joyce8/EMBER2024-capa huggingface dataset:
Function at 0x465ef0
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x4aebec
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x465f12
shr eax, 1
xor eax, 0xedb88320
jmp 0x465f14
shr eax, 1
dec edx
jne 0x465f00
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x465ef9
mov byte [0x4aefec], 1
pop esi
pop ebx
ret

Function at 0x465f30
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x4aefec], 0
jne 0x465f47
call fcn.00465ef0
mov eax, edi
dec eax
test eax, eax
jl 0x465f70
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4aebec]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x465f51
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x468d00
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x468d31
dec al
je 0x468d6d
dec al
je 0x468db1
dec al
je 0x468e1c
jmp 0x468ea6
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x468ea6
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x468d41
jmp 0x468ea6
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x468ea6
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x468d7d
jmp 0x468ea6
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x468ea6
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x468ddf
xor ebp, ebp
jmp 0x468df0
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x468df9
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x468dc1
jmp 0x468ea6
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x468ea6
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x468e74
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.00465f78
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x468e30
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x471dbc
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x471dea
mov eax, ebx
call fcn.00472870
cmp dword [ebx + 0x40], 0
je 0x471de3
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x471e5b
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x471e4d
cmp dword [ebx + 8], 0
je 0x471e0c
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x471e1e
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x471e4d
cmp dword [ebx + 8], 0
je 0x471dff
cmp eax, 3
je 0x471e31
dec eax
jne 0x471dff
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x471dff
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x471dff
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x471e79
cmp dword [ebx + 0x14], 0xcc
je 0x471e79
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00471e84
pop ebx
ret

Function at 0x483ba0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x483bce
mov eax, ebx
call fcn.00484644
cmp dword [ebx + 0x3c], 0
je 0x483bc7
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x483c3f
mov edx, dword [ebx + 0x1a6]
cmp dword [edx + 0x10], 0
je 0x483c31
cmp dword [ebx + 8], 0
je 0x483bf0
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1a6]
call dword [edx]
test eax, eax
jne 0x483c02
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x483c31
cmp dword [ebx + 8], 0
je 0x483be3
cmp eax, 3
je 0x483c15
dec eax
jne 0x483be3
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x483be3
mov edx, dword [ebx + 0x132]
add dword [eax + 8], edx
jmp 0x483be3
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x483c5d
cmp dword [ebx + 0x10], 0xcc
je 0x483c5d
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00483c68
pop ebx
ret
Function at 0x58e70f
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x421636
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x426a58]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea esi, [edi + 4]
mov dword [edi], 0x4239c0
mov dword [ebp - 0x14], esi
mov dword [esi], 0x42c1d8
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov eax, dword [0x42c1d8]
push 0
push 2
push esi
push 0x42c1d8
mov dword [ebp - 4], 0
call dword [eax]
mov eax, dword [esi + 4]
xor ecx, ecx
mov word [eax], cx
lea esi, [edi + 0x10]
mov dword [ebp - 4], 1
mov dword [ebp - 0x14], esi
mov dword [esi], 0x42c1d8
mov dword [esi + 4], ecx
mov dword [esi + 8], ecx
mov eax, dword [0x42c1d8]
push ecx
push 2
push esi
push 0x42c1d8
mov byte [ebp - 4], 2
call dword [eax]
mov eax, dword [esi + 4]
xor ecx, ecx
xor edx, edx
mov word [eax], cx
mov dword [edi + 0x1c], ecx
mov dword [edi + 0x20], ecx
mov dword [edi + 0x24], 0x80000000
mov dword [edi + 0x38], ecx
mov dword [edi + 0x2c], 0xc
mov dword [edi + 0x30], 7
mov dword [edi + 0x34], 0xffffffff
mov dword [edi + 0x3c], ecx
lea ecx, [edi + 0x40]
mov dword [edi + 0x28], 0x4239a0
lea eax, [ecx + 0x10]
mov dword [ebp - 0x14], ecx
mov dword [ecx + 4], eax
mov dword [ecx + 0xc], 0x102
mov dword [ecx], 0x42c1dc
mov dword [ecx + 8], 0x102
mov word [eax], dx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x432072
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x458c4e4e
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x432060
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4320d2
nop
nop
nop
mov ebx, 0x42f314
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x44b74111
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x6b9ac3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
dec esp
test ecx, ecx
je 0x6b9ad6
add eax, 0xaf7f88ac
pop ebp
jmp 0xb4865a4a
xor byte [eax - 0x14], al
fistp word [edi]
push esi
mov esi, ecx
add ecx, 0x34
call 0x11905d18
mov ss, word [ecx]
mov dword gs:[0xa3189f33], eax
aaa
sbb dword [ecx], eax
dec dword [ebp - 0x7b17dbb2]
fcom dword [0x442fb000]
xchg dword [eax - 0xe24c638], esi
mov byte [0xcd01d204], al
and byte [edx - 0x3f], 0x96
cmp esp, dword [eax]
aaa
ror dword [ecx - 0x5c], 0x6f
push eax
jle 0x6b9ad6
rol dword [ebp - 0x7e], 0x34
je 0x6b9b2c
jno 0x6c940f
add bh, ch
mov ds, word [edi + 0x56]
outsd dx, dword [esi]
push 0x3f
push 0x3ee8475d
retf 0x580
pop ebp
inc edi
call 0x5ec6571
loopne 0x6b9ba5
std
or byte [ebp - 0x7b70f040], al
inc ebp
in eax, dx
add dl, byte [esp + ebp*8]
mov byte [ecx + 0x54], ah
dec dword [ebx - 0x3785d83d]
dec edi
mov bh, 0xe2
or byte [eax], al
mov dword [ecx + 0x46], ebx
mov eax, dword [0xfe0a03bc]
ret 0xfeda
sar eax, cl
or dword [ebx - 0x46af7518], eax
invalid
add ebp, eax
sbb eax, 0x468d8340
add dword [0x55dff85], edi
adc al, 0xae
mov dword [ebp - 0x18], ecx
mov edx, dword [ecx + 8]
or byte [ecx], ch
cli
Function at 0x85c83d
Capabilities:
Encode data using xor

Disassembly:
adc eax, dword [ecx + 0x78]
fbstp tbyte [edi + edx + 0x3a]
invalid
pop ss
cmp al, ah
fldcw word [ecx + ecx]
pop ss
and ch, ah
dec eax
adc dl, byte [esi + eax*4]
and dword [ecx - 0x53dbf9cf], esi
inc ebx
inc ecx
mov al, dl
popal
mov cl, byte [ebx - 0x4c]
add eax, 0x60160201
dec edi
and eax, 0x7002a6bb
and byte [ebx + 0x65], 0x66
in al, 0x80
inc ebx
dec ecx
arpl word [ebp - 0x5efaadd7], di
push edx
add eax, 0x9a7539a1
push edx
add eax, 0x9a7539a1
adc eax, 0x3d9c8980
rol edx, 1
push eax
out dx, al
xor ebp, dword [ebp + 0x31]
jge 0x85c80b
and byte [ebx + 1], dl
cwde
stosd dword es:[edi], eax
jne 0x85c863
inc edx
mov ebp, 0x6c6329
jns 0x85c861
add byte [ecx], bh
xchg edi, eax
and al, 0x54
push esp
xor ch, byte [edx]
jge 0x85c8af
dec edx
inc esi
lodsd eax, dword [esi]
sub al, 0x51
or dword [ebx], esi
jo 0x85c806
popfd
mov cl, 0x2f
jnp 0x85c88b
and dword [ebx], 0xffffff86
sbb dword [esi], ebp
jge 0x85c896
adc ebp, edx
and byte [ebp + edx*2 + 5], bl
mov ebx, 0xa6deafa6
push ebx
bound eax, qword [eax]
int1
pcmpeqw mm4, qword [ebx + 0x55]
push edi
arpl word [ecx], dx
mov eax, dword [0xf4523700]
sbb dword [eax], eax
shl byte [0xb0744549], 0x93
add edx, ecx
ja 0x85c85e
push edx
hlt
cmp dword [ebx + 0x3b], 0x5cabd021
add bh, cl
dec ecx
add byte [ebx - 0x57], cl
push ss
push edx
in al, dx
