joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b8d4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
push dword [ebp + 0xc]
call fcn.00401df4
mov dword [ebp - 8], eax
push dword [ebp + 0xc]
call fcn.00401c84
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp - 0xc]
push dword [ebp - 8]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x40b935
push 0x33
push 0x40aa69d
push 6
call fcn.00441a64
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x40b93d
mov esp, ebp
pop ebp
ret 8

Function at 0x40b944
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], esp
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x40b98b
push 0
push 0x40aa699
push 6
call fcn.00441a64
add esp, 0xc
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
jmp 0x40b996
mov esp, ebp
pop ebp
ret 4

Function at 0x40c490
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
push 0
push dword [ebp - 0xc]
push dword [ebp + 0xc]
call fcn.00401ca8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40c4d2
push ebx
call fcn.00441a6a
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
lea eax, [ebp - 4]
push eax
call fcn.00401df4
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
push dword [ebp - 0xc]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x40c524
push 0x70
push 0x40aa69e
push 6
call fcn.00441a64
add esp, 0xc
push 0x80000301
push 0
push dword [ebp - 8]
push VariantCopy
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x40c541
mov eax, 0x47b30c
push eax
push 2
mov ebx, 0x1a0
call fcn.004431c0
add esp, 0x1c
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40c56b
push ebx
call fcn.00441a6a
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x40c589
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.00441a5e
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x40c58e
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40c59f
push ebx
call fcn.00441a6a
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 8
Function at 0x40c5a8
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0
push dword [ebp - 8]
push dword [ebp + 0xc]
call fcn.0040c634
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40c5e3
mov eax, 0
jmp 0x40c62b
mov dword [ebp - 8], esp
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
nop
nop
cmp dword [ebp - 8], esp
je 0x40c616
push 0xe1
push 0x409df05
push 6
call fcn.00441a64
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40c623
mov eax, dword [ebp - 4]
jmp 0x40c62b
mov esp, ebp
pop ebp
ret 8

Function at 0x40ce7c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], esp
push 1
push 0x47b308
push 0x47b308
mov ebx, dword [ebp + 8]
push dword [ebx]
push str.open
push 0
xor eax, eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
cmp dword [ebp - 4], esp
je 0x40cecc
push 0
push 0x40aa299
push 6
call fcn.00441a64
add esp, 0xc
mov esp, ebp
pop ebp
ret 4

Function at 0x40d000
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x32
push 1
mov ebx, 0x184
call fcn.00442980
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40d045
push ebx
call fcn.00441a6a
add esp, 4
pop eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
call fcn.00404324
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x40d085
push 0x73
push 0x40aa410
push 6
call fcn.00441a64
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x40d0b3
mov eax, dword [ebp - 4]
test eax, eax
je 0x40d0ae
push eax
mov ebx, eax
call fcn.00403b28
inc eax
push eax
call fcn.00441a5e
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x40d0bd
mov eax, 0x47b308
jmp 0x40d0bd
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40d0ce
push ebx
call fcn.00441a6a
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x40e830
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
mov ebx, dword [ebp + 8]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
nop
nop
cmp dword [ebp - 8], esp
je 0x40e86e
push 0x19
push 0x40aa29a
push 6
call fcn.00441a64
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x40e885
mov eax, 0
jmp 0x40e8a6
push 0x10
push dword [ebp - 4]
call fcn.0040e8ac
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
mov eax, 0
sete al
jmp 0x40e8a6
mov esp, ebp
pop ebp
ret 4

Function at 0x40e928
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], esp
push dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
nop
nop
cmp dword [ebp - 4], esp
je 0x40e962
push 0x24
push 0x40aa65f
push 6
call fcn.00441a64
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
mov eax, 0
setne al
jmp 0x40e976
mov esp, ebp
pop ebp
ret 8
Function at 0x4125f0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 4
push 1
mov ebx, 0x184
call fcn.00442980
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x412635
push ebx
call fcn.00441a6a
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 4
push dword [ebp - 4]
push 0x23
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
nop
nop
cmp dword [ebp - 8], esp
je 0x412674
push 0x36
push 0x409e699
push 6
call fcn.00441a64
add esp, 0xc
push 0x80000004
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x412687
mov eax, 0x47b308
push eax
push 1
mov ebx, 0x9dc
call fcn.004430e0
add esp, 0x10
jmp 0x41269f
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4126b0
push ebx
call fcn.00441a6a
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x415738
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
push 2
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
nop
nop
cmp dword [ebp - 8], esp
je 0x415779
push 0x19
push 0x40aa2c5
push 6
call fcn.00441a64
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x41
jl 0x415797
cmp dword [ebp - 4], 0x5a
jg 0x415797
mov eax, 1
jmp 0x41579c
mov eax, 0
test eax, eax
je 0x4157a8
add dword [ebp - 4], 0x20
mov eax, dword [ebp - 4]
jmp 0x4157b0
mov esp, ebp
pop ebp
ret 4

Function at 0x415c88
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x40
call fcn.00441a5e
add esp, 4
mov dword [ebp - 4], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 0x10
rep stosd dword es:[edi], eax
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 8]
mov dword [ebx], 0x40
mov dword [ebp - 8], esp
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
nop
nop
cmp dword [ebp - 8], esp
je 0x415ce9
push 0x2c
push 0x40aaee4
push 6
call fcn.00441a64
add esp, 0xc
mov eax, dword [ebp - 4]
push eax
push 0x40
call fcn.00441a5e
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x415d02
push eax
mov ebx, dword [ebp - 4]
push ebx
call fcn.00441a6a
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x418b7c
Capabilities:
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov eax, dword [0x5a3bb4]
mov dword [ebp - 4], eax
mov eax, dword [0x5a3bb8]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov ecx, eax
cmp eax, 0
jne 0x418bdd
leave
ret 0xc
mov eax, dword [eax + 4]
cmp eax, 0
jne 0x418be9
leave
ret 0xc
add eax, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp + 0xc], 0
je 0x418bf9
mov eax, ecx
jmp 0x418c50
cmp dword [ebp - 4], 0
jne 0x418c20
push 0x6a4abc5b
call fcn.00418cc5
push 0x864bde7e
push eax
call fcn.00418d38
call eax
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 1
cmp dword [ebp - 8], 0
jne 0x418c45
push 0x3cfa685d
call fcn.00418cc5
push 0xc9616ee
push eax
call fcn.00418d38
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 1
push dword [ebp - 0x10]
push 0
push dword [ebp - 4]
call dword [ebp - 8]
push ebx
push edx
mov dword [ebp - 0x14], eax
mov edx, eax
mov ecx, dword [ebp - 0x10]
sub ecx, 8
cmp dword [ebp + 0xc], 0
jne 0x418c6c
mov dword [edx], 1
mov dword [edx + 4], ecx
add edx, 8
dec ecx
mov dword [ebp - 0x10], ecx
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
lea ebx, [ebx + ecx + 8]
cmp dword [ebp + 0xc], 0
je 0x418c92
push edx
mov eax, dword [ebp - 0x10]
mov ecx, 2
cdq
idiv ecx
mov dword [ebp - 0x10], eax
pop edx
xor ecx, ecx
cmp ecx, dword [ebp - 0x10]
jle 0x418c9b
jmp 0x418cb2
cmp dword [ebp + 0xc], 0
je 0x418ca9
mov al, byte [ebx]
xchg byte [edx], al
mov byte [ebx], al
jmp 0x418cad
mov al, byte [ebx]
mov byte [edx], al
inc ecx
inc edx
dec ebx
jmp 0x418c94
pop edx
pop ebx
cmp dword [ebp + 0xc], 0
jne 0x418cbf
jmp 0x418ec1
xor eax, eax
leave
ret 0xc
cmp dword [ebp - 0xc], 0
jne 0x418ece
mov eax, dword [ebp - 0x14]
leave
ret 0xc
mov eax, dword [ebp - 4]
mov dword [0x5a3bb4], eax
mov eax, dword [ebp - 8]
mov dword [0x5a3bb8], eax
mov eax, dword [ebp - 0x14]
leave
ret 0xc

Function at 0x418cc5
Capabilities:
Access peb ldr_data

Disassembly:
pop edx
pop ecx
push edx
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword ds:[ebx + 0xc]
mov ebx, dword ds:[ebx + 0x14]
mov edi, ebx
mov esi, dword ds:[ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword ds:[esi]
test cx, cx
je 0x418d1a
mov al, cl
cmp al, 0x61
jb 0x418cf4
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x418d1a
mov al, cl
cmp al, 0x61
jb 0x418d0c
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, ds:[esi + 4]
jmp 0x418ce4
cmp edx, dword ss:[esp + 0x18]
je 0x418d2d
mov ebx, dword ds:[ebx]
cmp edi, dword ds:[ebx]
jne 0x418cdc
xor eax, eax
jmp 0x418d31
mov eax, dword ds:[ebx + 0x10]
mov dword ss:[esp + 0x1c], eax
popal
ret
Function at 0x418d38
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword ss:[esp]
mov edx, dword ss:[esp + 8]
mov dword ss:[esp + 8], ecx
mov ecx, dword ss:[esp + 4]
add esp, 8
xor eax, eax
pushal
mov ebx, ecx
mov eax, dword ds:[ebx + 0x3c]
mov eax, dword ds:[ebx + eax + 0x78]
test eax, eax
je 0x418e4a
lea esi, ds:[ebx + eax]
test edx, 0xffff0000
je 0x418e51
mov ecx, dword ds:[esi + 0x18]
mov edi, dword ds:[esi + 0x20]
lea edi, ds:[ebx + edi]
mov ebp, dword ds:[edi + ecx*4 - 4]
lea ebp, ds:[ebx + ebp]
xor eax, eax
xor edx, edx
mov al, byte ss:[ebp]
test al, al
je 0x418da3
cmp al, 0x61
jb 0x418d9b
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x418d8d
cmp edx, dword ss:[esp + 0x14]
je 0x418db4
dec ecx
jne 0x418d80
xor eax, eax
jmp 0x418e4a
mov edx, dword ds:[esi + 0x24]
lea edx, ds:[ebx + edx]
mov edx, dword ds:[edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword ds:[esi + 0x1c]
lea eax, ds:[ebx + eax]
mov eax, dword ds:[eax + edx*4]
lea eax, ds:[ebx + eax]
cmp eax, esi
jbe 0x418e4a
mov ecx, dword ds:[ebx + 0x3c]
mov ecx, dword ds:[ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x418e4a
mov ebp, eax
xor eax, eax
xor edx, edx
mov al, byte ss:[ebp]
cmp al, 0x61
jb 0x418dfa
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
inc ebp
cmp al, 0x2e
je 0x418e09
jmp 0x418df0
ror edx, 0xd
add edx, 0x44
ror edx, 0x1a
add edx, 0x4c
ror edx, 0x1a
add edx, 0x4c
ror edx, 0xd
mov ecx, edx
call 0x418e51
test eax, eax
je 0x418e4a
mov ecx, eax
xor eax, eax
xor edx, edx
mov al, byte ss:[ebp]
test al, al
je 0x418e45
cmp al, 0x61
jb 0x418e3d
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x418e2f
call 0x418d4e
mov dword ss:[esp + 0x1c], eax
popal
ret
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword ds:[ebx + 0xc]
mov ebx, dword ds:[ebx + 0x14]
mov edi, ebx
mov esi, dword ds:[ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword ds:[esi]
test cx, cx
je 0x418ea3
mov al, cl
cmp al, 0x61
jb 0x418e7d
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x418ea3
mov al, cl
cmp al, 0x61
jb 0x418e95
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, ds:[esi + 4]
jmp 0x418e6d
cmp edx, dword ss:[esp + 0x18]
je 0x418eb6
mov ebx, dword ds:[ebx]
cmp edi, dword ds:[ebx]
jne 0x418e65
xor eax, eax
jmp 0x418eba
mov eax, dword ds:[ebx + 0x10]
mov dword ss:[esp + 0x1c], eax
popal
ret
Function at 0x418d4e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword ss:[esp]
mov edx, dword ss:[esp + 8]
mov dword ss:[esp + 8], ecx
mov ecx, dword ss:[esp + 4]
add esp, 8
xor eax, eax
pushal
mov ebx, ecx
mov eax, dword ds:[ebx + 0x3c]
mov eax, dword ds:[ebx + eax + 0x78]
test eax, eax
je 0x418e4a
lea esi, ds:[ebx + eax]
test edx, 0xffff0000
je 0x418e51
mov ecx, dword ds:[esi + 0x18]
mov edi, dword ds:[esi + 0x20]
lea edi, ds:[ebx + edi]
mov ebp, dword ds:[edi + ecx*4 - 4]
lea ebp, ds:[ebx + ebp]
xor eax, eax
xor edx, edx
mov al, byte ss:[ebp]
test al, al
je 0x418da3
cmp al, 0x61
jb 0x418d9b
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x418d8d
cmp edx, dword ss:[esp + 0x14]
je 0x418db4
dec ecx
jne 0x418d80
xor eax, eax
jmp 0x418e4a
mov edx, dword ds:[esi + 0x24]
lea edx, ds:[ebx + edx]
mov edx, dword ds:[edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword ds:[esi + 0x1c]
lea eax, ds:[ebx + eax]
mov eax, dword ds:[eax + edx*4]
lea eax, ds:[ebx + eax]
cmp eax, esi
jbe 0x418e4a
mov ecx, dword ds:[ebx + 0x3c]
mov ecx, dword ds:[ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x418e4a
mov ebp, eax
xor eax, eax
xor edx, edx
mov al, byte ss:[ebp]
cmp al, 0x61
jb 0x418dfa
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
inc ebp
cmp al, 0x2e
je 0x418e09
jmp 0x418df0
ror edx, 0xd
add edx, 0x44
ror edx, 0x1a
add edx, 0x4c
ror edx, 0x1a
add edx, 0x4c
ror edx, 0xd
mov ecx, edx
call 0x418e51
test eax, eax
je 0x418e4a
mov ecx, eax
xor eax, eax
xor edx, edx
mov al, byte ss:[ebp]
test al, al
je 0x418e45
cmp al, 0x61
jb 0x418e3d
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x418e2f
call 0x418d4e
mov dword ss:[esp + 0x1c], eax
popal
ret
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword ds:[ebx + 0xc]
mov ebx, dword ds:[ebx + 0x14]
mov edi, ebx
mov esi, dword ds:[ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword ds:[esi]
test cx, cx
je 0x418ea3
mov al, cl
cmp al, 0x61
jb 0x418e7d
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x418ea3
mov al, cl
cmp al, 0x61
jb 0x418e95
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, ds:[esi + 4]
jmp 0x418e6d
cmp edx, dword ss:[esp + 0x18]
je 0x418eb6
mov ebx, dword ds:[ebx]
cmp edi, dword ds:[ebx]
jne 0x418e65
xor eax, eax
jmp 0x418eba
mov eax, dword ds:[ebx + 0x10]
mov dword ss:[esp + 0x1c], eax
popal
ret
Function at 0x418e51
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword ss:[esp]
mov edx, dword ss:[esp + 8]
mov dword ss:[esp + 8], ecx
mov ecx, dword ss:[esp + 4]
add esp, 8
xor eax, eax
pushal
mov ebx, ecx
mov eax, dword ds:[ebx + 0x3c]
mov eax, dword ds:[ebx + eax + 0x78]
test eax, eax
je 0x418e4a
lea esi, ds:[ebx + eax]
test edx, 0xffff0000
je 0x418e51
mov ecx, dword ds:[esi + 0x18]
mov edi, dword ds:[esi + 0x20]
lea edi, ds:[ebx + edi]
mov ebp, dword ds:[edi + ecx*4 - 4]
lea ebp, ds:[ebx + ebp]
xor eax, eax
xor edx, edx
mov al, byte ss:[ebp]
test al, al
je 0x418da3
cmp al, 0x61
jb 0x418d9b
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x418d8d
cmp edx, dword ss:[esp + 0x14]
je 0x418db4
dec ecx
jne 0x418d80
xor eax, eax
jmp 0x418e4a
mov edx, dword ds:[esi + 0x24]
lea edx, ds:[ebx + edx]
mov edx, dword ds:[edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword ds:[esi + 0x1c]
lea eax, ds:[ebx + eax]
mov eax, dword ds:[eax + edx*4]
lea eax, ds:[ebx + eax]
cmp eax, esi
jbe 0x418e4a
mov ecx, dword ds:[ebx + 0x3c]
mov ecx, dword ds:[ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x418e4a
mov ebp, eax
xor eax, eax
xor edx, edx
mov al, byte ss:[ebp]
cmp al, 0x61
jb 0x418dfa
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
inc ebp
cmp al, 0x2e
je 0x418e09
jmp 0x418df0
ror edx, 0xd
add edx, 0x44
ror edx, 0x1a
add edx, 0x4c
ror edx, 0x1a
add edx, 0x4c
ror edx, 0xd
mov ecx, edx
call 0x418e51
test eax, eax
je 0x418e4a
mov ecx, eax
xor eax, eax
xor edx, edx
mov al, byte ss:[ebp]
test al, al
je 0x418e45
cmp al, 0x61
jb 0x418e3d
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x418e2f
call 0x418d4e
mov dword ss:[esp + 0x1c], eax
popal
ret
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword ds:[ebx + 0xc]
mov ebx, dword ds:[ebx + 0x14]
mov edi, ebx
mov esi, dword ds:[ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword ds:[esi]
test cx, cx
je 0x418ea3
mov al, cl
cmp al, 0x61
jb 0x418e7d
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x418ea3
mov al, cl
cmp al, 0x61
jb 0x418e95
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, ds:[esi + 4]
jmp 0x418e6d
cmp edx, dword ss:[esp + 0x18]
je 0x418eb6
mov ebx, dword ds:[ebx]
cmp edi, dword ds:[ebx]
jne 0x418e65
xor eax, eax
jmp 0x418eba
mov eax, dword ds:[ebx + 0x10]
mov dword ss:[esp + 0x1c], eax
popal
ret
Function at 0x419338
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x5a3bc8], 0
jne 0x419360
call fcn.00419530
test eax, eax
je 0x419360
jmp 0x419360
call fcn.00419a08
mov dword [0x5a3bcc], eax
mov dword [ebp - 4], esp
mov eax, dword [0x5a3b54]
push eax
push 0x24
call fcn.00441a5e
add esp, 4
mov edi, eax
pop ebx
push eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], eax
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
nop
nop
cmp dword [ebp - 4], esp
je 0x419422
push 0x354
push 0x40ab1c8
push 6
call fcn.00441a64
add esp, 0xc
push eax
mov ebx, dword [ebp - 8]
push ebx
mov edi, dword [ebp - 0xc]
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
call fcn.00441a6a
add esp, 4
pop eax
call fcn.00419a5c
mov dword [0x5a3bd0], eax
call fcn.00419b38
mov dword [0x5a3b94], eax
call fcn.00419b90
mov dword [0x5a3bd4], eax
call fcn.00419bb4
mov dword [0x5a3bd8], eax
call fcn.00419bd8
mov dword [0x5a3bdc], eax
call fcn.00419bfc
mov dword [0x5a3be0], eax
call fcn.00419c20
mov dword [0x5a3be4], eax
call fcn.004024cc
mov dword [0x5a3b70], eax
call fcn.00419c44
mov dword [0x5a3be8], eax
call fcn.00419c80
push 1
push 1
push 1
push 1
call fcn.00419e08
mov dword [0x5a3b60], eax
push 0x5a3b8c
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 8]
mov esp, ebp
pop ebp
ret
Function at 0x4198ba
Capabilities:
Access peb ldr_data
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov esi, dword [ebp + 8]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
lea ecx, [eax + 0x14]
mov eax, dword [eax + 0x14]
cmp eax, ecx
je 0x4199f0
mov edx, eax
mov eax, dword [eax]
test eax, eax
je 0x4198dd
cmp dword [edx + 0x10], esi
jne 0x4198d5
xor eax, eax
mov dword [esp + 0x14], 0x8000000
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], SysReAllocString
mov eax, dword [edx + 0x20]
mov dword [esp], eax
call dword [ebp + 0x10]
sub esp, 0x1c
mov ebx, eax
cmp eax, 0xffffffff
je 0x4199f0
mov ecx, dword [esi + 0x3c]
mov eax, dword [ebp + 0xc]
add ecx, esi
sub eax, esi
lea edx, [ecx + 0xf8]
movzx ecx, word [ecx + 6]
mov dword [ebp - 0x24], eax
imul ecx, ecx, 0x28
add ecx, edx
cmp edx, ecx
je 0x4199e9
mov esi, dword [edx + 0xc]
cmp eax, esi
jb 0x41996a
mov edi, dword [edx + 0x10]
add edi, esi
cmp edi, eax
jb 0x41996a
add eax, dword [edx + 0x14]
sub eax, esi
jne 0x41996f
jmp 0x4199e9
add edx, 0x28
jmp 0x419949
xor edi, edi
mov dword [esp + 4], eax
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
mov dword [esp], ebx
call dword [ebp + 0x14]
sub esp, 0x10
inc eax
je 0x4199e9
xor esi, esi
lea eax, [ebp - 0x24]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x20]
mov dword [esp + 0x10], esi
mov dword [esp + 8], 8
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [ebp + 0x18]
sub esp, 0x14
test eax, eax
je 0x4199e9
cmp dword [ebp - 0x24], 8
jne 0x4199e9
cmp byte [ebp - 0x20], 0xb8
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
jne 0x4199e9
shrd eax, edx, 8
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
add eax, 5
mov dword [ebp - 0x1c], eax
mov dword [esp], ebx
call dword [ebp + 0x1c]
push ebx
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
jmp 0x4199f4
mov dword [esp], ebx
call dword [ebp + 0x1c]
push eax
xor eax, eax
xor edx, edx
leave
ret 0x18

Function at 0x419a08
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push esi
call 0x419a11
pop eax
mov esi, dword fs:[0x30]
mov esi, dword [esi + 0xc]
mov esi, dword [esi + 0x1c]
push esi
mov ebx, dword [esi + 8]
cmp eax, ebx
jb 0x419a34
mov ecx, dword [esi + 0x10]
add ecx, ebx
cmp eax, ecx
ja 0x419a34
mov eax, ebx
jmp 0x419a49
mov esi, dword [esi]
mov ebx, dword [esi]
cmp ebx, dword [esp]
jne 0x419a20
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
pop esi
pop esi
leave
ret