joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a0624
Capabilities:
Connect socket
Receive data
Receive data on socket
Send data
Send data on socket
Set socket configuration

Disassembly:
jmp 0x4a5810
sub esp, 8
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
push edi
push 1
push 2
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4a5851
mov eax, dword [esp + 0x2c]
cmp eax, edi
je 0x4a59d1
pop edi
pop esi
mov dword [eax], 0xfffffffd
pop ebp
xor al, al
pop ebx
add esp, 8
ret
mov ebp, dword [sym.imp.WS2_32.dll_setsockopt]
push 4
push 0x794068
push 0x1005
push 0xffff
push esi
call ebp
push 4
push 0x794068
push 0x1006
push 0xffff
push esi
call ebp
push 0x10
push 0x794058
push esi
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x4a58ab
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push esi
mov ebp, eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov esi, dword [esp + 0x2c]
cmp esi, edi
jmp 0x4a59c2
mov ebp, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov eax, ebp
sub eax, edi
push 0
lea edx, [edi + ecx]
push eax
push edx
push esi
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x4a58d2
add edi, eax
cmp edi, ebp
jb 0x4a58af
jmp 0x4a5909
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push esi
mov edi, eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x4a59d1
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov dword [esi], 0xfffffffd
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 8
ret
cmp ebx, 4
jge 0x4a595c
mov eax, 4
push 0
sub eax, ebx
lea ecx, [esp + ebx + 0x14]
push eax
push ecx
push esi
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test edi, edi
mov ebp, eax
je 0x4a59b5
cmp edi, 0xffffffff
je 0x4a59b5
add ebx, edi
cmp ebx, 4
jne 0x4a5907
mov edx, dword [esp + 0x10]
push ebx
push 0x1000
push edx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x14], eax
mov dword [eax], ecx
jmp 0x4a5904
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
sub eax, ebx
push 0
add edx, ebx
push eax
push edx
push esi
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test edi, edi
mov ebp, eax
je 0x4a59b5
cmp edi, 0xffffffff
je 0x4a59b5
mov eax, dword [esp + 0x10]
add ebx, edi
cmp ebx, eax
jne 0x4a5904
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x28]
push esi
mov dword [eax], ecx
mov dword [edx], ebx
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 8
ret
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x4a59d1
push ebp
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov dword [esi], 0xfffffffd
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 8
ret

Function at 0x4a0a1b
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
jmp 0x4a9800
mov byte [0x794078], 1
jmp fcn.0049f693
Function at 0x4a9000
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
push ebx
push esi
push edi
jmp 0x4a902a
mov dword [ebp - 0x118], str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov dword [ebp - 0x250], str.ProductName
mov dword [ebp - 8], str.CurrentBuildNumber
mov dword [ebp - 0x114], 1
mov dword [ebp - 4], 0x104
mov byte [ebp - 0x228], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x227]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x110], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 8]
mov byte [eax], 0
lea ecx, [ebp - 0x11c]
push ecx
mov edx, dword [ebp - 0x118]
push edx
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4a91ff
mov dword [ebp - 4], 0x104
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x228]
push ecx
lea edx, [ebp - 0x114]
push edx
push 0
mov eax, dword [ebp - 0x250]
push eax
mov ecx, dword [ebp - 0x11c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a9114
lea edi, [ebp - 0x228]
mov edx, dword [ebp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
add edi, 0xffffffff
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
add edi, 0xffffffff
mov ax, word [0x78c628]
mov word [edi], ax
mov dword [ebp - 4], 0x104
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x110]
push edx
lea eax, [ebp - 0x114]
push eax
push 0
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x11c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a918c
lea edi, [ebp - 0x110]
mov edx, dword [ebp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
add edi, 0xffffffff
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
add edi, 0xffffffff
mov ax, word [0x78c628]
mov word [edi], ax
lea ecx, [ebp - 0x24c]
push ecx
call fcn.004a92a0
add esp, 4
mov edx, dword [ebp - 0x24c]
and edx, 0xffff
cmp edx, 9
je 0x4a91d2
mov eax, dword [ebp - 0x24c]
and eax, 0xffff
cmp eax, 6
jne 0x4a91f2
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
add edi, 0xffffffff
mov ecx, dword [str._x64_]
mov dword [edi], ecx
mov dx, word [0x78c624]
mov word [edi + 4], dx
mov eax, dword [ebp - 0x11c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4a9212
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5382c0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4
push ebx
push esi
push edi
lea edi, [ebp - 4]
mov ecx, 1
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x79a067
call fcn.004a0629
mov esi, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cmp esi, esp
call fcn.0049f625
movsx ecx, ax
and ecx, 0x8000
je 0x53830f
mov dword [ebp - 0xc4], 1
jmp 0x538319
mov dword [ebp - 0xc4], 0
mov al, byte [ebp - 0xc4]
pop edi
pop esi
pop ebx
add esp, 0xc4
cmp ebp, esp
call fcn.0049f625
mov esp, ebp
pop ebp
ret
Function at 0x1002410
Capabilities:
Copy file
Get common file path
Query environment variable
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
push edi
lea eax, [ebp - 0x104]
push eax
xor eax, eax
push eax
push eax
push 0x25
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
jge 0x1002463
push 0x104
lea eax, [ebp - 0x104]
push eax
push 0x10011ec
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
jne 0x1002463
push 0x10011d4
lea eax, [ebp - 0x104]
push eax
call ebx
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov al, byte [ebp + eax - 0x105]
cmp al, 0x5c
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
je 0x1002493
cmp al, 0x2f
je 0x1002493
push 0x10011d0
lea eax, [ebp - 0x104]
push eax
call edi
mov esi, 0x10011c4
push esi
lea eax, [ebp - 0x104]
push eax
call edi
push 0x80
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
lea eax, [ebp - 0x208]
push eax
call ebx
push 0
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10024d9
Capabilities:
Check os version

Disassembly:
push dword [esp + 8]
push dword [esp + 8]
call fcn.01002c6d
cmp eax, 0xfffffff8
jne 0x10024ee
ret 8
cmp eax, 0xfffffffa
jne 0x10024eb
jmp 0x1002f1f
push dword [esp + 8]
push dword [esp + 8]
call fcn.01002c6d
call fcn.01002ef4
test eax, eax
je 0x1002f3a
jmp fcn.01002c6d
push 0xfffffffffffffffb
pop eax
ret 8
Function at 0x1002c6d
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
lea eax, [ebp - 0xa0]
push eax
mov dword [ebp - 0xa0], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x9c], 6
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0x1002b23
push 6
mov dword [ebp - 4], 0xfffffffa
push 0
jb 0x1002cbf
push 3
push section..data
jmp 0x1002cc6
push 0x27
push 0x1008010
call fcn.010029aa
test eax, eax
jne 0x1002cd2
mov eax, dword [ebp - 4]
leave
ret 8
Function at 0x10032ab
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
push esi
push edi
lea eax, [ebp - 0x9c]
push eax
mov dword [ebp - 0x9c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x98], 6
mov edi, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push 0x1002cd6
push 4
mov dword [ebp - 4], 0xfffffffa
mov dword [ebp - 8], edi
push 0
jb 0x10032f9
push 3
push section..data
jmp 0x1003300
push 0x27
push 0x1008010
call fcn.010029aa
mov esi, eax
test esi, esi
jne 0x100330e
mov esi, dword [ebp - 4]
test edi, edi
je 0x1003317
call fcn.0100302a
pop edi
mov eax, esi
pop esi
leave
ret 4

Function at 0x1003406
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push 0x60
push 0x1001688
call fcn.010044ec
and dword [ebp - 4], 0
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
or dword [ebp - 4], 0xffffffff
mov ebx, 0x94
push ebx
push 0
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x10035c7
mov dword [esi], ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push esi
test eax, eax
jne 0x1003462
push eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x10035c7
mov eax, dword [esi + 0x10]
mov dword [0x1008464], eax
mov eax, dword [esi + 4]
mov dword [0x1008470], eax
mov eax, dword [esi + 8]
mov dword [0x1008474], eax
mov eax, dword [esi + 0xc]
and eax, 0x7fff
mov dword [0x1008468], eax
xor ebx, ebx
push ebx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [0x1008464], 2
je 0x10034a3
or byte [0x1008469], 0x80
mov eax, dword [0x1008470]
shl eax, 8
add eax, dword [0x1008474]
mov dword [0x100846c], eax
call fcn.010033aa
mov dword [ebp - 0x1c], eax
push ebx
call fcn.01004498
pop ecx
test eax, eax
jne 0x10034ea
cmp dword [0x1008454], 1
jne 0x10034d7
call fcn.01003ca3
push 0x1c
call fcn.01003b42
push 0xff
call fcn.010039c4
pop ecx
pop ecx
mov dword [ebp - 4], 1
call fcn.010042bb
test eax, eax
jge 0x1003502
push 0x1b
call fcn.01003385
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x1008cf4], eax
call fcn.01004195
mov dword [0x100844c], eax
call fcn.010040f4
test eax, eax
jge 0x1003528
push 8
call fcn.01003385
pop ecx
call fcn.01003eaa
test eax, eax
jge 0x1003539
push 9
call fcn.01003385
pop ecx
call fcn.010039f4
mov dword [ebp - 0x28], eax
cmp eax, ebx
je 0x100354c
push eax
call fcn.01003385
pop ecx
call fcn.01003e4d
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x1003560
movzx eax, word [ebp - 0x40]
jmp 0x1003563
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push ebx
push 0x1000000
call fcn.01002817
mov esi, eax
mov dword [ebp - 0x2c], esi
cmp dword [ebp - 0x1c], ebx
jne 0x1003582
push esi
call fcn.01003b02
call fcn.01003b24
jmp 0x10035b4
or dword [ebp - 4], 0xffffffff
mov eax, esi
jmp 0x10035cc
mov eax, 0xff
call fcn.01004527
ret
Function at 0x1003b42
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
xor eax, eax
cmp ecx, dword [eax*8 + 0x10080c0]
je 0x1003b5a
inc eax
cmp eax, 0x13
jb 0x1003b4b
push esi
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x10080c0]
mov dword [ebp + 8], esi
jne 0x1003ca0
mov eax, dword [0x1008454]
cmp eax, 1
push ebx
je 0x1003c70
test eax, eax
jne 0x1003b8f
cmp dword [0x10080b8], 1
je 0x1003c70
cmp ecx, 0xfc
je 0x1003c9f
push edi
push 6
pop ecx
mov esi, 0x1001a28
mov edi, 0x10084a8
rep movsd dword es:[edi], dword [esi]
push 0x104
mov ebx, 0x10084c2
push ebx
movsw word es:[edi], word [esi]
push 0
mov byte [0x10085c6], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1003bdd
push 5
pop ecx
mov esi, 0x1001a10
mov edi, 0x10084c2
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003be2
sub eax, edx
inc eax
cmp eax, 0x3c
jbe 0x1003c15
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003bf6
sub eax, edx
push 3
lea eax, [eax + 0x1008487]
push 0x1001a0c
push eax
call fcn.010038a0
add esp, 0xc
mov edx, 0x10084a8
mov edi, edx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1003c1d
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10080c4]
mov esi, 0x1001a08
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003c38
mov edi, edx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1003c44
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x12010
mov ecx, eax
and ecx, 3
push 0x10019e0
push edx
rep movsb byte es:[edi], byte [esi]
call fcn.01004ce1
add esp, 0xc
pop edi
jmp 0x1003c9f
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x1003c9f
mov esi, dword [esi + 0x10080c4]
mov ecx, esi
lea edx, [ecx + 1]
mov bl, byte [ecx]
inc ecx
test bl, bl
jne 0x1003c87
push 0
sub ecx, edx
lea edx, [ebp - 4]
push edx
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebx
pop esi
leave
ret
Function at 0x1004ce1
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x10088f8], ebx
push esi
push edi
jne 0x1004d61
push 0x1001ab8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x1004d9c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1001aac
push edi
call esi
test eax, eax
mov dword [0x10088f8], eax
je 0x1004d9c
push 0x1001a9c
push edi
call esi
push 0x1001a88
push edi
mov dword [0x10088fc], eax
call esi
cmp dword [0x1008464], 2
mov dword [0x1008900], eax
jne 0x1004d61
push 0x1001a6c
push edi
call esi
test eax, eax
mov dword [0x1008908], eax
je 0x1004d61
push 0x1001a54
push edi
call esi
mov dword [0x1008904], eax
mov eax, dword [0x1008904]
test eax, eax
je 0x1004da6
call eax
test eax, eax
je 0x1004d8d
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x1008908]
test eax, eax
je 0x1004d8d
test byte [ebp - 8], 1
jne 0x1004da6
cmp dword [0x1008470], 4
jb 0x1004da0
or byte [ebp + 0x12], 0x20
jmp 0x1004dc5
xor eax, eax
jmp 0x1004dd5
or byte [ebp + 0x12], 4
jmp 0x1004dc5
mov eax, dword [0x10088fc]
test eax, eax
je 0x1004dc5
call eax
mov ebx, eax
test ebx, ebx
je 0x1004dc5
mov eax, dword [0x1008900]
test eax, eax
je 0x1004dc5
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x10088f8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1005825
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x1005853
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x100585a
cmp ebx, dword [eax + 4]
jae 0x100585a
xor eax, eax
jmp 0x1005a4a
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x100586b
xor eax, eax
inc eax
jmp 0x1005a49
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x1005881
cmp ecx, edx
jae 0x10059c6
cmp dword [eax + 4], 0
je 0x100588a
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x1005872
cmp dword [ebp + 8], 0
je 0x10058ac
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x10059c6
cmp eax, esi
jae 0x10059c6
mov eax, dword [0x1008910]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x10058d1
cmp dword [esi*4 + 0x1008918], edi
je 0x10059ca
inc esi
cmp esi, eax
jl 0x10058bf
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1005a46
cmp dword [ebp - 8], 0x1000000
jne 0x1005a46
test byte [ebp - 0xc], 0xcc
je 0x100594f
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x1005a46
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x1005a46
cmp word [eax + 0x18], 0x10b
jne 0x1005a46
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x1005a46
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x100594f
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x100594f
test byte [ecx + 0x27], 0x80
jne 0x10059c6
push 1
push 0x1008958
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x1005863
mov ecx, dword [0x1008910]
test ecx, ecx
mov edx, ecx
jle 0x1005983
lea eax, [ecx*4 + 0x1008914]
cmp dword [eax], edi
je 0x1005983
dec edx
sub eax, 4
test edx, edx
jg 0x1005977
test edx, edx
jne 0x10059b4
push 0xf
pop ebx
cmp ecx, ebx
jg 0x1005990
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x10059a8
lea eax, [edx*4 + 0x1008918]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x1005996
cmp ecx, 0x10
jge 0x10059b4
inc ecx
mov dword [0x1008910], ecx
push 0
push 0x1008958
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x1005863
xor eax, eax
jmp 0x1005a49
test esi, esi
jle 0x1005863
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
push 0x1008958
call ebx
test eax, eax
jne 0x1005863
cmp dword [esi*4 + 0x1008918], edi
je 0x1005a20
mov eax, dword [0x1008910]
lea esi, [eax - 1]
test esi, esi
jl 0x1005a0e
cmp dword [esi*4 + 0x1008918], edi
je 0x1005a0a
dec esi
jns 0x10059fe
test esi, esi
jge 0x1005a1e
cmp eax, 0x10
jge 0x1005a19
inc eax
mov dword [0x1008910], eax
lea esi, [eax - 1]
jmp 0x1005a20
je 0x1005a38
xor ecx, ecx
test esi, esi
jl 0x1005a38
lea eax, [ecx*4 + 0x1008918]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x1005a26
push 0
push 0x1008958
call ebx
jmp 0x1005863
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10066ab
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
push edi
push 4
pop eax
call fcn.010067b0
mov dword [ebp - 8], esp
push 0x1c
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10067a5
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [ebp - 0x4c]
xor esi, esi
cmp dword [0x1008464], 2
jne 0x100672a
push 0x1002334
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, esi
je 0x100672a
push 0x100231c
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
je 0x100672a
lea ecx, [ebp - 4]
push ecx
mov dword [ebp - 4], esi
call eax
cmp eax, 1
pop ecx
jne 0x100672a
cmp dword [ebp - 4], esi
jbe 0x100672a
mov esi, dword [ebp - 4]
mov edx, dword [0x1008464]
mov ebx, edx
dec ebx
neg ebx
sbb ebx, ebx
and ebx, 0x103
lea ecx, [edi - 1]
lea eax, [esi + edi - 1]
not ecx
inc ebx
and eax, ecx
mov dword [ebp - 4], eax
je 0x1006753
add eax, edi
mov dword [ebp - 4], eax
lea ecx, [edi + edi]
cmp eax, ecx
jae 0x100675f
mov dword [ebp - 4], ecx
mov eax, ecx
lea esi, [edi - 1]
not esi
and esi, dword [ebp - 8]
sub esi, eax
cmp edx, 1
jne 0x1006771
push 0x11
pop edi
mov ecx, dword [ebp - 0xc]
add edi, ecx
cmp esi, edi
jb 0x10067a5
push 4
push 0x1000
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x10067a5
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10067a5
xor eax, eax
inc eax
jmp 0x10067a7
xor eax, eax
lea esp, [ebp - 0x5c]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4a2404
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov byte [esp], cl
mov esi, edx
mov ebx, eax
lea edi, [esp + 1]
jl 0x4a241a
jmp 0x4a241a
jp 0x4a241f
jnp 0x4a241f
call 0xc6d5fbae
mov edx, edi
mov eax, esi
mov ecx, 8
call fcn.00402a38
cmp byte [esp], 0
je 0x4a24c1
mov eax, dword [ebx]
xor dword [esi], eax
mov eax, 1
xor edx, edx
mov dl, byte [edi + 3]
mov edx, dword [ebx + edx*4 + 0x48]
xor ecx, ecx
mov cl, byte [edi + 2]
add edx, dword [ebx + ecx*4 + 0x448]
xor ecx, ecx
mov cl, byte [edi + 1]
xor edx, dword [ebx + ecx*4 + 0x848]
xor ecx, ecx
mov cl, byte [edi]
add edx, dword [ebx + ecx*4 + 0xc48]
mov ecx, dword [ebx + eax*4]
xor ecx, dword [esi + 4]
xor edx, ecx
mov dword [esi + 4], edx
xor edx, edx
mov dl, byte [edi + 7]
mov edx, dword [ebx + edx*4 + 0x48]
xor ecx, ecx
mov cl, byte [edi + 6]
add edx, dword [ebx + ecx*4 + 0x448]
xor ecx, ecx
mov cl, byte [edi + 5]
xor edx, dword [ebx + ecx*4 + 0x848]
xor ecx, ecx
mov cl, byte [edi + 4]
add edx, dword [ebx + ecx*4 + 0xc48]
mov ecx, dword [ebx + eax*4 + 4]
xor ecx, dword [esi]
xor edx, ecx
mov dword [esi], edx
add eax, 2
cmp eax, 0x10
jle 0x4a2440
mov eax, dword [ebx + 0x44]
xor dword [esi + 4], eax
jmp 0x4a2546
mov eax, dword [ebx + 0x44]
xor dword [esi + 4], eax
mov eax, 0x10
xor edx, edx
mov dl, byte [edi + 7]
mov edx, dword [ebx + edx*4 + 0x48]
xor ecx, ecx
mov cl, byte [edi + 6]
add edx, dword [ebx + ecx*4 + 0x448]
xor ecx, ecx
mov cl, byte [edi + 5]
xor edx, dword [ebx + ecx*4 + 0x848]
xor ecx, ecx
mov cl, byte [edi + 4]
add edx, dword [ebx + ecx*4 + 0xc48]
mov ecx, dword [ebx + eax*4]
xor ecx, dword [esi]
xor edx, ecx
mov dword [esi], edx
xor edx, edx
mov dl, byte [edi + 3]
mov edx, dword [ebx + edx*4 + 0x48]
xor ecx, ecx
mov cl, byte [edi + 2]
add edx, dword [ebx + ecx*4 + 0x448]
xor ecx, ecx
mov cl, byte [edi + 1]
xor edx, dword [ebx + ecx*4 + 0x848]
xor ecx, ecx
mov cl, byte [edi]
add edx, dword [ebx + ecx*4 + 0xc48]
mov ecx, dword [ebx + eax*4 - 4]
xor ecx, dword [esi + 4]
xor edx, ecx
mov dword [esi + 4], edx
sub eax, 2
cmp eax, 1
jge 0x4a24cc
mov eax, dword [ebx]
xor dword [esi], eax
add esp, 0xc
pop edi
pop esi
pop ebx
ret

Function at 0x4a2d30
Capabilities:
Hash data with md5

Disassembly:
push ebx
add esp, 0xffffffa8
mov ebx, eax
jle 0x4a2d3b
jg 0x4a2d3b
call 0xc3d601ca
mov edx, esp
mov eax, ebx
mov ecx, 0x58
call fcn.00402a38
xor eax, eax
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], 0x67452301
mov dword [esp + 0xc], 0xefcdab89
mov dword [esp + 0x10], 0x98badcfe
mov dword [esp + 0x14], 0x10325476
mov edx, ebx
mov eax, esp
mov ecx, 0x58
call fcn.00402a38
add esp, 0x58
pop ebx
ret