joyce8/EMBER2024-capa huggingface dataset:
Function at 0x510930
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x21c
mov eax, dword [0x57f578]
xor eax, esp
mov dword [esp + 0x218], eax
push ebx
mov ebx, dword [esp + 0x228]
lea eax, [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x228]
push 0x208
push 0
push eax
call fcn.004e8f30
add esp, 0xc
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x51099d
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0x234]
or eax, 0x20019
push eax
push 0
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x5109b9
cmp eax, 2
jne 0x510abf
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.004e679a
add esp, 0x21c
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [ebx + eax*2 - 2], 0x5c
lea edi, [ebx + eax*2]
je 0x5109dc
mov eax, 0x5c
mov word [edi], ax
add edi, 2
xor eax, eax
mov word [edi], ax
lea eax, [esp + 0x14]
mov dword [esp + 0xc], 0x104
push eax
push 0
push 0
push 0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x510a9e
push esi
lea esi, [esp + 0x20]
sub esi, edi
nop dword [eax]
nop dword [eax + eax]
mov edx, 0x208
mov eax, edi
nop word [eax + eax]
lea ecx, [edx + 0x7ffffdf6]
test ecx, ecx
je 0x510a4e
movzx ecx, word [esi + eax]
test cx, cx
je 0x510a4e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x510a30
push dword [esp + 0x238]
lea ecx, [eax - 2]
test edx, edx
push ebx
cmovne ecx, eax
xor eax, eax
push ebp
mov word [ecx], ax
call fcn.00510930
add esp, 0xc
test eax, eax
je 0x510a9d
lea eax, [esp + 0x18]
mov dword [esp + 0x10], 0x104
push eax
push 0
push 0
push 0
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x34]
push eax
push 0
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x510a20
pop esi
xor eax, eax
mov word [edi - 2], ax
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop edi
test eax, eax
je 0x51099d
mov ecx, dword [esp + 0x220]
xor eax, eax
pop ebp
pop ebx
xor ecx, esp
call fcn.004e679a
add esp, 0x21c
ret
Function at 0x510b00
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5360f8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x57f578]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x30], eax
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x2c], edi
test edi, edi
jne 0x510b47
xor al, al
jmp 0x510c27
xor ecx, ecx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], cx
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0x28]
push ecx
push ebx
push edi
mov ecx, eax
call fcn.00510720
test al, al
je 0x510bd8
cmp byte [ebp + 0x14], 0
je 0x510b9b
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.0040d060
add esp, 8
test al, al
je 0x510bd8
mov bl, 1
jmp 0x510c16
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x510ba5
mov ecx, dword [esi]
cmp dword [ebp - 0x14], 8
lea edi, [ebp - 0x28]
mov edx, dword [ebp - 0x18]
cmovae edi, dword [ebp - 0x28]
cmp edx, dword [esi + 0x10]
jne 0x510bd5
test edx, edx
je 0x510bd1
sub edi, ecx
nop
mov ax, word [edi + ecx]
cmp ax, word [ecx]
jne 0x510bd5
add ecx, 2
sub edx, 1
jne 0x510bc0
mov bl, 1
jmp 0x510c16
mov edi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
cmp byte [eax], 0
je 0x510be8
mov byte [eax + 1], 1
mov bl, 1
jmp 0x510c16
cmp dword [esi + 0x14], 8
mov eax, dword [esi + 0x10]
jb 0x510bf3
mov esi, dword [esi]
cmp dword [ebx + 0x14], 8
jb 0x510bfb
mov ebx, dword [ebx]
lea eax, [eax*2 + 2]
push eax
push esi
push 1
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x510bd1
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00408080
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e679a
mov esp, ebp
pop ebp
ret 0x10
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x402c00
pop dword [ebp - 8]
mov eax, 0x120279ac
add eax, 0xee3db254
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x485199a2
sub dword [ebp - 0x18], 0xf9ff5457
mov dword [ebp - 0x14], 0xe85a1f09
add dword [ebp - 0x14], 0x49d92d3c
mov dword [ebp - 0x10], 0x196a7d9c
add dword [ebp - 0x10], 0x32e1c692
mov dword [ebp - 0xc], 0xf6c3d3ec
sub dword [ebp - 0xc], 0xf6c3d3ec
lea eax, [ebp - 0x18]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x29da2574
add dword [ebp - 0x18], 0x4a9843e2
mov dword [ebp - 0x14], 0xd21e1296
add dword [ebp - 0x14], 0x6f4e4edf
mov dword [ebp - 0x10], 0x4f078abd
add dword [ebp - 0x10], 0x1467e1af
mov dword [ebp - 0xc], 0x7c28b496
add dword [ebp - 0xc], 0x83d74b6a
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3824a
push 0
call eax
mov ecx, 0x9310d40b
add ecx, 0x6cef79c6
xor edx, edx
add edx, eax
mov esi, 0xa088b4fa
add esi, 0x5fb85b06
add esi, dword [ebp - 8]
mov ebx, 0xef8ca8a3
add ebx, 0xa70e238c
add dword [ebp - 4], edi
mov edi, dword [esi]
sub dword [ebp - 4], esi
xor edi, ebx
add dword [ebp - 4], ecx
mov dword [edx], edi
sub dword [ebp - 4], 0x5ae82b
add edx, 4
add esi, 0xa4717b1c
add esi, 0x5b8e84e8
loop 0x402d1a
add eax, 0x8ffe7ed2
sub eax, 0x8ffd54bb
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x40324c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x40325b
pop dword [ebp - 8]
mov eax, 0x9b93c193
sub eax, 0x9b538f38
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xa93bc0e8
sub dword [ebp - 0x18], 0x5ae97b9d
mov dword [ebp - 0x14], 0xc9408bad
sub dword [ebp - 0x14], 0x970d3f68
mov dword [ebp - 0x10], 0xfca24525
sub dword [ebp - 0x10], 0xb05600f7
mov dword [ebp - 0xc], 0xcf213cde
add dword [ebp - 0xc], 0x30dec322
lea eax, [ebp - 0x18]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x2e72efa6
sub dword [ebp - 0x18], 0xba008650
mov dword [ebp - 0x14], 0xc03fefac
sub dword [ebp - 0x14], 0x7ed38e37
mov dword [ebp - 0x10], 0xac20d4b3
sub dword [ebp - 0x10], 0x48b16847
mov dword [ebp - 0xc], 0xd7f98e78
add dword [ebp - 0xc], 0x28067188
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x5d8896d
sub eax, 0x59808f1
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x32490
push 0
call eax
mov ecx, 0xa1b45040
sub ecx, 0xa1b41b3c
xor edx, edx
add edx, eax
mov edi, 0x451400
add edi, dword [ebp - 8]
mov esi, 0x8d834844
sub esi, 0x64998844
sub dword [ebp - 4], edx
mov ebx, dword [edi]
add dword [ebp - 4], edi
xor ebx, esi
xor dword [ebp - 4], 0xce66c3f3
mov dword [edx], ebx
xor dword [ebp - 4], esi
add edx, 4
add edi, 0x7fe4d8ff
add edi, 0x801b2705
loop 0x403374
add eax, 0xc6e3
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x1efafb4
sub ecx, 0x1afafb4
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x10001044
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, 0x10014efc
sub byte [esi - 0x1a3], 0xd8
pop esi
jmp 0x1000107d
jmp 0x100010a4
xor eax, eax
jmp 0x10001414
call fcn.100010ab
test eax, eax
jne 0x10001422
ret
push ebp
push eax
mov eax, 0x10015143
add dword [eax - 0x3c], 0x25b5642c
xor byte [eax - 0x365], 0xf5
pop eax
push ebx
mov ebx, eax
call fcn.1000121c
sub esp, 4
push esi
pop dword [0x10014db5]
mov dword [esp], 0x35485406
add dword [esp], 0x343216f8
push eax
call fcn.1000125f
push 0x40
push 0x71bbe571
push ecx
inc ecx
not ecx
mov ecx, 0x71bbd571
xor dword [esp + 4], ecx
pop ecx
mov ecx, 0xe640
pushal
sbb dword [0x10014dec], 0xc7771e73
call fcn.1000121c
mov edx, eax
or dword [0x10014dbf], ecx
sub esp, 4
mov dword [esp], 0xf8db8669
push edi
mov edi, 0x10014ff3
add word [edi + 0xc1], 0xf648
sub word [edi - 0xfa], 0xfce1
pop edi
add dword [esp], 0x343216f8
push edx
xor word [0x10014fff], 0x6a06
jmp loc.10021000

Function at 0x1000121c
Capabilities:
Access peb ldr_data

Disassembly:
push esi
jmp 0x1000123c
xor eax, eax
mov eax, dword fs:[eax + 0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
pop esi
ret

Function at 0x1000125f
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push ebx
push edx
push ecx
mov ecx, 0x10014e79
xor dword [ecx - 0x121], 0x1638db40
pop ecx
push esi
push edi
mov ebx, dword [ebp + 8]
mov ecx, ebx
add ebx, dword [ebx + 0x3c]
push dword [ebx + 0x7c]
push 0x9c830a79
pop dword [0x10014f30]
mov ebx, dword [ebx + 0x78]
add ebx, ecx
add dword [esp], ebx
push edi
mov edi, 0x10015138
xor dword [edi - 0x326], 0x411f6b3b
mov byte [edi - 0x258], 0x58
pop edi
mov edi, dword [ebx + 0x20]
add edi, ecx
xor esi, esi
lea edx, [edi + esi*4]
mov edx, dword [edx]
jmp 0x100012f4
jmp 0x1000132b
jmp 0x10001351
add edx, ecx
mov dword [ebp - 4], edx
xor eax, eax
rol eax, 7
xor al, byte [edx]
inc edx
cmp byte [edx], 0
jne 0x10001358
mov dword [0x10014d6c], edi
cmp eax, dword [ebp + 0xc]
je 0x10001380
inc esi
cmp esi, dword [ebx + 0x18]
jb 0x100012b7
mov edx, dword [ebx + 0x24]
add edx, ecx
movzx edx, word [edx + esi*2]
push edi
mov edi, 0x10014d8f
and byte [edi + 0xfc], 0xef
mov word [edi + 0x185], 0x3fc
pop edi
mov eax, dword [ebx + 0x1c]
add eax, ecx
mov eax, dword [eax + edx*4]
add eax, ecx
pop ecx
cmp eax, ebx
jbe 0x100013fb
cmp eax, ecx
jae 0x100013fb
push edi
mov edi, 0x10014e35
sbb word [edi + 0xbf], 0x63e8
and word [edi + 0x31f], 0x6a01
pop edi
push dword [ebp - 4]
push dword [ebp + 8]
sub esp, 4
mov dword [esp], 0xeb8ed3f6
add dword [esp], 0x343216f8
push dword [ebp + 8]
call fcn.1000125f
call eax
sub dword [0x10014ed7], edi
pop edi
pop esi
push ecx
mov ecx, 0x10015162
sub dword [ecx - 0x2bf], 0x15bc800
pop ecx
pop edx
pop ebx
leave
ret 8
Function at 0x10002180
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call sym.___wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x10002358
mov edi, dword [0x10007084]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], edi
je 0x10002267
test byte [0x10003030], 8
jne 0x10002300
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x10003040], 8
jne 0x100022c0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x10002209
cmp esi, 3
jbe 0x10002278
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x1000221a
mov esi, edx
mov dword [esp + 0xc], edi
shr esi, 0x10
test edx, 0x8080
mov dword [esp + 4], 1
cmove edx, esi
lea esi, [ecx + 2]
mov dword [esp], ebx
cmove ecx, esi
mov eax, edx
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x100050d0]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x10002209
mov dword [esp], 0x10003040
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x100021e0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf
add edi, eax
jmp 0x100021e0
mov dword [esp], 0x10003030
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x100021cb
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea edi, [ebx + eax]
jmp 0x100021d3
mov eax, 0xffffffff
jmp 0x10002267
Function at 0x957058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.009571a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x95707e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x95706a
add dl, dl
jne 0x957089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9570dc
xor eax, eax
add dl, dl
jne 0x957096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x95717d
add dl, dl
jne 0x9570a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9570b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9570bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9570c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x9570d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x957075
mov eax, 1
add dl, dl
jne 0x9570ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9570f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9570e1
sub eax, ebx
mov ebx, 1
jne 0x957128
mov ecx, 1
add dl, dl
jne 0x95710e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x957119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x957105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x957075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x95713f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x95714a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x957136
cmp eax, 0x7d00
jae 0x95716d
cmp eax, 0x500
jb 0x957168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x957075
cmp eax, 0x7f
ja 0x957170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x957075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x95719e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x957075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x43aeb8
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043ac3f

Function at 0x43d116
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043c8f0

Function at 0x43d121
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043cb2b

Function at 0x44698b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00446590

Function at 0x446996
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00446711
Function at 0x4185f5
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push 0x28
call fcn.0041fef8
add esp, 4
mov dword [ebp - 4], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 0xa
rep stosd dword es:[edi], eax
push ebx
push 8
call fcn.0041fef8
add esp, 4
pop ebx
push ebx
mov dword [ebx], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
pop ebx
mov dword [ebp - 8], esp
mov eax, dword [ebp - 4]
push eax
push 0x24
call fcn.0041fef8
add esp, 4
mov edi, eax
pop ebx
push eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], eax
push ebx
mov ebx, dword [ebx]
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
pop ebx
add ebx, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov dword [edi], ebx
add edi, 4
add ebx, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4186f8
push 0
push 0x4088fa1
push 6
call fcn.0041ff04
add esp, 0xc
mov ebx, dword [ebp - 0xc]
push ebx
mov edi, dword [ebp - 0x10]
push edi
mov edi, dword [edi]
push ebx
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
pop ebx
add ebx, 4
pop edi
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
add edi, 4
add ebx, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
call fcn.0041fefe
add esp, 4
cmp dword [ebp + 8], 1
jge 0x4187c2
mov ebx, dword [ebp - 4]
add ebx, 0x14
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 8]
fild dword [ebx]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
fmul qword [0x42e629]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
fadd qword [0x42e629]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
call fcn.00401164
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
jmp 0x4187ca
push eax
mov ebx, dword [ebp - 4]
push ebx
push ebx
mov ebx, dword [ebx]
push ebx
call fcn.0041fefe
add esp, 4
pop ebx
call fcn.0041fefe
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x418df2
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
push 1
push 0
push 0
push 0x11
push 2
push 2
call dword [sym.imp.WS2_32.dll_WSASocketA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x418e49
push 0x19
push 0x4088eaf
push 6
call fcn.0041ff04
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jle 0x418ebc
push 1
push dword [ebp - 4]
call fcn.00418eca
cmp dword [ebp + 0xc], 0
je 0x418e7b
cmp dword [ebp + 8], 1
je 0x418e7b
xor eax, eax
jmp 0x418e80
mov eax, 1
test eax, eax
je 0x418ebc
push 1
push dword [ebp - 4]
call fcn.00418f63
push 1
push dword [ebp - 4]
call fcn.00418ffc
push 1
push dword [ebp - 4]
call fcn.004191a4
push 0
push dword [ebp - 4]
call fcn.0041923d
mov eax, dword [ebp - 4]
jmp 0x418ec4
mov esp, ebp
pop ebp
ret 8

Function at 0x418eca
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], esp
push 0
push dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyn]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x418f08
push 0x47
push 0x4088e9d
push 6
call fcn.0041ff04
add esp, 0xc
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 1
push dword [ebp - 8]
push 0x20
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WSOCK32.dll_setsockopt]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x418f49
push 0x47
push 0x4088e9d
push 6
call fcn.0041ff04
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
mov eax, 0
sete al
jmp 0x418f5d
mov esp, ebp
pop ebp
ret 8

Function at 0x418f63
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], esp
push 0
push dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyn]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x418fa1
push 0x47
push 0x4088e9c
push 6
call fcn.0041ff04
add esp, 0xc
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 1
push dword [ebp - 8]
push 4
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WSOCK32.dll_setsockopt]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x418fe2
push 0x47
push 0x4088e9c
push 6
call fcn.0041ff04
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
mov eax, 0
sete al
jmp 0x418ff6
mov esp, ebp
pop ebp
ret 8