joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406942
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x39c]
sub esp, 0x41c
mov ecx, dword [ebp + 0x3a4]
cmp ecx, dword [0x40ee80]
mov eax, dword [0x40d080]
push ebx
push esi
mov dword [ebp + 0x398], eax
push edi
jae 0x406b08
mov eax, ecx
sar eax, 5
lea ebx, [eax*4 + 0x40eea0]
mov eax, dword [ebx]
mov esi, ecx
and esi, 0x1f
shl esi, 3
mov al, byte [eax + esi + 4]
test al, 1
mov dword [ebp - 0x80], ebx
je 0x406b08
xor edi, edi
cmp dword [ebp + 0x3ac], edi
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x7c], edi
jne 0x4069ac
xor eax, eax
jmp 0x406b1c
test al, 0x20
je 0x4069bd
push 2
push edi
push edi
push ecx
call fcn.00408d87
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x406a92
cmp dword [ebp + 0x3ac], edi
mov eax, dword [ebp + 0x3a8]
mov dword [ebp - 0x70], eax
mov dword [ebp + 0x3a4], edi
jbe 0x406ad9
mov ecx, dword [ebp - 0x70]
sub ecx, dword [ebp + 0x3a8]
lea eax, [ebp - 0x6c]
cmp ecx, dword [ebp + 0x3ac]
jae 0x406a1f
mov edx, dword [ebp - 0x70]
inc dword [ebp - 0x70]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x406a10
inc dword [ebp - 0x7c]
mov byte [eax], 0xd
inc eax
inc edi
mov ebx, dword [ebp - 0x80]
mov byte [eax], dl
inc eax
inc edi
cmp edi, 0x400
jl 0x4069f2
mov edi, eax
lea eax, [ebp - 0x6c]
sub edi, eax
push 0
lea eax, [ebp - 0x78]
push eax
push edi
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x406a5f
mov eax, dword [ebp - 0x78]
add dword [ebp - 0x74], eax
cmp eax, edi
jl 0x406a6b
mov eax, dword [ebp - 0x70]
sub eax, dword [ebp + 0x3a8]
xor edi, edi
cmp eax, dword [ebp + 0x3ac]
jb 0x4069e6
jmp 0x406a6d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x3a4], eax
xor edi, edi
mov eax, dword [ebp - 0x74]
cmp eax, edi
jne 0x406b03
cmp dword [ebp + 0x3a4], edi
je 0x406ad9
push 5
pop eax
cmp dword [ebp + 0x3a4], eax
jne 0x406acb
mov dword [0x40e934], eax
jmp 0x406b0f
push edi
lea ecx, [ebp - 0x78]
push ecx
push dword [ebp + 0x3ac]
push dword [ebp + 0x3a8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x406abd
mov eax, dword [ebp - 0x78]
mov dword [ebp + 0x3a4], edi
mov dword [ebp - 0x74], eax
jmp 0x406a6d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x3a4], eax
jmp 0x406a6d
push dword [ebp + 0x3a4]
call fcn.00408d28
pop ecx
jmp 0x406b19
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x406af1
mov eax, dword [ebp + 0x3a8]
cmp byte [eax], 0x1a
je 0x4069a5
mov dword [0x40e930], 0x1c
mov dword [0x40e934], edi
jmp 0x406b19
sub eax, dword [ebp - 0x7c]
jmp 0x406b1c
and dword [0x40e934], 0
mov dword [0x40e930], 9
or eax, 0xffffffff
mov ecx, dword [ebp + 0x398]
pop edi
pop esi
pop ebx
call fcn.00403915
add ebp, 0x39c
leave
ret
Function at 0x406fc8
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x40d080]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x40d4d8]
je 0x406ffd
inc eax
cmp eax, 0x13
jb 0x406fee
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x40d4d8]
jne 0x407123
mov eax, dword [0x40e9b0]
cmp eax, 1
je 0x4070fb
cmp eax, edx
jne 0x40702d
cmp dword [0x40d334], 1
je 0x4070fb
cmp ecx, 0xfc
je 0x407123
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x407063
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.00406ed0
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.00407b60
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x407097
mov eax, edi
push eax
call fcn.00407b60
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x40b30c