outsb dx, byte [esi]
xchg ebx, eax
and eax, 0x3d5c8a33
mov esp, 0x64006c
jge 0x85c8d1
dec edi
pop edx
pop eax
push cs
adc eax, 0x2c3535
clc
sbb byte [eax - 0x76c2cf47], dl
xor eax, 0x87bec665
jmp 0x85c90e
xor byte [0xc6653589], bh
mov esi, 0x6c33eb87
pop ebp
pop ecx
out dx, eax
pop esp
invalid
mov ebx, 0xb80cbfa7
and bh, byte [eax + 0x53]
adc ebx, edx
cmpsb byte [esi], byte es:[edi]
out dx, al
lcall 0x212d, 0x7b20d5e8
and al, byte [eax]
and eax, 0x22611025
mov al, 0x22
ret
and eax, 0xb0226110
and al, bl
aaa
add eax, dword [ebx]
test dword [ebp + 0x5c59631f], ebx
cmc
or bl, byte [ecx]
and cl, byte fs:[edi + 0xc61a491]
inc eax
pop ss
sbb dword [ecx], 0x61
or eax, dword [ebx + eax*8 - 0x5e34701f]
loope 0x85c8f8
je 0x85c995
xor dword [ebx - 0x66ff5897], ebp
inc ecx
cmp eax, 0x3f292a5e
adc ah, byte [esi + 0x4c]
jo 0x85c9b7
or eax, 0x8428d32d
xchg ebp, eax
lodsd eax, dword [esi]
cmp ebp, ecx
pop edi
mov al, 0xc1
invalid
cmp al, 0xd
aas
les esi, [eax]
xor byte [0xe1eb73b4], bh
sub eax, dword [eax + 0x607f301]
out 0x8b, eax
xchg ebx, eax
mov dword [edi - 0x504385c9], edi
daa
sbb al, 0x41
dec ecx
movsd dword es:[edi], dword [esi]
and edx, dword [eax + 0x30]
or al, 0x87
pop es
insd dword es:[edi], dx
ud2
mov bh, 0xb0
add dword [ebx], edx
insd dword es:[edi], dx
imul ebp, dword [ebp + 0x2778216e], 0x5bbfef5c
and eax, 0x90e80665
popfd
add eax, 0xc026685
sbb al, 0x47
neg dword [ebx]
push ebp
and cl, byte [ebp + ecx*2 + 0x17]
push eax
das
jb 0x85c971
and cl, byte [ebx + 0x12]
loope 0x85c98e
int1
xchg edi, eax
and ecx, dword [edx + 0x3949d815]
or ebp, edx
call 0x1805972
salc
inc edx
inc esi
xchg ebp, eax
mov ebx, 0x6f0a0d73
ja 0x85ca08
inc esi
xchg ebp, eax
mov dword [0x510bd373], eax
mov al, bh
iretd
iretd
Function at 0x9ab720
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x65b00d
lea edi, [esi - 0x25a00d]
push edi
or ebp, 0xffffffff
jmp 0x9ab742
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x9ab749
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9ab738
mov eax, 1
add ebx, ebx
jne 0x9ab75b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x9ab750
jne 0x9ab76c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x9ab750
xor ecx, ecx
sub eax, 3
jb 0x9ab780
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x9ab7f2
mov ebp, eax
add ebx, ebx
jne 0x9ab78b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x9ab798
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x9ab7bc
inc ecx
add ebx, ebx
jne 0x9ab7a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x9ab79d
jne 0x9ab7b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x9ab79d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x9ab7dc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x9ab7cd
jmp 0x9ab73e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x9ab7dc
add edi, ecx
jmp 0x9ab73e
pop esi
mov edi, esi
mov ecx, 0x1844
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x9ab7fa
cmp byte [edi], 0x11
jne 0x9ab7fa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x9ab7ff
lea edi, [esi + 0x5a7000]
mov eax, dword [edi]
or eax, eax
je 0x9ab86e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x5adf9c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5adff4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x9ab82c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x5adffc]
or eax, eax
je 0x9ab868
mov dword [ebx], eax
add ebx, 4
jmp 0x9ab849
call dword [esi + 0x5adff8]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x9ab89f
cmp al, 0xef
ja 0x9ab892
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x9ab874
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x9ab881
mov ebp, dword [esi + 0x5ae000]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x197]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x9ab8d3
sub esp, 0xffffff80
jmp 0x40f11c
Function at 0x401110
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
push esi
push 2
push 0
mov esi, eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jge 0x401128
cmp eax, 0x80010106
jne 0x4011a6
push edi
push esi
push 0x6b307c
push 1
push 0
push 0x6b306c
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test edi, edi
jge 0x401157
push edi
push str.CoCreateInstance_NetFwMgr_failed:_0x_08lx_n
call fcn.005bbca0
add esp, 8
mov eax, edi
pop edi
pop esi
ret
mov eax, dword [esi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
push ebx
lea edi, [esi + 4]
push edi
push eax
call edx
mov ebx, eax
test ebx, ebx
jge 0x401180
push ebx
push str.get_LocalPolicy_failed:_0x_08lx_n
call fcn.005bbca0
add esp, 8
mov eax, ebx
pop ebx
pop edi
pop esi
ret
mov eax, dword [edi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
add esi, 8
push esi
push eax
call edx
mov esi, eax
test esi, esi
jge 0x4011a4
push esi
push str.get_CurrentProfile_failed:_0x_08lx_n
call fcn.005bbca0
mov eax, esi
add esp, 8
pop ebx
pop edi
pop esi
ret

Function at 0x4014a0
Capabilities:
Access firewall policy via inetfwpolicy2

Disassembly:
push esi
push 2
push 0
mov esi, eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jge 0x4014b8
cmp eax, 0x80010106
jne 0x40150c
push edi
push esi
push 0x6b30bc
push 1
push 0
push 0x6b30ac
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test edi, edi
jge 0x4014e7
push edi
push str.CoCreateInstance_NetFwPolicy2_failed:_0x_08lx_n
call fcn.005bbca0
add esp, 8
mov eax, edi
pop edi
pop esi
ret
mov eax, dword [esi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x48]
add esi, 4
push esi
push eax
call edx
mov esi, eax
test esi, esi
jge 0x40150b
push esi
push str.get_Rules_failed:_0x_08lx_n
call fcn.005bbca0
mov eax, esi
add esp, 8
pop edi
pop esi
ret
Function at 0x401590
Capabilities:
Access firewall rule properties via inetfwrule

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
cmp dword [esi + 4], 0
jne 0x4015a6
mov eax, 0x80004001
pop esi
pop ecx
ret 0xc
push ebx
push ebp
push edi
push 0x6ec5f8
call fcn.00401050
mov edi, eax
mov eax, dword [esp + 0x20]
push eax
call fcn.00401050
mov ecx, dword [esp + 0x28]
push ecx
mov ebp, eax
call fcn.00401050
mov dword [esp + 0x28], eax
add esp, 0xc
lea ebx, [esp + 0x20]
mov eax, esi
mov dword [esp + 0x10], 0
call fcn.00401510
mov esi, eax
test esi, esi
jge 0x401603
push esi
push str.IsAppEnabled_failed:_0x_08lx_n
call fcn.005bbca0
add esp, 8
pop edi
pop ebp
pop ebx
mov eax, esi
pop esi
pop ecx
ret 0xc
cmp dword [esp + 0x20], 0
je 0x401614
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
pop ecx
ret 0xc
lea edx, [esp + 0x10]
push edx
push 0x6b30dc
push 1
push 0
push 0x6b30cc
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
jge 0x40163e
push esi
push str.CoCreateInstance_NetFwRule_failed:_0x_08lx_n
jmp 0x4016cd
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x20]
push edi
push eax
call edx
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x1c]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x28]
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x30]
push ebp
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x40]
push 0x100
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x98]
push 6
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xa8]
push 1
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x88]
push 0xffffffffffffffff
push eax
call edx
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 4]
mov edx, dword [esp + 0x10]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x20]
call eax
mov esi, eax
test esi, esi
jge 0x4016d5
push esi
push str.Firewall_Rule_Add_failed:_0x_08lx_n
call fcn.005bbca0
add esp, 8
push edi
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call edi
push ebp
call edi
mov ecx, dword [esp + 0x1c]
push ecx
call edi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4016f8
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
pop edi
pop ebp
pop ebx
mov eax, esi
pop esi
pop ecx
ret 0xc
Function at 0x401910
Capabilities:
Copy file

Disassembly:
sub esp, 0x614
mov eax, dword [0x6e8ddc]
xor eax, esp
mov dword [esp + 0x610], eax
push esi
push edi
push 0x104
lea eax, [esp + 0x118]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x114]
push 0x5c
push ecx
call fcn.005e1e00
mov esi, eax
inc esi
add esp, 8
cmp esi, 1
jne 0x40196b
push 0
push 0x14
push str..GenerateUpdaterXML.cpp
push str._DWORD_fname___1
call fcn.005bbf90
add esp, 0x10
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x11c]
push ecx
call fcn.005bc9d0
add esp, 0xc
test al, al
jne 0x40199e
lea edx, [esp + 0x114]
push edx
push str.failed_to_get_crc_for__s_n
call fcn.005bbe50
add esp, 8
push str.1.0.3
push esi
lea eax, [esp + 0x18]
push str._s__s.exe
push eax
call fcn.00401aa0
add esp, 0x10
push 0
lea ecx, [esp + 0x14]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x4019db
lea edx, [esp + 0x10]
push edx
push esi
push str.unable_to_copy__s___s_n
call fcn.005bbe50
add esp, 0xc
push 0x2f
push str.https:__147.50.253.137_MANUT_TESTV1_UPDATER_wzupd.xml
call fcn.005e1e00
mov esi, eax
add esp, 8
test esi, esi
jne 0x401a05
push eax
push 0x21
push str..GenerateUpdaterXML.cpp
push str.updater_file
call fcn.005bbf90
add esp, 0x10
lea edi, [esi + 1]
push 0x6b316c
push edi
call fcn.005bcee0
mov esi, eax
push 0x6b3170
push esi
call fcn.005e1e2d
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
push eax
push str.1.0.3
push ecx
lea edx, [esp + 0x2c]
push edx
push str.https:__147.50.253.137_MANUT_TESTV1_UPDATER_
push str.__u_url__s_s__crc__u__ver__s__size__u____n
push esi
call fcn.005e1e2d
push str.__p__n
push esi
call fcn.005e1e2d
push esi
call fcn.005e1fc0
lea eax, [esp + 0x48]
push eax
push edi
lea ecx, [esp + 0x258]
push str.XML__s_generated_nnew_exe:_s
push ecx
call fcn.00401ac0
add esp, 0x48
push 0
push str.Updater_XML
lea edx, [esp + 0x220]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x618]
pop edi
pop esi
xor ecx, esp
call fcn.005e1b37
add esp, 0x614
ret
Function at 0x4021b0
Capabilities:
Get cpu information
Get memory capacity
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x48
push esi
push edi
call fcn.00402280
call fcn.00402300
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402209
mov edx, dword [esp + 0xc]
lea ecx, [esp + 8]
push ecx
push 0x7955c8
push eax
push eax
push str.MHz
push edx
mov dword [esp + 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
push 0
shrd ecx, edx, 0xa
push 0
push 0
push str.DISPLAY
shr edx, 0xa
mov dword [0x7955cc], ecx
call dword [sym.imp.GDI32.dll_CreateICA]
mov edi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov esi, eax
push 8
push esi
call edi
push 0xa
push esi
mov dword [0x7955d0], eax
call edi
push esi
mov dword [0x7955d4], eax
call dword [sym.imp.GDI32.dll_DeleteDC]
call fcn.004025e0
call fcn.004024b0
call fcn.00402780
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x402bd0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
lea eax, [esp]
push eax
push 0xf003f
push 0
push str.SoftwareMANUT_TESTV1WarZ
push bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x402bf8
mov al, 1
add esp, 0x10
ret
mov eax, dword [esp]
push esi
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
push 0
push str.UpdaterTime1
push eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 4]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x402c6a
push esi
call fcn.005e2325
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
add esp, 4
add esi, 0x2a300
adc ecx, 0
cmp edx, ecx
jg 0x402c6a
jl 0x402c63
cmp eax, esi
jae 0x402c6a
xor al, al
pop esi
add esp, 0x10
ret
mov al, 1
pop esi
add esp, 0x10
ret