joyce8/EMBER2024-capa huggingface dataset:
Function at 0x200028a0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x108
mov eax, dword [0x20021090]
push ebx
push ebp
mov ebp, ecx
add eax, 0x10
push esi
lea ecx, [esp + 0x10]
xor esi, esi
push eax
push ecx
mov dword [esp + 0x14], esi
call dword [0x2001a248]
lea edx, [esp + 0x10]
push 0x20023428
push edx
call fcn.20002dc0
add esp, 8
lea eax, [esp + 0x10]
push esi
push 0x80
push 3
push esi
push 3
push SysReAllocString
push eax
call dword [0x2001a2e4]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x2000295d
push edi
push esi
push ebx
call dword [0x2001a2f8]
mov edi, eax
push edi
call dword [0x2001a32c]
add esp, 4
lea ecx, [esp + 0x10]
mov esi, eax
push 0
push ecx
push edi
push esi
push ebx
call dword [0x2001a2f0]
xor eax, eax
test edi, edi
jbe 0x20002934
mov cl, byte [eax + esi]
xor cl, 0x44
mov byte [eax + esi], cl
inc eax
cmp eax, edi
jb 0x20002926
push edi
push esi
mov ecx, ebp
call fcn.20006d10
push esi
mov edi, eax
call dword [0x2001a328]
add esp, 4
push ebx
call dword [0x2001a260]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
Function at 0x20002e40
Capabilities:
Accept command line arguments
Get memory capacity

Disassembly:
sub esp, 0x410
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, dword [esp + 0x418]
stosb byte es:[edi], al
lea eax, [esp + 0xc]
push eax
push 3
push 0
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
test eax, eax
je 0x20002e86
xor al, al
pop edi
add esp, 0x410
ret
push ebx
push ebp
lea edx, [esp + 0x10]
push esi
lea eax, [esp + 0x20]
push edx
mov edx, dword [esp + 0x42c]
lea ecx, [esp + 0x20]
push eax
mov eax, dword [esp + 0x20]
push ecx
push 0
push edx
push eax
mov dword [esp + 0x2c], 0x400
mov byte [esp + 0x2b], 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
jne 0x20002fa8
mov eax, dword [esp + 0x14]
mov ebp, dword [esp + 0x42c]
test eax, eax
lea esi, [esp + 0x20]
jbe 0x20002f06
mov ebx, dword [0x2001a398]
push ebp
push esi
call ebx
add esp, 8
test eax, eax
je 0x20002f3e
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
mov eax, dword [esp + 0x14]
dec ecx
lea esi, [esi + ecx + 1]
mov ecx, esi
sub ecx, edx
cmp ecx, eax
jb 0x20002edb
cmp dword [esp + 0x430], 1
jne 0x20003010
lea esi, [esp + eax + 0x1f]
push ebp
push esi
call dword [0x2001a248]
mov edi, dword [0x2001a234]
push esi
call edi
push esi
mov byte [eax + esi + 1], 0
call edi
mov edx, dword [esp + 0x14]
lea ecx, [edx + eax + 1]
jmp 0x20002fe8
mov eax, dword [esp + 0x430]
test eax, eax
jne 0x20003010
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
or edx, 0xffffffff
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x14]
mov edi, esi
not ecx
dec ecx
sub edx, ecx
or ecx, 0xffffffff
add eax, edx
mov dword [esp + 0x14], eax
sub eax, esi
lea eax, [esp + eax + 0x21]
push eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea ecx, [ecx + esi + 1]
push ecx
push esi
call dword [0x2001a348]
mov ecx, dword [esp + 0x20]
add esp, 0xc
cmp ecx, 3
jae 0x20002fec
mov ecx, dword [esp + 0x428]
mov edx, dword [esp + 0x18]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_Process32Next]
jmp 0x20003009
cmp dword [esp + 0x430], 1
jne 0x20003010
mov edi, dword [esp + 0x42c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x20]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
inc ecx
mov dword [esp + 0x14], ecx
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x42c]
push eax
push 7
push 0
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test eax, eax
sete byte [esp + 0x13]
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov al, byte [esp + 0x13]
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x410
ret
Function at 0x20003730
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
sub esp, 0x11c
push ebx
push ebp
push esi
push 0x400
mov dword [esp + 0x20], ecx
push 0x40
mov dword [esp + 0x14], 0xff
call dword [0x2001a184]
mov esi, dword [esp + 0x130]
mov ebp, eax
push esi
lea eax, [ebp + 2]
mov byte [ebp], 0x8f
push eax
mov byte [ebp + 1], 0xa
call dword [0x2001a248]
push esi
call dword [0x2001a234]
lea ecx, [esp + 0x20]
mov ebx, eax
push ecx
mov ecx, dword [esp + 0x130]
push 0
push 0
lea edx, [esp + 0x18]
push 0
lea eax, [esp + 0x38]
push edx
push eax
push 0
push ecx
add ebx, 3
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, 0x103
je 0x20003898
push edi
test eax, eax
jne 0x20003857
push ebp
call dword [0x2001a180]
mov edx, dword [esp + 0x10]
lea ecx, [ebx + edx + 2]
cmp ecx, eax
jbe 0x200037e0
lea edx, [ebx + 0x400]
push 0x42
push edx
push ebp
call dword [0x2001a18c]
mov ebp, eax
mov ecx, dword [esp + 0x10]
lea esi, [esp + 0x2c]
mov eax, ecx
lea edi, [ebx + ebp]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea edx, [esp + 0x18]
and ecx, 3
push edx
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x14]
push 1
lea eax, [esp + 0x34]
push 0
lea ebx, [ebx + ecx + 1]
mov ecx, dword [esp + 0x13c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
test eax, eax
jne 0x20003856
push eax
push eax
push eax
push eax
push eax
push eax
lea edx, [esp + 0x34]
push eax
push edx
push eax
push eax
mov dword [esp + 0x44], eax
push eax
mov eax, dword [esp + 0x44]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x2000384b
mov byte [ebx + ebp], 1
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
inc ebx
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x24]
push edx
push 0
push 0
lea ecx, [esp + 0x1c]
push 0
lea edx, [esp + 0x3c]
inc eax
push ecx
push edx
mov dword [esp + 0x2c], eax
push eax
mov eax, dword [esp + 0x14c]
push eax
mov dword [esp + 0x30], 0xff
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, 0x103
jne 0x200037b3
pop edi
mov ecx, dword [esp + 0x1c]
push ebx
push ebp
call fcn.2000f9c0
push ebp
call dword [0x2001a17c]
pop esi
pop ebp
pop ebx
add esp, 0x11c
ret 8
Function at 0x20003e50
Capabilities:
Enumerate devices by category

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x20019b10
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push edi
mov edi, dword [esp + 0x34]
xor ebx, ebx
cmp edi, ebx
jge 0x20003e89
pop edi
xor al, al
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 8
mov dword [esp + 8], ebx
lea eax, [esp + 8]
mov dword [esp + 0x2c], ebx
push eax
push 0x2001dd48
push 1
push ebx
push 0x2001ddd8
call dword [0x2001a600]
cmp eax, ebx
je 0x20003ed8
mov eax, dword [esp + 8]
mov dword [esp + 0x2c], 0xffffffff
cmp eax, ebx
je 0x20003f22
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop edi
xor al, al
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 8
mov dword [esp + 0x34], ebx
mov eax, dword [esp + 8]
lea ecx, [esp + 0x34]
push ebx
push ecx
mov edx, dword [eax]
push 0x2001ddc8
push eax
mov byte [esp + 0x3c], 1
call dword [edx + 0xc]
cmp eax, ebx
je 0x20003f37
mov eax, dword [esp + 0x34]
mov byte [esp + 0x2c], bl
cmp eax, ebx
je 0x20003f0c
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [esp + 8]
mov dword [esp + 0x2c], 0xffffffff
cmp eax, ebx
je 0x20003f22
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop edi
xor al, al
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 8
mov eax, dword [esp + 0x34]
push esi
push eax
mov edx, dword [eax]
call dword [edx + 0x14]
mov eax, dword [esp + 0x38]
lea edx, [esp + 0x14]
push edx
lea edx, [esp + 0x14]
mov ecx, dword [eax]
push edx
push 1
push eax
xor esi, esi
call dword [ecx + 0xc]
cmp edi, ebx
jl 0x20003ff6
push ebp
mov ebp, dword [esp + 0x40]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x40]
push edx
push 0x2001a810
mov ecx, dword [eax]
push ebx
push ebx
push eax
call dword [ecx + 0x24]
cmp eax, ebx
jl 0x20003fcc
mov eax, dword [esp + 0x40]
lea edx, [esp + 0x1c]
push ebx
mov word [esp + 0x20], 8
mov ecx, dword [eax]
push edx
push 0x20022380
push eax
call dword [ecx + 0xc]
cmp eax, ebx
jne 0x20003fc2
cmp esi, edi
jne 0x20003fb7
mov eax, dword [esp + 0x14]
push ebp
push 0x2001dd38
push ebx
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x20]
mov edx, dword [esp + 0x24]
push edx
call dword [0x2001a3dc]
mov eax, dword [esp + 0x40]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x14]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 0x3c]
lea edx, [esp + 0x18]
push edx
lea edx, [esp + 0x18]
mov ecx, dword [eax]
push edx
push 1
push eax
inc esi
call dword [ecx + 0xc]
cmp esi, edi
jle 0x20003f67
pop ebp
mov eax, dword [esp + 0x38]
mov byte [esp + 0x30], bl
cmp eax, ebx
pop esi
je 0x20004009
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 8]
mov dword [esp + 0x2c], 0xffffffff
cmp eax, ebx
je 0x2000401f
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov ecx, dword [esp + 0x24]
pop edi
mov al, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 8
Function at 0x20004b40
Capabilities:
Get session information

Disassembly:
push 0xffffffffffffffff
push 0x200198a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push esi
mov esi, ecx
push eax
mov dword [esp + 8], esi
call fcn.20004600
push 0xf003f
push 0
push 0
mov dword [esp + 0x1c], 0
mov dword [esi], 0x2001a6c8
call dword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationA]
push 0x30
mov ecx, esi
mov dword [esi + 0x10], eax
call fcn.20001e90
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x20005f60
Capabilities:
Check for time delay via gettickcount
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x2001a738
push 0x200196c6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 0x20]
cmp eax, 3
ja case.default.0x20005f97
jmp dword [eax*4 + 0x200060dc]
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x24]
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne case.default.0x20005f97
lea ecx, [ebp - 0x24]
push ecx
push 0x2001f
push ebx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [ebp - 0x20], eax
cmp eax, ebx
jne case.default.0x20005f97
mov edx, dword [ebp + 0x14]
cmp edx, ebx
jbe case.default.0x20005f97
cmp edx, 2
jbe 0x20006023
cmp edx, 4
jne case.default.0x20005f97
push edx
lea ecx, [ebp + 0x1c]
push ecx
push edx
push ebx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test eax, eax
jne case.default.0x20005f97
jmp 0x200060a7
mov esi, dword [ebp + 0x18]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push esi
push edx
push ebx
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test eax, eax
jne case.default.0x20005f97
jmp 0x200060a7
lea eax, [ebp - 0x24]
push eax
push 0x2001f
push ebx
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
test eax, eax
jne case.default.0x20005f97
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
jne case.default.0x20005f97
jmp 0x200060a7
lea edx, [ebp - 0x24]
push edx
push 0x2001f
push ebx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
test eax, eax
jne case.default.0x20005f97
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne case.default.0x20005f97
mov dword [ebp - 0x1c], 1
mov dword [ebp - 4], 0xffffffff
call fcn.200060ce
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x200065c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
pushal
mov eax, dword fs:[0x30]
mov edx, dword [eax + 0xc]
add edx, 0x14
mov edx, dword [edx]
mov eax, dword [edx + 0x10]
test eax, eax
je 0x20006601
mov esi, dword [edx + 0x28]
mov edi, dword [ebp + 8]
mov bx, word [esi]
mov bh, byte [edi]
cmp bl, 0x5a
jg 0x200065f5
cmp bl, 0x41
jl 0x200065f5
add bl, 0x20
cmp bl, bh
jne 0x200065d4
inc esi
inc esi
inc edi
test bx, bx
jne 0x200065e3
mov dword [ebp - 4], eax
popal
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x20006cb0
Capabilities:
Encode data using xor

Disassembly:
push esi
call fcn.200086f0
mov esi, dword [esp + 0xc]
mov ecx, dword [esp + 8]
or eax, 0xffffffff
test esi, esi
jbe 0x20006ce5
push ebx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x20023e54]
xor eax, edx
inc ecx
dec esi
jne 0x20006cc6
pop ebx
not eax
mov esi, eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x20006d01
push esi
push 0x20021e8c
push eax
call dword [0x2001a4fc]
add esp, 0xc
mov eax, esi
pop esi
ret

Function at 0x20006f70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push ecx
mov dword [ebp - 4], 1
call fcn.200015c0
add esp, 8
nop
xor ecx, ecx
test eax, eax
jle 0x20006fc4
push ebx
mov edx, dword [ebp - 4]
mov bl, byte [ecx + edx]
add bl, 0x7a
mov byte [ecx + edx], bl
mov edx, dword [ebp - 4]
mov bl, byte [ecx + edx]
xor bl, 0x5f
mov byte [ecx + edx], bl
mov edx, dword [ebp - 4]
mov bl, byte [ecx + edx]
xor bl, 0x46
mov byte [ecx + edx], bl
inc ecx
cmp ecx, eax
jl 0x20006f93
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x20007690
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
mov ecx, 0x5f8
mov eax, esi
mov dl, byte [esi + 0xf]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
inc eax
dec ecx
jne 0x200076a0
mov al, byte [esi]
mov cl, byte [esi + 0xe]
pop esi
cmp al, cl
pop ebx
jne 0x200076bc
cmp al, 0x2b
jne 0x200076bc
mov al, 1
ret
xor al, al
ret
Function at 0x20008170
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x2001a7b0
push 0x200196c6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x140
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0xbe037055
xor esi, esi
push esi
call fcn.20005eb0
add esp, 8
cmp eax, esi
jne 0x200081c0
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 4], esi
push eax
push esi
push 0x400
call dword [0x2001a144]
mov ebx, eax
mov dword [ebp - 0x1c], ebx
cmp ebx, esi
je 0x200082a0
lea eax, [ebp - 0x30]
push eax
push 8
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov dword [ebp - 0x24], eax
cmp eax, esi
je 0x200082a0
mov dword [ebp - 0x38], esi
lea ecx, [ebp - 0x38]
push ecx
push esi
push esi
push 1
mov edx, dword [ebp - 0x30]
push edx
mov edi, dword [0x2001a004]
call edi
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x38]
test eax, eax
jbe 0x200082a0
push eax
call fcn.2001967e
add esp, 4
mov esi, eax
mov dword [ebp - 0x148], esi
mov dword [ebp - 0x28], esi
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [ebp - 0x38]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x30]
push edx
call edi
mov dword [ebp - 0x24], eax
test eax, eax
je 0x200082a0
mov dword [ebp - 0x140], 0x104
mov dword [ebp - 0x144], 0x100
push 0x100
call fcn.2001967e
add esp, 4
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x34]
push ecx
lea edx, [ebp - 0x140]
push edx
lea ecx, [ebp - 0x13c]
push ecx
lea edx, [ebp - 0x144]
push edx
push eax
mov eax, dword [esi]
push eax
push 0
call dword [sym.imp.OLEAUT32.dll_VariantInit]
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0xffffffff
call 0x200082b2
mov ebx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x28]
test ebx, ebx
je 0x200082bd
push ebx
call dword [0x2001a260]
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x200082cb
push eax
call dword [0x2001a260]
test esi, esi
je 0x200082d8
push esi
call fcn.20019684
add esp, 4
mov esp, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x200086f0
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor edx, edx
mov ecx, 0x20023e54
mov eax, edx
mov esi, 8
test al, 1
je 0x2000870c
shr eax, 1
xor eax, 0xedb88320
jmp 0x2000870e
shr eax, 1
dec esi
jne 0x200086ff
mov dword [ecx], eax
add ecx, 4
inc edx
cmp ecx, 0x20024254
jl 0x200086f8
pop esi
ret
Function at 0x2000a330
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x2001a7c0
push 0x200196c6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0xbe037055
xor edi, edi
push edi
call fcn.20005eb0
add esp, 8
cmp eax, edi
jne 0x2000a37d
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 4], edi
push eax
push edi
push 0x400
call dword [0x2001a144]
mov esi, eax
mov dword [ebp - 0x1c], esi
cmp esi, edi
je 0x2000a3ac
lea eax, [ebp - 0x28]
push eax
push 8
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0xffffffff
call 0x2000a3bd
xor edi, edi
mov esi, dword [ebp - 0x1c]
cmp esi, edi
je 0x2000a3c8
push esi
call dword [0x2001a260]
mov esp, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x2000a460
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x2c
xor eax, eax
mov edx, dword [esp + 0x34]
mov dword [esp + 4], eax
push esi
mov dword [esp + 0xc], eax
xor esi, esi
mov dword [esp + 0x10], eax
mov dword [esp + 8], esi
mov dword [esp + 0x14], eax
mov dword [esp + 4], 0x15180
lea eax, [esp + 0x18]
mov ecx, 3
mov dword [eax + 4], esi
mov dword [eax], edx
add eax, 8
dec ecx
jne 0x2000a491
mov eax, dword [esp + 0x34]
lea edx, [esp + 4]
push edx
lea ecx, [esp + 0x1c]
push 2
push eax
mov dword [esp + 0x1c], 3
mov dword [esp + 0x20], ecx
mov dword [esp + 0x18], esi
call dword [sym.imp.WS2_32.dll_recv]
pop esi
add esp, 0x2c
ret
Function at 0x2000a790
Capabilities:
Get session information
Monitor local ipv4 address changes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x2001a7d0
push 0x200196c6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x530
push ebx
push esi
push edi
