joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4115bb
Capabilities:
Read file via mapping

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 7
push 0x80000000
push dword [esp + 0x30]
mov dword [esp + 0x2c], ecx
mov edi, ebx
mov ebp, ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x41162e
push ebx
push ebx
push ebx
push 2
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edi, eax
test edi, edi
jne 0x411603
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41162e
mov eax, dword [esp + 0x1c]
push dword [eax + 0x20]
push ebx
push ebx
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebp, eax
test ebp, ebp
je 0x411639
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
push dword [eax + 0x20]
push ebp
call fcn.00411387
mov bl, al
test ebp, ebp
je 0x411639
push ebp
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test edi, edi
je 0x411644
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x411654
cmp esi, 0xffffffff
je 0x411654
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
pop ecx
ret 8

Function at 0x412fe0
Capabilities:
Parse pe header

Disassembly:
push 0x24
push 0x43dc78
call fcn.0043daf8
mov edi, edx
push 0x1c
lea eax, [ebp - 0x34]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
and dword [ebp - 4], 0
mov eax, 0x5a4d
mov ecx, dword [ebp - 0x30]
cmp word [ecx], ax
jne 0x413044
mov edx, dword [ecx + 0x3c]
cmp dword [edx + ecx], 0x4550
jne 0x413044
mov esi, dword [edx + ecx + 0xd8]
lea eax, [esi + ecx]
cmp edi, eax
jb 0x413044
mov eax, dword [edx + ecx + 0xdc]
add eax, esi
add eax, ecx
cmp edi, eax
jae 0x413044
or dword [ebp - 4], 0xffffffff
mov al, 1
jmp 0x41304a
or dword [ebp - 4], 0xffffffff
xor al, al
call fcn.0043db33
ret
Function at 0x4130dd
Capabilities:
Allocate or change rwx memory

