joyce8/EMBER2024-capa huggingface dataset:
Function at 0x671384
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
push ebp
push ebx
sub esp, 0x264
mov ebp, ecx
mov eax, dword [esp + 0x278]
mov edi, dword [esp + 0x27c]
mov dword [esp + 0x18], eax
mov eax, dword [0xaafc98]
test eax, eax
jl 0x6714d2
cmp eax, 9
jg 0x6714d2
mov esi, dword [esp + 0x18]
xor eax, eax
xor edx, edx
test edi, edi
jbe 0x6714cb
mov dword [esp + 0x20], ebp
mov ebx, eax
mov ebp, edx
xor edx, edx
xor ecx, ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x54], ecx
mov dword [esp + 0x58], ecx
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x60], ecx
mov dword [esp + 0x64], ecx
mov dword [esp + 0x68], ecx
mov dword [esp + 0x6c], ecx
mov dword [esp + 0x70], ecx
mov dword [esp + 0x74], ecx
mov dword [esp + 0x78], ecx
mov dword [esp + 0x7c], ecx
mov dword [esp + 0x80], ecx
mov dword [esp + 0x84], ecx
mov dword [esp + 0x88], ecx
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x90], ecx
mov dword [esp + 0x94], ecx
mov dword [esp + 0x98], ecx
mov dword [esp + 0x9c], ecx
mov dword [esp + 0xa0], ecx
add esi, 1
movzx eax, byte [esi - 1]
mov byte [esp + edx + 0x24], al
add ebp, 1
movsx ecx, byte [esp + edx + 0x24]
add edx, 1
cmp ecx, 0xa
je 0x671bff
cmp edx, 0x80
jge 0x6714a2
cmp ebp, edi
jb 0x67146f
test edx, edx
je 0x671bf4
lea ecx, [esp + 0x24]
push 6
push 0x93a3d4
push ecx
call fcn.008598c0
add esp, 0xc
test eax, eax
jne 0x6714bd
add ebx, 1
cmp ebp, edi
jb 0x6713d0
mov ebp, dword [esp + 0x20]
mov eax, ebx
jmp 0xb68088
add esp, 0x264
pop ebx
pop ebp
pop esi
pop edi
ret 8
mov ebp, dword [esp + 0x20]
mov eax, ebx
jmp 0x6714cb
test edx, edx
jne 0x6714a2
jmp 0x6714bd

Function at 0x6750e8
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x8e9700
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov eax, dword [ebp + 0xc]
push dword [ebp + 8]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], eax
call fcn.006132e4
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x14]
mov dword [ecx], 0xb36660
mov eax, dword [0x9c9920]
push edx
mov dword [ecx + 4], eax
call dword [0xb36674]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x30]
xor edx, edx
mov dword [eax + 0xd0], 0x10
or ecx, 0x40000000
mov word [eax + 0xc8], dx
mov dword [eax + 0xe0], 0x43fa0000
mov dword [eax + 0xcc], edx
mov word [eax + 0xd4], dx
mov word [eax + 0xd6], dx
mov dword [eax + 0x98], 3
mov dword [eax + 0xd8], edx
mov dword [eax + 0xdc], edx
mov dword [eax + 0x30], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x67d8f0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x8ea218
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], ebx
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
movzx edx, word [ebp + 0x10]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edx
call fcn.007b4b48
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov dword [edx], 0xb38150
mov ecx, dword [0x9cb490]
mov dword [edx + 4], ecx
mov ebx, dword [eax]
mov dword [edx + 0xb8], ebx
mov esi, dword [eax + 4]
mov dword [edx + 0xbc], esi
mov edi, dword [eax + 8]
mov dword [edx + 0xc0], edi
mov dword [edx + 0xac], ebx
mov dword [edx + 0xb0], esi
mov dword [edx + 0xb4], edi
mov ecx, dword [eax + 0xc]
mov dword [edx + 0xd0], ecx
mov ecx, dword [eax + 0x10]
mov dword [edx + 0xd4], ecx
mov ecx, dword [eax + 0x14]
mov dword [edx + 0xd8], ecx
fld dword [eax + 0x18]
mov ecx, dword [eax + 0x18]
mov dword [edx + 0xc4], ecx
fld dword [eax + 0x1c]
mov ecx, dword [eax + 0x1c]
mov dword [edx + 0xc8], ecx
fld dword [eax + 0x20]
mov ecx, dword [eax + 0x20]
mov dword [edx + 0xcc], ecx
fxch st(2)
fmul dword [eax + 0x28]
fstp dword [edx + 0xc4]
fmul dword [eax + 0x28]
fstp dword [edx + 0xc8]
fmul dword [eax + 0x28]
fstp dword [edx + 0xcc]
mov ecx, dword [eax + 0x24]
mov dword [edx + 0xe4], ecx
mov ecx, dword [eax + 0x2c]
mov dword [edx + 0xe8], ecx
mov ecx, dword [eax + 0x30]
mov dword [edx + 0xf0], ecx
mov eax, dword [eax + 0x34]
mov dword [edx + 0xec], eax
mov eax, dword [ebp - 0x18]
push eax
call fcn.007b4d18
mov edx, dword [ebp - 0x28]
push 0x135
mov dword [edx + 0xfc], eax
add edx, 0xb8
push edx
call fcn.00509590
add esp, 0xc
mov edx, dword [ebp - 0x28]
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
mov dword [edx + 0xf8], eax
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x68f578
Capabilities:
Enumerate pe sections

Disassembly:
push edi
push ebp
push ebx
sub esp, 0x20
mov byte [esp + 4], 0x2b
xor edx, edx
mov byte [esp + 0x1c], 2
mov byte [esp + 0x1d], dl
mov byte [esp + 0x1e], dl
mov byte [esp + 0x1f], dl
mov byte [esp + 5], 7
mov ecx, dword [eax]
mov dword [esp + 4], ecx
lea ecx, [esp + 8]
mov edx, dword [eax + 4]
mov dword [esp + 8], edx
mov edx, dword [eax + 8]
mov dword [esp + 0xc], edx
mov edx, dword [eax + 0xc]
mov dword [esp + 0x10], edx
mov edx, dword [eax + 0x10]
mov dword [esp + 0x14], edx
mov edx, dword [eax + 0x14]
mov dword [esp + 0x18], edx
mov eax, dword [eax + 0x18]
mov dword [esp + 0x1c], eax
call fcn.0061cdb0
lea ecx, [esp + 4]
call fcn.006a9e70
test eax, eax
je 0x68f656
movzx eax, word [esp + 6]
call fcn.0068d5ac
mov edi, eax
test edi, edi
je 0x68f656
mov ecx, edi
call fcn.0068fb8c
test eax, eax
jne 0x68f656
movzx edx, byte [esp + 5]
add edx, edx
add edx, edx
cmp edx, 0x18
jne 0x68f619
push 0
lea ecx, [esp + 0xc]
xor ebp, ebp
call fcn.00779df0
jmp 0x68f629
push 2
lea ecx, [esp + 0xc]
mov ebp, 2
call fcn.00779df0
lea ecx, [esp + 8]
call fcn.0061cdb0
lea edx, [esp + 8]
push edx
call fcn.005c3a80
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x68f656
push ebx
mov ecx, edi
call fcn.00687904
test eax, eax
je 0x68f656
cmp ebp, 2
je 0x68f65d
add esp, 0x20
pop ebx
pop ebp
pop edi
ret
movsx edx, byte [esp + 0x1d]
test edx, edx
je 0x68f656
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 0x7c]
lea ecx, [edi + 0xdf8]
movsx edx, al
push edx
call fcn.0069792c
test eax, eax
jne 0x68f656
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 0x7c]
movsx edx, al
mov dword [edi + edx*4 + 0xdf8], ebx
mov ebp, dword [edi + 0x33c]
mov ecx, ebx
or ebp, 0x20000
mov dword [edi + 0x33c], ebp
mov edx, dword [ebx]
call dword [edx + 0x48]
mov edx, dword [edi + 0x33c]
and edx, 0xfffdffff
mov dword [edi + 0x33c], edx
add esp, 0x20
pop ebx
pop ebp
pop edi
ret
Function at 0x68fbf4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x84
mov byte [esp + 8], 0xc4
mov edx, 0xffffffff
mov byte [esp + 9], 0x1f
mov eax, 0xffff
mov word [esp + 0xa], ax
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], edx
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], edx
mov dword [esp + 0x48], edx
mov dword [esp + 0x4c], edx
mov dword [esp + 0x50], edx
mov dword [esp + 0x54], edx
mov dword [esp + 0x58], edx
mov dword [esp + 0x5c], edx
mov dword [esp + 0x60], edx
mov dword [esp + 0x64], edx
mov dword [esp + 0x68], edx
