joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405282
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push edi
push str.WinMain_start__lpCmdLine_is:
call esi
mov eax, dword [esp + 0x14]
xor edi, edi
cmp dword [esp + 0x14], edi
jne 0x4052a2
mov eax, str.NULL
push eax
call esi
push str.WinMain_start__parameter_is:
call esi
push str.package.nameZoom.msipackage.versionlatestpackage.size9260kdownloadRoothttps:__launcher.zoom.us_clientactionjoinbrowserchromeconfiddGlkPTQ2ZTkyNWYzYzE1YTQ0NWNhOWVjM2VjNjAxZDY2NjNlJmVtYWlsPWVuZ2Vsa2luZ3NhcmFoJTQwZ21haWwuY29tJnphaz1leUpoYkdjaU9pSklVekkxTmlKOS5leUpoZFdRaU9pSmpiR2xsYm5RaUxDSjFhV1FpT2lKMFJFWTFVRzlSV0ZKdE5sQXhZMWd0V1dORGQxTm5JaXdpYVhOeklqb2lkMlZpSWl3aWMzUjVJam94TURBc0luZGpaQ0k2SW1GM01TSXNJbU5zZENJNk1Dd2ljM1JySWpvaVJ6TktZVk5EUjE5YVQyNDVkMFUyU0dKek1HRnJVWGx0YVhobWQxVlFiMDVTTlhrM1FWWjVWRjlaYXk1Q1oxVnpWbXhOZUdGSGRERmFWVkpvWTI1YVQxUllSazFSVld4U1VXdG9kMUV4YjNaT00yUjVWVlpHUkU1ck1YcFJNSGgzWW01Q1JrOUVVbkZVVkRGQlRXcEpOVTFVV1ROT1ZHTTBUbnBzYlUxWFVURk5iVmw1V1hwQmVrOVVXVFJPZWxacldsUlJNazR5VlhwTlJHTXdUV3BHYTAweVJtaFBWRVpxV20xUk5VMVVRVE5aTWxadFRtMVdiVTlIV214WmFteHRXa0ZCVFUwd1RrTlJXRloyWVZac1ZFMHpUVGxCUVU1b1pIcEZJaXdpWlhod0lqb3hOVE00T1RrME1ESXdMQ0pwWVhRaU9qRTFNemc1T1RNeE1qQXNJbUZwWkNJNklsbHlja3BXVlZsVlUxaHRTRXB6YzNaNGJtNTROa0VpTENKamFXUWlPaUlpZlEuYllndFZYeFJDelJpUFRWMFVfNUptUnVDSERLX1NQQUJ0R0dReGVqS2xDUSZ6YWt0PTcyMDAconfno666943802zc0uidtDF5PoQXRm6P1cX_YcCwSgunameSarah_Engelkingmcv0.92.11227.0929pkeyJjbHVzdGVySWQiOiJhdzEiLCJ1dGsiOiJET3FUbjZmc1Q1Q0oydTVUQUlFcF9zNFJ3clVkNHQ4NDZDZEU1Y1hadGRjLkJ3Y0FBQUZtVXlObExnQUFIQ0FBQUJaMFJFWTFVRzlSV0ZKdE5sQXhZMWd0V1dORGQxTm5BR1FBQUFBQUFBSUFBUUEifQstafalseinstaller.exeInstaller.exe
call esi
push 0x444
call fcn.00407475
pop ecx
cmp eax, edi
je 0x4052ce
mov edx, dword [esp + 0xc]
push eax
call fcn.0040538c
jmp 0x4052d0
xor eax, eax
push str.zoom.us_Downloader_Mutex_1.0.0.0
push edi
push 0x1f0001
mov dword [0x41ddb8], eax
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
cmp eax, edi
je 0x4052f3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4052fc
call fcn.00406405
test eax, eax
jne 0x40531c
push edi
push str.zoom.us_Boot_Downloader
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, edi
je 0x405341
push edi
push edi
push 0x7e9
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x405341
mov ecx, dword [esp + 0x14]
call fcn.004057bb
mov eax, dword [0x41ddb8]
cmp eax, edi
je 0x405334
push eax
call fcn.00405348
push str.WinMain_end
mov dword [0x41ddb8], edi
call esi
pop edi
xor eax, eax
pop esi
ret 0x10
Function at 0x4057bb
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x41ddb8]
and dword [ebp - 4], 0
push ebx
push esi
mov ebx, ecx
push edi
lea ecx, [ebp - 4]
mov edi, eax
mov dword [eax + 0x43c], ebx
call fcn.0040540b
test ebx, ebx
je 0x405810
push str.__urlhttp
push ebx
call fcn.004066e0
pop ecx
pop ecx
test eax, eax
jne 0x4057f9
call fcn.0040571a
jmp 0x405810
push str.http
push eax
call fcn.004066e0
pop ecx
pop ecx
lea edx, [ebp - 4]
mov ecx, eax
call fcn.004055b5
mov esi, 0x41ddbc
push str.downloadRoot
mov eax, esi
call fcn.00402a00
test eax, eax
je 0x405835
push str.package.version
mov eax, esi
call fcn.00402a00
test eax, eax
jne 0x405868
xor esi, esi
push esi
push str.Zoom_Error
push str.Failed_to_update_Zoom__please_get_latest_Zoom_client_from_our_web_site.
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
push 5
mov eax, 0x417cc6
push eax
push eax
push str.https:__www.zoom.us
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x405947
push str.actionid
mov eax, esi
call fcn.00402a00
test eax, eax
je 0x40588f
push str.domain
mov eax, esi
call fcn.00402a00
test eax, eax
je 0x40588f
mov byte [edi + 0x440], 1
cmp dword [ebp - 4], 3
je 0x40589b
cmp dword [ebp - 4], 0
jne 0x4058ca
mov eax, dword [0x41ddc8]
test eax, eax
je 0x405900
push str.confid
call fcn.004022fc
mov dword [ebp - 4], eax
mov eax, dword [0x41ddc8]
push str.confno
call fcn.004022fc
cmp dword [ebp - 4], 0
jne 0x4058ca
test eax, eax
je 0x405900
cmp byte [edi + 0x440], 0
jne 0x405900
push 0
push str.ZoomPTApp_HostWindow
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x4058ee
push ebx
mov ecx, esi
call fcn.00402f24
jmp 0x405947
call fcn.00402a18
test eax, eax
je 0x405900
push ebx
push esi
call fcn.00402aef
jmp 0x405947
mov ecx, edi
call fcn.00405c57
test al, al
jne 0x405921
push 0
push str.Zoom_Error
push str.Failed_to_update_Zoom___please_check_your_OS_is_in_our_supporting_list.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x405947
lea eax, [edi + 0x28]
mov dword [edi + 0x18], edi
mov dword [edi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0
push 0x4049b1
push 0
push 0x65
push dword [edi + 0x10]
mov dword [edi + 0x20], eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40594c
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x4d8
mov eax, dword [0x41b034]
xor eax, ebp
mov dword [ebp + 0x6c], eax
mov eax, dword [ebp + 0x78]
push ebx
push esi
push edi
xor ebx, ebx
push 0x3ff
mov dword [ebp - 0x458], eax
lea eax, [ebp - 0x453]
mov edi, ecx
push ebx
push eax
mov dword [ebp - 0x468], edi
mov byte [ebp - 0x454], bl
call fcn.00406970
add esp, 0xc
push str.domain
mov eax, 0x41ddbc
call fcn.00402a00
mov esi, 0x400
cmp eax, ebx
je 0x4059ad
push eax
jmp 0x4059b2
push str.https:__zoom.us
lea eax, [ebp - 0x454]
push esi
push eax
call fcn.00406c0d
add esp, 0xc
push str._support_down4j_oswinerr
lea eax, [ebp - 0x454]
push esi
push eax
call fcn.00406c0d
push 0x7f
lea eax, [ebp - 0x53]
push ebx
push eax
mov byte [ebp - 0x54], bl
call fcn.00406970
push 0xa
push 0x80
lea eax, [ebp - 0x54]
push eax
push dword [edi + 0x24]
call fcn.00408541
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x454]
push esi
push eax
call fcn.00406c0d
push 0x4186a4
lea eax, [ebp - 0x454]
push esi
push eax
call fcn.00406c0d
add esp, 0x40
lea eax, [ebp - 0x464]
mov dword [ebp - 0x460], ebx
mov dword [ebp - 0x45c], ebx
mov dword [ebp - 0x464], ebx
push eax
lea ebx, [ebp - 0x45c]
lea edi, [ebp - 0x460]
call fcn.004035bc
xor ebx, ebx
push 0x3f
lea eax, [ebp + 0x2d]
push ebx
push eax
mov byte [ebp + 0x2c], bl
call fcn.00406970
push dword [ebp - 0x464]
lea eax, [ebp + 0x2c]
push dword [ebp - 0x45c]
push dword [ebp - 0x460]
push str._d__d__d
push eax
call fcn.00406448
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp - 0x454]
push esi
push eax
call fcn.00406c0d
add esp, 0x2c
cmp dword [ebp + 0x7c], 1
jne 0x405aae
push 5
mov eax, 0x417cc6
push eax
push eax
lea eax, [ebp - 0x454]
push eax
push str.open
push dword [ebp - 0x458]
jmp 0x405b0e
