joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401470
Capabilities:
Create thread
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d8
mov eax, dword [0x41a038]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x3e
push eax
mov word [ebp - 0x48], ax
lea eax, [ebp - 0x46]
push eax
call fcn.00409990
add esp, 0xc
lea eax, [ebp - 0x48]
push eax
call fcn.00403c20
add esp, 4
xor ecx, ecx
jmp 0x4014b0
movzx eax, word [ebp + ecx - 0x48]
mov word [ecx + 0x41bf88], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x4014b0
push 0x41bf88
push 0
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
test eax, eax
je 0x4014f1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405da4
mov esp, ebp
pop ebp
ret
push 0x41bf88
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
test eax, eax
je 0x4014e1
lea eax, [ebp - 0x1d8]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ecx, 0x41cb20
call fcn.00401da0
test eax, eax
jne 0x4015c0
xor ecx, ecx
lea esp, [esp]
movzx eax, word [ecx + 0x418894]
mov word [ecx + 0x41ccc8], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x401530
push 0x4188a0
push 0x40
push 0x41cb24
call fcn.00405ee9
add esp, 0xc
push 0x4188c0
push 0x10
push 0x41cba6
call fcn.00405ee9
add esp, 0xc
push 0x4188cc
push 0x40
push 0x41cbc6
call fcn.00405ee9
mov eax, 0x51
mov word [0x41cba4], ax
mov eax, 0x2b8e
add esp, 0xc
mov word [0x41cc46], ax
xor ecx, ecx
lea ebx, [ebx]
movzx eax, word [ecx + 0x4188ec]
mov word [ecx + 0x41cca8], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x4015a0
mov dword [0x41cce8], 5
call fcn.00403d60
push 0x4188fc
call fcn.00403e80
add esp, 4
mov dword [0x41ce20], eax
call fcn.00401250
push 0
push 0
push 0
push 0x4013b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
call fcn.00405da4
mov esp, ebp
pop ebp
ret
Function at 0x4019f0
Capabilities:
Create process on windows
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x210
mov eax, dword [0x41a038]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push edi
mov edi, dword [ebp + 8]
push 0x64
push 0x41beb8
push 0x67
push edi
call esi
push 0x64
push 0x41bdf0
push 0x6d
push edi
call esi
mov ecx, edi
call fcn.00401b90
push 0
push edi
push 0
push 0
push 0
push connect
push 0
push connect
push 0xcf0000
push 0x41beb8
push 0x41bdf0
push 0
mov dword [0x41bf80], edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
jne 0x401a82
mov ecx, dword [esp + 0x214]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.00405da4
mov esp, ebp
pop ebp
ret 0x10
push 0x6d
push edi
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x7d0
call esi
push 0x41af08
call fcn.00402b50
add esp, 4
call fcn.00402110
test eax, eax
je 0x401abb
call fcn.00403780
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.00401470
test eax, eax
je 0x401a6a
call fcn.00401740
mov eax, dword [0x41ce20]
test eax, eax
je 0x401af6
cmp word [0x41ce24], 0
jbe 0x401af6
push 0x41aef8
push eax
call fcn.004044d0
mov ax, word [0x41ce24]
add esp, 8
mov word [0x41aef4], ax
xor ecx, ecx
jmp 0x401b00
movzx eax, word [ecx + 0x418a04]
mov word [ecx + 0x41c1a0], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x401b00
call fcn.00404580
xor eax, eax
push 0x206
push eax
mov word [esp + 0x10], ax
lea eax, [esp + 0x12]
push eax
call fcn.00409990
add esp, 0xc
lea eax, [esp + 8]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x41c1a0
lea eax, [esp + 0xc]
push 0x104
push eax
call fcn.00405f45
add esp, 0xc
push 0x1f4
call esi
push 1
push 0
push 0x418a84
lea eax, [esp + 0x14]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x401e40
Capabilities:
Get common file path
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x41a038]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
test edi, edi
je 0x401f63
test esi, esi
je 0x401f63
mov ecx, esi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401e70
sub ecx, edx
xor eax, eax
sar ecx, 1
je 0x401f65
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.00409990
add esp, 0xc
cmp dword [ebp + 0xc], 0
jne 0x401edf
cmp dword [0x41af08], 3
jne 0x401edf
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x418aa4
