joyce8/EMBER2024-capa huggingface dataset:
Function at 0x20062bd2
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov esi, ecx
lea edi, [esi + 8]
inc dword [edi + 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0x38]
cmp eax, 0xbb8
mov dword [ebp - 4], 0xa
jle 0x20062c02
mov ecx, 0x12c
jmp 0x20062c1a
cmp eax, 0x2710
jle 0x20062c10
mov ecx, 0x96
jmp 0x20062c1a
cmp eax, 0x9c40
jle 0x20062c20
push 0x64
pop ecx
cdq
idiv ecx
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x34]
mov dword [ebp - 8], eax
mov eax, dword [ecx]
cmp eax, ecx
mov dword [ebp - 0xc], eax
je 0x20062c8a
mov ecx, dword [eax + 0x10]
mov ebx, dword [eax + 0x18]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x10], eax
call fcn.2003c473
test ebx, ebx
je 0x20062c7c
mov eax, dword [ebp - 8]
sub eax, dword [ebx + 0x10]
cmp eax, dword [ebp + 8]
jb 0x20062c78
add ebx, 8
push ebx
lea ecx, [esi + 0x24]
call fcn.20062781
lea eax, [ebp - 0x14]
push eax
lea ecx, [esi + 0x30]
call fcn.200627c9
dec dword [ebp - 4]
jmp 0x20062c7c
and dword [ebp - 4], 0
cmp dword [ebp - 4], 0
jle 0x20062c8a
mov eax, dword [ebp - 0xc]
cmp eax, dword [esi + 0x34]
jne 0x20062c35
mov eax, dword [esi + 0x50]
cmp eax, 0xbb8
mov dword [ebp - 4], 0xa
jle 0x20062ca2
mov ecx, 0x12c
jmp 0x20062cba
cmp eax, 0x2710
jle 0x20062cb0
mov ecx, 0x96
jmp 0x20062cba
cmp eax, 0x9c40
jle 0x20062cc0
push 0x64
pop ecx
cdq
idiv ecx
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x2c]
cmp eax, 0x3e8
jge 0x20062cdc
mov dword [ebp + 8], 0x1d4c0
jmp 0x20062d26
cmp eax, 0x1388
jge 0x20062cec
mov dword [ebp + 8], 0x249f0
jmp 0x20062d26
cmp eax, 0x2710
jge 0x20062cfc
mov dword [ebp + 8], 0x2bf20
jmp 0x20062d26
cmp eax, 0x4e20
jge 0x20062d0c
mov dword [ebp + 8], 0x33450
jmp 0x20062d26
xor ecx, ecx
cmp eax, 0xc350
setge cl
dec ecx
and ecx, 0xffff15a0
add ecx, 0x493e0
mov dword [ebp + 8], ecx
mov ecx, dword [esi + 0x4c]
mov eax, dword [ecx]
cmp eax, ecx
mov dword [ebp - 0xc], eax
je 0x20062d87
mov ecx, dword [eax + 0x10]
mov ebx, dword [eax + 0x18]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x10], eax
call fcn.2003c473
test ebx, ebx
je 0x20062d79
mov eax, dword [ebp - 8]
sub eax, dword [ebx + 0x10]
cmp eax, dword [ebp + 8]
jb 0x20062d75
add ebx, 8
push ebx
lea ecx, [esi + 0x3c]
call fcn.20062811
lea eax, [ebp - 0x14]
push eax
lea ecx, [esi + 0x48]
call fcn.20062859
dec dword [ebp - 4]
jmp 0x20062d79
and dword [ebp - 4], 0
cmp dword [ebp - 4], 0
jle 0x20062d87
mov eax, dword [ebp - 0xc]
cmp eax, dword [esi + 0x4c]
jne 0x20062d32
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
mov dword [esi + 0x60], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
dec dword [edi + 0x18]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x20063001
Capabilities:
Get number of processors

Disassembly:
mov eax, 0x200a191a
call fcn.2007d394
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x200aa610
mov dword [ebp - 4], 4
lea ecx, [esi + 0x64]
call fcn.20062fde
mov byte [ebp - 4], 3
lea ecx, [esi + 0x48]
call fcn.20062a55
mov byte [ebp - 4], 2
lea ecx, [esi + 0x3c]
call fcn.20062a32
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.20062a0f
mov byte [ebp - 4], 0
lea ecx, [esi + 0x24]
call fcn.200629ec
or dword [ebp - 4], 0xffffffff
add esi, 8
push esi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x2006311c
Capabilities:
Get number of processors

Disassembly:
mov eax, 0x200a191a
call fcn.2007d394
push ecx
push esi
mov esi, ecx
push edi
lea eax, [esi + 8]
mov dword [esi], 0x200aa610
