joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40cbc0
Capabilities:
Query environment variable

Disassembly:
sub esp, 4
cmp dword [0x418490], 0
push ebx
push esi
push edi
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push ebp
jne 0x40cc0c
call esi
mov edi, eax
test edi, edi
je 0x40cbea
mov dword [0x418490], 1
jmp 0x40cc10
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test ebx, ebx
je 0x40cc02
mov dword [0x418490], 2
jmp 0x40cc14
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x10]
cmp dword [0x418490], 1
jne 0x40ccc3
test edi, edi
jne 0x40cc37
call esi
mov edi, eax
test edi, edi
jne 0x40cc37
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp word [edi], 0
mov esi, edi
je 0x40cc51
add esi, 2
cmp word [esi], 0
jne 0x40cc3f
add esi, 2
cmp word [esi], 0
jne 0x40cc3f
sub esi, edi
push 0
sar esi, 1
push 0
inc esi
push 0
push 0
push esi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebp, eax
test ebp, ebp
je 0x40ccb2
push ebp
call fcn.0040b550
add esp, 4
mov ebx, eax
test ebx, ebx
je 0x40ccb2
push 0
push 0
push ebp
push ebx
push esi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x40cca1
push ebx
call fcn.0040b5d0
add esp, 4
xor ebx, ebx
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp dword [0x418490], 2
jne 0x40cd47
test ebx, ebx
jne 0x40cce6
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test ebx, ebx
jne 0x40cce6
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov ebp, ebx
cmp byte [ebx], 0
je 0x40ccfb
inc ebp
cmp byte [ebp], 0
jne 0x40cced
inc ebp
cmp byte [ebp], 0
jne 0x40cced
sub ebp, ebx
inc ebp
push ebp
call fcn.0040b550
mov dword [esp + 0x14], eax
add esp, 4
test eax, eax
jne 0x40cd20
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov edi, dword [esp + 0x10]
mov esi, ebx
mov ecx, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, dword [esp + 0x10]
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x40d060
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1a8
xor ecx, ecx
mov eax, 0x4184a0
push ebx
mov edx, dword [esp + 0x1b0]
push esi
push edi
push ebp
cmp dword [eax], edx
je 0x40d087
add eax, 8
inc ecx
cmp eax, 0x418528
jb 0x40d078
cmp dword [ecx*8 + 0x4184a0], edx
lea ebx, [ecx*8]
jne 0x40d242
cmp dword [0x417e1c], 1
je 0x40d207
cmp dword [0x417e1c], 0
jne 0x40d0be
cmp dword [0x417e20], 1
je 0x40d207
cmp edx, 0xfc
je 0x40d242
lea eax, [esp + 0xb4]
push 0x104
push eax
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
call ebp
test eax, eax
jne 0x40d0fb
mov esi, str._program_name_unknown_
lea edi, [esp + 0xb4]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea ebp, [esp + 0xb4]
lea edi, [esp + 0xb4]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
cmp ecx, 0x3c
jbe 0x40d13f
lea edi, [esp + 0xb4]
mov ecx, 0xffffffff
sub eax, eax
push 3
repne scasb al, byte es:[edi]
not ecx
lea ebp, [esp + ecx + 0x7c]
push 0x4152c0
push ebp
call fcn.0040d250
add esp, 0xc
mov esi, str.Runtime_Error__n_nProgram:
lea edi, [esp + 0x14]
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, ebp
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x14]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4152a0
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x14]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebx + 0x4184a4]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
lea edi, [esp + 0x14]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x12010
and ecx, 3
push str.Microsoft_Visual_C_Runtime_Library
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x1c]
push eax
call fcn.0040d480
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1a8
ret
mov eax, dword [0x418c50]
mov esi, dword [eax + 0x10]
cmp esi, 0xffffffff
jne 0x40d21e
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
mov edx, dword [ebx + 0x4184a4]
push 0
lea eax, [esp + 0x14]
mov edi, edx
push eax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1a8
ret
Function at 0x10023720
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006ad78
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x1008a3dc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x30]
push ecx
lea ecx, [ebp - 0x14]
call fcn.1002dac0
mov dword [ebp - 4], 0
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
call fcn.10029d20
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp + 0x14]
mov dword [ecx + 0x10], eax
xor ecx, ecx
mov byte [ebp - 0x1d], cl
movzx edx, byte [ebp - 0x1d]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
call fcn.10042c30
movzx ecx, al
test ecx, ecx
jne 0x100237b6
mov byte [ebp - 0x1e], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.1002daf0
mov al, byte [ebp - 0x1e]
jmp 0x1002386e
mov edx, dword [ebp + 0xc]
cmp dword [edx + 0x18], 0
jne 0x100237da
mov byte [ebp - 0x1f], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.1002daf0
mov al, byte [ebp - 0x1f]
jmp 0x1002386e
lea eax, [ebp + 8]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.1003cbb0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x18]
mov dword [ebp + 8], edx
xor eax, eax
mov byte [ebp - 0x20], al
movzx ecx, byte [ebp - 0x20]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
call fcn.10042c30
movzx eax, al
test eax, eax
jne 0x100237b6
mov ecx, dword [ebp - 0x18]
call fcn.10029d20
cmp dword [ebp - 0x1c], eax
jne 0x10023831
mov byte [ebp - 0x21], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.1002daf0
mov al, byte [ebp - 0x21]
jmp 0x1002386e
lea ecx, [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x18]
call fcn.1003cc40
xor edx, edx
mov byte [ebp - 0x22], dl
movzx eax, byte [ebp - 0x22]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
call fcn.10042c70
movzx edx, al
test edx, edx
je 0x1002380c
jmp 0x100237b6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x10023880
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006ad78
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x1008a3dc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x30]
push ecx
lea ecx, [ebp - 0x14]
call fcn.1002dac0
mov dword [ebp - 4], 0
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
call fcn.10029d20
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp + 0x14]
mov dword [ecx + 0x10], eax
xor ecx, ecx
mov byte [ebp - 0x1d], cl
movzx edx, byte [ebp - 0x1d]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
call fcn.10042c50
movzx ecx, al
test ecx, ecx
jne 0x10023916
mov byte [ebp - 0x1e], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.1002daf0
mov al, byte [ebp - 0x1e]
jmp 0x100239ce
mov edx, dword [ebp + 0xc]
cmp dword [edx + 0x18], 0
jne 0x1002393a
mov byte [ebp - 0x1f], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.1002daf0
mov al, byte [ebp - 0x1f]
jmp 0x100239ce
lea eax, [ebp + 8]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.1003cbb0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x18]
mov dword [ebp + 8], edx
xor eax, eax
mov byte [ebp - 0x20], al
movzx ecx, byte [ebp - 0x20]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
call fcn.10042c50
movzx eax, al
test eax, eax
jne 0x10023916
mov ecx, dword [ebp - 0x18]
call fcn.10029d20
cmp dword [ebp - 0x1c], eax
jne 0x10023991
mov byte [ebp - 0x21], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.1002daf0
mov al, byte [ebp - 0x21]
jmp 0x100239ce
lea ecx, [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x18]
call fcn.1003cc40
xor edx, edx
mov byte [ebp - 0x22], dl
movzx eax, byte [ebp - 0x22]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
call fcn.100292c0
movzx edx, al
test edx, edx
je 0x1002396c
jmp 0x10023916
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x10051410
Capabilities:
Authenticate hmac
Get number of processors

Disassembly:
pop es
add byte [esi - 0x14], bh
pop es
add byte [edx - 0x47fff814], bl
in al, dx
pop es
add ah, cl
in al, dx
pop es
add dl, ah
loop 0x100513fe
loop 0x100513fe
pop es
add ah, dh
in al, dx
pop es
add byte [eax], cl
in eax, dx
pop es
add byte [esi], dl
in eax, dx
pop es
add byte [edx], ah
in eax, dx
pop es
add byte [eax], dh
in eax, dx
pop es
add byte [edx], bh
in eax, dx
pop es
add byte [edx - 0x13], dl
pop es
add byte [edx - 0x13], ah
pop es
add byte [edx - 0x13], bh
pop es
add byte [eax - 0x69fff813], cl
in eax, dx
pop es
add byte [esi - 0x51fff813], ah
in eax, dx
pop es
add byte [ebp + ebp*8 - 0x1237fff9], bh
pop es
add al, bl
in eax, dx
pop es
add dl, ch
in eax, dx
pop es
add al, bh
in eax, dx
pop es
add byte [edx], cl
out dx, al
pop es
add byte [esi], dl
out dx, al
pop es
add byte [eax], ah
out dx, al
pop es
add byte [esi + ebp*8], ch
pop es
add byte [esi], bh
out dx, al
pop es
add byte [esi - 0x12], cl
pop es
add byte [esi + ebp*8 + 7], ah
add byte [edx - 0x12], bh
pop es
add byte [edx - 0x63fff812], cl
out dx, al
pop es
add byte [esi - 0x37fff812], ch
out dx, al
pop es
add al, ah
out dx, al
pop es
add dl, bh
out dx, al
pop es
add byte [edi + ebp*8], dl
pop es
add byte [esi], ch
out dx, eax
pop es
add byte [edi + ebp*8 + 7], al
add byte [esi - 0x11], bl
pop es
add byte [esi - 0x11], ch
pop es
add byte [eax - 0x57fff811], al
out dx, eax
pop es
add byte [eax - 0x33fff811], bh
out dx, eax
pop es
add byte [edx + 0x7f0], dl
add byte [eax], al
add byte [esi + 0x7eb], bh
add byte [eax], al
add byte [esi - 0x73fff815], bl
jmp 0x100514d6
pop es
add dh, dl
jmp 0x100514e2
add byte [eax], al
xor al, 0
add byte [eax - 0x7ffffff5], al
add al, 0
add byte [eax - 0x7ffffff4], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
out dx, eax
mov edi, 0xc0171006
push es
adc byte [eax], dh
mov ebx, 0xbb501006
push es
adc byte [eax - 0x45], dh
push es
adc byte [eax - 0x4feff945], dl
mov ebx, 0xbbd01006
push es
adc al, dh
mov ebx, 0xbc101006
push es
Function at 0x10051530
Capabilities:
Authenticate hmac
Get number of processors

Disassembly:
adc byte [eax - 0x44], al
push es
adc byte [eax], al
add byte [eax], al
add byte [eax - 0x44], dl
push es
adc byte [eax], al
add byte [eax], al
add byte [eax], al
cmp byte [esi + eax + 0x10], 0
nop
mov esp, 0x1006
add byte [eax], al
mov al, 0xbc
push es
adc byte [eax], al
add byte [eax], al
add byte [eax], al
cmp byte [esi + eax + 0x10], 0
nop
mov esp, 0x1006
add byte [eax], al
mov al, 0xbc
push es
adc byte [eax], al
add byte [eax], al
add al, ah
mov esp, 0x1006
add byte [eax], al
adc byte [ebp + 0x1006], bh
add byte [eax], al
inc eax
mov ebp, 0x1006
add byte [eax], al
jo 0x10051523
push es
adc byte [eax], al
add byte [eax], al
add byte [eax + 0x1006bd], ah
add byte [eax], al
add al, dl
mov ebp, 0x1006
add byte [eax], al
adc byte [esi + 0x1006], bh
add byte [eax], al
add byte [eax], al
inc eax
mov esi, 0x1006
add byte [eax], al
cmp byte [esi + 0x1006], 0
add byte [eax + 0x1006be], dh
add byte [eax], al
add al, ah
mov esi, 0x1006
add byte [eax], al
add byte [eax], al
adc byte [edi + 0x1006], bh
add byte [eax], al
inc eax
mov edi, 0x1006
add byte [eax], al
cmp byte [edi + 0x1006], 0
add al, al
mov edi, 0x1006
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, 0x6a
add eax, 0x58dfd10
adc byte [ebp*4 - 0x412feffb], dl
add eax, 0x10
add byte [eax], al
add byte [eax], al
add ah, ch
imul eax, dword [esi], 0x5adc510
adc byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edx + eax], dl
xchg esp, eax
push esp
add byte [eax], al
add byte [eax], al
add al, byte [eax]
add byte [eax], al
pop ebx
add byte [eax], al
add al, al
pop edx
pop es
add al, al
inc eax
pop es
add byte [eax], al
add byte [eax], al
add byte [edx + 0x61], ah
and byte fs:[ecx + 0x6c], ah
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [ecx + 0x74], sp
imul ebp, dword [edi + 0x6e], 0x30300000
xor byte [eax], dh
Function at 0x10051580
Capabilities:
Authenticate hmac
Get number of processors

Disassembly:
adc byte [eax - 0x44], al
push es
adc byte [eax], al
add byte [eax], al
add byte [eax - 0x44], dl
push es
adc byte [eax], al
add byte [eax], al
add byte [eax], al
cmp byte [esi + eax + 0x10], 0
nop
mov esp, 0x1006
add byte [eax], al
mov al, 0xbc
push es
adc byte [eax], al
add byte [eax], al
add byte [eax], al
cmp byte [esi + eax + 0x10], 0
nop
mov esp, 0x1006
add byte [eax], al
mov al, 0xbc
push es
adc byte [eax], al
add byte [eax], al
add al, ah
mov esp, 0x1006
add byte [eax], al
adc byte [ebp + 0x1006], bh
add byte [eax], al
inc eax
mov ebp, 0x1006
add byte [eax], al
jo 0x10051523
push es
adc byte [eax], al
add byte [eax], al
add byte [eax + 0x1006bd], ah
add byte [eax], al
add al, dl
mov ebp, 0x1006
add byte [eax], al
adc byte [esi + 0x1006], bh
add byte [eax], al
add byte [eax], al
inc eax
mov esi, 0x1006
add byte [eax], al
cmp byte [esi + 0x1006], 0
add byte [eax + 0x1006be], dh
add byte [eax], al
add al, ah
mov esi, 0x1006
add byte [eax], al
add byte [eax], al
adc byte [edi + 0x1006], bh
add byte [eax], al
inc eax
mov edi, 0x1006
add byte [eax], al
cmp byte [edi + 0x1006], 0
add al, al
mov edi, 0x1006
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, 0x6a
add eax, 0x58dfd10
adc byte [ebp*4 - 0x412feffb], dl
add eax, 0x10
add byte [eax], al
add byte [eax], al
add ah, ch
imul eax, dword [esi], 0x5adc510
adc byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edx + eax], dl
xchg esp, eax
push esp
add byte [eax], al
add byte [eax], al
add al, byte [eax]
add byte [eax], al
pop ebx
add byte [eax], al
add al, al
pop edx
pop es
add al, al
inc eax
pop es
add byte [eax], al
add byte [eax], al
add byte [edx + 0x61], ah
and byte fs:[ecx + 0x6c], ah
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [ecx + 0x74], sp
imul ebp, dword [edi + 0x6e], 0x30300000
xor byte [eax], dh
Function at 0x100515a0
Capabilities:
Authenticate hmac
Get number of processors