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00405f45
add esp, 0xc
jmp 0x401ef1
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push esi
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00405f45
push 0x418aa8
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x210]
push eax
mov dword [ebp - 0x210], 0
call fcn.0040613c
mov eax, dword [ebp - 0x210]
add esp, 0x18
test eax, eax
je 0x401f63
push eax
push 1
push 0x200
push edi
call fcn.0040640e
push dword [ebp - 0x210]
call fcn.00406526
add esp, 0x14
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405da4
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00405da4
mov esp, ebp
pop ebp
ret

Function at 0x402020
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x41a038]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
xor edx, edx
jmp 0x402040
not byte [esi + edx]
inc edx
cmp edx, 0x200
jb 0x402040
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.00409990
add esp, 0xc
mov dword [ebp - 0x214], 0
test esi, esi
je 0x4020f5
lea eax, [ebp - 0x210]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x418ac8
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.00405f45
push 0x418ae4
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.0040613c
mov eax, dword [ebp - 0x214]
add esp, 0x18
test eax, eax
je 0x4020e1
push eax
push 1
push 0x200
push esi
call fcn.004066f4
push dword [ebp - 0x214]
call fcn.00406526
add esp, 0x14
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405da4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop esi
call fcn.00405da4
mov esp, ebp
pop ebp
ret
Function at 0x4029a0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x41a038]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.00409990
add esp, 0xc
lea eax, [ebp - 0x410]
push 0x200
push 0
push eax
call fcn.00409990
add esp, 0xc
lea ecx, [ebp - 0x410]
call fcn.00401f80
test eax, eax
je 0x402ad2
xor ecx, ecx
lea esp, [esp]
movzx eax, word [ecx + 0x418c40]
mov word [ecx + 0x41c018], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x402a00
xor ecx, ecx
jmp 0x402a20
movzx eax, word [ebp + ecx - 0x38a]
mov word [ecx + 0x41c120], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x402a20
xor ecx, ecx
lea esp, [esp]
movzx eax, word [ebp + ecx - 0x40c]
mov word [ecx + 0x41c0a0], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x402a40
cmp dword [0x41af08], 3
movzx eax, word [ebp - 0x38c]
mov word [0x41c098], ax
movzx eax, word [ebp - 0x2ea]
mov word [0x41c010], ax
lea eax, [ebp - 0x210]
mov dword [0x41c00c], 5
push eax
je 0x402a8f
push 1
jmp 0x402a91
push 0
call fcn.00403580
add esp, 8
lea eax, [ebp - 0x210]
push 0x418c60
push 0x104
push eax
call fcn.00405f45
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405da4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.00405da4
mov esp, ebp
pop ebp
ret

Function at 0x402b50
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x41a038]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x124], 0
xor ecx, ecx
mov word [ebp - 0x12c], cx
push 0x11c
push 0
lea edx, [ebp - 0x120]
push edx
call fcn.00409990
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x402c30
mov ecx, dword [ebp - 0x11c]
mov dword [ebp - 0x128], ecx
mov edx, dword [ebp - 0x118]
mov dword [ebp - 0x124], edx
mov ax, word [ebp - 0xc]
mov word [ebp - 0x12c], ax
cmp dword [ebp - 0x128], 5
jne 0x402c01
cmp dword [ebp - 0x124], 2
jae 0x402bf8
cmp dword [ebp - 0x124], 1
jne 0x402c01
mov ecx, dword [ebp + 8]
mov dword [ecx], 3
cmp dword [ebp - 0x128], 6
jne 0x402c30
cmp dword [ebp - 0x124], 0
jne 0x402c1e
mov edx, dword [ebp + 8]
mov dword [edx], 4
jmp 0x402c30
cmp dword [ebp - 0x124], 1
jne 0x402c30
mov eax, dword [ebp + 8]
mov dword [eax], 5
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405da4
mov esp, ebp
pop ebp
ret
Function at 0x402c40
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x41a038]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x20c], ax
push 0x206
push 0
lea ecx, [ebp - 0x20a]
push ecx
call fcn.00409990
add esp, 0xc
cmp dword [0x41af08], 3
jne 0x402ca8
push 0x104
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x418c78
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.00405f45
add esp, 0xc
jmp 0x402cba
lea ecx, [ebp - 0x20c]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x20c]
push eax
push 0x418c7c
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405da4
mov esp, ebp
pop ebp
ret

Function at 0x402fb0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x41a038]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x214], 0xffffffff
xor eax, eax
mov word [ebp - 0x20c], ax
push 0x206
push 0
lea ecx, [ebp - 0x20a]
push ecx
call fcn.00409990
add esp, 0xc
push 0x104
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov eax, 2
imul eax, eax, 0
movzx ecx, word [ebp + eax - 0x20c]
sub ecx, 0x41
mov dword [ebp - 0x218], ecx
lea edx, [ebp - 0x210]
push edx
mov eax, dword [ebp - 0x218]
push eax
call fcn.00403280
add esp, 8
mov ecx, dword [ebp - 0x210]
push ecx
call fcn.004033f0
add esp, 4
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0xffffffff
jne 0x403063
xor eax, eax
jmp 0x403076
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x214]
push eax
call fcn.00402dd0
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405da4
mov esp, ebp
pop ebp
ret

Function at 0x4031e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x41a038]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x1c], 0
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0xffffffff
jne 0x40321d
jmp 0x40326e
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], edx
push 0
push 0x200
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call fcn.0040dc10
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edx
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 0x10]
shl eax, 9
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405da4
mov esp, ebp
pop ebp
ret
Function at 0x403580
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x40359a
mov eax, dword [ebp + 0xc]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x4035bf
push 0x104
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x418d00
push 0x104
mov edx, dword [ebp + 0xc]
push edx
call fcn.00405f45
add esp, 0xc
pop ebp
ret

Function at 0x4035d0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x41a038]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 8], 0
push 0x418d04
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 8]
push ecx
call fcn.0040613c
add esp, 0xc
test eax, eax
je 0x40360e
xor eax, eax
jmp 0x4036ef
mov dword [ebp - 0x10], 0
push 2
push 0
mov edx, dword [ebp - 8]
push edx
call fcn.00406f10
add esp, 0xc
mov eax, dword [ebp - 8]
push eax
call fcn.004072e8
add esp, 4
mov dword [ebp - 0x10], eax
push 0
push 0
mov ecx, dword [ebp - 8]
push ecx
call fcn.00406f10
add esp, 0xc
mov edx, dword [ebp - 0x10]
add edx, dword [ebp + 0x10]
push edx
call fcn.00406db7
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
push eax
push 1
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.0040640e
add esp, 0x10
mov eax, dword [ebp - 8]
push eax
call fcn.00406526
add esp, 4
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 0x10]
push edx
call fcn.00403700
add esp, 8
push 0x418d0c
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 8]
push ecx
call fcn.0040613c
add esp, 0xc
test eax, eax
je 0x4036a8
xor eax, eax
jmp 0x4036ef
mov edx, dword [ebp - 0x10]
add edx, dword [ebp + 0x10]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
push eax
push 1
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.004066f4
add esp, 0x10
mov eax, dword [ebp - 8]
push eax
call fcn.00406526
add esp, 4
mov dword [ebp - 0x14], 1
cmp dword [ebp - 0xc], 0
je 0x4036ec
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00406e49
add esp, 4
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405da4
mov esp, ebp
pop ebp
ret
Function at 0x405be0
Capabilities:
Download and write a file
Receive and write data from server to client
Receive data
Receive data on socket
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.0040cb90
mov eax, dword [0x41a038]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x100c], 0
mov dword [ebp - 0x1010], 0
push 0x418dbc
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x100c]
push ecx
call fcn.0040613c
add esp, 0xc
cmp dword [ebp - 0x100c], 0
jne 0x405c33
xor eax, eax
jmp 0x405ce8
push 0
push 4
lea edx, [ebp - 0x1008]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 4
je 0x405c56
xor eax, eax
jmp 0x405ce8
mov edx, dword [ebp - 0x1010]
cmp edx, dword [ebp - 0x1008]
jae 0x405cc2
push 0
push 0x1000
lea eax, [ebp - 0x1004]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 0x1014], eax
cmp dword [ebp - 0x1014], 0
jne 0x405c8f
jmp 0x405cc2
mov eax, dword [ebp - 0x100c]
push eax
mov ecx, dword [ebp - 0x1014]
push ecx
push 1
lea edx, [ebp - 0x1004]
push edx
call fcn.004066f4
add esp, 0x10
mov eax, dword [ebp - 0x1010]
add eax, dword [ebp - 0x1014]
mov dword [ebp - 0x1010], eax
jmp 0x405c56
mov ecx, dword [ebp - 0x100c]
push ecx
call fcn.00406526
add esp, 4
mov edx, dword [ebp - 0x1010]
cmp edx, dword [ebp - 0x1008]
jae 0x405ce3
xor eax, eax
jmp 0x405ce8
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405da4
mov esp, ebp
pop ebp
ret
Function at 0x40356e
Capabilities:
Delete directory
Get common file path
Get file attributes
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc48
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
mov dword [ebp - 0x10], eax
mov eax, dword [edi + 4]
xor esi, esi
cmp dword [0x5e9120], 0x594
mov dword [ebp - 0xc], eax
jne 0x4035ba
push 0x402eb4
push 0x402ed4
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
push 0x402ee0
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
mov eax, dword [0x4754b8]
mov dword [ebp - 0x24], eax
mov eax, dword [0x4754bc]
mov dword [ebp - 0x2c], eax
push ebx
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
call fcn.00403567
mov eax, dword [0x4754c0]
mov ebx, dword [ebp - 8]
mov dword [ebp - 0x28], eax
mov eax, dword [0x4754c4]
add ebx, 0x23f
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0x20
mov dword [ebp - 8], 2
add dword [ebp - 8], 3
mov eax, dword [ebp - 0x10]
mov ecx, eax
shl ecx, 4
cmp dword [0x5e9120], 0xc
mov dword [ebp - 4], ecx
jne 0x403661
push esi
lea eax, [ebp - 0x448]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor eax, eax
mov word [ebp - 0x18], ax
lea edi, [ebp - 0x16]
stosw word es:[edi], ax
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x18]
lea eax, [ebp - 0xc48]
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterW]
lea eax, [ebp - 0x34]
push eax
push esi
lea eax, [ebp - 0x48]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
mov eax, dword [ebp - 0x10]
mov edi, dword [ebp + 8]
mov ecx, dword [ebp - 0x28]
add dword [ebp - 4], ecx
mov ecx, dword [0x5e9120]
cmp ecx, 0xfa9
jne 0x40367f
mov dword [0x5e86bc], 0xedeb2e40
cmp ecx, 0x3eb
jne 0x40368d
mov dword [0x5e8070], esi
lea ecx, [ebx + eax]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 8]
shr eax, cl
mov dword [0x5e86b8], 0xf4ea3dee
add eax, dword [ebp - 0x20]
mov ecx, eax
mov eax, dword [ebp - 0x14]
xor dword [ebp - 4], eax
xor ecx, dword [ebp - 4]
cmp dword [0x5e9120], 0x213
mov dword [ebp - 0x14], ecx
jne 0x4036ca
push 0x402f08
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov eax, dword [ebp - 0x14]
add dword [ebp - 0xc], 0x64
sub dword [ebp - 0xc], eax
sub dword [ebp - 0xc], 0x64
mov eax, dword [ebp - 0xc]
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
lea edx, [ebx + eax]
shr eax, cl
add eax, dword [ebp - 0x2c]
xor eax, edx
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub dword [ebp - 0x10], eax
add ebx, 0x61c88647
dec dword [ebp - 0x1c]
jne 0x4035f6
cmp dword [0x5e9120], 0xa6d
mov eax, dword [ebp - 0x10]
mov dword [edi], eax
pop ebx
jne 0x403729
push esi
push esi
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov eax, dword [ebp - 0xc]
mov dword [edi + 4], eax
pop edi
pop esi
leave
ret 4
Function at 0x403735
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x5e9120]
mov ecx, dword [0x5e8074]
sub esp, 0x58c
push ebx
push esi
shr eax, 3
xor esi, esi
push edi
cmp eax, esi
jbe 0x4037f7
mov ebx, ecx
mov dword [ebp - 8], eax
cmp dword [0x5e9120], 0x959
jne 0x4037e5
