joyce8/EMBER2024-capa huggingface dataset:
Function at 0x9bff30
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0xa21230]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [edi + 0xc]
mov eax, dword [esi + 0x14c]
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x14]
push edx
push eax
mov dword [ebp - 0x1c], eax
or ebx, 0xffffffff
mov dword [ebp - 0x18], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x9bff86
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x14]
push ecx
push edx
mov dword [ebp - 0x18], 0x10
call dword [sym.imp.WS2_32.dll_accept]
mov ebx, eax
mov eax, dword [ebp - 0x1c]
push eax
push esi
push edi
call fcn.009a92c0
add esp, 0xc
cmp ebx, 0xffffffff
jne 0x9bffbc
push str.Error_accept__ing_server_connect
push edi
call fcn.009a2680
add esp, 8
pop esi
mov eax, 0x1e
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.009861d0
mov esp, ebp
pop ebp
ret
push str.Connection_accepted_from_server
push edi
call fcn.009a2610
push 1
push ebx
mov dword [esi + 0x2c0], 0
mov dword [esi + 0x14c], ebx
call fcn.009d4de0
add esp, 0x10
mov dword [esi + 0x30c], 1
cmp dword [edi + 0x1d8], 0
je 0x9c003e
push 1
push edi
call fcn.009a01b0
mov ecx, dword [edi + 0x1dc]
mov edx, dword [edi + 0x1d8]
push 1
push ebx
push ecx
call edx
push 0
push edi
mov ebx, eax
call fcn.009a01b0
add esp, 0x1c
test ebx, ebx
je 0x9c003e
push edi
call fcn.009bfe90
add esp, 4
pop esi
mov eax, 0x2a
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.009861d0
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.009861d0
mov esp, ebp
pop ebp
ret
Function at 0x9c37a0
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
push esi
add eax, edx
xor esi, esi
push edi
mov edi, dword [ebx + 0xc]
cmp eax, 2
je 0x9c37d9
push str.Couldnt_set_desired_mode
push ebx
call fcn.009a2680
add esp, 8
pop edi
lea eax, [esi + 0x11]
pop esi
pop ebx
pop ebp
ret
cmp ecx, 0xc8
je 0x9c37f0
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200
push ebx
call fcn.009a2610
add esp, 0xc
mov eax, dword [ebp + 8]
cmp eax, 0x13
jne 0x9c3809
push edi
push ebx
call fcn.009c3720
add esp, 8
pop edi
mov esi, eax
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x14
jne 0x9c381a
call fcn.009c0bc0
pop edi
mov esi, eax
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x15
jne 0x9c382d
mov eax, ebx
call fcn.009c3780
pop edi
mov esi, eax
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x16
jne 0x9c383b
mov eax, ebx
call fcn.009c3790
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
Function at 0x9cb8e0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, eax
test ebx, ebx
je 0x9cb8f2
cmp dword [ebx], 0
jne 0x9cb904
test edi, edi
je 0x9cb8fb
cmp dword [edi], 0
jne 0x9cb904
test esi, esi
je 0x9cb967
cmp dword [esi], 0
je 0x9cb967
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
lea edx, [ebp - 8]
push edx
call fcn.009dd2f0
add esp, 0xc
test esi, esi
je 0x9cb921
cmp dword [esi], 0
jne 0x9cb923
xor esi, esi
test edi, edi
je 0x9cb930
cmp dword [edi], 0
je 0x9cb930
mov edx, edi
jmp 0x9cb932
xor edx, edx
test ebx, ebx
je 0x9cb951
cmp dword [ebx], 0
je 0x9cb951
push eax
mov eax, dword [ebp + 8]
push esi
push edx
mov ecx, ebx
push ecx
inc eax
push eax
call dword [sym.imp.WS2_32.dll_select]
pop esi
mov esp, ebp
pop ebp
ret
push eax
mov eax, dword [ebp + 8]
push esi
push edx
xor ecx, ecx
push ecx
inc eax
push eax
call dword [sym.imp.WS2_32.dll_select]
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push ecx
push edx
call fcn.009cb890
add esp, 8
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x9d3920
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
lea eax, [ebp - 0x24]
push edi
push eax
call fcn.009add70
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov edi, dword [eax]
mov ebx, dword [eax + 4]
mov eax, dword [ebp + 8]
push eax
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
call fcn.009b3370
mov ecx, dword [ebp + 0xc]
push ecx
mov esi, eax
call fcn.009b3370
add esp, 0xc
push 1
push eax
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x9d39d8
jmp 0x9d3970
lea edx, [ebp - 0x24]
push edx
call fcn.009add70
mov edx, dword [ebp - 0xc]
sub esp, 0xc
mov ecx, esp
mov dword [ecx], edi
mov dword [ecx + 4], ebx
mov dword [ecx + 8], edx
mov edx, dword [ebp - 8]
mov dword [ecx + 0xc], edx
mov edx, dword [eax]
sub esp, 0x10
mov ecx, esp
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], eax
call fcn.009ade10
add esp, 0x20
test edx, edx
ja 0x9d39fe
jb 0x9d39bf
cmp eax, 0x3e8
ja 0x9d39fe
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 4]
push 1
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x9d3970
test esi, esi
je 0x9d39e5
push esi
call fcn.00981615
add esp, 4
mov eax, dword [ebp - 4]
test eax, eax
je 0x9d39f5
push eax
call fcn.00981615
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x9d3a0b
push esi
call fcn.00981615
add esp, 4
mov eax, dword [ebp - 4]
test eax, eax
je 0x9d3a1b
push eax
call fcn.00981615
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x9d8190
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0xa21230]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, edx
push edi
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x110], edi
mov dword [ebp - 0x108], ecx
xor ebx, ebx
xor esi, esi
call fcn.009b3370
add esp, 4
mov dword [ebp - 0x118], eax
test eax, eax
jne 0x9d820a
push 0x100
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.009d2980
push eax
mov eax, dword [ebp - 0x108]
push edi
push str.schannel:_invalid_path_name_for_CA_file__s:__s
push eax
call fcn.009a2680
add esp, 0x1c
lea esi, [ebx + 0x4d]
jmp 0x9d8373
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x10c], eax
cmp eax, 0xffffffff
jne 0x9d8266
push 0x100
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.009d2980
mov edx, dword [ebp - 0x108]
push eax
push edi
push str.schannel:_failed_to_open_CA_file__s:__s
push edx
call fcn.009a2680
add esp, 0x1c
mov esi, 0x4d
jmp 0x9d8373
lea ecx, [ebp - 0x124]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x9d82b0
push 0x100
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.009d2980
push eax
push edi
push str.schannel:_failed_to_determine_size_of_CA_file__s:__s
mov eax, dword [ebp - 0x108]
push eax
call fcn.009a2680
add esp, 0x1c
mov esi, 0x4d
jmp 0x9d8366
mov edi, dword [ebp - 0x124]
cmp dword [ebp - 0x120], ebx
jl 0x9d82e8
jg 0x9d82c8
cmp edi, 0x100000
jbe 0x9d82e8
mov ecx, dword [ebp - 0x108]
push 0x100000
push str.schannel:_CA_file_exceeds_max_size_of__u_bytes
push ecx
call fcn.009a2680
mov esi, 0x4d
jmp 0x9d8363
lea edx, [edi + 1]
push edx
call dword [0xa2233c]
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x9d8300
lea esi, [eax + 0x1b]
jmp 0x9d8366
test edi, edi
je 0x9d8341
push 0
lea eax, [ebp - 0x114]
push eax
mov eax, dword [ebp - 0x10c]
mov ecx, edi
sub ecx, esi
push ecx
lea edx, [esi + ebx]
push edx
push eax
mov dword [ebp - 0x114], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x9d83a7
mov eax, dword [ebp - 0x114]
test eax, eax
je 0x9d83a3
add esi, eax
cmp esi, edi
jb 0x9d8304
mov ecx, dword [ebp - 0x108]
mov edx, dword [ebp - 0x11c]
push ecx
push ebx
push edx
mov edx, dword [ebp - 0x110]
mov ecx, edi
mov byte [edi + ebx], 0
call fcn.009d7f20
mov esi, eax
add esp, 0xc
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [0xa22340]
mov eax, dword [ebp - 0x118]
add esp, 4
test eax, eax
je 0x9d8390
push eax
call fcn.00981615
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.009861d0
mov esp, ebp
pop ebp
ret
mov edi, esi
jmp 0x9d8341
push 0x100
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.009d2980
mov edx, dword [ebp - 0x110]
push eax
push edx
push str.schannel:_failed_to_read_from_CA_file__s:__s
jmp 0x9d8297
Function at 0x9d8d60
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0xa21230]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0xf0000040
push 1
push 0
push 0
lea eax, [ebp - 0x1c]
mov esi, 8
push eax
mov dword [ebp - 0x20], esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x9d8df1
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], esi
lea esi, [ebp - 0xc]
mov eax, ebx
mov word [ebp - 0x18], 0x208
mov dword [ebp - 0x14], 0x6601
call fcn.009d8cd0
mov ecx, esi
push 8
push ecx
call fcn.009de430
mov ecx, dword [ebp - 0x1c]
add esp, 8
lea edx, [ebp - 0x24]
push edx
push 0
push 0
push 0x14
lea eax, [ebp - 0x18]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x9d8e02
mov edx, dword [ebp - 0x1c]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.009861d0
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [edi], ecx
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0x20]
push eax
lea ecx, [ebp - 0x20]
push ecx
push edi
push 0
push 0
mov dword [edi + 4], edx
mov edx, dword [ebp - 0x24]
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov ecx, dword [ebp - 0x1c]
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
pop esi
call fcn.009861d0
mov esp, ebp
pop ebp
ret

Function at 0x9da8d0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push esi
mov byte [esi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [esi + edi - 1], 0
test eax, eax
jne 0x9da903
push 0x2e
push esi
call fcn.009862e0
add esp, 8
test eax, eax
je 0x9da901
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
pop ebp
ret

Function at 0x9de480
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
push edi
push 0xf0000040
push 1
push 0
push 0
lea edi, [esi + 4]
push esi
mov dword [esi], 0
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x9de4b9
mov eax, dword [esi]
push edi
push 0
push 0
push 0x8002
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
pop edi
ret
Function at 0x9df950
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea eax, [ecx + eax*2 + 0xc]
push edi
push eax
call dword [0xa2233c]
mov edi, eax
add esp, 4
test edi, edi
jne 0x9df97b
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], eax
mov edx, dword [esi + 0xc]
add edx, eax
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], edx
cmp ebx, dword [esi + 0x10]
jbe 0x9df9c2
push eax
mov eax, dword [esi]
call eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push ebx
push ecx
push edx
call eax
mov ebx, dword [edi + 8]
mov ecx, dword [edi + 4]
add ebx, dword [esi + 0xc]
mov edx, dword [esi + 8]
push ecx
push ebx
call edx
mov eax, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], eax
jmp 0x9df9c5
mov ebx, dword [ebp + 0xc]
mov ecx, dword [edi + 4]
mov edx, dword [esi]
push ecx
call edx
mov eax, dword [edi + 8]
mov ecx, dword [esi]
push eax
call ecx
mov eax, dword [ebp + 0x10]
add esp, 8
mov dword [ebp - 4], 0
test eax, eax
je 0x9dfa26
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea esp, [esp]
mov dl, byte [ebx]
xor dl, 0x36
mov byte [ebp + 0xb], dl
mov ecx, dword [edi + 4]
mov edx, dword [esi + 4]
push 1
lea eax, [ebp + 0xb]
push eax
push ecx
call edx
mov al, byte [ebx]
xor al, 0x5c
mov byte [ebp + 0xb], al
mov edx, dword [edi + 8]
mov eax, dword [esi + 4]
push 1
lea ecx, [ebp + 0xb]
push ecx
push edx
inc ebx
call eax
add esp, 0x18
dec dword [ebp - 8]
jne 0x9df9f0
mov ecx, dword [ebp - 4]
pop ebx
cmp ecx, dword [esi + 0x10]
jae 0x9dfa5f
nop
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push 1
push 0xa1618a
push edx
call eax
mov ecx, dword [edi + 8]
mov edx, dword [esi + 4]
push 1
push 0xa1618b
push ecx
call edx
mov eax, dword [ebp - 4]
inc eax
add esp, 0x18
mov dword [ebp - 4], eax
cmp eax, dword [esi + 0x10]
jb 0x9dfa30
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x9dfb30
Capabilities:
Create new key via cryptacquirecontext
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0xf0000040
push 0x18
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x9dfb63
mov ecx, dword [esi]
lea eax, [esi + 4]
push eax
push 0
push 0
push 0x800c
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
xor eax, eax
pop esi
pop ebp
ret
Function at 0x9e1cf5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x9e1d1c
call fcn.00984218
mov dword [eax], esi
call fcn.00984205
push 0x16
pop esi
mov dword [eax], esi
call fcn.00984e5a
mov eax, esi
jmp 0x9e1d71
test dword [ebp + 0xc], 0xfffffff9
jne 0x9e1d02
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x9e1d49
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0098422b
pop ecx
call fcn.00984205
mov eax, dword [eax]
jmp 0x9e1d71
test al, 0x10
jne 0x9e1d6f
test al, 1
je 0x9e1d6f
test byte [ebp + 0xc], 2
je 0x9e1d6f
call fcn.00984218
mov dword [eax], 5
call fcn.00984205
mov dword [eax], 0xd
jmp 0x9e1d40
xor eax, eax
pop esi
pop ebp
ret
Function at 0x439bf2
Capabilities:
Encode data using xor

Disassembly:
push edi
push dword [esp + 0x10]
call 0x3d5710
xor edi, edi
pop ecx
cmp dword [esp + 0xc], edi
jbe 0x439c1c
push esi
mov eax, dword [esp + 0xc]
lea esi, [edi + eax]
call 0x3d5880
xor byte [esi], al
inc edi
cmp edi, dword [esp + 0x10]
jb 0x439c06
pop esi
pop edi
ret 0xc

Function at 0x439f02
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
push esi
push edi
push 1
pop ebx
mov esi, ecx
mov byte [ebp - 1], bl
push dword [esi]
lea eax, [ebp - 0x14]
push 4
push ebx
push eax
call fcn.0043f221
add esp, 0x10
lea eax, [ebp - 0x14]
mov ecx, esi
push 0x16fa
push 4
push eax
call fcn.00439bf2
and byte [ebp - 0x10], 0
lea eax, [ebp - 0x14]
push 0x49c018
push eax
call fcn.0043f3e0
pop ecx
test eax, eax
pop ecx
jne 0x43a033
push dword [esi]
lea eax, [ebp - 0xc]
push ebx
push 4
push eax
call fcn.0043f221
mov edi, dword [ebp - 0xc]
push dword [esi]
xor edi, 0x29bc
lea eax, [ebp - 0x11c]
push edi
push ebx
push eax
call fcn.0043f221
add esp, 0x20
lea eax, [edi + 0xa25e]
mov ecx, esi
push eax
lea eax, [ebp - 0x11c]
push edi
push eax
call fcn.00439bf2
push dword [esi]
and byte [ebp + edi - 0x11c], 0
lea eax, [ebp - 0xc]
push ebx
push 4
push eax
call fcn.0043f221
mov edi, dword [ebp - 0xc]
push dword [esi]
xor edi, 0x29ac
push edi
push ebx
push dword [ebp + 0xc]
call fcn.0043f221
add esp, 0x20
lea eax, [edi + 0xf25e]
mov ecx, esi
push eax
push edi
push dword [ebp + 0xc]
call fcn.00439bf2
mov eax, dword [ebp + 0xc]
push dword [ebp + 8]
and byte [edi + eax], 0
lea eax, [ebp - 0x11c]
push eax
call fcn.0043f3e0
pop ecx
test eax, eax
pop ecx
je 0x43a04a
push ebx
push ebx
push dword [esi]
call fcn.0043f2c8
push dword [esi]
lea eax, [ebp - 8]
push ebx
push 4
push eax
call fcn.0043f221
xor dword [ebp - 8], 0x45aa
push ebx
push 4
push dword [esi]
call fcn.0043f2c8
push ebx
push 0x10
push dword [esi]
call fcn.0043f2c8
push ebx
push dword [ebp - 8]
push dword [esi]
call fcn.0043f2c8
add esp, 0x40
jmp 0x43a037
and byte [ebp - 1], 0
cmp byte [ebp - 1], bl
je 0x439f16
push 6
pop eax
pop edi
pop esi
pop ebx
leave
ret 8
xor eax, eax
jmp 0x43a043

Function at 0x43a08e
Capabilities:
Hash data using crc32b

Disassembly:
mov eax, ecx
push esi
push edi
mov edi, eax
or dword [eax + 0x400], 0xffffffff
xor esi, esi
mov edx, esi
push 8
shl edx, 0x18
pop ecx
test edx, 0x80000000
je 0x43a0b7
add edx, edx
xor edx, 0x4c11db7
jmp 0x43a0b9
shl edx, 1
dec ecx
jne 0x43a0a5
mov dword [edi], edx
inc esi
add edi, 4
cmp esi, 0x100
jl 0x43a09d
pop edi
pop esi
ret
Function at 0x43a241
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x14], 1
jne 0x43a266
mov eax, dword [esi + 0xc]
push 8
add eax, dword [esi + 4]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0043f470
add esp, 0xc
jmp 0x43a279
push dword [esi + 0x1c]
lea eax, [ebp - 8]
push 8
push 1
push eax
call fcn.0043f221
add esp, 0x10
movzx eax, byte [ebp - 4]
movzx ecx, byte [ebp - 3]
shl eax, 8
or eax, ecx
add dword [esi + 0xc], 8
movzx ecx, byte [ebp - 2]
shl eax, 8
or eax, ecx
and byte [ebp - 4], 0
movzx ecx, byte [ebp - 1]
shl eax, 8
or eax, ecx
mov ecx, dword [ebp + 8]
push 0x49c020
mov dword [ecx], eax
lea eax, [ebp - 8]
push eax
call fcn.0043f3e0
neg eax
pop ecx
sbb eax, eax
pop ecx
neg eax
pop esi
leave
ret 4

Function at 0x4785bf
Capabilities:
Encode data using xor

Disassembly:
ror dword [esi - 0xad6fa8e], 1
add al, 0x52
sbb al, byte [eax]
imul edi, dword [ebx], 0x4ef390d6
and al, 0x62
lcall 0x4a93, 0xa604a078
dec edi
mov ebp, 0x40ef3921
or eax, 0x418f9022
dec edx
dec edi
cmp bh, cl
xor al, 0x87
xor al, 0
invalid
Function at 0x401006
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43f004]
jne 0x401010
repz ret
jmp fcn.004013fc

Function at 0x40703b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004028fd
and dword [ebp - 4], 0
cmp dword [0x443798], 0
mov ebx, eax
jne 0x4070ec
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40719d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40719d
push eax
call fcn.0040288b
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x443798], eax
call esi
push eax
call fcn.0040288b
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x44379c], eax
call esi
push eax
call fcn.0040288b
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4437a0], eax
call esi
push eax
call fcn.0040288b
pop ecx
mov dword [0x4437a8], eax
test eax, eax
je 0x4070ec
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040288b
pop ecx
mov dword [0x4437a4], eax
mov eax, dword [0x4437a4]
cmp eax, ebx
je 0x407144
cmp dword [0x4437a8], ebx
je 0x407144
push eax
call fcn.00402906
push dword [0x4437a8]
mov esi, eax
call fcn.00402906
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x407144
test edi, edi
je 0x407144
call esi
test eax, eax
je 0x40713b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40713b
test byte [ebp - 0xc], 1
jne 0x407144
or dword [ebp + 0x10], 0x200000
jmp 0x40717d
mov eax, dword [0x44379c]
cmp eax, ebx
je 0x40717d
push eax
call fcn.00402906
pop ecx
test eax, eax
je 0x40717d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40717d
mov eax, dword [0x4437a0]
cmp eax, ebx
je 0x40717d
push eax
call fcn.00402906
pop ecx
test eax, eax
je 0x40717d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x443798]
call fcn.00402906
pop ecx
test eax, eax
je 0x40719d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40719f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x438660
Capabilities:
Get hostname

Disassembly:
sub esp, 0x414
mov eax, dword [0x43f004]
xor eax, esp
mov dword [esp + 0x410], eax
push ebp
mov ebp, dword [esp + 0x41c]
push edi
cmp ebx, 0x182
jne 0x43869f
push 0
push 0
push 0
push str.sukeje
push str.nakefajijihi
push 0
call dword [sym.imp.KERNEL32.dll_UpdateResourceA]
jmp 0x4386c9
cmp ebx, 0x19f
jne 0x4386c9
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 0
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
xor edi, edi
test ebx, ebx
jle 0x438743
push esi
lea esi, [esp + 0x14]
mov dword [esp + 0x10], 5
mov dword [esp + 0x14], 0
call fcn.00438650
mov eax, dword [esp + 0x14]
add eax, 0x46
mov dword [esp + 0x10], eax
sub dword [esp + 0x10], 0x46
movsx eax, byte [edi + ebp]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x10]
xor dword [esp + 0xc], eax
mov cl, byte [esp + 0xc]
mov byte [edi + ebp], cl
cmp ebx, 0xf
jne 0x43873d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoA]
inc edi
cmp edi, ebx
jl 0x4386d0
pop esi
pop edi
pop ebp
cmp ebx, 0x2d
jne 0x43875e
mov dword [0x2b419c0], 0xa62e7790
mov dword [0x2b419c4], 0xffffffff
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.00401006
add esp, 0x414
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x406058], 1
mov dword [0x406054], 1
mov dword [0x406050], 1
jne 0x401056
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010b0
mov dword [0x40600c], eax
mov eax, dword [0x406064]
test eax, eax
je 0x4010a0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x406078]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x406060]
mov dword [eax], edx
call dbg._setargv
cmp dword [0x4034f0], 1
je 0x4010e0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x401070
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x4010f8
cmp dx, 0x20b
jne 0x401056
cmp dword [ecx + 0x84], 0xe
jbe 0x401056
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401056
mov dword [esp], dbg._matherr
call dbg.__mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401056
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401056