joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dd6b0
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x80
push ebx
push ebp
mov ebp, dword [esp + 0x8c]
push esi
push eax
push ebp
mov esi, dword [ebp + eax*4 + 0x1a4]
call fcn.004ddb60
add esp, 8
push 0
push dword [esp + 0xa0]
push dword [esp + 0xa0]
push esi
call dword [sym.imp.WS2_32.dll_send]
mov ebx, dword [esp + 0xa0]
mov esi, eax
mov dword [ebx], 0
cmp esi, 0xffffffff
jne 0x4dd757
push edi
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp edi, 0x2733
jne 0x4dd724
pop edi
pop esi
pop ebp
mov dword [ebx], 0x51
xor eax, eax
pop ebx
add esp, 0x80
ret
push pe_nt_image_headers32
lea eax, [esp + 0x14]
push eax
push edi
call fcn.004f7470
push eax
push str.Send_failure:__s
push dword [ebp]
call fcn.004dd360
mov eax, dword [ebp]
add esp, 0x18
mov dword [eax + 0xc54], edi
mov eax, esi
mov dword [ebx], 0x37
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x80
ret

Function at 0x4ddb60
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov ecx, dword [esp + 8]
mov eax, ecx
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
shl eax, 4
mov ebp, dword [ebx + ecx*4 + 0x1a4]
lea esi, [ebx + 0x1c8]
add esi, eax
mov eax, dword [ebx + 0x2c0]
push edi
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [eax + 0x40], 3
je 0x4ddc16
cmp dword [ebx + ecx*4 + 0x1b8], 0x4dd5e0
jne 0x4ddc16
cmp dword [esi], 0
je 0x4ddbac
test edi, edi
je 0x4ddc16
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebp
call fcn.004e5670
add esp, 0x10
cmp eax, 0xffffffff
je 0x4ddc16
test al, 1
je 0x4ddc16
cmp dword [esi], 0
jne 0x4ddbff
mov eax, dword [ebx]
mov eax, dword [eax + 0x8d0]
add eax, eax
push eax
mov dword [esi + 4], eax
call dword [0x1de85c8]
mov edi, dword [esi + 4]
add esp, 4
mov dword [esi], eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
test eax, eax
jne 0x4ddbff
pop edi
mov dword [esi + 4], eax
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esi]
add eax, dword [esi + 8]
push 0
push edi
push eax
push ebp
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x4ddc16
add dword [esi + 8], eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4e44d0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x188
push ebx
mov ebx, dword [esp + 0x190]
cmp dword [ebx + 0x90], 3
jne 0x4e46a8
cmp byte [ebx + 0x289], 0
push ebp
push esi
push edi
jne 0x4e469c
cmp byte [ebx + 0x2a1], 0
jne 0x4e469c
mov esi, dword [esp + 0x1a0]
lea eax, [esp + 0x10]
mov ebp, dword [ebx]
push eax
lea eax, [esp + 0x11c]
mov dword [esp + 0x14], pe_nt_image_headers32
push eax
push esi
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x4e4564
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
lea eax, [esp + 0x18]
push pe_nt_image_headers32
push eax
push esi
call fcn.004f7470
push eax
push esi
push str.getpeername___failed_with_errno__d:__s
push ebp
call fcn.004dd360
add esp, 0x1c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x188
ret
push pe_nt_image_headers32
lea eax, [esp + 0x9c]
mov dword [esp + 0x18], pe_nt_image_headers32
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x9c]
push eax
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x4e45ce
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
lea eax, [esp + 0x18]
push pe_nt_image_headers32
push eax
push esi
call fcn.004f7470
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
push ebp
call fcn.004dd360
add esp, 0x1c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x188
ret
lea eax, [ebx + 0x138]
push eax
lea esi, [ebx + 0x10a]
push esi
push dword [esp + 0x18]
lea eax, [esp + 0x124]
push eax
call fcn.004e38f0
add esp, 0x10
test al, al
jne 0x4e462f
mov esi, dword [sym.imp.MSVCRT.dll__errno]
call esi
mov edi, eax
call esi
mov esi, eax
lea eax, [esp + 0x18]
push pe_nt_image_headers32
push eax
push dword [edi]
call fcn.004f7470
push eax
push dword [esi]
push str.ssrem_inet_ntop___failed_with_errno__d:__s
push ebp
call fcn.004dd360
add esp, 0x1c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x188
ret
lea edi, [ebx + 0x5c]
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
lea eax, [ebx + 0x16c]
push eax
lea eax, [ebx + 0x13c]
push eax
push dword [esp + 0x1c]
lea eax, [esp + 0xa4]
movsw word es:[edi], word [esi]
push eax
call fcn.004e38f0
add esp, 0x10
test al, al
jne 0x4e469c
mov esi, dword [sym.imp.MSVCRT.dll__errno]
call esi
mov edi, eax
call esi
mov esi, eax
lea eax, [esp + 0x18]
push pe_nt_image_headers32
push eax
push dword [edi]
call fcn.004f7470
push eax
push dword [esi]
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebp
call fcn.004dd360
add esp, 0x1c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x188
ret
push ebx
call fcn.004e41b0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x188
ret
Function at 0x4e5000
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x18]
xor eax, eax
push edi
mov edi, dword [esp + 0x20]
push 4
cmp byte [esi + 0xa9f], al
setne al
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
push eax
push 8
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x4e504a
push edi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
push esi
call fcn.004dd420
add esp, 0xc
pop edi
pop esi
add esp, 0x10
ret
push dword [esi + 0xa3c]
mov dword [esp + 0x10], 1
call fcn.004e3870
push dword [esi + 0xa40]
imul eax, eax, 0x3e8
mov dword [esp + 0x24], eax
mov dword [esp + 0x18], eax
call fcn.004e3870
add esp, 8
imul eax, eax, 0x3e8
push 0
push 0
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0xc
lea eax, [esp + 0x24]
push eax
push 0x98000004
push edi
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x4e50c1
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
push esi
call fcn.004dd420
add esp, 0x10
pop edi
pop esi
add esp, 0x10
ret

Function at 0x4e50d0
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x84
mov eax, dword [esp + 0x88]
push esi
push 4
mov dword [esp + 8], 1
mov esi, dword [eax]
lea eax, [esp + 8]
push eax
push 1
push 6
push dword [esp + 0xa0]
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x4e5131
push pe_nt_image_headers32
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.004f7470
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.004dd420
add esp, 0x18
pop esi
add esp, 0x84
ret
push str.TCP_NODELAY_set_n
push esi
call fcn.004dd420
add esp, 8
pop esi
add esp, 0x84
ret
Function at 0x4efe60
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x1000
call fcn.004405c0
push dword [esp + 0x1004]
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
mov byte [esp], 0
test eax, eax
je 0x4efead
push 0x1000
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [esp], 0
je 0x4efead
lea eax, [esp]
push eax
call dword [0x1de85d4]
add esp, 4
add esp, 0x1000
ret
xor eax, eax
add esp, 0x1000
ret
Function at 0x4f6950
Capabilities:
Resolve dns

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x1c]
push ebp
xor ebp, ebp
mov dword [esp + 4], ebp
mov dword [eax], ebp
lea eax, [esp + 8]
push eax
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [esp + 0xc], eax
test eax, eax
jne 0x4f6ae3
push ebx
push edi
mov edi, dword [esp + 0x10]
test edi, edi
je 0x4f6acd
push esi
mov eax, dword [edi + 4]
cmp eax, 2
jne 0x4f699f
lea ebx, [eax + 0xe]
jmp 0x4f69ab
cmp eax, 0x17
jne 0x4f6a5a
lea ebx, [eax + 5]
cmp dword [edi + 0x18], 0
je 0x4f6a5a
mov eax, dword [edi + 0x10]
test eax, eax
je 0x4f6a5a
cmp eax, ebx
jb 0x4f6a5a
push 0x20
call dword [0x1de85c8]
mov esi, eax
add esp, 4
test esi, esi
je 0x4f6ac2
mov eax, dword [edi]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
push ebx
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x1c], 0
call dword [0x1de85c8]
add esp, 4
mov dword [esi + 0x18], eax
test eax, eax
je 0x4f6ab1
push ebx
push dword [edi + 0x18]
push eax
call sub.MSVCRT.dll_memcpy
mov eax, dword [edi + 0x14]
add esp, 0xc
test eax, eax
je 0x4f6a45
push eax
call dword [0x1de85d4]
add esp, 4
mov dword [esi + 0x14], eax
test eax, eax
je 0x4f6a97
test ebp, ebp
jne 0x4f6a4b
mov ebp, esi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4f6a56
mov dword [eax + 0x1c], esi
mov dword [esp + 0x10], esi
mov edi, dword [edi + 0x1c]
test edi, edi
jne 0x4f6992
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
pop esi
test eax, eax
je 0x4f6a79
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
test ebx, ebx
je 0x4f6ac9
push ebp
call fcn.004f6910
mov eax, dword [esp + 0x2c]
add esp, 4
xor ebp, ebp
mov dword [eax], ebp
mov eax, ebx
pop edi
pop ebx
pop ebp
add esp, 0xc
ret
push dword [esi + 0x18]
mov ebx, 8
call dword [0x1de85cc]
push esi
call dword [0x1de85cc]
add esp, 8
jmp 0x4f6a69
push esi
mov ebx, 8
call dword [0x1de85cc]
add esp, 4
jmp 0x4f6a69
mov ebx, 8
jmp 0x4f6a69
test ebp, ebp
jne 0x4f6ad9
mov ebx, 0x2af9
push ebx
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [esp + 0x28]
pop edi
mov dword [eax], ebp
mov eax, ebx
pop ebx
pop ebp
add esp, 0xc
ret
Function at 0x4fb120
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information
Receive data
Receive data on socket
Send data
Send data on socket
Set socket configuration
Start tcp server

Disassembly:
sub esp, 0x30
push esi
mov esi, dword [sym.imp.WS2_32.dll_socket]
push edi
push 6
push 1
push 2
mov dword [esp + 0x18], 0x10
mov dword [esp + 0x14], 1
call esi
mov edi, eax
cmp edi, 0xffffffff
jne 0x4fb152
pop edi
or eax, eax
pop esi
add esp, 0x30
ret
xor eax, eax
mov dword [esp + 0x10], eax
push ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov eax, 2
push 0x7f000001
mov word [esp + 0x18], ax
call dword [sym.imp.WS2_32.dll_htonl]
mov ebx, dword [esp + 0x4c]
mov dword [esp + 0x18], eax
xor eax, eax
push 4
mov word [esp + 0x1a], ax
lea eax, [esp + 0x10]
push eax
push 4
push 0xffff
push edi
mov dword [ebx + 4], 0xffffffff
mov dword [ebx], 0xffffffff
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x4fb2e7
push 0x10
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x4fb2e7
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x4fb2e7
push 1
push edi
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x4fb2e7
push 0
push 1
push 2
call esi
mov dword [ebx], eax
cmp eax, 0xffffffff
je 0x4fb2e7
push 0x10
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x4fb2e7
push 0
push 0
push edi
call dword [sym.imp.WS2_32.dll_accept]
mov dword [ebx + 4], eax
cmp eax, 0xffffffff
je 0x4fb2e7
push ebx
push 0x538918
lea eax, [esp + 0x2c]
push 0xc
push eax
call fcn.004eeaa0
lea esi, [esp + 0x34]
add esp, 0x10
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x4fb254
push 0
sub esi, ecx
lea eax, [esp + 0x28]
push esi
push eax
push dword [ebx]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, esi
jne 0x4fb2e7
push 0
push 0xc
lea eax, [esp + 0x38]
push eax
push dword [ebx + 4]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, esi
jne 0x4fb2e7
lea ecx, [esp + 0x24]
lea edx, [esp + 0x30]
sub esi, 4
jb 0x4fb2a5
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x4fb2aa
add ecx, 4
add edx, 4
sub esi, 4
jae 0x4fb294
cmp esi, 0xfffffffc
je 0x4fb2d7
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x4fb2e7
cmp esi, 0xfffffffd
je 0x4fb2d7
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x4fb2e7
cmp esi, 0xfffffffe
je 0x4fb2d7
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x4fb2e7
cmp esi, 0xffffffff
je 0x4fb2d7
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x4fb2e7
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x30
ret
mov esi, dword [sym.imp.WS2_32.dll_closesocket]
push edi
call esi
push dword [ebx]
call esi
push dword [ebx + 4]
call esi
pop ebx
pop edi
or eax, 0xffffffff
pop esi
add esp, 0x30
ret
Function at 0x5066e0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x1ded994], 0
push ebx
push esi
mov esi, 0x1ded99c
jne 0x50670c
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x1ded9b4], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x1ded994], 1
push dword [0x1ded9b4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x5067a9
push 0x14
push 8
push dword [0x1debc34]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x5067d3
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x1ded998]
test eax, eax
je 0x50674e
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x1ded998], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x5067d8
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x1ded9b4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x1debc34]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x5067d3
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8
Function at 0x401102
Capabilities:
Terminate process

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x44
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0x18
mov eax, dword [ebp - 0x18]
mov eax, dword fs:[eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 0
jmp 0x40115e
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x14]
jne 0x40114d
mov dword [ebp - 0xc], 1
jmp 0x401188
mov dword [esp], 0x3e8
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], 0x4060b4
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], 0
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x20]
lock cmpxchg dword [edx], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40113c
mov eax, dword [0x4060b8]
cmp eax, 1
jne 0x4011a0
mov dword [esp], 0x1f
call sym.__amsg_exit
jmp 0x4011d3
mov eax, dword [0x4060b8]
test eax, eax
jne 0x4011c9
mov dword [0x4060b8], 1
mov dword [esp + 4], 0x408014
mov dword [esp], 0x40800c
call sym.__initterm
jmp 0x4011d3
mov dword [0x40601c], 1
mov eax, dword [0x4060b8]
cmp eax, 1
jne 0x4011fb
mov dword [esp + 4], 0x408008
mov dword [esp], section..CRT
call sym.__initterm
mov dword [0x4060b8], 2
cmp dword [ebp - 0xc], 0
jne 0x401217
mov dword [ebp - 0x2c], 0x4060b4
mov dword [ebp - 0x30], 0
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
xchg dword [eax], edx
mov eax, dword [entry1]
test eax, eax
je 0x401241
mov eax, dword [entry1]
mov dword [esp + 8], 0
mov dword [esp + 4], 2
mov dword [esp], 0
call eax
sub esp, 0xc
call sym.__pei386_runtime_relocator
mov dword [esp], sym.__gnu_exception_handler_4
mov eax, dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call eax
sub esp, 4
mov dword [0x406074], eax
mov dword [esp], sym.___mingw_invalidParameterHandler
call sym.__set_invalid_parameter_handler
call sym.__fpreset
mov eax, dword [0x406004]
mov dword [esp + 4], 0x406008
mov dword [esp], eax
call sym._duplicate_ppstrings
call sym.___main
mov eax, dword [0x403028]
mov edx, dword [0x40600c]
mov dword [eax], edx
mov ecx, dword [0x40600c]
mov edx, dword [0x406008]
mov eax, dword [0x406004]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call dbg.main
mov dword [0x406014], eax
mov eax, dword [0x406018]
test eax, eax
jne 0x4012d0
mov eax, dword [0x406014]
mov dword [esp], eax
call sym._exit
mov eax, dword [0x40601c]
test eax, eax
jne 0x4012de
call sym.__cexit
mov eax, dword [0x406014]
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret
Function at 0x4012eb
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x40604c], 1
mov dword [0x406050], 1
mov dword [0x406054], 1
mov dword [ebp - 4], 0x400000
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x40132c
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x40134f
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
movzx eax, ax
cmp eax, 0x10b
je 0x401371
cmp eax, 0x20b
je 0x401396
jmp 0x4013c1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x5c]
cmp eax, 0xe
ja 0x401383
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x4013c6
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x6c]
cmp eax, 0xe
ja 0x4013ae
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x4013c6
mov eax, 0
leave
ret

Function at 0x40180c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [esp], 2
call sym.___acrt_iob_func
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov ebx, dword [ebp - 0xc]
mov dword [esp], 2
call sym.___acrt_iob_func
mov dword [esp + 8], ebx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._vfprintf
call sym._abort

Function at 0x4023e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x4023ff
mov eax, 0
jmp 0x402443
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x402422
mov eax, 0
jmp 0x402443
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x10b
je 0x40243e
mov eax, 0
jmp 0x402443
mov eax, 1
leave
ret
Function at 0x402445
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0x18
mov dword [ebp - 4], eax
jmp 0x4024a4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp dword [ebp + 0xc], eax
jb 0x40249c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x40249c
mov eax, dword [ebp - 4]
jmp 0x4024b8
add dword [ebp - 8], 1
add dword [ebp - 4], 0x28
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 8], eax
jb 0x402479
mov eax, 0
leave
ret
Function at 0x40f7e0
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46456b
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x48406c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x497928], 0
je 0x40f81d
mov al, 1
jmp 0x40f9e3
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00443020
xor eax, eax
mov dword [ebp - 0x220], 0
add esp, 0xc
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40f870
sub eax, edx
lea ecx, [ebp - 0x230]
sar eax, 1
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00406190
push 0xa
push 0x4777e0
lea ecx, [ebp - 0x230]
call fcn.0040abe0
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x497928], eax
test eax, eax
je 0x40f9a3
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.ASIO_Open
push eax
call esi
push str.ASIO_ReadMSR
push dword [0x497928]
mov dword [0x497924], eax
call esi
push str.ASIO_WriteMSR
push dword [0x497928]
mov dword [0x49793c], eax
call esi
push str.ASIO_InPortB
push dword [0x497928]
mov dword [0x49792c], eax
call esi
push str.ASIO_OutPortB
push dword [0x497928]
mov dword [0x497938], eax
call esi
push str.ASIO_InPortD
push dword [0x497928]
mov dword [0x497934], eax
call esi
push str.ASIO_OutPortD
push dword [0x497928]
mov dword [0x497930], eax
call esi
push str.MapPhysToLin
push dword [0x497928]
mov dword [0x497920], eax
call esi
push str.UnmapPhysicalMemory
push dword [0x497928]
mov dword [0x497948], eax
call esi
push str.ASIO_MapMem
push dword [0x497928]
mov dword [0x497944], eax
call esi
push str.ASIO_UnmapMem
push dword [0x497928]
mov dword [0x49794c], eax
call esi
push 0
mov dword [0x497940], eax
call dword [0x497924]
test eax, eax
je 0x40f9a3
mov bl, 1
jmp 0x40f9a5
xor bl, bl
mov edx, dword [ebp - 0x21c]
cmp edx, 8
jb 0x40f9e1
mov ecx, dword [ebp - 0x230]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40f9d7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f9fe
push edx
push ecx
call fcn.0042b5db
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042b067
mov esp, ebp
pop ebp
ret
call fcn.00449472
int3
Function at 0x40ff30
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x48406c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x228
xor ebx, ebx
mov dword [ebp - 0x234], ecx
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x230], 0x22c
push ebx
push eax
call fcn.00443020
add esp, 0xc
push ebx
push 0xf
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x40ffd8
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x40ffd1
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Process32NextW]
lea eax, [ebp - 0x230]
push eax
push esi
call edi
test eax, eax
je 0x40ffd0
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x234]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x40ffca
lea eax, [ebp - 0x230]
push eax
push esi
call edi
test eax, eax
jne 0x40ffa3
jmp 0x40ffd0
mov ebx, dword [ebp - 0x228]
pop edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.0042b067
mov esp, ebp
pop ebp
ret