lea eax, [ebp - 0x10]
push eax
push esi
lea eax, [ebp - 0x24]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_PeekConsoleInputW]
xor eax, eax
mov word [ebp - 4], ax
lea edi, [ebp - 2]
stosw word es:[edi], ax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_CreateActCtxW]
push esi
call dword [sym.imp.KERNEL32.dll_SetComputerNameW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
lea eax, [ebp - 0x188]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
push 0x402f3c
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerA]
push esi
lea eax, [ebp - 0x588]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push ebx
call fcn.0040356e
add ebx, 8
dec dword [ebp - 8]
jne 0x40375e
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403b29
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x424
push ebx
push esi
xor esi, esi
cmp dword [0x5e9120], 0x400
push edi
jne 0x403b82
push esi
push esi
call fcn.00403e16
push esi
push esi
call fcn.00403e16
push esi
call fcn.00403fe0
add esp, 0x14
push esi
push esi
push esi
call fcn.00404a9e
pop ecx
mov dword [esp + 4], esi
mov dword [esp], esi
call fcn.00403542
fstp st(0)
push esi
call fcn.00404b23
pop ecx
push esi
call fcn.004048b5
pop ecx
mov eax, dword [0x475b44]
mov dword [0x5e9120], eax
mov eax, dword [0x475b1c]
mov dword [0x5e9124], eax
call fcn.00403816
mov dword [esp + 0x10], esi
mov ebx, 0x2b259d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor eax, eax
mov dword [esp + 0x1c], esi
lea edi, [esp + 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
push esi
lea eax, [esp + 0x3c]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp dword [esp + 0x10], ebx
jle 0x403be9
cmp dword [esp + 0x18], 0x785074d5
jne 0x403bf7
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x1c1b
jl 0x403ba4
xor edi, edi
push esi
lea eax, [esp + 0x34]
push eax
push esi
push 0x4033b0
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
push 0x4033fc
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
cmp edi, ebx
jle 0x403c26
cmp dword [esp + 0x18], 0x785074d5
jne 0x403c2f
inc edi
cmp edi, 0x11915
jl 0x403bf9
mov eax, dword [0x5e8074]
mov dword [0x5e86b4], eax
call eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x40ab95
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4746c4]
jne 0x40ab9f
repz ret
jmp fcn.0040ef58
Function at 0x40ed30
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00407288
and dword [ebp - 4], 0
cmp dword [0x476478], 0
mov ebx, eax
jne 0x40ede1
push 0x402cd4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40ee92
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402cc8
push edi
call esi
test eax, eax
je 0x40ee92
push eax
call fcn.00407216
mov dword [esp], 0x402cb8
push edi
mov dword [0x476478], eax
call esi
push eax
call fcn.00407216
mov dword [esp], 0x402ca4
push edi
mov dword [0x47647c], eax
call esi
push eax
call fcn.00407216
mov dword [esp], 0x402c88
push edi
mov dword [0x476480], eax
call esi
push eax
call fcn.00407216
pop ecx
mov dword [0x476488], eax
test eax, eax
je 0x40ede1
push 0x402c70
push edi
call esi
push eax
call fcn.00407216
pop ecx
mov dword [0x476484], eax
mov eax, dword [0x476484]
cmp eax, ebx
je 0x40ee39
cmp dword [0x476488], ebx
je 0x40ee39
push eax
call fcn.00407291
push dword [0x476488]
mov esi, eax
call fcn.00407291
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40ee39
test edi, edi
je 0x40ee39
call esi
test eax, eax
je 0x40ee30
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40ee30
test byte [ebp - 0xc], 1
jne 0x40ee39
or dword [ebp + 0x10], 0x200000
jmp 0x40ee72
mov eax, dword [0x47647c]
cmp eax, ebx
je 0x40ee72
push eax
call fcn.00407291
pop ecx
test eax, eax
je 0x40ee72
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40ee72
mov eax, dword [0x476480]
cmp eax, ebx
je 0x40ee72
push eax
call fcn.00407291
pop ecx
test eax, eax
je 0x40ee72
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x476478]
call fcn.00407291
pop ecx
test eax, eax
je 0x40ee92
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40ee94
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret