joyce8/EMBER2024-capa huggingface dataset:
Function at 0x506cd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x70
call fcn.0055f310
mov eax, dword [0x6817dc]
xor eax, esp
mov dword [esp + 0x6c], eax
cmp dword [esp + 0x88], 0x40000000
mov eax, dword [esp + 0x7c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x84]
push ebp
mov ebp, dword [esp + 0x78]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x90]
push esi
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], 0
ja 0x506ea7
mov esi, dword [esp + 0x80]
cmp esi, 0x40000000
ja 0x506ea7
cmp dword [esp + 0x88], 0x40000000
ja 0x506ea7
push ebx
push edi
push eax
call fcn.004ae120
mov edi, eax
lea eax, [esp + 0x28]
push eax
call fcn.00499b80
push 0
push dword [esp + 0x20]
lea eax, [esp + 0x34]
mov ebx, 1
push eax
call fcn.00499630
push dword [esp + 0xa4]
lea eax, [esp + 0x3c]
mov dword [esp + 0x28], 0x1000000
push dword [esp + 0x30]
push eax
call fcn.004997d0
add esp, 0x20
test eax, eax
je 0x506e83
push 4
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.004997d0
add esp, 0xc
test eax, eax
je 0x506e83
push dword [esp + 0x98]
lea eax, [esp + 0x28]
push dword [esp + 0x24]
push eax
call fcn.004997d0
add esp, 0xc
test eax, eax
je 0x506e83
push 0
cmp esi, edi
jb 0x506e4b
lea eax, [esp + 0x28]
push ebp
push eax
call fcn.00499560
add esp, 0xc
test eax, eax
je 0x506e83
sub esi, edi
je 0x506e7b
push 0
push dword [esp + 0x18]
lea eax, [esp + 0x2c]
add ebp, edi
push eax
inc ebx
call fcn.00499630
push dword [esp + 0x9c]
mov eax, ebx
mov byte [esp + 0x23], bl
push dword [esp + 0x28]
shr eax, 8
mov byte [esp + 0x26], al
mov eax, ebx
shr eax, 0x10
mov byte [esp + 0x25], al
mov eax, ebx
shr eax, 0x18
mov byte [esp + 0x24], al
lea eax, [esp + 0x38]
push eax
call fcn.004997d0
add esp, 0x18
test eax, eax
jne 0x506d97
jmp 0x506e83
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.00499560
add esp, 0xc
test eax, eax
je 0x506e83
push esi
lea eax, [esp + 0x40]
push eax
push ebp
call fcn.005c93b0
lea eax, [esp + 0x48]
push edi
push eax
call fcn.004a8a90
add esp, 0x14
mov dword [esp + 0x1c], 1
lea eax, [esp + 0x24]
push eax
call fcn.004997e0
mov eax, dword [esp + 0x20]
add esp, 4
pop edi
pop ebx
pop esi
pop ebp
mov ecx, dword [esp + 0x6c]
xor ecx, esp
call fcn.0055e6d4
add esp, 0x70
ret
mov ecx, dword [esp + 0x74]
xor eax, eax
pop esi
pop ebp
xor ecx, esp
call fcn.0055e6d4
add esp, 0x70
ret
Function at 0x52d340
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ecx, dword [edx + 4]
mov ebp, edx
push edi
cmp ecx, dword [ebx + 4]
mov edi, dword [esp + 0x10]
cmovge ebp, ebx
cmovge ebx, edx
mov eax, dword [ebx + 4]
cmp eax, dword [edi + 8]
jg 0x52d369
mov eax, edi
jmp 0x52d373
push eax
push edi
call fcn.00495c90
add esp, 8
test eax, eax
jne 0x52d37b
pop edi
pop ebp
pop ebx
ret
push esi
xor esi, esi
cmp dword [ebp + 4], esi
jle 0x52d399
mov eax, dword [ebp]
mov ecx, dword [ebx]
mov edx, dword [eax + esi*4]
mov eax, dword [edi]
xor edx, dword [ecx + esi*4]
mov dword [eax + esi*4], edx
inc esi
cmp esi, dword [ebp + 4]
jl 0x52d383
mov eax, dword [ebx + 4]
cmp esi, eax
jge 0x52d3b2
mov eax, dword [ebx]
mov ecx, dword [edi]
mov eax, dword [eax + esi*4]
mov dword [ecx + esi*4], eax
inc esi
mov eax, dword [ebx + 4]
cmp esi, eax
jl 0x52d3a0
mov dword [edi + 4], eax
pop esi
test eax, eax
jle 0x52d3d5
mov edx, dword [edi]
add edx, 0xfffffffc
lea edx, [edx + eax*4]
mov ecx, dword [edx]
lea edx, [edx - 4]
test ecx, ecx
jne 0x52d3d0
dec eax
test eax, eax
jg 0x52d3c2
mov dword [edi + 4], eax
test eax, eax
jne 0x52d3de
mov dword [edi + 0xc], 0
pop edi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x52e3d0
Capabilities:
Inspect section memory permissions

Disassembly:
mov eax, 4
call fcn.0055f310
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
push ebp
xor edi, edi
call fcn.004b4ff0
push ebp
call fcn.004b4e60
mov esi, eax
add esp, 8
test esi, esi
je 0x52e5e6
push ebx
mov ebx, dword [esp + 0x1c]
mov eax, dword [ebx + 4]
add eax, eax
cmp eax, dword [esi + 8]
jg 0x52e40f
mov eax, esi
jmp 0x52e419
push eax
push esi
call fcn.00495c90
add esp, 8
test eax, eax
je 0x52e5e5
mov eax, dword [ebx + 4]
lea ecx, [eax - 1]
test ecx, ecx
js 0x52e5a1
mov ebp, ecx
mov eax, dword [ebx]
mov edx, dword [eax + ebp*4]
mov ecx, edx
shr ecx, 1
mov eax, edx
and eax, 0x20000
and ecx, 0x8000
or ecx, eax
mov eax, edx
and eax, 0x40000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x80000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x100000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x200000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x400000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x800000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x1000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x2000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x4000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x8000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x10000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x20000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x40000000
shr ecx, 1
or ecx, eax
and edx, reloc.WS2_32.dll_accept
mov eax, dword [esi]
shr ecx, 1
or ecx, edx
shr ecx, 1
mov dword [eax + ebp*8 + 4], ecx
mov eax, dword [ebx]
mov ecx, dword [eax + ebp*4]
mov edx, ecx
and edx, 0x8000
mov eax, ecx
add edx, edx
and eax, 0x4000
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x2000
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x1000
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x800
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x400
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x200
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x100
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x80
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x40
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x20
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x10
or edx, eax
mov eax, ecx
add edx, edx
and eax, 8
or edx, eax
mov eax, ecx
add edx, edx
and eax, 4
or edx, eax
mov eax, ecx
add edx, edx
and eax, 2
or edx, eax
and ecx, 1
mov eax, dword [esi]
add edx, edx
or edx, ecx
mov dword [eax + ebp*8], edx
sub ebp, 1
jns 0x52e431
mov eax, dword [ebx + 4]
mov ebp, dword [esp + 0x24]
add eax, eax
mov dword [esi + 4], eax
test eax, eax
jle 0x52e5c5
mov edx, dword [esi]
add edx, 0xfffffffc
lea edx, [edx + eax*4]
mov ecx, dword [edx]
lea edx, [edx - 4]
test ecx, ecx
jne 0x52e5c0
dec eax
test eax, eax
jg 0x52e5b2
mov dword [esi + 4], eax
test eax, eax
jne 0x52e5ca
mov dword [esi + 0xc], edi
push dword [esp + 0x20]
push esi
push dword [esp + 0x20]
call fcn.0052d3f0
add esp, 0xc
mov ecx, 1
test eax, eax
cmovne edi, ecx
pop ebx
push ebp
call fcn.004b4d80
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ecx
ret
Function at 0x561924
Capabilities:
Move file

Disassembly:
push 0x3c
mov eax, 0x5f8cf6
call fcn.0055ef38
mov edi, edx
mov esi, ecx
xor eax, eax
mov ecx, edi
mov ebx, eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], ebx
cmp dword [edi + 0x14], 8
jb 0x561948
mov ecx, dword [edi]
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x561952
mov eax, dword [esi]
push 1
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x5619a4
cmp dword [edi + 0x14], 8
jb 0x561968
mov edi, dword [edi]
push edi
lea ecx, [ebp - 0x40]
call fcn.00405d00
and dword [ebp - 4], 0
xor ebx, ebx
inc ebx
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x44], ebx
jb 0x561983
mov esi, dword [esi]
push esi
lea ecx, [ebp - 0x28]
call fcn.00405d00
push 3
mov dword [ebp - 4], ebx
lea edx, [ebp - 0x40]
pop ebx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x44], ebx
call fcn.00561924
test al, al
je 0x5619a8
mov byte [ebp - 0x48], 1
test bl, 2
je 0x5619b8
lea ecx, [ebp - 0x28]
and ebx, 0xfffffffd
call fcn.00405c20
test bl, 1
je 0x5619c5
lea ecx, [ebp - 0x40]
call fcn.00405c20
mov al, byte [ebp - 0x48]
call fcn.0055eee2
ret

Function at 0x561d28
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [ecx + 0x14], 8
jb 0x561d30
