joyce8/EMBER2024-capa huggingface dataset:
Function at 0x508f0b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.004f62f1
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x508f42
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.00508f61
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x515fb5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 4], ebx
test byte [esi + 4], 1
mov edi, dword [esi + 0xc]
jne 0x51600b
push 5
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x515fe4
call fcn.004f70bf
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x515ff9
call fcn.004f70bf
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x51600b
call fcn.004f70bf
call fcn.004f62f1
cmp dword [eax + 0x3c], 0
je 0x516020
push edi
mov ecx, ebx
call fcn.005156e5
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.005161f2
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x516049
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x88], 0
test ebx, ebx
je 0x516055
mov edi, ebx
mov dword [eax + 0x88], ebx
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x5288ca
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
push edi
test esi, esi
jne 0x5288e4
call fcn.004f62f1
mov esi, dword [eax + 0xc]
push 0x695adc
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, eax
test ebx, ebx
je 0x52893a
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x52893a
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
test eax, eax
jne 0x528919
xor esi, esi
jmp 0x52892f
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 8]
push eax
push dword [ebp - 4]
call fcn.00528943
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
jmp 0x52893c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x5ab174
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [edi + 4]
call fcn.004f4704
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongA]
push dword [ebp + 0xc]
mov esi, eax
mov ecx, edi
and esi, 3
call fcn.005ab38d
cmp esi, 3
je 0x5ab1b2
mov dword [edi + 0xc], 1
cmp dword [edi], 0
je 0x5ab1fb
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov esi, dword [ebp + 0x10]
test eax, eax
jle 0x5ab1d5
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, esi
call fcn.004ec734
jmp 0x5ab1e6
push 0xff
mov ecx, esi
call fcn.0040e840
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, esi
call fcn.0040dbb0
jmp 0x5ab21f
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x5ab21f
push dword [esi]
push dword [ebp - 4]
call fcn.00512489
pop edi
pop esi
leave
ret 0xc

Function at 0x5ab2e4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.005ab38d
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x5ab32c
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.004ec734
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.0040dbb0
jmp 0x5ab337
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.00512489
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x5f8f9f
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.0062b5c6
call fcn.004f6345
cmp dword [eax + 0x14], 0
jne 0x5f8fba
mov ecx, esi
pop esi
jmp fcn.005f82ca
pop esi
ret

Function at 0x5f90c3
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
call fcn.006484e4
pop ecx
test eax, eax
jne 0x5f9105
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str._s_s_X.tmp
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.00427fb0
add esp, 0x18
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x5f90cb
leave
ret
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
leave
ret

Function at 0x612b34
Capabilities:
Get common file path
Get file system object information

Disassembly:
push esi
mov esi, ecx
call fcn.004f1967
call fcn.004f6345
cmp dword [eax + 0x14], 0
jne 0x612b4f
mov ecx, esi
pop esi
jmp fcn.006123b0
pop esi
ret

Function at 0x64fb32
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0064f9b1
Function at 0x653767
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00653427
Function at 0x401030
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push esi
push 0x200
mov esi, eax
push 0
push esi
call fcn.0040ab60
add esp, 0xc
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push str.SoftWareSogouInput
push 0x80000002
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x401075
xor al, al
pop esi
add esp, 0xc
ret
mov eax, dword [esp + 0x14]
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 8]
push esi
lea edx, [esp + 0x14]
push edx
push 0
push eax
push ecx
mov dword [esp + 0x24], 1
mov dword [esp + 0x20], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [esp + 4]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
sete al
pop esi
add esp, 0xc
ret

Function at 0x401440
Capabilities:
Create http request

Disassembly:
mov eax, 0x1008
call fcn.0040abe0
mov eax, dword [0x4352dc]
xor eax, esp
mov dword [esp + 0x1004], eax
push ebx
push ebp
mov ebp, dword [esp + 0x1014]
push edi
push 0
push 0
push 0
push 0
push str.SOGOUPY_POPTEST
xor bl, bl
call dword [sym.imp.WININET.dll_InternetOpenW]
mov edi, eax
test edi, edi
je 0x40151b
push esi
mov esi, dword [sym.imp.WININET.dll_InternetSetOptionW]
push 4
lea eax, [esp + 0x14]
push eax
push 2
push edi
mov dword [esp + 0x20], 0xbb8
call esi
push 4
lea ecx, [esp + 0x14]
push ecx
push 5
push edi
call esi
push 4
lea edx, [esp + 0x14]
push edx
push 6
push edi
call esi
push 4
lea eax, [esp + 0x14]
push eax
push 8
push edi
call esi
xor ecx, ecx
push 0xffe
push ecx
lea edx, [esp + 0x1e]
push edx
mov word [esp + 0x20], cx
call fcn.0040ab60
push ebp
lea eax, [esp + 0x24]
push 0x800
push eax
call fcn.00407d46
add esp, 0x18
lea esi, [esp + 0x14]
call fcn.00401310
push 0
push 0x84200000
push 0
push 0
mov ecx, esi
push ecx
push edi
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
test eax, eax
je 0x401517
push eax
mov bl, 1
call esi
push edi
call esi
pop esi
mov ecx, dword [esp + 0x1010]
pop edi
pop ebp
mov al, bl
pop ebx
xor ecx, esp
call fcn.00407401
add esp, 0x1008
ret
Function at 0x401e80
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov ebx, eax
mov eax, dword [esp + 0x20]
mov esi, ecx
mov ecx, dword [eax]
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x10]
push edx
mov edx, dword [esi + 4]
push eax
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x20]
push ecx
push 0
push ebx
push edx
mov dword [esp + 0x30], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
je 0x401fab
test ebx, ebx
je 0x401f57
cmp word [ebx], 0
je 0x401f57
cmp byte [esi + 0x128], 0
je 0x401ee9
add esi, 0x18
mov dword [esp + 0x20], esi
jmp 0x401ef0
mov eax, dword [esi + 0x14]
mov dword [esp + 0x20], eax
mov ecx, ebp
call fcn.004036a0
mov esi, eax
call fcn.004037f0
mov ecx, ebp
call fcn.004036a0
push 0x425968
mov esi, eax
push 0x425b40
mov edx, esi
call fcn.00403d10
mov ecx, dword [esp + 0x28]
add ecx, 4
push ecx
push 0x425b40
mov edx, esi
call fcn.00403d10
push 0x425950
push 0x425b40
mov edx, esi
call fcn.00403d10
push ebx
push 0x425b40
mov edx, esi
call fcn.00403d10
add esp, 0x20
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0x10
cmp byte [esi + 0x128], 0
lea ebx, [esi + 0x18]
jne 0x401f66
mov ebx, dword [esi + 0x14]
mov ecx, ebp
call fcn.004036a0
mov esi, eax
call fcn.004037f0
mov ecx, ebp
call fcn.004036a0
mov esi, eax
push 0x425968
push 0x425b40
mov edx, esi
call fcn.00403d10
add ebx, 4
push ebx
push 0x425b40
mov edx, esi
call fcn.00403d10
add esp, 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0x10
mov edx, dword [esp + 0x18]
cmp edx, dword [esp + 0x24]
je 0x402045
test ebx, ebx
je 0x401ffd
cmp word [ebx], 0
je 0x401ffd
cmp byte [esi + 0x128], 0
je 0x401fd5
add esi, 0x18
mov dword [esp + 0x20], esi
jmp 0x401fdc
mov eax, dword [esi + 0x14]
mov dword [esp + 0x20], eax
mov ecx, ebp
call fcn.004036a0
xor edi, edi
mov esi, eax
call fcn.004037f0
mov ecx, ebp
call fcn.004036a0
push 0x425978
jmp 0x401f0a
cmp byte [esi + 0x128], 0
je 0x40200b
add esi, 0x18
jmp 0x40200e
mov esi, dword [esi + 0x14]
mov ecx, ebp
call fcn.004036a0
mov edi, eax
push 0x425978
push 0x425b40
mov edx, edi
call fcn.00403d10
add esi, 4
push esi
push 0x425b40
mov edx, edi
call fcn.00403d10
add esp, 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0x10
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword [eax], edx
mov al, 1
pop ebx
pop ecx
ret 0x10

Function at 0x403160
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp byte [ecx + 0x11c], 0
lea eax, [ecx + 0xc]
jne 0x40316f
mov eax, dword [ecx + 8]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x403181
xor al, al
ret
shr eax, 4
not eax
and eax, 1
ret
Function at 0x404b50
Capabilities:
Get file version info

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
lea eax, [esp + 0xc]
xor ebx, ebx
push eax
push edi
mov byte [esp + 0x13], 0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [esp + 0xc], eax
cmp eax, ebx
jne 0x404b87
pop ebp
xor al, al
pop ebx
add esp, 0x10
ret
push eax
call fcn.00407645
mov ecx, dword [esp + 0x10]
add esp, 4
mov ebx, eax
push ebx
push ecx
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x404c09
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push 0x425950
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x404c09
mov eax, dword [esp + 0x10]
movzx ecx, word [eax + 0xa]
mov word [esi], cx
movzx edx, word [eax + 8]
mov word [esi + 2], dx
movzx ecx, word [eax + 0xe]
mov word [esi + 4], cx
movzx edx, word [eax + 0xc]
mov word [esi + 6], dx
test ebp, ebp
je 0x404c04
movzx ecx, word [eax + 0x12]
mov word [ebp], cx
movzx edx, word [eax + 0x10]
mov word [ebp + 2], dx
movzx ecx, word [eax + 0x16]
mov word [ebp + 4], cx
movzx edx, word [eax + 0x14]
mov word [ebp + 6], dx
mov byte [esp + 0xb], 1
test ebx, ebx
je 0x404c16
push ebx
call fcn.00407568
add esp, 4
mov al, byte [esp + 0xb]
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x404c20
Capabilities:
Get common file path

Disassembly:
sub esp, 0x21c
mov eax, dword [0x4352dc]
xor eax, esp
mov dword [esp + 0x218], eax
push ebp
mov ebp, dword [esp + 0x224]
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x1e]
push ecx
mov word [esp + 0x20], ax
call fcn.0040ab60
add esp, 0xc
push 0x104
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
test eax, eax
jne 0x404c82
xor al, al
pop ebp
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.00407401
add esp, 0x21c
ret
push esi
push edi
push str.kernel32.dll
lea eax, [esp + 0x20]
push 0x104
push eax
call fcn.00407a5d
lea ecx, [esp + 0x18]
push ecx
lea esi, [esp + 0x24]
lea edi, [esp + 0x2c]
call fcn.00404b50
add esp, 0x10
pop edi
pop esi
test al, al
je 0x404c6a
movzx edx, word [esp + 0xc]
movzx eax, word [esp + 0xe]
movzx ecx, word [esp + 0x10]
mov dword [ebx + 4], edx
mov dword [ebx + 8], eax
xor edx, edx
mov eax, 2
mov dword [ebx], 0x114
mov dword [ebx + 0xc], ecx
mov dword [ebx + 0x10], eax
mov word [ebx + 0x14], dx
test ebp, ebp
je 0x404d0b
movzx ecx, word [esp + 4]
movzx edx, word [esp + 6]
mov dword [ebp + 4], ecx
movzx ecx, word [esp + 8]
mov dword [ebp + 8], edx
xor edx, edx
mov dword [ebp], 0x114
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x10], eax
mov word [ebp + 0x14], dx
mov ecx, dword [esp + 0x21c]
pop ebp
xor ecx, esp
mov al, 1
call fcn.00407401
add esp, 0x21c
ret
Function at 0x405510
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x437a10], 0
je 0x405565
mov eax, dword [0x437a18]
push eax
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
test eax, eax
je 0x405565
cmp dword [eax], 0xd
jbe 0x405565
mov ecx, dword [eax + 8]
mov eax, dword [ecx + 0x34]
test eax, eax
je 0x405565
push 0
push 0x437c70
push 0x437c50
push 0
push eax
call fcn.0040aa88
add esp, 0x14
test eax, eax
je 0x405565
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 8]
call eax
mov ecx, dword [esp + 4]
mov dword [ecx], eax
mov al, 1
ret
xor al, al
ret

Function at 0x405570
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x437a10], 0
push esi
push edi
mov esi, eax
je 0x4055b9
mov eax, dword [0x437a18]
mov edi, dword [sym.imp.KERNEL32.DLL_TlsGetValue]
push eax
call edi
test eax, eax
je 0x4055b9
cmp dword [eax], 0xd
jbe 0x4055b9
mov ecx, dword [eax + 8]
mov ecx, dword [ecx + 0x34]
test ecx, ecx
jne 0x4055e6
push 8
call fcn.00407ec3
add esp, 4
test eax, eax
je 0x4055be
mov dword [eax + 4], esi
mov dword [eax], vtable.t_visualDataItemPtr_class_t_perfManager_.0
mov esi, eax
jmp 0x4055c0
pop edi
xor al, al
pop esi
ret
xor esi, esi
cmp dword [0x437a10], 0
je 0x4055ee
mov edx, dword [0x437a18]
push edx
call edi
test eax, eax
je 0x4055ee
cmp dword [eax], 0xd
jbe 0x4055ee
mov eax, dword [eax + 8]
mov dword [eax + 0x34], esi
pop edi
mov al, 1
pop esi
ret
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
push esi
call eax
pop edi
mov al, 1
pop esi
ret

Function at 0x407401
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4352dc]
jne 0x40740b
repz ret
jmp fcn.0040b041
Function at 0x41311f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00409d9d
and dword [ebp - 4], 0
cmp dword [0x438da4], 0
mov ebx, eax
jne 0x4131d0
push str.USER32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x413281
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x413281
push eax
call fcn.00409d2b
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x438da4], eax
call esi
push eax
call fcn.00409d2b
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x438da8], eax
call esi
push eax
call fcn.00409d2b
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x438dac], eax
call esi
push eax
call fcn.00409d2b
pop ecx
mov dword [0x438db4], eax
test eax, eax
je 0x4131d0
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00409d2b
pop ecx
mov dword [0x438db0], eax
mov eax, dword [0x438db0]
cmp eax, ebx
je 0x413228
cmp dword [0x438db4], ebx
je 0x413228
push eax
call fcn.00409da6
push dword [0x438db4]
mov esi, eax
call fcn.00409da6
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x413228
test edi, edi
je 0x413228
call esi
test eax, eax
je 0x41321f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41321f
test byte [ebp - 0xc], 1
jne 0x413228
or dword [ebp + 0x10], 0x200000
jmp 0x413261
mov eax, dword [0x438da8]
cmp eax, ebx
je 0x413261
push eax
call fcn.00409da6
pop ecx
test eax, eax
je 0x413261
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x413261
mov eax, dword [0x438dac]
cmp eax, ebx
je 0x413261
push eax
call fcn.00409da6
pop ecx
test eax, eax
je 0x413261
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x438da4]
call fcn.00409da6
pop ecx
test eax, eax
je 0x413281
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x413283
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405b19
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.00402760
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x405bb4
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x4089e4]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x405bb4
cmp eax, 1
je 0x405bd5
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x405bb4
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x405b81
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x405bb0
xor eax, eax
inc eax
jmp 0x405bf4
cmp edi, eax
jae 0x405bb8
xor eax, eax
jmp 0x405bf4
cmp eax, esi
jae 0x405bbf
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x4089e4]
jmp 0x405bd8
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x402450
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jne 0x402475
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 0x1c], 0
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov ecx, 0x4030a8
sub ecx, 0x4030a4
sar ecx, 2
push ecx
push 0x4030a4
call fcn.00402560
add esp, 8
mov edx, 0x4030a0
sub edx, 0x40309c
sar edx, 2
push edx
push 0x40309c
call fcn.00402560
add esp, 8
mov eax, dword [ebp - 0x1c]
and eax, 1
je 0x4024cf
movzx ecx, word [ebp - 0x18]
mov dword [ebp - 0x54], ecx
jmp 0x4024d6
mov dword [ebp - 0x54], 0xa
mov edx, dword [ebp - 0x54]
push edx
mov eax, dword [ebp - 0x50]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x4c], eax
mov ecx, dword [0x40368c]
push ecx
mov edx, dword [0x403688]
push edx
call fcn.004025a0
add esp, 8
mov eax, dword [0x403688]
push eax
call fcn.00402420
add esp, 4
mov ecx, 0x4030b0
sub ecx, 0x4030ac
sar ecx, 2
push ecx
push 0x4030ac
call fcn.00402560
add esp, 8
mov edx, 0x4030b8
sub edx, 0x4030b4
sar edx, 2
push edx
push 0x4030b4
call fcn.00402560
add esp, 8
call fcn.004025d0
mov eax, dword [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x100025e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x1000262c
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x1000260f
cmp edi, 2
jb 0x1000260f
cmp byte [esi], cl
jne 0x1000260f
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100347b0]
test edi, edi
jne 0x100025f5
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x1000265b
cmp cl, 0x23
jne 0x10002642
cmp byte [esi], cl
jne 0x10002642
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x100347b0]
test cl, cl
jne 0x10002633
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x10002780
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x10002792
mov dword [edi], 0
mov edx, 0x10034624
call fcn.10002670
mov esi, eax
test esi, esi
jne 0x100027a6
pop edi
pop esi
pop ebp
ret
push ebx
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10002859
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
je 0x10002859
push 0
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10002859
mov eax, dword [0x100604b8]
test eax, eax
je 0x100027f3
inc dword [eax + 0x370]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [ebp + 8], eax
test eax, eax
je 0x10002859
push esi
push ebx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, ebx
je 0x10002842
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [0x100604b8]
add esp, 4
test eax, eax
je 0x1000282f
dec dword [eax + 0x370]
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test edi, edi
je 0x10002851
mov dword [edi], ebx
mov eax, dword [ebp + 8]
pop ebx
pop edi
pop esi
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret