joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa9b880
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0xb1208c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, dword [ebp + 0xc]
push 4
cmp byte [esi + 0x6c7], al
setne al
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 8
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0xa9b8dd
push edi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d
push esi
call fcn.00a6ebd0
add esp, 0xc
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00a5942e
mov esp, ebp
pop ebp
ret
push dword [esi + 0x664]
mov dword [ebp - 0x10], 1
call fcn.00a70550
push dword [esi + 0x668]
imul eax, eax, 0x3e8
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], eax
call fcn.00a70550
add esp, 8
imul eax, eax, 0x3e8
push 0
push 0
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0xc
lea eax, [ebp - 0x10]
push eax
push 0x98000004
push edi
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0xa9b94d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d
push esi
call fcn.00a6ebd0
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00a5942e
mov esp, ebp
pop ebp
ret

Function at 0xa9b960
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0xb1208c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x108]
push 4
push eax
push 1
push 6
push dword [ebp + 0xc]
mov dword [ebp - 0x108], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0xa9b9c2
push 0x100
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.00a7e960
push eax
push str.Could_not_set_TCP_NODELAY:__s
push esi
call fcn.00a6ebd0
add esp, 0x18
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00a5942e
mov esp, ebp
pop ebp
ret
Function at 0xa9cba0
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
push 0x11
push str.WWW_Authenticate:
push edi
mov dword [ebp - 4], 0
call fcn.00a72520
mov esi, dword [ebp + 0xc]
add esp, 0xc
test eax, eax
je 0xa9cbd6
mov ebx, dword [esi + 0xe0]
cmp ebx, 0x191
je 0xa9cbf8
push 0x13
push str.Proxy_authenticate:
push edi
call fcn.00a72520
add esp, 0xc
test eax, eax
je 0xa9cc42
mov ebx, dword [esi + 0xe0]
cmp ebx, 0x197
jne 0xa9cc42
push edi
call fcn.00a754c0
mov edi, eax
add esp, 4
test edi, edi
jne 0xa9cc11
lea eax, [edi + 0x1b]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ebx, 0x197
push edi
sete al
movzx eax, al
push eax
push esi
call fcn.00a76fd0
push edi
mov esi, eax
call dword [0xb120d0]
add esp, 0x10
test esi, esi
je 0xa9cd93
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xf
push str.Content_Length:
push edi
call fcn.00a72520
add esp, 0xc
test eax, eax
je 0xa9cca1
mov ecx, dword [esi + 0xe0]
lea eax, [ecx - 0xc8]
cmp eax, 0x64
jae 0xa9cc7f
push ecx
push str.Ignoring_Content_Length_in_CONNECT__03d_response
push esi
call fcn.00a6ebd0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x10]
add eax, 0x200
push eax
push 0xa
lea eax, [edi + 0xf]
push 0
push eax
call fcn.00a7f500
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 5
push str.close
push 0xb
push str.Connection:
push edi
call fcn.00a75420
add esp, 0x14
test al, al
jne 0xa9cd89
push 0x12
push str.Transfer_Encoding:
push edi
call fcn.00a72520
add esp, 0xc
test eax, eax
je 0xa9cd3f
mov ecx, dword [esi + 0xe0]
lea eax, [ecx - 0xc8]
cmp eax, 0x64
jae 0xa9ccfd
push ecx
push str.Ignoring_Transfer_Encoding_in_CONNECT__03d_response
push esi
call fcn.00a6ebd0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 7
push str.chunked
push 0x12
push str.Transfer_Encoding:
push edi
call fcn.00a75420
add esp, 0x14
test al, al
je 0xa9cd93
push str.CONNECT_responded_chunked
push esi
call fcn.00a6ebd0
mov eax, dword [ebp + 0x10]
push esi
mov byte [eax + 0x20c], 1
call fcn.00a9fea0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 5
push str.close
push 0x11
push str.Proxy_Connection:
push edi
call fcn.00a75420
add esp, 0x14
test al, al
jne 0xa9cd89
lea ebx, [esi + 0xe0]
push ebx
lea eax, [ebp - 4]
push eax
push str.HTTP_1._d__d
push edi
call fcn.00a649a0
add esp, 0x10
cmp eax, 2
jne 0xa9cd93
mov eax, dword [ebx]
pop edi
mov dword [esi + 0xd4c], eax
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x10]
mov byte [eax + 0x20d], 1
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xaa7090
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push esi
push edi
mov byte [edi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [edi + esi - 1], 0
test eax, eax
jne 0xaa70c3
push 0x2e
push edi
call fcn.00aad0d0
add esp, 8
test eax, eax
je 0xaa70c1
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
pop ebp
ret

Function at 0xaa8230
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0xb1208c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x1c]
push edi
mov edi, dword [ebp + 0x10]
push 0xf0000040
push 1
push 0
push 0
push eax
mov dword [ebp - 0x20], 8
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0xaa82c2
lea eax, [ebp - 0xc]
mov dword [ebp - 0x18], 0x208
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0x6601
push edi
movlpd qword [ebp - 0xc], xmm0
mov dword [ebp - 0x10], 8
call fcn.00aa8320
lea eax, [ebp - 0xc]
push 8
push eax
call fcn.00aaa9c0
add esp, 0x10
lea eax, [ebp - 0x24]
push eax
push 0
push 0
push 0x14
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0xaa82d4
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00a5942e
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
push dword [ebp - 0x20]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push eax
push esi
push 0
push 0
push 0
push dword [ebp - 0x24]
mov dword [esi], ecx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push 0
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.00a5942e
mov esp, ebp
pop ebp
ret
Function at 0xaa91e0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0xb120cc]
mov edi, eax
add esp, 4
test edi, edi
jne 0xaa920d
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0xaa9257
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [ebp + 0xc]
push dword [edi + 4]
call eax
mov eax, dword [edi + 8]
add eax, dword [esi + 0xc]
push dword [edi + 4]
mov dword [ebp - 4], eax
push eax
mov eax, dword [esi + 8]
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov ecx, dword [edi + 4]
mov dword [ebp + 0x10], ebx
jmp 0xaa925d
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [esi]
push ecx
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [ebp + 0x10]
add esp, 8
xor ebx, ebx
test eax, eax
je 0xaa92bb
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], eax
nop dword [eax + eax]
movzx eax, byte [ebx]
xor al, 0x36
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor al, 0x5c
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub dword [ebp + 0x10], 1
jne 0xaa9280
mov ebx, dword [ebp - 8]
cmp ebx, dword [esi + 0x10]
jae 0xaa92e7
mov eax, dword [esi + 4]
push 1
push 0xafc66d
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0xafc66e
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0xaa92c0
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0xaa9340
Capabilities:
Create new key via cryptacquirecontext
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0xf0000040
push 0x18
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0xaa9372
lea eax, [esi + 4]
push eax
push 0
push 0
push 0x800c
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
xor eax, eax
pop esi
pop ebp
ret

Function at 0xaaa9c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
test edi, edi
je 0xaaaa0d
push ebx
mov ebx, dword [ebp + 8]
mov cl, byte [esi + ebx]
mov dl, cl
mov al, cl
shr dl, 1
and al, 0xfe
not dl
movzx eax, al
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
or cl, 1
and dl, 2
movzx ecx, cl
cmove ecx, eax
mov byte [esi + ebx], cl
inc esi
cmp esi, edi
jb 0xaaa9d2
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0xaaaa60
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0xf0000040
push 1
push 0
push 0
lea edi, [esi + 4]
mov dword [esi], 0
push esi
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0xaaaa9f
push edi
push 0
push 0
push 0x8002
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
pop edi
pop esi
pop ebp
ret

Function at 0xac28b6
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00ac2576

Function at 0xac8c8c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00ac8b0b
Function at 0x40272e
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40276d
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40276d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40276d
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40276d
cmp dword [ecx + 0x74], 0xe
jbe 0x40276d
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x8e9030
