joyce8/EMBER2024-capa huggingface dataset:
Function at 0x469020
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x46904b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00457910
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x46906d
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x46906f
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x4690f3
jg 0x469084
test esi, esi
je 0x4690f3
test ecx, ecx
jl 0x4690cd
jg 0x46908e
test eax, eax
je 0x4690cd
cmp edi, ecx
jg 0x4690a2
jl 0x469098
cmp esi, eax
jae 0x4690a2
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call fcn.004876a0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x4690d0
mov edx, dword [ebp + 8]
test edi, edi
jl 0x4690f3
jg 0x4690da
test esi, esi
je 0x4690f3
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x4690f3
push eax
push esi
push 1
push edx
call fcn.00499be1
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x469110
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x46913b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004579f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], eax
test eax, eax
je 0x46915d
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x46915f
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test ebx, ebx
jl 0x4691fe
jg 0x46917c
test esi, esi
je 0x4691fe
test ecx, ecx
jl 0x4691c9
jg 0x469186
test eax, eax
je 0x4691c9
cmp ebx, ecx
jg 0x46919a
jl 0x469190
cmp esi, eax
jae 0x46919a
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
push eax
push dword [esp + 0x18]
push dword [ebp + 8]
call fcn.004876a0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [edi + 0x2c]
add edx, ecx
sub esi, ecx
mov dword [esp + 0xc], edx
sbb ebx, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x4691d0
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
test ebx, ebx
jl 0x4691fe
jg 0x4691da
test esi, esi
je 0x4691fe
cmp dword [edi + 0x4c], 0
je 0x4691fe
mov ecx, edi
call fcn.00469850
push dword [edi + 0x4c]
push esi
push 1
push dword [esp + 0x18]
call fcn.0049b8bd
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
pop edi
pop esi
sbb edx, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x469510
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x46952c
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x46955e
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x46955e
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x469631
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x469586
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4695af
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.0049ac24
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp + 8]
mov byte [ebp - 1], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x469631
cmp eax, 1
jle 0x469604
cmp eax, 3
jne 0x469631
push dword [esi + 0x4c]
movsx eax, byte [ebp - 1]
push eax
call fcn.0049ac24
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x28]
sub edi, eax
je 0x469621
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00499be1
add esp, 0x10
cmp edi, eax
jne 0x469631
lea eax, [ebp - 1]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 8], eax
jne 0x469553
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x469880
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x4698ff
cmp byte [esi + 0x3d], 0
je 0x4698ff
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x4698c9
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x4698d1
sub eax, 1
je 0x4698d5
sub eax, 2
je 0x4698ff
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 4]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x4698f2
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00499be1
add esp, 0x10
cmp edi, eax
jne 0x4698c9
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x471a62
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x4a64e6
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004a635c
Function at 0x10002f40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax - 0x5225b], al
inc dword [eax]
mov byte [ebp - 0x522], 0x15
and byte [ebp - 0x521], 0
mov byte [ebp - 0x520], 0xa2
mov byte [ebp - 0x51f], 0x8f
mov byte [ebp - 0x51e], 0x8b
mov byte [ebp - 0x51d], 0x9a
mov byte [ebp - 0x51c], 0xac
mov byte [ebp - 0x51b], 0x98
mov byte [ebp - 0x51a], 0x8f
mov byte [ebp - 0x519], 0x8f
mov byte [ebp - 0x518], 0xea
call 0xfb002f8f
lea eax, [ebp - 0x524]
push eax
call fcn.100023b9
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1000236e
invalid
invalid

Function at 0x10002f90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax - 0x5225b], al
inc dword [eax]
mov byte [ebp - 0x522], 0x15
and byte [ebp - 0x521], 0
mov byte [ebp - 0x520], 0xa2
mov byte [ebp - 0x51f], 0x8f
mov byte [ebp - 0x51e], 0x8b
mov byte [ebp - 0x51d], 0x9a
mov byte [ebp - 0x51c], 0xac
mov byte [ebp - 0x51b], 0x98
mov byte [ebp - 0x51a], 0x8f
mov byte [ebp - 0x519], 0x8f
mov byte [ebp - 0x518], 0xea
call 0xfb002f8f
lea eax, [ebp - 0x524]
push eax
call fcn.100023b9
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1000236e
invalid
invalid

Function at 0x10003060
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea eax, [ebp - 0x334]
push eax
push dword [ebp + 8]
call dword [ebp - 0x538]
mov dword [ebp - 0x398], eax
mov byte [ebp - 0x544], 1
cmp dword [ebp - 0x398], 0
je 0x1000309d
cmp dword [ebp - 0x398], 0
je 0x10003267
cmp dword [ebp + 0xc], 1
je 0x10003267
cmp dword [ebp + 0xc], 8
jne 0x1000322f
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
call fcn.100023a9
sahf
int 4
and al, 0x80
movsd dword es:[edi], dword [esi]
mov esp, 0xfffffa
push 0
call dword [ebp - 0x340]
mov dword [ebp + 8], eax
push 0x104
lea eax, [ebp - 0x334]
push eax
push 0
call dword [ebp - 0x538]
call fcn.100023a9
invalid
and byte [ebp - 0x230], 0
push 0x40
Function at 0x10009f20
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x11c], esi
mov dword [ebp - 0x118], edi
mov dword [ebp - 0x114], 0
mov dword [0x10013d30], 0
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp + eax - 0x108], 0
mov dword [ebp - 0x110], eax
mov ecx, dword [ebp - 0x110]
mov eax, ebp
mov edx, 0
call fcn.1000a110
mov eax, dword [0x10013d30]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x110]
inc ecx
lea eax, [ebp - 0x108]
call fcn.100020d0
call sub.kernel32.dll_GetCommandLineA
mov dword [0x1000f2a0], eax
mov ebx, dword [0x1000f2a0]
jmp 0x1000a0bd
inc ebx
movzx eax, byte [ebx]
dec eax
cmp eax, 0x20
jb 0x10009fbc
mov al, byte [ebx]
test al, al
je 0x1000a0c7
mov byte [ebp - 0x10c], 0
mov edi, ebx
mov dword [ebp - 0x110], 0
jmp 0x1000a02c
mov al, byte [ebx]
cmp al, 1
jb 0x1000a025
sub al, 0x20
jbe 0x10009ff8
sub al, 2
je 0x1000a00a
jmp 0x1000a025
mov al, byte [ebp - 0x10c]
test al, al
je 0x1000a032
inc dword [ebp - 0x110]
jmp 0x1000a02b
mov al, byte [ebx + 1]
cmp al, 0x22
je 0x1000a022
mov al, byte [ebp - 0x10c]
test al, al
sete byte [ebp - 0x10c]
jmp 0x1000a02b
inc ebx
jmp 0x1000a02b
inc dword [ebp - 0x110]
inc ebx
mov al, byte [ebx]
test al, al
jne 0x10009fe8
mov eax, dword [ebp - 0x114]
test eax, eax
je 0x1000a0b7
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x114]
mov eax, ebp
call fcn.1000a110
mov byte [ebp - 0x10c], 0
mov ebx, edi
mov eax, dword [0x10013d30]
mov edx, dword [ebp - 0x114]
mov esi, dword [eax + edx*4]
jmp 0x1000a0ae
mov al, byte [ebx]
cmp al, 1
jb 0x1000a0a8
sub al, 0x20
jbe 0x1000a07c
sub al, 2
je 0x1000a08d
jmp 0x1000a0a8
mov al, byte [ebp - 0x10c]
test al, al
je 0x1000a0b4
mov al, byte [ebx]
mov byte [esi], al
inc esi
jmp 0x1000a0ad
mov al, byte [ebx + 1]
cmp al, 0x22
je 0x1000a0a5
mov al, byte [ebp - 0x10c]
test al, al
sete byte [ebp - 0x10c]
jmp 0x1000a0ad
inc ebx
jmp 0x1000a0ad
mov al, byte [ebx]
mov byte [esi], al
inc esi
inc ebx
mov al, byte [ebx]
test al, al
jne 0x1000a06c
mov byte [esi], 0
inc dword [ebp - 0x114]
mov al, byte [ebx]
test al, al
jne 0x10009fbd
mov ebx, dword [ebp - 0x114]
mov dword [0x10013d20], ebx
mov edx, ebx
inc edx
shl edx, 2
mov eax, 0x10013d30
call fcn.10008460
mov eax, dword [0x10013d30]
mov dword [eax + ebx*4], 0
mov ebx, dword [ebp - 0x120]
mov esi, dword [ebp - 0x11c]
mov edi, dword [ebp - 0x118]
leave
ret
Function at 0x6dc41aa0
Capabilities:
Parse pe header

Disassembly:
push ebx
sub esp, 0x48
cmp dword [esp + 0x54], 1
je 0x6dc41ac0
add esp, 0x48
mov eax, 1
pop ebx
ret 0xc
mov eax, dword [esp + 0x50]
mov dword [esp], 0
mov dword [0x6dc4701c], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
sub esp, 4
cmp word [eax], 0x5a4d
jne 0x6dc41b80
mov ebx, dword [eax + 0x3c]
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x6dc41b60
cmp word [ebx + 0x14], 0
je 0x6dc41bc4
mov edx, dword [ebx + 0x28]
test edx, edx
jne 0x6dc41ba0
xor ebx, ebx
mov edx, ebx
mov eax, 0x6dc4156b
mov byte [esp + 0x3a], 0xe9
mov byte [esp + 0x3f], 0xc3
sub eax, edx
mov dword [esp + 0x3b], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edx, [esp + 0x3a]
mov dword [esp + 4], ebx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 6
mov dword [esp], eax
mov dword [esp + 8], edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
sub esp, 0x14
mov eax, 1
add esp, 0x48
pop ebx
ret 0xc
mov dword [esp], 0xbf
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor edx, edx
sub esp, 4
jmp 0x6dc41b0b
mov dword [esp], 0xc1
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor edx, edx
sub esp, 4
jmp 0x6dc41b0b
mov dword [esp + 0x2c], eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
mov eax, dword [esp + 0x2c]
add eax, dword [ebx + 0x28]
mov ebx, eax
mov edx, eax
jmp 0x6dc41b0b
mov dword [esp], 0xc0
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor edx, edx
sub esp, 4
jmp 0x6dc41b0b

Function at 0x6dc43220
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
lea ebx, [esp + 0x24]
mov dword [esp + 4], 1
mov dword [esp], 0x6dc450a4
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.6dc43280
Function at 0x6dc43280
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x3c
mov eax, dword [0x6dc47038]
test eax, eax
jle 0x6dc43383
mov edx, dword [0x6dc4703c]
xor ebx, ebx
mov ecx, dword [edx + 4]
cmp ecx, esi
ja 0x6dc432b1
mov edi, dword [edx + 8]
add ecx, dword [edi + 8]
cmp esi, ecx
jb 0x6dc43326
add ebx, 1
add edx, 0xc
cmp ebx, eax
jne 0x6dc432a0
mov dword [esp], esi
call fcn.6dc43bb0
test eax, eax
mov edi, eax
je 0x6dc433aa
lea esi, [ebx + ebx*2]
mov ebx, dword [0x6dc4703c]
shl esi, 2
add ebx, esi
mov dword [ebx + 8], eax
mov dword [ebx], 0
call fcn.6dc43ca0
add eax, dword [edi + 0xc]
mov dword [ebx + 4], eax
lea eax, [ebp - 0x34]
mov dword [esp + 4], eax
mov eax, dword [0x6dc4703c]
mov dword [esp + 8], 0x1c
mov eax, dword [eax + esi + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x6dc4338a
mov eax, dword [ebp - 0x20]
cmp eax, 0x40
jne 0x6dc43330
add dword [0x6dc47038], 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 4
je 0x6dc4331f
cmp eax, 0x80
je 0x6dc4331f
cmp eax, 8
je 0x6dc4331f
mov eax, dword [ebp - 0x28]
add esi, dword [0x6dc4703c]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 0xc], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x6dc4331f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.6dc43220
xor ebx, ebx
jmp 0x6dc432bb
mov eax, dword [0x6dc4703c]
mov eax, dword [eax + esi + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.6dc43220
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call fcn.6dc43220
lea esi, [esi]

Function at 0x6dc43ad0
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x6dc43b08
xor edx, edx
nop
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
ja 0x6dc43afe
add ecx, dword [eax + 8]
cmp ebx, ecx
jb 0x6dc43b0a
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x6dc43af0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x4039e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x469793
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x47c5a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor eax, eax
or ecx, 0xffffffff
mov dword [edi + 8], ecx
mov dword [edi + 4], ecx
mov dword [edi + 0xc], eax
mov dword [edi + 0x20], 0x547224
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], eax
mov dword [edi + 0x24], eax
mov dword [edi + 0x28], eax
mov dword [ebp - 4], eax
lea ebx, [edi + 0x34]
mov dword [edi], vtable.TiXmlDocument.0
mov dword [ebx], 0x547224
mov byte [ebp - 4], 1
mov dword [edi + 0x40], ecx
mov dword [edi + 0x3c], ecx
push 0x472d80
xor esi, esi
mov dword [edi + 0x38], 4
mov byte [edi + 0x44], al
mov byte [edi + 0x2c], al
mov dword [edi + 0x30], eax
call fcn.0040a710
xor eax, eax
mov dword [edi + 0x40], eax
mov dword [edi + 0x3c], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x403d80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
test ebx, ebx
jne 0x403dcc
cmp byte [edi + 0x2c], bl
jne 0x403dc4
mov byte [edi + 0x2c], 1
mov dword [edi + 0x30], 2
mov edx, dword [str.Failed_to_open_file]
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403da7
sub eax, esi
push edx
lea ebx, [edi + 0x34]
mov esi, eax
call fcn.0040a710
or eax, 0xffffffff
mov dword [edi + 0x40], eax
mov dword [edi + 0x3c], eax
pop esi
xor al, al
pop ebx
pop ebp
ret 8
mov esi, dword [edi + 0x18]
test esi, esi
je 0x403de4
mov ecx, esi
mov eax, dword [ecx]
mov edx, dword [eax]
mov esi, dword [esi + 0x28]
push 1
call edx
test esi, esi
jne 0x403dd3
xor ecx, ecx
push 2
or eax, 0xffffffff
push ecx
mov dword [edi + 0x18], ecx
mov dword [edi + 0x1c], ecx
push ebx
mov dword [edi + 8], eax
mov dword [edi + 4], eax
call fcn.00441af2
push ebx
call fcn.00441a03
push 0
mov ebx, eax
mov eax, dword [ebp + 8]
push 0
push eax
call fcn.00441af2
add esp, 0x1c
test ebx, ebx
jg 0x403e42
cmp byte [edi + 0x2c], 0
jne 0x403dc4
mov byte [edi + 0x2c], 1
mov dword [edi + 0x30], 0xc
mov edx, dword [str.Error_document_empty.]
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403e36
jmp 0x403dae
lea ecx, [ebx + 1]
push ecx
call fcn.004408e7
mov edx, dword [ebp + 8]
push edx
push 1
mov esi, eax
push ebx
push esi
mov byte [esi], 0
call fcn.00441852
add esp, 0x14
cmp eax, 1
je 0x403e9c
push esi
call fcn.004401d7
add esp, 4
cmp byte [edi + 0x2c], 0
jne 0x403dc4
mov byte [edi + 0x2c], 1
mov dword [edi + 0x30], 2
mov edx, dword [str.Failed_to_open_file]
mov eax, edx
lea esi, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403e90
jmp 0x403dae
mov byte [esi + ebx], 0
cmp byte [esi], 0
mov eax, esi
mov ecx, esi
je 0x403ecc
lea esp, [esp]
mov dl, byte [eax]
cmp dl, 0xd
jne 0x403ec3
mov byte [ecx], 0xa
inc eax
inc ecx
cmp byte [eax], 0xa
jne 0x403ec7
jmp 0x403ec6
mov byte [ecx], dl
inc ecx
inc eax
cmp byte [eax], 0
jne 0x403eb0
mov byte [ecx], 0
mov ecx, dword [ebp + 0xc]
mov eax, dword [edi]
mov edx, dword [eax + 8]
push ecx
push 0
push esi
mov ecx, edi
call edx
push esi
call fcn.004401d7
add esp, 4
xor eax, eax
cmp byte [edi + 0x2c], al
pop esi
sete al
pop ebx
pop ebp
ret 8
Function at 0x40ab50
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x40ab76
push str.createSnapshot__of_processes_
call fcn.00425870
add esp, 4
xor eax, eax
pop edi
pop ebp
ret
push esi
mov esi, dword [ebp + 0xc]
push esi
push edi
mov dword [esi], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40ab92
push str.process32First
jmp 0x40abbb
push ebx
mov ebx, dword [ebp + 8]
cmp dword [esi + 8], ebx
je 0x40abb3
jmp 0x40aba0
push esi
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x40abb0
cmp dword [esi + 8], ebx
jne 0x40aba0
cmp dword [esi + 8], ebx
pop ebx
je 0x40abd0
push str.finding_proc_failed.
call fcn.00425870
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
xor eax, eax
pop edi
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, 1
pop edi
pop ebp
ret
Function at 0x40e000
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4657ab
mov eax, dword fs:[0]
push eax
sub esp, 0x268
mov eax, dword [0x47c5a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov esi, ecx
cmp dword [esi + 0x6c], 0
mov dword [ebp - 0x224], eax
je 0x40e19c
push 0x46abc0
lea ecx, [ebp - 0x274]
call fcn.00402de0
push edi
push 0x104
lea edx, [ebp - 0x220]
push edx
push 0x472d80
push str.EadIpv6Addr
lea ecx, [ebp - 0x274]
push 0x46c7ac
mov dword [ebp - 4], 0
mov dword [esi + 0x6c], ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x220]
push eax
push str.eadIpv6Addr
mov ecx, esi
call fcn.00406dc0
push str..MaxUserCtrl
push 0x46c7ac
lea ecx, [ebp - 0x118]
push 0x46c5b4
push ecx
call fcn.00440eaa
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
add esp, 0x10
push edi
push 0xffffffffffffffff
lea edx, [ebp - 0x118]
push edx
push str.Common
call ebx
cmp eax, 0xffffffff
je 0x40e0e2
push eax
push str.MaxUserCtrl
mov ecx, esi
call fcn.00407040
push str..ProbationCtrl
push 0x46c7ac
lea eax, [ebp - 0x118]
push 0x46c5b4
push eax
call fcn.00440eaa
add esp, 0x10
push edi
push 0xffffffffffffffff
lea ecx, [ebp - 0x118]
push ecx
push str.Common
call ebx
cmp eax, 0xffffffff
je 0x40e123
push eax
push str.ProbationCtrl
mov ecx, esi
call fcn.00407040
push str..TimeStamp
push 0x46c7ac
lea edx, [ebp - 0x118]
push 0x46c5b4
push edx
call fcn.00440eaa
add esp, 0x10
push edi
push 0x104
lea eax, [ebp - 0x220]
push eax
push 0x472d80
lea ecx, [ebp - 0x118]
push ecx
push str.Common
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [ebp - 0x220]
push edx
push str.TimeStamp
mov ecx, esi
call fcn.00406dc0
mov ecx, dword [ebp - 0x224]
lea eax, [ebp - 0x274]
push eax
call fcn.00402720
lea ecx, [ebp - 0x274]
mov dword [ebp - 4], 0xffffffff
call fcn.00402fa0
push 1
mov ecx, esi
call fcn.00407280
movzx eax, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043fe5a
mov esp, ebp
pop ebp
ret 8