joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419d45
Capabilities:
Write file on windows

Disassembly:
push 0x4c
mov eax, 0x47e58d
call fcn.00466686
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x3c], edi
je 0x419e51
cmp byte [esi + 0x41], 0
je 0x419e51
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 4]
cmp eax, 0xffffffff
jne 0x419d7b
xor al, al
jmp 0x419e53
push edi
push 8
lea ecx, [ebp - 0x30]
call fcn.00419c14
mov dword [ebp - 4], edi
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x30]
call fcn.0040a8c6
mov ecx, eax
call fcn.0041a002
mov edi, dword [ebp - 0x1c]
mov ebx, eax
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x30]
call fcn.0040a8c6
mov ecx, eax
call fcn.0041a002
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x34]
push eax
add edi, ebx
push edi
push dword [ebp - 0x38]
lea eax, [esi + 0x44]
push eax
call dword [edx + 0x18]
sub eax, 0
je 0x419deb
dec eax
je 0x419def
dec eax
dec eax
je 0x419e4d
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.00408bd4
mov al, bl
jmp 0x419e53
mov byte [esi + 0x41], 0
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x30]
call fcn.0040a8c6
mov ecx, eax
call fcn.0041a002
mov edi, dword [ebp - 0x34]
sub edi, eax
je 0x419e2f
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x30]
call fcn.0040a8c6
mov ecx, eax
call fcn.0041a002
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004607c7
add esp, 0x10
cmp edi, eax
jne 0x419dd9
cmp byte [esi + 0x41], 0
je 0x419e4d
test edi, edi
jne 0x419d89
push edi
push 8
lea ecx, [ebp - 0x30]
call fcn.004127f6
jmp 0x419d89
mov bl, 1
jmp 0x419ddb
mov al, 1
call fcn.00466709
ret
Function at 0x422866
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x854
mov eax, 0x47e3e2
call fcn.00466686
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x814], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x818], eax
mov dword [edi], ebx
cmp byte [edi + 4], bl
je 0x42296c
xor eax, eax
push 0x7fe
mov word [ebp - 0x810], ax
xor esi, esi
lea eax, [ebp - 0x80e]
push ebx
inc esi
push eax
mov dword [ebp - 0x820], esi
call fcn.00467850
add esp, 0xc
lea eax, [ebp - 0x81c]
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x820]
push eax
mov eax, dword [ebp - 0x814]
push ebx
mov dword [ebp - 0x81c], 0x800
call fcn.00425210
push eax
push dword [edi + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x814], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
cmp dword [ebp - 0x814], ebx
jne 0x42293c
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x840]
push eax
call fcn.00424e0d
mov esi, dword [ebp - 0x818]
lea eax, [ebp - 0x840]
mov dword [ebp - 4], ebx
call fcn.00424f31
lea ecx, [ebp - 0x840]
call fcn.0042523a
mov al, 1
jmp 0x42296e
push 0x48a97c
lea eax, [ebp - 0x860]
push eax
call fcn.00424e0d
mov dword [ebp - 4], esi
mov esi, dword [ebp - 0x818]
lea eax, [ebp - 0x860]
call fcn.00424f31
lea ecx, [ebp - 0x860]
call fcn.0042523a
xor al, al
call fcn.00466709
ret 8
Function at 0x422be3
Capabilities:
Encode data using xor

