joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a7460
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x61c868]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a756a
sub esp, 0x1c
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x4a7496
lea eax, [0x53a284]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], 1
add esp, 0x1c
ret
dec eax
mov dword [esp + 0x14], eax
test eax, eax
jne 0x4a74a2
xor ecx, ecx
jmp 0x4a74be
mov ecx, dword [esp + 0x20]
movzx edx, byte [eax + ecx - 1]
mov byte [esp], dl
call sym.internal_filepathlite.IsPathSeparator
movzx eax, byte [esp + 4]
mov ecx, eax
mov eax, dword [esp + 0x14]
test cl, cl
jne 0x4a7495
mov ecx, dword [esp + 0x20]
mov dword [esp], ecx
mov dword [esp + 4], eax
call sym.internal_filepathlite.VolumeName
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
sub ecx, eax
mov dword [esp + 0x14], ecx
mov edx, ecx
neg ecx
sar ecx, 0x1f
and eax, ecx
mov ecx, dword [esp + 0x20]
add eax, ecx
mov dword [esp + 0x18], eax
lea ecx, [edx - 1]
jmp 0x4a74f9
dec ecx
test ecx, ecx
jge 0x4a7501
xor ebx, ebx
jmp 0x4a7527
mov dword [esp + 0x10], ecx
movzx edx, byte [eax + ecx]
mov byte [esp], dl
call sym.internal_filepathlite.IsPathSeparator
movzx eax, byte [esp + 4]
xor eax, 1
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ebx, eax
mov eax, dword [esp + 0x18]
test bl, bl
jne 0x4a74f8
test ecx, ecx
jl 0x4a7542
sub edx, ecx
dec edx
mov ebx, edx
neg edx
sar edx, 0x1f
lea ebp, [ecx + 1]
and edx, ebp
add eax, edx
jmp 0x4a7544
mov ebx, edx
test ebx, ebx
jne 0x4a755e
lea eax, [0x53a2dc]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], 1
add esp, 0x1c
ret
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ebx
add esp, 0x1c
ret
call sym.runtime.morestack_noctxt
jmp sym.internal_filepathlite.Base
Function at 0x4b0f60
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x61c868]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4b1039
sub esp, 0x10
mov eax, dword [esp + 0x14]
movzx ecx, byte [eax + 4]
test cl, cl
je 0x4b101b
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x4b101b
mov eax, dword [esp + 0x18]
mov dword [esp], eax
mov ecx, dword [esp + 0x1c]
mov dword [esp + 4], ecx
call sym.unicode_utf8.RuneCountInString
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x10]
movzx edx, byte [eax + 6]
sub ecx, dword [esp + 8]
test dl, dl
je 0x4b0fed
mov dword [esp + 0xc], ecx
mov ecx, dword [eax]
mov dword [esp], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 8], ecx
call sym.fmt._buffer_.writeString
mov eax, dword [esp + 0x14]
mov dword [esp], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 4], eax
call sym.fmt._fmt_.writePadding
jmp 0x4b1017
mov dword [esp], eax
mov dword [esp + 4], ecx
call sym.fmt._fmt_.writePadding
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], eax
call sym.fmt._buffer_.writeString
add esp, 0x10
ret
mov eax, dword [eax]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], eax
call sym.fmt._buffer_.writeString
add esp, 0x10
ret
call sym.runtime.morestack_noctxt
jmp sym.fmt._fmt_.padString
Function at 0x4b8180
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x61c868]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4b8221
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [esp + 0x18]
cmp dword [edx], ecx
jne 0x4b8217
movzx ecx, byte [eax + 4]
cmp byte [edx + 4], cl
jne 0x4b8217
movzx ecx, byte [eax + 5]
cmp byte [edx + 5], cl
jne 0x4b8217
movzx ecx, byte [eax + 6]
cmp byte [edx + 6], cl
jne 0x4b8217
movzx ecx, byte [eax + 7]
cmp byte [edx + 7], cl
jne 0x4b8217
movzx ecx, byte [eax + 8]
cmp byte [edx + 8], cl
jne 0x4b8217
movzx ecx, byte [eax + 9]
cmp byte [edx + 9], cl
jne 0x4b8217
movzx ecx, byte [eax + 0xa]
cmp byte [edx + 0xa], cl
jne 0x4b8217
movzx ecx, byte [eax + 0xb]
cmp byte [edx + 0xb], cl
jne 0x4b8217
movzx ecx, byte [eax + 0xc]
cmp byte [edx + 0xc], cl
jne 0x4b8217
add eax, 0x10
mov dword [esp], eax
lea eax, [edx + 0x10]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x4c
call sym.runtime.memequal
movzx eax, byte [esp + 0xc]
jmp 0x4b8219
xor eax, eax
mov byte [esp + 0x1c], al
add esp, 0x10
ret
call sym.runtime.morestack_noctxt
jmp sym.type:.eq.fmt.fmt
Function at 0x4ba460
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x61c868]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4ba60a
sub esp, 0x54
lea edi, [esp + 0x60]
xor eax, eax
call fcn.0047548b
mov ecx, dword [esp + 0x58]
mov edx, dword [esp + 0x5c]
xor ebx, ebx
jmp 0x4ba48f
inc ebx
cmp edx, ebx
jle 0x4ba5ae
movzx ebp, byte [ecx + ebx]
xchg ebp, eax
cmp al, 0x25
xchg ebp, eax
je 0x4ba552
xchg ebp, eax
cmp al, 0x2e
xchg ebp, eax
je 0x4ba503
xchg ebp, eax
cmp al, 0x3a
xchg ebp, eax
jne 0x4ba48e
lea edi, [esp + 0x28]
call fcn.0047548b
mov ecx, dword [esp + 0x58]
mov dword [esp], ecx
mov dword [esp + 4], edx
call sym.net_netip.parseIPv6
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0x20]
lea edi, [esp + 0x28]
lea esi, [esp + 8]
call fcn.0047596e
lea edi, [esp + 0x60]
lea esi, [esp + 0x28]
call fcn.0047596e
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x74], ecx
mov dword [esp + 0x78], edx
add esp, 0x54
ret
lea edi, [esp + 0x28]
call fcn.0047548b
mov ecx, dword [esp + 0x58]
mov dword [esp], ecx
mov dword [esp + 4], edx
call sym.net_netip.parseIPv4
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0x20]
lea edi, [esp + 0x28]
lea esi, [esp + 8]
call fcn.0047596e
lea edi, [esp + 0x60]
lea esi, [esp + 0x28]
call fcn.0047596e
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x74], ecx
mov dword [esp + 0x78], edx
add esp, 0x54
ret
lea edi, [esp + 0x3c]
call fcn.0047548a
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
lea ecx, [0x529642]
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], 0x14
lea edi, [esp + 0x60]
call fcn.0047548b
lea ecx, [0x516100]
mov dword [esp], ecx
lea ecx, [esp + 0x3c]
mov dword [esp + 4], ecx
call sym.runtime.convT
mov ecx, dword [esp + 8]
lea edx, [0x53b630]
mov dword [esp + 0x74], edx
mov dword [esp + 0x78], ecx
add esp, 0x54
ret
lea edi, [esp + 0x3c]
call fcn.0047548a
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
lea ecx, [0x528843]
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], 0x12
lea edi, [esp + 0x60]
call fcn.0047548b
lea ecx, [0x516100]
mov dword [esp], ecx
lea ecx, [esp + 0x3c]
mov dword [esp + 4], ecx
call sym.runtime.convT
mov ecx, dword [esp + 8]
lea edx, [0x53b630]
mov dword [esp + 0x74], edx
mov dword [esp + 0x78], ecx
add esp, 0x54
ret
call sym.runtime.morestack_noctxt
jmp sym.net_netip.ParseAddr
Function at 0x4c3150
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x61c868]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4c3278
sub esp, 0x1c
mov eax, dword [esp + 0x20]
movzx ecx, word [eax]
mov edx, dword [esp + 0x24]
mov dword [esp], edx
mov edx, dword [esp + 0x28]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x2c]
mov dword [esp + 8], edx
mov word [esp + 0xc], cx
call sym.vendor_golang.org_x_net_dns_dnsmessage.packUint16
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x20]
movzx ebp, word [ebx + 2]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov word [esp + 0xc], bp
call sym.vendor_golang.org_x_net_dns_dnsmessage.packUint16
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x20]
movzx ebp, word [ebx + 4]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov word [esp + 0xc], bp
call sym.vendor_golang.org_x_net_dns_dnsmessage.packUint16
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x20]
movzx ebp, word [ebx + 6]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov word [esp + 0xc], bp
call sym.vendor_golang.org_x_net_dns_dnsmessage.packUint16
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x20]
movzx ebp, word [ebx + 8]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov word [esp + 0xc], bp
call sym.vendor_golang.org_x_net_dns_dnsmessage.packUint16
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x20]
movzx ebx, word [ebx + 0xa]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov word [esp + 0xc], bx
call sym.vendor_golang.org_x_net_dns_dnsmessage.packUint16
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], edx