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
ret

Function at 0x561d3e
Capabilities:
Copy file
Delete file

Disassembly:
push 0x3c
mov eax, 0x5f8dbf
call fcn.0055ef38
mov esi, ecx
cmp dword [esi + 0x10], 0
je 0x561df6
cmp dword [esi + 0x10], 0x104
ja 0x561df6
call fcn.00561d28
test al, al
jne 0x561d73
inc al
jmp 0x561df8
xor edi, edi
lea ecx, [ebp - 0x28]
push esi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
call fcn.0040bf60
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
push edi
add eax, 2
mov dword [ebp - 4], edi
push eax
call fcn.00412d70
push 0x1e
lea eax, [ebp - 0x48]
push edi
push eax
call fcn.005c9930
mov eax, dword [ebp - 0x38]
add esp, 0xc
and eax, 0xffbf
mov dword [ebp - 0x32], edi
or eax, 0x414
mov dword [ebp - 0x48], edi
cmp dword [ebp - 0x14], 8
mov word [ebp - 0x38], ax
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 0x2e], edi
mov dword [ebp - 0x44], 3
mov dword [ebp - 0x3c], edi
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebx, eax
lea ecx, [ebp - 0x28]
neg ebx
sbb bl, bl
inc bl
call fcn.00405c20
mov al, bl
jmp 0x561df8
xor al, al
call fcn.0055eee2
ret
Function at 0x4010b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4415ba
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x4572b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x18], esi
call fcn.0042f468
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x401156
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x14], str.bad_locale_name
call fcn.0041eb6e
push 0x453598
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x24], vtable.std::runtime_error.0
call fcn.00426521
push edi
push esi
call fcn.0042f19e
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e77a
mov esp, ebp
pop ebp
ret 4

Function at 0x401b90
Capabilities:
Check os version
Create process on windows
Extract resource via kernel32 functions
Print debug messages
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xe4
mov eax, dword [0x4572b4]
xor eax, esp
mov dword [esp + 0xe0], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x44d500
push 0x89
push ebx
mov dword [0x45b268], 1
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push eax
call fcn.0043312d
call fcn.00402c40
call fcn.00403d10
call fcn.004026a0
call fcn.00401e10
call fcn.00402810
call fcn.0040ce30
push 0x98
mov esi, eax
lea eax, [esp + 0x58]
push 0
push eax
call fcn.00426230
add esp, 0x14
lea eax, [esp + 0x48]
push eax
mov dword [esp + 0x4c], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x401c45
push 0x44d4ec
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x401cb5
cmp dword [esp + 0x4c], 5
jbe 0x401cb5
push esi
push 0
push 9
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 1
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x38
lea eax, [esp + 0x14]
push 0
push eax
mov dword [esp + 0x18], 0x3c
call fcn.00426230
add esp, 0xc
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x14], 0x40
mov dword [esp + 0x1c], str.runas
mov dword [esp + 0x20], str.c:windowsexplorer.exe
mov dword [esp + 0x28], str.c:windows_
mov dword [esp + 0x2c], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
call fcn.00403040
mov ecx, dword [esp + 0xec]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0041e77a
mov esp, ebp
pop ebp
ret 0x10
Function at 0x401ce0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x441c48
mov eax, dword fs:[0]
push eax
sub esp, 0x40c
mov eax, dword [0x4572b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov edi, ecx
lea esi, [ebx + ebx*4]
add esi, esi
push esi
mov dword [ebp - 4], 0
call fcn.0041f2f4
add esp, 4
mov dword [ebp - 0x414], eax
push esi
push 0
push eax
call fcn.00426230
add esp, 0xc
lea eax, [ebp - 0x40f]
push 0x3ff
push 0
push eax
mov byte [ebp - 0x410], 0
call fcn.00426230
add esp, 0xc
lea eax, [ebp - 0x410]
push ebx
push str.filesize:_d
push eax
call fcn.0041ea25
add esp, 0xc
lea edx, [ebp - 0x418]
push ebx
mov ebx, dword [ebp - 0x414]
push edi
mov ecx, ebx
mov dword [ebp - 0x418], esi
call fcn.0040d030
add esp, 8
cmp dword [ebp + 0x1c], 0x10
push 0
push 0x80
push 2
push 0
push 0
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push 0x10000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x401dd8
push 0
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x418]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test ebx, ebx
je 0x401dd8
push ebx
call fcn.0041ff01
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x1c], 0x10
jb 0x401df0
push dword [ebp + 8]
call fcn.0041ff30
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e77a
mov esp, ebp
pop ebp
ret
Function at 0x4024c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x441c18
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x4572b4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
mov eax, dword [ebp + 8]
push edi
mov dword [ebp - 0x38], eax
call fcn.0041f2f4
mov ebx, eax
push edi
push esi
lea edx, [ebp - 0x34]
mov ecx, ebx
mov dword [ebp - 0x34], edi
call fcn.0040d0c0
add esp, 0xc
lea ecx, [ebp - 0x50]
push 0xa
push str.config.dat
mov dword [ebp - 0x3c], 0xf
mov dword [ebp - 0x40], 0
mov byte [ebp - 0x50], 0
call fcn.004053b0
lea eax, [ebp - 0x50]
push eax
mov edx, 0x459ad4
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0
call fcn.00407d60
add esp, 4
mov byte [ebp - 4], 2
cmp dword [ebp - 0x3c], 0x10
jb 0x402560
push dword [ebp - 0x50]
call fcn.0041ff30
add esp, 4
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x3c], 0xf
cmp byte [edx], 0
mov dword [ebp - 0x40], 0
mov byte [ebp - 0x50], 0
jne 0x40257e
xor esi, esi
jmp 0x40258c
mov esi, edx
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x402583
sub esi, ecx
cmp dword [ebp - 0x1c], 0x10
mov edi, dword [ebp - 0x20]
lea ecx, [ebp - 0x30]
cmovae ecx, dword [ebp - 0x30]
mov eax, esi
cmp edi, esi
cmovb eax, edi
push eax
call fcn.00401010
add esp, 4
test eax, eax
jne 0x4025c0
cmp edi, esi
jae 0x4025b7
or eax, 0xffffffff
jmp 0x4025be
xor eax, eax
cmp edi, esi
setne al
test eax, eax
mov edi, dword [ebp - 0x34]
sete al
test al, al
je 0x402628
push edi
push ebx
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x34], esp
push 6
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push str.Config
mov byte [ecx], 0
call fcn.004053b0
sub esp, 0x18
mov ecx, esp
mov byte [ebp - 4], 3
push 8
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push str.Software
mov byte [ecx], 0
call fcn.004053b0
mov edx, 3
mov byte [ebp - 4], 2
call fcn.0040a000
add esp, 0x38
mov eax, dword [ebp - 0x38]
push 0
push 0x80
push 2
push 0
push 0
push 0x10000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x402667
push 0
lea eax, [ebp - 0x18]
push eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test ebx, ebx
je 0x402667
push ebx
call fcn.0041ff01
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x1c], 0x10
jb 0x40267f
push dword [ebp - 0x30]
call fcn.0041ff30
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e77a
mov esp, ebp
pop ebp
ret
Function at 0x4026a0
Capabilities:
Get system information on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x441990
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x4572b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 8
push str.safe.dat
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x58], 0xf
mov dword [ebp - 0x5c], 0
mov byte [ebp - 0x6c], 0
call fcn.004053b0
lea eax, [ebp - 0x6c]
push eax
mov edx, 0x459ad4
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.00407d60
add esp, 4
mov byte [ebp - 4], 2
cmp dword [ebp - 0x58], 0x10
jb 0x402723
push dword [ebp - 0x6c]
call fcn.0041ff30
add esp, 4
lea eax, [ebp - 0x50]
mov dword [ebp - 0x58], 0xf
mov dword [ebp - 0x5c], 0
mov byte [ebp - 0x6c], 0
test eax, eax
je 0x402769
push str.GetNativeSystemInfo
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40275f
lea ecx, [ebp - 0x50]
push ecx
call eax
jmp 0x402769
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ax, word [ebp - 0x50]
cmp ax, 9
je 0x402784
cmp ax, 6
je 0x402784
lea eax, [ebp - 0x54]
push eax
push 0x44d61c
jmp 0x40278d
lea eax, [ebp - 0x54]
push eax
push 0x44d628
call fcn.00433071
mov ebx, dword [ebp - 0x54]
add esp, 8
cmp dword [ebp - 0x18], 0x10
push 0
push 0x80
push 4
push 0
mov esi, eax
push 2
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4027e2
push 0
lea eax, [ebp - 0x14]
push eax
push esi
push ebx
push edi
mov dword [ebp - 0x14], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x18], 0x10
jb 0x4027f3
push dword [ebp - 0x2c]
call fcn.0041ff30
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e77a
mov esp, ebp
pop ebp
ret
Function at 0x405ac0
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x441552
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4572b4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], 0
mov dword [esi], 0x44da80
mov dword [esi + 0x60], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], 0
mov eax, dword [esi]
lea edi, [esi + 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], 1
mov dword [esi + eax], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
push ecx
lea eax, [ecx - 8]
mov dword [ecx + esi - 4], eax
mov eax, dword [esi]
push edi
mov ecx, dword [eax + 4]
add ecx, esi
call fcn.00406b00
mov dword [ebp - 4], 2
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov dword [esi + eax], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x60]
mov dword [ecx + esi - 4], eax
mov ecx, edi
call fcn.004077d0
lea eax, [edi + 4]
mov dword [edi + 0xc], eax
lea eax, [edi + 0x14]
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
mov dword [edi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [edi + 0x4c], 0
mov byte [edi + 0x45], 0
lea ecx, [edi + 8]
mov dword [edi + 0x10], ecx
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, dword [0x45b218]
mov dword [edi + 0x50], 0
mov dword [edi + 0x48], eax
mov dword [edi + 0x40], 0
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 3
cmp dword [eax + 0x14], 0x10
jb 0x405be7
mov eax, dword [eax]
sub esp, 8
mov ecx, edi
push eax
call fcn.00406e00
test eax, eax
jne 0x405c1f
mov eax, dword [esi]
mov ecx, dword [eax + 4]
mov eax, dword [ecx + esi + 0xc]
add ecx, esi
or eax, 2
cmp dword [ecx + 0x38], 0
jne 0x405c0d
or eax, 4
and eax, 0x17
mov dword [ecx + 0xc], eax
test dword [ecx + 0x10], eax
je 0x405c1f
push 0
call fcn.00401830
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x407010
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4417c8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x4572b4]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov eax, dword [0x4572b4]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x40], 0
je 0x407164
cmp byte [ebx + 0x45], 0
je 0x407164
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x407070
xor al, al
jmp 0x407166
mov ecx, 0xf
mov byte [esp + 0x18], 0
xorps xmm0, xmm0
movq qword [esp + 0x18], xmm0
lea eax, [esp + 0x18]
cmp ecx, 0x10
cmovae eax, dword [esp + 0x18]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], 8
mov byte [eax + 8], 0
mov dword [esp + 0x40], 0
jmp 0x4070b0
cmp dword [esp + 0x2c], 0x10
mov ecx, dword [ebx + 0x40]
lea eax, [esp + 0x14]
mov edx, dword [ecx]
push eax
mov eax, dword [esp + 0x2c]
lea edi, [esp + 0x1c]
cmovae edi, dword [esp + 0x1c]
lea esi, [esp + 0x1c]
cmovae esi, dword [esp + 0x1c]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x4070f1
dec eax
je 0x4070f5
sub eax, 2
je 0x40714b
xor bl, bl
jmp 0x40714d
mov byte [ebx + 0x45], 0
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
cmp ecx, 0x10
lea eax, [esp + 0x18]
cmovae eax, edx
sub esi, eax
je 0x40712c
push dword [ebx + 0x50]
cmp ecx, 0x10
push esi
lea eax, [esp + 0x20]
cmovae eax, edx
push 1
push eax
call fcn.0042010b
add esp, 0x10
cmp esi, eax
jne 0x4070ed
cmp byte [ebx + 0x45], 0
je 0x40714b
test esi, esi
jne 0x4070b0
push esi
push 8
lea ecx, [esp + 0x20]
call fcn.00406780
jmp 0x4070b0
mov bl, 1
cmp dword [esp + 0x2c], 0x10
jb 0x407160
push dword [esp + 0x18]
call fcn.0041ff30
add esp, 4
mov al, bl
jmp 0x407166
mov al, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0041e77a
mov esp, ebp
pop ebp
ret