joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002550
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 6
push 1
mov si, dx
mov ebx, ecx
push 2
mov word [ebp - 2], si
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebx + 0x190], eax
cmp eax, 0xffffffff
je 0x100026bb
push 0x10
lea ecx, [ebx + 0x194]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_connect]
mov al, byte [ebp + 8]
lea ecx, [ebp - 0xc]
mov byte [ebp - 8], 0
mov word [ebp - 7], si
mov byte [ebp - 5], al
call fcn.100028f0
push 4
lea eax, [ebp - 8]
push eax
call fcn.100028f7
xor ecx, ecx
call fcn.1000231e
lea esi, [eax + 0xc]
push esi
call fcn.1000295a
pop ecx
mov edi, eax
mov ecx, edi
call fcn.1000231e
mov edx, eax
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x10], edx
call fcn.100028f4
mov dword [edx + edi], eax
lea ecx, [ebp - 8]
lea eax, [edx + 4]
push 4
add eax, edi
push ecx
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.VCRUNTIME140.dll_memcpy]
add esp, 0xc
lea eax, [esi - 4]
push 0
push eax
push edi
push dword [ebx + 0x190]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x10002697
push 0
push esi
push edi
push dword [ebx + 0x190]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, esi
jne 0x10002693
mov ecx, edi
call fcn.1000236a
test al, al
je 0x1000268f
lea ecx, [ebp - 0xc]
call fcn.100028f0
sub esi, dword [ebp - 0x10]
sub esi, 4
push esi
mov esi, dword [ebp - 0x14]
push esi
call fcn.100028f7
lea ecx, [ebp - 0xc]
call fcn.100028f4
mov edx, dword [ebp - 0x10]
cmp dword [edx + edi], eax
jne 0x1000268b
mov eax, dword [esi]
mov dword [ebp - 8], eax
cmp byte [ebp - 8], 0x7f
jne 0x10002687
mov ecx, eax
shr ecx, 8
cmp cx, word [ebp - 2]
jne 0x10002683
shr eax, 0x18
cmp al, byte [ebp + 8]
jne 0x1000267f
mov esi, dword [edx + edi + 8]
push edi
call fcn.10002955
pop ecx
mov eax, esi
jmp 0x100026cd
push 8
jmp 0x10002699
push 7
jmp 0x10002699
push 6
jmp 0x10002699
push 5
jmp 0x10002699
push 4
jmp 0x10002699
push 3
jmp 0x10002699
push 2
pop ecx
call fcn.100023b0
push eax
call fcn.10001f44
pop ecx
push edi
call fcn.10002955
pop ecx
push dword [ebx + 0x190]
call dword [sym.imp.WS2_32.dll_closesocket]
jmp 0x100026ca
xor ecx, ecx
inc ecx
call fcn.100023b0
push eax
call fcn.10001f44
pop ecx
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100026d2
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Download and write a file
Receive and write data from server to client
Receive data
Receive data on socket
Send data
Send data on socket
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push edi
push 6
push 1
mov bx, dx
mov edi, ecx
push 2
mov word [ebp - 2], bx
call dword [sym.imp.WS2_32.dll_socket]
mov dword [edi + 0x190], eax
cmp eax, 0xffffffff
je 0x100028ad
push esi
push 0x10
lea ecx, [edi + 0x194]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_connect]
mov al, byte [ebp + 8]
lea ecx, [ebp - 0xc]
mov byte [ebp - 8], 1
mov word [ebp - 7], bx
mov byte [ebp - 5], al
call fcn.100028f0
push 4
lea eax, [ebp - 8]
push eax
call fcn.100028f7
xor ecx, ecx
call fcn.1000231e
lea ebx, [eax + 8]
push ebx
call fcn.1000295a
pop ecx
mov esi, eax
mov ecx, esi
call fcn.1000231e
mov edx, eax
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x10], edx
call fcn.100028f4
mov dword [edx + esi], eax
lea ecx, [ebp - 8]
lea eax, [edx + 4]
push 4
add eax, esi
push ecx
push eax
call dword [sym.imp.VCRUNTIME140.dll_memcpy]
add esp, 0xc
push 0
push ebx
push esi
push dword [edi + 0x190]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x10002888
push 0
push ebx
push esi
push dword [edi + 0x190]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, ebx
jne 0x10002884
mov ecx, esi
call fcn.1000236a
test al, al
je 0x10002880
lea ecx, [ebp - 0xc]
call fcn.100028f0
mov eax, dword [ebp - 0x10]
sub ebx, eax
sub ebx, 4
push ebx
lea ebx, [eax + 4]
add ebx, esi
push ebx
call fcn.100028f7
lea ecx, [ebp - 0xc]
call fcn.100028f4
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + esi], eax
jne 0x1000287c
mov eax, dword [ebx]
mov dword [ebp - 8], eax
mov cl, byte [ebp - 8]
cmp cl, 0x7e
jne 0x1000286f
mov ecx, eax
shr ecx, 8
cmp cx, word [ebp - 2]
jne 0x1000286b
shr eax, 0x18
cmp al, byte [ebp + 8]
jne 0x10002867
push 0xfffffffffffffffe
pop ecx
call fcn.100023b0
push eax
call fcn.10001f44
push esi
call fcn.10002955
push 0x401
call fcn.1000295a
push 0x10004830
push str.update.bin
mov esi, eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
add esp, 0x14
mov ebx, eax
jmp 0x10002846
push eax
push 1
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
push 0
push 0x400
push esi
push dword [edi + 0x190]
call dword [sym.imp.WS2_32.dll_recv]
push ebx
test eax, eax
jg 0x10002839
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x10002896
push 8
jmp 0x1000288a
push 7
jmp 0x1000288a
cmp cl, 0xff
jne 0x10002878
push 9
jmp 0x1000288a
push 6
jmp 0x1000288a
push 5
jmp 0x1000288a
push 4
jmp 0x1000288a
push 3
jmp 0x1000288a
push 2
pop ecx
call fcn.100023b0
push eax
call fcn.10001f44
pop ecx
push esi
call fcn.10002955
pop ecx
push dword [edi + 0x190]
call dword [sym.imp.WS2_32.dll_closesocket]
pop esi
jmp 0x100028bc
xor ecx, ecx
inc ecx
call fcn.100023b0
push eax
call fcn.10001f44
pop ecx
pop edi
pop ebx
leave
ret
Function at 0x100028c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test edx, edx
je 0x100028eb
push edi
not esi
xor edi, edi
movzx eax, byte [edi + ecx]
xor eax, esi
shr esi, 8
movzx eax, al
xor esi, dword [eax*4 + 0x10004368]
inc edi
cmp edi, edx
jne 0x100028d0
not esi
pop edi
mov eax, esi
pop esi
pop ebp
ret
Function at 0x401198
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
and dword [ebp - 8], 0
lea eax, [ebp - 4]
push eax
push 4
push 0x410252
call fcn.00403472
pop ecx
pop ecx
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x401282
push ebx
push esi
push edi
mov ebx, 0x41098b
push eax
push ebx
call fcn.004034a2
pop ecx
mov dword [ebp - 0xc], eax
pop ecx
lea eax, [ebp - 0x110]
push 0x104
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x401276
lea eax, [ebp - 0x110]
push eax
call fcn.0040c7b8
xor edi, edi
pop ecx
cmp dword [ebp - 0xc], edi
jle 0x40126e
push edi
push ebx
call fcn.00403472
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.00403c7c
add esp, 0x10
test eax, eax
je 0x401268
push 0x410b93
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x401268
push 2
push 0x410c93
call fcn.00403472
pop ecx
pop ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401261
lea ecx, [ebp - 0x110]
push ecx
push dword [ebp - 4]
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
inc edi
cmp edi, dword [ebp - 0xc]
jl 0x40120f
inc dword [ebp - 8]
jmp 0x4011df
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401284
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x814
lea eax, [ebp + 0xc]
push esi
and dword [ebp - 4], 0
push eax
push dword [ebp + 0xc]
mov esi, 0x400
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x4012b8
xor eax, eax
jmp 0x4013a4
push ebx
push edi
mov edi, 0x41098b
push 0
push edi
call fcn.004034a2
pop ecx
mov dword [ebp + 8], eax
pop ecx
lea eax, [ebp - 8]
xor ebx, ebx
push eax
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push ebx
push eax
lea eax, [ebp - 0x414]
mov dword [ebp - 0xc], esi
push eax
mov dword [ebp - 8], esi
push dword [ebp - 4]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x401397
cmp dword [ebp - 0x10], 1
je 0x40130f
and byte [ebp - 0x814], al
lea eax, [ebp - 0x414]
push eax
call fcn.0040c7b8
lea eax, [ebp - 0x814]
push eax
call fcn.0040c7b8
cmp dword [ebp + 8], 0
pop ecx
pop ecx
jle 0x40138f
push ebx
push edi
call fcn.00403472
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.00403c7c
add esp, 0x10
test eax, eax
jne 0x401379
push dword [ebp - 0x14]
lea eax, [ebp - 0x814]
push eax
call fcn.00403c7c
pop ecx
test eax, eax
pop ecx
jne 0x401379
lea eax, [ebp - 0x414]
push str.____
push eax
call fcn.00407650
pop ecx
test eax, eax
pop ecx
jne 0x401389
lea eax, [ebp - 0x414]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
inc ebx
cmp ebx, dword [ebp + 8]
jl 0x40132f
inc dword [ebp - 4]
jmp 0x4012cc
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop ebx
pop esi
leave
ret 8
Function at 0x4013fa
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x444
push ebx
push 0x40f0c0
call fcn.00407830
xor ebx, ebx
mov dword [esp], 0x410e04
push ebx
mov dword [ebp - 0x14], eax
call fcn.0040543d
push ebx
push 0x410bc5
call fcn.004034a2
add esp, 0x10
mov dword [ebp - 4], eax
lea eax, [ebp - 0x444]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push dword [ebp + 8]
mov dword [ebp - 0x340], 0x224
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [ebp - 0x340]
mov dword [ebp - 0x18], eax
push ecx
push eax
call sub.KERNEL32.dll_Module32First
test eax, eax
je 0x4015ef
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.00407740
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x444]
push eax
call fcn.0040c910
add esp, 0x10
test eax, eax
je 0x4015ef
push dword [ebp - 0x338]
push ebx
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x4015ef
push esi
mov esi, 0x80000
push edi
push esi
mov edi, 0x4131d0
push ebx
push edi
call fcn.004076e0
mov eax, dword [ebp - 0x328]
add esp, 0xc
cmp eax, esi
jb 0x4014e1
mov eax, esi
cmp dword [ebp + 0xc], ebx
mov dword [ebp - 8], ebx
jne 0x401506
lea ecx, [ebp - 8]
push ecx
push eax
push edi
push dword [ebp - 0x32c]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x4015e1
cmp dword [ebp - 4], ebx
mov dword [ebp + 8], ebx
jbe 0x4015e1
push dword [ebp + 8]
push 0x410bc5
call fcn.00403472
push eax
mov dword [ebp - 0x10], eax
call fcn.00407830
xor esi, esi
add esp, 0xc
cmp dword [ebp + 0xc], esi
mov ebx, eax
je 0x40153c
lea eax, [ebx + 0x6e]
mov dword [ebp - 8], eax
jmp 0x40153f
mov eax, dword [ebp - 8]
sub eax, ebx
sub eax, 0xa
je 0x4015d2
push dword [ebp - 0x14]
lea edi, [esi + 0x4131d0]
push edi
push 0x40f0c0
call fcn.0040c860
add esp, 0xc
test eax, eax
je 0x4015cb
cmp dword [ebp + 0xc], 0
jne 0x40158b
push ebx
push edi
push dword [ebp - 0x10]
call fcn.0040c860
add esp, 0xc
test eax, eax
je 0x40158b
mov eax, dword [ebp - 8]
inc esi
sub eax, ebx
sub eax, 0xa
cmp esi, eax
jb 0x40154a
jmp 0x4015d2
push 0
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push 0x410df0
call fcn.00403472
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.00403c7c
add esp, 0x10
test eax, eax
jne 0x4015cb
lea eax, [ebp - 0x11c]
push eax
call fcn.00403ef9
pop ecx
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp + 8], eax
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 4]
jb 0x401512
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop ebx
pop edi
pop esi
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x403216
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
push ebx
push esi
push 1
lea eax, [ebp - 0x190]
pop ebx
mov esi, ecx
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
movsx eax, word [ebp + 0xc]
dec eax
dec eax
jne 0x403240
push 2
pop ebx
movsx eax, bx
push 6
push eax
push 2
call dword [sym.imp.WS2_32.dll_socket]
xor ecx, ecx
cmp eax, 0xffffffff
mov dword [esi], eax
pop esi
setne cl
mov eax, ecx
pop ebx
leave
ret 0xc

Function at 0x403260
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0xe], ax
lea eax, [ebp + 0xc]
push eax
mov ecx, esi
push dword [ebp + 8]
mov word [ebp - 0x10], 2
call fcn.00403303
mov eax, dword [ebp + 0xc]
push 0x10
mov byte [ebp - 0xc], al
mov al, byte [ebp + 0xe]
mov byte [ebp - 0xa], al
mov al, byte [ebp + 0xf]
mov byte [ebp - 0xb], ah
mov byte [ebp - 9], al
lea eax, [ebp - 0x10]
push eax
push dword [esi]
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
pop esi
je 0x4032bc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
xor eax, eax
jmp 0x4032bf
push 1
pop eax
leave
ret 8

Function at 0x4032c3
Capabilities:
Send data
Send data on socket

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [ecx]
call dword [sym.imp.WS2_32.dll_send]
ret 0xc

Function at 0x4032da
Capabilities:
Receive data
Receive data on socket

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [ecx]
call dword [sym.imp.WS2_32.dll_recv]
ret 0xc

Function at 0x403303
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 1
xor esi, esi
pop ebx
mov dword [ebp - 8], ecx
push edi
mov dword [ebp - 4], esi
call fcn.00407830
test eax, eax
pop ecx
jle 0x403350
mov al, byte [esi + edi]
cmp al, 0x2e
jne 0x403330
inc dword [ebp - 4]
jmp 0x40333a
cmp al, 0x30
jl 0x403338
cmp al, 0x39
jle 0x40333a
xor ebx, ebx
push edi
inc esi
call fcn.00407830
cmp esi, eax
pop ecx
jl 0x403324
test ebx, ebx
je 0x403362
cmp dword [ebp - 4], 3
je 0x403354
xor eax, eax
jmp 0x40338e
push dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
push edi
call fcn.00403395
jmp 0x40338b
push edi
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test esi, esi
je 0x40338b
xor eax, eax
mov ecx, dword [esi + 0xc]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ecx]
mov cl, byte [ecx + eax]
mov byte [eax + edx], cl
inc eax
cmp eax, 4
jl 0x403377
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4035cc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
and dword [ebp - 8], 0
cmp dword [ebp + 0xc], 0
push ebx
mov cl, byte [eax]
mov al, byte [eax + 1]
push esi
push edi
mov byte [ebp - 2], cl
mov byte [ebp - 1], al
jle 0x403620
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
add eax, ecx
mov dword [ebp - 0xc], eax
mov al, byte [eax]
mov byte [ebp + 0x13], al
pushal
mov al, byte [ebp + 0x13]
mov cl, byte [ebp - 2]
rol al, cl
xor al, byte [ebp - 1]
mov byte [ebp + 0x13], al
popal
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp + 0x13]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
jl 0x4035ed
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403628
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
and dword [ebp - 8], 0
cmp dword [ebp + 0xc], 0
push ebx
mov cl, byte [eax]
mov al, byte [eax + 1]
push esi
push edi
mov byte [ebp - 2], cl
mov byte [ebp - 1], al
jle 0x40367c
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
add eax, ecx
mov dword [ebp - 0xc], eax
mov al, byte [eax]
mov byte [ebp + 0x13], al
pushal
mov al, byte [ebp + 0x13]
mov cl, byte [ebp - 2]
xor al, byte [ebp - 1]
ror al, cl
mov byte [ebp + 0x13], al
popal
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp + 0x13]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
jl 0x403649
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403dba
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
push edi
push esi
push 0x20
push 2
push esi
push 3
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
mov dword [ebp + 8], esi
cmp edi, 0xffffffff
je 0x403e04
cmp dword [ebp + 0xc], esi
je 0x403e04
lea eax, [ebp + 8]
push esi
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop eax
jmp 0x403e06
xor eax, eax
pop edi
pop esi
pop ebp
ret

Function at 0x403e0a
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push 0
push 0x27
push 3
push 0
push 3
push closesocket
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
and dword [ebp + 8], 0
mov edi, eax
or ebx, 0xffffffff
cmp edi, ebx
je 0x403e51
lea eax, [ebp + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp dword [ebp + 8], 0
mov ebx, eax
je 0x403e4a
or ebx, 0xffffffff
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop edi
pop ebx
pop ebp
ret
Function at 0x403e8b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push esi
push 4
push 5
lea eax, [ebp - 0x14]
push 2
push eax
call fcn.00403723
add esp, 0x10
lea eax, [ebp - 0x118]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push esi
push 0
push eax
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push esi
call fcn.00403ef9
push esi
call fcn.00407830
pop ecx
pop ecx
dec eax
js 0x403ee7
cmp byte [eax + esi], 0x2e
jne 0x403ede
add eax, esi
push 0x4101dc
push eax
call fcn.00407740
pop ecx
pop ecx
pop esi
leave
ret

Function at 0x403ef9
Capabilities:
Delete file
Set file attributes

Disassembly:
push 0x20
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
ret

Function at 0x403f10
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x348
push esi
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x208]
xor esi, esi
push eax
call fcn.00407740
lea eax, [ebp - 0x208]
push eax
call fcn.00407830
add esp, 0xc
test eax, eax
je 0x403f56
cmp byte [ebp + eax - 0x209], 0x5c
lea eax, [ebp + eax - 0x209]
jne 0x403f56
and byte [eax], 0
push 1
pop esi
lea eax, [ebp - 0x208]
push str..
push eax
call fcn.00407750
pop ecx
lea eax, [ebp - 0x348]
pop ecx
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40405c
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push eax
call fcn.00407740
pop ecx
test esi, esi
pop ecx
jne 0x403fb0
lea eax, [ebp - 0x104]
push 0x40f044
push eax
call fcn.00407750
pop ecx
pop ecx
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.00407750
test byte [ebp - 0x348], 0x10
pop ecx
pop ecx
je 0x404029
lea eax, [ebp - 0x31c]
push 0x40f0ac
push eax
call fcn.00407650
pop ecx
test eax, eax
pop ecx
je 0x40403f
lea eax, [ebp - 0x31c]
push 0x40f0a8
push eax
call fcn.00407650
pop ecx
test eax, eax
pop ecx
je 0x40403f
push dword [ebp + 0x10]
lea eax, [ebp - 0x104]
push 1
push eax
call dword [ebp + 0xc]
add esp, 0xc
test eax, eax
je 0x40403f
push dword [ebp + 0x10]
lea eax, [ebp - 0x104]
push dword [ebp + 0xc]
push eax
call fcn.00403f10
add esp, 0xc
jmp 0x40403f
push dword [ebp + 0x10]
lea eax, [ebp - 0x104]
push 0
push eax
call dword [ebp + 0xc]
add esp, 0xc
test eax, eax
je 0x404055
lea eax, [ebp - 0x348]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x403f88
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
xor eax, eax
pop esi
leave
ret
Function at 0x404062
Capabilities:
Get file size
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0x15000
push ebx
push esi
push edi
jl 0x40409c
push 0x20
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
xor ebx, ebx
push ebx
push 0x20
push 3
push ebx
push 3
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4040a3
xor eax, eax
jmp 0x404127
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, dword [ebp + 0xc]
jle 0x4040ca
push ebx
push ebx
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
jmp 0x40411d
push 2
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp + 0xc]
sub eax, esi
mov esi, 0x80000
mov dword [ebp + 8], eax
mov ecx, esi
cdq
idiv ecx
cmp eax, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
jle 0x404108
mov dword [ebp + 0xc], eax
lea eax, [ebp - 4]
push 0
push eax
push esi
push 0x4131d0
push edi
call ebx
dec dword [ebp + 0xc]
jne 0x4040f4
lea eax, [ebp - 4]
push 0
push eax
mov eax, dword [ebp + 8]
cdq
idiv esi
push edx
push 0x4131d0
push edi
call ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4045e3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0x18]
or dword [ebp - 8], 0xffffffff
push eax
push 0
push dword [ebp + 0x14]
mov dword [ebp - 4], eax
call fcn.004076e0
add esp, 0xc
lea eax, [ebp + 0x18]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x404619
push 1
pop eax
leave
ret
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push dword [ebp + 0x14]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
leave
ret

Function at 0x40463f
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x40465b
push 1
pop eax
pop ebp
ret
push dword [ebp + 0x14]
call fcn.00407830
pop ecx
push eax
push dword [ebp + 0x14]
push 1
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop ebp
ret