joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1006886a
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100e70dc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x18], 0x10
push ecx
mov eax, dword [edi + 0x1ac]
or esi, 0xffffffff
mov ebx, dword [edi]
push eax
mov dword [ebp - 0x1c], eax
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x100688c2
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x10
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.WS2_32.dll_accept]
mov esi, eax
push dword [ebp - 0x1c]
push edi
call fcn.1004ea49
pop ecx
pop ecx
cmp esi, 0xffffffff
jne 0x100688e4
push str.Error_accept__ing_server_connect
push ebx
call fcn.1004e0de
pop ecx
pop ecx
push 0x1e
pop eax
jmp 0x1006894f
push str.Connection_accepted_from_server_n
push ebx
call fcn.1004e1b4
and dword [edi + 0x284], 0xfffff7ff
push 1
push esi
mov dword [edi + 0x1ac], esi
call fcn.10071432
add esp, 0x10
mov byte [edi + 0x1b9], 1
cmp dword [ebx + 0x610], 0
je 0x1006894d
push 1
push ebx
call fcn.10041abc
push 1
push esi
push dword [ebx + 0x614]
call dword [ebx + 0x610]
push 0
push ebx
mov esi, eax
call fcn.10041abc
add esp, 0x1c
test esi, esi
je 0x1006894d
push edi
call fcn.10068ced
pop ecx
push 0x2a
jmp 0x100688e1
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1007bf25
mov esp, ebp
pop ebp
ret

Function at 0x1006a821
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
lea eax, [ecx - 0xc8]
mov edx, dword [edi]
cmp eax, 0x64
jb 0x1006a84d
push str.Couldnt_set_desired_mode
push edx
call fcn.1004e0de
pop ecx
pop ecx
push 0x11
pop eax
jmp 0x1006a8a1
cmp ecx, 0xc8
je 0x1006a864
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push edx
call fcn.1004e1b4
add esp, 0xc
mov eax, dword [ebp + 0x10]
cmp eax, 0x13
jne 0x1006a875
push edi
call fcn.1006a5ce
pop ecx
jmp 0x1006a89d
cmp eax, 0x14
jne 0x1006a882
push edi
call fcn.1006977a
jmp 0x1006a872
cmp eax, 0x15
jne 0x1006a88b
push 0xd
jmp 0x1006a892
cmp eax, 0x16
jne 0x1006a89f
push 0xe
push 1
push edi
call fcn.1006a1c9
add esp, 0xc
mov esi, eax
mov eax, esi
pop edi
pop esi
pop ebp
ret
Function at 0x10074da1
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ebx
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x10074db1
sub esi, ecx
cmp esi, 0x7fffffff
jbe 0x10074dca
push 0x1b
pop eax
jmp 0x10074e90
push edi
test esi, esi
je 0x10074ddb
lea eax, [esi + esi]
push eax
call dword [0x100e7064]
jmp 0x10074de6
push 0x100da4ce
call dword [0x100e7070]
mov edi, eax
pop ecx
test edi, edi
jne 0x10074df5
push 0x1b
pop eax
jmp 0x10074e8f
xor edx, edx
mov ecx, edx
test esi, esi
je 0x10074e0c
mov al, byte [ecx + ebx]
mov byte [edi + ecx*2], al
mov byte [edi + ecx*2 + 1], dl
inc ecx
cmp ecx, esi
jb 0x10074dfd
push 0xf0000000
push 1
push edx
push edx
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov ebx, dword [ebp + 0x10]
test eax, eax
je 0x10074e7d
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x8002
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x10074e72
push 0
lea eax, [esi + esi]
mov dword [ebp - 0xc], 0x10
push eax
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
lea eax, [ebp - 0xc]
push eax
push ebx
push 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
and dword [ebx + 0x10], 0
push edi
mov byte [ebx + 0x14], 0
call dword [0x100e7068]
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10074e96
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100e70dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push 0xf0000000
inc ebx
mov dword [ebp - 0x28], eax
push ebx
push 0
push 0
lea eax, [ebp - 0x24]
mov dword [ebp - 0x1c], 8
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x10074eda
xor al, al
jmp 0x10074f6c
push edi
xor eax, eax
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x28]
mov word [ebp - 0x18], 0x208
mov dword [ebp - 0x14], 0x6601
mov dword [ebp - 0x10], 8
call fcn.10074f7c
lea eax, [ebp - 0xc]
push 8
push eax
call fcn.10077e98
add esp, 0x10
lea eax, [ebp - 0x20]
push eax
push 0
push 0
push 0x14
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
pop edi
test eax, eax
jne 0x10074f33
xor bl, bl
jmp 0x10074f5f
mov ecx, dword [ebp + 8]
push dword [ebp - 0x1c]
mov eax, dword [ecx]
mov dword [esi], eax
mov eax, dword [ecx + 4]
mov dword [esi + 4], eax
lea eax, [ebp - 0x1c]
push eax
push esi
xor eax, eax
push eax
push eax
push eax
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push 0
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov al, bl
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1007bf25
mov esp, ebp
pop ebp
ret
Function at 0x10078eed
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0x100e7064]
mov edi, eax
pop ecx
test edi, edi
je 0x10078fd9
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x10078f56
push ecx
call dword [esi]
push ebx
push dword [ebp + 0xc]
push dword [edi + 4]
call dword [esi + 4]
mov eax, dword [edi + 8]
add eax, dword [esi + 0xc]
push dword [edi + 4]
mov dword [ebp - 4], eax
push eax
call dword [esi + 8]
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], ebx
jmp 0x10078f5c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [edi + 4]
call dword [esi]
push dword [edi + 8]
call dword [esi]
mov eax, dword [ebp + 0x10]
xor ebx, ebx
pop ecx
pop ecx
test eax, eax
je 0x10078fd1
mov dword [ebp - 8], eax
mov ebx, eax
mov eax, dword [ebp - 4]
push 1
mov al, byte [eax]
xor al, 0x36
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push eax
push dword [edi + 4]
call dword [esi + 4]
mov ecx, dword [ebp - 4]
push 1
mov al, byte [ecx]
xor al, 0x5c
inc ecx
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push eax
push dword [edi + 8]
mov dword [ebp - 4], ecx
call dword [esi + 4]
add esp, 0x18
sub ebx, 1
jne 0x10078f76
mov ebx, dword [ebp - 8]
jmp 0x10078fd1
push 1
push 0x100ccf57
push dword [edi + 4]
call dword [esi + 4]
push 1
push 0x100ccf58
push dword [edi + 8]
call dword [esi + 4]
add esp, 0x18
inc ebx
cmp ebx, dword [esi + 0x10]
jb 0x10078fb3
mov eax, edi
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1007b435
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
movsx eax, byte [ecx + 8]
push esi
push edi
sub eax, 0
je 0x1007b4b2
sub eax, 1
je 0x1007b4a3
sub eax, 1
je 0x1007b494
sub eax, 1
je 0x1007b47c
sub eax, 1
je 0x1007b46f
sub eax, 1
jne 0x1007b4c8
cmp byte [ecx], 0
mov eax, str.true
mov edx, str.false
cmove eax, edx
push eax
jmp 0x1007b4b7
cmp dword [ecx], 0
mov eax, 0x100da4ce
cmovne eax, dword [ecx]
jmp 0x1007b46c
movsd xmm0, qword [ecx]
push ecx
push ecx
movsd qword [esp], xmm0
push dword [ebp + 8]
call fcn.1007ba8a
add esp, 0xc
jmp 0x1007b4bf
push dword [ecx + 4]
push dword [ecx]
push dword [ebp + 8]
call fcn.1007bb8c
jmp 0x1007b48f
push dword [ecx + 4]
push dword [ecx]
push dword [ebp + 8]
call fcn.1007bb21
jmp 0x1007b48f
push 0x100da4ce
mov ecx, dword [ebp + 8]
call fcn.10003a10
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebp
ret 4
push 8
pop ecx
mov esi, 0x100cd288
mov edi, 0x29a
rep movsd dword es:[edi], dword [esi]
push 0x7b
movsw word es:[edi], word [esi]
call fcn.100a32ef
int3
Function at 0x1007b502
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
cmp esi, 0xffffffff
jne 0x1007b51e
mov esi, dword [ebp + 8]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x1007b515
sub esi, ecx
mov eax, bind
cmp esi, 0x7fffffff
cmovae esi, eax
lea eax, [esi + 1]
push eax
call fcn.100a277d
mov edi, eax
pop ecx
test edi, edi
je 0x1007b553
push esi
push dword [ebp + 8]
push edi
call fcn.10094e60
add esp, 0xc
mov byte [edi + esi], 0
mov eax, edi
pop edi
pop esi
pop ebp
ret
push 9
pop ecx
mov esi, str.Failed_to_allocate_string_value_buffer
mov edi, 0x29a
rep movsd dword es:[edi], dword [esi]
push 0x7b
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.100a32ef
int3

Function at 0x1007ee36
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x100ae38f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100ae052

Function at 0x100ae39a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100ae1d3

Function at 0x100b44e4
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100b41a4
Function at 0x6d464bf6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x6d464c05
pop dword [ebp - 8]
mov eax, 0x6d464c05
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x6c53c18e
add dword [ebp - 0x18], 0xe1fe83bd
mov dword [ebp - 0x14], 0x1910abb
add dword [ebp - 0x14], 0x30a2418a
mov dword [ebp - 0x10], 0x5254bb49
add dword [ebp - 0x10], 0xf9f788e5
mov dword [ebp - 0xc], 0x25baf2e8
sub dword [ebp - 0xc], 0x25baf2e8
lea eax, [ebp - 0x18]
push eax
mov eax, 0xd44065a8
sub eax, 0x66f9d558
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x6f0b648f
add dword [ebp - 0x18], 0x56704c7
mov dword [ebp - 0x14], 0x10406715
add dword [ebp - 0x14], 0x312bfa60
mov dword [ebp - 0x10], 0xc069fbfa
sub dword [ebp - 0x10], 0x5cfa8f8e
mov dword [ebp - 0xc], 0xd496fe6
add dword [ebp - 0xc], 0xf2b6901a
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x9fbd51d5
sub eax, 0x3276c17d
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3babf
push 0
call eax
mov ecx, 0x21f7e1a6
sub ecx, 0x21f78798
xor esi, esi
add esi, eax
mov edi, 0xd01110b3
sub edi, 0x62ca28b3
add edi, dword [ebp - 8]
mov ebx, 0xd2d76341
add ebx, 0x9bd9a0ca
mov dword [ebp - 4], 0x7d685fad
mov edx, dword [edi]
add dword [ebp - 4], 0x6fa41213
xor edx, ebx
xor dword [ebp - 4], edx
mov dword [esi], edx
sub dword [ebp - 4], esi
add esi, 0x384d2970
add esi, 0xc7b2d694
add edi, 0x364e227
add edi, 0xfc9b1ddd
loop 0x6d464d24
add eax, 0x6b3aa3c
add eax, 0xf94db0cf
mov ebx, eax
add eax, 0xdc58936b
sub eax, 0xdc589366
mov ecx, 0x6d460000
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x6d4678c4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x6d4678ce
repz ret
jmp fcn.6d467caf
Function at 0x405838
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x4060d0
call fcn.00405e04
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, ebx
mov edx, 0x407364
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x40587d
cmp eax, esi
jne 0x405870
xor esi, esi
inc esi
mov edi, esi
jmp 0x405880
push 0x3e8
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x405854
xor esi, esi
inc esi
cmp dword [0x407368], esi
jne 0x405892
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x4058cc
cmp dword [0x407368], ebx
jne 0x4058c6
mov dword [0x407368], esi
push 0x401018
push 0x40100c
call fcn.004059ac
pop ecx
pop ecx
test eax, eax
je 0x4058cc
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x4059a1
mov dword [0x407014], esi
cmp dword [0x407368], esi
jne 0x4058ef
push 0x401008
push section..text
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x407368], 2
test edi, edi
jne 0x4058fc
xor eax, eax
mov ecx, 0x407364
xchg dword [ecx], eax
cmp dword [0x407374], 0
je 0x405928
push 0x407374
call fcn.00405c30
pop ecx
test eax, eax
je 0x405928
push ebx
push 2
push ebx
mov esi, dword [0x407374]
mov ecx, esi
call dword [0x408144]
call esi
push dword [0x407020]
push dword [0x40701c]
push dword [0x407018]
call fcn.00401a93
add esp, 0xc
mov dword [0x407010], eax
cmp dword [0x407028], 0
jne 0x405986
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
push ecx
push eax
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x407014], 0
jne 0x40599a
call dword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x407010]
mov dword [ebp - 4], 0xfffffffe
call fcn.00405e4c
ret
call fcn.0052d000
jmp 0x405838

Function at 0x405b1f
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x406148
call fcn.0040603c
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x405b7f
cmp eax, 0xffffffff
je 0x405b7f
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x405b78
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x405b78
cmp edx, 0x10000000
jae 0x405b78
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x405b75
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
call fcn.00406081
ret 4

Function at 0x405be0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x405c1e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x405c16
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x405c20
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x405c06
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x7a6db8
Capabilities:
Encode data using xor

Disassembly:
jmp 0x7a6dc2
pushal
call 0x7a6dc8
pop ebp
sub ebp, 0x10
sub ebp, 0x3a6db8
mov al, byte [esp + 0x28]
cmp al, 1
je 0x7a6dec
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x7a6df5
mov eax, 0x3a6db8
add eax, ebp
add eax, 0x63
mov ecx, 0x5e6
add byte [ecx + 0x5e6], bh
mov edx, 0xbc6640dc
xor byte [eax], dl
inc eax
dec ecx
jne 0x7a6e0c
jmp 0x7a6e1f
push edi
adc dword [edi + 0x55], edx
loopne 0x7a6e01
invalid
Function at 0x401250
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
mov ebx, edx
mov dword [ebp - 4], ecx
push edi
mov edi, dword [ebx + 4]
sub edi, dword [ebx]
cmp edi, eax
jb 0x40126f
pop edi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
push esi
mov esi, eax
mov ecx, ebx
push eax
sub esi, edi
call fcn.00401a20
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
sub eax, ecx
cmp eax, edi
jbe 0x4012c5
mov dword [ebp + 8], 0
lea eax, [ecx + edi]
cmp esi, 0xffffffff
ja 0x4012bc
push 0
lea ecx, [ebp + 8]
push ecx
push esi
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4012bc
cmp dword [ebp + 8], esi
jne 0x4012bc
pop esi
pop edi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push str.invalid_vector_T__subscript
call fcn.0040d0b3
int3

Function at 0x4012d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, edx
push ebx
push esi
push edi
lea esi, [eax + 8]
mov dword [ebp - 0xc], eax
lea edi, [eax + 0x10]
mov ebx, ecx
mov eax, dword [esi]
cmp eax, dword [edi]
cmovb edi, esi
mov edx, dword [edi]
test edx, edx
je 0x4013b3
mov eax, dword [ebp + 8]
movzx ecx, al
mov eax, 0x51eb851f
imul ecx, edx
mov dword [ebp - 4], 1
mul ecx
lea eax, [ebp - 4]
shr edx, 5
lea ecx, [ebp - 8]
cmp edx, 1
mov dword [ebp - 8], edx
cmovae eax, ecx
mov edi, dword [eax]
test edi, edi
je 0x4013b3
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
cmp eax, 0x7fffffff
ja 0x4013aa
push 0
push 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x4013aa
mov esi, dword [ebp + 0x10]
mov ecx, dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], 0
cmp edi, esi
jbe 0x40137c
cmp esi, 0xffffffff
ja 0x4013aa
push 0
lea edx, [ebp - 4]
push edx
push esi
push eax
push ebx
call ecx
test eax, eax
je 0x4013aa
cmp dword [ebp - 4], esi
jne 0x4013aa
sub edi, esi
jmp 0x40134b
cmp edi, 0xffffffff
ja 0x4013a1
push 0
lea edx, [ebp - 4]
push edx
push edi
push eax
push ebx
call ecx
test eax, eax
je 0x4013a1
cmp dword [ebp - 4], edi
jne 0x4013a1
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4013c0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
xor eax, eax
push esi
push edi
mov dword [ebp - 0x24], eax
mov edi, edx
mov dword [ebp - 0x20], eax
mov esi, ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x20]
mov ecx, 0x1000
test eax, eax
cmove eax, ecx
lea ecx, [edi - 1]
add ecx, esi
mov dword [ebp - 0x20], eax
cmp esi, ecx
jae 0x401419
lea esp, [esp]
mov al, byte [esi]
add esi, dword [ebp - 0x20]
cmp esi, ecx
jb 0x401410
mov al, byte [ecx]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4015e0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 9
push 0
push ecx
mov byte [ebp - 1], dl
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, eax
test ebx, ebx
je 0x401712
mov eax, 0x5a4d
mov dword [ebp - 0x1c], 0x414520
mov dword [ebp - 0x18], ebx
cmp word [ebx], ax
jne 0x401712
mov eax, dword [ebx + 0x3c]
add eax, ebx
cmp dword [eax], 0x4550
jne 0x401712
mov ecx, 0xe0
cmp word [eax + 0x14], cx
jne 0x401712
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x401712
xor edx, edx
xor esi, esi
mov ecx, dword [ebx + 0x3c]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], edx
