joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425360
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x66bf78]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x68214c]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x20c], esi
push edi
mov edi, dword [ebp + 8]
test eax, eax
je 0x4253bc
push esi
push eax
push 0x4cb928
push ebx
push edi
call fcn.004b54a0
add esp, 0x14
test eax, eax
jle 0x4253bc
cmp eax, ebx
jge 0x4253bc
push edi
call fcn.004b5940
mov esi, eax
add esp, 4
test esi, esi
jne 0x425408
mov esi, dword [ebp - 0x20c]
push str.NMAPDIR
call dword [sym.imp.MSVCR120.dll_getenv]
add esp, 4
test eax, eax
je 0x4253f6
push esi
push eax
push 0x4cb928
push ebx
push edi
call fcn.004b54a0
add esp, 0x14
test eax, eax
jle 0x4253f6
cmp eax, ebx
jge 0x4253f6
push edi
call fcn.004b5940
mov esi, eax
add esp, 4
test esi, esi
jne 0x425408
push dword [ebp - 0x20c]
push ebx
push edi
call fcn.00425580
add esp, 0xc
mov esi, eax
call fcn.00424410
mov dword [ebp - 0x208], eax
test eax, eax
jne 0x425435
push 0xc64
push str..._nmap.cc
push str.argv0___NULL
call dword [sym.imp.MSVCR120.dll__wassert]
mov eax, dword [ebp - 0x208]
add esp, 0xc
push eax
call fcn.00423e90
add esp, 4
mov dword [ebp - 0x208], eax
test eax, eax
je 0x425485
test esi, esi
jne 0x42547b
push dword [ebp - 0x20c]
push eax
push 0x4cb928
push ebx
push edi
call fcn.004b54a0
add esp, 0x14
test eax, eax
jle 0x425475
cmp eax, ebx
jge 0x425475
push edi
call fcn.004b5940
add esp, 4
mov esi, eax
mov eax, dword [ebp - 0x208]
push eax
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
test esi, esi
jne 0x4254c6
push dword [ebp - 0x20c]
push str.c:_nmap
push 0x4cb928
push ebx
push edi
call fcn.004b54a0
add esp, 0x14
test eax, eax
jle 0x425569
cmp eax, ebx
jge 0x425569
push edi
call fcn.004b5940
mov esi, eax
add esp, 4
test esi, esi
je 0x425569
cmp byte [edi], 0x2e
je 0x425549
push dword [ebp - 0x20c]
lea eax, [ebp - 0x204]
push str..__s
push 0x200
push eax
call fcn.004b54a0
add esp, 0x10
test eax, eax
jle 0x425549
cmp eax, ebx
jge 0x425549
lea eax, [ebp - 0x204]
push eax
call fcn.004b5940
add esp, 4
test eax, eax
je 0x425549
lea eax, [ebp - 0x204]
push eax
push edi
call fcn.0042bc50
add esp, 8
test al, al
jne 0x425549
mov eax, dword [0x67df48]
mov ecx, eax
inc eax
mov dword [0x67df48], eax
cmp ecx, 1
jge 0x425549
cmp dword [0x67dff0], 0
je 0x425549
push edi
lea eax, [ebp - 0x204]
push eax
push str.Warning:_File__s_exists__but_Nmap_is_using__s_for_security_and_consistency_reasons.__set_NMAPDIR._to_give_priority_to_files_in_your_local_directory__may_affect_the_other_data_files_too_.
call fcn.00431e00
add esp, 0xc
test esi, esi
je 0x425569
cmp dword [0x67dff0], 1
jle 0x425569
push edi
push str.Fetchfile_found__s_n
push 0x405
call fcn.00454c40
add esp, 0xc
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bb11e
mov esp, ebp
pop ebp
ret
Function at 0x425580
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x66bf78]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x108]
push edi
mov edi, dword [ebp + 0x10]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jne 0x4255ef
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x108]
push eax
push str._s_nmap_s
push edi
push esi
call fcn.004b54a0
add esp, 0x14
test eax, eax
jle 0x4255ef
cmp eax, edi
jae 0x4255ef
push esi
call fcn.004b5940
add esp, 4
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bb11e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.004bb11e
mov esp, ebp
pop ebp
ret
Function at 0x42ecd0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc04
mov eax, dword [0x66bf78]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x67dfb8], 0
jne 0x42ed9e
push 0x400
lea eax, [ebp - 0x404]
mov dword [0x67dfb8], 1
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x42edac
lea eax, [ebp - 0x404]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42ed20
sub eax, edx
xor ecx, ecx
push esi
mov esi, 0x4e1654
cmp byte [ebp + eax - 0x405], 0x5c
mov eax, 0x4cbfec
sete cl
test ecx, ecx
cmove esi, eax
lea eax, [ebp - 0x404]
push esi
push eax
push str._s_shosts
lea eax, [ebp - 0xc04]
push 0x800
push eax
call fcn.004b54a0
lea eax, [ebp - 0xc04]
push eax
call fcn.00430790
push esi
lea eax, [ebp - 0x404]
push eax
push str._s_ssystem32driversetchosts
lea eax, [ebp - 0xc04]
push 0x800
push eax
call fcn.004b54a0
lea eax, [ebp - 0xc04]
push eax
call fcn.00430790
add esp, 0x30
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bb11e
mov esp, ebp
pop ebp
ret
push str.Failed_to_determine_your_windows_directory
call fcn.00431e30
int3

Function at 0x42efd0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
cmp byte [0x67dfbc], 0
jne 0x42effb
cmp byte [0x682160], 0
mov byte [0x67dfbc], 1
je 0x42effb
mov eax, dword [0x682168]
test eax, eax
je 0x42effc
push eax
call fcn.0042de20
add esp, 4
ret
jmp fcn.00431a80
Function at 0x431e30
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
lea eax, [ebp - 8]
push esi
push edi
push 0
push eax
call fcn.004b6680
push 0
call dword [sym.imp.MSVCR120.dll__time64]
mov esi, eax
mov edi, edx
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
push 0x801
call int.00454a80
push 0x4cc2d0
push 0x801
call fcn.00454c40
add esp, 0x20
call fcn.00482770
test al, al
je 0x431e88
push 1
call fcn.00482480
add esp, 4
call fcn.00482690
test al, al
jne 0x431ea0
push 1
push str.nmaprun
call fcn.00482730
add esp, 8
call fcn.004824d0
cmp eax, 1
jle 0x431ec4
lea ebx, [ebx]
call fcn.00482500
call fcn.00482580
call fcn.004824d0
cmp eax, 1
jg 0x431eb0
call fcn.004824d0
cmp eax, 1
jne 0x431f48
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x408]
push 0x400
push eax
call fcn.004b5510
push 1
push str.runstats
call fcn.00482730
lea eax, [ebp - 8]
push eax
push edi
push esi
call fcn.00456520
push str.error
push 0x4cc2f0
call fcn.00482330
lea eax, [ebp - 0x408]
push eax
push 0x4e1dd0
push str.errormsg
call fcn.00482330
add esp, 0x38
call fcn.004823c0
call fcn.00456630
call fcn.00482580
call fcn.00482500
call fcn.00482580
call fcn.00482500
call fcn.00482580
push 1
call dword [sym.imp.MSVCR120.dll_exit]
int3

Function at 0x431fe0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
mov esi, eax
lea eax, [ebp - 4]
push eax
push 0x400
push esi
push 0
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
lea eax, [ebp - 0xc]
push 0
push eax
call fcn.004b6680
push 0
call dword [sym.imp.MSVCR120.dll__time64]
mov edi, eax
mov ebx, edx
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x40c]
push 0x400
push eax
call fcn.004b5510
push esi
push dword [ebp - 4]
lea eax, [ebp - 0x40c]
push eax
push str._s:__s___d__n
push 0x801
call fcn.00454c40
add esp, 0x30
call fcn.00482770
test al, al
je 0x43206e
push 1
call fcn.00482480
add esp, 4
call fcn.00482690
test al, al
jne 0x432086
push 1
push str.nmaprun
call fcn.00482730
add esp, 8
call fcn.004824d0
cmp eax, 1
jle 0x4320a4
call fcn.00482500
call fcn.00482580
call fcn.004824d0
cmp eax, 1
jg 0x432090
call fcn.004824d0
cmp eax, 1
jne 0x432113
push eax
push str.runstats
call fcn.00482730
lea eax, [ebp - 0xc]
push eax
push ebx
push edi
call fcn.00456520
push str.error
push 0x4cc2f0
call fcn.00482330
push esi
push dword [ebp - 4]
lea eax, [ebp - 0x40c]
push eax
push str._s:__s___d_
push str.errormsg
call fcn.00482330
add esp, 0x30
call fcn.004823c0
call fcn.00456630
call fcn.00482580
call fcn.00482500
call fcn.00482580
call fcn.00482500
call fcn.00482580
push dword [ebp - 4]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 1
call fcn.004548c0
call dword [sym.imp.MSVCR120.dll___iob_func]
add eax, 0x40
push eax
call dword [sym.imp.MSVCR120.dll_fflush]
add esp, 8
push 1
call dword [sym.imp.MSVCR120.dll_exit]
int3
Function at 0x454a80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [sym.imp.MSVCR120.dll_vfprintf]
push edi
mov byte [ebp - 1], 0
mov edi, 1
mov edx, dword [sym.imp.MSVCR120.dll__wassert]
mov ecx, dword [ebp + 0xc]
test eax, edi
je 0x454bc8
cmp edi, 0x400
jg 0x454aed
je 0x454adb
lea eax, [edi - 1]
cmp eax, 7
ja case.0x454ac8.3
movzx eax, byte [eax + 0x454c2c]
jmp dword [eax*4 + 0x454c24]
cmp edi, 0x1000
je 0x454b1e
mov eax, edi
jmp 0x454b23
push ebx
push ecx
push dword [0x682140]
call esi
add esp, 0xc
jmp 0x454bc5
cmp edi, 0x800
je 0x454bdd
cmp edi, 0x1000
je 0x454b1a
push 0x40b
push str...output.cc
push 0x4cb8c8
call edx
add esp, 0xc
jmp 0x454bc5
mov byte [ebp - 1], 1
mov eax, 4
xor esi, esi
test al, 1
jne 0x454b53
lea esp, [esp]
sar eax, 1
inc esi
test al, 1
je 0x454b30
cmp esi, 4
jl 0x454b53
push 0x3f3
push str...output.cc
push str.fileidx___LOG_NUM_FILES
call edx
mov ecx, dword [ebp + 0xc]
add esp, 0xc
cmp dword [esi*4 + 0x682130], 0
je 0x454bbf
push ebx
push ecx
lea eax, [ebp - 8]
push eax
call fcn.004b5540
mov ecx, dword [ebp - 8]
add esp, 0xc
mov ebx, eax
test ecx, ecx
je 0x454c12
test ebx, ebx
je 0x454bb2
test edi, 0x1004
je 0x454b96
cmp byte [ebp - 1], 0
jne 0x454b96
push ecx
call fcn.0045a880
mov ecx, dword [ebp - 8]
add esp, 4
push dword [esi*4 + 0x682130]
push 1
push ebx
push ecx
call dword [sym.imp.MSVCR120.dll_fwrite]
add esp, 0x10
cmp eax, 1
jne 0x454c05
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.MSVCR120.dll_free]
mov ebx, dword [ebp + 0x10]
add esp, 4
mov esi, dword [sym.imp.MSVCR120.dll_vfprintf]
mov eax, dword [ebp + 8]
add edi, edi
cmp edi, 0x1000
jle 0x454a9e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.MSVCR120.dll___iob_func]
add eax, 0x20
push eax
call dword [sym.imp.MSVCR120.dll_fflush]
add esp, 4
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.MSVCR120.dll___iob_func]
add eax, 0x40
push eax
call esi
add esp, 0xc
jmp 0x454bc5
push eax
push edi
push ebx
push str.Failed_to_write__d_bytes_of_data_to__logt_d__stream._fwrite_returned__d.__Quitting.
call fcn.00431e30
push str.log_vwrite
push str._s:_alloc_vsprintf_failed.
call fcn.00431e30
lea ecx, [ecx]
iretd
Function at 0x460740
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bfb4c
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x66bf78]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 0
push 0
lea ecx, [edi + 0x28]
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
call fcn.004483f0
mov dword [edi + 0x28], eax
mov dword [ebp - 4], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov ecx, dword [ebp + 0xc]
xorps xmm0, xmm0
mov eax, dword [ebp + 8]
mov dword [edi], eax
mov dword [edi + 0x24], ecx
mov dword [edi + 4], 0
mov byte [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov eax, dword [ecx + 0x10]
mov dword [edi + 0x88], eax
mov eax, dword [ecx + 0x14]
mov dword [edi + 0x8c], eax
mov eax, dword [ecx + 0x10]
mov dword [edi + 0x9c], eax
mov eax, dword [ecx + 0x14]
mov dword [edi + 0xa0], eax
mov eax, dword [ecx + 0x10]
mov dword [edi + 0x90], eax
mov eax, dword [ecx + 0x14]
mov dword [edi + 0x94], eax
lea eax, [ecx + 0x10]
push eax
lea eax, [ecx + 0x20]
mov dword [edi + 0x98], 0
push eax
push 1
lea eax, [edi + 0x68]
mov byte [edi + 0xd8], 1
push 0
mov dword [edi + 0xa4], 0
mov byte [edi + 0xa8], 1
mov dword [edi + 0xac], 0
mov dword [edi + 0xb0], 0
push eax
mov byte [ebp - 4], 3
movq qword [edi + 0x60], xmm0
call fcn.00462b90
mov dword [edi + 0x44], 0
xorps xmm0, xmm0
movdqu xmmword [edi + 0xb4], xmm0
mov dword [edi + 0xc4], 0
mov ecx, dword [edi + 0x24]
mov eax, dword [ecx + 0x10]
mov dword [edi + 0xc0], eax
mov eax, dword [ecx + 0x14]
mov dword [edi + 0xc4], eax
mov eax, dword [0x67e0a0]
mov dword [edi + 0xb4], eax
mov dword [edi + 0xc8], 0
mov byte [edi + 0xcc], 0
mov eax, dword [ecx + 0x10]
mov dword [edi + 0xd0], eax
mov eax, dword [ecx + 0x14]
mov esi, dword [edi]
mov dword [edi + 0xd4], eax
lea edx, [esi + 0x23c]
push edx
push ecx
call fcn.00463190
add esp, 0x1c
test al, al
jne 0x460962
cmp dword [0x67dff0], 1
jle 0x460949
movzx eax, byte [edx]
add esi, 0x3d8
push eax
call fcn.00463d30
push eax
push esi
push str._s_pingprobe_type__s_is_inappropriate_for_this_scan_type__resetting._n
push 0x400
call fcn.00454c40
add esp, 0x14
mov eax, dword [edi]
xor ecx, ecx
mov dword [eax + 0x23c], ecx
mov word [eax + 0x240], cx
mov eax, dword [edi]
mov dword [eax + 0x244], ecx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4669c0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x66bf78]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x88]
push 4
push eax
push 0x80
push 0xffff
push edi
mov dword [ebp - 0x88], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
mov esi, dword [sym.imp.MSVCR120.dll_perror]
test eax, eax
je 0x466a20
call sub.WS2_32.dll_WSAGetLastError
push eax
push str.Problem_setting_socket_SO_LINGER__errno:__d
call fcn.00431e00
push str.setsockopt
call esi
add esp, 0xc
cmp dword [0x67e014], 0
je 0x466a9b
cmp dword [0x68a0e0], 0
jne 0x466a9b
lea eax, [ebp - 0x8c]
mov ecx, 0x67dfe8
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.00433a50
push dword [ebp - 0x8c]
lea eax, [ebp - 0x84]
push eax
push edi
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
je 0x466a9b
call sub.WS2_32.dll_WSAGetLastError
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.004797e0
add esp, 4
push eax
push str.init_socket
push str._s:_Problem_binding_source_address___s___errno:__d
call fcn.00431e00
push str.bind
call esi
add esp, 0x14
mov dword [0x68a0e0], 1
call dword [sym.imp.MSVCR120.dll__errno]
push 0x67e01c
push edi
mov dword [eax], 0
call fcn.004b6370
add esp, 8
test eax, eax
jne 0x466ae6
call dword [sym.imp.MSVCR120.dll__errno]
cmp dword [eax], 0x271d
je 0x466ae6
call sub.WS2_32.dll_WSAGetLastError
push eax
push 0x67e01c
push str.Problem_binding_to_interface__s__errno:__d
call fcn.00431e00
push str.socket_bindtodevice
call esi
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004bb11e
mov esp, ebp
pop ebp
ret
Function at 0x4788d0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 1
cmp eax, 0x1f5
je 0x478915
push 4
lea ecx, [ebp - 4]
push ecx
push 0x20
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x478915
push str.Failed_to_secure_socket_broadcasting_permission
call fcn.00431e00
push str.setsockopt
call dword [sym.imp.MSVCR120.dll_perror]
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x479910
Capabilities:
Create raw socket

Disassembly:
push esi
push 0xff
push 3
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
test esi, esi
js 0x47993c
push esi
call fcn.004788d0
push 0x67e01c
push esi
call fcn.004b6370
add esp, 0xc
mov eax, esi
pop esi
ret
Function at 0x47a3f0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x66bf78]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x108], 1
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x104], edi
test esi, esi
je 0x47a43c
mov dword [esi], 0
lea eax, [ebp - 0x110]
push eax
push 0
push 0
lea eax, [ebp - 0x108]
push eax
lea eax, [edi + 1]
push eax
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jle 0x47a492
push 0
push dword [ebp + 0x10]
push ebx
push edi
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jns 0x47a4c6
push str.recvtime
push str.recv_in__s
call fcn.00431f60
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bb11e
mov esp, ebp
pop ebp
ret
jne 0x47a4b1
test esi, esi
je 0x47a49e
mov dword [esi], 1
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bb11e
mov esp, ebp
pop ebp
ret
push str.recvtime
push str.select___in__s
call fcn.00431f60
add esp, 8
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bb11e
mov esp, ebp
pop ebp
ret

Function at 0x481ca0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x481d8d
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x481d8d
cmp dword [ebp + 0x10], 0
jne 0x481cd0
mov eax, closesocket
mov dword [ebp + 0xc], 2
jmp 0x481cdc
mov eax, 0xc0000000
mov dword [ebp + 0xc], 4
push edi
push 0
push 0x80
push 3
push 0
push 0
push eax
push ebx
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
test edi, edi
je 0x481da0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push 0
push 0
push dword [ebp + 0xc]
mov dword [esi], eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
mov dword [0x68aa18], ecx
test ecx, ecx
je 0x481db4
xor eax, eax
cmp dword [ebp - 4], 0x80000000
push 0
sete al
push 0
push 0
lea eax, [eax*2 + 2]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
test ebx, ebx
je 0x481dce
cmp dword [0x67dff0], 2
jle 0x481d7d
push dword [esi]
push ebx
push dword [0x68aa18]
push edi
push str.mmapfile
push str._s__:_fd__08lX__gmap__08lX__fileptr__08lX__length__d_n
push 0x405
call fcn.00454c40
add esp, 0x1c
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
push 0x2726
call dword [sym.imp.WS2_32.dll_WSASetLastError]
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push 0x2b3
push str...utils.cc
push str._s__u_:_CreateFile__
call fcn.00431fe0
push dword [ebp + 0xc]
push dword [esi]
push ebx
push 0x2ba
push str...utils.cc
push str._s__u_:_CreateFileMapping____file__s__length__d__mflags__08lX
call fcn.00431fe0
push 0x2bf
push str...utils.cc
push str._s__u_:_MapViewOfFile__
call fcn.00431fe0
int3
Function at 0x482b90
Capabilities:
Create process on windows
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x66bf78]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
jne 0x482bd8
push str.Error_in_OpenSCManager
call fcn.00431e00
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bb11e
mov esp, ebp
pop ebp
ret
push 5
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, eax
mov dword [ebp - 0x44], ebx
test ebx, ebx
je 0x482c07
lea eax, [ebp - 0x40]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x482c2a
push str.Error_in_QueryServiceStatus
call fcn.00431e00
add esp, 4
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
test ebx, ebx
je 0x482c17
push ebx
call esi
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bb11e
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 0x3c]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
shr ebx, 2
call esi
push dword [ebp - 0x44]
call esi
and bl, 1
je 0x482c72
cmp dword [0x67dff0], 1
jle 0x482c5f
push edi
push str._s_service_is_already_running._n
push 0x405
call fcn.00454c40
add esp, 0xc
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bb11e
mov esp, ebp
pop ebp
ret
cmp dword [0x67dff0], 1
jle 0x482c8e
push edi
push str._s_service_is_not_running._n
push 0x405
call fcn.00454c40
add esp, 0xc
push edi
push str.start__s
lea eax, [ebp - 0x24]
push 0x20
push eax
call fcn.004b54a0
add esp, 0x10
lea eax, [ebp - 0x24]
push 0
push 0
push eax
push str.net.exe
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jg 0x482c5f
push eax
push edi
push str.Unable_to_start__s_service:_ShellExecute_returned__d._nResorting_to_unprivileged__non_administrator__mode.
call fcn.00431e00
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
xor al, al
pop edi
pop esi
pop ebx
call fcn.004bb11e
mov esp, ebp
pop ebp
ret
Function at 0x482d00
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4e9de0
push 0x4bbb94
mov eax, dword fs:[0]
push eax
sub esp, 0xac
mov eax, dword [0x66bf78]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
call fcn.00482a30
mov dword [ebp - 0xb8], 0x9c
lea eax, [ebp - 0xb8]
push eax
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
call esi
test eax, eax
jne 0x482d81
mov dword [ebp - 0xb8], 0x94
lea eax, [ebp - 0xb8]
push eax
call esi
test eax, eax
jne 0x482d7c
push str.GetVersionEx_failed_n
call fcn.00431e30
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0xbc], 0x1000
mov byte [0x67dfec], 1
mov esi, dword [sym.imp.MSVCR120.dll_printf]
cmp dword [0x67dff0], 2
jle 0x482db2
push str.Trying_to_initialize_Windows_pcap_engine_n
call esi
add esp, 4
cmp dword [0x67dfe8], 0
je 0x482e01
push str.npcap
call fcn.00482b90
add esp, 4
test al, al
jne 0x482dfc
push 0x4d9e8c
call fcn.00482b90
add esp, 4
test al, al
jne 0x482e01
cmp dword [0x67dff0], 0
je 0x482df3
push str.Unable_to_start_either_npcap_or_npf_service
call fcn.00431e00
add esp, 4
mov byte [0x67dfec], 0
jmp 0x482e01
call fcn.00482ad0
push 0x4d9ebc
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, eax
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, eax
lea eax, [ebp - 0xbc]
push eax
push 0x68ea38
call sub.packet.dll_PacketGetAdapterNames
add esp, 8
cmp ebx, 0x80
je 0x482e3d
test ebx, ebx
jne 0x482e44
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x4d9ee0
call fcn.004ba64f
test eax, eax
jns 0x482e6d
push str.WARNING:_your_winpcap_is_too_old_to_use.__Nmap_may_not_function._n
call fcn.00431e00
add esp, 4
mov byte [0x67dfec], 0
cmp dword [0x67dff0], 0
je 0x482ea6
call dword [sym.imp.wpcap.dll_pcap_lib_version]
push eax
push str.Winpcap_present__dynamic_linked_to:__s_n
call esi
add esp, 8
jmp 0x482ea6
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x67dfe8]
xor ecx, ecx
cmp byte [0x67dfec], cl
cmove eax, ecx
mov dword [0x67dfe8], eax
push 0x482cf0
call fcn.004bb109
add esp, 4
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004bb11e
mov esp, ebp
pop ebp
ret