mov ecx, dword [ebp - 0x468]
mov edx, dword [ecx + 0x30]
xor esi, esi
cmp edx, ebx
jle 0x405ad4
mov eax, dword [ecx + 0x28]
add eax, 0x804
cmp dword [eax], 2
jne 0x405ae1
inc esi
add eax, 0x80c
cmp esi, edx
jl 0x405ac5
push dword [ecx + 0x43c]
call fcn.0040614e
jmp 0x405b14
push ebx
push str.Zoom_Error
push str.Failed_to_install_Zoom__please_get_latest_Zoom_client_from_our_web_site_and_install_it_manually.
push dword [ebp - 0x458]
call dword [sym.imp.USER32.dll_MessageBoxA]
push 5
mov eax, 0x417cc6
push eax
push eax
lea eax, [ebp - 0x454]
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp + 0x6c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406486
add ebp, 0x70
leave
ret 8
Function at 0x405bcd
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x41b034]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
test ebx, ebx
je 0x405c4a
test edi, edi
je 0x405c4a
push esi
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.CZpDownloadMgr::FindParam
call esi
push ebx
call esi
push 0x3ff
lea eax, [ebp - 0x403]
push 0
push eax
mov byte [ebp - 0x404], 0
call fcn.00406970
add esp, 0xc
lea eax, [ebp - 0x404]
mov ecx, edi
call fcn.00405b28
test al, al
je 0x405c3b
lea eax, [ebp - 0x404]
push eax
call esi
lea edi, [ebp - 0x404]
jmp 0x405c3e
push edi
call esi
push ebx
mov esi, 0x41ddbc
call fcn.00402961
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00406486
leave
ret
Function at 0x406405
Capabilities:
Check mutex on windows

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
call esi
push str.zoom.us_Downloader_Mutex_1.0.0.0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, eax
call esi
cmp eax, 0xb7
jne 0x406434
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x406445
push 0x2710
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x406429
inc eax
pop edi
pop esi
ret

Function at 0x406486
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41b034]
jne 0x406490
repz ret
jmp fcn.0040887e

Function at 0x413240
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040da37
and dword [ebp - 4], 0
cmp dword [0x41dcdc], 0
mov ebx, eax
jne 0x4132f1
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4133a2
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x417bfc
push edi
call esi
test eax, eax
je 0x4133a2
push eax
call fcn.0040d9c5
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x41dcdc], eax
call esi
push eax
call fcn.0040d9c5
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x41dce0], eax
call esi
push eax
call fcn.0040d9c5
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x41dce4], eax
call esi
push eax
call fcn.0040d9c5
pop ecx
mov dword [0x41dcec], eax
test eax, eax
je 0x4132f1
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040d9c5
pop ecx
mov dword [0x41dce8], eax
mov eax, dword [0x41dce8]
cmp eax, ebx
je 0x413349
cmp dword [0x41dcec], ebx
je 0x413349
push eax
call fcn.0040da40
push dword [0x41dcec]
mov esi, eax
call fcn.0040da40
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x413349
test edi, edi
je 0x413349
call esi
test eax, eax
je 0x413340
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x413340
test byte [ebp - 0xc], 1
jne 0x413349
or dword [ebp + 0x10], 0x200000
jmp 0x413382
mov eax, dword [0x41dce0]
cmp eax, ebx
je 0x413382
push eax
call fcn.0040da40
pop ecx
test eax, eax
je 0x413382
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x413382
mov eax, dword [0x41dce4]
cmp eax, ebx
je 0x413382
push eax
call fcn.0040da40
pop ecx
test eax, eax
je 0x413382
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x41dcdc]
call fcn.0040da40
pop ecx
test eax, eax
je 0x4133a2
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4133a4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4012e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.0041382b
mov esi, eax
cmp esi, 0x100000
pop ecx
jbe 0x401306
xor eax, eax
jmp 0x4013c7
push edi
lea edi, [esi + 0x80]
push edi
call fcn.00410bf4
pop ecx
push ebx
push 0x80
push 3
push ebx
push 1
push accept
push dword [ebp + 8]
mov dword [0x44f76c], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
jne 0x401374
push dword [0x44f76c]
mov byte [0x44f768], bl
mov byte [0x44f769], bl
mov dword [0x44f774], ebx
call fcn.00410c3b
push dword [0x44f770]
mov dword [0x44f76c], ebx
call fcn.00410c3b
pop ecx
pop ecx
mov dword [0x44f770], ebx
xor eax, eax
jmp 0x4013c6
push ebx
lea ecx, [ebp - 4]
push ecx
push esi
push dword [0x44f76c]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
mov dword [0x44f774], esi
call fcn.00410bf4
push esi
push dword [0x44f76c]
mov dword [0x44f770], eax
push eax
call fcn.00421920
push esi
push dword [0x44f76c]
push dword [0x44f770]
call fcn.00421920
xor eax, eax
add esp, 0x1c
inc eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4013cb
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
xor ebx, ebx
cmp byte [0x44f780], bl
push esi
push edi
je 0x4013ec
xor ebp, ebp
inc ebp
mov byte [0x44f780], bl
mov byte [0x44f781], 1
jmp 0x4013fc
push 2
pop ebp
mov byte [0x44f781], bl
mov byte [0x44f780], 1
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1388
call esi
cmp ebp, 1
jne 0x401416
cmp dword [0x44f778], ebx
ja 0x401409
cmp ebp, 2
jne 0x401423
cmp dword [0x44f77c], ebx
ja 0x401409
push 0x3e8
call esi
push dword [esp + 0x18]
mov dword [esp + 0x14], ebx
call fcn.0041382b
pop ecx
push ebx
push 0x80
push 3
push ebx
push 1
push accept
push dword [esp + 0x30]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40149b
push dword [0x44f784]
mov byte [0x44f780], bl
mov dword [0x44f78c], ebx
mov byte [0x44f781], bl
mov dword [0x44f790], ebx
call fcn.00410c3b
push dword [0x44f788]
mov dword [0x44f784], ebx
call fcn.00410c3b
pop ecx
pop ecx
mov dword [0x44f788], ebx
xor eax, eax
jmp 0x40150b
cmp ebp, 1
jne 0x4014cf
push dword [0x44f784]
call fcn.00410c3b
push esi
call fcn.00410bf4
pop ecx
pop ecx
push ebx
lea ecx, [esp + 0x14]
push ecx
push esi
push eax
push edi
mov dword [0x44f784], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [0x44f78c], esi
jmp 0x401501
cmp ebp, 2
jne 0x401501
push dword [0x44f788]
call fcn.00410c3b
push esi
call fcn.00410bf4
pop ecx
pop ecx
push ebx
lea ecx, [esp + 0x14]
push ecx
push esi
push eax
push edi
mov dword [0x44f788], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [0x44f790], esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x4015bb
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push dword [ebp + 8]
xor ebx, ebx
mov byte [ebp - 1], bl
call fcn.0041382b
mov esi, eax
push esi
call fcn.00410bf4
pop ecx
pop ecx
push ebx
push 0x80
push 3
push ebx
push 1
push accept
push dword [ebp + 8]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40162b
push ebx
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push dword [ebp - 8]
call fcn.0040156c
test al, al
pop ecx
pop ecx
je 0x40162b
mov byte [ebp - 1], 1
push dword [ebp - 8]
call fcn.00410c3b
mov al, byte [ebp - 1]
pop ecx
pop edi
pop esi
cmp al, bl
pop ebx
je 0x401645
mov byte [0x44f795], 1
leave
ret
Function at 0x401b8d
Capabilities:
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 8], 0
push ebx
push esi
push edi
push dword [ebp + 0xc]
mov byte [ebp - 1], 0
call fcn.00410bf4
push dword [ebp + 0xc]
mov ebx, eax
push dword [ebp + 8]
push ebx
call fcn.00421920
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.0041a679
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x1c
mov edi, 0x12c
push edi
call esi
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.0041a679
add esp, 0xc
push edi
call esi
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.0041a679
add esp, 0xc
push edi
call esi
cmp byte [ebx], 0x4d
jne 0x401c65
cmp byte [ebx + 1], 0x5a
jne 0x401c65
push 0x26
lea eax, [ebx + 0x4e]
push str.This_program_cannot_be_run_in_DOS_mode
push eax
call fcn.00421cc0
add esp, 0xc
test eax, eax
jne 0x401c65
mov esi, 0x80
push esi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
push esi
push 2
push 0
push 2
push 0x40000000
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x401c5e
mov esi, dword [ebp + 0xc]
push 0
lea eax, [ebp - 8]
push eax
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 8], esi
jne 0x401c5e
mov byte [ebp - 1], 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call fcn.00410c3b
mov al, byte [ebp - 1]
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401c74
Capabilities:
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
push 0x41
pop ecx
xor eax, eax
xor ebx, ebx
mov byte [ebp - 0x158], bl
lea edi, [ebp - 0x157]
rep stosd dword es:[edi], eax
push 0x458ff0
lea eax, [ebp - 0x158]
push eax
call esi
lea eax, [ebp - 0x158]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp + eax - 0x158]
push 0x27
push eax
call fcn.00413732
push 0x500000
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 8]
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call fcn.0040ed45
add esp, 0x1c
test al, al
je 0x401e23
push 0x10
pop ecx
xor eax, eax
push 0x3f
mov byte [ebp - 0x50], bl
lea edi, [ebp - 0x4f]
rep stosd dword es:[edi], eax
pop ecx
push dword [ebp + 0xc]
mov byte [ebp - 0x258], bl
lea edi, [ebp - 0x257]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x258]
push eax
call esi
lea eax, [ebp - 0x258]
push eax
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0041a679
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0041a7a8
push 0x40
push dword [ebp + 0xc]
lea eax, [ebp - 0x50]
push eax
call fcn.004224e1
add esp, 0x24
test eax, eax
jne 0x401e1a
push dword [ebp - 4]
call fcn.00410bf4
push dword [ebp - 4]
mov edi, eax
push dword [ebp - 8]
push edi
call fcn.00421920
push dword [ebp - 4]
push edi
call fcn.00401647
add esp, 0x18
test al, al
je 0x401e0f
push edi
call fcn.00410c3b
pop ecx
mov esi, 0x80
push esi
lea eax, [ebp - 0x158]
push eax
xor edi, edi
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebx
push esi
push 2
push ebx
push 2
push 0x40000000
lea eax, [ebp - 0x158]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x401e1a
push ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 4]
jne 0x401e02
push 0x41
lea eax, [ebp - 0x50]
push eax
push 0x4594f3
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push dword [ebp - 8]
mov byte [0x4594f2], 1
call fcn.00410c3b
pop ecx
mov al, 1
jmp 0x401e25
lea eax, [ebp - 0x158]
push eax
call fcn.00414ef4
pop ecx
cmp edi, ebx
je 0x401e1a
push edi
call fcn.00410c3b
pop ecx
push dword [ebp - 8]
call fcn.00410c3b
pop ecx
xor al, al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401e2a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push dword [ebp + 8]
xor ebx, ebx
mov byte [ebp - 1], bl
call fcn.0041382b
mov esi, eax
cmp esi, 0xc350
pop ecx
jae 0x401e4e
xor al, al
jmp 0x401eb9
push edi
push esi
call fcn.00410bf4
push esi
mov edi, eax
push ebx
push edi
call fcn.00421c60
add esp, 0x10
push ebx
push 0x80
push 3
push ebx
push 1
push accept
push dword [ebp + 8]
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0xc], eax
je 0x401eae
push ebx
lea ecx, [ebp - 8]
push ecx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push edi
call fcn.00401647
test al, al
pop ecx
pop ecx
je 0x401eae
mov byte [ebp - 1], 1
push edi
call fcn.00410c3b
mov al, byte [ebp - 1]
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401ebd
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push ebx
xor ebx, ebx
cmp byte [0x4594f2], bl
jne 0x401ed8
xor al, al
jmp 0x401f9a
push edi
push 0x41
pop ecx
xor eax, eax
mov byte [ebp - 0x14c], bl
lea edi, [ebp - 0x14b]
rep stosd dword es:[edi], eax
push 0x458ff0
lea eax, [ebp - 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp + eax - 0x14c]
push 0x27
push eax
call fcn.00413732
lea eax, [ebp - 0x14c]
push eax
call fcn.00413a97
add esp, 0xc
test eax, eax
je 0x401f97
push 0x10
xor eax, eax
pop ecx
mov byte [ebp - 0x44], bl
lea edi, [ebp - 0x43]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x14c]
push eax
call fcn.0041a836
test eax, eax
pop ecx
pop ecx
je 0x401f97
push 0x40
lea eax, [ebp - 0x44]
push 0x4594f3
push eax
call fcn.004224e1
add esp, 0xc
test eax, eax
jne 0x401f91
lea eax, [ebp - 0x14c]
push eax
call fcn.00401e2a
test al, al
pop ecx
je 0x401f91
push ebx
push dword [ebp + 8]
lea eax, [ebp - 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x401f91
mov al, 1
jmp 0x401f99
mov byte [0x4594f2], bl
xor al, al
pop edi
pop ebx
leave
ret
Function at 0x40245c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push dword [0x4594ac]
xor ebx, ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00414e03
mov esi, eax
add esp, 0xc
cmp esi, ebx
jne 0x402484
xor al, al
jmp 0x4024ed
push edi
push 7
pop ecx
xor eax, eax
mov byte [ebp - 0x20], bl
lea edi, [ebp - 0x1f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041216e
add esp, 0xc
push ebx
push 0xa
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.WS2_32.dll_send]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push esi
call fcn.004032d4
cmp eax, 1
pop ecx
pop ecx
pop edi
jne 0x4024e4
push ebx
push 0x44f798
push esi
call fcn.00402936
add esp, 0xc
test eax, eax
je 0x4024e4
mov bl, 1
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov al, bl
pop esi
pop ebx
leave
ret