joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1006f2e1
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1006f25d
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x1006f459
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x1006f459
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x1006f408
jg 0x1006f33a
test eax, eax
je 0x1006f3fe
push 1
push 0x1000
call fcn.10061ea6
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x1006f360
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x1006f3f5
push 0x8000
push ebx
call fcn.1006f18e
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x1006f38c
jg 0x1006f387
cmp ecx, 0x1000
jb 0x1006f38c
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.10061728
add esp, 0x10
cmp eax, 0xffffffff
je 0x1006f3d1
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x1006f387
jl 0x1006f3b8
test ecx, ecx
jne 0x1006f379
push dword [ebp - 0xc]
push ebx
call fcn.1006f18e
push esi
call fcn.10061928
add esp, 0xc
xor edi, edi
jmp 0x1006f46a
cmp byte [edi + 0x24], 0
je 0x1006f3e8
cmp dword [edi + 0x20], 5
jne 0x1006f3e8
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x1006f3f3
mov edi, dword [edi + 0x18]
jmp 0x1006f3f5
xor edi, edi
push esi
call fcn.10061928
pop ecx
jmp 0x1006f46a
test ecx, ecx
jg 0x1006f3ca
jl 0x1006f408
test eax, eax
jae 0x1006f3ca
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.10064dbd
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x1006f42b
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x1006f3ca
jmp 0x1006f462
push ebx
call fcn.10068ee2
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1006f3ca
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x1006f46a
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x1006f467
mov edi, dword [edi + 0x18]
jmp 0x1006f46a
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.10064dbd
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10070a70
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10070a9d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10070a9d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0xff2058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00ff21a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xff207e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xff206a
add dl, dl
jne 0xff2089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xff20dc
xor eax, eax
add dl, dl
jne 0xff2096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xff217d
add dl, dl
jne 0xff20a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xff20b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xff20bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xff20c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xff20d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xff2075
mov eax, 1
add dl, dl
jne 0xff20ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xff20f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xff20e1
sub eax, ebx
mov ebx, 1
jne 0xff2128
mov ecx, 1
add dl, dl
jne 0xff210e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xff2119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xff2105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xff2075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xff213f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xff214a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xff2136
cmp eax, 0x7d00
jae 0xff216d
cmp eax, 0x500
jb 0xff2168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xff2075
cmp eax, 0x7f
ja 0xff2170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xff2075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xff219e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xff2075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4018d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.0046f710
mov eax, dword [0x4bb874]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0x100
push 0x20
push 0
push eax
lea eax, [ebp - 0x1008]
push eax
call fcn.00471528
add esp, 0x14
test eax, eax
je 0x401918
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046e4f8
mov esp, ebp
pop ebp
ret
push esi
push 0xc
push 1
call fcn.0046ea8c
mov esi, eax
add esp, 8
test esi, esi
je 0x401952
push 0x20
mov dword [esi + 8], 0x20
mov dword [esi + 4], 0
call fcn.0046eacc
add esp, 4
mov dword [esi], eax
test eax, eax
jne 0x401964
push esi
call fcn.0046de39
add esp, 4
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046e4f8
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x1008]
push edi
push 0x1000
lea ecx, [ebp - 0x1004]
push ecx
push edx
call fcn.00470c3a
mov edi, eax
add esp, 0xc
test edi, edi
jle 0x4019fc
push ebx
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
mov edx, eax
sub edx, ecx
cmp edx, edi
jg 0x4019b8
add eax, eax
lea ecx, [ecx + edi + 8]
mov ebx, eax
cmp eax, ecx
jg 0x4019a3
mov ebx, ecx
mov eax, dword [esi]
push ebx
push eax
call fcn.00471e79
add esp, 8
test eax, eax
je 0x4019da
mov dword [esi + 8], ebx
mov dword [esi], eax
mov edx, dword [esi + 4]
add edx, dword [esi]
push edi
lea ecx, [ebp - 0x1004]
push ecx
push edx
call fcn.00474760
mov ecx, dword [esi]
add esp, 0xc
add dword [esi + 4], edi
mov eax, dword [esi + 4]
mov byte [eax + ecx], 0
mov eax, dword [ebp - 0x1008]
push 0x1000
lea edx, [ebp - 0x1004]
push edx
push eax
call fcn.00470c3a
mov edi, eax
add esp, 0xc
test edi, edi
jg 0x401987
pop ebx
mov ecx, dword [ebp - 0x1008]
push ecx
call fcn.00471db5
add esp, 4
test edi, edi
jns 0x401a33
mov edx, dword [esi]
push edx
call fcn.0046de39
push esi
call fcn.0046de39
add esp, 8
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046e4f8
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
push eax
call fcn.004021e0
mov ecx, dword [esi]
push ecx
mov edi, eax
call fcn.0046de39
push esi
call fcn.0046de39
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0046e4f8
mov esp, ebp
pop ebp
ret
Function at 0x428c80
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x485224
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4bb874]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
mov dword [esi], 0x48c380
mov eax, dword [edi]
sub eax, 0x10
push eax
mov dword [ebp - 4], 1
call fcn.0041b5c3
add eax, 0x10
mov dword [esi + 4], eax
mov eax, dword [edi + 4]
sub eax, 0x10
push eax
mov byte [ebp - 4], 2
call fcn.0041b5c3
add eax, 0x10
mov dword [esi + 8], eax
mov eax, dword [edi + 8]
sub eax, 0x10
push eax
mov byte [ebp - 4], 3
call fcn.0041b5c3
add eax, 0x10
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0xc]
sub eax, 0x10
push eax
mov byte [ebp - 4], 4
call fcn.0041b5c3
add eax, 0x10
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x10]
sub eax, 0x10
push eax
mov byte [ebp - 4], 5
call fcn.0041b5c3
add eax, 0x10
mov dword [esi + 0x14], eax
mov edi, dword [edi + 0x1c]
sub edi, 0x10
push edi
mov byte [ebp - 4], 6
call fcn.0041b5c3
add eax, 0x10
add esp, 0x18
mov dword [esi + 0x18], eax
lea eax, [ebp + 0xc]
push eax
lea ecx, [esi + 0x1c]
mov byte [ebp - 4], 7
call fcn.004286b0
xor ebx, ebx
mov dword [esi + 0x2c], ebx
lea ecx, [ebp + 0x1c]
push ecx
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 9
call fcn.004286b0
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov ecx, esi
mov byte [ebp - 4], 0xd
call fcn.00428a00
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], bl
cmp eax, ebx
je 0x428d99
mov edx, dword [ebp + 0x10]
push edx
push eax
lea ecx, [ebp + 0xc]
call fcn.0041fdd0
mov eax, dword [ebp + 0xc]
push eax
call fcn.0046dbca
add esp, 4
mov eax, dword [ebp + 0x1c]
mov dword [ebp + 0xc], ebx
mov dword [ebp + 0x10], ebx
mov dword [ebp + 0x14], ebx
mov dword [ebp - 4], 0xffffffff
cmp eax, ebx
je 0x428dc9
mov ecx, dword [ebp + 0x20]
push ecx
push eax
lea ecx, [ebp + 0x1c]
call fcn.0041fdd0
mov edx, dword [ebp + 0x1c]
push edx
call fcn.0046dbca
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24
Function at 0x42d3a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x485ad5
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x4bb874]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.0041b5c3
add eax, 0x10
mov dword [esi], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
sub eax, 0x10
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.0041b5c3
add eax, 0x10
mov dword [esi + 4], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx]
sub eax, 0x10
push eax
mov byte [ebp - 4], 1
call fcn.0041b5c3
add eax, 0x10
add esp, 0xc
mov dword [esi + 8], eax
lea edi, [esi + 0xc]
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
lea ecx, [esi + 0x1c]
mov byte [ebp - 4], 3
call fcn.0042e9a0
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 4
call fcn.0042e9a0
lea ecx, [esi + 0x44]
mov byte [ebp - 4], 5
call fcn.0042e9a0
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 6
call fcn.0042b3d0
mov eax, dword [esi]
mov byte [ebp - 4], 7
cmp dword [eax - 0xc], ebx
je 0x42d580
mov ecx, dword [esi + 4]
cmp dword [ecx - 0xc], ebx
je 0x42d580
lea edx, [ebp + 0x10]
push edx
mov ecx, 0x4bdbb0
call fcn.00462960
mov eax, dword [ebp + 0x10]
mov eax, dword [eax - 0xc]
mov byte [ebp - 4], 8
cmp eax, ebx
je 0x42d55d
push 2
push 0x48d4ec
push ebx
call fcn.0041cde0
mov ecx, eax
call fcn.0041ea00
mov ecx, esi
call fcn.0042cde0
test eax, eax
je 0x42d55d
mov eax, dword [ebp + 0x10]
add eax, 0xfffffff0
push eax
call fcn.0041b5c3
add eax, 0x10
add esp, 4
mov dword [ebp + 0xc], eax
push 0x48be1c
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 9
call fcn.0041e740
push 0x48d4c8
lea ecx, [ebp + 0xc]
call fcn.0041e740
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
lea ecx, [ebp + 0xc]
push ecx
mov bl, 0xa
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], bl
call fcn.00427270
sub esp, 0x10
lea edx, [ebp - 0x20]
mov ecx, esp
mov dword [ebp + 8], esp
push edx
call fcn.004286b0
lea ecx, [ebp - 0x30]
call fcn.004202d0
push edi
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0xb
call fcn.004200a0
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], bl
call fcn.0041fd70
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 9
call fcn.00453bf0
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
mov byte [ebp - 4], 8
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42d55d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp + 0x10]
add eax, 0xfffffff0
mov byte [ebp - 4], 7
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42d580
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4315f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x486328
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4bb874]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
xor edi, edi
push 0x4ab2fc
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x18], edi
call fcn.0041ac6d
mov ebx, dword [ebp + 0xc]
push ebx
mov ecx, esi
mov dword [ebp - 4], edi
call fcn.00430090
mov edi, eax
test edi, edi
jle 0x4317b2
xor ecx, ecx
lea eax, [edi + 1]
mov edx, 2
mul edx
seto cl
mov byte [ebp - 4], 1
neg ecx
or ecx, eax
push ecx
call fcn.0046dae2
mov ebx, dword [ebx]
add esp, 4
push 0x48d858
mov esi, eax
lea eax, [ebp - 0x18]
push ebx
push eax
mov dword [ebp - 4], 0
call fcn.0046f04e
add esp, 0xc
test eax, eax
je 0x4316a2
push esi
call fcn.0046e690
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
push eax
call fcn.0041b5c3
add esp, 8
jmp 0x4317c1
mov ecx, dword [ebp - 0x18]
push ecx
push edi
push 2
push esi
call fcn.0046feb6
xor edx, edx
mov word [esi + edi*2], dx
mov eax, dword [ebp - 0x18]
push eax
call fcn.0046ee10
add esp, 0x14
push esi
lea ecx, [ebp + 0xc]
call fcn.0041ac6d
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.0041b16a
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4316fa
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push esi
call fcn.0046e690
mov ecx, dword [ebp - 0x14]
add esp, 4
cmp dword [ecx - 0xc], 0
jge 0x431711
or esi, 0xffffffff
jmp 0x431731
push 0x4ab4b4
push ecx
call fcn.0046f0f3
mov ecx, dword [ebp - 0x14]
add esp, 8
test eax, eax
jne 0x43172b
or esi, 0xffffffff
jmp 0x431731
sub eax, ecx
sar eax, 1
mov esi, eax
cmp dword [ecx - 0xc], 0
jge 0x43173c
or eax, 0xffffffff
jmp 0x431758
push 0x48d838
push ecx
call fcn.0046f0f3
add esp, 8
test eax, eax
jne 0x431753
or eax, 0xffffffff
jmp 0x431758
sub eax, dword [ebp - 0x14]
sar eax, 1
test esi, esi
js 0x4317a3
test eax, eax
js 0x4317a3
add eax, 0xf
push eax
push esi
lea ecx, [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x14]
call fcn.0041aead
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 4
call fcn.0041b16a
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4317b2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x4317b2
push 0
push 0x4ab2fc
lea ecx, [ebp - 0x14]
call fcn.0041b4d5
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
push eax
call fcn.0041b5c3
add esp, 4
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4317ef
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x433b90
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x486489
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4bb874]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [0x48b518]
xor ebx, ebx
mov dword [esi + 4], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], eax
mov dword [esi], 0x48d964
mov dword [esi + 0x34], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
push 0x432850
push 0x432840
push 2
push 0x14
lea edi, [esi + 0x278]
push edi
mov byte [ebp - 4], 3
call fcn.0046f69c
mov dword [esi + 0x2b0], ebx
mov dword [esi + 0x2b4], ebx
mov dword [esi + 0x2b8], ebx
mov dword [esi + 0x2bc], ebx
mov dword [esi + 0x2c0], ebx
mov dword [esi + 0x2c4], ebx
and byte [esi + 0x38], 0xfe
xor eax, eax
mov dword [esi + 0x24], 1
mov dword [esi + 0x260], eax
mov dword [esi + 0x264], eax
mov dword [esi + 0x268], eax
mov dword [esi + 0x26c], eax
mov dword [esi + 0x270], eax
mov dword [esi + 0x274], eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], eax
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], eax
mov cl, byte [esi + 0x38]
mov edi, dword [0x48b514]
and byte [esi + 0x39], 0xf1
and cl, 0x1f
or cl, 0x60
push 0xf
mov dword [esi + 0x28], ebx
mov byte [esi + 0x38], cl
call edi
push 0x12
mov dword [esi + 0x48], eax
call edi
push 0xf
mov dword [esi + 0x4c], eax
call edi
push 0x12
mov dword [esi + 0x50], eax
call edi
and byte [esi + 0x38], 0xfd
push 0x208
lea edx, [esi + 0x58]
push ebx
mov dword [esi + 0x54], eax
mov dword [esi + 0x34], ebx
push edx
mov dword [esi + 0x44], ebx
call fcn.0046e510
add esp, 0xc
and byte [esi + 0x39], 0xfe
mov dword [esi + 0x30], ebx
mov dword [esi + 0x2c], 0x64
and byte [esi + 0x38], 0xe3
mov dword [esi + 0x2a0], ebx
mov dword [esi + 0x2a4], ebx
mov dword [esi + 0x2a8], ebx
mov dword [esi + 0x2ac], ebx
mov byte [esi + 0x2c8], bl
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001160
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x100011d1
mov ecx, dword [ebp - 4]
cmp dword [ecx + 8], 0
je 0x100011d1
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
test eax, eax
jne 0x100011ba
jmp 0x100011d1
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
push 0x40
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8

Function at 0x10001e62
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1000d120]
jne 0x10001e6c
repz ret
jmp fcn.10002a36
Function at 0x100080ba
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10002e47
and dword [ebp - 4], 0
cmp dword [0x1000e7c8], 0
mov ebx, eax
jne 0x1000816b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1000821c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1000821c
push eax
call fcn.10002dd5
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1000e7c8], eax
call esi
push eax
call fcn.10002dd5
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1000e7cc], eax
call esi
push eax
call fcn.10002dd5
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1000e7d0], eax
call esi
push eax
call fcn.10002dd5
pop ecx
mov dword [0x1000e7d8], eax
test eax, eax
je 0x1000816b
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10002dd5
pop ecx
mov dword [0x1000e7d4], eax
mov eax, dword [0x1000e7d4]
cmp eax, ebx
je 0x100081c3
cmp dword [0x1000e7d8], ebx
je 0x100081c3
push eax
call fcn.10002e50
push dword [0x1000e7d8]
mov esi, eax
call fcn.10002e50
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x100081c3
test edi, edi
je 0x100081c3
call esi
test eax, eax
je 0x100081ba
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x100081ba
test byte [ebp - 0xc], 1
jne 0x100081c3
or dword [ebp + 0x10], 0x200000
jmp 0x100081fc
mov eax, dword [0x1000e7cc]
cmp eax, ebx
je 0x100081fc
push eax
call fcn.10002e50
pop ecx
test eax, eax
je 0x100081fc
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x100081fc
mov eax, dword [0x1000e7d0]
cmp eax, ebx
je 0x100081fc
push eax
call fcn.10002e50
pop ecx
test eax, eax
je 0x100081fc
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1000e7c8]
call fcn.10002e50
pop ecx
test eax, eax
je 0x1000821c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1000821e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10008a90
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [0x1000e898], 0
push str.Mir2Packet1103
push 1
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10008aba
jmp 0x10008afc
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10008ae8
push 4
mov ecx, dword [ebp - 4]
push ecx
push 0x1000e898
call fcn.10001e80
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x401392
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
movzx eax, byte [eax + 2]
cmp eax, 1
ret

Function at 0x402cd7
Capabilities:
Delete file

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
xor edi, edi
test esi, esi
je 0x402d39
cmp word [esi], di
je 0x402d39
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.00415620
push dword [esp + 0x1c]
mov ebx, eax
push ebx
call dword [esp + 0x20]
push esi
push ebx
call fcn.00415830
add esp, 0x10
test eax, eax
jne 0x402d38
push 0x24
push 8
push dword [0x727614]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
mov eax, dword [esp + 0x10]
mov dword [ecx + 0x14], edi
mov edi, ecx
mov dword [ecx], ebx
mov dword [ecx + 8], 1
mov dword [ecx + 0x20], eax
mov dword [eax + 4], ecx
pop ebx
mov eax, edi
pop edi
pop esi
ret 0x10

Function at 0x40343d
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
push 0x40338c
push 0x10
push 0x2c
call fcn.00404801
push 0
push 0
push 8
mov dword [0x727840], eax
call fcn.004046f6
cmp word [0x727838], 0
mov dword [0x728180], eax
jne 0x403522
push edi
lea eax, [esp + 4]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
xor edi, edi
inc edi
test eax, eax
jne 0x403495
mov word [0x727838], di
jmp 0x40349d
xor eax, eax
mov word [0x727838], ax
push str.ws2_32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x727854], eax
test eax, eax
je 0x403521
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.getaddrinfo
push eax
call esi
push str.freeaddrinfo
push dword [0x727854]
mov dword [0x727844], eax
call esi
push str.getnameinfo
push dword [0x727854]
mov dword [0x727848], eax
call esi
push str.WSAStringToAddressA
push dword [0x727854]
mov dword [0x72784c], eax
call esi
cmp dword [0x727844], 0
mov dword [0x727850], eax
pop esi
je 0x403521
cmp dword [0x727848], 0
je 0x403521
cmp dword [0x72784c], 0
je 0x403521
test eax, eax
je 0x403521
mov dword [0x72783c], edi
pop edi
add esp, 0x190
ret