joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4573de
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x47fc14]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.0044e950
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.0044e950
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x457455
cmp word [ecx], dx
je 0x457455
mov eax, dword [0x470f64]
push edi
dec eax
push eax
push 0x470e50
call fcn.0045737d
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x4574c8
cmp word [eax], dx
je 0x4574c8
mov eax, dword [edi]
test eax, eax
je 0x457479
cmp word [eax], dx
je 0x457479
lea eax, [ebp - 0x10]
push eax
call fcn.00456d60
jmp 0x457482
lea eax, [ebp - 0x10]
push eax
call fcn.00456dfb
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x4574f2
mov eax, dword [0x470e4c]
push dword [ebp - 0x14]
dec eax
push eax
push 0x470b40
call fcn.0045737d
add esp, 0xc
test al, al
je 0x4574f2
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x4574bd
cmp word [eax], di
je 0x4574bd
lea eax, [ebp - 0x10]
push eax
call fcn.00456d60
pop ecx
jmp 0x4574f4
lea eax, [ebp - 0x10]
push eax
call fcn.00456dfb
jmp 0x4574ba
mov eax, dword [edi]
test eax, eax
je 0x4574df
cmp word [eax], dx
je 0x4574df
lea eax, [ebp - 0x10]
push eax
call fcn.00456d15
pop ecx
jmp 0x4574f2
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x4575bd
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.00457202
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x4575bd
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x4575bd
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x4575bd
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x45754a
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.00450b39
test ebx, ebx
je 0x4575b8
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.00450b39
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4575bd
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4575bd
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.0045be64
add esp, 0x10
xor eax, eax
inc eax
jmp 0x4575bf
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00438d70
leave
ret
Function at 0x45aa99
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x4888d8]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x45aad9
cmp byte [ebx], 0xa
jne 0x45aad9
or byte [edi + eax + 0x28], 4
jmp 0x45aade
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x45abdd
mov dl, byte [eax]
cmp dl, 0x1a
je 0x45abc0
inc eax
cmp dl, 0xd
je 0x45ab0a
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x45ab30
cmp eax, ecx
jae 0x45ab3e
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x45aaf2
jmp 0x45abdd
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x45abbb
cmp dword [ebp - 0x10], 0
je 0x45abbb
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x4888d8]
test byte [eax + edi + 0x28], 0x48
je 0x45ab95
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x45ab80
mov byte [esi], dl
jmp 0x45ab91
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x4888d8]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x45abdd
cmp byte [ebp - 1], 0xa
jne 0x45aba4
cmp esi, ebx
jne 0x45aba4
mov byte [esi], 0xa
jmp 0x45abdc
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0045aa3b
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x45abdd
mov byte [esi], 0xd
jmp 0x45abdc
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x4888d8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x45abda
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x45abdd
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x45abe6
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x4888d8]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x45ac2c
cmp word [ebx], dx
jne 0x45ac2c
or byte [eax + edi + 0x28], 4
jmp 0x45ac31
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x45ad94
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x45ad74
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x45ac72
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x45aca8
cmp eax, edx
jae 0x45acb6
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x45ac4d
jmp 0x45ad94
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x45ad6f
cmp dword [ebp - 0x18], 0
je 0x45ad6f
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x4888d8]
test byte [eax + edi + 0x28], 0x48
je 0x45ad45
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x45ad09
mov word [esi], cx
jmp 0x45ad40
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x4888d8]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x4888d8]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x4888d8]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x45ad94
pop eax
cmp word [ebp - 4], ax
jne 0x45ad55
cmp esi, ebx
jne 0x45ad55
mov word [esi], ax
jmp 0x45ad91
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0045aa3b
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x45ad94
push 0xd
pop eax
jmp 0x45ad50
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x4888d8]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x45ad8e
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x45ad94
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x45c4f5
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.0045c471
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x45c664
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x45c664
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x45c619
jg 0x45c551
test eax, eax
je 0x45c60f
push 1
push 0x1000
call fcn.00450502
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x45c574
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x45c606
push 0x8000
push ebx
call fcn.0044cc6d
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x45c59d
jg 0x45c598
cmp ecx, 0x1000
jb 0x45c59d
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.0045244a
add esp, 0x10
cmp eax, 0xffffffff
je 0x45c5e2
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x45c598
jl 0x45c5c9
test ecx, ecx
jne 0x45c58a
push dword [ebp - 0xc]
push ebx
call fcn.0044cc6d
push esi
call fcn.0044f069
add esp, 0xc
xor ebx, ebx
jmp 0x45c672
cmp byte [edi + 0x24], 0
je 0x45c5f9
cmp dword [edi + 0x20], 5
jne 0x45c5f9
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x45c604
mov ebx, dword [edi + 0x18]
jmp 0x45c606
xor ebx, ebx
push esi
call fcn.0044f069
pop ecx
jmp 0x45c672
test ecx, ecx
jg 0x45c5db
jl 0x45c619
test eax, eax
jae 0x45c5db
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0045aa3b
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x45c639
cmp byte [edi + 0x1c], 0
je 0x45c5db
jmp 0x45c66a
push ebx
call fcn.004552d9
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x45c5db
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x45c672
cmp byte [edi + 0x1c], 0
je 0x45c66f
mov ebx, dword [edi + 0x18]
jmp 0x45c672
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.0045aa3b
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x45d3e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x45d40d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x45d40d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x404c50
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x469974
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x18], 0
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov edx, dword [0x489670]
cmp edx, dword [ecx + 4]
jle 0x404d2a
push 0x489670
call fcn.0044349c
add esp, 4
cmp dword [0x489670], 0xffffffff
jne 0x404d2a
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], 0x489658
mov ecx, dword [ebp - 0x20]
call fcn.0041d6d0
mov byte [ebp - 4], 1
mov byte [ebp - 4], 2
mov dword [ebp - 0x14], 0x4777f8
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x14]
mov dl, byte [ecx]
mov byte [ebp - 0xd], dl
add dword [ebp - 0x14], 1
cmp byte [ebp - 0xd], 0
jne 0x404cd7
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
push ecx
push 0x4777f8
mov ecx, 0x489658
call fcn.00419b30
mov byte [ebp - 4], 0
push 0x46e790
call fcn.0044376c
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0x489670
call fcn.0044344b
add esp, 4
mov ecx, dword [ebp + 8]
call fcn.00412710
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xffffffff
jne 0x404dec
push 0xffffffffffffffff
push 0x489658
mov ecx, dword [ebp + 8]
call fcn.00412570
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
je 0x404dce
mov dword [ebp - 4], 3
lea edx, [ebp - 0xe]
push edx
mov eax, dword [ebp - 0x1c]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x58]
call fcn.00416540
mov dword [ebp - 0x3c], eax
mov edx, dword [ebp - 0x18]
or edx, 1
mov dword [ebp - 0x18], edx
lea eax, [ebp - 0x58]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
push ecx
mov ecx, dword [ebp - 0x34]
call fcn.00404c50
and dword [ebp - 0x18], 0xfffffffe
mov dword [ebp - 4], 4
lea ecx, [ebp - 0x58]
call fcn.00415fd0
mov dword [ebp - 4], 0xffffffff
lea edx, [ebp - 0x58]
mov dword [ebp - 0x40], edx
mov dword [ebp - 4], 5
mov dword [ebp - 4], 6
mov dword [ebp - 4], 0xffffffff
push 0
mov ecx, dword [ebp + 8]
call fcn.00412710
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jne 0x404dec
xor al, al
jmp 0x404dee
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x405050
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x469a0e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x13b0
call fcn.004443d0
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
call fcn.00442bd6
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x38], 0xffffffff
push 0x6c078965
mov eax, dword [ebp - 0x20]
push eax
lea ecx, [ebp - 0x13bc]
call fcn.00417410
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
mov dword [edx], 0
mov eax, dword [ebp - 0x18]
mov dword [eax + 4], 0x3d
mov ecx, dword [ebp + 8]
call fcn.00412d90
mov dword [ebp - 0x34], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
or ecx, 1
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
call fcn.00412630
mov dword [ebp - 0x14], 0
jmp 0x4050f8
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp + 0xc]
jge 0x405135
mov edx, dword [ebp - 0x28]
push edx
mov eax, dword [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x13bc]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.00420e30
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x24]
mov al, byte [edx + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz]
mov byte [ebp - 0x10], al
movzx ecx, byte [ebp - 0x10]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004161c0
jmp 0x4050ef
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x405490
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
cmp dword [ebp + 8], 0
je 0x4054cb
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 8]
mov al, byte [edx]
mov byte [ebp - 1], al
add dword [ebp - 8], 1
cmp byte [ebp - 1], 0
jne 0x4054ae
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x10]
mov dword [ebp - 0x14], ecx
jne 0x4054cf
xor al, al
jmp 0x40550f
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x40550d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x44
je 0x405503
cmp dword [ebp - 0xc], 0x20
je 0x405503
cmp dword [ebp - 0xc], 0x45
je 0x405503
cmp dword [ebp - 0xc], 0x24
jne 0x405509
mov al, 1
jmp 0x40550f
xor al, al
jmp 0x40550f
mov al, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x4056b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov dword [ebp - 0xc], ecx
push 0x44
push 0
lea eax, [ebp - 0x60]
push eax
call fcn.00445020
add esp, 0xc
mov dword [ebp - 0x60], 0x44
movzx ecx, byte [ebp + 0xc]
test ecx, ecx
je 0x4056e1
mov dword [ebp - 4], 1
jmp 0x4056e8
mov dword [ebp - 4], 0
mov dx, word [ebp - 4]
mov word [ebp - 0x30], dx
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
movzx ecx, byte [ebp + 0xc]
test ecx, ecx
je 0x40570f
mov dword [ebp - 8], 0
jmp 0x405716
mov dword [ebp - 8], 0x8000000
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x60]
push eax
push 0
push 0
mov ecx, dword [ebp - 8]
push ecx
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40573e
jmp 0x40574a
push 0xffffffffffffffff
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esp, ebp
pop ebp
ret 8
Function at 0x40c600
Capabilities:
Connect socket
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c0
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x1c0]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40c641
or eax, 0xffffffff
jmp 0x40c739
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x24], 6
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40c69d
call dword [sym.imp.WS2_32.dll_WSACleanup]
or eax, 0xffffffff
jmp 0x40c739
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x40c6ae
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x1c]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x40c71b
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x40c6e3
call dword [sym.imp.WS2_32.dll_WSACleanup]
or eax, 0xffffffff
jmp 0x40c739
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x18]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.WS2_32.dll_connect]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x40c717
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [ebp - 8], 0xffffffff
jmp 0x40c6a5
jmp 0x40c71b
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
cmp dword [ebp - 8], 0xffffffff
jne 0x40c736
call dword [sym.imp.WS2_32.dll_WSACleanup]
or eax, 0xffffffff
jmp 0x40c739
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x4286f0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x270
jne 0x42870e
mov ecx, dword [ebp - 8]
call fcn.00428a20
jmp 0x428721
mov ecx, dword [ebp - 8]
cmp dword [ecx], 0x4e0
jb 0x428721
mov ecx, dword [ebp - 8]
call fcn.00428ab0
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4 + 4]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
add ecx, 1
mov edx, dword [ebp - 8]
mov dword [edx], ecx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
shr ecx, 0xb
mov edx, dword [ebp - 8]
and ecx, dword [edx + 0x1384]
xor ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
shl eax, 7
and eax, 0x9d2c5680
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
shr edx, 0x12
xor edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x428a20
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0x270
jmp 0x428a3b
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x4e0
jae 0x428aa7
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4 - 0x9bc]
and eax, 0x80000000
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [edx + ecx*4 - 0x9b8]
and ecx, 0x7fffffff
or eax, ecx
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
and edx, 1
je 0x428a7f
mov dword [ebp - 0x10], 0x9908b0df
jmp 0x428a86
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
shr eax, 1
xor eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
xor eax, dword [edx + ecx*4 - 0x388]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx + ecx*4 + 4], eax
jmp 0x428a32
mov esp, ebp
pop ebp
ret
Function at 0x428ab0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 4], ecx
mov dword [ebp - 0x28], 0x26f
mov dword [ebp - 0x2c], 0xe3
mov dword [ebp - 8], 0
jmp 0x428ad9
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xe3
jae 0x428b45
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [edx + ecx*4 + 0x9c4]
and eax, 0x80000000
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov ecx, dword [edx + ecx*4 + 0x9c8]
and ecx, 0x7fffffff
or eax, ecx
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
and edx, 1
je 0x428b1d
mov dword [ebp - 0x14], 0x9908b0df
jmp 0x428b24
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x10]
shr eax, 1
xor eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
xor eax, dword [edx + ecx*4 + 0xff8]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [edx + ecx*4 + 4], eax
jmp 0x428ad0
mov dword [ebp - 0xc], 0xe3
jmp 0x428b57
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x26f
jae 0x428bc3
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [edx + ecx*4 + 0x9c4]
and eax, 0x80000000
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov ecx, dword [edx + ecx*4 + 0x9c8]
and ecx, 0x7fffffff
or eax, ecx
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
and edx, 1
je 0x428b9b
mov dword [ebp - 0x1c], 0x9908b0df
jmp 0x428ba2
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x18]
shr eax, 1
xor eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
xor eax, dword [edx + ecx*4 - 0x388]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov dword [edx + ecx*4 + 4], eax
jmp 0x428b4e
mov dword [ebp - 0x30], 0x26f
mov eax, 4
imul ecx, eax, 0x4df
mov edx, dword [ebp - 4]
mov eax, dword [edx + ecx + 4]
and eax, 0x80000000
mov ecx, 4
imul edx, ecx, 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + edx + 4]
and edx, 0x7fffffff
or eax, edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
and eax, 1
je 0x428c0c
mov dword [ebp - 0x24], 0x9908b0df
jmp 0x428c13
mov dword [ebp - 0x24], 0
mov ecx, dword [ebp - 0x20]
shr ecx, 1
xor ecx, dword [ebp - 0x24]
mov edx, 4
imul eax, edx, 0x18c
mov edx, dword [ebp - 4]
xor ecx, dword [edx + eax + 4]
mov eax, 4
imul edx, eax, 0x26f
mov eax, dword [ebp - 4]
mov dword [eax + edx + 4], ecx
mov ecx, dword [ebp - 4]
mov dword [ecx], 0
mov esp, ebp
pop ebp
ret