joyce8/EMBER2024-capa huggingface dataset:
Function at 0x465020
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ed0a8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x65bf90]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea edi, [esi + 0x3c]
push edi
mov dword [ebp - 0x10], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
test ebx, ebx
jne 0x4650a0
mov eax, dword [esi + 0x34]
test eax, eax
je 0x4650a0
mov edx, dword [ebp + 0xc]
mov ecx, dword [eax]
push edx
mov edx, dword [ebp + 8]
push edx
push eax
mov eax, dword [ecx + 0xc]
call eax
mov edi, eax
test edi, edi
je 0x46509d
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov edi, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
test eax, eax
je 0x4650b4
mov edx, dword [eax]
mov dword [esi + ebx*8 + 0x10], edx
mov eax, dword [eax + 4]
mov dword [esi + ebx*8 + 0x14], eax
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4650c8
mov ecx, dword [eax]
mov dword [esi + ebx*8 + 0x20], ecx
mov edx, dword [eax + 4]
mov dword [esi + ebx*8 + 0x24], edx
cmp byte [esi + 0x38], 0
je 0x4650dc
mov eax, dword [esi + 0x18]
add eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x1c]
adc ecx, dword [esi + 0x14]
jmp 0x4650e8
mov eax, dword [esi + 0x28]
add eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x2c]
adc ecx, dword [esi + 0x24]
mov edx, dword [esi + 8]
add edx, eax
mov eax, dword [esi + 0xc]
mov esi, dword [esi + 0x30]
adc eax, ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], eax
mov ecx, dword [esi]
mov eax, dword [ecx + 0x10]
lea edx, [ebp - 0x18]
push edx
push esi
call eax
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x46ab20
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x14]
mov ebx, dword [esi + 8]
push edi
xor edi, edi
push eax
lea edx, [esi + 0x40]
mov dword [ebp - 4], ebx
mov dword [ebp - 8], edi
mov dword [esi + 0x38], edi
call fcn.0046a510
add esp, 4
cmp ebx, edi
jbe 0x46ab6b
add esi, 0x270
call fcn.0046a610
test eax, eax
jne 0x46ad2a
inc edi
add esi, 0x44
cmp edi, ebx
jb 0x46ab53
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc], 0
test ebx, ebx
je 0x46ac25
add esi, 0x29c
cmp dword [esi - 0x14], 0
lea edi, [esi - 0x14]
jne 0x46ac13
push 0
push 0
push 0
lea ecx, [esi - 0x2c]
push 0
mov dword [esi - 4], 0x46a8c0
mov dword [esi], ecx
mov dword [esi - 8], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi - 0x10], eax
test eax, eax
jne 0x46abca
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x46accd
mov eax, 1
jmp 0x46ac0b
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi - 0xc], eax
test eax, eax
je 0x46abb5
lea edx, [ebp - 0x10]
push edx
push 0
push edi
push 0x46a4a0
push 0
push 0
call fcn.005c2584
add esp, 0x18
mov dword [edi], eax
test eax, eax
jne 0x46ac13
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x46accd
test eax, eax
jne 0x46accd
mov eax, dword [ebp - 0xc]
inc eax
add esi, 0x44
mov dword [ebp - 0xc], eax
cmp eax, ebx
jb 0x46ab80
xor edi, edi
test ebx, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetEvent]
je 0x46ac56
mov esi, dword [ebp + 8]
add esi, 0x28c
lea ebx, [ebx]
mov eax, dword [esi]
push eax
call ebx
test eax, eax
je 0x46acd6
inc edi
add esi, 0x44
cmp edi, dword [ebp - 4]
jb 0x46ac40
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x2b0]
push ecx
call ebx
test eax, eax
jne 0x46ac6c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esi + 0x2ac]
push edx
call ebx
test eax, eax
jne 0x46ac7f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test edi, edi
je 0x46ac9f
mov esi, dword [ebp + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add esi, 0x290
mov eax, dword [esi]
push 0xffffffffffffffff
push eax
call ebx
add esi, 0x44
dec edi
jne 0x46ac92
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x46ad1d
mov esi, dword [ebp + 8]
mov edi, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esi, 0x2b0
mov eax, dword [esi - 4]
test eax, eax
je 0x46acf5
push eax
call ebx
test eax, eax
jne 0x46acf5
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x46acfc
mov dword [ebp - 8], 0xc
jmp 0x46aca2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp + 8]
mov dword [ebp - 8], 0xc
mov dword [esi + 0x2a4], 1
jmp 0x46ac59
mov dword [esi - 4], 0
mov eax, dword [esi]
test eax, eax
je 0x46ad11
push eax
call ebx
test eax, eax
jne 0x46ad11
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x46ad17
mov dword [esi], 0
add esi, 0x44
dec edi
jne 0x46acb7
mov eax, dword [ebp - 8]
test eax, eax
jne 0x46ad2a
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x38]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x471b50
Capabilities:
Hash data using sha256

Disassembly:
xor ecx, ecx
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
ret

Function at 0x472680
Capabilities:
Hash data using sha256

Disassembly:
push ebx
push edi
mov edi, dword [esi + 0x20]
and edi, 0x3f
mov byte [edi + esi + 0x28], 0x80
inc edi
mov ebx, eax
cmp edi, 0x38
je 0x4726ae
and edi, 0x3f
jne 0x4726a3
push esi
call fcn.00471b90
add esp, 4
mov byte [esi + edi + 0x28], 0
inc edi
cmp edi, 0x38
jne 0x472695
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x24]
shld ecx, eax, 3
add eax, eax
add eax, eax
add eax, eax
bswap ecx
bswap eax
push esi
mov dword [esi + 0x60], ecx
mov dword [esi + 0x64], eax
call fcn.00471b90
add esp, 4
xor edx, edx
xor eax, eax
mov ecx, dword [esi + eax*4 + 4]
mov edi, dword [esi + eax*4]
bswap edi
bswap ecx
mov dword [ebx], edi
mov dword [ebx + 4], ecx
add eax, 2
add ebx, 8
cmp eax, 8
jb 0x4726d5
pop edi
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov dword [esi + 0x20], edx
mov dword [esi + 0x24], edx
pop ebx
ret
Function at 0x475140
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ef748
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x65bf90]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
or edi, 0xffffffff
cmp eax, edi
je 0x475187
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x47520a
mov dword [esi + 0x10], edi
mov eax, dword [esi + 0x18]
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], edi
cmp eax, ecx
je 0x4751cc
mov ecx, dword [esi + 0x14]
mov ebx, dword [ebp + 0xc]
call fcn.00440e50
test eax, eax
jne 0x47520f
mov eax, dword [esi + 0x18]
mov edx, dword [esi + 0x14]
push 0x66b9a0
push eax
mov ecx, edi
call dword [0x66d9a0]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0
cmp byte [esi + 0x2c], 0
je 0x4752bc
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov eax, dword [esi + 4]
push 1
push SysReAllocString
mov edi, 3
lea esi, [ebp - 0x10]
call fcn.00418390
test al, al
jne 0x475223
mov eax, dword [ebp - 0x10]
cmp eax, 0xffffffff
je 0x47520a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x80004005
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov esi, dword [ebp + 8]
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [esi + 0x24]
ja 0x4752ad
jb 0x475238
mov edx, dword [ebp - 0x20]
cmp edx, dword [esi + 0x20]
jae 0x4752ad
mov eax, dword [esi + 0x14]
mov edx, dword [ebp - 0x10]
push 0
lea ecx, [ebp - 0x18]
push ecx
push 0x100000
push eax
push edx
mov dword [ebp - 0x18], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4752f6
mov edi, dword [ebp - 0x18]
test edi, edi
je 0x4752ad
mov ecx, dword [esi + 0x14]
mov ebx, dword [ebp + 0xc]
mov eax, edi
call fcn.00440e50
mov ebx, eax
test ebx, ebx
jne 0x475303
mov edx, dword [esi + 0x14]
mov ecx, dword [ebp - 0x14]
push 0x66b9a0
push edi
call dword [0x66d9a0]
add dword [ebp - 0x20], edi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x1c]
adc eax, ebx
mov dword [ebp - 0x1c], eax
cmp eax, dword [esi + 0x24]
jb 0x475238
ja 0x4752ad
mov eax, dword [ebp - 0x20]
cmp eax, dword [esi + 0x20]
jb 0x475238
mov eax, dword [ebp - 0x10]
cmp eax, 0xffffffff
je 0x4752bc
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x14]
cmp dword [esi + 0x28], ecx
jne 0x47520a
mov edx, dword [ebp - 0x20]
cmp edx, dword [esi + 0x20]
jne 0x47520a
mov eax, dword [ebp - 0x1c]
cmp eax, dword [esi + 0x24]
jne 0x47520a
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea esi, [ebp - 0x10]
call fcn.004187a0
jmp 0x47520a
lea esi, [ebp - 0x10]
call fcn.004187a0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4764b0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ecda3
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x65bf90]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor eax, eax
or ecx, 0xffffffff
mov dword [ebx + 8], ecx
mov dword [ebx + 4], ecx
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x20], 0x6686e4
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], eax
mov dword [ebx + 0x24], eax
mov dword [ebx + 0x28], eax
mov dword [ebp - 4], eax
lea edi, [ebx + 0x34]
mov dword [ebx], vtable.TiXmlDocument.0
mov dword [edi], 0x6686e4
mov byte [ebp - 4], 1
mov dword [ebx + 0x40], ecx
mov dword [ebx + 0x3c], ecx
push 0x627ca0
xor esi, esi
mov dword [ebx + 0x38], 4
mov byte [ebx + 0x44], al
mov byte [ebx + 0x2c], al
mov dword [ebx + 0x30], eax
call fcn.00479330
xor eax, eax
mov dword [ebx + 0x40], eax
mov dword [ebx + 0x3c], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x476680
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x4766d7
cmp byte [ebx + 0x2c], 0
jne 0x4766cd
mov byte [ebx + 0x2c], 1
mov dword [ebx + 0x30], 2
mov edx, dword [0x65ddc0]
mov eax, edx
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4766b0
sub eax, esi
push edx
lea edi, [ebx + 0x34]
mov esi, eax
call fcn.00479330
or eax, 0xffffffff
mov dword [ebx + 0x40], eax
mov dword [ebx + 0x3c], eax
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
mov esi, dword [ebx + 0x18]
test esi, esi
je 0x4766f1
mov edi, edi
mov ecx, esi
mov eax, dword [ecx]
mov edx, dword [eax]
mov esi, dword [esi + 0x28]
push 1
call edx
test esi, esi
jne 0x4766e0
xor ecx, ecx
push 2
or eax, 0xffffffff
push ecx
mov dword [ebx + 0x18], ecx
mov dword [ebx + 0x1c], ecx
push edi
mov dword [ebx + 8], eax
mov dword [ebx + 4], eax
call fcn.005c47a5
push edi
call fcn.005c52cb
push 0
mov esi, eax
push 0
push edi
mov dword [ebp - 4], esi
call fcn.005c47a5
add esp, 0x1c
test esi, esi
jg 0x47674f
cmp byte [ebx + 0x2c], 0
jne 0x4766cd
mov byte [ebx + 0x2c], 1
mov dword [ebx + 0x30], 0xc
mov edx, dword [0x65dde8]
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x476743
jmp 0x4766b7
lea eax, [esi + 1]
push eax
call fcn.004ba280
mov ecx, dword [ebp + 8]
push ecx
push 1
mov edi, eax
push esi
push edi
mov byte [edi], 0
call fcn.005c2fa7
add esp, 0x14
cmp eax, 1
je 0x4767ac
push edi
call fcn.004ba2af
add esp, 4
cmp byte [ebx + 0x2c], 0
jne 0x4766cd
mov byte [ebx + 0x2c], 1
mov dword [ebx + 0x30], 2
mov edx, dword [0x65ddc0]
mov eax, edx
lea esi, [eax + 1]
jmp 0x4767a0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4767a0
jmp 0x4766b7
mov edx, dword [ebp - 4]
mov byte [edi + edx], 0
cmp byte [edi], 0
mov eax, edi
mov esi, edi
je 0x4767dc
lea esp, [esp]
mov cl, byte [eax]
cmp cl, 0xd
jne 0x4767d3
mov byte [esi], 0xa
inc eax
inc esi
cmp byte [eax], 0xa
jne 0x4767d7
jmp 0x4767d6
mov byte [esi], cl
inc esi
inc eax
cmp byte [eax], 0
jne 0x4767c0
push 0
mov byte [esi], 0
mov eax, dword [ebx]
mov edx, dword [eax + 8]
push 0
push edi
mov ecx, ebx
call edx
push edi
call fcn.004ba2af
add esp, 4
xor eax, eax
cmp byte [ebx + 0x2c], al
pop edi
sete al
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x479460
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ef718
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x65bf90]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x224], 0
push 0x105
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x224]
push ecx
lea edx, [ebp - 0x22c]
push edx
lea eax, [ebp - 0x228]
push eax
push 0x105
lea ecx, [ebp - 0x220]
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
lea eax, [ebp - 0x118]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4794f0
sub eax, edx
push eax
lea eax, [ebp - 0x118]
push eax
mov ecx, esi
call fcn.004022cd
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47952e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005bdb17
mov esp, ebp
pop ebp
ret
Function at 0x47a960
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
lea esi, [eax - 1]
push edi
test esi, esi
jle 0x47a99c
mov ebx, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
lea esp, [esp]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push 0
push eax
push ecx
call ebx
test eax, eax
jne 0x47a9a3
push 0x3e8
call edi
dec esi
test esi, esi
jg 0x47a980
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret

Function at 0x47a9b0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, 4
mov eax, dword [ebp + 8]
push eax
call ebx
test eax, eax
jne 0x47a9e4
push 0x3e8
call edi
dec esi
test esi, esi
jg 0x47a9c7
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret

Function at 0x47b0d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, 0x10
push edi
mov edi, ecx
cmp dword [eax + 0x14], ebx
jb 0x47b0e5
mov eax, dword [eax]
push eax
movzx eax, word [ebp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x47b102
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x47b0f9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x47b0f9
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp + 8], esi
cmp dword [edi + 0x14], ebx
jb 0x47b134
mov eax, dword [edi]
jmp 0x47b136
mov eax, edi
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x47b0f9
push 0
push esi
push 0
push 4
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
test edi, edi
je 0x47b0f9
push 0
push 0
push 0
push 2
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 4]
push ecx
mov esi, eax
push edx
push esi
call fcn.005c27a0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call esi
push ebx
call esi
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47b720
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
push edi
lea eax, [ebp - 4]
push eax
push 0
mov dword [ebp - 4], 0
call esi
mov ecx, dword [ebp - 4]
push ecx
call fcn.005c242b
add esp, 4
lea edx, [ebp - 4]
mov edi, eax
push edx
push edi
call esi
xor eax, eax
test edi, edi
je 0x47b7e6
lea ebx, [ebx]
xor esi, esi
cmp dword [edi + 0x190], esi
jle 0x47b7d1
lea ebx, [ebx]
movzx edx, byte [edi + esi + 0x194]
mov ecx, edx
shr ecx, 4
and edx, reloc.OLEAUT32.dll_SafeArrayDestroy
jns 0x47b78a
dec edx
or edx, 0xfffffff0
inc edx
cmp ecx, 0xa
jge 0x47b794
add ecx, 0x30
jmp 0x47b797
add ecx, 0x37
mov byte [eax + ebx], cl
cmp edx, 0xa
jge 0x47b7a4
add edx, 0x30
jmp 0x47b7a7
add edx, 0x37
mov byte [eax + ebx + 1], dl
mov ecx, dword [edi + 0x190]
dec ecx
cmp esi, ecx
jge 0x47b7c9
mov byte [eax + ebx + 2], 0x3a
inc esi
add eax, 3
cmp esi, dword [edi + 0x190]
jl 0x47b770
jmp 0x47b7d1
mov byte [eax + ebx + 2], 0
add eax, 3
mov edi, dword [edi]
test edi, edi
jne 0x47b760
test eax, eax
jle 0x47b7e6
dec eax
pop edi
mov byte [eax + ebx], 0
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov byte [ebx], 0
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x47c6f0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
mov eax, dword [0x65bf90]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
mov eax, ecx
push edi
mov dword [ebp - 0xb4], ebx
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0xac], ebx
mov dword [ebp - 0xa8], 0x67452301
mov dword [ebp - 0xa4], 0xefcdab89
mov dword [ebp - 0xa0], 0x98badcfe
mov dword [ebp - 0x9c], 0x10325476
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x47c746
sub eax, edi
push ecx
lea ebx, [ebp - 0xb0]
call fcn.0047bd40
lea eax, [ebp - 0x14]
push eax
mov ecx, ebx
call fcn.0047bdf0
add esp, 8
lea ebx, [ebp - 0x58]
xor edi, edi
mov edi, edi
movzx ecx, byte [ebp + edi - 0x14]
push ecx
push 0x62e604
push ebx
call fcn.005be0c1
inc edi
add esp, 0xc
add ebx, 2
cmp edi, 0x10
jl 0x47c770
lea eax, [ebp - 0x58]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x47c7a4
sub eax, edx
mov edi, eax
mov eax, dword [esi + 0x14]
mov ebx, 0x10
cmp eax, ebx
jb 0x47c7bf
mov ecx, dword [esi]
jmp 0x47c7c1
mov ecx, esi
lea edx, [ebp - 0x58]
cmp edx, ecx
jb 0x47c827
cmp eax, ebx
jb 0x47c7d0
mov ecx, dword [esi]
jmp 0x47c7d2
mov ecx, esi
mov edx, dword [esi + 0x10]
add edx, ecx
lea ecx, [ebp - 0x58]
cmp edx, ecx
jbe 0x47c827
cmp eax, ebx
jb 0x47c804
mov eax, dword [esi]
mov edx, ecx
push edi
sub edx, eax
push edx
push esi
mov ecx, esi
call fcn.004025f3
mov eax, esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005bdb17
mov esp, ebp
pop ebp
ret
mov eax, esi
push edi
lea edx, [ebp - 0x58]
sub edx, eax
push edx
push esi
mov ecx, esi
call fcn.004025f3
mov eax, esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005bdb17
mov esp, ebp
pop ebp
ret
cmp edi, 0xfffffffe
jbe 0x47c836
push 0x627c04
call fcn.005de715
cmp eax, edi
jae 0x47c848
mov eax, dword [esi + 0x10]
push eax
push edi
mov ecx, esi
call fcn.004024a0
jmp 0x47c85c
test edi, edi
jne 0x47c85e
mov dword [esi + 0x10], edi
cmp eax, ebx
jb 0x47c857
mov eax, dword [esi]
jmp 0x47c859
mov eax, esi
mov byte [eax], 0
test edi, edi
setne al
test al, al
je 0x47c890
cmp dword [esi + 0x14], ebx
jb 0x47c86e
mov eax, dword [esi]
jmp 0x47c870
mov eax, esi
push edi
lea ecx, [ebp - 0x58]
push ecx
push eax
call fcn.005c27a0
add esp, 0xc
mov dword [esi + 0x10], edi
cmp dword [esi + 0x14], ebx
jb 0x47c88a
mov eax, dword [esi]
jmp 0x47c88c
mov eax, esi
mov byte [eax + edi], 0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, esi
pop ebx
call fcn.005bdb17
mov esp, ebp
pop ebp
ret
Function at 0x47d210
Capabilities:
Hash data with md5
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x65bf90]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push 0x62e02c
push eax
mov esi, ecx
call fcn.005c21f4
mov ebx, eax
xor eax, eax
add esp, 8
cmp ebx, eax
jne 0x47d250
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005bdb17
mov esp, ebp
pop ebp
ret
mov dword [esi + 4], eax
mov dword [esi], eax
mov dword [esi + 8], 0x67452301
mov dword [esi + 0xc], 0xefcdab89
mov dword [esi + 0x10], 0x98badcfe
mov dword [esi + 0x14], 0x10325476
mov dword [ebp - 0x808], eax
push edi
jmp 0x47d280
push ebx
push 0x800
lea eax, [ebp - 0x804]
push 1
push eax
call fcn.005c2fa7
mov edi, eax
add dword [ebp - 0x808], edi
lea ecx, [ebp - 0x804]
push ecx
mov ecx, edi
call fcn.0047cfb0
add esp, 0x14
cmp edi, 0x800
jge 0x47d280
push ebx
call fcn.005c0853
add esp, 4
mov ecx, esi
call fcn.0047d0e0
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x808]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005bdb17
mov esp, ebp
pop ebp
ret

Function at 0x4804a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5ef6b8
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x65bf90]
xor eax, esp
mov dword [esp + 0x2c], eax
mov eax, dword [0x65bf90]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
lea ecx, [esp + 8]
call fcn.005bdb26
xor eax, eax
push 0xffffffffffffffff
mov dword [esp + 0x44], eax
push eax
push esi
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], vtable.Json::Exception.0
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], eax
mov byte [esp + 0x20], al
call fcn.004025f3
push 0x64b208
lea eax, [esp + 0xc]
mov dword [esp + 0x44], 0xffffffff
push eax
mov dword [esp + 0x10], vtable.Json::RuntimeError.0
call fcn.005c75bb
int3