Disassembly:
mov edx, dword [0x440e30]
sub esp, 0x38
push ebx
push ebp
push esi
mov esi, ecx
cmp esi, 0x7ff80000
lea eax, [esi - 0x7ff80000]
mov ebx, 0x10000
cmova ebx, eax
push edi
lea eax, [esi + 0x7ff80000]
cmp esi, 0x80000000
mov edi, 0xfff80000
cmovb edi, eax
mov eax, dword [0x440e38]
test edx, edx
jne 0x413129
test eax, eax
je 0x41313c
mov edx, eax
mov dword [0x440e30], edx
mov ecx, dword [edx + 4]
test ecx, ecx
je 0x41313c
cmp ecx, ebx
jb 0x41313c
cmp ecx, edi
jbe 0x4132b5
mov edx, eax
test eax, eax
jmp 0x41315d
test edx, edx
je 0x413159
mov eax, dword [edx + 4]
test eax, eax
je 0x413159
cmp eax, ebx
jb 0x413159
cmp eax, edi
jbe 0x4132b5
mov edx, dword [edx]
test edx, edx
mov dword [0x440e30], edx
jne 0x413142
movzx eax, si
sub esi, eax
xor ecx, ecx
mov ebp, esi
cmp esi, ebx
jbe 0x4131ea
lea eax, [ebp - 0x70000000]
cmp eax, 0x10000000
push 0x1c
push ecx
lea eax, [esp + 0x34]
mov edx, 0x6fff0000
push eax
cmovbe ebp, edx
call dword [sym.imp.msvcrt.dll_memset]
add esp, 0xc
lea eax, [esp + 0x2c]
push 0x1c
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4131e8
mov eax, 0x10000
cmp dword [esp + 0x3c], eax
jne 0x4131b9
cmp dword [esp + 0x38], eax
jae 0x4131c9
mov ebp, dword [esp + 0x30]
add ebp, 0xffff0000
xor ecx, ecx
cmp ebp, ebx
jmp 0x413170
push 0x40
push 0x3000
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, eax
mov dword [0x440e30], edx
test edx, edx
jne 0x41328a
xor ecx, ecx
cmp esi, edi
jae 0x4132db
mov ebp, 0x10000
lea eax, [esi - 0x70000000]
cmp eax, 0x10000000
push 0x1c
push ecx
lea eax, [esp + 0x18]
mov edx, 0x80010000
push eax
cmovbe esi, edx
call dword [sym.imp.msvcrt.dll_memset]
add esp, 0xc
lea eax, [esp + 0x10]
push 0x1c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4132db
cmp dword [esp + 0x20], ebp
jne 0x413275
mov ecx, dword [esp + 0x1c]
cmp ecx, ebp
jb 0x413279
movzx edx, si
test edx, edx
je 0x41325a
mov esi, dword [esp + 0x10]
mov eax, ebp
sub eax, edx
sub ecx, eax
add esi, eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x10], esi
push 0x40
push 0x3000
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, eax
mov dword [0x440e30], edx
test edx, edx
jne 0x41328a
mov ecx, dword [esp + 0x1c]
mov esi, dword [esp + 0x10]
add esi, ecx
cmp esi, edi
jae 0x4132db
xor ecx, ecx
jmp 0x4131f7
mov eax, dword [0x440e38]
xor ecx, ecx
mov dword [edx], eax
mov dword [edx + 4], ecx
mov dword [0x440e38], edx
lea eax, [edx + 0xffc0]
mov esi, 0x3fd
mov dword [eax + 0x38], ecx
mov ecx, eax
sub eax, 0x40
dec esi
jne 0x4132a7
mov dword [edx + 4], ecx
mov esi, dword [edx + 4]
cmp esi, ebx
jb 0x4132db
cmp esi, edi
ja 0x4132db
mov ecx, dword [esi + 0x38]
push 0x40
push 0xcc
push esi
mov dword [edx + 4], ecx
call dword [sym.imp.msvcrt.dll_memset]
add esp, 0xc
mov eax, esi
jmp 0x4132dd
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret
Function at 0x41335b
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
cmp dword [0x440e3c], 0
je 0x41336c
mov eax, 0x10dd
pop ecx
ret
push esi
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0x440e3c
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x41338d
mov eax, 0x10dd
jmp 0x4133ce
mov dword [0x440e44], esi
mov dword [0x440e34], esi
mov dword [0x440e2c], esi
mov dword [0x440e40], esi
mov dword [0x440e28], esi
mov esi, dword [0x440e38]
jmp 0x4133c8
lea eax, [esp + 4]
push eax
push 0x40
push 0x10000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, dword [esi]
test esi, esi
jne 0x4133b3
xor eax, eax
pop esi
pop ecx
ret

Function at 0x4133d1
Capabilities:
Resume thread

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x440e3c], eax
je 0x4133e7
mov eax, 0x10dd
pop ecx
ret
push ebx
push esi
push edi
mov edi, dword [0x440e34]
xor ebx, ebx
test edi, edi
je 0x413432
lea eax, [esp + 0xc]
push eax
mov eax, dword [edi + 0x10]
push dword [edi + 0x14]
movzx eax, byte [eax + 0x36]
push eax
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [edi + 4], ebx
jne 0x413423
mov ecx, dword [edi + 0x10]
test ecx, ecx
je 0x413423
call fcn.004132e5
mov dword [edi + 0x10], ebx
mov esi, dword [edi]
mov ecx, edi
call fcn.00430e28
mov edi, esi
test esi, esi
jne 0x4133f6
mov dword [0x440e34], ebx
call fcn.0041309f
mov edi, dword [0x440e2c]
test edi, edi
je 0x41345f
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esi, dword [edi]
mov ecx, edi
call fcn.00430e28
mov edi, esi
test esi, esi
jne 0x413447
pop edi
pop esi
mov dword [0x440e2c], ebx
mov dword [0x440e3c], ebx
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x413472
Capabilities:
Resume thread

Disassembly:
sub esp, 0x2d0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x440e3c], eax
je 0x413490
mov eax, 0x10dd
jmp 0x41365d
cmp dword [0x440e40], 0
je 0x4134a3
call fcn.004133d1
jmp 0x413658
push ebp
push esi
mov esi, dword [0x440e34]
push edi
xor ebp, ebp
jmp 0x41350e
cmp dword [esi + 4], ebp
je 0x4134d2
mov ecx, dword [esi + 0x10]
movzx eax, byte [ecx + 0x36]
push eax
lea eax, [ecx + 0x20]
push eax
push dword [esi + 0xc]
call dword [sym.imp.msvcrt.dll_memcpy]
mov eax, dword [esi + 0xc]
add esp, 0xc
jmp 0x413507
mov eax, dword [esi + 0x10]
mov edx, dword [esi + 0xc]
mov ecx, dword [eax + 0x3c]
lea eax, [edx + 5]
sub ecx, eax
mov byte [edx], 0xe9
mov dword [edx + 1], ecx
mov eax, dword [esi + 0x10]
add edx, 5
mov eax, dword [eax + 0x38]
cmp edx, eax
jae 0x413504
sub eax, edx
push eax
push 0xcc
push edx
call sub.msvcrt.dll_memset
add esp, 0xc
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 8]
mov dword [ecx], eax
mov esi, dword [esi]
test esi, esi
jne 0x4134b0
mov edi, dword [0x440e2c]
push ebx
test edi, edi
je 0x4135bb
mov ebx, dword [sym.imp.KERNEL32.dll_SetThreadContext]
lea eax, [esp + 0x14]
push eax
push dword [edi + 4]
mov dword [esp + 0x1c], 0x10001
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x4135b1
mov esi, dword [0x440e34]
test esi, esi
je 0x4135b1
mov ecx, dword [esp + 0xcc]
cmp dword [esi + 4], ebp
je 0x413573
mov edx, dword [esi + 0x10]
cmp ecx, edx
jb 0x4135ab
lea eax, [edx + 4]
cmp ecx, eax
jae 0x4135ab
sub ecx, edx
mov dword [esp + 0xcc], ecx
add ecx, dword [esi + 0xc]
jmp 0x413593
cmp ecx, dword [esi + 0xc]
jb 0x4135ab
mov eax, dword [esi + 0x10]
movzx eax, byte [eax + 0x36]
add eax, dword [esi + 0xc]
cmp ecx, eax
jae 0x4135ab
sub ecx, dword [esi + 0xc]
mov dword [esp + 0xcc], ecx
add ecx, dword [esi + 0x10]
lea eax, [esp + 0x14]
push eax
push dword [edi + 4]
mov dword [esp + 0xd4], ecx
call ebx
mov ecx, dword [esp + 0xcc]
mov esi, dword [esi]
test esi, esi
jne 0x413552
mov edi, dword [edi]
test edi, edi
jne 0x413527
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, dword [0x440e34]
mov ebx, eax
test edi, edi
je 0x41361b
lea eax, [esp + 0x10]
push eax
mov eax, dword [edi + 0x10]
push dword [edi + 0x14]
movzx eax, byte [eax + 0x36]
push eax
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [edi + 0x10]
movzx eax, byte [eax + 0x36]
push eax
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
cmp dword [edi + 4], ebp
je 0x41360c
mov ecx, dword [edi + 0x10]
test ecx, ecx
je 0x41360c
call fcn.004132e5
mov dword [edi + 0x10], ebp
mov esi, dword [edi]
mov ecx, edi
call fcn.00430e28
mov edi, esi
test esi, esi
jne 0x4135cd
mov dword [0x440e34], ebp
call fcn.0041309f
mov edi, dword [0x440e2c]
pop ebx
test edi, edi
je 0x413649
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esi, dword [edi]
mov ecx, edi
call fcn.00430e28
mov edi, esi
test esi, esi
jne 0x413631
pop edi
pop esi
mov dword [0x440e2c], ebp
mov dword [0x440e3c], ebp
pop ebp
mov eax, dword [0x440e40]
add esp, 0x2d0
ret
Function at 0x414afe
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x458
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x46c]
mov esi, ecx
push 0x407964
mov edx, edi
lea ecx, [esp + 0x264]
call fcn.00419668
test eax, eax
jne 0x414b30
push 3
pop eax
jmp 0x414c70
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x264]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x414b4e
push 4
jmp 0x414b2a
xor ebx, ebx
lea ecx, [esp + 0x3c]
call fcn.0041ac8f
test al, al
jne 0x414c2c
mov ecx, dword [esi]
lea edx, [esp + 0x10]
mov eax, dword [ecx]
push edx
push edi
call dword [eax + 4]
test eax, eax
je 0x414b7a
cmp eax, 1
jmp 0x414c2a
test byte [esp + 0x10], 0x10
je 0x414c05
test byte [esi + 8], 2
je 0x414bac
lea eax, [esp + 0x3c]
push eax
mov ecx, esi
call fcn.00414cdd
test al, al
je 0x414bac
mov ecx, dword [esi]
lea edx, [esp + 0x10]
mov eax, dword [ecx]
push edx
push edi
call dword [eax + 8]
test eax, eax
jne 0x414b72
test byte [esi + 8], 1
je 0x414c2c
lea eax, [esp + 0x3c]
push eax
mov edx, edi
lea ecx, [esp + 0x264]
call fcn.00419668
test eax, eax
jne 0x414bce
push 3
pop ebx
jmp 0x414bed
lea eax, [esp + 0x260]
push eax
mov ecx, esi
call fcn.00414afe
mov ebx, eax
test ebx, ebx
je 0x414c2c
cmp ebx, 1
je 0x414c4b
cmp ebx, 2
je 0x414c4b
mov ecx, dword [esi]
push ebx
mov eax, dword [ecx]
lea edx, [esp + 0x14]
push edx
push edi
call dword [eax + 0xc]
cmp eax, 3
je 0x414bb2
jmp 0x414b72
test byte [esi + 8], 4
je 0x414c2c
lea eax, [esp + 0x3c]
push eax
mov ecx, esi
call fcn.00414cdd
test al, al
je 0x414c2c
mov ecx, dword [esi]
lea edx, [esp + 0x10]
mov eax, dword [ecx]
push edx
push edi
call dword [eax + 8]
test eax, eax
jne 0x414c42
lea eax, [esp + 0x10]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x414b50
jmp 0x414c4b
xor ebx, ebx
cmp eax, 2
setne bl
inc ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test ebx, ebx
jne 0x414c60
push 4
pop eax
cmp esi, 0x12
cmovne ebx, eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x458
ret 4
Function at 0x414eeb
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x2d0
lea eax, [ebp - 0x258]
push ebx
push esi
push eax
xor ebx, ebx
push ebx
push ebx
push 0x24
push ebx
mov esi, ecx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x414f46
push 0x10
push ebx
push esi
call dword [sym.imp.msvcrt.dll_memset]
add esp, 0xc
pop esi
mov al, bl
pop ebx
add ebp, 0x78
leave
ret
lea eax, [ebp - 0x258]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
lea eax, [ebp - 0x258]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x414f12
lea eax, [ebp - 0x258]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [ebp - 0x50]
push 0x64
push eax
lea eax, [ebp - 0x258]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
je 0x414f28
cmp word [ebp - 0x3c], 0x7b
jne 0x414f12
xor eax, eax
mov word [ebp + 0x10], ax
push esi
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
test eax, eax
jne 0x414f12
mov bl, 1
jmp 0x414f1f

Function at 0x414f8a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push esi
push edi
push 0x10
push ecx
lea eax, [ebp - 0x10]
push eax
mov esi, edx
call dword [sym.imp.msvcrt.dll_memcpy]
xor dword [ebp - 0x10], esi
xor word [ebp - 0xc], si
shr esi, 0x10
xor word [ebp - 0xa], si
add esp, 0xc
xor edx, edx
xor ecx, ecx
mov al, byte [ebp + ecx + 8]
xor byte [ebp + edx - 8], al
inc ecx
xor eax, eax
cmp ecx, 4
cmove ecx, eax
inc edx
cmp edx, 8
jb 0x414fb9
cmp dword [ebp + 0x10], eax
je 0x414ffa
push dword [ebp + 0x10]
and dword [ebp - 0x118], eax
lea ecx, [ebp - 0x118]
call fcn.0041ff15
lea eax, [ebp - 0x10]
push 0x10
push eax
lea ecx, [ebp - 0x118]
call fcn.0041ff75
movzx eax, byte [ebp + 0x14]
sub eax, 0
je 0x41502a
dec eax
je 0x415012
dec eax
jne 0x41502a
mov edx, 0x407968
push 7
jmp 0x415019
mov edx, 0x407978
push 6
mov esi, dword [ebp + 0xc]
pop edi
push edi
mov ecx, esi
call fcn.0043397c
lea eax, [esi + edi*2]
jmp 0x41502d
mov eax, dword [ebp + 0xc]
push 0x28
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
pop edi
pop esi
leave
ret 0x10
Function at 0x41524b
Capabilities:
Accept command line arguments
Get session user name
Identify system language via api

Disassembly:
sub esp, 0x25c
push ebx
push ebp
push esi
push edi
mov ebp, 0x104
push ebp
lea eax, [esp + 0x64]
push eax
xor ebx, ebx
push ebx
mov dword [esp + 0x48], ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, dword [sym.imp.msvcrt.dll_memset]
mov dword [esp + 0x14], eax
test eax, eax
je 0x41528f
lea ecx, [esp + 0x30]
push ecx
mov edx, eax
lea ecx, [esp + 0x64]
call fcn.004342b8
test al, al
jne 0x41529c
push 0xc
lea eax, [esp + 0x34]
push ebx
push eax
call edi
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, 0x103
lea ecx, [esp + 0x18]
cmp eax, edx
push ecx
cmovl edx, eax
mov ecx, esi
call fcn.004342b8
test al, al
jne 0x4152d2
push 0xc
lea eax, [esp + 0x1c]
push ebx
push eax
call edi
add esp, 0xc
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x64]
push eax
push 2
mov dword [esp + 0x20], ebp
call dword [sym.imp.Secur32.dll_GetUserNameExW]
test al, al
je 0x415302
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x64]
call fcn.004342b8
test al, al
jne 0x41530f
push 0xc
lea eax, [esp + 0x28]
push ebx
push eax
call edi
add esp, 0xc
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x4c]
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
jne 0x415333
mov esi, ebx
jmp 0x415355
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x44]
push ebx
add ecx, 0x2ac18000
push 0x989680
adc eax, 0xfe624e21
push eax
push ecx
call fcn.0043db50
mov esi, eax
mov edx, dword [esp + 0x20]
mov ebp, dword [esp + 0x38]
add edx, dword [esp + 0x2c]
add ebp, 0x12
add ebp, edx
je 0x4153f8
mov ecx, ebp
call fcn.00430dfe
mov ebx, eax
test ebx, ebx
je 0x4153f8
mov byte [ebx], 1
mov ecx, dword [0x440b88]
mov dword [ebx + 1], ecx
mov cl, byte [0x440b84]
lea edi, [ebx + 0x12]
mov byte [ebx + 5], cl
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov word [ebx + 6], ax
mov dword [ebx + 8], esi
mov ax, word [esp + 0x38]
mov esi, dword [sym.imp.msvcrt.dll_memcpy]
mov word [ebx + 0xc], ax
mov ax, word [esp + 0x20]
mov word [ebx + 0xe], ax
mov ax, word [esp + 0x2c]
mov word [ebx + 0x10], ax
movzx eax, word [ebx + 0xc]
push eax
push dword [esp + 0x34]
push edi
call esi
movzx eax, word [ebx + 0xc]
add edi, eax
movzx eax, word [ebx + 0xe]
add esp, 0xc
push eax
push dword [esp + 0x1c]
push edi
call esi
movzx eax, word [ebx + 0x10]
add esp, 0xc
push eax
movzx eax, word [ebx + 0xe]
push dword [esp + 0x28]
add eax, edi
push eax
call esi
add esp, 0xc
lea ecx, [esp + 0x30]
call fcn.0043429e
lea ecx, [esp + 0x18]
call fcn.0043429e
lea ecx, [esp + 0x24]
call fcn.0043429e
mov eax, dword [esp + 0x3c]
pop edi
pop esi
mov dword [eax], ebp
pop ebp
mov eax, ebx
pop ebx
add esp, 0x25c
ret
Function at 0x41596c
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
push ebx
push esi
push edi
push 0x10
mov edi, ecx
push 0
push edi
call dword [sym.imp.msvcrt.dll_memset]
add esp, 0xc
lea eax, [ebp - 0x58]
push eax
mov byte [edi], 1
mov dword [ebp - 0x58], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x4159c0
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x4c]
shrd ecx, eax, 0x14
shr eax, 0x14
test eax, eax
jne 0x4159b8
cmp ecx, 0xffffffff
ja 0x4159b8
mov dword [ebp - 0xc], eax
jmp 0x4159bd
xor ecx, ecx
and dword [ebp - 0xc], ecx
mov dword [edi + 1], ecx
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [ebp - 0x24]
xor edx, edx
movzx ecx, ax
cmp eax, 0xffff
cmova ecx, edx
mov word [edi + 5], cx
lea edx, [ebp - 0x70]
mov ecx, 0xb6
call fcn.0041c8a9
lea edx, [ebp - 0x10]
mov ecx, 0xb7
call fcn.0041c8a9
lea eax, [ebp - 0x10]
lea edx, [ebp - 0x70]
push eax
call fcn.0040cea9
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x50
mov dword [edi + 7], eax
call esi
mov byte [edi + 0xb], al
push 0x4e
call esi
mov ebx, eax
push 0x4f
call esi
lea ecx, [ebx - 1]
mov edx, 0xfffd
cmp ecx, edx
ja 0x415a39
lea ecx, [eax - 1]
cmp ecx, edx
ja 0x415a39
mov word [edi + 0xc], bx
mov word [edi + 0xe], ax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x417371
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
call fcn.00417345
push eax
push 0
push dword [ebp + 8]
mov dword [ebp - 4], eax
call dword [sym.imp.msvcrt.dll_memset]
add esp, 0xc
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_getsockname]
neg eax
sbb eax, eax
inc eax
pop esi
leave
ret 4

Function at 0x4173f9
Capabilities:
Connect socket

Disassembly:
sub esp, 0x2c
push esi
push edi
mov esi, ecx
call fcn.0041707e
test al, al
je 0x417445
push 0x33
mov ecx, esi
call fcn.004171d4
test al, al
je 0x417445
mov ecx, dword [esp + 0x38]
movzx edx, word [ecx]
cmp edx, 2
jne 0x417427
push 0x10
pop eax
jmp 0x417432
xor eax, eax
push 0x1c
pop edi
cmp edx, 0x17
cmove eax, edi
push eax
push ecx
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x417445
mov al, 1
jmp 0x4174a8
push ebp
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, dword [sym.imp.WS2_32.dll_WSASetLastError]
mov ebp, eax
cmp ebp, 0x2733
je 0x417466
mov ecx, esi
call fcn.00417225
push ebp
call edi
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
pop ebp
cmp eax, 0x2733
jne 0x4174a6
jmp 0x41747d
test byte [esp + 8], 0x10
jne 0x417499
push dword [esp + 0x40]
mov eax, dword [esi]
push dword [esp + 0x40]
lea ecx, [esp + 0x10]
push ecx
push 0x10
mov ecx, esi
call dword [eax + 0x18]
test eax, eax
je 0x417476
jmp 0x4174a6
cmp dword [esp + 0x1c], 0
je 0x417441
push dword [esp + 0x1c]
call edi
xor al, al
pop edi
pop esi
add esp, 0x2c
ret 0xc

Function at 0x4176b2
Capabilities:
Receive data
Receive data on socket

Disassembly:
push 0
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [ecx + 4]
call dword [sym.imp.WS2_32.dll_recv]
ret 8

Function at 0x41779b
Capabilities:
Send data
Send data on socket

Disassembly:
push 0
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [ecx + 4]
call dword [sym.imp.WS2_32.dll_send]
ret 8
Function at 0x417f12
Capabilities:
Send data
Send http request

Disassembly:
sub esp, 0x118
mov eax, 0x844cff00
push ebx
mov ebx, dword [esp + 0x138]
push esi
push edi
and ebx, 2
mov edi, 0x840cff00
cmovne edi, eax
test byte [esp + 0x140], 4
mov esi, ecx
je 0x417f44
or edi, 0x800000
call fcn.00417efa
test byte [esp + 0x140], 1
push 0
push edi
push 0x4403c0
push dword [esp + 0x138]
mov ecx, 0x4079f8
push 0x4079fc
push dword [esp + 0x13c]
mov eax, 0x4079f0
cmove eax, ecx
push eax
push dword [esi + 4]
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov dword [esi + 8], eax
test eax, eax
jne 0x417f91
xor al, al
jmp 0x4180ac
push ebp
push 4
lea ecx, [esp + 0x14]
push ecx
push 0x4d
push eax
mov dword [esp + 0x20], 1
call dword [sym.imp.WININET.dll_InternetSetOptionA]
call fcn.0042f837
mov edi, dword [sym.imp.WININET.dll_HttpAddRequestHeadersA]
mov ebp, 0xa0000000
cmp al, 4
jne 0x417fc7
call fcn.0042f87b
test al, al
je 0x418045
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x29]
push eax
mov dword [esp + 0x18], 0x100
call dword [sym.imp.SHLWAPI.dll_GetAcceptLanguagesA]
test eax, eax
jne 0x418045
mov eax, 0xff
cmp dword [esp + 0x10], eax
cmovb eax, dword [esp + 0x10]
mov byte [esp + eax + 0x25], 0
lea eax, [esp + 0x25]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [esp + 0x10], eax
test eax, eax
je 0x418045
push 0x11
lea eax, [esp + 0x18]
push 0x407a08
push eax
call dword [sym.imp.msvcrt.dll_memcpy]
mov eax, dword [esp + 0x1c]
add esp, 0xc
lea eax, [esp + eax + 0x25]
push 0x407848
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [esp + 0x10]
push ebp
add eax, 0x13
push eax
lea eax, [esp + 0x1c]
push eax
push dword [esi + 8]
call edi
cmp dword [esp + 0x134], 0
je 0x418068
push ebp
push dword [esp + 0x13c]
push dword [esp + 0x13c]
push dword [esi + 8]
call edi
cmp eax, 1
jne 0x4180a2
test ebx, ebx
jne 0x41807e
push ebp
push 0x13
push 0x407a1c
push dword [esi + 8]
call edi
cmp eax, 1
jne 0x4180a2
push dword [esp + 0x140]
push dword [esp + 0x140]
push 0
push 0
push dword [esi + 8]
call dword [sym.imp.WININET.dll_HttpSendRequestA]
cmp eax, 1
jne 0x4180a2
mov al, al
jmp 0x4180ab
mov ecx, esi
call fcn.00417efa
xor al, al
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x118
ret 0x1c