push edi
call fcn.004037c0
add esp, 0x10
push edi
call fcn.00407b60
push dword [esi + 0x40d4dc]
mov ebx, eax
call fcn.00407b60
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.004076e0
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.00406ed0
push edi
push ebx
call fcn.00406ee0
push 0x40b308
push ebx
call fcn.00406ee0
push dword [esi + 0x40d4dc]
push ebx
call fcn.00406ee0
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.00407a5d
add esp, 0x2c
jmp 0x407123
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x40d4dc]
push dword [esi]
call fcn.00407b60
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.00403915
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret
Function at 0x407a5d
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x40ebdc], ebx
push esi
push edi
jne 0x407add
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x407b18
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
mov dword [0x40ebdc], eax
je 0x407b18
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x40ebe0], eax
call esi
cmp dword [0x40e93c], 2
mov dword [0x40ebe4], eax
jne 0x407add
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x40ebec], eax
je 0x407add
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x40ebe8], eax
mov eax, dword [0x40ebe8]
test eax, eax
je 0x407b22
call eax
test eax, eax
je 0x407b09
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x40ebec]
test eax, eax
je 0x407b09
test byte [ebp - 8], 1
jne 0x407b22
cmp dword [0x40e948], 4
jb 0x407b1c
or byte [ebp + 0x12], 0x20
jmp 0x407b41
xor eax, eax
jmp 0x407b51
or byte [ebp + 0x12], 4
jmp 0x407b41
mov eax, dword [0x40ebe0]
test eax, eax
je 0x407b41
call eax
mov ebx, eax
test ebx, ebx
je 0x407b41
mov eax, dword [0x40ebe4]
test eax, eax
je 0x407b41
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x40ebdc]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407cda
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x407d08
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x407d0f
cmp ebx, dword [eax + 4]
jae 0x407d0f
xor eax, eax
jmp 0x407eff
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x407d20
xor eax, eax
inc eax
jmp 0x407efe
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x407d36
cmp ecx, edx
jae 0x407e7b
cmp dword [eax + 4], 0
je 0x407d3f
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x407d27
cmp dword [ebp + 8], 0
je 0x407d61
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x407e7b
cmp eax, esi
jae 0x407e7b
mov eax, dword [0x40ebf0]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x407d86
cmp dword [esi*4 + 0x40ebf8], edi
je 0x407e7f
inc esi
cmp esi, eax
jl 0x407d74
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x407efb
cmp dword [ebp - 8], 0x1000000
jne 0x407efb
test byte [ebp - 0xc], 0xcc
je 0x407e04
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x407efb
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407efb
cmp word [eax + 0x18], 0x10b
jne 0x407efb
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x407efb
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x407e04
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x407e04
test byte [ecx + 0x27], 0x80
jne 0x407e7b
push 1
push 0x40ec38
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x407d18
mov ecx, dword [0x40ebf0]
test ecx, ecx
mov edx, ecx
jle 0x407e38
lea eax, [ecx*4 + 0x40ebf4]
cmp dword [eax], edi
je 0x407e38
dec edx
sub eax, 4
test edx, edx
jg 0x407e2c
test edx, edx
jne 0x407e69
push 0xf
pop ebx
cmp ecx, ebx
jg 0x407e45
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x407e5d
lea eax, [edx*4 + 0x40ebf8]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x407e4b
cmp ecx, 0x10
jge 0x407e69
inc ecx
mov dword [0x40ebf0], ecx
push 0
push 0x40ec38
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x407d18
xor eax, eax
jmp 0x407efe
test esi, esi
jle 0x407d18
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
push 0x40ec38
call ebx
test eax, eax
jne 0x407d18
cmp dword [esi*4 + 0x40ebf8], edi
je 0x407ed5
mov eax, dword [0x40ebf0]
lea esi, [eax - 1]
test esi, esi
jl 0x407ec3
cmp dword [esi*4 + 0x40ebf8], edi
je 0x407ebf
dec esi
jns 0x407eb3
test esi, esi
jge 0x407ed3
cmp eax, 0x10
jge 0x407ece
inc eax
mov dword [0x40ebf0], eax
lea esi, [eax - 1]
jmp 0x407ed5
je 0x407eed
xor ecx, ecx
test esi, esi
jl 0x407eed
lea eax, [ecx*4 + 0x40ebf8]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x407edb
push 0
push 0x40ec38
call ebx
jmp 0x407d18
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x408c45
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.004076e0
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x408ce0
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x40e93c]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x408ce0
cmp eax, 1
je 0x408d01
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x408ce0
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x408cad
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x408cdc
xor eax, eax
inc eax
jmp 0x408d20
cmp edi, eax
jae 0x408ce4
xor eax, eax
jmp 0x408d20
cmp eax, esi
jae 0x408ceb
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x40e93c]
jmp 0x408d04
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x409a11
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [ebp - 0x10], ebx
jne 0x409a2a
or eax, 0xffffffff
jmp 0x409a8b
push esi
mov esi, dword [eax]
cmp esi, ebx
mov dword [ebp - 4], esi
je 0x409a87
push 0x3d
push esi
call fcn.00409c11
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
je 0x409a87
cmp esi, eax
je 0x409a87
xor ecx, ecx
cmp byte [eax + 1], bl
mov eax, dword [0x40e95c]
sete cl
cmp eax, dword [0x40e960]
mov dword [ebp - 8], ecx
jne 0x409a6d
mov edi, eax
call fcn.004099b0
mov dword [0x40e95c], eax
cmp eax, ebx
jne 0x409ac6
cmp dword [ebp + 0xc], ebx
je 0x409a8f
cmp dword [0x40e964], ebx
je 0x409a8f
call fcn.00409455
test eax, eax
je 0x409ac6
or eax, 0xffffffff
pop esi
pop edi
pop ebx
leave
ret
cmp dword [ebp - 8], ebx
je 0x409a98
xor eax, eax
jmp 0x409a8a
push 4
call fcn.0040806c
cmp eax, ebx
pop ecx
mov dword [0x40e95c], eax
je 0x409a87
mov dword [eax], ebx
cmp dword [0x40e964], ebx
jne 0x409ac6
push 4
call fcn.0040806c
cmp eax, ebx
pop ecx
mov dword [0x40e964], eax
je 0x409a87
mov dword [eax], ebx
mov edi, dword [ebp - 0xc]
sub edi, dword [ebp - 4]
push dword [ebp - 4]
mov esi, dword [0x40e95c]
call fcn.00409963
mov edi, eax
cmp edi, ebx
pop ecx
jl 0x409b27
cmp dword [esi], ebx
je 0x409b27
lea esi, [esi + edi*4]
push dword [esi]
call fcn.0040377d
cmp dword [ebp - 8], ebx
pop ecx
jne 0x409b0a
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
jmp 0x409b68
mov eax, dword [esi + 4]
mov dword [esi], eax
inc edi
add esi, 4
cmp dword [esi], ebx
jne 0x409b01
mov eax, edi
shl eax, 2
push eax
push dword [0x40e95c]
call fcn.00408f32
cmp eax, ebx
pop ecx
pop ecx
je 0x409b68
jmp 0x409b63
cmp dword [ebp - 8], ebx
jne 0x409bd3
cmp edi, ebx
jge 0x409b36
neg edi
lea eax, [edi*4 + 8]
push eax
push dword [0x40e95c]
call fcn.00408f32
cmp eax, ebx
pop ecx
pop ecx
je 0x409a87
mov edx, dword [ebp - 4]
lea ecx, [eax + edi*4]
mov dword [ecx], edx
mov dword [ecx + 4], ebx
mov ecx, dword [ebp + 8]
mov dword [ecx], ebx
mov dword [0x40e95c], eax
cmp dword [ebp + 0xc], ebx
je 0x409bbd
push dword [ebp - 4]
call fcn.00407b60
inc eax
inc eax
push eax
call fcn.0040806c
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x409bbd
push dword [ebp - 4]
push esi
call fcn.00406ed0
mov eax, esi
sub eax, dword [ebp - 4]
pop ecx
add eax, dword [ebp - 0xc]
pop ecx
mov ecx, dword [ebp - 8]
mov byte [eax], bl
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x409bb6
or dword [ebp - 0x10], 0xffffffff
push esi
call fcn.0040377d
pop ecx
cmp dword [ebp - 8], ebx
je 0x409bcb
push dword [ebp - 4]
call fcn.0040377d
pop ecx
mov eax, dword [ebp - 0x10]
jmp 0x409a8a
push dword [ebp - 4]
call fcn.0040377d
mov eax, dword [ebp + 8]
pop ecx
mov dword [eax], ebx
jmp 0x409a94
Function at 0x99f9c7
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x11c
cmp dword [esp + 0x128], 0
je 0x99fb8c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x130]
xor ebp, ebp
push edi
mov dword [esp + 0x1c], ebp
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x99fb88
mov edx, esi
mov eax, dword [edx]
mov ebx, dword [esp + 0x130]
add eax, ebx
mov dword [esp + 0x18], eax
mov eax, dword [edx + 0x10]
add eax, ebx
lea edi, [ecx + ebx]
mov dword [esp + 0x20], eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
mov dword [esp + 0x10], ebx
test ebx, ebx
jne 0x99fa32
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
mov dword [esp + 0x10], eax
push 0x104
lea eax, [esp + 0x2c]
push 0
push eax
call fcn.00998142
add esp, 0xc
test ebx, ebx
je 0x99fb32
mov eax, dword [esp + 0x18]
and dword [esp + 0x14], 0
mov eax, dword [eax]
test eax, eax
je 0x99fb1b
mov esi, dword [esp + 0x10]
xor edi, edi
mov ebp, dword [esp + 0x130]
test eax, eax
jns 0x99fa77
movzx ebx, ax
jmp 0x99fa7c
lea ebx, [ebp + 2]
add ebx, eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [esp + 0x20]
mov dword [edi + ecx], eax
test eax, eax
jne 0x99faf3
cmp dword [0x9a4eac], 1
jne 0x99faf3
push 0x104
push eax
lea eax, [esp + 0x30]
push eax
call fcn.00998142
lea eax, [esp + 0x34]
push eax
call fcn.0099fc74
lea eax, [esp + 0x38]
push 0x997204
push eax
call fcn.00998170
lea eax, [esp + 0x40]
push ebx
push eax
call fcn.00998170
add esp, 0x20
lea eax, [esp + 0x24]
push 0
push eax
lea eax, [esp + 0x30]
push eax
call fcn.00998197
pop ecx
push eax
lea eax, [esp + 0x34]
push eax
push dword [0x9a4e58]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
inc ecx
mov edi, ecx
mov dword [esp + 0x14], ecx
shl edi, 2
mov eax, dword [edi + eax]
test eax, eax
jne 0x99fa70
mov esi, dword [esp + 0x134]
mov ebp, dword [esp + 0x1c]
inc ebp
imul edx, ebp, 0x14
mov dword [esp + 0x1c], ebp
add edx, esi
mov ecx, dword [edx + 0xc]
test ecx, ecx
jne 0x99f9f9
jmp 0x99fb88
lea eax, [esp + 0x28]
push eax
call fcn.0099fc74
lea eax, [esp + 0x2c]
mov dword [esp], 0x9971e8
push eax
call fcn.00998170
lea eax, [esp + 0x30]
push edi
push eax
call fcn.00998170
add esp, 0x10
cmp dword [0x9a4eac], 1
jne 0x99fb88
push 0
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
call fcn.00998197
pop ecx
push eax
lea eax, [esp + 0x34]
push eax
push dword [0x9a4e58]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebp
pop ebx
xor eax, eax
add esp, 0x11c
ret
Function at 0x99fbc2
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push 0x208
lea eax, [ebp - 0x410]
push eax
call fcn.0099fc40
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x9a4d24], eax
push 0
push 0
push 0
push 2
push 0
push dword [0x9a4d24]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [0x9a4d28], eax
push 0
push 0
push 0
push 4
push dword [0x9a4d28]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
add eax, dword [0x9a4eb4]
mov esp, ebp
pop ebp
ret
Function at 0x99fccc
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
cmp dword [ebp + 0x14], 0
jne 0x99fcdf
xor eax, eax
jmp 0x99fe63
mov eax, dword [ebp + 0xc]
add eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
and dword [ebp - 0x24], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 8]
movzx eax, word [eax + 4]
cmp eax, 0x14c
jne 0x99fd1d
mov eax, dword [ebp - 8]
add eax, 0xf8
mov dword [ebp - 0xc], eax
jmp 0x99fd36
mov eax, dword [ebp - 8]
movzx eax, word [eax + 4]
cmp eax, 0x8664
jne 0x99fd36
mov eax, dword [ebp - 8]
add eax, 0x108
mov dword [ebp - 0xc], eax
and dword [ebp - 0x10], 0
jmp 0x99fd43
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x10], eax
je 0x99fd7c
imul eax, dword [ebp - 0x10], 0x28
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax + 0xc]
mov dword [ebp - 0x28], edx
lea eax, [ebp - 0x24]
push eax
push 0x40
imul eax, dword [ebp - 0x10], 0x28
mov ecx, dword [ebp - 0xc]
push dword [ecx + eax + 8]
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x99fd3c
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 0x2c]
jae 0x99fe1c
mov eax, dword [ebp + 0xc]
add eax, 8
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
sub eax, 8
shr eax, 1
mov dword [ebp - 0x30], eax
and dword [ebp - 4], 0
jmp 0x99fdac
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x30]
je 0x99fe0b
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
movzx eax, word [ecx + eax*2]
test eax, eax
jne 0x99fdc4
jmp 0x99fda5
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
movzx eax, word [ecx + eax*2]
and eax, 0xfff
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx]
add ecx, eax
add ecx, dword [ebp + 8]
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
movzx eax, word [ecx + eax*2]
sar eax, 0xc
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
je 0x99fdfc
jmp 0x99fe09
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
add eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x20]
mov dword [ecx], eax
jmp 0x99fda5
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax + 4]
mov dword [ebp + 0xc], ecx
jmp 0x99fd7c
and dword [ebp - 0x14], 0
jmp 0x99fe29
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x14], eax
je 0x99fe61
imul eax, dword [ebp - 0x14], 0x28
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax + 0xc]
mov dword [ebp - 0x38], edx
push 0
push dword [ebp - 0x24]
imul eax, dword [ebp - 0x14], 0x28
mov ecx, dword [ebp - 0xc]
push dword [ecx + eax + 8]
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x99fe22
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x9a000a
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x6c
mov eax, dword [esp + 0x70]
push ebx
push esi
push edi
mov esi, dword [eax]
xor edi, edi
call fcn.0099ffcd
push esi
call fcn.009a01bb
push dword [esp + 0x84]
mov esi, eax
call fcn.009a01bb
push 0x58
mov dword [esp + 0x20], eax
lea eax, [esp + 0x2c]
push edi
push eax
call fcn.00998142
lea eax, [esp + 0x34]
push eax
push 5
push esi
call fcn.0099fee7
mov ebx, eax
add esp, 0x20
cmp ebx, 5
jb 0x9a01a2
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push esi
call fcn.009a01f0
mov edi, eax
add esp, 0x14
test edi, edi
je 0x9a01a2
push ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and dword [esp + 0x14], 0
mov ebp, eax
and dword [esp + 0x10], 0
lea eax, [esp + 0x14]
push eax
push 0x40
push ebx
push esi
push ebp
mov dword [esp + 0x34], ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x9a0185
lea eax, [esp + 0x10]
push eax
push 0x40
push 0x6c
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x9a016a
xor edx, edx
lea ecx, [edi + 0x2c]
test ebx, ebx
je 0x9a00eb
mov ebp, esi
sub ebp, ecx
mov al, byte [ecx + ebp]
mov byte [ecx], al
mov byte [edi + edx + 0x4c], al
inc edx
inc ecx
cmp edx, ebx
jb 0x9a00d5
mov ebp, dword [esp + 0x20]
lea ecx, [edi + 0x2c]
lea eax, [ebx + esi]
push eax
lea eax, [ecx + ebx]
push eax
call fcn.0099ff88
mov edx, dword [esp + 0x20]
mov eax, edx
pop ecx
pop ecx
mov ecx, esi
sub eax, esi
sub ecx, edx
cmp edx, esi
cmovb eax, ecx
cmp eax, 0x7fff0000
jbe 0x9a0134
lea eax, [edi + 0xc]
push edx
push eax
call fcn.0099ff88
pop ecx
sub eax, edi
pop ecx
sub eax, 0xc
push eax
lea eax, [edi + 0xc]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [edi + 0xc]
jmp 0x9a0136
mov eax, edx
push eax
push esi
call fcn.0099ff88
mov eax, dword [esp + 0x20]
pop ecx
pop ecx
mov dword [edi + 8], eax
lea eax, [edi + 0x2c]
push ebx
push eax
push ebp
mov dword [edi + 4], ebx
mov dword [edi], esi
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push 0x6c
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push ebx
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x18]
push ebx
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
cmp dword [edi], 0
pop ebp
je 0x9a0196
mov ecx, dword [esp + 0x7c]
lea eax, [edi + 0x2c]
mov dword [ecx], eax
jmp 0x9a01a2
push 1
push edi
call fcn.009a02e4
pop ecx
pop ecx
xor edi, edi
push 0x9a4d40
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
test edi, edi
pop edi
pop esi
setne al
pop ebx
add esp, 0x6c
ret
Function at 0x9a01f0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x40
push ebx
xor ebx, ebx
cmp dword [0x9a4d34], 0x40
jae 0x9a02dd
mov ecx, dword [esp + 0x48]
push ebp
push esi
mov esi, dword [esp + 0x54]
mov ebp, 0xfff80000
add esi, ecx
add ecx, dword [esp + 0x5c]
push edi
cmp ecx, 0x80000000
lea edi, [esp + 0x2c]
push 9
lea eax, [ecx + 0x7ff80000]
cmovb ebp, eax
xor eax, eax
pop ecx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor eax, eax
lea edi, [esi - 0x7fff0000]
inc eax
cmp esi, 0x80000000
cmovb edi, eax
cmp edi, ebp
jae 0x9a02da
push 0x1c
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x9a02b5
cmp dword [esp + 0x20], 0x10000
jne 0x9a02a7
mov eax, dword [esp + 0x1c]
cmp eax, 0x6c
jb 0x9a02ab
mov ecx, dword [esp + 0x48]
cmp eax, ecx
jb 0x9a02ab
lea eax, [ecx - 1]
xor edx, edx
add eax, edi
div ecx
push 0x20
imul eax, ecx
push 0x3000
push 0x6c
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, eax
test ebx, ebx
jne 0x9a02b9
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x10]
add edi, eax
cmp edi, ebp
jb 0x9a0258
test ebx, ebx
je 0x9a02da
xor eax, eax
cmp dword [eax*4 + 0x9a4d58], 0
je 0x9a02cd
inc eax
cmp eax, 0x40
jb 0x9a02bb
jmp 0x9a02da
inc dword [0x9a4d34]
mov dword [eax*4 + 0x9a4d58], ebx
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x40
ret