joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4152b8
Capabilities:
Connect to http server

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov edi, eax
mov ebx, edx
mov dword [esp + 0x3c], 0
mov dword [esp], eax
call sub.lua54.dll_lua_gettop
mov dword [esp + 0x2c], eax
mov eax, dword [ebx]
mov dword [esp + 0x24], eax
cmp eax, dword [sym.imp.lua54.dll_THttp]
sete al
movzx eax, al
lea eax, [eax + eax + 1]
mov dword [esp + 0x20], eax
mov eax, dword [sym.imp.lua54.dll_TFtp]
mov dword [esp + 0x28], eax
cmp dword [ebx + 0xc], 0
je 0x415308
mov dword [esp], edi
call fcn.00406c10
lea eax, [esp + 0x3c]
mov dword [esp + 8], eax
mov dword [esp + 4], 2
mov dword [esp], edi
call fcn.004172c4
mov esi, eax
xor ebp, ebp
test eax, eax
je 0x41547e
mov edx, dword [eax + 0x14]
test edx, edx
je 0x41533d
mov eax, dword [eax + 0x10]
call fcn.004236f4
mov ebp, eax
cmp dword [esp + 0x2c], 2
jle 0x415384
mov ecx, dword [esp + 0x28]
cmp dword [esp + 0x24], ecx
jne 0x415384
mov dword [esp + 8], 0
mov dword [esp + 4], 3
mov dword [esp], edi
call sub.lua54.dll_lua_tolwstring
mov dword [esp + 0x24], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov dword [esp], edi
call sub.lua54.dll_lua_tolwstring
jmp 0x4153b0
mov edx, dword [esi + 0x20]
mov dword [esp + 0x24], 0
test edx, edx
je 0x41539f
mov eax, dword [esi + 0x1c]
call fcn.004236f4
mov dword [esp + 0x24], eax
mov edx, dword [esi + 0x28]
xor edi, edi
test edx, edx
je 0x4153b2
mov eax, dword [esi + 0x24]
call fcn.004236f4
mov edi, eax
cmp dword [esp + 0x20], 1
jne 0x4153c1
cmp dword [esi + 0xc], 1
jne 0x4153d3
jmp 0x4153e6
cmp dword [esp + 0x20], 3
jne 0x4153e6
mov eax, dword [esi + 0xc]
sub eax, 3
cmp eax, 1
jbe 0x4153e6
mov dword [esp], 0x2ee5
call dword [sym.imp.KERNEL32.dll_SetLastError]
push eax
jmp 0x41547c
mov eax, dword [sym.imp.lua54.dll_TFtp]
cmp dword [ebx], eax
mov eax, 0x8400000
mov edx, 0
cmovne eax, edx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edi
mov eax, dword [esp + 0x24]
mov dword [esp + 0xc], eax
movzx eax, word [esi + 0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], ebp
mov eax, dword [ebx + 8]
mov dword [esp], eax
call dword [sym.imp.WININET.DLL_InternetConnectW]
sub esp, 0x20
mov dword [ebx + 0xc], eax
test eax, eax
je 0x415460
mov dword [ebx + 0x14], ebp
mov eax, dword [esi + 0xc]
mov dword [ebx + 4], eax
movzx edx, word [esi + 0x18]
mov dword [ebx + 0x20], edx
mov ebp, 1
dec eax
jne 0x41547e
mov eax, dword [esp + 0x24]
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], edi
jmp 0x41547e
mov dword [esp], ebp
call sub.msvcrt.dll_free
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [esp], edi
call sub.msvcrt.dll_free
xor ebp, ebp
mov dword [esp], esi
call sub.msvcrt.dll_free
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, ebp
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x415bc0
Capabilities:
Resolve dns

Disassembly:
push edi
push esi
push ebx
sub esp, 0xd0
mov ebx, dword [esp + 0xe0]
mov edi, dword [esp + 0xe8]
mov dword [esp + 0x14], 0
lea eax, [esp + 0x3c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
movzx eax, di
mov dword [esp + 4], eax
mov eax, dword [esp + 0xe4]
mov dword [esp], eax
call sub.DNSAPI.dll_DnsQuery_A
sub esp, 0x18
test eax, eax
jne 0x415cae
mov edx, dword [esp + 0x3c]
cmp di, 1
jne 0x415c31
mov eax, dword [edx + 0x18]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push ecx
jmp 0x415c8a
cmp di, 0x1c
jne 0x415c87
lea edi, [esp + 0x50]
mov ecx, 0x20
rep stosd dword es:[edi], eax
mov dword [esp + 8], 0x10
add edx, 0x18
mov dword [esp + 4], edx
lea esi, [esp + 0x40]
mov dword [esp], esi
call sub.msvcrt.dll_memcpy
mov dword [esp + 0xc], pe_nt_image_headers32
lea edi, [esp + 0x50]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], 0x17
call dword [sym.imp.WS2_32.dll_inet_ntop]
sub esp, 0x10
mov dword [esp + 4], edi
jmp 0x415c8e
mov eax, dword [edx + 0x18]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.lua54.dll_lua_pushstring
mov dword [esp + 4], 1
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call sub.DNSAPI.dll_DnsFree
push edx
push edx
jmp 0x415cf5
cmp eax, 0x251d
sete cl
cmp eax, 0x25e5
sete dl
or cl, dl
jne 0x415cc9
cmp eax, 0x232b
jne 0x415cd3
mov dword [esp], ebx
call sub.lua54.dll_lua_pushnil
jmp 0x415cf5
mov dword [esp + 0x2c], eax
mov dword [esp + 4], 0
mov dword [esp], ebx
call sub.lua54.dll_lua_pushboolean
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push eax
mov eax, 1
add esp, 0xd0
pop ebx
pop esi
pop edi
ret
Function at 0x4172c4
Capabilities:
Parse url

Disassembly:
push esi
push ebx
sub esp, 0x24
mov esi, dword [esp + 0x38]
mov dword [esp + 4], 0x3c
mov dword [esp], 1
call sub.msvcrt.dll_calloc
mov ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call sub.lua54.dll_lua_tolwstring
mov dword [esi], eax
mov dword [ebx], 0x3c
mov dword [ebx + 0x14], 1
mov dword [ebx + 0x20], 1
mov dword [ebx + 0x28], 1
mov dword [ebx + 0x30], 1
mov dword [ebx + 8], 1
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0
mov edx, dword [esp + 0x1c]
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.WININET.DLL_InternetCrackUrlW]
sub esp, 0x10
test eax, eax
jne 0x417370
mov dword [esp], 0x2ee5
call dword [sym.imp.KERNEL32.dll_SetLastError]
push eax
mov dword [esp], ebx
call sub.msvcrt.dll_free
mov eax, dword [esi]
mov dword [esp], eax
call sub.msvcrt.dll_free
xor ebx, ebx
mov eax, ebx
add esp, 0x24
pop ebx
pop esi
ret
Function at 0x417608
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
mov eax, 0x104c
call fcn.004027c0
sub esp, eax
mov ebx, dword [esp + 0x1060]
mov dword [esp], ebx
call fcn.00417568
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x80000000
mov eax, dword [esp + 0x1064]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
sub esp, 0x1c
cmp eax, 0xffffffff
je 0x417822
mov esi, eax
mov dword [esp + 0x10], 0
lea eax, [esp + 0x3c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1000
lea edi, [esp + 0x40]
mov dword [esp + 4], edi
mov dword [esp], esi
mov eax, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [esp + 0x28], eax
call eax
sub esp, 0x14
cmp word [esp + 0x40], 0x5a4d
jne 0x4176bd
mov edx, dword [esp + 0x7c]
add edx, edi
cmp dword [edx], 0x4550
je 0x4176cc
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
jmp 0x417822
lea eax, [edx + 0xf8]
movzx ecx, word [edx + 6]
mov dword [esp + 0x2c], ecx
xor edi, edi
xor ebp, ebp
xor ecx, ecx
cmp dword [esp + 0x2c], edi
jle 0x4176fa
mov edx, dword [eax + 0x14]
cmp edx, ecx
jbe 0x4176f4
mov ebp, dword [eax + 0x10]
add ebp, edx
mov ecx, edx
add eax, 0x28
inc edi
jmp 0x4176e0
mov dword [esp + 4], 0
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edx
push edx
mov edi, eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], ebp
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
sub esp, 0x10
sub edi, ebp
je 0x417822
mov dword [esp], edi
call sub.msvcrt.dll_malloc
mov dword [0x426a00], eax
mov dword [esp + 0x10], 0
lea ecx, [esp + 0x3c]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], esi
mov eax, dword [esp + 0x28]
call eax
sub esp, 0x14
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
mov dword [esp + 4], edi
mov eax, dword [0x426a00]
mov dword [esp], eax
call fcn.0041d720
mov dword [0x426ca0], eax
test eax, eax
je 0x417815
mov dword [esp + 4], 0x427196
mov dword [esp], ebx
call sub.lua54.dll_lua_getglobal
mov dword [esp + 8], 0x42719e
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call sub.lua54.dll_lua_getfield
mov dword [esp + 8], 0
mov dword [esp + 4], 0x4186bc
mov dword [esp], ebx
call sub.lua54.dll_lua_pushcclosure
mov dword [esp + 4], 0xfffffffe
mov dword [esp], ebx
call sub.lua54.dll_luaL_len
add eax, 1
adc edx, 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 4], 0xfffffffe
mov dword [esp], ebx
call sub.lua54.dll_lua_rawseti
mov dword [esp + 4], 0xfffffffd
mov dword [esp], ebx
call fcn.00401580
mov eax, 1
jmp 0x417824
mov eax, dword [0x426a00]
mov dword [esp], eax
call sub.msvcrt.dll_free
xor eax, eax
add esp, 0x104c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x41a454
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
mov dword [esp + 0xc], esi
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x3c]
mov ebp, dword [esp + 0x40]
test eax, eax
je 0x41a4c0
cmp dword [eax + 0x48], 0
je 0x41a493
test ebx, ebx
je 0x41a485
test ecx, ecx
je 0x41a493
test edi, edi
je 0x41a48d
test esi, esi
je 0x41a493
cmp dword [eax + 0x38], 0
jne 0x41a49c
mov dword [eax + 0x1c], 0x18
jmp 0x41a4c0
mov dword [esp + 0x40], ebp
mov dword [esp + 0x3c], edi
mov dword [esp + 0x38], esi
mov edi, dword [esp + 0xc]
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], ebx
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.0041a4cc
xor eax, eax
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x41a9d4
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
xor ecx, ecx
test eax, eax
je 0x41a9fc
mov ebx, dword [eax + 0x48]
test ebx, ebx
je 0x41a9fc
cmp edx, dword [eax + 0x10]
jae 0x41a9fc
mov ecx, dword [ebx + 0x10]
mov ecx, dword [ecx + edx*4]
add ecx, dword [ebx]
test ecx, ecx
je 0x41aa04
test esi, esi
jne 0x41aa11
test eax, eax
je 0x41aa1c
mov dword [eax + 0x1c], 0x18
jmp 0x41aa1c
mov dword [esp + 0xc], esi
pop ebx
pop esi
jmp fcn.004194d8
xor eax, eax
pop ebx
pop esi
ret
Function at 0x423730
Capabilities:
Get file attributes
Get file system object information

Disassembly:
push edi
push esi
push ebx
sub esp, 0x2e0
mov esi, dword [esp + 0x2f0]
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push ebx
mov ebx, eax
lea edi, [esp + 0x2c]
mov ecx, 0xad
xor eax, eax
rep stosd dword es:[edi], eax
mov dword [esp], esi
call sub.lua54.dll_lua_gettop
dec eax
jle 0x4238ee
mov dword [esp + 4], 2
mov dword [esp], esi
call sub.lua54.dll_lua_type
test eax, eax
je 0x4238ee
cmp eax, 5
jne 0x423824
lea eax, [esp + 0x28]
mov dword [esp + 8], eax
mov dword [esp + 4], 2
mov dword [esp], esi
call sub.lua54.dll_lua_tocinstance
mov edx, dword [esp + 0x28]
cmp edx, dword [sym.imp.lua54.dll_TBuffer]
jne 0x423801
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x10
mov dword [esp + 0x10], 0x10
mov dword [esp + 0xc], 0x30000
mov dword [esp + 8], 1
mov edx, dword [eax + 4]
mov dword [esp + 4], edx
mov eax, dword [eax + 8]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_CreateIconFromResourceEx]
sub esp, 0x1c
jmp 0x42381b
cmp edx, dword [sym.imp.lua54.dll_TWidget]
jne 0x423824
mov eax, dword [eax + 0x30]
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.SHELL32.dll_DuplicateIcon]
push ecx
push ecx
mov dword [esp + 0x24], eax
jmp 0x4238ee
mov dword [esp + 4], 2
mov dword [esp], esi
call sub.lua54.dll_luaL_checkFilename
mov ebx, eax
mov dword [esp], eax
call sub.msvcrt.dll_wcslen
mov di, word [ebx + eax*2 - 2]
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 4], 3
mov dword [esp], esi
call sub.lua54.dll_luaL_optinteger
mov dword [esp + 0x10], 1
lea edx, [esp + 0x24]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
dec eax
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
sub esp, 0x14
dec eax
cmp eax, 0xfffffffd
jbe 0x4238e6
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push edx
cmp di, 0x5c
je 0x4238b1
cmp di, 0x2f
je 0x4238b1
cmp eax, 0xffffffff
jne 0x4238b6
xor eax, eax
jmp 0x4238b6
mov eax, 0x10
mov dword [esp + 0x10], 0x111
mov dword [esp + 0xc], 0x2b4
lea edx, [esp + 0x2c]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
sub esp, 0x14
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x24], eax
mov dword [esp], ebx
call sub.msvcrt.dll_free
mov eax, dword [esp + 0x24]
add esp, 0x2e0
pop ebx
pop esi
pop edi
ret
Function at 0x424910
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
mov eax, 0x205c
call fcn.004027c0
sub esp, eax
mov ebx, dword [esp + 0x2070]
mov ebp, dword [esp + 0x2074]
or esi, 0xffffffff
test ebx, ebx
je 0x424a2b
mov dword [esp + 8], 0x2000
mov dword [esp + 4], 0
lea edi, [esp + 0x50]
mov dword [esp], edi
call sub.msvcrt.dll_memset
mov dword [esp + 8], 0x38
mov dword [esp + 4], 0
lea esi, [esp + 0x18]
mov dword [esp], esi
call sub.msvcrt.dll_memset
mov dword [esp + 4], esi
mov dword [esp], ebp
call dword [sym.imp.msvcrt.dll__wstat64]
mov esi, eax
test eax, eax
jne 0x424a1f
movzx eax, word [esp + 0x1e]
mov edx, eax
test al, 0x80
jne 0x42499a
or dword [ebx + 0x4e008], 1
shl eax, 0x10
or eax, dword [ebx + 0x4e008]
and dx, 0xf000
mov ecx, eax
or ecx, 0x10
cmp dx, 0x4000
cmove eax, ecx
mov dword [ebx + 0x4e008], eax
mov eax, dword [esp + 0x40]
mov dword [ebx + 0x4e00c], eax
mov dword [esp + 4], 0x427f22
mov dword [esp], ebp
call dword [sym.imp.msvcrt.dll__wfopen]
mov ebp, eax
test eax, eax
je 0x424a26
mov dword [esp + 0xc], ebp
mov dword [esp + 8], 0x2000
mov dword [esp + 4], 1
mov dword [esp], edi
call sub.msvcrt.dll_fread
test eax, eax
je 0x424a15
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.00424dc8
test eax, eax
jns 0x4249dc
mov esi, 0xfffffff8
mov dword [esp], ebp
call sub.msvcrt.dll_fclose
jmp 0x424a2b
mov esi, 0xfffffffd
jmp 0x424a2b
mov esi, 0xfffffff0
mov eax, esi
add esp, 0x205c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x424c18
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor ecx, ecx
mov edx, dword [esp + 8]
mov eax, dword [esp + 4]
jmp fcn.00414050
Function at 0x424c28
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x46c
mov ebx, dword [esp + 0x480]
mov esi, dword [esp + 0x484]
or edx, 0xffffffff
test ebx, ebx
je 0x424d3b
mov edx, 0xfffffffc
cmp dword [ebx + 0x14], 1
jne 0x424d3b
mov edx, 0xfffffff6
cmp dword [ebx + 0x10], esi
jbe 0x424d3b
mov ecx, dword [ebx + 0x48]
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + esi*4]
mov edx, 0xfffffff5
add eax, dword [ecx]
je 0x424d3b
movzx ebp, word [eax + 0x1c]
lea edi, [eax + 0x2e]
mov eax, dword [ebx + 0x5c]
test eax, eax
je 0x424c9b
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [ebx + 0x5c], 0
mov edx, ebp
mov eax, edi
call fcn.00424ffc
mov dword [ebx + 0x5c], eax
mov edx, 0xfffffffe
test eax, eax
je 0x424d3b
lea eax, [esp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.0041a9d4
mov edx, 0xfffffffd
test eax, eax
je 0x424d3b
mov dword [ebx + 0x58], esi
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
mov dword [ebx + 0x68], eax
mov dword [ebx + 0x6c], edx
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [ebx + 0x60], eax
mov dword [ebx + 0x64], edx
mov eax, dword [esp + 0x2c]
mov dword [ebx + 0x70], eax
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [ebx + 0x78], eax
mov dword [ebx + 0x7c], edx
mov eax, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
mov dword [ebx + 0xa0], eax
mov dword [ebx + 0xa4], edx
mov ax, word [esp + 0x26]
mov word [ebx + 0xa8], ax
mov eax, dword [esp + 0x44]
mov dword [ebx + 0x4e008], eax
mov eax, dword [esp + 0x28]
mov dword [ebx + 0x4e00c], eax
xor edx, edx
mov eax, edx
add esp, 0x46c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x425090
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00403010
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00403010
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
jmp fcn.004014e0
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x1f1477cf
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0x3ad5402e
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x4023b0
Capabilities:
Get number of processors
Move file

Disassembly:
push 0xffffffffffffffff
push 0x413210
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x41905c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esp + 0x18]
push eax
push esi
call fcn.00402710
lea ebp, [esi + 0x58]
mov ecx, ebp
mov dword [esp + 0x38], 0
call fcn.00405470
mov dword [esp + 0x38], 0xffffffff
mov eax, dword [esp + 0x18]
test eax, eax
je 0x40240f
push eax
call fcn.00407637
add esp, 4
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x4163f0
call ebx
push 0x4163f0
mov edi, ebp
call fcn.00405240
push str.CcComSetting.dat
call ebx
push str.CcComSetting.dat
call fcn.00405240
cmp dword [esi + 0x68], 0
lea edi, [esi + 0x64]
jle 0x40245a
mov ecx, dword [edi + 8]
mov edx, dword [edi]
push ecx
push 0
push edx
call fcn.0040a540
add esp, 0xc
mov dword [edi + 4], 0
mov eax, dword [ebp]
test eax, eax
jne 0x402466
mov eax, 0x415bbc
push eax
call fcn.00403600
test al, al
je 0x402506
call fcn.00402810
test al, al
jne 0x40251c
or esi, 0xffffffff
cmp dword [ebp + 4], 0
jle 0x4024a3
mov eax, dword [ebp]
push 0x2e
push eax
call fcn.004078f5
add esp, 8
test eax, eax
je 0x4024a3
sub eax, dword [ebp]
sar eax, 1
mov esi, eax
lea eax, [esp + 0x24]
lea edx, [esi + 1]
push eax
mov ecx, ebp
call fcn.00404cc0
mov ecx, edi
mov dword [esp + 0x38], 1
call fcn.00405470
lea esi, [esp + 0x24]
mov dword [esp + 0x38], 0xffffffff
call fcn.00404aa0
push 0x4166fc
call ebx
push 0x4166fc
call fcn.00405240
mov edi, dword [edi]
test edi, edi
jne 0x4024ee
mov edi, 0x415bbc
mov ebp, dword [ebp]
test ebp, ebp
mov eax, ebp
jne 0x4024fc
mov eax, 0x415bbc
push 1
push edi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov al, 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
xor al, al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
Function at 0x402810
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esi + 0x58]
sub esp, 8
push ebx
xor ebx, ebx
cmp eax, ebx
jne 0x40282a
mov eax, 0x415bbc
cmp eax, ebx
je 0x4028d5
cmp word [eax], bx
je 0x4028d5
cmp dword [esi + 0x3c], 0xffffffff
jne 0x4028c7
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x4028b7
cmp eax, 0xffffffff
mov dword [esi + 0x3c], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], ebx
je 0x4028e3
push ebx
lea ecx, [esp + 8]
push ecx
push 4
lea edx, [esp + 0x14]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40288a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x38], eax
cmp dword [esp + 4], 4
jne 0x40289a
cmp dword [esp + 8], 0x4c
jne 0x40289a
mov bl, 1
mov eax, dword [esi + 0x3c]
cmp eax, 0xffffffff
je 0x4028b0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x3c], 0xffffffff
mov al, bl
pop ebx
add esp, 8
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x38], eax
mov al, bl
pop ebx
add esp, 8
ret
mov al, bl
mov dword [esi + 0x38], 0xc
pop ebx
add esp, 8
ret
mov al, bl
mov dword [esi + 0x38], 0x57
pop ebx
add esp, 8
ret
mov dword [esi + 0x38], 0xc
jmp 0x40289a

Function at 0x403350
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x60
push ebx
xor bl, bl
test edx, edx
je 0x403360
cmp word [edx], 0
jne 0x403372
test esi, esi
je 0x403401
cmp word [esi], 0
je 0x403401
mov ecx, 0x10
lea eax, [esp + 8]
jmp 0x403380
mov byte [eax], 0
add eax, 1
sub ecx, 1
jne 0x403380
mov ecx, 0x44
lea eax, [esp + 0x18]
mov byte [eax], 0
add eax, 1
sub ecx, 1
jne 0x403394
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
push 0x20
push 0
push 0
push 0
push esi
push edx
mov dword [esp + 0x40], 0x44
mov dword [esp + 0x6c], 0x40
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4033f1
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x10]
mov dword [edi + 8], eax
mov dword [edi + 0xc], ecx
mov al, 1
pop ebx
add esp, 0x60
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 4], eax
mov al, bl
pop ebx
add esp, 0x60
ret
mov al, bl
mov dword [edi + 4], 0x57
pop ebx
add esp, 0x60
ret
Function at 0x4037e0
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x412ef9
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push edi
mov eax, dword [0x41905c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x28]
mov edi, dword [esp + 0x20]
xor ebx, ebx
mov dword [esp + 0x28], ebx
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [esp + 0x18], ebx
cmp dword [esi + 8], ebx
mov dword [esp + 0x28], 1
jle 0x40389f
mov ecx, dword [esp + 0x24]
cmp ecx, ebx
je 0x40389f
cmp word [ecx], bx
je 0x40389f
cmp ebp, ebx
je 0x40389f
cmp word [ebp], bx
je 0x40389f
cmp dword [esi + 0x1c], ebx
jne 0x40385a
push 0x800
call fcn.004077f8
mov ecx, dword [esp + 0x28]
add esp, 4
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0x1c]
cmp eax, ebx
je 0x40389f
mov word [eax], bx
mov eax, dword [esi + 4]
cmp eax, ebx
jne 0x403870
mov eax, 0x415bbc
push eax
mov eax, dword [esi + 0x1c]
push 0x400
push eax
push 0x415bbc
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp eax, ebx
jbe 0x403897
mov eax, dword [esi + 0x1c]
mov ecx, edi
call fcn.00405530
jmp 0x40389f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
add esp, 0xc
ret 0xc

Function at 0x403aa0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x413021
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
mov eax, dword [0x41905c]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x2c]
xor ebx, ebx
mov dword [esp + 0xc], ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov eax, dword [esp + 0x30]
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], ebx
push ecx
mov dword [esp + 0x14], 1
call fcn.004044b0
mov ecx, esi
mov dword [esp + 0x24], 1
call fcn.00405470
mov byte [esp + 0x24], bl
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x403b16
push eax
call fcn.00407637
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x1c
ret 8