joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4410b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
push ebp
mov ebp, dword [esp + 0x10]
push esi
xor esi, esi
push edi
mov edi, dword [esp + 0x14]
test ebp, 0xffff7fff
jne 0x44118b
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x44112a
call ebx
cmp eax, 3
jne 0x441111
push edi
call fcn.004413b0
mov esi, eax
add esp, 4
test esi, esi
jne 0x441105
call fcn.0042dcc8
pop edi
pop esi
pop ebp
mov dword [eax], 0x16
or eax, 0xffffffff
pop ebx
ret
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x44112a
call ebx
push eax
call fcn.004415c0
push esi
call fcn.00421011
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
ret
test al, 0x10
je 0x441183
push 0
push 0x2000001
push 3
push 0
push 0
push 0
test esi, esi
je 0x44114a
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x441151
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
mov edi, eax
call fcn.00421011
add esp, 4
cmp edi, 0xffffffff
jne 0x441173
call ebx
push eax
call fcn.004415c0
add esp, 4
or eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
push 0
push edi
call fcn.004658dd
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
ret
test esi, esi
jne 0x44121f
push dword [esp + 0x1c]
push ebp
push edi
call fcn.00473b76
mov esi, eax
add esp, 0xc
test esi, esi
jns 0x4412a6
call fcn.0042dcc8
cmp dword [eax], 0xd
jne 0x4411fe
test ebp, 0x100
je 0x4411fe
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4411d4
call ebx
push eax
call fcn.004415c0
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
ret
test al, 0x10
je 0x4411eb
call fcn.0042dcc8
pop edi
pop esi
pop ebp
mov dword [eax], 0x15
or eax, 0xffffffff
pop ebx
ret
call fcn.0042dcc8
pop edi
pop esi
pop ebp
mov dword [eax], 0xd
or eax, 0xffffffff
pop ebx
ret
call fcn.0042dcc8
cmp dword [eax], 2
jne 0x4412a6
push edi
call fcn.004413b0
mov esi, eax
add esp, 4
test esi, esi
je 0x4410f2
push dword [esp + 0x1c]
push ebp
push esi
call fcn.00473c5f
mov edi, eax
add esp, 0xc
test edi, edi
jns 0x441296
call fcn.0042dcc8
cmp dword [eax], 0xd
jne 0x441296
test ebp, 0x100
je 0x441296
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x44126c
call ebx
push eax
call fcn.004415c0
add esp, 4
push esi
call fcn.00421011
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
test al, 0x10
je 0x44128b
call fcn.0042dcc8
push esi
mov dword [eax], 0x15
call fcn.00421011
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
call fcn.0042dcc8
mov dword [eax], 0xd
push esi
call fcn.00421011
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
Function at 0x4412b0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jns 0x4412c7
call fcn.0042dcc8
mov dword [eax], 9
or eax, 0xffffffff
ret
cmp dword [esp + 0xc], 0
je 0x441338
push eax
call fcn.00465873
add esp, 4
lea ecx, [esp + 4]
push 0
push ecx
push dword [esp + 0x14]
push dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x441333
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe8
jne 0x44130d
call fcn.0042dcc8
mov dword [eax], 0xb
or eax, 0xffffffff
ret
cmp eax, 0x6d
je 0x441338
cmp eax, 5
jne 0x441326
call fcn.0042dcc8
mov dword [eax], 9
or eax, 0xffffffff
ret
push eax
call fcn.004415c0
add esp, 4
or eax, 0xffffffff
ret
mov eax, dword [esp + 4]
ret
xor eax, eax
ret

Function at 0x441340
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jns 0x441357
call fcn.0042dcc8
mov dword [eax], 9
or eax, 0xffffffff
ret
push 0
lea ecx, [esp + 8]
push ecx
push dword [esp + 0x14]
push dword [esp + 0x14]
push eax
call fcn.00465873
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4413a1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x441394
call fcn.0042dcc8
mov dword [eax], 9
or eax, 0xffffffff
ret
push eax
call fcn.004415c0
add esp, 4
or eax, 0xffffffff
ret
mov eax, dword [esp + 4]
ret
Function at 0x443450
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x4435d5
cmp dword [esi + 0x20], 0
je 0x4435d5
cmp dword [esi + 0x24], 0
je 0x4435d5
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x4435d5
cmp dword [eax], esi
jne 0x4435d5
mov eax, dword [eax + 4]
cmp eax, 0x2a
je 0x4434b5
cmp eax, 0x39
je 0x4434b5
cmp eax, 0x45
je 0x4434b5
cmp eax, 0x49
je 0x4434b5
cmp eax, 0x5b
je 0x4434b5
cmp eax, 0x67
je 0x4434b5
cmp eax, 0x71
je 0x4434b5
cmp eax, 0x29a
jne 0x4435d5
push edi
mov edi, dword [esi + 0x1c]
mov dword [esi + 0x14], 0
mov dword [esi + 8], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x2c], 2
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 8]
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], eax
test ecx, ecx
jns 0x4434ee
neg ecx
mov dword [edi + 0x18], ecx
cmp ecx, 2
mov eax, 0x2a
push 0
mov edx, 0x39
cmove eax, edx
push 0
mov dword [edi + 4], eax
push 0
jne 0x443510
call fcn.00432910
jmp 0x443515
call fcn.00467b10
add esp, 0xc
mov dword [esi + 0x30], eax
mov dword [edi + 0x28], 0xfffffffe
push edi
call fcn.00474460
mov esi, dword [esi + 0x1c]
xor edx, edx
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x4c]
add eax, eax
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x44]
mov word [eax + ecx*2 - 2], dx
mov eax, dword [esi + 0x4c]
lea eax, [eax*2 - 2]
push eax
push edx
push dword [esi + 0x44]
call fcn.00401100
mov eax, dword [esi + 0x84]
add esp, 0x10
lea ecx, [eax + eax*2]
movzx eax, word [ecx*4 + 0x4f34f2]
mov dword [esi + 0x80], eax
movzx eax, word [ecx*4 + 0x4f34f0]
mov dword [esi + 0x8c], eax
movzx eax, word [ecx*4 + 0x4f34f4]
mov dword [esi + 0x90], eax
xor eax, eax
movzx ecx, word [ecx*4 + 0x4f34f6]
pop edi
mov dword [esi + 0x7c], ecx
mov dword [esi + 0x6c], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x16b4], 0
mov dword [esi + 0x78], 2
mov dword [esi + 0x60], 2
mov dword [esi + 0x68], 0
mov dword [esi + 0x48], 0
pop esi
ret
mov eax, 0xfffffffe
pop esi
ret

Function at 0x444280
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
lea eax, [esp + 4]
push 0xf0000000
push 1
push 0
push 0
push eax
call esi
test eax, eax
jne 0x4442c6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x4442be
push 8
push 1
push 0
push 0
lea eax, [esp + 0x14]
push eax
call esi
test eax, eax
jne 0x4442c6
mov eax, 0xffffffe7
pop esi
pop ecx
ret
push dword [esp + 0xc]
push dword [esp + 0x14]
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0
push dword [esp + 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor ecx, ecx
mov eax, 0xffffffe7
test esi, esi
pop esi
cmovne eax, ecx
pop ecx
ret
Function at 0x4456de
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x518f00]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x510fd0
push esi
call fcn.00463443
pop ecx
pop ecx
test eax, eax
jne 0x44570c
xor al, al
jmp 0x445789
push ebx
lea eax, [ebp - 0x210]
xor ebx, ebx
push eax
push 0x104
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], ebx
push esi
push eax
call fcn.0044546d
mov edx, eax
add esp, 0x10
test edx, edx
jne 0x445746
push dword [ebp - 0x210]
call fcn.00421011
xor al, al
jmp 0x445787
mov ecx, edx
push edi
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x44574c
sub ecx, edi
sar ecx, 1
pop edi
cmp ecx, 3
je 0x44576c
push edx
call fcn.00445630
pop ecx
test al, al
je 0x445737
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x44577a
mov bl, 1
push dword [ebp - 0x210]
call fcn.00421011
mov al, bl
pop ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0042f6af
leave
ret
Function at 0x44c5b0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x18]
test ebx, ebx
je 0x44c660
lea eax, [esp + 0x18]
push eax
push ebx
push 2
call fcn.0049ade0
add esp, 0xc
test eax, eax
jne 0x44c660
lea eax, [esp + 4]
push eax
push ebx
push 0x17
call fcn.0049ade0
add esp, 0xc
test eax, eax
jne 0x44c660
push esi
mov esi, ebx
push edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x44c5f3
sub esi, ecx
push esi
push 0x2e
push ebx
call fcn.0049adb0
add esp, 0xc
test eax, eax
je 0x44c62b
sub eax, ebx
push eax
push 0x2e
push ebx
call fcn.0049adb0
mov edi, eax
add esp, 0xc
test edi, edi
je 0x44c62b
inc edi
mov ecx, ebx
sub ecx, edi
add esi, ecx
test edi, edi
jne 0x44c62d
mov edi, ebx
add esi, edi
mov ebx, 0x1505
cmp edi, esi
jae 0x44c656
mov al, byte [edi]
push eax
call fcn.0045d360
movsx ecx, al
inc edi
mov eax, ebx
add esp, 4
shl eax, 5
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp edi, esi
jb 0x44c638
pop edi
pop esi
movzx eax, bl
pop ebx
add esp, 0x10
ret
xor eax, eax
pop ebx
add esp, 0x10
ret

Function at 0x44c9e0
Capabilities:
Create udp socket

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x2f0], 2
je fcn.0044c990
mov al, 1
ret
Function at 0x459b00
Capabilities:
Receive data
Receive data on socket

Disassembly:
push 0
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.WS2_32.dll_recv]
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x459b31
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2733
neg eax
sbb eax, eax
and eax, 0xffffffe7
add eax, 0x51
ret
mov eax, dword [esp + 0x10]
mov dword [eax], ecx
xor eax, eax
ret

Function at 0x459ea0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
mov edx, dword [esp + 8]
sub esp, 0x80
xor eax, eax
push ebx
mov ebx, dword [esp + 0x88]
push ebp
push esi
mov esi, edx
mov ecx, dword [ebx + 0x1c4]
cmp edx, ecx
push edi
sete al
sub esi, ecx
neg esi
sbb esi, esi
and esi, 0xfffffff0
lea eax, [eax*4 + 0x1c0]
mov ebp, dword [eax + ebx]
add esi, 0x1f4
mov eax, dword [ebx + 0x2e8]
add esi, ebx
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [eax + 0x40], 3
je 0x459f84
xor eax, eax
cmp edx, ecx
sete al
lea eax, [eax*4 + 0x1d4]
cmp dword [eax + ebx], 0x459b40
jne 0x459f84
cmp dword [esi], 0
je 0x459f15
test edi, edi
je 0x459f84
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebp
call fcn.0045c690
add esp, 0x14
cmp eax, 0xffffffff
je 0x459f84
test al, 1
je 0x459f84
cmp dword [esi], 0
jne 0x459f5e
mov eax, dword [ebx]
mov eax, dword [eax + 0x8fc]
add eax, eax
push eax
mov dword [esi + 4], eax
call dword [0x518cc0]
mov edi, dword [esi + 4]
add esp, 4
mov dword [esi], eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov ecx, dword [esi]
test ecx, ecx
je 0x459f7d
mov eax, dword [esi + 8]
push 0
push edi
add eax, ecx
push eax
push ebp
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x459f84
add dword [esi + 8], eax
jmp 0x459f84
mov dword [esi + 4], 0
push 0
push dword [esp + 0xa4]
push dword [esp + 0xa4]
push ebp
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
cmp edi, 0xffffffff
jne 0x45a00e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
jne 0x459fcd
mov ecx, dword [esp + 0xa4]
lea eax, [edi + 0x52]
pop edi
pop esi
pop ebp
mov dword [ecx], 0
pop ebx
add esp, 0x80
ret
push 0x80
lea eax, [esp + 0x14]
push eax
push esi
call fcn.004b6080
push eax
push str.Send_failure:__s
push dword [ebx]
call fcn.004599d0
mov eax, dword [ebx]
add esp, 0x18
mov ecx, dword [esp + 0xa4]
mov dword [eax + 0xd14], esi
mov eax, 0x37
mov dword [ecx], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x80
ret
mov ecx, dword [esp + 0xa4]
xor eax, eax
mov dword [ecx], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x80
ret
Function at 0x45ae20
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x188
push ebx
mov ebx, dword [esp + 0x190]
cmp dword [ebx + 0x90], 3
jne 0x45b058
cmp byte [ebx + 0x2a5], 0
push ebp
push esi
push edi
jne 0x45afea
cmp byte [ebx + 0x2c0], 0
jne 0x45afea
mov esi, dword [esp + 0x1a0]
lea eax, [esp + 0x10]
mov ebp, dword [ebx]
push eax
lea eax, [esp + 0x11c]
mov dword [esp + 0x14], 0x80
push eax
push esi
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x45aeb4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
lea eax, [esp + 0x18]
push 0x80
push eax
push esi
call fcn.004b6080
push eax
push esi
push str.getpeername___failed_with_errno__d:__s
push ebp
call fcn.004599d0
add esp, 0x1c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x188
ret
push 0x80
lea eax, [esp + 0x9c]
mov dword [esp + 0x18], 0x80
push 0
push eax
call fcn.00401100
add esp, 0xc
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x9c]
push eax
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x45af1e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
lea eax, [esp + 0x18]
push 0x80
push eax
push esi
call fcn.004b6080
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
push ebp
call fcn.004599d0
add esp, 0x1c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x188
ret
lea eax, [ebx + 0x138]
push eax
lea esi, [ebx + 0x10a]
push esi
push dword [esp + 0x18]
lea eax, [esp + 0x124]
push eax
call fcn.0045ad10
add esp, 0x10
test al, al
jne 0x45af7e
call fcn.0042dcc8
mov esi, dword [eax]
call fcn.0042dcc8
mov edi, eax
lea eax, [esp + 0x18]
push 0x80
push eax
push esi
call fcn.004b6080
push eax
push dword [edi]
push str.ssrem_inet_ntop___failed_with_errno__d:__s
push ebp
call fcn.004599d0
add esp, 0x1c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x188
ret
lea edi, [ebx + 0x5c]
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
lea eax, [ebx + 0x16c]
push eax
lea eax, [ebx + 0x13c]
push eax
push dword [esp + 0x1c]
lea eax, [esp + 0xa4]
movsw word es:[edi], word [esi]
push eax
call fcn.0045ad10
add esp, 0x10
test al, al
jne 0x45afea
call fcn.0042dcc8
mov esi, dword [eax]
call fcn.0042dcc8
mov edi, eax
lea eax, [esp + 0x18]
push 0x80
push eax
push esi
call fcn.004b6080
push eax
push dword [edi]
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebp
call fcn.004599d0
add esp, 0x1c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x188
ret
mov edi, dword [ebx]
lea esi, [ebx + 0x10a]
add edi, 0x1088
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
mov ecx, 0xb
movsw word es:[edi], word [esi]
mov edi, dword [ebx]
lea esi, [ebx + 0x13c]
add edi, 0x10bc
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, dword [ebx + 0x2e8]
mov ecx, dword [ebx]
pop edi
pop esi
mov eax, dword [eax]
mov dword [ecx + 0x10f0], eax
mov eax, dword [ebx + 0x2e8]
mov ecx, dword [ebx]
pop ebp
mov eax, dword [eax + 0x40]
mov dword [ecx + 0x10f4], eax
mov ecx, dword [ebx]
mov eax, dword [ebx + 0x138]
mov dword [ecx + 0x10b8], eax
mov ecx, dword [ebx]
mov eax, dword [ebx + 0x16c]
mov dword [ecx + 0x10ec], eax
pop ebx
add esp, 0x188
ret
Function at 0x45c0c0
Capabilities:
Get common file path
Initialize winsock library

Disassembly:
sub esp, 0x190
test byte [esp + 0x194], 2
je 0x45c103
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x45c0f7
mov eax, dword [esp]
cmp al, 2
jne 0x45c0f1
shr eax, 8
cmp al, 2
je 0x45c103
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
add esp, 0x190
ret
call fcn.004b9660
test eax, eax
jne 0x45c2fd
push esi
push edi
push 0x50a09c
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
test edi, edi
jne 0x45c130
mov dword [0x51c2d4], esi
jmp 0x45c260
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.LoadLibraryExA
push edi
call ebp
push 0x50a5c8
push str.iphlpapi.dll
mov ebx, eax
call fcn.004b9620
add esp, 8
test eax, eax
je 0x45c180
test ebx, ebx
je 0x45c16e
push 8
push 0
push str.iphlpapi.dll
call ebx
mov esi, eax
jmp 0x45c243
push str.iphlpapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
jmp 0x45c243
test ebx, ebx
je 0x45c1a5
push str.AddDllDirectory
push edi
call ebp
test eax, eax
je 0x45c1a5
push 0x800
push 0
push str.iphlpapi.dll
call ebx
mov esi, eax
jmp 0x45c243
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ebp, eax
test ebp, ebp
je 0x45c23d
lea ecx, [ebp + 0xd]
push ecx
call dword [0x518cc0]
mov edi, eax
add esp, 4
test edi, edi
je 0x45c233
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x45c233
mov ecx, edi
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x45c1e0
sub ecx, edx
mov eax, 0x5c
mov word [ecx + edi], ax
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x45c1f7
sub ecx, edx
mov edx, str.iphlpapi.dll
sub ecx, edx
add ecx, edi
lea esp, [esp]
mov al, byte [edx]
lea edx, [edx + 1]
mov byte [ecx + edx - 1], al
test al, al
jne 0x45c210
test ebx, ebx
je 0x45c22a
push 8
push 0
push edi
call ebx
jmp 0x45c231
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
push edi
call dword [0x518cc4]
add esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x51c2d4], esi
test esi, esi
je 0x45c25e
push str.if_nametoindex
push esi
call ebp
test eax, eax
je 0x45c25e
mov dword [0x51c2d0], eax
pop ebp
pop ebx
push 0x9c
lea eax, [esp + 0xc]
push 0
push eax
call fcn.00401100
mov esi, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
add esp, 0xc
mov dword [esp + 8], 0x9c
mov dword [esp + 0xc], 6
mov dword [esp + 0x10], 0
push 3
push 2
push 0
push 0
mov dword [esp + 0x28], 2
call esi
push 3
push 1
push edx
push eax
call esi
push 3
push 0x20
push edx
push eax
call esi
push 3
push 0x10
push edx
push eax
call esi
push 1
push 8
push edx
push eax
call esi
push edx
push eax
push 0x33
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
pop edi
pop esi
test eax, eax
je 0x45c2f4
push 0x51c2d8
mov byte [0x51c2e0], 1
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor eax, eax
add esp, 0x190
ret
mov byte [0x51c2e0], 0
xor eax, eax
add esp, 0x190
ret
Function at 0x45c430
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
push edi
push 0x50a09c
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
jne 0x45c44a
pop edi
pop ebx
pop ecx
ret
push ebp
push esi
push str.LoadLibraryExA
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [esp + 0x18]
mov ebp, eax
push 0x50a5c8
push esi
call fcn.004b9620
add esp, 8
test eax, eax
je 0x45c492
test ebp, ebp
je 0x45c483
push 8
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
test ebp, ebp
je 0x45c4b8
push str.AddDllDirectory
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x45c4b8
push 0x800
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, eax
mov dword [esp + 0x10], edx
test edx, edx
je 0x45c56f
mov ecx, esi
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x45c4d5
sub ecx, ebx
lea eax, [ecx + 1]
add eax, edx
push eax
call dword [0x518cc0]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x45c565
push dword [esp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x45c565
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x45c507
sub ecx, edx
mov eax, 0x5c
mov word [ecx + ebx], ax
mov ecx, ebx
lea edx, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x45c520
sub ecx, edx
sub ecx, esi
add ecx, ebx
lea ecx, [ecx]
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x45c530
test ebp, ebp
je 0x45c55c
push 8
push 0
push ebx
call ebp
push ebx
mov edi, eax
call dword [0x518cc4]
add esp, 4
mov eax, edi
pop esi
pop ebp
pop edi
pop ebx
pop ecx
ret
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push ebx
call dword [0x518cc4]
add esp, 4
pop esi
pop ebp
mov eax, edi
pop edi
pop ebx
pop ecx
ret
Function at 0x45e905
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x51bfc0]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x45e945
cmp byte [ebx], 0xa
jne 0x45e945
or byte [edi + eax + 0x28], 4
jmp 0x45e94a
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x45ea49
mov dl, byte [eax]
cmp dl, 0x1a
je 0x45ea2c
inc eax
cmp dl, 0xd
je 0x45e976
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x45e99c
cmp eax, ecx
jae 0x45e9aa
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x45e95e
jmp 0x45ea49
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x45ea27
cmp dword [ebp - 0x10], 0
je 0x45ea27
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x51bfc0]
test byte [eax + edi + 0x28], 0x48
je 0x45ea01
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x45e9ec
mov byte [esi], dl
jmp 0x45e9fd
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x51bfc0]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x45ea49
cmp byte [ebp - 1], 0xa
jne 0x45ea10
cmp esi, ebx
jne 0x45ea10
mov byte [esi], 0xa
jmp 0x45ea48
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0045ede6
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x45ea49
mov byte [esi], 0xd
jmp 0x45ea48
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x51bfc0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x45ea46
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x45ea49
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret