joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4109d0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x442768
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov eax, dword [esp + 0x18]
push 0x44f8cc
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x410c28
mov ecx, dword [0x45d9a4]
push ebx
push edi
push esi
push 0x4f1a00
push 1
push ecx
call dword [sym.imp.MSVCRT.dll_fread]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov ecx, dword [0x34bdb10]
mov eax, dword [0x45d9a4]
add esp, 0x14
cmp ecx, 1
jne 0x410af9
xor edi, edi
lea esi, [eax + 0x278d01]
xor eax, eax
xor ecx, ecx
xor edx, edx
mov cl, byte [esi - 0x278d01]
mov dl, byte [esi - 0x278d00]
shl ecx, 8
lea ebx, [edx + ecx]
cmp ebx, 0xffff
jle 0x410a7a
mov edx, dword [0x44fa38]
mov ecx, dword [0x45d9a0]
imul edx, edi
add edx, eax
mov word [ecx + edx*2], 0xffff
jmp 0x410a91
add edx, ecx
mov ecx, dword [0x44fa38]
imul ecx, edi
mov ebx, dword [0x45d9a0]
add ecx, eax
mov word [ebx + ecx*2], dx
xor ecx, ecx
xor edx, edx
mov cl, byte [esi - 1]
mov dl, byte [esi]
shl ecx, 8
lea ebx, [edx + ecx]
cmp ebx, 0xffff
jle 0x410ac1
mov edx, dword [0x44fa38]
mov ecx, dword [0x45d99c]
imul edx, edi
add edx, eax
mov word [ecx + edx*2], 0xffff
jmp 0x410ad8
add edx, ecx
mov ecx, dword [0x44fa38]
imul ecx, edi
mov ebx, dword [0x45d99c]
add ecx, eax
mov word [ebx + ecx*2], dx
inc eax
add esi, 2
cmp eax, 0x5a0
jl 0x410a43
inc edi
cmp edi, 0x384
jl 0x410a41
jmp 0x410c05
lea edi, [eax + 0x278d01]
push ebp
xor ecx, ecx
mov dword [esp + 0x10], edi
xor eax, eax
xor edx, edx
mov ebp, dword [0x44faec]
mov dl, byte [edi - 0x278d01]
mov esi, edx
xor edx, edx
mov dl, byte [edi - 0x278d00]
shl esi, 8
dec ebp
lea ebx, [edx + esi]
cmp ebx, ebp
jle 0x410b34
mov edx, dword [0x44faec]
dec edx
jmp 0x410b36
add edx, esi
mov esi, dword [0x44fa38]
mov ebx, dword [0x45d9a0]
imul esi, ecx
add esi, eax
mov word [ebx + esi*2], dx
xor edx, edx
mov dl, byte [edi - 1]
mov ebp, dword [0x44faec]
mov esi, edx
xor edx, edx
mov dl, byte [edi]
shl esi, 8
dec ebp
lea ebx, [edx + esi]
cmp ebx, ebp
jle 0x410b70
mov edx, dword [0x44faec]
dec edx
jmp 0x410b72
add edx, esi
mov esi, dword [0x44fa38]
mov ebx, dword [0x45d99c]
imul esi, ecx
add esi, eax
mov word [ebx + esi*2], dx
mov edx, dword [0x34bdb1c]
cmp ecx, edx
jl 0x410ba2
mov ebx, dword [0x34bdb20]
mov edx, 0x300
sub edx, ebx
cmp ecx, edx
jle 0x410bda
mov esi, dword [0x44fa38]
mov edx, dword [0x44faec]
imul esi, ecx
mov ebx, dword [0x45d9a0]
add esi, eax
dec edx
mov word [ebx + esi*2], dx
mov esi, dword [0x44fa38]
mov edx, dword [0x44faec]
imul esi, ecx
mov ebx, dword [0x45d99c]
dec edx
add esi, eax
mov word [ebx + esi*2], dx
inc eax
add edi, 2
cmp eax, 0x400
jl 0x410b08
mov edi, dword [esp + 0x10]
inc ecx
add edi, 0xb40
cmp ecx, 0x300
mov dword [esp + 0x10], edi
jl 0x410b06
pop ebp
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop edi
pop ebx
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x416d10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [0x34bdba0]
sub esp, 0x64
cmp eax, 1
jne 0x416616
mov ecx, dword [0x45d68c]
lea eax, [esp]
push 0xb
push eax
mov byte [esp + 8], 2
mov byte [esp + 9], 0x45
mov byte [esp + 0xa], 0x4e
mov byte [esp + 0xb], 0x42
mov byte [esp + 0xc], 0x4c
mov byte [esp + 0xd], 0x20
mov byte [esp + 0xe], 0x31
mov byte [esp + 0xf], 0x3b
mov byte [esp + 0x10], 0x53
mov byte [esp + 0x11], 0xd
mov byte [esp + 0x12], 0xa
call fcn.00436c00
cmp dword [0x34bdba0], 2
jne 0x416654
lea ecx, [esp]
push 7
push ecx
mov ecx, dword [0x45d68c]
mov byte [esp + 8], 2
mov byte [esp + 9], 0x45
mov byte [esp + 0xa], 0x4e
mov byte [esp + 0xb], 0x42
mov byte [esp + 0xc], 0x4c
mov byte [esp + 0xd], 0x31
mov byte [esp + 0xe], 0xd
call fcn.00436c00
add esp, 0x64
ret
mov eax, dword [0x34bdba0]
sub esp, 0x64
cmp eax, 1
jne 0x4166b6
mov ecx, dword [0x45d68c]
lea eax, [esp]
push 0xb
push eax
mov byte [esp + 8], 2
mov byte [esp + 9], 0x45
mov byte [esp + 0xa], 0x4e
mov byte [esp + 0xb], 0x42
mov byte [esp + 0xc], 0x4c
mov byte [esp + 0xd], 0x20
mov byte [esp + 0xe], 0x30
mov byte [esp + 0xf], 0x3b
mov byte [esp + 0x10], 0x54
mov byte [esp + 0x11], 0xd
mov byte [esp + 0x12], 0xa
call fcn.00436c00
cmp dword [0x34bdba0], 2
jne 0x4166f4
lea ecx, [esp]
push 7
push ecx
mov ecx, dword [0x45d68c]
mov byte [esp + 8], 2
mov byte [esp + 9], 0x45
mov byte [esp + 0xa], 0x4e
mov byte [esp + 0xb], 0x42
mov byte [esp + 0xc], 0x4c
mov byte [esp + 0xd], 0x30
mov byte [esp + 0xe], 0xd
call fcn.00436c00
add esp, 0x64
ret
mov eax, dword [0x34bdba0]
sub esp, 8
cmp eax, 1
jne 0x416747
mov ecx, dword [0x45d68c]
lea eax, [esp]
push 8
push eax
mov byte [esp + 8], 2
mov byte [esp + 9], 0x43
mov byte [esp + 0xa], 0x4c
mov byte [esp + 0xb], 0x52
mov byte [esp + 0xc], 0x3b
mov byte [esp + 0xd], 0x64
mov byte [esp + 0xe], 0xd
mov byte [esp + 0xf], 0xa
call fcn.00436c00
cmp dword [0x34bdba0], 2
jne 0x416785
lea ecx, [esp]
push 7
push ecx
mov ecx, dword [0x45d68c]
mov byte [esp + 8], 2
mov byte [esp + 9], 0x57
mov byte [esp + 0xa], 0x44
mov byte [esp + 0xb], 0x4f
mov byte [esp + 0xc], 0x47
mov byte [esp + 0xd], 0x30
mov byte [esp + 0xe], 0xd
call fcn.00436c00
add esp, 8
ret
sub esp, 0x10
mov ecx, dword [0x45d68c]
lea eax, [esp]
push 9
push eax
mov byte [esp + 8], 2
mov byte [esp + 9], 0x56
mov byte [esp + 0xa], 0x53
mov byte [esp + 0xb], 0x45
mov byte [esp + 0xc], 0x54
mov byte [esp + 0xd], 0x3b
mov byte [esp + 0xe], 0x43
mov byte [esp + 0xf], 0xd
mov byte [esp + 0x10], 0xa
call fcn.00436c00
add esp, 0x10
ret
sub esp, 0x10
mov ecx, dword [0x45d68c]
lea eax, [esp]
push 9
push eax
mov byte [esp + 8], 2
mov byte [esp + 9], 0x49
mov byte [esp + 0xa], 0x53
mov byte [esp + 0xb], 0x45
mov byte [esp + 0xc], 0x54
mov byte [esp + 0xd], 0x3b
mov byte [esp + 0xe], 0x50
mov byte [esp + 0xf], 0xd
mov byte [esp + 0x10], 0xa
call fcn.00436c00
add esp, 0x10
ret
mov eax, dword [esp + 4]
cmp eax, 6
ja case.default.0x416d19
jmp dword [eax*4 + 0x416d58]
jmp 0x416700
jmp 0x4165c0
jmp 0x416660
mov eax, dword [esp + 8]
push eax
call fcn.00416790
add esp, 4
ret
jmp 0x416a00
mov ecx, dword [esp + 0xc]
push ecx
call fcn.00416a50
add esp, 4
ret
jmp 0x416cc0
Function at 0x4174d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [0x34bdbb4]
sub esp, 0x64
cmp eax, 1
jne 0x416dd6
mov ecx, dword [0x45d598]
lea eax, [esp]
push 0xb
push eax
mov byte [esp + 8], 2
mov byte [esp + 9], 0x45
mov byte [esp + 0xa], 0x4e
mov byte [esp + 0xb], 0x42
mov byte [esp + 0xc], 0x4c
mov byte [esp + 0xd], 0x20
mov byte [esp + 0xe], 0x31
mov byte [esp + 0xf], 0x3b
mov byte [esp + 0x10], 0x53
mov byte [esp + 0x11], 0xd
mov byte [esp + 0x12], 0xa
call fcn.00436c00
cmp dword [0x34bdba0], 2
jne 0x416e14
lea ecx, [esp]
push 7
push ecx
mov ecx, dword [0x45d598]
mov byte [esp + 8], 2
mov byte [esp + 9], 0x45
mov byte [esp + 0xa], 0x4e
mov byte [esp + 0xb], 0x42
mov byte [esp + 0xc], 0x4c
mov byte [esp + 0xd], 0x31
mov byte [esp + 0xe], 0xd
call fcn.00436c00
add esp, 0x64
ret
mov eax, dword [0x34bdbb4]
sub esp, 0x64
cmp eax, 1
jne 0x416e76
mov ecx, dword [0x45d598]
lea eax, [esp]
push 0xb
push eax
mov byte [esp + 8], 2
mov byte [esp + 9], 0x45
mov byte [esp + 0xa], 0x4e
mov byte [esp + 0xb], 0x42
mov byte [esp + 0xc], 0x4c
mov byte [esp + 0xd], 0x20
mov byte [esp + 0xe], 0x30
mov byte [esp + 0xf], 0x3b
mov byte [esp + 0x10], 0x54
mov byte [esp + 0x11], 0xd
mov byte [esp + 0x12], 0xa
call fcn.00436c00
cmp dword [0x34bdba0], 2
jne 0x416eb4
lea ecx, [esp]
push 7
push ecx
mov ecx, dword [0x45d598]
mov byte [esp + 8], 2
mov byte [esp + 9], 0x45
mov byte [esp + 0xa], 0x4e
mov byte [esp + 0xb], 0x42
mov byte [esp + 0xc], 0x4c
mov byte [esp + 0xd], 0x30
mov byte [esp + 0xe], 0xd
call fcn.00436c00
add esp, 0x64
ret
mov eax, dword [0x34bdbb4]
sub esp, 8
cmp eax, 1
jne 0x416f07
mov ecx, dword [0x45d598]
lea eax, [esp]
push 8
push eax
mov byte [esp + 8], 2
mov byte [esp + 9], 0x43
mov byte [esp + 0xa], 0x4c
mov byte [esp + 0xb], 0x52
mov byte [esp + 0xc], 0x3b
mov byte [esp + 0xd], 0x64
mov byte [esp + 0xe], 0xd
mov byte [esp + 0xf], 0xa
call fcn.00436c00
cmp dword [0x34bdba0], 2
jne 0x416f45
lea ecx, [esp]
push 7
push ecx
mov ecx, dword [0x45d598]
mov byte [esp + 8], 2
mov byte [esp + 9], 0x57
mov byte [esp + 0xa], 0x44
mov byte [esp + 0xb], 0x4f
mov byte [esp + 0xc], 0x47
mov byte [esp + 0xd], 0x30
mov byte [esp + 0xe], 0xd
call fcn.00436c00
add esp, 8
ret
sub esp, 0x10
mov ecx, dword [0x45d598]
lea eax, [esp]
push 9
push eax
mov byte [esp + 8], 2
mov byte [esp + 9], 0x56
mov byte [esp + 0xa], 0x53
mov byte [esp + 0xb], 0x45
mov byte [esp + 0xc], 0x54
mov byte [esp + 0xd], 0x3b
mov byte [esp + 0xe], 0x43
mov byte [esp + 0xf], 0xd
mov byte [esp + 0x10], 0xa
call fcn.00436c00
add esp, 0x10
ret
sub esp, 0x10
mov ecx, dword [0x45d598]
lea eax, [esp]
push 9
push eax
mov byte [esp + 8], 2
mov byte [esp + 9], 0x49
mov byte [esp + 0xa], 0x53
mov byte [esp + 0xb], 0x45
mov byte [esp + 0xc], 0x54
mov byte [esp + 0xd], 0x3b
mov byte [esp + 0xe], 0x50
mov byte [esp + 0xf], 0xd
mov byte [esp + 0x10], 0xa
call fcn.00436c00
add esp, 0x10
ret
mov eax, dword [esp + 4]
cmp eax, 6
ja case.default.0x4174d9
jmp dword [eax*4 + 0x417518]
jmp 0x416ec0
jmp 0x416d80
jmp 0x416e20
mov eax, dword [esp + 8]
push eax
call fcn.00416f50
add esp, 4
ret
jmp 0x4171c0
mov ecx, dword [esp + 0xc]
push ecx
call fcn.00417210
add esp, 4
ret
jmp 0x417480
Function at 0x417540
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x442f2b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xd4
push ebx
push esi
lea eax, [esp + 0x78]
push 0x64
xor ebx, ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x78]
push 0x5c
push ecx
call dword [sym.imp.MSVCRT.dll__mbsrchr]
add esp, 8
lea ecx, [esp + 0xc]
mov byte [eax + 1], bl
call fcn.0043fabe
lea edx, [esp + 0x78]
lea eax, [esp + 0xc]
push edx
push 0x44f214
push eax
mov dword [esp + 0xf0], ebx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [esp + 0xc]
push str.Cmdflush.dll
call sub.MFC42.DLL_CString::operator
mov ecx, dword [esp + 0xc]
push 0x450110
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x417715
fld dword [0x44fae0]
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll_sprintf]
push edi
lea edx, [esp + 0x1c]
sub esp, 8
fstp qword [esp]
push str._.2f
push edx
call ebp
mov ebx, dword [sym.imp.MSVCRT.dll_fwrite]
push esi
push 0x64
lea eax, [esp + 0x34]
push 1
push eax
call ebx
mov ecx, dword [0x45d8e0]
lea eax, [esp + 0x3c]
mov edx, dword [ecx + 0x2c]
push edx
push 0x44f180
push eax
call ebp
push esi
push 0x64
lea ecx, [esp + 0x50]
push 1
push ecx
call ebx
mov edx, dword [0x45cfd0]
xor ecx, ecx
mov eax, dword [edx - 8]
mov edi, eax
mov cl, ah
and edi, 0xffff
mov byte [esp + 0x4e], cl
mov edx, edi
and edx, 0x800000ff
jns 0x417651
dec edx
or edx, 0xffffff00
inc edx
push esi
push 1
lea eax, [esp + 0x56]
push 1
push eax
mov byte [esp + 0x5f], dl
call ebx
add esp, 0x4c
lea ecx, [esp + 0x13]
push esi
push 1
push 1
push ecx
call ebx
push edi
call sub.MFC42.DLL_operatornew
mov edx, dword [0x45cfd0]
mov dword [esp + 0x2c], eax
push edx
push 0x44f214
push eax
call ebp
push esi
push edi
mov edi, dword [esp + 0x40]
push 1
push edi
call ebx
push edi
call sub.MFC42.DLL_operatordelete
push 0x64
call sub.MFC42.DLL_operatornew
mov edi, eax
mov eax, dword [0x34beeb4]
push eax
push 0x44f214
push edi
call ebp
add esp, 0x44
push esi
push 0x64
push 1
push edi
call ebx
mov ecx, dword [0x34beeb0]
push ecx
push 0x44f214
push edi
call ebp
push esi
push 0x64
push 1
push edi
call ebx
mov edx, dword [0x34beeac]
push edx
push 0x44f214
push edi
call ebp
push esi
push 0x64
push 1
push edi
call ebx
mov eax, dword [0x34beea8]
add esp, 0x48
push eax
push 0x44f214
push edi
call ebp
push esi
push 0x64
push 1
push edi
call ebx
push edi
call sub.MFC42.DLL_operatordelete
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x24
pop edi
pop ebp
lea ecx, [esp + 0xc]
mov dword [esp + 0xe4], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xdc]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0xe0
ret
Function at 0x4177b0
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x442f4b
push eax
mov dword fs:[0], esp
sub esp, 0x230
lea eax, [esp + 0xa0]
push eax
push 2
call sub.WSOCK32.dll_WSAStartup
test eax, eax
jne 0x417875
lea ecx, [esp + 4]
push 0x9b
push ecx
call sub.WSOCK32.dll_gethostname
test eax, eax
jne 0x417870
lea edx, [esp + 4]
push edx
call sub.WSOCK32.dll_gethostbyname
test eax, eax
je 0x417870
mov eax, dword [eax + 0xc]
push esi
push edi
mov ecx, dword [eax]
mov edx, dword [ecx]
push edx
call sub.WSOCK32.dll_inet_ntoa
lea ecx, [esp + 8]
mov esi, eax
call fcn.0043fabe
push esi
lea eax, [esp + 0xc]
push 0x44f214
push eax
mov dword [esp + 0x24c], 0
call sub.MFC42.DLL_CString::Format
mov ecx, dword [esp + 0x14]
mov edi, dword [esp + 0x254]
add esp, 0xc
mov dword [esp + 0x240], 0xffffffff
mov eax, dword [ecx - 8]
lea ecx, [eax + 1]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString
pop edi
pop esi
call sub.WSOCK32.dll_WSACleanup
mov ecx, dword [esp + 0x230]
mov dword fs:[0], ecx
add esp, 0x23c
ret
Function at 0x42bce0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4442b9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
xor ebx, ebx
push edi
mov edi, dword [esp + 0x34]
push ebx
push ebx
push edi
mov dword [esp + 0x18], ebx
call fcn.0042bcc0
mov esi, eax
add esp, 0xc
cmp esi, ebx
jne 0x42bd3b
mov eax, dword [esp + 0x30]
mov cl, byte [esp + 0x30]
pop edi
pop esi
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov byte [eax], cl
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
mov dl, byte [esp + 0x30]
lea eax, [esi - 1]
push ebx
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x18], dl
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int______thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::assign_unsigned_int__unsigned_short_int_]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], ebx
cmp eax, ebx
jne 0x42bd6f
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
push esi
push eax
push edi
call fcn.0042bcc0
mov esi, dword [esp + 0x3c]
mov cl, byte [esp + 0x1c]
add esp, 0xc
mov byte [esi], cl
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov edx, dword [sym.imp.MSVCP60.dll_unsigned_int_const_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::npos]
lea ecx, [esp + 0x10]
mov eax, dword [edx]
push eax
push ebx
push ecx
mov ecx, esi
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int______thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::assign_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int___const___unsigned_int__unsigned_int_]
mov ecx, dword [esp + 0x14]
cmp ecx, ebx
je 0x42bddc
mov al, byte [ecx - 1]
cmp al, bl
je 0x42bdd0
cmp al, 0xff
je 0x42bdd0
dec al
pop edi
mov byte [ecx - 1], al
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
add ecx, 0xfffffffe
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x436b00
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
mov esi, dword [esp + 0x18]
push edi
xor ebx, ebx
lea edi, [esi + 0x10]
mov dword [esp + 0x10], ebx
push edi
mov dword [esp + 0x18], ebx
call ebp
mov edx, dword [esi + 8]
lea eax, [esp + 0x20]
lea ecx, [esp + 0x10]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ClearCommError]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [esp + 0x24], ebx
je 0x436bf6
push edi
call ebp
mov edx, dword [esi + 8]
lea ebx, [esi + 0x40]
lea eax, [esp + 0x14]
push ebx
push eax
lea ecx, [esp + 0x24]
push 1
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x436ba1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
mov dword [esp + 0x10], eax
je 0x436b7f
push str.ReadFile__
jmp 0x436b9a
mov ecx, dword [esi + 8]
lea eax, [esp + 0x14]
push 1
push eax
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x436ba1
push str.GetOverlappedResults___in_ReadFile__
mov ecx, esi
call fcn.004369c0
mov ebx, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push edi
call ebx
mov eax, dword [esp + 0x1c]
mov edx, dword [esi + 0x88]
mov ecx, dword [esi + 0x84]
and eax, 0xff
push edx
push eax
mov edx, dword [ecx + 0x20]
push 0x407
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
push edi
call ebp
mov edx, dword [esi + 8]
lea eax, [esp + 0x20]
lea ecx, [esp + 0x10]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ClearCommError]
push edi
call ebx
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x436b46
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x43f340
Capabilities:
Get disk information

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
push edi
push eax
xor ebp, ebp
call fcn.0043f520
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
jne 0x43f368
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [ecx], eax
pop ebx
pop ecx
ret
mov ebx, dword [esp + 0x20]
mov edx, dword [ebx]
lea eax, [edx*4 + 4]
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
mov esi, dword [esp + 0x20]
mov edi, eax
add esp, 4
test edi, edi
mov dword [esi], edi
jne 0x43f393
pop edi
pop esi
mov dword [ebx], eax
pop ebp
pop ebx
pop ecx
ret
mov ecx, dword [ebx]
xor eax, eax
push 0x8000
lea ecx, [ecx*4 + 4]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov ebx, eax
mov ecx, 0x2000
xor eax, eax
mov edi, ebx
push 0x8000
push ebx
push eax
rep stosd dword es:[edi], eax
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
jne 0x43f3f8
mov eax, dword [esp + 0x20]
push ebx
mov dword [eax], 0
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov eax, dword [esp + 0x18]
lea ecx, [eax + 0x8000]
cmp eax, ecx
jae 0x43f500
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x43f4fc
mov edx, dword [esp + 0x10]
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push ebx
push edx
call dword [sym.imp.MSVCRT.dll__memicmp]
add esp, 0xc
test eax, eax
jne 0x43f4db
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
add ecx, 8
push ecx
call dword [sym.imp.MSVCRT.dll_malloc]
mov ecx, dword [esi]
mov edi, ebx
add esp, 4
mov dword [ecx + ebp*4], eax
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esi]
repne scasb al, byte es:[edi]
mov edi, dword [edx + ebp*4]
not ecx
add ecx, 3
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esi]
mov edi, ebx
not ecx
mov edx, dword [eax + ebp*4]
add ecx, 3
mov dword [edx], ecx
mov eax, dword [esi]
mov edx, dword [str.._]
mov ecx, dword [eax + ebp*4]
add ecx, 4
mov dword [ecx], edx
mov al, byte [0x45cdec]
mov byte [ecx + 4], al
mov ecx, dword [esi]
xor eax, eax
mov edx, dword [ecx + ebp*4]
or ecx, 0xffffffff
add edx, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebp
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x1c]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x18]
not ecx
dec ecx
add eax, 0x8000
lea ebx, [ebx + ecx + 1]
cmp ebx, eax
jb 0x43f40a
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
push eax
mov dword [ecx], ebp
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x4021c4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 0
push 5
call dword [sym.imp.SQLUNIRL.dll__MAKEINTRESOURCE_4]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SQLUNIRL.dll__FindResource_12]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x402247
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x402247
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40223d
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
mov edx, dword [ebp - 4]
push edx
call fcn.0040224e
add esp, 0xc
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x402dd8
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x7d0
je 0x402dfd
cmp dword [ebp - 4], 0x7d1
je 0x402ec1
jmp 0x402f03
cmp dword [0x412654], 0
je 0x402e5b
push 0xffffffffffffffff
mov ecx, dword [0x41146c]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
mov edx, dword [0x411460]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [0x411460], 0
push 0
push 1
mov eax, dword [0x41146c]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov dword [0x412654], 0
call fcn.0040576f
push 0
push 0x71
call fcn.004069ed
add esp, 8
jmp 0x402ebf
push 0xffffffffffffffff
mov ecx, dword [0x411468]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x103
push 0x412220
push 0x3e8
mov edx, dword [0x41135c]
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.SQLUNIRL.dll__GetWindowText_12]
push 0
push 1
mov eax, dword [0x411468]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push 0
push 0x75
call fcn.004069ed
add esp, 8
push 0
push 0x4110c0
mov ecx, dword [0x41135c]
push ecx
call fcn.004087bb
add esp, 0xc
jmp 0x402f03
cmp dword [0x412650], 0
jne 0x402f03
mov dword [0x412650], 1
push 0
push 0x4017d2
mov edx, dword [0x41135c]
push edx
push 0x6b
call dword [sym.imp.SQLUNIRL.dll__MAKEINTRESOURCE_4]
push eax
mov eax, dword [0x411478]
push eax
call fcn.0040203b
add esp, 0x14
mov dword [0x412650], 0
mov esp, ebp
pop ebp
ret