movzx eax, word [ecx + ebx + 6]
cmp edx, eax
jae 0x401702
movzx eax, word [ecx + ebx + 0x14]
add eax, esi
lea esi, [ebx + 0x18]
add esi, ecx
add esi, eax
je 0x401702
mov eax, dword [esi + 8]
lea ecx, [esi + 8]
cmp eax, dword [esi + 0x10]
lea edx, [esi + 0x10]
cmovb edx, ecx
mov eax, dword [edx]
test eax, eax
je 0x4016f3
movzx ecx, byte [ebp - 1]
imul ecx, eax
mov eax, 0x51eb851f
mov dword [ebp - 8], 1
mul ecx
lea eax, [ebp - 8]
shr edx, 5
lea ecx, [ebp - 0x14]
cmp edx, 1
mov dword [ebp - 0x14], edx
cmovae eax, ecx
mov eax, dword [eax]
mov dword [ebp - 8], eax
test eax, eax
je 0x4016f3
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x4016c6
xor edi, edi
jmp 0x4016c9
lea edi, [eax + ebx]
push edi
lea ecx, [ebp - 0x1c]
call fcn.00401b90
cmp esi, eax
jne 0x401712
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0x1c]
dec eax
add eax, edi
push eax
call fcn.00401b90
cmp esi, eax
jne 0x401712
mov edx, dword [ebp - 8]
mov ecx, edi
call fcn.004013c0
mov edx, dword [ebp - 0xc]
mov esi, dword [ebp - 0x10]
inc edx
add esi, 0x28
jmp 0x40164c
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401720
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40e6db
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [section..data]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x418268], 0
jne 0x40179e
push 0x28
call fcn.0040261f
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x401776
mov ecx, eax
call fcn.00401c60
mov esi, eax
jmp 0x401778
xor esi, esi
push 0
push esi
push 0x418268
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x40179e
test esi, esi
je 0x40179e
push esi
call fcn.004025f4
add esp, 4
mov eax, dword [0x418268]
cmp dword [eax], 1
jle 0x401869
push 0
push 0x8000000
push 3
push 0
push 7
push 0x80000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4017f1
test esi, esi
je 0x4017f1
push 4
push 0x1000
push 0x100000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
jne 0x401805
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor ebx, ebx
lea eax, [ebp - 0x10]
push ebx
push eax
push 0x100000
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x401840
lea ecx, [ecx]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x401840
push 0
add ebx, eax
lea eax, [ebp - 0x10]
push eax
push 0x100000
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x401820
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 9
push 0
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
je 0x4017f1
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x4017f1
mov eax, dword [esi + 0x3c]
cmp dword [eax + esi], 0x4550
jne 0x4017f1
mov ecx, 0xe0
cmp word [eax + esi + 0x14], cx
jne 0x4017f1
mov ecx, 0x10b
cmp word [eax + esi + 0x18], cx
jne 0x4017f1
mov eax, dword [eax + esi + 0x50]
lea ecx, [ebp - 0x14]
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x10]
mov dword [ebp - 0x14], 0xffffffff
cmovae edx, ecx
mov ecx, esi
mov edx, dword [edx]
call fcn.004013c0
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401b90
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ecx + 4]
xor edx, edx
push edi
mov dword [ebp - 4], esi
mov ebx, dword [esi + 0x3c]
add ebx, esi
xor edi, edi
movzx ecx, word [ebx + 6]
cmp edx, ecx
jae 0x401beb
movzx eax, word [ebx + 0x14]
lea ecx, [ebx + 0x18]
add eax, edi
add ecx, eax
je 0x401beb
mov eax, dword [ecx + 0xc]
test eax, eax
jne 0x401bc6
xor esi, esi
jmp 0x401bcd
add esi, eax
cmp esi, dword [ebp + 8]
ja 0x401bd7
mov eax, dword [ecx + 8]
add eax, esi
cmp eax, dword [ebp + 8]
ja 0x401be0
mov esi, dword [ebp - 4]
inc edx
add edi, 0x28
jmp 0x401ba6
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x401c00
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [ecx + 4]
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x401c10
xor al, al
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x401c0d
mov ecx, 0xe0
cmp word [eax + 0x14], cx
jne 0x401c0d
mov ecx, 0x10b
cmp word [eax + 0x18], cx
sete al
ret