xor edi, edi
push eax
mov dword [ebp - 0x10], esi
mov dword [eax + 0x18], edi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [ebp - 4], edi
lea ecx, [esi + 0x24]
call fcn.20062eda
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.20062f00
mov byte [ebp - 4], 2
lea ecx, [esi + 0x3c]
call fcn.20062f26
mov byte [ebp - 4], 3
lea ecx, [esi + 0x48]
call fcn.20062f4c
mov byte [ebp - 4], 4
lea ecx, [esi + 0x64]
call fcn.200630f6
mov byte [ebp - 4], 5
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x20065045
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0x20038]
xor eax, eax
cmp esi, eax
je 0x200650d4
cmp dword [esi + 0x10c], eax
jne 0x200650d4
cmp word [esi + 0x1dc], 1
ja 0x20065084
cmp word [esi + 0x1de], ax
ja 0x20065084
cmp word [esi + 0x1e0], ax
ja 0x20065084
cmp word [esi + 0x1e2], 0x9b6
jbe 0x200650d4
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
sub eax, dword [esi + 0x110]
cmp eax, 0xbb8
jbe 0x200650d3
mov eax, dword [edi + 0x20038]
cmp dword [eax + 0x114], 0xa
jae 0x200650d3
inc dword [eax + 0x114]
mov edi, dword [edi + 0x20038]
call ebx
mov ecx, dword [esp + 0x10]
push 1
mov dword [edi + 0x110], eax
call fcn.2000133b
mov ecx, dword [esp + 0x10]
push 0x24
call fcn.20001294
pop ebx
xor eax, eax
pop edi
inc eax
pop esi
ret 4
Function at 0x2006f98c
Capabilities:
Check os version

Disassembly:
mov eax, 0x200a22be
call fcn.2007d394
sub esp, 0xa4
mov eax, dword [0x200cc84c]
push esi
xor eax, ebp
mov esi, 0x9c
push esi
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xac]
push 0
push eax
call fcn.2007e690
add esp, 0xc
lea eax, [ebp - 0xac]
mov dword [ebp - 0xac], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push eax
call esi
test eax, eax
jne 0x2006f9ee
lea eax, [ebp - 0xac]
push eax
mov dword [ebp - 0xac], 0x94
call esi
test eax, eax
je 0x2006fa5a
cmp dword [ebp - 0xa8], 5
jne 0x2006fa5a
cmp dword [ebp - 0xa4], 1
jne 0x2006fa5a
lea eax, [ebp - 0x98]
push eax
lea ecx, [ebp - 0xb0]
call fcn.20004f37
and dword [ebp - 4], 0
lea ecx, [ebp - 0xb0]
call fcn.20008e10
push 0x200a8b48
push dword [ebp - 0xb0]
call fcn.2007e81b
test eax, eax
pop ecx
pop ecx
jne 0x2006fa4b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb0]
call fcn.200026ee
xor eax, eax
inc eax
jmp 0x2006fa5c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb0]
call fcn.200026ee
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
pop esi
call fcn.2007c9ae
leave
ret
Function at 0x2007023b
Capabilities:
Copy file

Disassembly:
mov eax, 0x200a235b
call fcn.2007d394
sub esp, 0x68
mov eax, dword [0x200cc84c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x54]
mov edi, ecx
push eax
mov dword [ebp - 0x50], edi
call fcn.2006fa73
test al, al
je 0x20070382
push ebx
push esi
push 0xf
pop esi
xor ebx, ebx
push ebx
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x30], esi
call fcn.20001bc0
mov dword [ebp - 4], ebx
push ebx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], esi
call fcn.20001bc0
mov byte [ebp - 4], 1
push 0xffffffffffffffff
mov esi, 0x200a6718
lea ecx, [edi + 0xc]
push esi
call fcn.200383cf
push eax
push ebx
lea eax, [ebp - 0x74]
push eax
lea ecx, [edi + 0xc]
call fcn.200039ea
mov byte [ebp - 4], 2
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x48]
call fcn.20002fc3
mov byte [ebp - 4], 1
push ebx
push 1
lea ecx, [ebp - 0x74]
call fcn.2000275e
push 0xffffffffffffffff
add edi, 0x28
push esi
mov ecx, edi
call fcn.200383cf
push eax
push ebx
lea eax, [ebp - 0x74]
push eax
mov ecx, edi
call fcn.200039ea
mov byte [ebp - 4], 3
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x2c]
call fcn.20002fc3
mov byte [ebp - 4], 1
push ebx
push 1
lea ecx, [ebp - 0x74]
call fcn.2000275e
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x20070315
lea eax, [ebp - 0x28]
push eax
call fcn.200808d3
cmp dword [edi + 0x18], 0x10
pop ecx
jb 0x20070327
mov edi, dword [edi + 4]
jmp 0x2007032a
add edi, 4
mov esi, dword [ebp - 0x50]
add esi, 0xc
cmp dword [esi + 0x18], 0x10
jb 0x2007033b
mov eax, dword [esi + 4]
jmp 0x2007033e
lea eax, [esi + 4]
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x2007035d
push dword [ebp + 8]
mov ecx, dword [ebp - 0x50]
push esi
call fcn.2006fd59
mov byte [ebp - 0x49], 1
jmp 0x20070360
mov byte [ebp - 0x49], bl
mov byte [ebp - 4], bl
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.2000275e
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.2000275e
mov al, byte [ebp - 0x49]
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
pop edi
call fcn.2007c9ae
leave
ret 4
Function at 0x200706ea
Capabilities:
Get common file path

Disassembly:
mov eax, 0x200a245a
call fcn.2007d394
sub esp, 0x144
mov eax, dword [0x200cc84c]
push ebx
push esi
xor eax, ebp
mov esi, ecx
push edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x118], esi
call fcn.200706c4
xor ebx, ebx
mov dword [ebp - 4], ebx
lea ecx, [esi + 0xc]
call fcn.20002957
mov byte [ebp - 4], 1
lea ecx, [esi + 0x28]
call fcn.20002957
mov byte [ebp - 4], 2
lea edi, [esi + 0x44]
mov ecx, edi
call fcn.20002957
mov byte [ebp - 4], 3
push 0xffffffffffffffff
push ebx
push 0x200de2e8
mov ecx, edi
call fcn.20002fc3
mov ecx, esi
call fcn.200704e4
push 0x40
pop ecx
xor eax, eax
mov byte [ebp - 0x114], bl
lea edi, [ebp - 0x113]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x150]
call fcn.20003c27
mov byte [ebp - 4], 4
push str._system32drivers_tcpip.sys
push eax
lea eax, [ebp - 0x134]
push eax
call fcn.20014e68
add esp, 0xc
mov byte [ebp - 4], 5
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esi + 0xc]
call fcn.20008e33
mov byte [ebp - 4], 4
xor edi, edi
push ebx
inc edi
push edi
lea ecx, [ebp - 0x134]
call fcn.2000275e
mov byte [ebp - 4], 3
push ebx
push edi
lea ecx, [ebp - 0x150]
call fcn.2000275e
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x134]
call fcn.20003c27
mov byte [ebp - 4], 6
push str._system32_backup_tcpip.sys
push eax
lea eax, [ebp - 0x150]
push eax
call fcn.20014e68
add esp, 0xc
mov byte [ebp - 4], 7
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esi + 0x28]
call fcn.20002fc3
mov byte [ebp - 4], 6
push ebx
push edi
lea ecx, [ebp - 0x150]
call fcn.2000275e
mov byte [ebp - 4], 3
push ebx
push edi
lea ecx, [ebp - 0x134]
call fcn.2000275e
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.2007c9ae
leave
ret
Function at 0x20076019
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x200a2ad5
call fcn.2007d394
mov eax, 0x20234
call fcn.2007eb40
mov eax, dword [0x200cc84c]
push ebx
xor eax, ebp
xor ebx, ebx
cmp dword [0x200de33c], ebx
mov dword [ebp - 0x10], eax
je 0x200761a7
cmp dword [ebp + 8], ebx
je 0x200761a7
cmp dword [ebp + 0xc], ebx
je 0x200761a7
push esi
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
mov esi, 0x10000
lea eax, [ebp - 0x10230]
push esi
push eax
call fcn.20080921
add esp, 0x10
lea ecx, [ebp - 0x20234]
call fcn.200026bf
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x20234]
push eax
call fcn.20075f4e
mov dword [esp], 0x200
lea eax, [ebp - 0x230]
push ebx
push eax
call fcn.2007e690
add esp, 0xc
lea eax, [ebp - 0x20240]
push eax
call fcn.20001792
push dword [ebp + 8]
lea eax, [ebp - 0x230]
push dword [ebp - 0x20234]
push str._s_s.log
push eax
call fcn.2007d900
push esi
lea eax, [ebp - 0x20230]
push ebx
push eax
call fcn.2007e690
add esp, 0x1c
push str._Y__m__d__H:_M:_S
lea eax, [ebp - 0x20238]
push eax
lea ecx, [ebp - 0x20240]
call fcn.20004f86
mov byte [ebp - 4], 1
push dword [eax]
lea eax, [ebp - 0x30]
push 0x200a6adc
push eax
call fcn.2007d900
add esp, 0xc
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x20238]
call fcn.200026ee
lea eax, [ebp - 0x10230]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x20230]
push 0x200ab61c
push eax
call fcn.2007d900
add esp, 0x10
push ebx
push 0x80
push 4
push ebx
push ebx
push 0x40000000
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x20076197
push 2
push ebx
push ebx
push esi
mov dword [ebp - 0x20238], ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
lea eax, [ebp - 0x20238]
push eax
lea eax, [ebp - 0x20230]
push eax
call fcn.2007d3c0
pop ecx
push eax
lea eax, [ebp - 0x20230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20234]
call fcn.200026ee
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
pop ebx
call fcn.2007c9ae
leave
ret

Function at 0x2007625c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x200cc84c]
push esi
push edi
push dword [ebp + 0x14]
mov edi, dword [ebp + 8]
xor eax, ebp
mov dword [ebp - 4], eax
mov esi, ecx
mov word [ebp - 0x14], 2
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
mov eax, dword [ebp + 0x10]
push 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp + 0xc]
push edi
push dword [esi + 0x8c]
call dword [sym.imp.WS2_32.dll_sendto]
xor ecx, ecx
test eax, eax
setg cl
pop edi
pop esi
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.2007c9ae
leave
ret 0x10
Function at 0x200762f2
Capabilities:
Create udp socket
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x200cc84c]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
or dword [esi + 0x8c], 0xffffffff
xor eax, ebp
xor ebx, ebx
cmp di, bx
mov dword [ebp - 4], eax
je 0x2007631f
mov word [esi + 0x90], di
xor eax, eax
mov ax, word [esi + 0x90]
mov word [ebp - 0x14], 2
mov dword [ebp - 0x10], ebx
push eax
call dword [sym.imp.WS2_32.dll_htons]
push ebx
push 2
mov dword [ebp - 0x18], edi
mov edi, dword [sym.imp.WS2_32.dll_socket]
push 2
mov word [ebp - 0x12], ax
mov dword [ebp - 0x1c], ebx
call edi
mov ebx, dword [sym.imp.WS2_32.dll_bind]
push 0x10
lea ecx, [ebp - 0x14]
push ecx
mov dword [esi + 0x8c], eax
push eax
jmp 0x200763aa
push dword [esi + 0x8c]
call dword [sym.imp.WS2_32.dll_closesocket]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xa
jg 0x200763e6
cmp word [ebp + 8], 0
je 0x20076390
inc dword [ebp - 0x18]
push dword [ebp - 0x18]
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
push 0
push 2
push 2
call edi
mov dword [esi + 0x8c], eax
push 0x10
lea eax, [ebp - 0x14]
push eax
push dword [esi + 0x8c]
call ebx
cmp eax, 0xffffffff
je 0x20076364
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [esi + 0x8c]
mov dword [ebp - 0x18], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x200763e6
push dword [ebp - 0x12]
call dword [sym.imp.WS2_32.dll_ntohs]
mov word [esi + 0x90], ax
xor eax, eax
inc eax
jmp 0x200763fb
push dword [esi + 0x8c]
call dword [sym.imp.WS2_32.dll_closesocket]
or dword [esi + 0x8c], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.2007c9ae
leave
ret 4
Function at 0x2007eaac
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
test edi, edi
jne 0x2007eac9
call fcn.20081cdf
mov dword [eax], 0x16
xor eax, eax
jmp 0x2007eb33
push esi
push 0x8c
push 1
call fcn.2007f77b
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x2007eb1e
push esi
call fcn.20082c6d
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
pop ecx
mov dword [esi + 0x4c], edi
jne 0x2007eafc
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x2007ea17
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x2007eb32
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.2007ee22
test ebx, ebx
pop ecx
je 0x2007eb30
push ebx
call fcn.20081cf1
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x2007eb7d
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.2007eb40
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x2007ec18
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x200e0378]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x2007ec18
cmp eax, 1
je 0x2007ec39
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x2007ec18
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x2007ebe5
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x2007ec14
xor eax, eax
inc eax
jmp 0x2007ec58
cmp edi, eax
jae 0x2007ec1c
xor eax, eax
jmp 0x2007ec58
cmp eax, esi
jae 0x2007ec23
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x200e0378]
jmp 0x2007ec3c
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x2007f02a
Capabilities:
Terminate process

Disassembly:
push 8
push 0x200ae730
call fcn.2007ee94
push 8
call fcn.20083ddc
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x200e03b8], esi
jne 0x2007f05e
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x200e03b4], esi
mov al, byte [ebp + 0x10]
mov byte [0x200e03b0], al
cmp dword [ebp + 0xc], edi
jne 0x2007f0a8
cmp dword [0x200e1dcc], edi
je 0x2007f098
mov eax, dword [0x200e1dc8]
sub eax, 4
mov dword [0x200e1dc8], eax
cmp eax, dword [0x200e1dcc]
jb 0x2007f098
mov eax, dword [eax]
cmp eax, edi
je 0x2007f079
call eax
jmp 0x2007f079
push 0x200cb154
mov eax, 0x200cb14c
call fcn.2007efa8
pop ecx
push 0x200cb160
mov eax, 0x200cb158
call fcn.2007efa8
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x2007f0d9
cmp dword [ebp + 0x10], edi
jne 0x2007f0e7
mov dword [0x200e03b8], esi
push dword [ebp + 8]
call fcn.2007ef66
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x2007f0e6
push 8
call fcn.20083d27
pop ecx
ret
call fcn.2007eecf
ret

Function at 0x20080977
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 1
push esi
jne 0x20080a67
mov eax, 0x94
call fcn.2007eb40
mov esi, esp
push esi
mov dword [esi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x20080adc
mov ecx, dword [esi + 0x10]
mov dword [0x200e0378], ecx
mov eax, dword [esi + 4]
mov dword [0x200e0384], eax
mov edx, dword [esi + 8]
mov dword [0x200e0388], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
cmp ecx, 2
mov dword [0x200e037c], esi
je 0x200809e2
or esi, 0x8000
mov dword [0x200e037c], esi
shl eax, 8
add eax, edx
push 1
mov dword [0x200e0380], eax
call fcn.20084daa
test eax, eax
pop ecx
je 0x20080adc
call fcn.20082e67
test eax, eax
jne 0x20080a0f
call fcn.20084dfb
jmp 0x20080adc
call fcn.200859b8
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x200e1dc0], eax
call fcn.200891ab
mov dword [0x200e03e8], eax
call fcn.20088c8c
test eax, eax
jl 0x20080a60
call fcn.20089109
test eax, eax
jl 0x20080a5b
call fcn.20088ed6
test eax, eax
jl 0x20080a5b
push 0
call fcn.2007efc0
test eax, eax
pop ecx
jne 0x20080a5b
inc dword [0x200e03e4]
jmp 0x20080aed
call fcn.20088e8a
call fcn.20082c50
jmp 0x20080a05
test eax, eax
jne 0x20080a97
cmp dword [0x200e03e4], eax
jle 0x20080adc
dec dword [0x200e03e4]
cmp dword [0x200e03b4], eax
jne 0x20080a86
call fcn.2007f10f
call fcn.20088e8a
call fcn.20082c50
call fcn.20084dfb
jmp 0x20080aed
cmp eax, 2
jne 0x20080ae0
push 0x8c
push 1
call fcn.2007f77b
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x20080adc
push esi
push dword [0x200ccbf4]
call dword [0x200e0408]
test eax, eax
push esi
je 0x20080ad6
call fcn.20082c6d
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
or dword [esi + 4], 0xffffffff
mov dword [esi], eax
jmp 0x20080aed
call fcn.2007ee22
pop ecx
xor eax, eax
jmp 0x20080af0
cmp eax, 3
jne 0x20080aed
push 0
call fcn.20082e38
pop ecx
xor eax, eax
inc eax
lea esp, [ebp - 4]
pop esi
pop ebp
ret 0xc
Function at 0x20086d8a
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3a4]
sub esp, 0x424
mov eax, dword [0x200cc84c]
xor ecx, ecx
xor eax, ebp
cmp dword [ebp + 0x3b4], ecx
push edi
mov edi, dword [ebp + 0x3b0]
mov dword [ebp + 0x3a0], eax
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x78], ecx
jne 0x20086dc6
xor eax, eax
jmp 0x20086f30
mov eax, dword [ebp + 0x3ac]
push ebx
mov ebx, dword [ebp + 0x3ac]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x200e0a40]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x20086e04
push 2
push ecx
push ecx
push dword [ebp + 0x3ac]
call fcn.2008aaa1
add esp, 0x10
xor ecx, ecx
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x20086e9e
cmp dword [ebp + 0x3b4], ecx
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x68], ecx
jbe 0x20086f01
jmp 0x20086e28
xor ecx, ecx
mov dword [ebp - 0x6c], ecx
mov ecx, dword [ebp - 0x70]
sub ecx, dword [ebp - 0x7c]
lea eax, [ebp - 0x64]
cmp ecx, dword [ebp + 0x3b4]
jae 0x20086e63
mov edx, dword [ebp - 0x70]
inc dword [ebp - 0x70]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x20086e54
inc dword [ebp - 0x78]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 0x6c]
mov byte [eax], dl
inc eax
inc dword [ebp - 0x6c]
cmp dword [ebp - 0x6c], 0x400
jl 0x20086e34
mov edi, eax
lea eax, [ebp - 0x64]
sub edi, eax
push 0
lea eax, [ebp - 0x80]
push eax
push edi
lea eax, [ebp - 0x64]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x20086ec2
mov eax, dword [ebp - 0x80]
add dword [ebp - 0x74], eax
cmp eax, edi
jl 0x20086ecb
mov eax, dword [ebp - 0x70]
sub eax, dword [ebp - 0x7c]
cmp eax, dword [ebp + 0x3b4]
jb 0x20086e26
jmp 0x20086ecb
push ecx
lea ecx, [ebp - 0x80]
push ecx
push dword [ebp + 0x3b4]
push edi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x20086ec2
mov eax, dword [ebp - 0x80]
and dword [ebp - 0x68], 0
mov dword [ebp - 0x74], eax
jmp 0x20086ecb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x74]
test eax, eax
jne 0x20086f2b
cmp dword [ebp - 0x68], eax
je 0x20086efe
push 5
pop esi
cmp dword [ebp - 0x68], esi
jne 0x20086ef3
call fcn.20081cdf
mov dword [eax], 9
call fcn.20081ce8
mov dword [eax], esi
jmp 0x20086f26
push dword [ebp - 0x68]
call fcn.20081cf1
pop ecx
jmp 0x20086f26
mov edi, dword [ebp - 0x7c]
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x20086f13
cmp byte [edi], 0x1a
jne 0x20086f13
xor eax, eax
jmp 0x20086f2e
call fcn.20081cdf
mov dword [eax], 0x1c
call fcn.20081ce8
and dword [eax], 0
or eax, 0xffffffff
jmp 0x20086f2e
sub eax, dword [ebp - 0x78]
pop esi
pop ebx
mov ecx, dword [ebp + 0x3a0]
xor ecx, ebp
pop edi
call fcn.2007c9ae
add ebp, 0x3a4
leave
ret