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x475dc0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x49e044]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], 0x48bc00
call fcn.0092525d
mov esi, eax
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
push 1
mov dword [ebp - 4], eax
call fcn.00912900
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov dword [eax], 0x48d55c
mov dword [eax + 0x38], 0
mov dword [eax + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x8eb5a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x475dc0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x49e044]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], 0x48d1c0
call fcn.0092525d
mov esi, eax
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
push 1
mov dword [ebp - 4], eax
call fcn.00912900
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x8f4970
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x188
mov eax, dword [0x49e044]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
xor eax, eax
mov dword [edi + 4], eax
lea esi, [edi + 4]
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
test edx, edx
je 0x8f49a1
mov byte [edx], al
push 0x48d71c
call dword [0x47e07c]
test eax, eax
jne 0x8f49bf
push 0x48d71c
call dword [0x47e070]
test eax, eax
je 0x8f49e6
push 0x48d704
push eax
call dword [fcn.0047e04c]
test eax, eax
je 0x8f49e6
lea ecx, [ebp - 0x1c]
push ecx
call eax
test eax, eax
jne 0x8f49e6
mov eax, dword [ebp - 0x12]
mov dword [esi], eax
mov ax, word [ebp - 0xe]
mov word [esi + 4], ax
push 0
push 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [edi + 0xa]
push eax
push 0
push 0
push 0x48d728
call dword [0x47e068]
push 0xe
lea eax, [ebp - 0xf8]
mov dword [ebp - 0xf0], 0x67452301
push edi
push eax
mov dword [ebp - 0xec], 0xefcdab89
mov dword [ebp - 0xe8], 0x98badcfe
mov dword [ebp - 0xe4], 0x10325476
mov dword [ebp - 0xe0], 0xc3d2e1f0
mov dword [ebp - 0xdc], 0
mov dword [ebp - 0xf8], 0
mov dword [ebp - 0xf4], 0
call fcn.00910500
add esp, 0xc
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0xf8]
push eax
call fcn.009105a0
push 0xa
lea eax, [ebp - 0x110]
mov dword [ebp - 0x78], 0x67452301
push eax
lea eax, [ebp - 0x80]
mov dword [ebp - 0x74], 0xefcdab89
push eax
mov dword [ebp - 0x70], 0x98badcfe
mov dword [ebp - 0x6c], 0x10325476
mov dword [ebp - 0x68], 0xc3d2e1f0
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x7c], 0
call fcn.00910500
add esp, 0x14
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.009105a0
lea eax, [ebp - 0x98]
add esp, 8
cmp esi, eax
je 0x8f4b10
mov eax, dword [ebp - 0x98]
mov dword [esi], eax
mov eax, dword [ebp - 0x94]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x90]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x8c]
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 0x88]
mov dword [esi + 0x10], eax
push 4
lea eax, [ebp - 0x170]
mov dword [ebp - 0x168], 0x67452301
push edi
push eax
mov dword [ebp - 0x164], 0xefcdab89
mov dword [ebp - 0x160], 0x98badcfe
mov dword [ebp - 0x15c], 0x10325476
mov dword [ebp - 0x158], 0xc3d2e1f0
mov dword [ebp - 0x154], 0
mov dword [ebp - 0x170], 0
mov dword [ebp - 0x16c], 0
call fcn.00910500
add esp, 0xc
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp - 0x170]
push eax
call fcn.009105a0
add esp, 8
lea ecx, [ebp - 0x188]
mov edx, 5
mov eax, dword [ecx]
lea ecx, [ecx + 4]
add dword [esi], eax
lea esi, [esi + 4]
sub edx, 1
jne 0x8f4b93
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0092503f
mov esp, ebp
pop ebp
ret
Function at 0x902260
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4787eb
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x49e044]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
mov dword [edi], 0x48ee9c
mov byte [edi + 4], 0
mov dword [edi + 8], esi
mov dword [edi + 0xc], 0
mov byte [edi + 0x10], 0
mov dword [edi + 0x14], 1
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 1
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
push 0xc
mov byte [ebp - 4], 1
call fcn.0092525d
xor ecx, ecx
mov dword [ebp + 8], eax
add esp, 4
mov dword [eax + 8], ecx
mov dword [eax], 0x48ee60
mov dword [eax + 4], esi
mov dword [edi + 0x3c], eax
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x907400
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x479039
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x49e044]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0x48f458
mov dword [edi + 4], 0x48f50c
mov dword [edi + 8], 0x48f4ac
mov dword [edi + 0xc], 0x48f5e0
mov dword [edi + 0x10], 0x48f650
mov dword [edi + 0x14], 0x48f564
mov dword [edi + 0x18], 0x48f54c
mov dword [edi + 0x1c], 0x48f5c0
mov dword [edi + 0x20], 0x48f440
mov dword [edi + 0x24], 0x48f638
mov dword [edi + 0x28], 0x48f4f8
mov dword [edi + 0x2c], 0x48f498
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
push 0x10
mov dword [ebp - 4], 0
call fcn.0092525d
mov ecx, eax
add esp, 4
xor eax, eax
mov dword [ebp - 0x14], ecx
push dword [ebp + 0xc]
mov dword [ecx + 0xc], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov al, byte [ebp + 8]
mov dword [ecx], 0x48f584
mov byte [ecx + 0xc], al
mov dword [edi + 0x40], ecx
lea ecx, [edi + 0x4c]
mov byte [edi + 0x44], 0
mov dword [edi + 0x48], 0
call fcn.008fb590
push dword [ebp + 0x10]
mov byte [ebp - 4], 1
lea ecx, [edi + 0x5c]
mov byte [edi + 0x58], 1
call fcn.008e7130
mov dword [edi + 0x74], 0
mov dword [edi + 0x84], 0
mov dword [edi + 0x88], 0xf
mov byte [edi + 0x74], 0
xor eax, eax
mov dword [edi + 0x8c], 0
mov dword [edi + 0x9c], 0
mov dword [edi + 0xa0], 7
mov word [edi + 0x8c], ax
mov word [edi + 0xa4], ax
mov dword [edi + 0xa8], eax
mov dword [edi + 0xb8], eax
mov dword [edi + 0xbc], 7
mov word [edi + 0xa8], ax
mov dword [edi + 0xc0], eax
lea esi, [edi + 0xc4]
mov byte [ebp - 4], 6
push 0x2c
mov dword [ebp + 8], esi
mov dword [esi], eax
mov dword [esi + 4], eax
call fcn.0092525d
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea esi, [edi + 0xcc]
mov byte [ebp - 4], 7
mov dword [ebp + 8], esi
mov dword [esi], 0
mov dword [esi + 4], 0
push 0x2c
call fcn.0092525d
add esp, 8
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
xor eax, eax
mov dword [edi + 0xd4], 0x3e8
mov word [edi + 0xd8], 0x100
mov byte [edi + 0xda], 0
mov dword [edi + 0xdc], 0
mov word [edi + 0xdc], ax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0xec], 0
mov dword [edi + 0xf0], 7
mov dword [edi + 0xf4], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x9105a0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x1c]
cmp ecx, 0x40
jb 0x9105b7
mov eax, 0x10
pop esi
pop ebp
ret
lea eax, [ecx*8]
add dword [esi], eax
adc dword [esi + 4], 0
mov byte [ecx + esi + 0x20], 0x80
inc dword [esi + 0x1c]
mov eax, dword [esi + 0x1c]
cmp eax, 0x38
jbe 0x910603
cmp eax, 0x40
jae 0x9105f0
lea esp, [esp]
mov byte [eax + esi + 0x20], 0
inc dword [esi + 0x1c]
mov eax, dword [esi + 0x1c]
cmp eax, 0x40
jb 0x9105e0
lea edx, [esi + 0x20]
mov ecx, esi
call fcn.009100c0
mov dword [esi + 0x1c], 0
jmp 0x910605
jae 0x910616
mov eax, dword [esi + 0x1c]
mov byte [esi + eax + 0x20], 0
inc dword [esi + 0x1c]
cmp dword [esi + 0x1c], 0x38
jb 0x910605
movzx eax, byte [esi + 7]
lea edx, [esi + 0x20]
mov byte [esi + 0x58], al
mov ecx, esi
movzx eax, byte [esi + 6]
mov byte [esi + 0x59], al
movzx eax, byte [esi + 5]
mov byte [esi + 0x5a], al
movzx eax, byte [esi + 4]
mov byte [esi + 0x5b], al
movzx eax, byte [esi + 3]
mov byte [esi + 0x5c], al
movzx eax, byte [esi + 2]
mov byte [esi + 0x5d], al
movzx eax, byte [esi + 1]
mov byte [esi + 0x5e], al
movzx eax, byte [esi]
mov byte [esi + 0x5f], al
call fcn.009100c0
mov ecx, dword [ebp + 0xc]
movzx eax, byte [esi + 0xb]
mov byte [ecx], al
movzx eax, byte [esi + 0xa]
mov byte [ecx + 1], al
movzx eax, byte [esi + 9]
mov byte [ecx + 2], al
movzx eax, byte [esi + 8]
mov byte [ecx + 3], al
movzx eax, byte [esi + 0xf]
mov byte [ecx + 4], al
movzx eax, byte [esi + 0xe]
mov byte [ecx + 5], al
movzx eax, byte [esi + 0xd]
mov byte [ecx + 6], al
movzx eax, byte [esi + 0xc]
mov byte [ecx + 7], al
movzx eax, byte [esi + 0x13]
mov byte [ecx + 8], al
movzx eax, byte [esi + 0x12]
mov byte [ecx + 9], al
movzx eax, byte [esi + 0x11]
mov byte [ecx + 0xa], al
movzx eax, byte [esi + 0x10]
mov byte [ecx + 0xb], al
movzx eax, byte [esi + 0x17]
mov byte [ecx + 0xc], al
movzx eax, byte [esi + 0x16]
mov byte [ecx + 0xd], al
movzx eax, byte [esi + 0x15]
mov byte [ecx + 0xe], al
movzx eax, byte [esi + 0x14]
mov byte [ecx + 0xf], al
movzx eax, byte [esi + 0x1b]
mov byte [ecx + 0x10], al
movzx eax, byte [esi + 0x1a]
mov byte [ecx + 0x11], al
movzx eax, byte [esi + 0x19]
mov byte [ecx + 0x12], al
movzx eax, byte [esi + 0x18]
mov byte [ecx + 0x13], al
xor eax, eax
pop esi
pop ebp
ret