mov dword [esp + 0x6c], edx
mov dword [esp + 0x70], edx
mov dword [esp + 0x74], edx
mov dword [esp + 0x78], edx
mov dword [esp + 0x7c], edx
mov dword [esp + 0x80], edx
lea eax, [esp + 0xc]
mov edx, dword [ecx + 0xdf4]
mov edx, dword [edx + 0x1c4]
mov ecx, dword [edx + 0x18]
test ecx, ecx
je 0x68fd02
mov dword [esp + 4], ebx
mov ebx, ecx
mov dword [esp], esi
mov esi, eax
mov edx, dword [ebx + 4]
cmp edx, dword [0x9cba2c]
jne 0x68fcd1
mov ecx, ebx
call fcn.008173b4
test eax, eax
je 0x68fccd
mov edx, 1
jmp 0x68fcd3
xor edx, edx
jmp 0x68fcd3
xor edx, edx
test edx, edx
je 0x68fcf4
mov ecx, ebx
call fcn.006a60dc
test eax, eax
je 0x68fcf4
mov edx, dword [eax + 0xd8]
cmp edx, 0xffffffff
je 0x68fcf4
mov eax, esi
add esi, 4
mov dword [eax], edx
mov ebx, dword [ebx + 0x10]
test ebx, ebx
jne 0x68fcb0
mov ebx, dword [esp + 4]
mov esi, dword [esp]
lea ecx, [esp + 8]
call fcn.008003e0
add esp, 0x84
ret
Function at 0x6c1c9c
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x8ec66c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x28], 0
push 0xbaa4
call fcn.008581c5
mov dword [ebp - 0x14], eax
add esp, 4
mov dword [ebp - 0x24], eax
test eax, eax
je 0x6c1e29
mov dword [ebp - 0x28], 1
mov dword [ebp - 4], 0
push 0x6c1940
push 0x6c17f0
push 4
lea edx, [eax + 4]
push 0x2ea4
push edx
call fcn.00858736
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 0xffffffff
push 0xbaa4
push dword [ebp + 8]
mov eax, dword [ebp - 0x14]
push eax
call fcn.0086b324
add esp, 0xc
mov eax, dword [ebp - 0x14]
mov esi, dword [eax]
mov dword [eax], 0
mov ebx, 0xffffffff
xor ecx, ecx
mov eax, dword [ebp - 0x14]
movzx edx, byte [ecx + eax]
xor ebx, edx
test bl, 1
je 0x6c1d59
shr ebx, 1
xor ebx, 0xedb88320
jmp 0x6c1d5b
shr ebx, 1
test bl, 1
je 0x6c1d6a
shr ebx, 1
xor ebx, 0xedb88320
jmp 0x6c1d6c
shr ebx, 1
test bl, 1
je 0x6c1d7b
shr ebx, 1
xor ebx, 0xedb88320
jmp 0x6c1d7d
shr ebx, 1
test bl, 1
je 0x6c1d8c
shr ebx, 1
xor ebx, 0xedb88320
jmp 0x6c1d8e
shr ebx, 1
test bl, 1
je 0x6c1d9d
shr ebx, 1
xor ebx, 0xedb88320
jmp 0x6c1d9f
shr ebx, 1
test bl, 1
je 0x6c1dae
shr ebx, 1
xor ebx, 0xedb88320
jmp 0x6c1db0
shr ebx, 1
test bl, 1
je 0x6c1dbf
shr ebx, 1
xor ebx, 0xedb88320
jmp 0x6c1dc1
shr ebx, 1
test bl, 1
je 0x6c1dd0
shr ebx, 1
xor ebx, 0xedb88320
jmp 0x6c1dd2
shr ebx, 1
add ecx, 1
cmp ecx, 0xbaa4
jb 0x6c1d41
not ebx
test eax, eax
je 0x6c1df0
mov ecx, eax
push 1
call fcn.006c1780
cmp esi, ebx
jne 0x6c1e10
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x6c1d14

Function at 0x6c1e34
Capabilities:
Hash data with crc32

Disassembly:
push esi
push ebx
mov eax, 0xffffffff
mov ebx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
xor edx, edx
test ecx, ecx
jbe 0x6c1ed6
movzx esi, byte [edx + ebx]
xor eax, esi
add edx, 1
test al, 1
je 0x6c1e63
shr eax, 1
xor eax, 0xedb88320
jmp 0x6c1e65
shr eax, 1
test al, 1
je 0x6c1e72
shr eax, 1
xor eax, 0xedb88320
jmp 0x6c1e74
shr eax, 1
test al, 1
je 0x6c1e81
shr eax, 1
xor eax, 0xedb88320
jmp 0x6c1e83
shr eax, 1
test al, 1
je 0x6c1e90
shr eax, 1
xor eax, 0xedb88320
jmp 0x6c1e92
shr eax, 1
test al, 1
je 0x6c1e9f
shr eax, 1
xor eax, 0xedb88320
jmp 0x6c1ea1
shr eax, 1
test al, 1
je 0x6c1eae
shr eax, 1
xor eax, 0xedb88320
jmp 0x6c1eb0
shr eax, 1
test al, 1
je 0x6c1ebd
shr eax, 1
xor eax, 0xedb88320
jmp 0x6c1ebf
shr eax, 1
test al, 1
je 0x6c1ecc
shr eax, 1
xor eax, 0xedb88320
jmp 0x6c1ece
shr eax, 1
cmp edx, ecx
jb 0x6c1e4d
not eax
pop ebx
pop esi
ret
Function at 0x6c26fc
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov ecx, eax
xor edx, edx
mov dword [ecx], edx
mov dword [ecx + 0xbaa0], edx
mov eax, 0xffffffff
xor edx, edx
movzx ebx, byte [edx + ecx]
xor eax, ebx
add edx, 1
test al, 1
je 0x6c2726
shr eax, 1
xor eax, 0xedb88320
jmp 0x6c2728
shr eax, 1
test al, 1
je 0x6c2735
shr eax, 1
xor eax, 0xedb88320
jmp 0x6c2737
shr eax, 1
test al, 1
je 0x6c2744
shr eax, 1
xor eax, 0xedb88320
jmp 0x6c2746
shr eax, 1
test al, 1
je 0x6c2753
shr eax, 1
xor eax, 0xedb88320
jmp 0x6c2755
shr eax, 1
test al, 1
je 0x6c2762
shr eax, 1
xor eax, 0xedb88320
jmp 0x6c2764
shr eax, 1
test al, 1
je 0x6c2771
shr eax, 1
xor eax, 0xedb88320
jmp 0x6c2773
shr eax, 1
test al, 1
je 0x6c2780
shr eax, 1
xor eax, 0xedb88320
jmp 0x6c2782
shr eax, 1
test al, 1
je 0x6c278f
shr eax, 1
xor eax, 0xedb88320
jmp 0x6c2791
shr eax, 1
cmp edx, 0xbaa4
jb 0x6c2710
not eax
mov dword [ecx], eax
pop ebx
ret
Function at 0x70b7cc
Capabilities:
Hash data with crc32

Disassembly:
xor eax, eax
test al, 1
je 0x70b7de
mov edx, eax
shr edx, 1
xor edx, 0xedb88320
jmp 0x70b7e2
mov edx, eax
shr edx, 1
test dl, 1
je 0x70b7f1
shr edx, 1
xor edx, 0xedb88320
jmp 0x70b7f3
shr edx, 1
test dl, 1
je 0x70b802
shr edx, 1
xor edx, 0xedb88320
jmp 0x70b804
shr edx, 1
test dl, 1
je 0x70b813
shr edx, 1
xor edx, 0xedb88320
jmp 0x70b815
shr edx, 1
test dl, 1
je 0x70b824
shr edx, 1
xor edx, 0xedb88320
jmp 0x70b826
shr edx, 1
test dl, 1
je 0x70b835
shr edx, 1
xor edx, 0xedb88320
jmp 0x70b837
shr edx, 1
test dl, 1
je 0x70b846
shr edx, 1
xor edx, 0xedb88320
jmp 0x70b848
shr edx, 1
test dl, 1
je 0x70b857
shr edx, 1
xor edx, 0xedb88320
jmp 0x70b859
shr edx, 1
mov dword [eax*4 + 0xa97f80], edx
add eax, 1
cmp eax, 0x100
jl 0x70b7ce
ret

Function at 0x70bdb4
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebx
mov ebx, eax
push 0x92b680
push ebx
call fcn.0085957c
add esp, 8
test eax, eax
je 0x70bde7
push eax
call fcn.00859710
pop ecx
push ebx
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
test al, 1
je 0x70bde7
push 0x80
push ebx
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
pop ebx
ret

Function at 0x70c294
Capabilities:
Set current directory

Disassembly:
push ebx
sub esp, 0x104
mov ebx, ecx
lea eax, [ebx + 0x1a8e0]
push 0x10
push dword [esp + 0x110]
push eax
call fcn.00858900
lea eax, [ebx + 0x1a8f0]
push 0x10
push dword [esp + 0x120]
push eax
call fcn.00858900
lea eax, [ebx + 0x1a900]
push 0x40
push dword [esp + 0x130]
push eax
call fcn.00858900
add esp, 0x24
mov eax, dword [0xacbef0]
test eax, eax
je 0x70c315
lea eax, [esp + 4]
push 0xaf0700
push 0x96f15c
push eax
call fcn.00858bf5
add esp, 0xc
push 0xacba40
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
lea eax, [esp + 4]
push eax
call fcn.0083c4cc
pop ecx
mov eax, dword [ebx + 0x18290]
test eax, eax
jne 0x70c3f2
mov eax, dword [ebx + 0x18298]
cmp eax, dword [ebx + 0x18294]
jge 0x70c408
mov dword [esp], esi
lea esi, [eax + eax*4]
add esi, esi
add esi, esi
sub esi, eax
lea eax, [esi + esi]
add eax, eax
add eax, eax
lea eax, [ebx + eax + 0x1829c]
movzx edx, word [eax + 0x80]
push edx
mov ecx, ebx
push eax
call fcn.0070b450
test eax, eax
jne 0x70c3b4
mov eax, dword [ebx + 0x1dc]
mov dword [ebx + esi*8 + 0x18320], eax
mov edx, dword [ebx + 0x1e0]
mov dword [ebx + esi*8 + 0x18324], edx
mov eax, dword [ebx + 0x1e4]
mov dword [ebx + esi*8 + 0x18328], eax
mov eax, dword [ebx + 0x1e8]
mov dword [ebx + esi*8 + 0x1832c], eax
call dword [sym.imp.winmm.dll_timeGetTime]
mov dword [ebx + 0x1a89c], eax
mov ecx, ebx
call fcn.0070b574
test eax, eax
je 0x70c3ed
mov eax, dword [ebx]
test al, 2
jne 0x70c403
mov eax, dword [ebx + 0x18298]
add eax, 1
cmp eax, dword [ebx + 0x18294]
mov dword [ebx + 0x18298], eax
jl 0x70c338
mov esi, dword [esp]
mov eax, dword [ebx]
or eax, 3
mov dword [ebx], eax
mov eax, dword [ebx + 0x1a8bc]
test eax, eax
je 0x70c3f9
push 6
push ebx
call eax
add esp, 8
jmp 0x70c3f9
mov esi, dword [esp]
jmp 0x70c3f9
mov ecx, ebx
call fcn.0070c8e4
add esp, 0x104
pop ebx
ret 0xc
mov esi, dword [esp]
jmp 0x70c3d4
mov eax, dword [ebx]
jmp 0x70c3d4
Function at 0x83e730
Capabilities:
Enumerate files on windows

Disassembly:
push edi
push esi
push ebx
sub esp, 0x340
mov edi, ecx
lea eax, [esp]
push 0x100
push 0
push eax
call fcn.0086b688
lea eax, [esp + 0xc]
push edi
push 0x98b084
push eax
call fcn.00858bf5
add esp, 0x18
lea edx, [esp]
lea eax, [esp + 0x100]
push eax
push edx
call dword [sym.imp.kernel32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x83e85f
mov ebx, eax
mov esi, edi
lea edx, [esp + 0x100]
push edx
push ebx
call dword [sym.imp.kernel32.dll_FindNextFileA]
test eax, eax
je 0x83e856
mov edx, dword [esp + 0x100]
cmp edx, 0x10
je 0x83e77d
lea edx, [esp + 0x240]
push 0x100
push 0
push edx
call fcn.0086b688
lea ecx, [esp + 0x24c]
lea edx, [esp + 0x138]
push edx
push esi
push 0x98b090
push ecx
call fcn.00858bf5
add esp, 0x1c
mov eax, dword [0xadac70]
cmp eax, 0x100
je 0x83e77d
add eax, eax
add eax, eax
lea edi, [eax + eax]
add edi, edi
add edi, edi
add edi, edi
lea edx, [edi + eax]
mov ecx, dword [edx + 0xaebe40]
cmp ecx, 0xffffffff
jne 0x83e77d
lea ecx, [eax + edi + 0xaebe00]
lea edx, [esp + 0x12c]
push 0x40
push edx
push ecx
call fcn.00858900
add esp, 0xc
lea ecx, [esp + 0x240]
xor edx, edx
push edx
push 0x80
push 3
push edx
push 1
push 0x80000000
push ecx
call dword [sym.imp.kernel32.dll_CreateFileA]
mov edi, eax
mov eax, dword [0xadac70]
lea edx, [eax + eax]
add edx, edx
lea ecx, [edx + edx]
add eax, 1
mov dword [edx + ecx*8 + 0xaebe40], edi
mov dword [0xadac70], eax
jmp 0x83e77d
mov eax, ebx
push eax
call dword [sym.imp.kernel32.dll_FindClose]
add esp, 0x340
pop ebx
pop esi
pop edi
ret

Function at 0x83ea38
Capabilities:
Get file size

Disassembly:
push edi
push ebp
sub esp, 0x108
mov edx, ecx
mov ebp, dword [0xaf0200]
mov eax, dword [0xaf0204]
xor ecx, ecx
test eax, eax
je 0x83ea65
mov edi, dword [ebp]
cmp edi, 0xffffffff
je 0x83ea70
add ebp, 0x2c
add ecx, 1
cmp ecx, eax
jne 0x83ea53
xor eax, eax
add esp, 0x108
pop ebp
pop edi
ret
lea ecx, [esp]
call fcn.0083e5cc
lea edx, [esp]
xor eax, eax
push eax
push 0x80
push 3
push eax
push 1
push 0x80000000
push edx
call dword [sym.imp.kernel32.dll_CreateFileA]
mov dword [ebp], eax
cmp eax, 0xffffffff
je 0x83ea65
mov dword [ebp + 0x18], 0
lea edx, [esp + 0x104]
push edx
push eax
call dword [sym.imp.kernel32.dll_GetFileSize]
mov dword [ebp + 0x1c], eax
mov eax, ebp
add esp, 0x108
pop ebp
pop edi
ret

Function at 0x83f6a0
Capabilities:
Set socket configuration

Disassembly:
push ebp
sub esp, 0xc
mov ebp, ecx
lea edx, [esp + 4]
mov dword [esp], 4
lea eax, [esp]
push eax
push edx
push 0x1002
push 0xffff
push dword [ebp + 0x10]
call dword [sym.imp.wsock32.dll_getsockopt]
mov dword [esp + 4], 0x10000
lea eax, [esp + 4]
push dword [esp]
push eax
push 0x1002
push 0xffff
push dword [ebp + 0x10]
call dword [sym.imp.wsock32.dll_setsockopt]
mov dword [esp], 4
lea edx, [esp + 8]
lea eax, [esp]
push eax
push edx
push 0x1001
push 0xffff
push dword [ebp + 0x10]
call dword [sym.imp.wsock32.dll_getsockopt]
mov dword [esp + 8], 0x10000
lea eax, [esp + 8]
push dword [esp]
push eax
push 0x1001
push 0xffff
push dword [ebp + 0x10]
call dword [sym.imp.wsock32.dll_setsockopt]
add esp, 0xc
pop ebp
ret
Function at 0x841738
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x98b0d0
push 0x85b6a4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], ebx
xor eax, eax
mov edx, dword [0xadc8fc]
mov dword [0xadc8f8], eax
test edx, edx
mov dword [0xadc900], eax
mov dword [0xadc904], eax
mov dword [0xadc908], eax
jne 0x8418a4
mov dword [ebp - 4], 0
jmp 0x84179a
push 0
call dword [sym.imp.user32.dll_GetKeyboardLayout]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 0xffffffff
push dword [ebp - 0x2c]
call fcn.00841994
pop ecx
mov dword [0xadc90c], eax
mov eax, dword [0xacbed8]
push edi
call fcn.00841438
pop ecx
mov dword [ebp - 0x28], eax
test eax, eax
je 0x84180a
mov eax, dword [ebp - 0x2c]
push edi
call fcn.00841440
pop ecx
test eax, eax
je 0x84180a
mov eax, dword [ebp - 0x28]
mov dword [0xadc8f8], 1
add esp, 0xfffffff8
mov edx, 1
call fcn.0084169c
add esp, 8
test eax, eax
je 0x841887
mov dword [0xadc900], 1
call fcn.00841454
mov eax, dword [0xadc8f8]
test eax, eax
je 0x841859
mov eax, dword [ebp - 0x28]
mov dword [0xadc8fc], eax
call fcn.008408a8
mov eax, dword [0xacbed8]
add esp, 0xfffffff8
mov edx, 0xfffffffc
call fcn.00841714
add esp, 8
mov dword [0xadc958], eax
mov eax, dword [0xacbed8]
add esp, 0xfffffff4
mov edx, 0xfffffffc
mov ecx, 0x83ff58
call fcn.00841448
add esp, 0xc
mov dword [0xa21ccc], 1
mov eax, 1
mov esp, dword [ebp - 0x18]
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov ecx, 0x98b144
call fcn.0083c070
xor eax, eax
mov esp, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov ecx, 0x98b10c
call fcn.0083c070
xor eax, eax
mov esp, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x843564
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
push edi
push esi
push ebx
sub esp, 8
movsx ebx, word [esp + 0x18]
mov edx, dword [ebx*4 + 0xaebdc0]
test edx, edx
je 0x8435f4
lea edx, [ebx + ebx]
add edx, edx
add edx, edx
add edx, edx
add edx, edx
add edx, edx
lea esi, [edx + edx + 0xaeb5c0]
push esi
call dword [sym.imp.wsock32.dll_inet_addr]
mov dword [esp + 4], eax
cmp eax, 0xffffffff
jne 0x8435a7
push esi
call dword [sym.imp.wsock32.dll_gethostbyname]
jmp 0x8435b6
lea edx, [esp + 4]
push 2
push 4
push edx
call dword [sym.imp.wsock32.dll_gethostbyaddr]
test eax, eax
je 0x843607
mov edx, dword [eax + 0xc]
mov edi, dword [edx]
test edi, edi
je 0x843600
mov esi, dword [esp + 0x1c]
movzx edx, byte [edi]
mov byte [esi + 4], dl
movzx ecx, byte [edi + 1]
mov byte [esi + 5], cl
movzx edx, byte [edi + 2]
mov byte [esi + 6], dl
movzx edx, byte [edi + 3]
mov byte [esi + 7], dl
xor esi, esi
mov eax, ebx
call fcn.00843615
mov eax, esi
add esp, 8
pop ebx
pop esi
pop edi
ret
mov eax, 0xfffffffe
add esp, 8
pop ebx
pop esi
pop edi
ret
mov esi, 0xffffffb9
jmp 0x8435e4
mov esi, 0xffffffb9
jmp 0x8435e4
Function at 0x844bb8
Capabilities:
Get file size

Disassembly:
push edi
push ebx
sub esp, 0x108
mov eax, ecx
lea ecx, [esp]
mov edx, eax
call fcn.00844b70
cmp eax, 1
je 0x844bdc
xor eax, eax
add esp, 0x108
pop ebx
pop edi
ret
lea edx, [esp]
xor eax, eax
push eax
push 0x80
push 3
push eax
push 1
push 0x80000000
push edx
call dword [sym.imp.kernel32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x844bd1
lea edx, [esp + 0x104]
push edx
push ebx
call dword [sym.imp.kernel32.dll_GetFileSize]
mov edi, eax
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, edi
add esp, 0x108
pop ebx
pop edi
ret

Function at 0x844c24
Capabilities:
Read file on windows

Disassembly:
push esi
push ebp
push ebx
sub esp, 0x108
mov ebp, edx
mov ebx, ecx
mov esi, dword [esp + 0x118]
test esi, esi
jne 0x844c45
mov ecx, ebx
call fcn.00844bb8
mov esi, eax
lea ecx, [esp]
mov edx, ebx
call fcn.00844b70
cmp eax, 1
je 0x844c60
add esp, 0x108
pop ebx
pop ebp
pop esi
ret 4
lea ebx, [esp]
xor ecx, ecx
push ecx
push 0x80
push 3
push ecx
push 1
push 0x80000000
push ebx
call dword [sym.imp.kernel32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x844c54
xor ecx, ecx
push ecx
push ecx
push ecx
push ebx
call dword [sym.imp.kernel32.dll_SetFilePointer]
lea ecx, [esp + 0x104]
push 0
push ecx
push esi
push ebp
push ebx
call dword [sym.imp.kernel32.dll_ReadFile]
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
add esp, 0x108
pop ebx
pop ebp
pop esi
ret 4