call fcn.00410c51
mov ecx, dword [0x48bf70]
push 0
push 0
push ecx
mov dword [0x48bf84], eax
call fcn.0041076f
mov edx, dword [0x48bf78]
mov eax, dword [0x48bf84]
mov ecx, dword [0x48bf48]
push edx
mov edx, dword [0x48bf7c]
push eax
mov eax, dword [0x48bf54]
push ecx
push edx
push str.sendfile_inet__d__d__d___s_
push eax
call fcn.0040f560
mov edi, dword [0x48bf54]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x40
repne scasb al, byte es:[edi]
push eax
push eax
not ecx
push 0x40dc60
mov dword [0x48bf80], ecx
mov dword [0x48bf44], 9
call fcn.00411024
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x400
ret