Disassembly:
push 0x1a4
mov eax, 0x482cf6
call fcn.00466686
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov edi, ecx
mov cl, byte [edi]
mov ebx, edx
mov dword [ebp - 0x170], eax
mov dword [ebp - 0x168], esi
test cl, cl
jne 0x422c19
or eax, 0xffffffff
call fcn.00466709
ret 8
cmp byte [edi + 1], 0
jne 0x422c0e
test ebx, ebx
je 0x422c0e
test eax, eax
jle 0x422c0e
test esi, esi
je 0x422c0e
cmp byte [ebx], 4
jne 0x422c0e
lea esi, [ebp - 0x180]
call fcn.0043c044
lea esi, [ebp - 0x190]
call fcn.0043c044
cmp byte [ebx], 4
jne 0x422c6d
push dword [edi + 0x28]
lea eax, [ebx + 1]
lea ecx, [ebp - 0x180]
call fcn.0043cdf0
mov eax, dword [edi + 0x28]
pop ecx
push eax
lea eax, [eax + ebx + 1]
mov ecx, esi
call fcn.0043cdf0
pop ecx
lea esi, [ebp - 0x1b0]
call fcn.0043c044
lea esi, [ebp - 0x1a0]
call fcn.0043c044
push dword [edi + 4]
mov eax, esi
push dword [edi + 8]
lea edx, [ebp - 0x190]
push dword [edi + 0x18]
lea ecx, [ebp - 0x180]
push eax
lea eax, [ebp - 0x1b0]
push eax
call fcn.004230b8
add esp, 0x14
lea eax, [ebp - 0x160]
push eax
lea eax, [ebp - 0x1b0]
push eax
call fcn.00422e34
lea esi, [ebp - 0x164]
call fcn.00423e74
and dword [ebp - 4], 0
push dword [edi + 0x28]
lea eax, [ebp - 0x160]
push eax
mov eax, esi
call fcn.00423e31
mov eax, dword [edi + 0x28]
lea eax, [ebp + eax - 0x160]
push eax
lea eax, [ebp - 0x1a0]
push eax
call fcn.00422e34
mov esi, dword [ebp - 0x170]
and dword [ebp - 0x16c], 0
lea eax, [ebp - 0x16c]
push eax
push dword [ebp - 0x168]
mov eax, dword [edi + 0x28]
add eax, eax
push eax
lea eax, [ebp - 0x160]
push eax
mov ecx, esi
call fcn.00422af8
push dword [ebp - 0x16c]
mov edx, dword [ebp - 0x168]
push edx
call fcn.00422e74
test al, al
je 0x422d78
lea esi, [ebp - 0x180]
call fcn.0043b73a
lea esi, [ebp - 0x190]
call fcn.0043b73a
lea esi, [ebp - 0x1b0]
call fcn.0043b73a
lea esi, [ebp - 0x1a0]
call fcn.0043b73a
push dword [ebp - 0x164]
call fcn.0045fbe6
pop ecx
push 0xfffffffffffffffe
pop eax
jmp 0x422c11
mov eax, dword [edi + 0x28]
lea ecx, [ebx + eax*2 + 1]
mov dword [ebp - 0x16c], ecx
test esi, esi
jle 0x422da1
mov eax, edx
sub ecx, edx
mov dword [ebp - 0x168], esi
mov bl, byte [ecx + eax]
xor byte [eax], bl
inc eax
dec dword [ebp - 0x168]
jne 0x422d93
push esi
push edx
lea eax, [ebp - 0x164]
call fcn.00423e31
mov edi, dword [edi + 0x28]
push edi
lea eax, [ebp + edi - 0x160]
push eax
lea eax, [ebp - 0x164]
call fcn.00423e31
lea edi, [ebp - 0x30]
lea ebx, [ebp - 0x164]
call fcn.00423e53
lea esi, [ebp - 0x180]
call fcn.0043b73a
lea esi, [ebp - 0x190]
call fcn.0043b73a
lea esi, [ebp - 0x1b0]
call fcn.0043b73a
lea esi, [ebp - 0x1a0]
call fcn.0043b73a
mov eax, dword [ebp - 0x170]
mov edx, dword [ebp - 0x16c]
push 8
lea edi, [eax + edx]
pop ecx
lea esi, [ebp - 0x30]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
je 0x422e30
push 0xfffffffffffffffe
pop esi
push dword [ebp - 0x164]
call fcn.0045fbe6
pop ecx
mov eax, esi
jmp 0x422c11
xor esi, esi
jmp 0x422e1d
Function at 0x423eff
