joyce8/EMBER2024-capa huggingface dataset:
Function at 0xc1f001
Capabilities:
Parse pe header

Disassembly:
jmp 0xc5e010
push 0
call dword [0xc9d0e8]
test eax, eax
je 0xc5e04f
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0xc5e04f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0xc5e04f
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0xc5e04f
cmp dword [ecx + 0x74], 0xe
jbe 0xc5e04f
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0xc1f31c
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
jmp 0xc34fe0
push esi
push edi
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [0xccaf90], eax
pop edi
pop esi
ret

Function at 0x4b37ea
Capabilities:
Hash data with crc32

Disassembly:
push 0x400
push 0
call dword [ebp + 0x412faf]
or eax, eax
je 0x4b3832
mov dword [ebp + 0x412eeb], eax
mov edx, eax
xor ebx, ebx
cmp ebx, 0x100
je 0x4b3830
mov eax, ebx
mov ecx, 8
test eax, 1
je 0x4b3824
shr eax, 1
xor eax, 0xedb88320
jmp 0x4b3826
shr eax, 1
loop 0x4b3814
mov dword [edx], eax
add edx, 4
inc ebx
jmp 0x4b3805
clc
ret
stc
ret

Function at 0x4b3834
Capabilities:
Encode data using xor

Disassembly:
or edx, edx
je 0x4b3857
jecxz 0x4b3857
push esi
push ebx
mov esi, dword [ebp + 0x412eeb]
movzx ebx, al
xor bl, byte [edx]
shr eax, 8
and eax, 0xffffff
xor eax, dword [esi + ebx]
inc edx
loop 0x4b3842
pop ebx
pop esi
ret
Function at 0x4011f0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
bswap esi
ror esi, 0x3f
dec ebx
and esi, 0xaf
ror edx, 0xf1
ror eax, 0xb8
rcl eax, 0x5f
dec esi
rcl edi, 0x39
inc edx
and eax, 0x25
sbb esi, 0x57
inc esi
and esi, 0x62
bswap edx
rol edx, 0xb
rcl edx, 0xc2
inc ebx
not edx
inc ebx
imul edx
imul eax
imul edi
neg edi
and esi, 0xa2
ror ebx, 0x1d
dec eax
dec eax
imul edi
imul edx
neg esi
inc edi
bswap ebx
neg edx
ror edx, 0x17
and eax, 0xd6
inc edi
and ebx, 0x2d
neg edi
neg edi
dec ebx
sub edi, 0x46
ror esi, 0x4c
or eax, 0xf3
dec esi
or esi, 0x83
add eax, 0xdd
inc edi
bswap eax
inc edx
xor ecx, ecx
xor edi, edi
rcl eax, 8
imul edx
imul edx
dec edx
neg edx
inc eax
neg esi
neg ebx
not edi
inc esi
add esi, 0xef
imul eax
not edi
rol ebx, 0xa8
mov edx, 0x74
imul eax
not ebx
and eax, 0x55
imul edx
ror esi, 0xbb
imul eax
dec esi
bswap ebx
neg ebx
imul esi
imul esi
dec edi
neg eax
mov eax, 0xac
add esi, 0xf6
or eax, 0x58
not eax
dec edx
mov eax, 0xec
dec eax
sbb edx, 0x53
ror esi, 0x92
or ebx, 0xe9
imul edi
and edx, 0x77
or eax, 0x3f
not edi
and edx, 0x17
rcr ebx, 0xd2
sub ebx, 0x30
bswap esi
ror esi, 0x49
bswap edx
dec esi
bswap edi
mov ecx, dword [ebp + 0xc]
sbb edi, 0x57
inc ebx
add edx, 0x44
inc edi
neg esi
imul edx
not ebx
mov edx, 0x90
and edi, 0x28
or edi, 0x2d
add edx, 0x10
dec ebx
imul eax
imul ebx
inc edi
or eax, 0xbc
inc edi
and edx, 0x21
bswap eax
dec eax
ror edi, 0x3c
and edi, 0x4f
neg edi
imul eax
sub edx, 0xbc
or esi, 0xce
rol ebx, 0xf5
or eax, 0x22
neg edi
rol edx, 0xd8
add edx, 0x5c
sub esi, 0x3a
and ebx, 0xc8
mov esi, 0x17
or edi, 0x3f
neg eax
bswap esi
neg edx
sbb esi, 0x23
ror eax, 0x17
ror edx, 0x9a
neg esi
sbb ebx, 0x34
add esi, 0x34
rcl edi, 0xd2
or ebx, 0x3c
ror esi, 0x70
inc esi
inc ebx
sub edi, 0x57
mov edi, dword [ebp + 8]
mov eax, esi
mov esi, esi
xor eax, ebx
not byte [edi]
xor eax, esi
xor esi, esi
mov ebx, ebx
sub byte [edi], 0x88
xor ebx, esi
mov eax, esi
mov ebx, eax
add byte [edi], 0x49
mov eax, esi
xor eax, esi
mov ebx, esi
imul byte [edi]
inc edi
loop 0x401386
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407534
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4108f0]
jne 0x40753e
repz ret
jmp fcn.0040b49c
Function at 0x407ea3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004057ca
and dword [ebp - 4], 0
cmp dword [0x4115d4], 0
mov ebx, eax
jne 0x407f54
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408005
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x408005
push eax
call fcn.00405758
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4115d4], eax
call esi
push eax
call fcn.00405758
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4115d8], eax
call esi
push eax
call fcn.00405758
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4115dc], eax
call esi
push eax
call fcn.00405758
pop ecx
mov dword [0x4115e4], eax
test eax, eax
je 0x407f54
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00405758
pop ecx
mov dword [0x4115e0], eax
mov eax, dword [0x4115e0]
cmp eax, ebx
je 0x407fac
cmp dword [0x4115e4], ebx
je 0x407fac
push eax
call fcn.004057d3
push dword [0x4115e4]
mov esi, eax
call fcn.004057d3
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x407fac
test edi, edi
je 0x407fac
call esi
test eax, eax
je 0x407fa3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x407fa3
test byte [ebp - 0xc], 1
jne 0x407fac
or dword [ebp + 0x10], 0x200000
jmp 0x407fe5
mov eax, dword [0x4115d8]
cmp eax, ebx
je 0x407fe5
push eax
call fcn.004057d3
pop ecx
test eax, eax
je 0x407fe5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x407fe5
mov eax, dword [0x4115dc]
cmp eax, ebx
je 0x407fe5
push eax
call fcn.004057d3
pop ecx
test eax, eax
je 0x407fe5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4115d4]
call fcn.004057d3
pop ecx
test eax, eax
je 0x408005
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408007
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405b3a
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 0xc]
mov dword [0x44b838], 0x44
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
je 0x405b5e
test al, 0x10
jne 0x405b61
mov dword [ebp + 0xc], ecx
lea eax, [ebp - 0x10]
push eax
push 0x44b838
push dword [ebp + 0xc]
push ecx
push ecx
push ecx
push ecx
push ecx
push dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x405b8c
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 8
Function at 0x405f07
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x449038
push esi
call fcn.00406322
push esi
call fcn.00405eb8
mov edi, eax
test edi, edi
jne 0x405f28
xor eax, eax
jmp 0x405f7a
push edi
call fcn.00406596
test byte [0x45d810], 0x80
je 0x405f41
mov al, byte [edi]
test al, al
je 0x405f24
cmp al, 0x5c
je 0x405f24
sub edi, esi
push esi
call fcn.00406338
cmp eax, edi
push esi
jle 0x405f64
call fcn.004067ca
test eax, eax
je 0x405f5c
test byte [eax], 0x10
je 0x405f24
push esi
call fcn.00405e6c
jmp 0x405f43
call fcn.00405e25
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405ff1
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x406020
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x63
pop edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x406065
mov eax, edi
dec edi
test eax, eax
jne 0x40602b
and byte [esi], al
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x40605f
Function at 0x406069
Capabilities:
Get common file path
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push str.MoveFileExA
push str.KERNEL32.dll
call fcn.00406808
test eax, eax
mov esi, dword [esp + 0x18]
je 0x406095
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x4061db
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [0x44b9c0], 0x4c554e
test esi, esi
mov edi, 0x400
mov ebp, 0x44b9c0
je 0x4060d9
push 1
push 0
push esi
call fcn.00405ff1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x4061e1
cmp eax, edi
jg 0x4061e1
mov esi, 0x44b438
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x4061e1
cmp eax, edi
jg 0x4061e1
push esi
push ebp
push str._s_s_r_n
push 0x44b038
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebx, eax
push 0x3f0
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.wininit.ini
push esi
call fcn.00406345
xor eax, eax
push eax
push 0x8000080
push 4
push eax
push eax
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x4061db
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x4061d4
lea eax, [esp + 0x18]
push 0
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4061d4
cmp edi, dword [esp + 0x18]
jne 0x4061d4
push str._Rename__r_n
push esi
call fcn.00405f7f
test eax, eax
jne 0x4061e8
lea eax, [esi + edi]
push str._Rename__r_n
push eax
call fcn.00406322
add edi, 0xa
mov eax, edi
push ebx
add eax, esi
push 0x44b038
push eax
call fcn.00405fcb
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 0x18]
push 0
add edi, ebx
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x45d890]
pop edi
pop esi
pop ebp
pop ebx
ret 8
add eax, 0xa
push 0x40a9fc
push eax
call fcn.00405f7f
test eax, eax
je 0x40619f
inc eax
lea edx, [esi + edi]
cmp eax, edx
mov ecx, eax
jae 0x406211
mov dl, byte [ecx]
mov byte [ecx + ebx], dl
inc ecx
lea edx, [esi + edi]
cmp ecx, edx
jb 0x406204
sub eax, esi
jmp 0x4061a1
Function at 0x406215
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
xor ebx, ebx
push eax
push 0x20019
push ebx
push dword [ebp + 0xc]
mov byte [esi], bl
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x406279
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x2000
push eax
lea eax, [ebp + 0x14]
push esi
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x406268
cmp dword [ebp + 0x14], 1
je 0x40626a
cmp dword [ebp + 0x14], 2
je 0x40626a
mov byte [esi], bl
push dword [ebp + 0xc]
mov byte [esi + 0x1fff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x40662f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x406654
mov eax, dword [0x40a8f8]
cmp eax, 0xffffffff
je 0x40664b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x40a8f8], 0xffffffff
jmp 0x4066c7
cmp dword [0x44d760], ebx
je 0x4066c7
cmp byte [0x44d360], bl
je 0x406693
cmp dword [0x40a8f8], 0xffffffff
jne 0x40669c
push 4
push 0x40000000
push 0x44d360
call fcn.00405ff1
cmp eax, 0xffffffff
mov dword [0x40a8f8], eax
je 0x4066c7
push 2
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [0x40a8f8], 0xffffffff
je 0x4066c7
push esi
mov esi, 0x4517a0
push 0x40aacc
push esi
call fcn.00406345
lea eax, [ebp + 8]
push ebx
push eax
push esi
call fcn.00406338
push eax
push esi
push dword [0x40a8f8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
pop ebx
pop ebp
ret 4

Function at 0x40686f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor esi, esi
cmp dword [0x44bdc4], esi
push edi
jne 0x4068a9
mov ecx, 0x44bdc0
push 8
mov eax, esi
pop edi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec edi
jne 0x406885
mov dword [ecx], eax
add ecx, 4
inc esi
cmp ecx, 0x44c1c0
jl 0x406880
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov edx, ecx
dec ecx
test edx, edx
not eax
jbe 0x4068de
lea edx, [ecx + 1]
mov ecx, dword [esp + 0x10]
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x44bdc0]
xor eax, esi
inc ecx
dec edx
jne 0x4068c1
pop edi
pop esi
not eax
ret 0xc
Function at 0x402240
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
jne 0x402259
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov esi, eax
test esi, esi
jne 0x40226d
pop esi
pop edi
xor eax, eax
pop ebx
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x40228e
cmp esi, eax
jae 0x402267
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x402280
cmp esi, eax
jae 0x402267
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x405270
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46d958
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebp
push esi
push edi
mov esi, ecx
call fcn.0045bebc
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0xc], eax
mov dword [esp + 0x20], 0
call fcn.0045bebc
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x10], eax
mov byte [esp + 0x20], 1
call fcn.0045bebc
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x30], 2
call fcn.00405070
mov ecx, dword [esi + 0x168]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x147
push ecx
call ebp
test eax, eax
mov edi, dword [esp + 0x2c]
jne 0x405321
lea edx, [esp + 0xc]
push edx
mov ecx, edi
call fcn.004028b0
jmp 0x405340
mov eax, dword [esi + 0x168]
push edi
push 0
push 0
push 0x147
push eax
call ebp
push eax
lea ecx, [esi + 0x14c]
call fcn.0046464e
mov ecx, dword [edi]
mov edx, dword [ecx - 0xc]
lea eax, [edx - 1]
test eax, eax
jl 0x405455
cmp eax, edx
jg 0x405455
cmp byte [ecx + eax], 0x5c
je 0x40536c
push 1
push 0x474568
mov ecx, edi
call fcn.00404f40
call fcn.00469602
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x1c]
mov ecx, dword [eax + 0x55c]
test ecx, ecx
mov ebp, dword [esp + 0x10]
je 0x405392
mov ecx, dword [esp + 0x30]
mov eax, dword [ecx]
mov ecx, dword [eax - 0xc]
push ecx
push eax
jmp 0x405397
mov eax, dword [ebp - 0xc]
push eax
push ebp
mov ecx, edi
call fcn.00404f40
push 1
push 0x474564
mov ecx, edi
call fcn.00404f40
mov ecx, esi
call fcn.00404a10
lea ecx, [eax*4 + 0x4949e8]
test ecx, ecx
jne 0x4053c2
xor eax, eax
jmp 0x4053d0
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4053c7
sub eax, esi
push eax
push ecx
mov ecx, edi
call fcn.00404f40
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x20], 1
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4053fc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea eax, [ebp - 0x10]
mov byte [esp + 0x20], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40541b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov dword [esp + 0x20], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405441
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x18
ret 0xc
push 0x80070057
call fcn.00401490
int3
Function at 0x40be80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46dec8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x1c]
mov eax, dword [esi]
mov ecx, dword [eax - 0x10]
mov edx, dword [ecx]
push edi
xor edi, edi
mov dword [esp + 8], edi
call dword [edx + 0x10]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax]
mov edx, dword [eax - 0xc]
mov ecx, dword [esi]
mov esi, dword [ecx - 0xc]
push edx
push eax
push esi
push ecx
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x28], edi
call fcn.0040bd60
mov esi, dword [esp + 0x34]
add esi, 0xfffffff0
push esi
call fcn.00402590
mov edi, dword [esp + 0x34]
add eax, 0x10
mov dword [edi], eax
add esp, 0x18
mov dword [esp + 0x14], 0xffffffff
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x40bf12
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov ecx, dword [esp + 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x40c1e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46df08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
call fcn.0045bebc
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
push eax
lea ecx, [esp + 8]
push 0x472b7c
push ecx
mov dword [esp + 0x1c], 0
call fcn.00401ab0
mov edx, dword [esp + 0x30]
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
add esp, 0xc
push edx
push esi
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringA]
lea eax, [esi - 0x10]
mov dword [esp + 0x10], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
pop esi
jg 0x40c266
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 0x10
Function at 0x40cb90
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x46dfb6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xd0
push ebx
push ebp
push esi
push edi
xor esi, esi
push esi
lea ecx, [esp + 0x1c]
call fcn.00401c70
mov eax, dword [esp + 0xf4]
mov ecx, dword [esp + 0xf0]
mov ebp, dword [sym.imp.KERNEL32.DLL_GetDriveTypeA]
mov dword [esp + 0xe8], esi
mov dword [esp + 0xdc], eax
mov dword [esp + 0x10], esi
mov byte [ecx], 0x20
mov bl, 0x41
mov edi, 0x41
jmp 0x40cbf0
call fcn.0045bebc
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x14], eax
push edi
lea eax, [esp + 0x18]
push str._c:_
push eax
mov byte [esp + 0xf4], 1
call fcn.00401ab0
mov esi, dword [esp + 0x20]
add esp, 0xc
push esi
call ebp
cmp eax, 5
jne 0x40cc3c
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xf0]
inc eax
mov byte [ecx], bl
mov dword [esp + 0x10], eax
lea eax, [esi - 0x10]
mov byte [esp + 0xe8], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40cc5e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
inc bl
inc edi
cmp bl, 0x5a
jle 0x40cbf0
mov eax, dword [esp + 0x10]
test eax, eax
pop edi
pop esi
pop ebp
pop ebx
jne 0x40ccaf
push 0x35
call fcn.00419c20
push eax
call fcn.004143b0
add esp, 8
lea ecx, [esp + 8]
mov dword [esp + 0xd8], 0xffffffff
call fcn.00401c10
xor eax, eax
mov ecx, dword [esp + 0xd0]
mov dword fs:[0], ecx
add esp, 0xdc
ret 8
cmp eax, 1
je 0x40ccd2
lea ecx, [esp + 8]
call fcn.004574aa
cmp eax, 1
jne 0x40cc82
mov al, byte [esp + 0xc8]
mov ecx, dword [esp + 0xe0]
mov byte [ecx], al
lea ecx, [esp + 8]
mov dword [esp + 0xd8], 0xffffffff
call fcn.00401c10
mov ecx, dword [esp + 0xd0]
mov eax, 1
mov dword fs:[0], ecx
add esp, 0xdc
ret 8
Function at 0x410ec0
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push 5
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
ret 4
Function at 0x4138f0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x414480
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [esp + 0x114]
push esi
xor edx, edx
mov esi, 0x3e8
div esi
mov dword [esp + 0xc], 1
imul edx, edx, 0x3e8
mov dword [esp + 4], eax
mov eax, dword [ecx]
lea ecx, [esp + 4]
push ecx
push 0
mov dword [esp + 0x10], edx
push 0
lea edx, [esp + 0x18]
push edx
push 0
mov dword [esp + 0x24], eax
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
pop esi
jne 0x4144da
xor eax, eax
add esp, 0x10c
ret 8
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov eax, 1
mov dword [edx], ecx
add esp, 0x10c
ret 8

Function at 0x415330
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46e535
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esp + 8], esi
mov dword [esi], 0x47752c
mov dword [esi + 4], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0xc], edi
mov dword [esi + 8], edi
mov dword [esp + 0x14], edi
call fcn.0045bebc
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esi + 0x1c], eax
mov byte [esp + 0x14], 1
call fcn.0045bebc
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esi + 0x20], eax
mov byte [esp + 0x14], 2
call fcn.0045bebc
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esi + 0x24], eax
mov byte [esp + 0x14], 3
call fcn.0045bebc
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esi + 0x2c], eax
mov byte [esp + 0x14], 4
call fcn.0045bebc
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esi + 0x30], eax
lea ecx, [esi + 0x34]
mov byte [esp + 0x14], 5
call fcn.00455ce7
mov byte [esp + 0x14], 6
call fcn.0045bebc
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esi + 0x48], eax
lea ecx, [esi + 0x4c]
mov byte [esp + 0x14], 7
call fcn.00455ce7
mov dword [esi + 0x60], 0x47752c
mov dword [esi + 0x64], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x68], edi
call fcn.0045bebc
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esi + 0x78], eax
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x74], edi
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret