joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6cd2b2
Capabilities:
Check for software breakpoints

Disassembly:
jmp 0x6d995f
and al, 0x7f
test al, al
call fcn.006c9b25
pushfd
lea esp, [esp + 0x38]
je 0x6c9dce
cmc
stc
push 0xfe9e72cb
cmc
add eax, edi
stc
cmp eax, edx
call fcn.006c9ebb
sbb al, 0xc6
stosd dword es:[edi], eax
in eax, 0x17
xchg esp, eax
jnp 0x6d992c
dec ebx
jne 0x6d99d0
ja 0x6d99d0
js 0x6d99d4
js 0x6d99bd
lodsb al, byte [esi]
sbb byte [ebp - 0x142f5ede], ah
iretd
pop edi
rcr dword [eax + 0x4d52fda0], cl
push 0x30fcc997
out dx, eax
sbb byte [eax + edi*8], 7
push cs
inc ebp
inc ebp
invalid
jae 0x6d9a25
xor al, ah
push ebp
scasw ax, word es:[edi]
popfd
xchg byte [ebp - 0x6cb59601], ch
or ch, al
mov ah, 0xb7
xor bl, ah
mov bl, 0xc7
aad 0xb2
sub byte [ecx + 8], bh
js 0x6d9a44
outsd dx, dword [esi]
or al, 0x79
mov ebp, 0x2b92b3d9
in eax, 0x6f
or dword [esi - 0x350b1e7b], edi
das
sbb dword [esi - 0x17807a3], esp
invalid
push ds
std
or ah, ah
jo 0x6d9a69
dec eax
fdivr st(3)
movsb byte es:[edi], byte [esi]
in al, 0xce
invalid
lea cx, [eax + edi*2 - 0x2b]
loopne 0x6d99be
test byte [0xfb6812af], 8
mov esi, 0xdee2b885
add eax, 0xa55ad0a1
pop ebp
clc
or byte [eax + 0x6a692504], al
jne 0x6d9a87
push 0x75
inc eax
imul esp, dword [ebp + 0x56], 0x69
adc al, 0xac
adc ch, byte [edx - 0x59ed5ce0]
in al, dx
int 0xd2
cli
mov edx, 0xd031af1a
mov al, byte [0x92cfe734]
xchg edx, eax
in eax, 0x4a
jecxz 0x6d9a60
salc
mov cl, 0xd4
cmpsd dword [esi], dword es:[edi]
aad 0xac
jecxz 0x6d9a02
cmp byte [ebx - 0x7b2e87b6], al
xchg esp, eax
das
sub byte [edi - 0x39], dl
push esi
sbb byte [0xe4fbc216], 0xd7
jmp 0x6d9a0f
inc esp
cmp dh, 0xcc
add dword [ebp + 0x28acf3c2], esi
dec edi
pop eax
push ebp
xchg ebx, eax
jb 0x6d9aea
push ebp
loopne 0x6d9a80
stc
sbb dl, bl
invalid
sub al, 0x71
sub eax, 0x819044
or dword [esi - 0x25224c7b], edi
add byte [ecx], cl
mov esi, 0xdaddb385
lcall 0xf85d, 0xa4b07a12
add dword [esi], ebx
imul ebx, dword [edx], 0x5e667344
push esp
push 0x16
mov eax, dword [0x922e8a38]
sub al, 0x93
xchg ebp, eax
in al, dx
in al, 0xa0
push ebp
jle 0x6d9b4a
movsb byte es:[edi], byte [esi]
adc al, 0x82
sti
xor eax, 0x167041dc
inc ebp
movsd dword es:[edi], dword [esi]
pop es
push ecx
pop es
jnp 0x6d9b3c
inc esp
je 0x6d9b56
sub ch, byte [edx + 0x6f09fdac]
dec esi
js 0x6d9b0a
mov bl, 0xe8
out 0x55, al
jo 0x6d9ba0
dec edx
sub eax, 0xd4e57f86
in al, dx
jmp 0x6d9ae4
cmpsd dword [esi], dword es:[edi]
fbstp tbyte [edi]
inc edi
xor dword [edx - 0x6579013a], ebp
and al, cl
sal edx, 0x28
mov eax, dword [0x9839cae6]
sub byte [ecx - 0x67c6351a], ah
and byte [eax - 0x730574a1], bl
cmpsd dword [esi], dword es:[edi]
ret
pop esi
invalid

Function at 0x6d8f49
Capabilities:
Resolve function by parsing pe exports

Disassembly:
stosb byte es:[edi], al
push 0xd27d996a
push dword [esp + 0xc]
push 0xf7ed636e
lea esp, [esp + 0x18]
jmp fcn.006de3e9
Function at 0x6dc9ac
Capabilities:
Resolve function by parsing pe exports

Disassembly:
not al
not al
jmp 0x6e47ba
mov byte [esp + 0xc], 0xff
lea esp, [esp + 0x3c]
jne 0x644306
cmp eax, edx
push 0x27aafb73
lea esp, [esp + 8]
jb 0x6c9dd3
pushal
stc
cmp dx, 0x5c37
cmc
cmp eax, dword [ebp - 0x10]
push esi
pushfd
lea esp, [esp + 0x28]
jae 0x6c9dd3
xor edi, ebp
shld di, bp, cl
mov ebx, eax
cmc
mov edi, eax
shl cl, cl
cmp ecx, 0x20aa3f1b
bts ecx, 0x17
mov ecx, 0x104
jmp 0x6dc9f5
sub al, al
call fcn.006dcf75
add byte [eax], al
dec eax
popal
jo 0x6dca55
inc ecx
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [eax], ax
dec al
test eax, 0x5abde8d9
stc
bt cx, bp
neg al
bt di, dx
stc
cmc
shl edi, 8
bt dx, dx
cmp cl, bh
add edi, eax
pushal
sub ecx, 1
pushfd
jmp 0x6c9b73
and eax, 0xd05b5aaf
cld

Function at 0x6dcc88
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test edi, edi
mov word [esp], cx
pushfd
call fcn.006438d2

Function at 0x6dccde
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmc
sub al, 0x2e
cmp dh, dl
clc
cmp al, byte [edi]
call fcn.00645b32
rol al, 4
test edi, esp
test si, 0xf61b
jmp 0x6dddc2
lea esp, [esp + 0xc]
jnp 0x6d9374
sub al, 0x2e
pushal

Function at 0x6dd062
Capabilities:
Check os version
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 8]
jb 0x6e2790
sal cl, 3
jmp 0x6e2788
lahf
xor cl, ch
mov eax, 3
pushal
mov ecx, 6
stc

Function at 0x6e1e8c
Capabilities:
Check os version
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0x20], edx
lahf
pushfd
pushfd
mov edx, dword [esp + 0xc]
lea esp, [esp + 0x10]

Function at 0x6e21f0
Capabilities:
Check os version
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x38]
ja 0x64660d
mov al, 0xd0
sub al, 0x28
ror al, 2
sub ebx, edi
bsf di, bp
lea edi, [edi - 0x4a5c5c91]
neg edi
add ebx, esp

Function at 0x6e23d9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x6dd074
mov word [esp], 0xbd83
push dword [esp]
sbb ecx, ecx
cmc
pushfd
lea ecx, [ecx + ecx*2 + 0xb]
pushal
xchg dword [esp + 0x28], ecx
shrd cx, di, cl
cmc
pushal
pushfd
lea ecx, [ecx + ecx*2 + 0xb]
push ebp
mov dword [esp + 0x24], ecx
bswap ecx
xchg dword [esp + 0x20], esi
sar si, 1
pop esi
bsr ecx, ebx
lea ecx, [eax + 2]
pushal
bsr si, cx
mov esi, dword [ebp - 0x20]
sar al, cl
sar al, 1
sal al, cl
shr al, cl
not esi
sub al, dh
xor al, bl
add esi, edi
push dword [esp + 4]
not al
rep movsb byte es:[edi], byte [esi]
lea ecx, [0xa636faa9]
not cl
lea esi, [ebp - 0x2a9b53e7]
mov esi, dword [esp + 0x40]
mov byte [esp + 4], dl
bswap cx
mov ecx, dword [esp + 0x44]
jmp 0x6e412e
pushfd
jmp 0x6dcbd1
pushfd
lea esp, [esp + 0x2c]
call fcn.00643d04
test bp, ax
test ch, 0x51
pushal
test edi, 0x1d6a978c
cmp ecx, 7
lea esp, [esp + 0x20]
jg 0x6ddb89
pushfd
pushal
sbb ecx, ecx
mov word [esp], 0x7cec
add esp, 0x24
jg 0x642ef1
lea ecx, [ecx + ecx*2 + 0xb]
mov byte [ebp - 2], al
mov al, byte [edi - 1]
jmp 0x6e294b
Function at 0x6e29ee
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.00644a6b
lea esp, [esp + 0x24]
jb 0x6ddc38
or ch, ah
xor ecx, ebp
mov ecx, eax
and dl, dl
cmp bx, sp
mov edx, 1
cmp edi, 0x8ba84bf8
shr ecx, 1
jg 0x6420ce
pushal
push 0xddbe3b09
adc edx, edx
push edx
test dx, 0xe62
call fcn.006d90d2
add byte [eax], al
inc esp
imul esi, dword [ebx + 0x70], 0x68637461
dec ebp
jae 0x645df3
popal
inc ecx
add byte [esi + 0xf], ah
movsb byte es:[edi], byte [esi]
fiadd dword [edx]
pop edx
or edi, 0xae809eb2
pop edi
add si, 0x17ca
lea ebx, [eax + 0x2cb9a7f5]
pop esi
lea ebx, [esi - 0x6f30c4ec]
bswap bx
bt bp, cx
pop ecx
test ch, 0x2e
bts ebp, ebx
bswap bp
pop ebx
sbb bp, cx
add esp, 0x28
movsx bp, cl
not ebp
pushfd
call fcn.006e361f
jmp 0x645d37
mov dword [ebp - 0x20], eax
bt ebx, 0x1a
cmc
cmp eax, 4
pushal
jmp 0x6e1fa2
Function at 0x6e3d2b
Capabilities:
Check os version
Resolve function by parsing pe exports

Disassembly:
cmp byte [edi - 1], 0
jmp 0x6ca524
pushal
pushfd
call fcn.006d989a
add byte [eax], al
inc edi
je 0x645993
jae 0x6459bc
popal
push eax
outsd dx, dword [esi]
jae fcn.00645950
arpl word [edx + 0x65], si
outsb dx, byte gs:[esi]
push esp
outsd dx, dword [esi]
inc ebx
insb byte es:[edi], dx
imul esp, dword [ebp + 0x6e], 0x74
inc ebx
jb 0x645a0b
popal
je 0x645a0e
inc esi
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x6459f7
outsb dx, byte [esi]
imul esi, dword fs:[edx + 0x65], 0x577463
add byte [edi + 0x65], al
je 0x645a4f
jmp 0x6e3300
push 0xad5fdc7a
mov byte [esp], 0x60
lea esp, [esp + 8]
jne 0x644ace
shl di, 2
shrd di, si, cl
rol di, cl
mov edi, dword [edx + 0x24]
pushal
pushal
test al, 0x35
add edi, eax
stc
movzx ecx, word [edi + ecx*2]
and edi, 0x3c00b13b
mov edi, dword [edx + 0x1c]
jmp 0x6ca581
stc
push dword [esp]
pushfd
add edi, eax
pushfd
mov edi, dword [edi + ecx*4]
bt sp, di
test ch, dl
mov word [esp + 4], 0x7790
stc
test edi, edi
lea esp, [esp + 0x4c]
jns 0x6ddb4a
push esi
lea esp, [esp + 4]
je 0x6c9dce
stc
bt sp, cx
cmc
stc
add eax, edi
jmp 0x6c999c
lea esp, [esp + 8]
je 0x6c9dce
bt cx, si
add eax, edi
stc
cmp bl, ch
cmp eax, edx
push ebx
mov byte [esp], 0xbc
lea esp, [esp + 4]
jb 0x6c9dd3
stc
pushfd
cmp eax, dword [ebp - 0x10]
mov word [esp], 0x61cf
lea esp, [esp + 4]
jae 0x6c9dd3
bswap di
mov ebx, eax
ror di, 0xa
mov edi, eax
and cl, 0x7d
lea ecx, [edi + 0x35058235]
mov ecx, 0x104
push 0x53213743
sub al, al
mov byte [esp], al
call fcn.006ca1b9
add byte [eax], al
inc esi
imul ebp, dword [esi + 0x64], 0x756c6f56
insd dword es:[edi], dx
inc ebx
insb byte es:[edi], dx
outsd dx, dword [esi]
jae 0x6dbf78
add byte [edi], cl
mov bh, 0xc
dec edi
bsr di, bx
or di, 0x5327
movsx di, al
test cl, cl
mov edi, dword [edx + 0x1c]
push edx
add edi, eax
cmp bl, 0x80
cmp bl, 0xf9
mov byte [esp + 4], bl
mov edi, dword [edi + ecx*4]
clc
test edi, edi
jmp 0x645939
inc dword [eax]
add byte [edi + ebp*2 + 0x63], cl
popal
insb byte es:[edi], dx
add byte [eax], al
dec esp
outsd dx, dword [esi]
arpl word [ecx + 0x6c], sp
inc ecx
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [eax], ax
cmp dword [ecx - 0x6c0e5d12], ecx
jnp 0x6dbf79
jnp 0x6dbfea
cmp ecx, dword [eax + 0x7bac31a]
pop es
mov eax, dword [0x8f266135]
sub eax, 0xc7026ed
sbb ecx, dword [0x4b7e7f0a]
push esp
scasb al, byte es:[edi]
movsb byte es:[edi], byte ds:[esi]
sti
loopne 0x6dbf95
rol al, cl
pop edi
adc al, 0xae
movsd dword es:[edi], dword [esi]
and esp, dword [edi + 0x76]
or esi, dword [ecx + 0x24]
dec edx
mov esp, 0x5f351e03
pushal
iretd
invalid
pushfd
push dword [esp]
jmp 0x6dbea1
cmp eax, dword [ebp - 0x10]
pushfd
cmp eax, edx
push 0xf5d31c5c
pushfd
mov word [esp + 4], 0xa600
lea esp, [esp + 0xc]
jb 0x6c9dd3
cmc
clc
jmp 0x6e2958
cmp bh, cl
jmp 0x64395b
Function at 0x6e4e88
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 4]
je 0x6c9dce
movzx si, bl
shl dh, 6
shld esi, esp, 0x11
mov si, dx
mov esi, dword [eax + 0x3c]
neg dh
neg dx
push edx
stc
add esi, eax
movsx dx, al
bt bp, 0xd
shl dl, 4
neg dh
mov edx, dword [esi + 0x78]
call fcn.006ca2d6
jmp 0x6ddaea
pushfd
jmp 0x5cd146
cmp ch, 0xdb
clc
lea esp, [esp + 8]
add ebx, esp
pushfd
pushfd
pushal
push 0x42bc0dd2
lea esp, [esp + 0x2c]
jmp 0x6e2211
mov dword [esp + 4], esi
shrd ax, dx, cl
pop eax
test bx, 0x212c
push 0x6a1e95d
mov dword [esp], edi
aad 0x83
stc
cmc
or ax, 0x4d7f
push ebx
rol al, 4
neg ax
push edx
not ax
mov eax, dword [ebp + 8]
bt sp, ax
cmc
test eax, eax
jmp 0x64238a

Function at 0x6f56d6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x6d9852
lea esp, [esp + 0x10]
ja 0x64660d
neg al
bt si, si
sub ebx, edi
rcr al, cl
add ebx, esp
pushfd
mov edi, ebx
call fcn.006cd2b7
push ebp
jmp 0x64391f

Function at 0x6f56f7
Capabilities:
Check os version

Disassembly:
shr ax, cl
mov ebx, dword [esp + 4]
shrd cx, dx, 5
bswap ecx
btc ecx, ebx
mov ecx, dword [esp + 8]
jmp 0x6ca295

Function at 0x438c8e
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x438a14
mov ecx, ecx
mov ecx, ecx
sub eax, 0x993a346b
call fcn.00438ccc
add ecx, ecx
and eax, eax
xor dword [ebx], edx
or eax, eax
add eax, ecx
inc ebx
sub ecx, eax
push ecx
pop ecx
add eax, 0x7026eea9
cmp ebx, esi
jne fcn.00438c8e
add eax, eax
ret
Function at 0x4a8780
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x97000]
push edi
or ebp, 0xffffffff
jmp 0x4a87a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4a87a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a8798
mov eax, 1
add ebx, ebx
jne 0x4a87bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4a87cc
jne 0x4a87eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a87eb
dec eax
add ebx, ebx
jne 0x4a87d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4a87b0
add ebx, ebx
jne 0x4a87e7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4a883d
xor ecx, ecx
sub eax, 3
jb 0x4a8803
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4a8872
sar eax, 1
mov ebp, eax
jmp 0x4a880e
add ebx, ebx
jne 0x4a880e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a87dc
inc ecx
add ebx, ebx
jne 0x4a881c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a87dc
add ebx, ebx
jne 0x4a8829
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4a881e
jne 0x4a883a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4a881e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4a885c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4a884e
jmp 0x4a879e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4a885c
add edi, ecx
jmp 0x4a879e
pop esi
mov edi, esi
mov ecx, 0x3f7
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4a887a
cmp byte [edi], 4
jne 0x4a887a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4a887f
lea edi, [esi + 0xa6000]
mov eax, dword [edi]
or eax, eax
je 0x4a88f7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x102acc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x102b08]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4a88ac
mov ecx, edi
jns 0x4a88db
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x102b0c]
or eax, eax
je 0x4a88f1
mov dword [ebx], eax
add ebx, 4
jmp 0x4a88c9
call dword [esi + 0x102b1c]
mov ebp, dword [esi + 0x102b10]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1e7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4a892b
sub esp, 0xffffff80
jmp 0x403060
Function at 0x401ea0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401eb5
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401ef4
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x401ef0
lea ebx, [ebx]
cmp esi, edx
jae 0x401ef4
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x401ee0
cmp esi, edx
jb 0x401ef9
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret

Function at 0x402740
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x5d61f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push 0x288
mov dword [ebp - 8], 0x288
call fcn.00426dcb
mov esi, eax
add esp, 4
test esi, esi
je 0x402811
push 0x288
push 0
push esi
call fcn.0054c3e0
add esp, 0xc
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x40279b
push esi
call fcn.00426e01
jmp 0x40280e
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x402808
mov eax, esi
lea esp, [esp]
cmp dword [eax + 0x1a0], 6
jne 0x4027c2
cmp dword [eax + 0x190], 6
je 0x4027ca
mov eax, dword [eax]
test eax, eax
jne 0x4027b0
jmp 0x402808
movzx eax, byte [esi + 0x199]
push eax
movzx eax, byte [esi + 0x198]
push eax
movzx eax, byte [esi + 0x197]
push eax
movzx eax, byte [esi + 0x196]
push eax
movzx eax, byte [esi + 0x195]
push eax
movzx eax, byte [esi + 0x194]
push eax
push str._02X__02X__02X__02X__02X__02X
push ebx
call fcn.00404a00
add esp, 0x20
push esi
call fcn.00426e01
add esp, 4
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0054940a
mov esp, ebp
pop ebp
ret 4
Function at 0x402830
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x5d61f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push 0x178
mov dword [ebp - 8], 0x178
call fcn.00426dcb
mov esi, eax
add esp, 4
test esi, esi
je 0x4028ec
push 0x178
push 0
push esi
call fcn.0054c3e0
add esp, 0xc
lea eax, [ebp - 8]
push eax
push esi
push 0
push 0
push 0
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersAddresses]
cmp eax, 0x6f
jne 0x402891
push esi
call fcn.00426e01
jmp 0x4028e9
lea eax, [ebp - 8]
push eax
push esi
push 0
push 0
push 0
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersAddresses]
test eax, eax
jne 0x4028e3
mov eax, esi
cmp dword [eax + 0x34], 6
je 0x4028b7
mov eax, dword [eax + 8]
test eax, eax
jne 0x4028a8
jmp 0x4028e3
movzx ecx, byte [eax + 0x31]
push ecx
movzx ecx, byte [eax + 0x30]
push ecx
movzx ecx, byte [eax + 0x2f]
push ecx
movzx ecx, byte [eax + 0x2e]
push ecx
movzx ecx, byte [eax + 0x2d]
movzx eax, byte [eax + 0x2c]
push ecx
push eax
push str._02X__02X__02X__02X__02X__02X
push ebx
call fcn.00404a00
add esp, 0x20
push esi
call fcn.00426e01
add esp, 4
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0054940a
mov esp, ebp
pop ebp
ret 4
Function at 0x406d50
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5d61f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push dword [ebp + 8]
call fcn.0054acb8
add esp, 8
cmp eax, 0xffffffff
jne 0x406da9
push 1
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x24], 0xc
mov dword [ebp - 0x1c], 1
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x406da9
xor esi, esi
jmp 0x406dae
mov esi, 1
mov edi, dword [ebp + 8]
add edi, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x406dcb
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0054940a
mov esp, ebp
pop ebp
ret

Function at 0x406f90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5765f8
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x5d61f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 1
jle 0x406fd2
push dword [eax - 0xc]
lea ecx, [ebp + 8]
call fcn.004022d0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
mov eax, dword [ebp + 8]
setne bl
push dword [eax - 8]
push eax
call fcn.0054a435
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x40703f
mov eax, dword [ebp + 8]
cmp ecx, dword [eax - 8]
jg 0x40703f
mov dword [eax - 0xc], ecx
mov eax, dword [ebp + 8]
xor edx, edx
mov word [eax + ecx*2], dx
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp + 8]
add esi, 0xfffffff0
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40702c
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00402650
int3
Function at 0x407200
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x5d61f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0xc], edx
mov esi, ecx
call fcn.00430b1e
mov edi, dword [eax + 0xc]
movzx eax, si
push 0x5acfa8
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x407245
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054940a
mov esp, ebp
pop ebp
ret
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x40726f
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054940a
mov esp, ebp
pop ebp
ret
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push ebx
push esi
push eax
call fcn.005507b0
add esp, 0xc
lea eax, [ebp - 8]
push eax
push 0
push edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov ebx, dword [ebp - 8]
push 0x10
call dword [sym.imp.gdiplus.dll_GdipAlloc]
mov esi, eax
test esi, esi
je 0x4072c6
lea ecx, [esi + 4]
push ecx
push ebx
mov dword [esi], vtable.Gdiplus::Image.0
mov dword [ecx], 0
call dword [sym.imp.gdiplus.dll_GdipLoadImageFromStream]
mov dword [esi + 8], eax
jmp 0x4072c8
xor esi, esi
mov ebx, dword [ebp - 0xc]
push edi
mov dword [ebx], esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [ebx], eax
pop ebx
setne al
pop edi
xor ecx, ebp
pop esi
call fcn.0054940a
mov esp, ebp
pop ebp
ret
Function at 0x408da0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x575fb8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x5d61f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1c], 0
call fcn.004290db
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x408df0
push 0x80004005
call fcn.00402650
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 4], 0
push 0
mov dword [ebp - 0x14], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x408eb0
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
jge 0x408e44
push 0x104
lea ecx, [ebp - 0x18]
call fcn.00402390
mov esi, dword [ebp - 0x18]
push esi
push dword [ebp - 0x14]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push dword [esi - 8]
push esi
call fcn.0054a435
add esp, 8
test eax, eax
js 0x408ea6
cmp eax, dword [esi - 8]
jg 0x408ea6
mov dword [esi - 0xc], eax
xor ecx, ecx
mov word [esi + eax*2], cx
push dword [ebp - 0x14]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
add esi, 0xfffffff0
push esi
call fcn.00402680
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x408edd
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
jmp 0x408edd
push 0x80070057
call fcn.00402650
push 0x5ac810
mov ecx, edi
call fcn.00402110
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x408edd
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0054940a
mov esp, ebp
pop ebp
ret 8