joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1c27910
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov esi, ecx
xor edi, edi
push dword [esi + edi*4 + 0x28]
call fcn.01ca0440
add esp, 4
mov dword [esi + edi*4 + 0x28], eax
inc edi
cmp edi, 0x10
jne 0x1c2791d
xor eax, eax
mov ecx, dword [esi + eax*4 + 0x48]
xor ecx, dword [esi + eax*4 + 0x5c]
xor ecx, dword [esi + eax*4 + 0x30]
xor ecx, dword [esi + eax*4 + 0x28]
rol ecx, 1
mov dword [esi + eax*4 + 0x68], ecx
inc eax
cmp eax, 0x40
jne 0x1c27935
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x20], eax
mov edx, dword [esi + 0x18]
mov eax, dword [esi + 0x1c]
mov ebx, dword [esi + 0x20]
mov dword [ebp - 0x10], esi
mov ecx, dword [esi + 0x24]
xor edi, edi
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x20]
mov ecx, ebx
mov esi, dword [ebp - 0x1c]
mov ebx, eax
mov eax, edx
mov edx, ecx
rol edx, 5
cmp edi, 0x14
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x34], ecx
jae 0x1c279b7
mov ecx, ebx
mov ebx, eax
and ebx, ecx
add ebx, edx
mov edx, eax
not edx
and edx, esi
add ebx, edx
add ebx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
add ebx, dword [ecx + edi*4 + 0x28]
mov ecx, 0x5a827999
jmp 0x1c27a0c
cmp edi, 0x28
jae 0x1c279d3
xor ebx, esi
xor ebx, eax
add ebx, edx
add ebx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
add ebx, dword [ecx + edi*4 + 0x28]
mov ecx, 0x6ed9eba1
jmp 0x1c27a0c
cmp edi, 0x3b
mov dword [ebp - 0x18], esi
ja 0x1c279e7
mov ecx, ebx
or ecx, esi
and ecx, eax
and ebx, esi
or ebx, ecx
jmp 0x1c279eb
xor ebx, esi
xor ebx, eax
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x14]
add ebx, edx
add ebx, esi
add ebx, dword [ecx + edi*4 + 0x28]
cmp edi, 0x3c
mov ecx, 0xca62c1d6
mov edx, 0x8f1bbcdc
cmovb ecx, edx
mov esi, dword [ebp - 0x18]
add ebx, ecx
rol eax, 0x1e
inc edi
mov dword [ebp - 0x14], esi
mov ecx, dword [ebp - 0x34]
mov edx, ecx
cmp edi, 0x50
jne 0x1c2797d
mov edi, dword [ebp - 0x10]
mov dword [edi + 0x10], esi
mov edx, dword [ebp - 0x1c]
mov dword [edi + 0xc], edx
mov dword [edi + 8], eax
mov dword [edi + 4], ecx
mov dword [edi], ebx
mov dword [ebp - 0x18], esi
mov esi, ecx
mov ecx, dword [ebp - 0x20]
add ecx, ebx
mov dword [edi + 0x14], ecx
mov ecx, dword [ebp - 0x24]
add ecx, esi
mov dword [edi + 0x18], ecx
mov ecx, dword [ebp - 0x28]
add ecx, eax
mov dword [edi + 0x1c], ecx
mov eax, dword [ebp - 0x2c]
add eax, edx
mov dword [edi + 0x20], eax
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x18]
mov dword [edi + 0x24], eax
mov dword [edi + 0x168], 0
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1c2aa40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x20], ecx
mov eax, dword [0x1cda44c]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x10]
xor eax, eax
dec eax
mov dword [ecx - 4], eax
mov dword [ecx - 8], eax
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x1c], 0xffffffff
mov ecx, dword [edi + 0x24]
mov eax, dword [ecx]
lea edx, [ebp - 0x1c]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
push dword [edi + 0x28]
call dword [eax + 0x10]
mov ebx, eax
mov esi, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.01ca964d
add esp, 0x10
cmp eax, esi
jne 0x1c2aac3
cmp ebx, 1
je 0x1c2aa65
cmp ebx, 2
mov esi, 0xffffffff
je 0x1c2aac6
mov eax, dword [ebp - 0x20]
push dword [eax + 0x20]
call fcn.01ca912b
add esp, 4
neg eax
sbb esi, esi
jmp 0x1c2aac6
xor esi, esi
dec esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c92b01
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1c2aae0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp byte [ecx + 0x2c], 0
je 0x1c2ab04
push dword [ecx + 0x20]
push esi
push 1
push eax
call fcn.01ca964d
add esp, 0x14
jmp 0x1c2ab33
test esi, esi
jle 0x1c2ab2c
mov dword [ebp - 0x10], ecx
xor edi, edi
mov ebx, eax
movzx eax, byte [eax + edi]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push eax
call dword [edx + 0x30]
cmp eax, 0xffffffff
je 0x1c2ab2e
inc edi
cmp esi, edi
mov eax, ebx
jne 0x1c2ab0d
mov edi, esi
jmp 0x1c2ab2e
xor edi, edi
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x1c2ab40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov ebx, dword [ebp + 8]
mov eax, dword [0x1cda44c]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
cmp ebx, eax
je 0x1c2ab90
mov edi, ecx
mov byte [ebp - 0x19], bl
cmp byte [ecx + 0x2c], 0
je 0x1c2ab99
xor esi, esi
inc esi
lea eax, [ebp - 0x19]
push dword [edi + 0x20]
push esi
push esi
push eax
call fcn.01ca964d
add esp, 0x10
cmp eax, esi
mov esi, 0xffffffff
je 0x1c2ab92
jmp 0x1c2ac21
xor ebx, ebx
mov esi, ebx
jmp 0x1c2ac21
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x20]
mov dword [ecx], eax
lea esi, [ebp - 0x19]
mov dword [ebp - 0x24], 0xffffffff
mov ecx, dword [edi + 0x24]
mov eax, dword [ecx]
lea edx, [ebp - 0x20]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp - 0x18]
push edx
push esi
push dword [edi + 0x28]
call dword [eax + 8]
cmp dword [ebp - 0x24], esi
je 0x1c2ac1e
mov ebx, eax
cmp eax, 3
je 0x1c2ac01
cmp ebx, 1
ja 0x1c2ac1e
mov esi, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.01ca964d
add esp, 0x10
cmp eax, esi
jne 0x1c2ac1e
mov esi, dword [ebp - 0x24]
cmp ebx, 1
je 0x1c2aba4
jmp 0x1c2ac16
xor ebx, ebx
inc ebx
push dword [edi + 0x20]
push ebx
push ebx
push esi
call fcn.01ca964d
add esp, 0x10
cmp eax, ebx
jne 0x1c2ac1e
mov ebx, dword [ebp + 8]
jmp 0x1c2ab92
xor esi, esi
dec esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c92b01
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x1c2ac70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp byte [ecx + 0x2c], 0
je 0x1c2ac94
push dword [ecx + 0x20]
push esi
push 2
push eax
call fcn.01ca964d
add esp, 0x14
jmp 0x1c2acc4
test esi, esi
jle 0x1c2acbd
mov dword [ebp - 0x10], ecx
xor edi, edi
mov ebx, eax
movzx eax, word [eax + edi*2]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push eax
call dword [edx + 0x30]
cmp ax, 0xffff
je 0x1c2acbf
inc edi
cmp esi, edi
mov eax, ebx
jne 0x1c2ac9d
mov edi, esi
jmp 0x1c2acbf
xor edi, edi
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x1c2acd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
movzx esi, word [ebp + 8]
mov eax, dword [0x1cda44c]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
cmp si, 0xffff
je 0x1c2ad1f
mov edi, ecx
mov word [ebp - 0x1a], si
cmp byte [ecx + 0x2c], 0
je 0x1c2ad37
lea eax, [ebp - 0x1a]
push dword [edi + 0x20]
push 1
push 2
push eax
call fcn.01ca964d
add esp, 0x10
cmp eax, 1
je 0x1c2ad21
xor esi, esi
dec esi
jmp 0x1c2ad21
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c92b01
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x20]
mov dword [ecx], eax
lea esi, [ebp - 0x1a]
mov dword [ebp - 0x24], 0xffffffff
mov ecx, dword [edi + 0x24]
mov eax, dword [ecx]
lea edx, [ebp - 0x20]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp - 0x18]
push edx
push esi
push dword [edi + 0x28]
call dword [eax + 8]
cmp dword [ebp - 0x24], esi
je 0x1c2ad1a
mov ebx, eax
cmp eax, 3
je 0x1c2ad9f
cmp ebx, 1
ja 0x1c2ad1a
mov esi, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.01ca964d
add esp, 0x10
cmp eax, esi
jne 0x1c2ad1a
mov esi, dword [ebp - 0x24]
cmp ebx, 1
je 0x1c2ad42
jmp 0x1c2adb8
xor ebx, ebx
inc ebx
push dword [edi + 0x20]
push ebx
push ebx
push esi
call fcn.01ca964d
add esp, 0x10
cmp eax, ebx
jne 0x1c2ad1a
movzx esi, word [ebp + 8]
jmp 0x1c2ad21

Function at 0x1c2af50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x1c2af7f
shl eax, 4
movsx esi, byte [edx]
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
inc edx
cmp ecx, edx
jne 0x1c2af61
pop esi
pop edi
pop ebp
ret 8

Function at 0x1c2b080
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x1c2b0b1
shl eax, 4
movzx esi, word [edx]
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
add edx, 2
cmp ecx, edx
jne 0x1c2b091
pop esi
pop edi
pop ebp
ret 8
Function at 0x1c315b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x90
mov esi, esp
mov dword [esi + 0x78], ebp
lea ecx, [esi + 0x80]
mov dword [ecx - 4], esp
xor edx, edx
dec edx
mov dword [ecx + 8], edx
mov dword [ecx + 4], 0x1c3e630
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
lea eax, [esi + 0x18]
mov word [eax + 4], 0
mov dword [eax], 0x7025
lea edi, [esi + 0x50]
mov dword [edi + 0x10], edx
pcmpeqd xmm0, xmm0
movdqa xmmword [edi], xmm0
lea ebx, [esi + 0x70]
push ebx
call fcn.01c2cfa0
add esp, 4
push dword [ebp + 0x18]
lea eax, [esi + 0x18]
push eax
push dword [ebx + 4]
push dword [ebx]
push 0x14
push edi
call fcn.01c40af3
add esp, 0x18
mov dword [esi + 0x14], eax
add eax, esi
add eax, 0x50
push dword [ebp + 0x10]
mov dword [esi + 0x10], eax
push eax
push edi
call fcn.01c301f6
add esp, 0xc
mov dword [esi + 0xc], eax
xor eax, eax
dec eax
mov dword [esi + 0x41], eax
mov dword [esi + 0x3d], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
lea edi, [esi + 8]
mov ecx, dword [ebp + 0x10]
push edi
call fcn.01c289a8
lea eax, [esi + 0x80]
mov dword [eax + 8], 0
mov ecx, edi
push 0x1cf41e8
call fcn.01c3a1b8
mov ebx, eax
mov ecx, dword [esi + 8]
xor eax, eax
dec eax
lock xadd dword [ecx + 4], eax
test eax, eax
jne 0x1c31696
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebx]
mov eax, dword [eax + 0x18]
mov dword [esi + 0x88], 0xffffffff
lea edx, [esi + 0x20]
mov ecx, ebx
push edx
mov edi, dword [esi + 0x10]
push edi
lea ebx, [esi + 0x50]
push ebx
call eax
mov ecx, dword [esi + 0xc]
mov eax, ecx
sub eax, ebx
cmp ecx, edi
mov ecx, dword [esi + 0x14]
lea ecx, [esi + ecx + 0x20]
lea eax, [esi + eax + 0x20]
cmove eax, ecx
movsx edx, byte [ebp + 0x14]
push edx
push dword [ebp + 0x10]
push ecx
push eax
lea eax, [esi + 0x20]
push eax
push dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push edi
call fcn.01c23830
add esp, 0x1c
mov eax, dword [esi + 0x80]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
Function at 0x1c34da4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.01c3de44
mov ebx, eax
test esi, esi
je 0x1c34ddd
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 0x10]
je 0x1c34dca
movzx eax, word [eax]
jmp 0x1c34dd1
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
cmp ax, 0xffff
je 0x1c34ddd
test bl, bl
jne 0x1c34de3
jmp 0x1c34e40
xor esi, esi
test bl, bl
jne 0x1c34e31
mov ecx, dword [edi]
mov eax, dword [ecx + 0xc]
cmp eax, dword [ecx + 0x10]
je 0x1c34df2
movzx eax, word [eax]
jmp 0x1c34df7
mov eax, dword [ecx]
call dword [eax + 0x20]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
movzx eax, ax
push eax
push 8
call dword [edx + 0xc]
test al, al
je 0x1c34e22
mov ecx, dword [edi]
mov eax, dword [ecx + 0xc]
cmp eax, dword [ecx + 0x10]
je 0x1c34e1b
add eax, 2
mov dword [ecx + 0xc], eax
jmp 0x1c34db0
mov eax, dword [ecx]
call dword [eax + 0x24]
jmp 0x1c34db0
mov ecx, edi
call fcn.01c3de44
mov ebx, eax
test esi, esi
jne 0x1c34e49
jmp 0x1c34e3a
mov ecx, edi
call fcn.01c3de44
mov ebx, eax
test bl, bl
jne 0x1c34e68
jmp 0x1c34e6e
mov ecx, edi
call fcn.01c3de44
mov ebx, eax
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 0x10]
je 0x1c34e56
movzx eax, word [eax]
jmp 0x1c34e5d
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
cmp ax, 0xffff
sete al
xor bl, al
jne 0x1c34e6e
mov eax, dword [ebp + 0x10]
or byte [eax], 2
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x1c36250
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xa0
mov esi, esp
mov dword [esi + 0x88], ebp
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x90]
mov dword [eax - 4], esp
xor edx, edx
dec edx
mov dword [eax + 8], edx
mov dword [eax + 4], 0x1c3e7b0
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
lea ecx, [esi + 0x20]
mov dword [ecx + 0x60], edx
pcmpeqd xmm0, xmm0
movdqa xmmword [ecx + 0x50], xmm0
movdqa xmmword [ecx + 0x40], xmm0
movdqa xmmword [ecx + 0x30], xmm0
movdqa xmmword [ecx + 0x20], xmm0
movdqa xmmword [ecx + 0x10], xmm0
movdqa xmmword [ecx], xmm0
mov dword [esi + 8], ecx
mov dword [esi + 0x18], ecx
mov ecx, dword [ebp + 0x18]
mov dword [esi + 0xc], fcn.01c23c30
mov dword [esi + 0x14], edx
mov dword [eax + 8], 1
lea eax, [esi + 4]
mov dword [eax], edx
push eax
call fcn.01c289a8
mov dword [esi + 0x98], 2
lea ecx, [esi + 4]
push 0x1cf41e8
call fcn.01c3a1b8
mov dword [esi + 0x10], eax
mov al, byte [ebp + 0x14]
lea ecx, [esi + 0x84]
lea edx, [esi + 3]
mov byte [edx], 0
lea edi, [esi + 0x14]
lea ebx, [esi + 8]
movzx eax, al
push ecx
push edi
push ebx
push dword [esi + 0x10]
push edx
push dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
push dword [ecx + 4]
lea ecx, [esi + 4]
push ecx
push eax
push dword [esi + 0x1c]
lea eax, [ebp + 0xc]
push eax
call fcn.01c357b0
add esp, 0x2c
test al, al
je 0x1c363b0
mov ecx, dword [ebp + 0x20]
cmp byte [ecx + 0xb], 0
js 0x1c3634a
xor eax, eax
mov byte [ecx], al
mov byte [ecx + 0xb], al
jmp 0x1c36356
mov eax, dword [ecx]
mov byte [eax], 0
mov dword [ecx + 4], 0
cmp byte [esi + 3], 0
je 0x1c36372
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
push 0x2d
call dword [eax + 0x1c]
movsx eax, al
mov ecx, dword [ebp + 0x20]
push eax
call fcn.01c3f1d6
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
push 0x30
call dword [eax + 0x1c]
mov edx, dword [esi + 8]
mov edi, dword [esi + 0x14]
lea ebx, [edi - 1]
cmp edx, ebx
jae 0x1c3639c
lea ecx, [edx + 1]
cmp ebx, ecx
cmova ecx, ebx
cmp byte [edx], al
jne 0x1c3639c
inc edx
cmp ecx, edx
jne 0x1c36391
mov edx, ecx
mov dword [esi + 0x98], 2
mov ecx, dword [ebp + 0x20]
push edi
push edx
call fcn.01c3de80
lea eax, [ebp + 0x10]
lea ecx, [ebp + 0xc]
push eax
call fcn.01c242d0
mov edi, dword [ebp + 8]
test al, al
je 0x1c363c9
mov eax, dword [ebp + 0x1c]
or byte [eax], 2
mov eax, dword [ebp + 0xc]
mov dword [edi], eax
mov ecx, dword [esi + 4]
xor eax, eax
dec eax
lock xadd dword [ecx + 4], eax
test eax, eax
jne 0x1c363e2
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [esi + 8]
mov dword [esi + 8], 0
test eax, eax
je 0x1c36404
mov dword [esi + 0x98], 0
push eax
call dword [esi + 0xc]
mov edi, dword [ebp + 8]
add esp, 4
mov eax, dword [esi + 0x90]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x1c
Function at 0x1c41591
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov eax, dword [0x1cda44c]
xor eax, ebp
mov dword [esp + 0x38], eax
mov ebx, 0x57
test ecx, ecx
je 0x1c4161e
mov edi, edx
test edx, edx
je 0x1c4161e
mov esi, ecx
xorps xmm0, xmm0
lea eax, [esp + 0x10]
movups xmmword [eax + 0xc], xmm0
movaps xmmword [eax], xmm0
push 0x1c
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1c41616
test byte [esp + 0x24], 0xf0
lea ebx, [esp + 0xc]
mov dword [ebx], 0
mov eax, 4
mov ecx, 0x40
cmove ecx, eax
push ebx
push ecx
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1c41616
mov eax, dword [edi]
mov dword [esi], eax
push ebx
push dword [esp + 0x10]
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor ebx, ebx
jmp 0x1c4161e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, dword [esp + 0x38]
xor ecx, ebp
call fcn.01c92b01
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1c41ff4
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov ebx, edx
mov edi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [0x1cda44c]
xor eax, ebp
mov dword [esp + 0x48], eax
movzx eax, byte [ecx + 0xb]
test al, al
jns 0x1c4201d
mov eax, dword [ecx + 4]
test eax, eax
je 0x1c42044
mov eax, 0x300
mov ecx, ebx
and ecx, eax
cmp ecx, eax
je 0x1c42044
cmp edi, 2
mov eax, 0x1cf4ac2
mov ecx, 0x1cf4cc2
cmove ecx, eax
cmp word [ecx], 0
je 0x1c42057
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.01c92b01
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xorps xmm0, xmm0
lea esi, [esp + 0x20]
movaps xmmword [esi + 0x10], xmm0
movaps xmmword [esi], xmm0
mov dword [esi + 0x20], 0
push esi
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [esi], 0
je 0x1c42044
cmp byte [0x1cf4ac0], 0
setne al
bt ebx, 8
jb 0x1c42044
shr ebx, 9
and ebx, 1
or bl, al
je 0x1c42044
cmp edi, 2
mov eax, 0x1cc0894
mov edx, 0x1cc08a8
cmove edx, eax
mov eax, dword [ebp + 8]
movzx ebx, byte [eax + 0xb]
test bl, bl
js 0x1c420b6
mov ecx, ebx
mov esi, eax
mov eax, ebx
jmp 0x1c420bb
mov esi, dword [eax]
mov eax, dword [eax + 4]
xor ecx, ecx
inc ecx
mov dword [esp + 0x10], ecx
xor ecx, ecx
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x1c], ecx
mov ebx, dword [edx + 4]
mov edi, eax
sub edi, ebx
jb 0x1c42109
push ebx
push dword [edx]
push esi
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], eax
call fcn.01ca7b52
mov edx, dword [esp + 0x24]
add esp, 0xc
test eax, eax
mov eax, dword [esp + 0x14]
je 0x1c42119
add edx, 0x14
mov ecx, dword [esp + 0x1c]
inc ecx
cmp ecx, dword [esp + 0x10]
jb 0x1c420dc
jmp 0x1c42183
movzx ecx, word [esi + ebx*2]
cmp cx, 0x5c
je 0x1c42128
test cx, cx
jne 0x1c42109
lea eax, [esi + ebx*2]
mov ebx, dword [edx + 8]
cmp ebx, 1
je 0x1c42148
cmp ebx, 2
mov esi, ebx
jne 0x1c42156
mov dword [esp + 8], str.WOW6432Node
mov dword [esp + 4], eax
jmp 0x1c42156
mov dword [esp + 8], str.WOW6432Node_
mov dword [esp + 4], esi
mov esi, ebx
mov dword [esp + 0xc], esi
cmp cx, 0x5c
jne 0x1c4216f
lea esi, [eax + 2]
dec edi
cmp word [eax + 2], 0x5c
mov eax, esi
je 0x1c42160
jmp 0x1c42171
mov esi, eax
mov eax, dword [edx + 0x10]
mov dword [esp + 0x10], eax
mov eax, dword [edx + 0xc]
xor ecx, ecx
mov edx, eax
mov eax, edi
jmp 0x1c42111
cmp dword [esp + 0xc], 0
je 0x1c42044
mov ecx, dword [ebp + 8]
cmp byte [ecx + 0xb], 0
js 0x1c4219b
mov eax, ecx
jmp 0x1c4219d
mov eax, dword [ecx]
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
push dword [esp + 8]
push edx
call fcn.01c3fd9c
jmp 0x1c42044
Function at 0x1c42f66
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [0x1cda44c]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
lea ebx, [ebp - 0x1c]
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
lea esi, [ebp - 0x28]
mov ecx, esi
push str.type
call fcn.01c3be7a
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea edi, [ebp - 0x34]
mov ecx, edi
push eax
call fcn.01c3be7a
push esi
push edi
push ebx
call fcn.01c43006
add esp, 0xc
cmp byte [edi + 0xb], 0
jns 0x1c42fc3
push dword [ebp - 0x34]
call fcn.01c92abc
add esp, 4
cmp byte [ebp - 0x1d], 0
jns 0x1c42fd4
push dword [ebp - 0x28]
call fcn.01c92abc
add esp, 4
lea esi, [ebp - 0x1c]
mov ecx, esi
call fcn.01c43154
mov dword [0x1cf50cc], eax
cmp byte [esi + 0xb], 0
jns 0x1c42ff4
push dword [ebp - 0x1c]
call fcn.01c92abc
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c92b01
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1c431ef
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov eax, dword [0x1cda44c]
xor eax, ebp
mov dword [esp + 0x18], eax
movzx eax, byte [ecx + 0xb]
test al, al
js 0x1c4321a
test al, al
jne 0x1c43223
jmp 0x1c43276
mov eax, dword [ecx + 4]
test eax, eax
je 0x1c43276
mov ecx, dword [ecx]
sub esp, 0x20
xorps xmm0, xmm0
movups xmmword [esp + 0x10], xmm0
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
xor edi, edi
mov dword [esp + 4], edi
mov dword [esp], 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
mov dword [esp + 0x10], edi
cmp eax, 0xfffffff0
jae 0x1c43341
mov ebx, eax
cmp eax, 0xb
jae 0x1c43285
lea edi, [esp + 8]
mov byte [edi + 0xb], bl
mov dword [esp + 4], edi
test ebx, ebx
jne 0x1c432af
jmp 0x1c432bb
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi], eax
mov dword [esi + 8], eax
jmp 0x1c4332c
lea esi, [ebx + 0x10]
and esi, 0xfffffff0
push esi
call fcn.01c92a8c
add esp, 4
mov edi, eax
lea eax, [esp + 8]
mov dword [eax], edi
or esi, 0x80000000
mov dword [eax + 8], esi
mov esi, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [eax + 4], ebx
push ebx
push 0
push edi
call fcn.01c97000
add esp, 0xc
mov byte [edi + ebx], 0
mov eax, dword [esp + 4]
cmp byte [eax + 0xb], 0
jns 0x1c432cf
mov eax, dword [esp + 8]
jmp 0x1c432d3
lea eax, [esp + 8]
mov edx, dword [ebp + 0xc]
movzx ecx, byte [edx + 0xb]
test cl, cl
jns 0x1c432e3
mov ecx, dword [edx + 4]
mov edx, dword [edx]
xor edi, edi
push edi
push edi
push ebx
push eax
push ecx
push edx
push edi
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, ebx
jne 0x1c4330e
mov eax, dword [esp + 0x10]
mov dword [esi + 8], eax
movsd xmm0, qword [esp + 8]
movsd qword [esi], xmm0
jmp 0x1c4332c
mov dword [esi + 4], edi
mov dword [esi], edi
mov dword [esi + 8], edi
mov eax, dword [esp + 4]
cmp byte [eax + 0xb], 0
jns 0x1c4332c
push dword [esp + 8]
call fcn.01c92abc
add esp, 4
mov ecx, dword [esp + 0x18]
xor ecx, ebp
call fcn.01c92b01
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea ecx, [esp + 8]
call fcn.01c3eb04