Disassembly:
adc byte [eax - 0x44], al
push es
adc byte [eax], al
add byte [eax], al
add byte [eax - 0x44], dl
push es
adc byte [eax], al
add byte [eax], al
add byte [eax], al
cmp byte [esi + eax + 0x10], 0
nop
mov esp, 0x1006
add byte [eax], al
mov al, 0xbc
push es
adc byte [eax], al
add byte [eax], al
add byte [eax], al
cmp byte [esi + eax + 0x10], 0
nop
mov esp, 0x1006
add byte [eax], al
mov al, 0xbc
push es
adc byte [eax], al
add byte [eax], al
add al, ah
mov esp, 0x1006
add byte [eax], al
adc byte [ebp + 0x1006], bh
add byte [eax], al
inc eax
mov ebp, 0x1006
add byte [eax], al
jo 0x10051523
push es
adc byte [eax], al
add byte [eax], al
add byte [eax + 0x1006bd], ah
add byte [eax], al
add al, dl
mov ebp, 0x1006
add byte [eax], al
adc byte [esi + 0x1006], bh
add byte [eax], al
add byte [eax], al
inc eax
mov esi, 0x1006
add byte [eax], al
cmp byte [esi + 0x1006], 0
add byte [eax + 0x1006be], dh
add byte [eax], al
add al, ah
mov esi, 0x1006
add byte [eax], al
add byte [eax], al
adc byte [edi + 0x1006], bh
add byte [eax], al
inc eax
mov edi, 0x1006
add byte [eax], al
cmp byte [edi + 0x1006], 0
add al, al
mov edi, 0x1006
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, 0x6a
add eax, 0x58dfd10
adc byte [ebp*4 - 0x412feffb], dl
add eax, 0x10
add byte [eax], al
add byte [eax], al
add ah, ch
imul eax, dword [esi], 0x5adc510
adc byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edx + eax], dl
xchg esp, eax
push esp
add byte [eax], al
add byte [eax], al
add al, byte [eax]
add byte [eax], al
pop ebx
add byte [eax], al
add al, al
pop edx
pop es
add al, al
inc eax
pop es
add byte [eax], al
add byte [eax], al
add byte [edx + 0x61], ah
and byte fs:[ecx + 0x6c], ah
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [ecx + 0x74], sp
imul ebp, dword [edi + 0x6e], 0x30300000
xor byte [eax], dh
Function at 0x10051630
Capabilities:
Authenticate hmac
Get number of processors

Disassembly:
xor byte [eax], dh
xor byte [eax], al
xor byte [eax], al
add byte [eax], al
dec ebp
popal
arpl word [ecx + 0x64], ax
jb 0x10051640
inc ebx
outsd dx, dword [esi]
outsb dx, byte [esi]
imul sp, word [edi], 0x4300
insb byte es:[edi], dx
imul esp, dword [ebp + 0x6e], 0x72614274
add byte [eax], al
add byte [eax + 0x74], ch
je 0x100516c8
cmp ch, byte [edi]
das
and eax, 0x732573
das
add byte [eax], al
add byte [0x736f480a], cl
je 0x1005166b
add byte [ecx], dh
xor dh, byte [ebx]
jae 0x100516e1
outsd dx, dword [si]
jne 0x100516a4
arpl word [edi + 0x6d], bp
das
aas
add byte [esi + 0x69], ah
insb byte es:[edi], dx
cmp ch, byte gs:[edi]
das
das
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
dec eax
push esp
push esp
push eax
das
xor dword [esi], ebp
xor dword [eax], esp
xor dh, byte [eax]
xor byte [eax], ah
dec edi
dec ebx
or eax, 0x6e6f430a
sub eax, 0x65707954
cmp ah, byte [eax]
jp 0x10051734
jo 0x100516da
or cl, byte [ecx + 0x73]
cmp ah, byte fs:[eax]
and byte [edx], dh
xor byte [eax], ah
inc ecx
jo 0x1005175a
and byte [edx], dh
xor byte [ecx], dh
xor ah, byte [eax]
xor byte [ebx], dh
cmp dh, byte [ebx]
aaa
dec esi
Function at 0x100516d0
Capabilities:
Authenticate hmac
Get number of processors

Disassembly:
xor byte [eax], dh
xor byte [eax], al
xor byte [eax], al
add byte [eax], al
dec ebp
popal
arpl word [ecx + 0x64], ax
jb 0x10051640
inc ebx
outsd dx, dword [esi]
outsb dx, byte [esi]
imul sp, word [edi], 0x4300
insb byte es:[edi], dx
imul esp, dword [ebp + 0x6e], 0x72614274
add byte [eax], al
add byte [eax + 0x74], ch
je 0x100516c8
cmp ch, byte [edi]
das
and eax, 0x732573
das
add byte [eax], al
add byte [0x736f480a], cl
je 0x1005166b
add byte [ecx], dh
xor dh, byte [ebx]
jae 0x100516e1
outsd dx, dword [si]
jne 0x100516a4
arpl word [edi + 0x6d], bp
das
aas
add byte [esi + 0x69], ah
insb byte es:[edi], dx
cmp ch, byte gs:[edi]
das
das
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
dec eax
push esp
push esp
push eax
das
xor dword [esi], ebp
xor dword [eax], esp
xor dh, byte [eax]
xor byte [eax], ah
dec edi
dec ebx
or eax, 0x6e6f430a
sub eax, 0x65707954
cmp ah, byte [eax]
jp 0x10051734
jo 0x100516da
or cl, byte [ecx + 0x73]
cmp ah, byte fs:[eax]
and byte [edx], dh
xor byte [eax], ah
inc ecx
jo 0x1005175a
and byte [edx], dh
xor byte [ecx], dh
xor ah, byte [eax]
xor byte [ebx], dh
cmp dh, byte [ebx]
aaa
dec esi

Function at 0x10051730
Capabilities:
Authenticate hmac
Get number of processors

Disassembly:
jbe 0x10051797
jb 0x1005176e
and byte [ebp + 0x69], cl
arpl word [edx + 0x6f], si
jae 0x100517ab
je 0x1005176c
dec ecx
dec ecx
push ebx
das
aaa
jo 0x100517e2
and byte [edx], dh
xor byte [ecx], dh
or cl, byte [0x3c00000a]
dec ecx
and ah, byte [eax]
ja 0x10051818
je 0x10051857

Function at 0x10051760
Capabilities:
Authenticate hmac
Get number of processors

Disassembly:
popal
je 0x100517c8
cmp ah, byte [eax]
and eax, 0x63732022
jb 0x1005183e

Function at 0x10051840
Capabilities:
Authenticate hmac
Get number of processors

Disassembly:
and bh, byte [esi]
cmp al, 0x2f
imul esp, dword [esi + 0x72], 0x3e656d61
add byte [eax + 0x54], cl
push esp
push eax

Function at 0x10051870
Capabilities:
Authenticate hmac
Get number of processors

Disassembly:
push 0xd6c6d74
or cl, byte [ecx + 0x73]
Function at 0x10051cd0
Capabilities:
Get number of processors

Disassembly:
arpl word [ecx + 0x64], bp
cmp eax, 0x39383433
pop edi
add byte [eax], al
add byte [0x37253737], ah
aaa
and eax, 0x32253737
and eax, 0x36253337
and ax, 0x3736

Function at 0x10051e00
Capabilities:
Get number of processors

Disassembly:
cmp byte [edx + 0x35], ah
xor dword [ecx + 0x63], esp
xor eax, 0x32656563
popal
Function at 0x10053739
Capabilities:
Encode data using xor

Disassembly:
fiadd dword [edx]
adc byte [eax - 0x6feffd26], dl
fiadd dword [edx]
adc byte [eax - 0x4feffe6a], dh
xchg esi, eax
Function at 0x4d7d9c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d7e0a
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x10
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x19]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4d7de2
lea eax, [ebp - 4]
lea edx, [ebp - 0x19]
mov ecx, 0x11
call fcn.00404ae8
jmp 0x4d7dea
lea eax, [ebp - 4]
call fcn.00404878
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.004048cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d7e11
lea eax, [ebp - 4]
call fcn.00404878
ret

Function at 0x4d80f0
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffe30
mov ebp, eax
lea eax, [esp + 0x40]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, ebp
call fcn.00404878
push 0x40
lea eax, [esp + 4]
push eax
call sub.wsock32.dll_gethostname
push esp
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x4d814a
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x4d813e
push dword [edi]
call sub.wsock32.dll_inet_ntoa
mov edx, ebp
call fcn.0040a07c
inc ebx
mov edi, dword [esi + ebx*4]
test edi, edi
jne 0x4d812f
call sub.wsock32.dll_WSACleanup
add esp, 0x1d0
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4d827c
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
or al, al
je 0x4d8293
jne 0x4d829a
mov dword [ebp - 4], 1
mov dword [ebp - 8], 1
cmp dword [ebp - 8], 1
jne 0x4d82a9
mov dl, 1
cmp dword [ebp - 4], 1
jne 0x4d82b1
xor edx, edx
mov eax, edx
pop ecx
pop ecx
pop ebp
ret