joyce8/EMBER2024-capa huggingface dataset:
Function at 0x456750
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4fad60]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x1c], 8
mov eax, dword [ebp + 8]
jae 0x45676c
lea eax, [ebp + 8]
push esi
push 0
push 0x80
push 3
push 0
push 0
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
push eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov byte [ebp - 7], al
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 4
lea ecx, [ebp - 0x10]
push ecx
push esi
mov byte [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x10], 0x23535023
pop esi
jne 0x4567ea
cmp dword [ebp + 0x1c], 8
jb 0x4567d5
mov edx, dword [ebp + 8]
push edx
call fcn.00490a16
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00490a21
mov esp, ebp
pop ebp
ret 0x1c
cmp dword [ebp + 0x1c], 8
jb 0x4567fc
mov eax, dword [ebp + 8]
push eax
call fcn.00490a16
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.00490a21
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x457250
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cb4f0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4fad60]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov eax, dword [edi + 0x3c]
mov ecx, dword [edi + 0x38]
lea esi, [edi + 0x38]
push eax
push ecx
lea eax, [ebp - 0x1c]
push eax
xor ebx, ebx
push esi
mov dword [ebp - 0x14], ebx
call fcn.00458b40
mov ecx, dword [esi + 0x14]
mov edx, dword [ecx + 4]
push edx
lea ecx, [esi + 0x10]
call fcn.00407cc0
mov eax, dword [esi + 0x14]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x14]
mov dword [eax], eax
mov eax, dword [esi + 0x14]
mov dword [eax + 8], eax
mov dword [esi + 0x18], ebx
or eax, 0xffffffff
xor ecx, ecx
mov esi, edi
call fcn.00404150
lea esi, [edi + 0x1c]
or eax, 0xffffffff
xor ecx, ecx
call fcn.00404150
mov eax, dword [ebp + 8]
mov dword [ebp - 4], ebx
cmp dword [eax + 0x14], 8
jb 0x4572e1
mov eax, dword [eax]
push ebx
push 0x80
push 3
push ebx
push 3
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x1c], esi
cmp esi, 0xffffffff
je 0x4573ac
push 2
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, eax
test ebx, ebx
js 0x4573a5
je 0x45736b
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
mov dword [ebp - 0x18], 0
call fcn.0048d7af
add esp, 4
push 0
lea ecx, [ebp - 0x18]
push ecx
push ebx
push eax
push esi
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x457399
mov eax, dword [ebp - 0x18]
cmp ebx, eax
jne 0x457399
mov ebx, dword [ebp - 0x14]
push eax
push ebx
push edi
call fcn.00456810
push ebx
call fcn.00491285
add esp, 4
push esi
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp + 8]
mov ecx, edi
call fcn.00456d80
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [ebp - 0x14]
push edx
call fcn.00491285
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4573f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c9468
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4fad60]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov edi, ecx
xor ebx, ebx
lea ecx, [edi + 0x38]
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 4], ebx
call fcn.00454a00
mov esi, eax
mov dword [ebp - 0x34], esi
test esi, esi
jle 0x45746c
push esi
call fcn.0048d7af
add esp, 4
push esi
mov ebx, eax
push 0
push ebx
mov dword [ebp - 0x40], ebx
call fcn.00497ad0
add esp, 0xc
push ebx
lea ecx, [edi + 0x38]
call fcn.00454c00
mov eax, dword [ebp - 0x3c]
cmp dword [eax + 0x14], 8
jb 0x457477
mov eax, dword [eax]
push 0
push 0x80
push 2
push 0
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x38], eax
cmp eax, 0xffffffff
jne 0x4574c5
test ebx, ebx
je 0x4574a5
push ebx
call fcn.00491285
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00490a21
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 0x1c], 0xf
mov dword [ebp - 0x20], 0
mov byte [ebp - 0x30], 0
mov eax, ebx
mov byte [ebp - 4], 1
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4574e0
sub eax, edx
mov edi, eax
mov eax, ebx
lea esi, [ebp - 0x30]
call fcn.00403cd0
mov edi, dword [ebp - 0x34]
test edi, edi
jle 0x45755c
cmp dword [ebp - 0x1c], 0x10
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], 0
jae 0x45750e
mov eax, esi
mov esi, dword [ebp - 0x38]
push 0
lea ecx, [ebp - 0x34]
push ecx
push edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x457534
cmp edi, dword [ebp - 0x34]
jne 0x457534
push ebx
call fcn.00491285
add esp, 4
jmp 0x45755f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call fcn.00491285
add esp, 4
cmp dword [ebp - 0x1c], 0x10
jb 0x4574a5
mov edx, dword [ebp - 0x30]
push edx
call fcn.00490a16
jmp 0x4574a2
mov esi, dword [ebp - 0x38]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x1c], 0x10
jb 0x457578
mov eax, dword [ebp - 0x30]
push eax
call fcn.00490a16
add esp, 4
mov ebx, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 0x1c], 0xf
mov dword [ebp - 0x20], 0
mov byte [ebp - 0x30], 0
mov dword [ebp - 4], 0xffffffff
call fcn.00456d80
mov al, 1
jmp 0x4574a7
Function at 0x45b110
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, eax
mov esi, ecx
xor eax, eax
jmp 0x45b120
mov edx, eax
sar edx, 3
mov dl, byte [edx + esi]
mov cl, al
and cl, 7
sar dl, cl
inc eax
and dl, 1
mov byte [eax + 0x50631f], dl
cmp eax, 0x40
jl 0x45b120
xor eax, eax
movsx ecx, byte [eax + 0x4e20b0]
movzx edx, byte [ecx + 0x50631f]
movsx ecx, byte [eax + 0x4e20b1]
mov byte [eax + 0x500d30], dl
movzx edx, byte [ecx + 0x50631f]
movsx ecx, byte [eax + 0x4e20b2]
mov byte [eax + 0x500d31], dl
movzx edx, byte [ecx + 0x50631f]
movsx ecx, byte [eax + 0x4e20b3]
mov byte [eax + 0x500d32], dl
movzx edx, byte [ecx + 0x50631f]
mov byte [eax + 0x500d33], dl
add eax, 4
cmp eax, 0x40
jl 0x45b140
push ebx
push 0x40
push 0x500d30
push 0x506320
call fcn.00498770
add esp, 0xc
cmp byte [ebp + 0xc], 0
jne 0x45b23a
mov ebx, edi
mov dword [ebp + 0xc], 0x10
mov ecx, 8
mov esi, 0x506340
mov edi, 0x5067a8
rep movsd dword es:[edi], dword [esi]
mov edi, ebx
mov esi, 0x506340
call fcn.0045b530
xor eax, eax
nop
movzx ecx, byte [eax + 0x506320]
movzx edx, byte [eax + 0x506321]
xor byte [eax + 0x506340], cl
xor byte [eax + 0x506341], dl
movzx ecx, byte [eax + 0x506322]
movzx edx, byte [eax + 0x506323]
xor byte [eax + 0x506342], cl
xor byte [eax + 0x506343], dl
add eax, 4
cmp eax, 0x20
jl 0x45b1e0
mov ecx, 8
mov esi, 0x5067a8
mov edi, 0x506320
add ebx, 0x30
dec dword [ebp + 0xc]
rep movsd dword es:[edi], dword [esi]
jne 0x45b1c0
jmp 0x45b2cb
mov dword [ebp + 0xc], 0xf
lea ebx, [edi + 0x2d0]
jmp 0x45b250
mov ecx, 8
mov esi, 0x506320
mov edi, 0x5067a8
rep movsd dword es:[edi], dword [esi]
mov edi, ebx
mov esi, 0x506320
call fcn.0045b530
xor eax, eax
nop
movzx ecx, byte [eax + 0x506340]
movzx edx, byte [eax + 0x506341]
xor byte [eax + 0x506320], cl
xor byte [eax + 0x506321], dl
movzx ecx, byte [eax + 0x506342]
movzx edx, byte [eax + 0x506343]
xor byte [eax + 0x506322], cl
xor byte [eax + 0x506323], dl
add eax, 4
cmp eax, 0x20
jl 0x45b270
mov eax, dword [ebp + 0xc]
dec eax
mov ecx, 8
mov esi, 0x5067a8
mov edi, 0x506340
sub ebx, 0x30
rep movsd dword es:[edi], dword [esi]
mov dword [ebp + 0xc], eax
test eax, eax
jns 0x45b250
xor eax, eax
pop ebx
mov edi, edi
movsx ecx, byte [eax + 0x4e20f0]
movzx edx, byte [ecx + 0x50631f]
movsx ecx, byte [eax + 0x4e20f1]
mov byte [eax + 0x500d30], dl
movzx edx, byte [ecx + 0x50631f]
movsx ecx, byte [eax + 0x4e20f2]
mov byte [eax + 0x500d31], dl
movzx edx, byte [ecx + 0x50631f]
movsx ecx, byte [eax + 0x4e20f3]
mov byte [eax + 0x500d32], dl
movzx edx, byte [ecx + 0x50631f]
mov byte [eax + 0x500d33], dl
add eax, 4
cmp eax, 0x40
jl 0x45b2d0
push 0x40
push 0x500d30
push 0x506320
call fcn.00498770
mov esi, dword [ebp + 8]
add esp, 0xc
mov edi, 0x506320
call fcn.0045b800
pop edi
pop esi
pop ebp
ret
Function at 0x45b350
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, eax
push edi
xor eax, eax
lea ebx, [ebx]
mov edx, eax
sar edx, 3
mov dl, byte [edx + esi]
mov cl, al
and cl, 7
sar dl, cl
inc eax
and dl, 1
mov byte [eax + 0x5062df], dl
cmp eax, 0x40
jl 0x45b360
xor eax, eax
movsx ecx, byte [eax + str.91__]
movzx edx, byte [ecx + 0x5062df]
movsx ecx, byte [eax + 0x4e2181]
mov byte [eax + 0x500d30], dl
movzx edx, byte [ecx + 0x5062df]
movsx ecx, byte [eax + 0x4e2182]
mov byte [eax + 0x500d31], dl
movzx edx, byte [ecx + 0x5062df]
movsx ecx, byte [eax + 0x4e2183]
mov byte [eax + 0x500d32], dl
movzx edx, byte [ecx + 0x5062df]
mov byte [eax + 0x500d33], dl
add eax, 4
cmp eax, 0x38
jl 0x45b380
push 0x38
push 0x500d30
push 0x5062e0
call fcn.00498770
mov ebx, dword [ebp + 8]
add esp, 0xc
xor edi, edi
movsx esi, byte [edi + 0x4e21e8]
push esi
push 0x5062e0
push 0x500d30
call fcn.00498770
mov eax, 0x1c
sub eax, esi
push eax
lea ecx, [esi + 0x5062e0]
push ecx
push 0x5062e0
call fcn.00498770
push esi
mov edx, 0x5062fc
sub edx, esi
push 0x500d30
push edx
call fcn.00498770
movsx esi, byte [edi + 0x4e21e8]
push esi
push 0x5062fc
push 0x500d30
call fcn.00498770
mov eax, 0x1c
sub eax, esi
push eax
lea ecx, [esi + 0x5062fc]
push ecx
push 0x5062fc
call fcn.00498770
push esi
mov edx, 0x506318
sub edx, esi
push 0x500d30
push edx
call fcn.00498770
add esp, 0x48
xor eax, eax
lea esp, [esp]
movsx ecx, byte [eax + 0x4e21b8]
movzx edx, byte [ecx + 0x5062df]
movsx ecx, byte [eax + 0x4e21b9]
mov byte [eax + 0x500d30], dl
movzx edx, byte [ecx + 0x5062df]
movsx ecx, byte [eax + 0x4e21ba]
mov byte [eax + 0x500d31], dl
movzx edx, byte [ecx + 0x5062df]
movsx ecx, byte [eax + 0x4e21bb]
mov byte [eax + 0x500d32], dl
movzx edx, byte [ecx + 0x5062df]
movsx ecx, byte [eax + 0x4e21bc]
mov byte [eax + 0x500d33], dl
movzx edx, byte [ecx + 0x5062df]
movsx ecx, byte [eax + 0x4e21bd]
mov byte [eax + 0x500d34], dl
movzx edx, byte [ecx + 0x5062df]
mov byte [eax + 0x500d35], dl
add eax, 6
cmp eax, 0x30
jl 0x45b480
push 0x30
push 0x500d30
push ebx
call fcn.00498770
inc edi
add esp, 0xc
add ebx, 0x30
cmp edi, 0x10
jl 0x45b3f1
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x45b530
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
xor eax, eax
movsx ecx, byte [eax + 0x4e2130]
movzx edx, byte [ecx + esi - 1]
movsx ecx, byte [eax + 0x4e2131]
mov byte [eax + 0x500d30], dl
movzx edx, byte [ecx + esi - 1]
movsx ecx, byte [eax + 0x4e2132]
mov byte [eax + 0x500d31], dl
movzx edx, byte [ecx + esi - 1]
movsx ecx, byte [eax + 0x4e2133]
mov byte [eax + 0x500d32], dl
movzx edx, byte [ecx + esi - 1]
movsx ecx, byte [eax + 0x4e2134]
mov byte [eax + 0x500d33], dl
movzx edx, byte [ecx + esi - 1]
movsx ecx, byte [eax + 0x4e2135]
mov byte [eax + 0x500d34], dl
movzx edx, byte [ecx + esi - 1]
mov byte [eax + 0x500d35], dl
add eax, 6
cmp eax, 0x30
jl 0x45b532
push 0x30
push 0x500d30
push 0x506778
call fcn.00498770
mov ecx, edi
add esp, 0xc
xor eax, eax
sub ecx, 0x506778
jmp 0x45b5d0
movzx edx, byte [ecx + eax + 0x506778]
xor byte [eax + 0x506778], dl
movzx edx, byte [edi + eax + 1]
xor byte [eax + 0x506779], dl
movzx edx, byte [edi + eax + 2]
xor byte [eax + 0x50677a], dl
movzx edx, byte [edi + eax + 3]
xor byte [eax + 0x50677b], dl
movzx edx, byte [edi + eax + 4]
xor byte [eax + 0x50677c], dl
movzx edx, byte [edi + eax + 5]
xor byte [eax + 0x50677d], dl
add eax, 6
cmp eax, 0x30
jl 0x45b5d0
mov ecx, esi
call fcn.0045b6a0
xor eax, eax
jmp 0x45b630
movsx ecx, byte [eax + 0x4e2160]
movzx edx, byte [ecx + esi - 1]
movsx ecx, byte [eax + 0x4e2161]
mov byte [eax + 0x500d30], dl
movzx edx, byte [ecx + esi - 1]
movsx ecx, byte [eax + 0x4e2162]
mov byte [eax + 0x500d31], dl
movzx edx, byte [ecx + esi - 1]
movsx ecx, byte [eax + 0x4e2163]
mov byte [eax + 0x500d32], dl
movzx edx, byte [ecx + esi - 1]
mov byte [eax + 0x500d33], dl
add eax, 4
cmp eax, 0x20
jl 0x45b630
push 0x20
push 0x500d30
push esi
call fcn.00498770
add esp, 0xc
ret
Function at 0x45bc70
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cb48b
mov eax, dword fs:[0]
push eax
sub esp, 0x124
mov eax, dword [0x4fad60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor esi, esi
cmp dword [edi], esi
je 0x45be7e
mov dword [ebp - 0x12c], esi
mov dword [ebp - 0x128], esi
mov dword [ebp - 0x124], esi
lea ecx, [ebp - 0x12c]
mov dword [ebp - 4], esi
call fcn.0045cf20
mov ecx, dword [ebp - 0x128]
sub ecx, dword [ebp - 0x12c]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
cmp ebx, 0xa
jbe 0x45bd45
mov eax, dword [edi]
cmp eax, esi
je 0x45bcfd
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], esi
cmp dword [edi + 0x1c], 8
lea eax, [edi + 8]
jb 0x45bd08
mov eax, dword [eax]
push eax
mov eax, ebx
shl eax, 8
add eax, 4
push eax
push esi
push 4
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [edi], eax
cmp eax, esi
jne 0x45bd45
mov ebx, dword [ebp - 0x12c]
cmp ebx, esi
je 0x45be7e
mov edi, dword [ebp - 0x128]
mov eax, ebx
call fcn.0041d5d0
push ebx
jmp 0x45be76
mov ecx, dword [edi]
push esi
push esi
push esi
push 2
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
lea edx, [eax + 4]
mov dword [ebp - 0x130], eax
mov dword [eax], ebx
mov dword [ebp - 0x118], edx
mov dword [ebp - 0x11c], esi
cmp ebx, esi
jbe 0x45be2b
mov edi, dword [ebp - 0x12c]
mov dword [ebp - 0x114], edi
jmp 0x45bd86
mov edi, dword [ebp - 0x114]
push 0xff
lea eax, [ebp - 0x10f]
push esi
push eax
mov byte [ebp - 0x110], 0
call fcn.00497ad0
add esp, 0xc
cmp ebx, dword [ebp - 0x11c]
jbe 0x45be9a
cmp dword [edi + 0x14], 8
jb 0x45bdb8
mov esi, dword [edi]
jmp 0x45bdba
mov esi, edi
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
push 0
push 0
call edi
test eax, eax
je 0x45bdea
push 0
push 0
push eax
lea ecx, [ebp - 0x110]
push ecx
push 0xffffffffffffffff
push esi
push 0
push 0
call edi
mov edi, dword [ebp - 0x118]
mov eax, dword [ebp - 0x11c]
add dword [ebp - 0x118], 0x100
add dword [ebp - 0x114], 0x1c
mov ecx, 0x40
lea esi, [ebp - 0x110]
inc eax
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov dword [ebp - 0x11c], eax
cmp eax, ebx
jb 0x45bd80
mov eax, dword [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x12c]
cmp eax, esi
je 0x45be7e
mov edi, dword [ebp - 0x128]
mov ebx, eax
cmp eax, edi
je 0x45be75
cmp dword [ebx + 0x14], 8
jb 0x45be5f
mov edx, dword [ebx]
push edx
call fcn.00490a16
mov eax, dword [ebp - 0x12c]
add esp, 4
xor ecx, ecx
mov dword [ebx + 0x14], 7
mov dword [ebx + 0x10], esi
mov word [ebx], cx
add ebx, 0x1c
cmp ebx, edi
jne 0x45be48
push eax
call fcn.00490a16
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00490a21
mov esp, ebp
pop ebp
ret
push str.invalid_vector_T__subscript
call fcn.0048d5e5
int3
Function at 0x45beb0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c54db
mov eax, dword fs:[0]
push eax
sub esp, 0x134
mov eax, dword [0x4fad60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edi, edi
mov dword [ebp - 0x13c], ecx
cmp eax, edi
je 0x45c01a
push edi
push edi
push edi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [eax]
lea esi, [eax + 4]
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x130], esi
cmp ecx, edi
jbe 0x45c013
lea ebx, [ebp - 0x110]
sub ebx, esi
mov dword [ebp - 0x134], ecx
jmp 0x45bf38
mov esi, dword [ebp - 0x130]
xor edi, edi
push 0xff
lea edx, [ebp - 0x10f]
push edi
push edx
mov byte [ebp - 0x110], 0
call fcn.00497ad0
add esp, 0xc
mov eax, esi
mov cl, byte [eax]
mov byte [ebx + eax], cl
inc eax
test cl, cl
jne 0x45bf56
xor eax, eax
mov dword [ebp - 0x118], 7
mov dword [ebp - 0x11c], edi
mov word [ebp - 0x12c], ax
lea ecx, [ebp - 0x12c]
push ecx
sub esp, 0x1c
mov dword [ebp - 4], edi
mov esi, esp
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], 0xf
mov byte [esi], al
lea eax, [ebp - 0x110]
mov dword [ebp - 0x140], esp
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x45bfa3
sub eax, edi
mov edi, eax
lea eax, [ebp - 0x110]
call fcn.00403cd0
call fcn.0044c520
mov edi, dword [ebp - 0x13c]
add esp, 0x20
lea ecx, [ebp - 0x12c]
call fcn.0041c120
add dword [ebp - 0x130], 0x100
sub ebx, 0x100
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x118], 8
jb 0x45c001
mov edx, dword [ebp - 0x12c]
push edx
call fcn.00490a16
add esp, 4
dec dword [ebp - 0x134]
jne 0x45bf30
mov eax, dword [ebp - 0x138]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00490a21
mov esp, ebp
pop ebp
ret 4

Function at 0x45e1d0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x4fad60]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x11c
xor esi, esi
lea eax, [ebp - 0x120]
push esi
push eax
call fcn.00497ad0
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0xc
lea ecx, [ebp - 0x120]
push ecx
mov dword [ebp - 0x120], 0x11c
call edi
test eax, eax
jne 0x45e240
lea edx, [ebp - 0x120]
push edx
mov dword [ebp - 0x120], 0x114
call edi
test eax, eax
jne 0x45e240
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00490a21
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x110]
dec eax
je 0x45e28b
dec eax
jne 0x45e290
cmp dword [ebp - 0x11c], 5
jne 0x45e274
cmp dword [ebp - 0x118], esi
jne 0x45e274
mov esi, 2
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00490a21
mov esp, ebp
pop ebp
ret
mov esi, 1
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00490a21
mov esp, ebp
pop ebp
ret
mov esi, 3
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00490a21
mov esp, ebp
pop ebp
ret
Function at 0x45eba0
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c42e8
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x4fad60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
push 0x170
mov dword [ebp - 0x7c], eax
call fcn.00490dc4
mov edi, dword [sym.imp.IPHLPAPI.DLL_GetAdaptersAddresses]
add esp, 4
lea ecx, [ebp - 0x74]
push ecx
mov esi, eax
push esi
xor ebx, ebx
push ebx
push ebx
push 2
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x74], ebx
call edi
cmp eax, 0x6f
jne 0x45ec15
push esi
call fcn.00490a16
mov edx, dword [ebp - 0x74]
push edx
call fcn.00496f1b
add esp, 8
mov dword [ebp - 0x70], eax
mov esi, eax
lea eax, [ebp - 0x74]
push eax
push esi
push ebx
push ebx
push 2
call edi
cmp eax, ebx
jne 0x45ed8b
cmp esi, ebx
je 0x45ed8b
or ecx, 0xffffffff
mov eax, ecx
jmp 0x45ec3a
mov esi, dword [ebp - 0x70]
cmp dword [esi + 0x34], ebx
jbe 0x45ec59
mov edi, 0xf
inc eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], ebx
mov byte [ebp - 0x34], bl
mov dword [ebp - 4], ebx
cmp eax, dword [ebp + 8]
je 0x45ec68
mov dword [ebp - 4], ecx
mov esi, dword [esi + 8]
mov dword [ebp - 0x70], esi
cmp esi, ebx
jne 0x45ec37
jmp 0x45ed8b
mov dword [ebp - 0x78], ebx
cmp dword [esi + 0x34], ebx
jbe 0x45ed62
jmp 0x45ec83
mov esi, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x78]
movzx edx, byte [esi + ecx + 0x2c]
push edx
push str._02X
lea eax, [ebp - 0x18]
push 5
push eax
call fcn.00493d3a
add esp, 0x10
cmp dword [ebp - 0x24], ebx
jne 0x45ecc8
lea eax, [ebp - 0x18]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x45ecb0
sub eax, edx
mov edi, eax
lea eax, [ebp - 0x18]
lea esi, [ebp - 0x34]
call fcn.00403cd0
jmp 0x45ed44
mov edi, 1
mov eax, 0x4e5b60
lea esi, [ebp - 0x50]
mov dword [ebp - 0x3c], 0xf
mov dword [ebp - 0x40], ebx
mov byte [ebp - 0x50], bl
call fcn.00403cd0
mov ecx, esi
push ecx
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 1
call fcn.00430930
add esp, 4
push ebx
push eax
or eax, 0xffffffff
lea esi, [ebp - 0x34]
mov byte [ebp - 4], 2
call fcn.00429d70
mov esi, 0x10
cmp dword [ebp - 0x58], esi
jb 0x45ed23
mov edx, dword [ebp - 0x6c]
push edx
call fcn.00490a16
add esp, 4
mov byte [ebp - 4], bl
mov dword [ebp - 0x58], 0xf
mov dword [ebp - 0x5c], ebx
mov byte [ebp - 0x6c], bl
cmp dword [ebp - 0x3c], esi
jb 0x45ed44
mov eax, dword [ebp - 0x50]
push eax
call fcn.00490a16
add esp, 4
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x78], eax
cmp eax, dword [ecx + 0x34]
jb 0x45ec80
mov edi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
cmp edi, 0x10
jae 0x45ed65
lea eax, [ebp - 0x34]
mov edx, dword [ebp - 0x7c]
sub edx, eax
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x45ed70
cmp edi, 0x10
jb 0x45ed8b
mov edx, dword [ebp - 0x34]
push edx
call fcn.00490a16
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00490a21
mov esp, ebp
pop ebp
ret