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x98
movzx ecx, byte [eax]
movzx edx, byte [eax + 1]
shl ecx, 8
or ecx, edx
movzx edx, byte [eax + 2]
shl ecx, 8
or ecx, edx
movzx edx, byte [eax + 3]
shl ecx, 8
or ecx, edx
movzx edx, byte [eax + 4]
push ebx
push esi
movzx esi, byte [eax + 5]
shl edx, 8
or edx, esi
movzx esi, byte [eax + 6]
movzx ebx, byte [eax + 0xd]
shl edx, 8
or edx, esi
movzx esi, byte [eax + 7]
push edi
movzx edi, byte [eax + 9]
shl edx, 8
or edx, esi
movzx esi, byte [eax + 8]
shl esi, 8
or esi, edi
movzx edi, byte [eax + 0xa]
shl esi, 8
or esi, edi
movzx edi, byte [eax + 0xb]
shl esi, 8
or esi, edi
movzx edi, byte [eax + 0xc]
shl edi, 8
or edi, ebx
movzx ebx, byte [eax + 0xe]
movzx eax, byte [eax + 0xf]
shl edi, 8
or edi, ebx
shl edi, 8
or edi, eax
xor ecx, 0xa3b1bac6
xor edx, 0x56aa3350
xor esi, 0x677d9197
xor edi, 0xb27022dc
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], edi
xor ecx, ecx
mov eax, dword [ecx + 0x48d848]
xor eax, dword [ebp + ecx - 0x20]
xor eax, dword [ebp + ecx - 0x18]
xor eax, dword [ebp + ecx - 0x1c]
mov edx, eax
shr edx, 0x18
mov ebx, eax
movzx edx, dl
mov dl, byte [edx + 0x48d738]
shr ebx, 0x10
mov byte [ebp + 0x70], dl
mov byte [ebp + 0x6d], bl
movzx edx, byte [ebp + 0x6d]
mov dl, byte [edx + 0x48d738]
mov ebx, eax
movzx eax, al
mov al, byte [eax + 0x48d738]
mov byte [ebp + 0x73], al
movzx eax, byte [ebp + 0x70]
shr ebx, 8
movzx edx, dl
shl eax, 8
or eax, edx
movzx esi, bl
mov bl, byte [esi + 0x48d738]
shl eax, 8
movzx edx, bl
or eax, edx
movzx edx, byte [ebp + 0x73]
shl eax, 8
or eax, edx
mov edx, eax
rol edx, 0xd
mov esi, eax
ror esi, 9
xor edx, esi
xor edx, dword [ebp + ecx - 0x24]
xor edx, eax
mov eax, dword [ebp + 0x7c]
mov dword [ebp + ecx - 0x14], edx
mov dword [ecx + eax], edx
add ecx, 4
cmp ecx, 0x80
jb 0x423fae
pop edi
pop esi
pop ebx
add ebp, 0x74
leave
ret
Function at 0x4241af
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4a0ee0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 1
mov eax, dword [ebp + 0x14]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x18]
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edi
jne 0x424250
cmp dword [ebp + 0x10], 0
jl 0x4242ba
jg 0x4241ed
cmp dword [ebp + 0xc], 0
jbe 0x4242ba
mov ebx, edi
add ecx, 4
sub ebx, edx
sub eax, edx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x18], eax
jmp 0x424204
mov edx, dword [ebp - 0x24]
mov edi, dword [ebp - 0x1c]
push 0x10
mov eax, edx
pop esi
mov ecx, dword [ebp - 0x18]
mov cl, byte [ecx + eax]
xor cl, byte [eax]
mov byte [ebx + eax], cl
inc eax
dec esi
jne 0x424209
push dword [ebp - 0x20]
mov eax, edi
call fcn.0042404d
mov esi, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x24]
add dword [ebp - 0x18], 0x10
add dword [ebp - 0x1c], 0x10
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add ebx, 0x10
add dword [ebp + 0xc], 0xfffffff0
movsd dword es:[edi], dword [esi]
adc dword [ebp + 0x10], 0xffffffff
cmp dword [ebp + 0x10], 0
pop ecx
movsd dword es:[edi], dword [esi]
jg 0x4241fe
jl 0x4242ba
cmp dword [ebp + 0xc], 0
ja 0x4241fe
jmp 0x4242ba
cmp dword [ebp + 0x10], 0
jl 0x4242ba
jg 0x42425e
cmp dword [ebp + 0xc], 0
jbe 0x4242ba
add ecx, 4
mov ebx, edx
mov dword [ebp - 0x20], ecx
sub ebx, edi
jmp 0x42426d
mov eax, dword [ebp - 0x18]
push dword [ebp - 0x20]
mov esi, eax
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x1c]
call fcn.0042404d
pop ecx
push 0x10
mov eax, edi
pop esi
mov cl, byte [ebx + eax]
xor byte [eax], cl
inc eax
dec esi
jne 0x424287
mov edi, dword [ebp - 0x24]
add dword [ebp - 0x18], 0x10
lea esi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub ebx, 0x10
add dword [ebp + 0xc], 0xfffffff0
movsd dword es:[edi], dword [esi]
adc dword [ebp + 0x10], 0xffffffff
cmp dword [ebp + 0x10], 0
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x1c], eax
jg 0x42426a
jl 0x4242ba
cmp dword [ebp + 0xc], 0
ja 0x42426a
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045fbf1
leave
ret
Function at 0x4253bb
Capabilities:
Get geographical location

Disassembly:
push 0x4ac
mov eax, 0x48083e
call fcn.004666bc
mov ebx, ecx
test ebx, ebx
jne 0x4253d8
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov ebx, eax
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
jne 0x4253ed
or eax, 0xffffffff
jmp 0x425589
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
xor eax, eax
mov byte [ebp - 0x1c], 0
lea edi, [ebp - 0x1b]
stosd dword es:[edi], eax
stosw word es:[edi], ax
push 8
stosb byte es:[edi], al
lea eax, [ebp - 0x1c]
push eax
push 0xb
push ebx
call esi
test eax, eax
jne 0x425416
push 0xfffffffffffffffe
jmp 0x425588
lea eax, [ebp - 0x1c]
push eax
call fcn.00463fbe
pop ecx
mov dword [ebp - 0x4b4], eax
test eax, eax
je 0x425586
cmp eax, 0xfde8
je 0x425586
cmp eax, 0xfde9
je 0x425586
movzx eax, ax
push eax
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x425586
push 0x3f
lea eax, [ebp - 0x6f]
push 0
push eax
mov byte [ebp - 0x70], 0
call fcn.00467850
add esp, 0xc
push 0x3f
lea eax, [ebp - 0xaf]
push 0
push eax
mov byte [ebp - 0xb0], 0
call fcn.00467850
xor eax, eax
mov byte [ebp - 0x2c], 0
lea edi, [ebp - 0x2b]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, 0x814
add esp, 0xc
cmp bx, ax
lea eax, [ebp - 0x70]
jne 0x4254cc
push str.Norwegian_Nynorsk
push 0x40
push eax
call fcn.00463dbc
add esp, 0xc
push 0x40
lea eax, [ebp - 0xb0]
push eax
push 0x1002
push ebx
call esi
test eax, eax
jne 0x4254e2
push 0xfffffffffffffffb
jmp 0x425588
push 0x40
push eax
push 0x1001
push ebx
call esi
test eax, eax
jne 0x4254b0
push 0xfffffffffffffffc
jmp 0x425588
push 0xa
push 0x10
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x4b4]
call fcn.0046360b
push 0x3ff
lea eax, [ebp - 0x4af]
push 0
push eax
mov byte [ebp - 0x4b0], 0
call fcn.00467850
add esp, 0x1c
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x70]
push eax
push str._s__s._s_n
lea eax, [ebp - 0x4b0]
push 0x3fc
push eax
call fcn.00460386
and dword [ebp - 4], 0
add esp, 0x18
lea edx, [ebp - 0x4b0]
lea ecx, [ebp - 0x4b8]
call fcn.004245b4
push eax
lea eax, [ebp - 0x4b4]
push eax
mov byte [ebp - 4], 1
call fcn.00450a6a
pop ecx
pop ecx
lea ecx, [ebp - 0x4b4]
call fcn.00412f65
lea ecx, [ebp - 0x4b8]
call fcn.00412f65
xor eax, eax
jmp 0x425589
push 0xfffffffffffffffd
pop eax
call fcn.00466718
ret
Function at 0x425965
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x481b81
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x4a0ee0]
xor eax, esp
mov dword [esp + 0x44], eax
push ebx
push esi
mov eax, dword [0x4a0ee0]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
and dword [esp + 0xc], 0
lea ecx, [esp + 0x30]
push ecx
push eax
call fcn.00425921
and dword [esp + 0x60], 0
push 0x48bc00
lea eax, [esp + 0x14]
push eax
call fcn.00424e0d
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x14]
call fcn.00425387
lea ecx, [esp + 0x10]
mov esi, eax
call fcn.0042523a
test esi, esi
jge 0x4259ec
lea eax, [esp + 0x30]
push eax
push edi
call fcn.00424e57
jmp 0x4259f9
push esi
push edi
xor ebx, ebx
lea ecx, [esp + 0x38]
call fcn.0042683d
lea ecx, [esp + 0x30]
call fcn.0042523a
mov eax, edi
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.0045fbf1
mov esp, ebp
pop ebp
ret 4

Function at 0x42662c
Capabilities:
Query environment variable

Disassembly:
push 0x830
mov eax, 0x47f205
call fcn.00466686
mov eax, dword [ebp + 8]
and dword [ebp - 0x83c], 0
push eax
lea ecx, [ebp - 0x838]
call fcn.004269e0
and dword [ebp - 4], 0
xor eax, eax
push 0x800
push eax
mov word [ebp - 0x818], ax
lea eax, [ebp - 0x816]
push eax
call fcn.00467850
mov eax, dword [ebp - 0x830]
add esp, 0xc
cmp dword [ebp - 0x81c], 8
jae 0x426688
lea eax, [ebp - 0x830]
push 0x400
lea ecx, [ebp - 0x818]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x4266ae
lea eax, [ebp - 0x818]
push eax
push edi
call fcn.00424e0d
jmp 0x4266bb
lea eax, [ebp - 0x838]
push eax
push edi
call fcn.00424e57
lea ecx, [ebp - 0x838]
call fcn.0042523a
mov eax, edi
call fcn.00466709
ret 4

Function at 0x42683d
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x47f19e
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x4a0ee0]
xor eax, esp
mov dword [esp + 0x44], eax
push esi
push edi
mov eax, dword [0x4a0ee0]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
and dword [esp + 0x10], 0
lea esi, [esp + 0x30]
mov edi, ecx
mov dword [esp + 0xc], eax
call fcn.00424973
and dword [esp + 0x60], 0
mov eax, dword [edi + 0x18]
test ebx, ebx
jge 0x4268a6
lea eax, [esp + 0x30]
push eax
push dword [esp + 0x10]
call fcn.00424e57
jmp 0x4268e2
cmp ebx, eax
jge 0x426896
mov ecx, dword [ebp + 0xc]
add ecx, ebx
cmp ecx, eax
jle 0x4268b7
or dword [ebp + 0xc], 0xffffffff
push dword [ebp + 0xc]
add edi, 4
push ebx
push edi
lea esi, [esp + 0x20]
call fcn.0042773e
push eax
push dword [esp + 0x10]
mov byte [esp + 0x68], 1
call fcn.00424d68
push 0
push 1
mov ecx, esi
call fcn.00408c43
lea ecx, [esp + 0x30]
call fcn.0042523a
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.0045fbf1
mov esp, ebp
pop ebp
ret 8
Function at 0x426adb
Capabilities:
Print debug messages

Disassembly:
mov cl, byte [section.Shared]
test cl, cl
je 0x426afa
cmp dword [eax + 0x1c], 8
jb 0x426af0
mov eax, dword [eax + 8]
jmp 0x426af3
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
ret

Function at 0x4297d8
Capabilities:
Get hostname
Resolve dns

Disassembly:
push 0x188
mov eax, 0x481a0b
call fcn.00466686
mov eax, dword [ebp + 8]
push eax
mov dword [ebp - 0x154], eax
mov esi, ecx
call fcn.0040d3ad
push esi
lea eax, [ebp - 0x14c]
push eax
call fcn.00424e57
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x134], ebx
jne 0x429897
push 0xff
lea eax, [ebp - 0x10f]
push ebx
push eax
mov byte [ebp - 0x110], bl
call fcn.00467850
add esp, 0xc
push pe_nt_image_headers32
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
cmp eax, ebx
je 0x42985d
or ebx, 0xffffffff
lea ecx, [ebp - 0x14c]
call fcn.0042523a
mov eax, ebx
call fcn.00466709
ret
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x194]
push eax
call fcn.00424da9
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x190]
push eax
lea ecx, [ebp - 0x148]
mov byte [ebp - 4], 1
call fcn.00409901
lea ecx, [ebp - 0x194]
mov byte [ebp - 4], bl
call fcn.0042523a
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x174]
rep stosd dword es:[edi], eax
push 2
inc eax
pop esi
lea edi, [ebp - 0x12c]
lea ecx, [ebp - 0x14c]
mov dword [ebp - 0x170], esi
mov dword [ebp - 0x174], eax
mov dword [ebp - 0x168], ebx
mov dword [ebp - 0x16c], eax
mov dword [ebp - 0x150], ebx
call fcn.004251d2
cmp dword [ebp - 0x114], 0x10
mov eax, dword [ebp - 0x128]
jae 0x4298ec
lea eax, [ebp - 0x128]
lea ecx, [ebp - 0x150]
push ecx
lea ecx, [ebp - 0x174]
push ecx
push ebx
push eax
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [ebp - 4], esi
cmp eax, ebx
jne 0x429970
mov edi, dword [ebp - 0x150]
cmp edi, ebx
je 0x429970
mov eax, dword [edi + 0x18]
push dword [eax + 4]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
cmp eax, ebx
je 0x429955
push eax
lea eax, [ebp - 0x194]
push eax
call fcn.00424da9
lea eax, [ebp - 0x194]
push eax
mov eax, dword [ebp - 0x154]
mov byte [ebp - 4], 5
call fcn.00408928
lea ecx, [ebp - 0x194]
mov byte [ebp - 4], 2
call fcn.0042523a
mov edi, dword [edi + 0x1c]
cmp edi, ebx
jne 0x429913
cmp dword [ebp - 0x150], ebx
je 0x429970
push dword [ebp - 0x150]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
push ebx
push 1
lea ecx, [ebp - 0x12c]
call fcn.00408bd4
jmp 0x42984a

Function at 0x429983
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x4a0ee0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x4a443e], 0
jne 0x4299a3
xor eax, eax
jmp 0x4299da
lea eax, [ebp - 0x198]
push eax
push 0x202
mov byte [0x4a443e], 0
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x4299d7
mov eax, dword [ebp - 0x198]
cmp al, 2
jne 0x4299d1
shr eax, 8
cmp al, 2
je 0x42999f
call dword [sym.imp.WS2_32.dll_WSACleanup]
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045fbf1
leave
ret
Function at 0x429a47
Capabilities:
Get disk size

Disassembly:
push 0x84
