joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43c9a0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x43c9d3
push esi
call fcn.0043fa90
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x43c9cc
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x43ca59
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x43ca42
mov eax, dword [esi + 8]
test eax, eax
je 0x43c9f7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x43ca3e
cmp eax, 2
je 0x43ca42
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43c9ea
cmp eax, 3
je 0x43ca1d
cmp eax, 1
jne 0x43c9ea
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x43c9ea
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x43c9ea
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0043ca80
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x43ca68
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0043ca80
add esp, 4
pop esi
ret

Function at 0x448620
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x4486c3
test eax, eax
jbe 0x4486c3
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x4486c3
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x44866e
xor esi, esi
jmp 0x448674
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x44869f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.0044a680
add esi, eax
push esi
mov ebx, esi
call fcn.0044a680
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x448680
pop ebp
test edi, edi
pop edi
jne 0x4486c3
test ebx, ebx
je 0x4486c3
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.00450670
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc
Function at 0x448805
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x44891d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x44891d
mov eax, dword [esi + 0x3c]
push eax
call fcn.00461904
mov esi, eax
test esi, esi
je 0x44891d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x44891d
mov ecx, esi
call fcn.00448770
cmp edi, eax
jge 0x44891d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x4488a3
mov dword [esp + 0x34], 1
jmp 0x4488fe
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x44891d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.00447ce0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc

Function at 0x44a7f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x44a856
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x44a856
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x44a837
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret
Function at 0x44b390
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.0044b4e0
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov dword [esi], eax
cmp eax, 0xffffffff
pop esi
jne 0x44b3b0
xor eax, eax
pop ecx
ret
lea ecx, [esp]
push 4
push ecx
push 0x1001
push 0xffff
push eax
mov dword [esp + 0x14], 0
call sub.WS2_32.dll_setsockopt
mov eax, 1
pop ecx
ret

Function at 0x44b391
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.0044b4e0
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov dword [esi], eax
cmp eax, 0xffffffff
pop esi
jne 0x44b3b0
xor eax, eax
pop ecx
ret
lea ecx, [esp]
push 4
push ecx
push 0x1001
push 0xffff
push eax
mov dword [esp + 0x14], 0
call sub.WS2_32.dll_setsockopt
mov eax, 1
pop ecx
ret

Function at 0x44b3e0
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x10
xor eax, eax
push esi
push edi
mov dword [esp + 8], eax
mov edi, ecx
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x10], eax
push ecx
mov dword [esp + 0x18], eax
mov word [esp + 0xc], 2
call sub.WS2_32.dll_htons
mov esi, dword [esp + 0x1c]
mov word [esp + 0xa], ax
push esi
call sub.WS2_32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x44b437
push esi
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x44b44d
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
mov dword [esp + 0xc], ecx
lea edx, [esp + 8]
push 0x10
push edx
mov ecx, edi
call fcn.0044b470
pop edi
pop esi
add esp, 0x10
ret 8
push 0x2726
call sub.WS2_32.dll_WSASetLastError
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret 8

Function at 0x44b470
Capabilities:
Connect socket

Disassembly:
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
mov eax, dword [ecx]
push edx
push eax
call sub.WS2_32.dll_connect
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret 8

Function at 0x44b500
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x44b549
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4
Function at 0x44b9c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46e390
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.0044b570
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.0044b5f0
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.0044b5f0
lea ecx, [esi + 0xc]
call fcn.0045fe8e
lea ecx, [esi + 0x10]
call fcn.0045fe8e
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.0044de20
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.0044de20
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.0044de20
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.0045ff03
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.0045ff03
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x44c668
Capabilities:
Get hostname

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x46e5b8
push eax
mov dword fs:[0], esp
sub esp, 0x64
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
test eax, eax
je 0x44c678
call fcn.0044cb90
mov edi, dword [esp + 0x7c]
test edi, edi
je 0x44c75b
cmp byte [edi], 0
je 0x44c75b
mov eax, dword [esp + 0x8c]
test eax, eax
jg 0x44c69d
mov eax, 0x7d0
mov ecx, esi
mov dword [esi + 8], eax
call fcn.0044b390
test eax, eax
jne 0x44c6bd
push 0x4ae488
lea ecx, [esi + 0x38]
call fcn.00460040
jmp 0x44c75b
mov eax, dword [esp + 0x80]
mov ecx, esi
push eax
push edi
call fcn.0044b3e0
test eax, eax
jne 0x44c6ec
mov ecx, esi
call fcn.0044b4e0
push edi
add esi, 0x38
push 0x4ae464
push esi
call fcn.0045dd07
add esp, 0xc
jmp 0x44c75b
push 0xdc
mov ecx, esi
mov dword [esi + 4], 1
call fcn.0044d410
test eax, eax
je 0x44c754
lea ecx, [esp + 8]
push 0x64
push ecx
call sub.WS2_32.dll_gethostname
mov eax, dword [esp + 0x88]
mov ecx, dword [esp + 0x84]
lea edx, [esp + 0x8c]
mov dword [esp + 0x8c], 1
push edx
push eax
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, esi
call fcn.0044c830
test eax, eax
jne 0x44c770
push edi
lea eax, [esi + 0x38]
push 0x4ae440
push eax
call fcn.0045dd07
add esp, 0xc
mov ecx, esi
call fcn.0044cb90
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x44c818
mov ecx, dword [0x4ae768]
mov dword [esp + 0x7c], ecx
lea edx, [esp + 8]
lea eax, [esp + 0x7c]
push edx
push str.HELO__s_r_n
push eax
mov dword [esp + 0x80], 0
call fcn.0045dd07
mov edx, dword [esp + 0x88]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
mov ecx, esi
call fcn.0044b490
test eax, eax
jne 0x44c7da
push 0x4ae424
lea ecx, [esi + 0x38]
call fcn.00460040
jmp 0x44c7ea
push 0xfa
mov ecx, esi
call fcn.0044d410
test eax, eax
jne 0x44c807
mov ecx, esi
call fcn.0044cb90
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.0045ff03
jmp 0x44c75b
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.0045ff03
mov ecx, dword [esp + 0x6c]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
Function at 0x4622a7
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4622df
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0046035e
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00460336
jmp 0x4622eb
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x463999
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4639db
call fcn.00469516
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4639db
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4639d2
xor eax, eax
jmp 0x4639e3
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004639e9
pop edi
pop esi
pop ebx
ret 4

Function at 0x469a46
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x469a74
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x469a92
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004699ac
jmp 0x469a92
mov eax, dword [esi + 0x14]
test eax, eax
je 0x469a92
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004699ac
test edi, edi
mov eax, edi
jne 0x469a7c
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x78c242
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov esi, dword [ebp + 8]
test esi, esi
jne 0x78c262
mov eax, GetInterfaceInfo
add esp, 0x1c
pop ebx
pop esi
pop edi
leave
ret
mov ebx, dword [esi + 0x1c]
test ebx, ebx
je 0x78c252
mov edx, dword [esi + 0x20]
test edx, edx
je 0x78c252
mov eax, dword [esi + 0x24]
test eax, eax
je 0x78c252
mov dword [esi + 0x14], 0
mov dword [esi + 8], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x2c], 2
mov dword [ebx + 0x14], 0
mov eax, dword [ebx + 8]
mov dword [ebx + 0x10], eax
mov eax, dword [ebx + 0x18]
cmp eax, 0
jl 0x78c37d
jne 0x78c382
mov dword [ebx + 4], 0x71
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.0078a8f2
mov dword [esi + 0x30], eax
mov dword [ebx + 0x28], 0
mov dword [esp], ebx
call fcn.00795b16
mov eax, dword [ebx + 0x2c]
shl eax, 1
mov dword [ebx + 0x3c], eax
mov edx, dword [ebx + 0x44]
mov eax, dword [ebx + 0x4c]
mov word [edx + eax*2 - 2], 0
lea ecx, [eax + eax - 2]
xor eax, eax
mov edi, edx
rep stosb byte es:[edi], al
mov eax, dword [ebx + 0x84]
lea edx, [eax + eax*2]
shl edx, 2
lea eax, reloc.MSVCRT.dll_strncpy
movzx ecx, word [eax + 2]
mov dword [ebx + 0x80], ecx
movzx edx, word [edx + 0x62e960e0]
mov dword [ebx + 0x8c], edx
movzx edx, word [eax + 4]
mov dword [ebx + 0x90], edx
movzx eax, word [eax + 6]
mov dword [ebx + 0x7c], eax
mov dword [ebx + 0x6c], 0
mov dword [ebx + 0x5c], 0
mov dword [ebx + 0x74], 0
mov dword [ebx + 0x78], 2
mov dword [ebx + 0x60], 2
mov dword [ebx + 0x68], 0
mov dword [ebx + 0x48], 0
call fcn.007970f8
xor eax, eax
jmp 0x78c257
neg eax
mov dword [ebx + 0x18], eax
mov dword [ebx + 4], 0x2a
cmp eax, 2
jne 0x78c2b9
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.0078b00e
jmp 0x78c2d5
Function at 0x78d916
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
test eax, eax
jne 0x78d93e
mov eax, 0xfffffffa
add esp, 0x1c
pop ebx
pop esi
pop edi
leave
ret
cmp byte [eax], 0x31
jne 0x78d92f
cmp edx, 0x38
jne 0x78d92f
mov eax, GetInterfaceInfo
test ebx, ebx
je 0x78d934
mov dword [ebx + 0x18], 0
cmp dword [ebx + 0x20], 0
jne 0x78d96c
mov dword [ebx + 0x20], reloc.MSVCRT.dll_strncpy
mov dword [ebx + 0x28], 0
cmp dword [ebx + 0x24], 0
jne 0x78d979
mov dword [ebx + 0x24], reloc.MSVCRT.dll_strncpy
cmp esi, reloc.MSVCRT.dll_strncpy
je 0x78dadb
mov eax, GetInterfaceInfo
test esi, esi
js 0x78d934
cmp esi, 9
jg 0x78d934
mov dword [esp + 8], reloc.MSVCRT.dll_strncpy
mov dword [esp + 4], 1
mov eax, dword [ebx + 0x28]
mov dword [esp], eax
call dword [ebx + 0x20]
mov edi, eax
test eax, eax
je 0x78db06
mov dword [ebx + 0x1c], eax
mov dword [eax], ebx
mov dword [eax + 0x18], 1
mov dword [eax + 0x1c], 0
mov dword [eax + 0x30], 0xf
mov dword [eax + 0x2c], 0x8000
mov dword [eax + 0x34], 0x7fff
mov dword [eax + 0x50], 0xf
mov dword [eax + 0x4c], 0x8000
mov dword [eax + 0x54], 0x7fff
mov dword [eax + 0x58], 5
mov dword [esp + 8], 2
mov dword [esp + 4], 0x8000
mov eax, dword [ebx + 0x28]
mov dword [esp], eax
call dword [ebx + 0x20]
mov dword [edi + 0x38], eax
mov dword [esp + 8], 2
mov eax, dword [edi + 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x28]
mov dword [esp], eax
call dword [ebx + 0x20]
mov dword [edi + 0x40], eax
mov dword [esp + 8], 2
mov eax, dword [edi + 0x4c]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x28]
mov dword [esp], eax
call dword [ebx + 0x20]
mov dword [edi + 0x44], eax
mov dword [edi + reloc.MSVCRT.dll_strncpy], 0
mov dword [edi + reloc.MSVCRT.dll_strncpy], 0x4000
mov dword [esp + 8], 4
mov dword [esp + 4], 0x4000
mov eax, dword [ebx + 0x28]
mov dword [esp], eax
call dword [ebx + 0x20]
mov dword [edi + 8], eax
mov edx, dword [edi + reloc.MSVCRT.dll_strncpy]
lea ecx, [edx*4]
mov dword [edi + 0xc], ecx
cmp dword [edi + 0x38], 0
je 0x78dae5
cmp dword [edi + 0x40], 0
je 0x78dae5
cmp dword [edi + 0x44], 0
je 0x78dae5
test eax, eax
je 0x78dae5
mov ecx, edx
and ecx, 0xfffffffe
lea ecx, [eax + ecx]
mov dword [edi + reloc.MSVCRT.dll_strncpy], ecx
lea edx, [edx + edx*2]
add eax, edx