add esp, 0x1c
ret
call sym.runtime.morestack_noctxt
jmp sym.vendor_golang.org_x_net_dns_dnsmessage._header_.pack
Function at 0x4c4960
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x61c868]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4c4abd
sub esp, 0x5c
lea edi, [esp + 0x7c]
xor eax, eax
call fcn.00475487
mov ecx, dword [esp + 0x60]
test ecx, ecx
je 0x4c4998
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x68]
mov eax, dword [esp + 0x60]
jmp 0x4c49c1
lea eax, [0x506260]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x200
call sym.runtime.makeslice
mov eax, dword [esp + 0xc]
xor ecx, ecx
mov edx, 0x200
mov dword [esp + 0x30], ecx
lea edi, [esp + 0x34]
mov ebx, eax
xor eax, eax
call fcn.00475487
mov dword [esp + 0x34], ebx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], edx
mov dword [esp + 0x50], ecx
lea ecx, [esp + 0x6c]
mov dword [esp], ecx
call sym.vendor_golang.org_x_net_dns_dnsmessage._Header_.pack
movzx ecx, word [esp + 4]
movzx edx, word [esp + 6]
mov word [esp + 0x42], cx
mov word [esp + 0x44], dx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
lea ebx, [edx + 0xc]
mov ebp, dword [esp + 0x34]
cmp ecx, ebx
jae 0x4c4a67
mov dword [esp + 0x30], edx
mov dword [esp], ebp
mov dword [esp + 4], ebx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 0xc
lea eax, [0x506260]
mov dword [esp + 0x10], eax
call sym.runtime.growslice
mov ebp, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x58], ebp
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], ecx
lea eax, [ebp + edx]
mov dword [esp], eax
lea eax, [esp + 0x20]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xc
call sym.runtime.memmove
mov eax, dword [esp + 0x58]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x3c], eax
mov byte [esp + 0x40], 1
lea edi, [esp + 0x7c]
lea esi, [esp + 0x34]
call fcn.00475946
add esp, 0x5c
ret
call sym.runtime.morestack_noctxt
jmp sym.vendor_golang.org_x_net_dns_dnsmessage.NewBuilder
Function at 0x4d9100
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x61c868]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4d9271
sub esp, 0x48
mov eax, dword [esp + 0x78]
cmp eax, 4
jne 0x4d9197
mov ecx, dword [esp + 0x74]
cmp dword [ecx], 0x6c616964
je 0x4d9136
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
jmp 0x4d91a3
mov eax, dword [esp + 0x64]
mov ecx, dword [eax + 0x18]
mov edx, dword [esp + 0x68]
mov dword [esp], edx
call ecx
movzx eax, byte [esp + 4]
test al, al
jne 0x4d9161
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
jmp 0x4d91a3
mov eax, dword [esp + 0x64]
mov eax, dword [eax + 0x20]
mov ecx, dword [esp + 0x68]
mov dword [esp], ecx
mov ecx, dword [esp + 0x54]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x58]
mov dword [esp + 8], edx
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, eax
mov ebx, ecx
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
jmp 0x4d91a3
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], ebx
mov ebp, dword [esp + 0x54]
mov dword [esp], ebp
mov esi, dword [esp + 0x58]
mov dword [esp + 4], esi
mov edi, dword [esp + 0x5c]
mov dword [esp + 8], edi
mov edi, dword [esp + 0x60]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
call sym.net.favoriteAddrFamily
mov eax, dword [esp + 0x20]
movzx ecx, byte [esp + 0x24]
mov edx, dword [esp + 0x4c]
mov dword [esp], edx
mov edx, dword [esp + 0x50]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x54]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x58]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], cl
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x30], eax
call sym.net.socket
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], ecx
mov dword [esp + 0x88], edx
add esp, 0x48
ret
call sym.runtime.morestack_noctxt
jmp sym.net.internetSocket
Function at 0x403b10
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6ac
push ebx
push esi
push edi
lea edi, [ebp - 0x6ac]
mov ecx, 0x1ab
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x4f1234]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x5c4]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
mov dword [ebp - 0x5d0], eax
cmp dword [ebp - 0x5d0], 0
je 0x403b76
mov eax, dword [ebp - 0x5d0]
push eax
push str.WSAStartup_failed:__d_n
call fcn.00448f00
add esp, 8
mov eax, 1
jmp 0x403d29
mov eax, 4
shl eax, 0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + eax]
push edx
call sub.WS2_32.dll_inet_addr
mov dword [ebp - 0x14], eax
cmp dword [ebp + 8], 3
je 0x403bb6
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + ecx]
push eax
push str.Usage:__s_hostname_Messagge_to_send_n
call fcn.00448f00
add esp, 8
xor eax, eax
jmp 0x403d29
push 0xc98d
call sub.WS2_32.dll_htons
mov word [ebp - 0x16], ax
mov eax, 2
mov word [ebp - 0x18], ax
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov dword [ebp - 0x5dc], eax
cmp dword [ebp - 0x5dc], 0
jg 0x403c13
push 0x401299
mov eax, dword [ebp - 0x5dc]
push eax
push str.Socketfehler___IDSocket:
push 0x4f3fb8
call fcn.00401532
add esp, 8
mov ecx, eax
call fcn.004010e6
mov ecx, eax
call fcn.00401537
push 0x10
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x5dc]
push ecx
call sub.WS2_32.dll_connect
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 0
jge 0x403c52
push 0x401299
push str.connect_Fehler
push 0x4f3fb8
call fcn.00401532
add esp, 8
mov ecx, eax
call fcn.00401537
push 0
mov eax, 4
shl eax, 1
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + eax]
push edx
call fcn.00448670
add esp, 4
add eax, 1
push eax
mov eax, 4
shl eax, 1
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + eax]
push edx
mov eax, dword [ebp - 0x5dc]
push eax
call sub.WS2_32.dll_send
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 0
jge 0x403cb5
push 0x401299
push str.send_Fehler
push 0x4f3fb8
call fcn.00401532
add esp, 8
mov ecx, eax
call fcn.00401537
push 0
push 0x400
lea eax, [ebp - 0x420]
push eax
mov ecx, dword [ebp - 0x5dc]
push ecx
call sub.WS2_32.dll_recv
mov dword [ebp - 0x5e8], eax
push 0x401299
mov eax, dword [ebp - 0x5e8]
push eax
push 0x4cd744
mov ecx, 1
imul edx, ecx, 0
movzx eax, byte [ebp + edx - 0x420]
push eax
push 0x4f3fb8
call fcn.0040132f
add esp, 8
push eax
call fcn.00401532
add esp, 8
mov ecx, eax
call fcn.004010e6
mov ecx, eax
call fcn.00401537
mov eax, dword [ebp - 0x5dc]
push eax
call sub.WS2_32.dll_closesocket
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x403d58]
call fcn.0044d6f0
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044d780
add esp, 0x6ac
cmp ebp, esp
call fcn.0044d750
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44e004]
jne 0x40100a
repz ret
jmp fcn.00401a32

Function at 0x40947b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x44e004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00402662
and dword [ebp - 0x14], 0
cmp dword [0x450728], 0
mov dword [ebp - 0x18], eax
jne 0x40952e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4095d6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4095d6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x450728], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x45072c], eax
call edi
push eax
call esi
push 0x44c8f0
push ebx
mov dword [0x450730], eax
call edi
push eax
call esi
mov dword [0x450738], eax
test eax, eax
je 0x40952e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x450734], eax
mov eax, dword [0x450734]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x409587
cmp dword [0x450738], ecx
je 0x409587
push eax
call esi
push dword [0x450738]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x409587
test ebx, ebx
je 0x409587
call edi
test eax, eax
je 0x40957e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40957e
test byte [ebp - 8], 1
jne 0x409587
or dword [ebp + 0x10], 0x200000
jmp 0x4095ba
mov eax, dword [0x45072c]
cmp eax, dword [ebp - 0x18]
je 0x4095ba
push eax
call esi
test eax, eax
je 0x4095ba
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4095ba
mov eax, dword [0x450730]
cmp eax, dword [ebp - 0x18]
je 0x4095ba
push eax
call esi
test eax, eax
je 0x4095ba
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x450728]
call esi
test eax, eax
je 0x4095d6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4095d8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret

Function at 0x44a580
Capabilities:
Get disk information

Disassembly:
mov eax, dword [0x4520fc]
push ebx
push esi
mov esi, dword [0x451e1c]
mov ebx, eax
cmp eax, 0x5dd
jne 0x44a5a2
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov eax, dword [0x44f1d0]
call fcn.0044a460
cmp dword [0x4520fc], 0x2f
jne 0x44a5bd
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push esi
call fcn.0044a4a0
add esp, 4
cmp dword [0x4520fc], 0x568
pop esi
pop ebx
jne 0x44a5ea
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaProcessorNode]
ret
Function at 0x10010730
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 0xc]
mov edx, ecx
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x18], edx
cmp ebx, eax
je 0x100108d4
mov eax, dword [edx + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 8], eax
movzx eax, byte [ebx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebx + 9]
push esi
push edi
mov edi, dword [edx + 0xc]
mov esi, ebx
xor ecx, eax
mov dword [ebp - 0x20], edi
movzx eax, byte [ebx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [edx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 4], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
nop word [eax + eax]
mov ebx, esi
mov dword [ebp - 0x14], esi
mov esi, dword [esi]
lea ecx, [ebx + 0x24]
call fcn.10010900
lea ecx, [ebx + 0x18]
call fcn.100100a0
lea ecx, [ebx + 0xc]
call fcn.100100a0
push 0x3c
push ebx
call fcn.1009359a
mov edx, dword [ebp - 0x18]
add esp, 8
mov eax, dword [ebp - 0x10]
dec dword [edx + 8]
cmp ebx, eax
je 0x10010810
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x100107b0
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x100108ca
mov edi, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov dword [edi], esi
mov dword [ecx], esi
pop edi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x10010824
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dword [edi], eax
jmp 0x10010827
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edi + 4], ecx
cmp esi, eax
je 0x100108ca
nop word [eax + eax]
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [edx + 0x18]
and ecx, eax
mov eax, dword [ebp - 0x20]
lea eax, [eax + ecx*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov ebx, esi
mov dword [ebp - 0x10], esi
mov esi, dword [esi]
lea ecx, [ebx + 0x24]
call fcn.10010900
lea ecx, [ebx + 0x18]
call fcn.100100a0
lea ecx, [ebx + 0xc]
call fcn.100100a0
push 0x3c
push ebx
call fcn.1009359a
mov edx, dword [ebp - 0x18]
add esp, 8
mov eax, dword [ebp - 0x14]
dec dword [edx + 8]
cmp ebx, eax
mov eax, dword [ebp + 0xc]
je 0x100108db
cmp esi, eax
jne 0x10010887
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp - 0x1c]
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
cmp esi, eax
jne 0x10010840
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10030600
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100959e8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x100b3008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x18], edi
xorps xmm0, xmm0
mov dword [ebp - 0x1c], edi
movq qword [edi], xmm0
push 0x14
mov dword [ebp - 4], 0
call fcn.10093136
mov esi, eax
add esp, 4
mov dword [esi], 1
mov dword [esi + 4], 2
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [edi + 8], esi
test esi, esi
je 0x1003067e
mov eax, 1
lock xadd dword [esi], eax
mov dword [ebp - 0x18], esi
push 8
mov byte [ebp - 4], 2
call fcn.10093136
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], eax
mov dword [eax], esi
mov dword [eax + 4], 0x100927c0
lea esi, [edi + 4]
mov byte [ebp - 4], 3
push esi
push 0
push eax
push 0x100316e0
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x1c
mov dword [edi], eax
test eax, eax
je 0x100306e1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10093128
mov esp, ebp
pop ebp
ret 4
push 6
mov dword [esi], 0
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3