mov byte [ebp - 0x53c], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x53b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov dword [ebp - 0x540], eax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 4], eax
push 0xf003f
push eax
push eax
call dword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationA]
mov edi, eax
mov dword [ebp - 0x13c], edi
push 0xf01ff
mov ebx, dword [ebp + 8]
push ebx
push edi
call dword [sym.imp.iphlpapi.dll_NotifyAddrChange]
mov esi, eax
mov dword [ebp - 0x540], esi
test edi, edi
jne 0x2000a815
test esi, esi
je 0x2000a880
lea eax, [ebp - 0x138]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
test eax, eax
je 0x2000a880
cmp dword [ebp - 0x134], 1
je 0x2000a84f
lea ecx, [ebp - 0x138]
push ecx
push 1
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x2000a880
push 0x320
call dword [0x2001a270]
push ebx
mov edx, dword [0x20021f84]
push edx
lea eax, [ebp - 0x53c]
push eax
call dword [0x2001a4fc]
add esp, 0xc
push esi
call dword [0x2001a090]
lea ecx, [ebp - 0x53c]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [0x2001a408]
mov dword [ebp - 4], 0xffffffff
call fcn.2000a8a9
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x2000b4f0
Capabilities:
Accept command line arguments
Get memory capacity

Disassembly:
sub esp, 0x10
mov eax, 4
mov dword [esp + 4], eax
mov dword [esp + 8], eax
lea eax, [esp]
push eax
push 0x20022560
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea ecx, [esp + 4]
lea edx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 4]
lea eax, [esp + 0xc]
push edx
push eax
push 0
push 0x20022558
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov edx, dword [esp]
push edx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov eax, dword [esp + 0xc]
add esp, 0x10
ret
Function at 0x2000b570
Capabilities:
Accept command line arguments
Get memory capacity

Disassembly:
sub esp, 0x14
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x20]
push esi
xor esi, esi
push esi
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x2000b5a0
xor eax, eax
pop esi
add esp, 0x14
ret
push ebp
mov ebp, dword [esp + 0x30]
cmp ebp, esi
push edi
jne 0x2000b662
xor eax, eax
lea ecx, [esp + 0xc]
mov dword [esp + 0xd], eax
push 0xa
mov dword [esp + 0x15], eax
push ecx
mov dword [esp + 0x1d], eax
mov byte [esp + 0x14], 0
mov dword [esp + 0x21], eax
mov word [esp + 0x25], ax
mov byte [esp + 0x27], al
call fcn.20014790
add esp, 8
push 1
push 0x20021b10
call fcn.20001130
push 1
push 0x20021afc
call fcn.20001130
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x30]
push edx
push 0xf003f
push esi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [esp + 0x30]
lea edx, [esp + 0xc]
push esi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [esp + 0x30]
mov edi, dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push ecx
call edi
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0xc]
push 8
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea ecx, [esp + 0xc]
neg esi
sbb esi, esi
push ecx
inc esi
call dword [0x2001a2b0]
mov eax, dword [esp + 0x2c]
push eax
call edi
pop edi
mov eax, esi
pop ebp
pop esi
add esp, 0x14
ret
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x24]
push ebx
push edx
push 0x20019
push esi
push eax
push ecx
mov dword [esp + 0x48], esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [esp + 0x28]
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
lea edx, [esp + 0x34]
push edx
push esi
push esi
push esi
push ebp
push eax
call ebx
test eax, eax
jne 0x2000b6f0
mov ecx, dword [esp + 0x34]
add ecx, 2
push ecx
call fcn.2001967e
mov ecx, dword [esp + 0x2c]
add esp, 4
lea edx, [esp + 0x34]
mov edi, eax
push edx
lea eax, [esp + 0x30]
push edi
push eax
push 0
push ebp
push ecx
call ebx
test eax, eax
jne 0x2000b6e7
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
push edx
push edi
push eax
push 0
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
neg esi
sbb esi, esi
inc esi
push edi
call fcn.20019684
add esp, 4
mov edx, dword [esp + 0x28]
mov edi, dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push edx
call edi
mov eax, dword [esp + 0x30]
pop ebx
push eax
call edi
pop edi
mov eax, esi
pop ebp
pop esi
add esp, 0x14
ret