mov dword [edi + reloc.MSVCRT.dll_strncpy], eax
mov dword [edi + 0x84], esi
mov dword [edi + 0x88], 0
mov byte [edi + 0x24], 8
mov dword [ebp + 8], ebx
add esp, 0x1c
pop ebx
pop esi
pop edi
leave
jmp fcn.0078c242
mov esi, 6
jmp 0x78d990
mov dword [edi + 4], reloc.MSVCRT.dll_strncpy
mov eax, dword [reloc.MSVCRT.dll_strncpy]
mov dword [ebx + 0x18], eax
mov dword [esp], ebx
call fcn.0078d5c2
mov eax, GetInterfaceInfo
jmp 0x78d934
mov eax, GetInterfaceInfo
jmp 0x78d934
Function at 0x796f62
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x24
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov eax, dword [edx + 0x78]
mov ebx, dword [edx + 0x8c]
cmp eax, ebx
mov eax, dword [edx + 0x34]
mov ebx, dword [edx + 0x7c]
jl 0x796f87
shr ebx, 2
dec ebx
shl ebx, 0x10
or ebx, eax
mov dword [esp], ebx
mov eax, dword [edx + 0x90]
mov ebx, dword [edx + 0x74]
cmp ebx, eax
jl 0x796f9f
mov ebx, eax
mov dword [esp + 0x18], ebx
mov esi, dword [edx + 0x38]
mov dword [esp + 4], esi
mov ebp, dword [edx + 0x6c]
lea edi, [esi + ebp]
mov dword [esp + 0x20], edi
mov eax, edi
neg eax
and eax, 3
mov dword [esp + 0x14], eax
mov eax, dword [edx + 0x2c]
sub eax, 0x106
sub ebp, eax
jg 0x796fcd
xor ebp, ebp
mov eax, dword [edx + 0x78]
mov dword [esp + 0x1c], eax
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [edi]
mov dword [esp + 0x10], ebx
movzx ebx, word [edi + eax - 1]
mov dword [esp + 0xc], ebx
mov edi, dword [edx + 0x40]
mov edx, dword [esp]
jmp 0x79700c
and ecx, edx
movzx ecx, word [edi + ecx*2]
cmp ecx, ebp
jbe 0x7970e0
sub edx, 0x10000
js 0x7970e0
movzx eax, word [esi + ecx - 1]
cmp eax, ebx
jne 0x796ff2
mov eax, dword [esp + 4]
movzx eax, word [eax + ecx]
cmp eax, dword [esp + 0x10]
jne 0x796ff2
mov dword [esp], edx
mov esi, dword [esp + 4]
mov edi, dword [esp + 0x20]
add esi, ecx
mov eax, dword [esp + 0x14]
mov edx, 0xfffffef8
lea edi, reloc.MSVCRT.dll_strncpy
lea esi, reloc.MSVCRT.dll_strncpy
mov eax, dword [esi + edx]
xor eax, dword [edi + edx]
jne 0x797063
mov eax, dword [esi + edx + 4]
xor eax, dword [edi + edx + 4]
jne 0x797060
add edx, 8
jne 0x797047
jmp 0x7970d1
add edx, 4
test eax, 0xffff
jne 0x797070
add edx, 2
shr eax, 0x10
sub al, 1
adc edx, 0
lea eax, [edi + edx]
mov edi, dword [esp + 0x20]
sub eax, edi
cmp eax, 0x102
jge 0x7970d1
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
cmp eax, ebx
jg 0x7970a4
mov esi, dword [esp + 8]
mov edi, dword [edx + 0x40]
mov ebx, dword [esp + 0xc]
mov edx, dword [esp]
jmp 0x796ff2
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov dword [edx + 0x70], ecx
cmp eax, ebx
jge 0x7970e0
mov esi, dword [esp + 4]
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [edi + eax - 1]
mov edi, dword [edx + 0x40]
mov dword [esp + 0xc], ebx
mov edx, dword [esp]
jmp 0x796ff2
mov edx, dword [esp + 0x38]
mov dword [esp + 0x1c], 0x102
mov dword [edx + 0x70], ecx
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
mov eax, dword [edx + 0x74]
cmp ebx, eax
jg 0x7970f1
mov eax, ebx
add esp, 0x24
pop ebx
pop esi
pop edi
pop ebp
Function at 0xa4cb8a
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.00a4cd3a
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0xa4cc88
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0xa4cc2b
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0xa4cc6e
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0xa4cc42
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0xa4cc5d
test al, 0x40
je 0xa4cc54
mov ecx, dword [edi + 0x20]
jmp 0xa4cc5b
test al, 0x80
je 0xa4cc6e
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0xa4cc6e
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0xa4cbfa
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0xb69671
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0xb69694
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0xb69694
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0xb6969e
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0xb696e0
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0xb69742
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0xb6973d
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0xb69728
test dl, dl
je 0xb69724
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0xb69728
add ecx, 2
add eax, 2
test dl, dl
jne 0xb69708
xor eax, eax
jmp 0xb6972d
sbb eax, eax
or eax, 1
test eax, eax
je 0xb6974e
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0xb696f5
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8