mov eax, 0x48055c
call fcn.00466686
xor ebx, ebx
cmp dword [ecx + 0x18], ebx
jne 0x429a65
xor al, al
call fcn.00466709
ret
xor edx, edx
inc edx
lea esi, [ebp - 0x50]
call fcn.0042527a
push 0x48b7d4
lea eax, [ebp - 0x90]
push eax
mov dword [ebp - 4], ebx
call fcn.00424e0d
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 1
call fcn.0041fd9f
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], bl
call fcn.0042523a
cmp dword [ebp - 0x34], 8
mov eax, dword [ebp - 0x48]
jae 0x429ab4
lea eax, [ebp - 0x48]
lea ecx, [ebp - 0x68]
push ecx
lea ecx, [ebp - 0x70]
push ecx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
cmp eax, ebx
jne 0x429ad4
lea ecx, [ebp - 0x50]
call fcn.0042523a
mov al, bl
jmp 0x429a5f
mov ecx, dword [ebp - 0x70]
mov eax, dword [ebp - 0x6c]
mov edx, dword [ebp - 0x64]
mov esi, dword [ebp - 0x68]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x60], ecx
mov ecx, closesocket
and eax, ecx
mov dword [ebp - 0x5c], eax
fild qword [ebp - 0x60]
mov eax, closesocket
and dword [ebp - 0x54], eax
mov dword [ebp - 0x58], ebx
fild qword [ebp - 0x58]
mov dword [ebp - 0x54], edx
and dword [ebp - 0x54], eax
and edx, ecx
fchs
mov dword [ebp - 0x60], esi
faddp st(1)
mov dword [ebp - 0x5c], edx
fld qword [0x490120]
mov dword [ebp - 0x58], ebx
push ecx
fmul st(1), st(0)
push ecx
fmul st(1), st(0)
fxch st(1)
fst qword [edi]
fild qword [ebp - 0x60]
fild qword [ebp - 0x58]
fchs
faddp st(1)
fmul st(2)
fmul st(2)
fstp qword [edi + 0x28]
fld qword [0x490118]
fcomp st(1)
fnstsw ax
test ah, 0x41
lea eax, [ebp - 0x30]
jp 0x429b55
fmulp st(1)
fstp qword [esp]
push str._.3f_GB
jmp 0x429b5f
fstp st(1)
fstp qword [esp]
push str._.3f_MB
push eax
call fcn.00460309
add esp, 0x10
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x90]
push eax
call fcn.00424da9
lea esi, [edi + 8]
lea eax, [ebp - 0x90]
mov byte [ebp - 4], 2
call fcn.00424f31
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], bl
call fcn.0042523a
fld qword [0x490118]
fcomp qword [edi + 0x28]
push ecx
push ecx
fnstsw ax
fld qword [edi + 0x28]
test ah, 0x41
lea eax, [ebp - 0x30]
jp 0x429bc0
fmul qword [0x490120]
fstp qword [esp]
push str._.3f_GB
jmp 0x429bc8
fstp qword [esp]
push str._.3f_MB
push eax
call fcn.00460309
add esp, 0x10
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x90]
push eax
call fcn.00424da9
lea esi, [edi + 0x30]
lea eax, [ebp - 0x90]
mov byte [ebp - 4], 3
call fcn.00424f31
lea ecx, [ebp - 0x90]
call fcn.0042523a
mov bl, 1
jmp 0x429ac8

Function at 0x42b39b
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test ecx, ecx
je 0x42b3e1
cmp dword [ebp + 0xc], 0
jl 0x42b3e1
jg 0x42b3b0
cmp dword [ebp + 8], 0
jbe 0x42b3e1
or eax, 0xffffffff
push esi
add dword [ebp + 8], 0xffffffff
movzx esi, byte [ecx]
adc dword [ebp + 0xc], 0xffffffff
mov edx, eax
and edx, 0xff
xor edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x4a3638]
mov edx, dword [ebp + 8]
inc ecx
or edx, dword [ebp + 0xc]
jne 0x42b3b4
not eax
pop esi
pop ebp
ret
xor eax, eax
pop ebp
ret