joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2aa01671
Capabilities:
Check os version
Create process on windows
Delete file
Encode data using xor
Get common file path
Get file size
Read file on windows
Shutdown system
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
mov eax, dword [0x2aa01110]
push ebx
push esi
mov dword [esp + 0x220], eax
push edi
xor eax, eax
lea ecx, [ecx]
xor byte [eax + 0x2aa02608], 0x69
inc eax
cmp eax, 0x730
jl 0x2aa01691
push 0x104
lea eax, [esp + 0x14]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push 0x80
push 3
push 0
push 3
push 0x10000000
push 0x2aa01134
call ebx
cmp eax, 0xffffffff
jne 0x2aa01734
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
jbe 0x2aa01746
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
push 0x2aa01168
call ebx
test ax, ax
jne 0x2aa0172c
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push 0
push 0
lea ecx, [esp + 0x1c]
push ecx
push 0x2aa01160
push 0
call esi
push 0x3e8
call edi
push 0x2aa01168
call ebx
test ax, ax
je 0x2aa01705
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x2aa01168
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
push 0x2710
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
mov edi, eax
push 0x2aa02608
push edi
call sub.CRTDLL.dll_sprintf
mov edx, 0x2aa02608
add esp, 0x30
mov eax, edi
sub edx, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x2aa01776
lea edx, [esp + 0x118]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edi, [esp + 0x118]
dec edi
jmp 0x2aa017a0
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x2aa017a0
mov eax, dword [0x2aa01154]
mov ecx, dword [0x2aa01158]
mov dx, word [0x2aa0115c]
push 0
push 0
push 3
mov dword [edi], eax
mov al, byte [0x2aa0115e]
push 0
mov dword [edi + 4], ecx
push 3
push 0x80000000
lea ecx, [esp + 0x130]
mov word [edi + 8], dx
push ecx
mov byte [edi + 0xa], al
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x2aa0184c
xor eax, eax
push eax
mov ecx, 0x41
lea edi, [esp + 0x14]
push esi
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push 0
push 0
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea edx, [esp + 0x10]
push edx
push edi
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.2aa01180
push 0
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.2aa01220
call fcn.2aa01470
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x401fc7
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
xor ebx, ebx
xor esi, esi
push ebx
inc esi
push ebx
mov dword [ebp - 0xc], esi
mov dword [edi], ebx
call fcn.00422453
pop ecx
pop ecx
push ebx
push 0x80000080
push 2
push ebx
push esi
push 0xc0000000
push eax
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0xfffffffffffffff5
mov dword [ebp - 4], eax
call esi
push 0xfffffffffffffff4
mov dword [ebp - 0x10], eax
call esi
push dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_SetStdHandle]
push 0xfffffffffffffff5
mov dword [ebp - 0x14], eax
call esi
push dword [ebp - 4]
push 0xfffffffffffffff4
call esi
mov ecx, 0x4306e0
call fcn.00401b9e
mov ecx, eax
mov dword [ebp - 8], ecx
cmp ecx, ebx
je 0x402058
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401dca
add esp, 0xc
push dword [ebp - 8]
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x40206d
push str._Could_not_load_Python_
call fcn.00408d40
add eax, 0x40
push eax
call fcn.00408baa
pop ecx
pop ecx
push dword [ebp - 0x10]
push 0xfffffffffffffff5
call esi
push dword [ebp - 0x14]
push 0xfffffffffffffff4
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetFileSize]
push ebx
push dword [ebp - 4]
call esi
mov ecx, 0x1000
cmp eax, ecx
jae 0x40209a
push ebx
push dword [ebp - 4]
call esi
mov esi, eax
jmp 0x40209c
mov esi, ecx
lea eax, [esi + 1]
push eax
call fcn.00408512
pop ecx
mov dword [edi], eax
cmp eax, ebx
je 0x4020d4
push ebx
push ebx
push ebx
push dword [ebp - 4]
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
lea eax, [ebp - 8]
push eax
push esi
push dword [edi]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [edi]
mov ecx, dword [ebp - 8]
mov byte [ecx + eax], bl
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 0xc]
pop esi
pop ebx
leave
ret

Function at 0x4020ed
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
mov edi, eax
push str.Py_Initialize
push edi
call esi
push str.Py_SetProgramName
push edi
mov ebx, eax
call esi
push str.Py_Finalize
push edi
mov dword [ebp - 4], eax
call esi
push str.PyRun_SimpleString
push edi
mov dword [ebp - 0xc], eax
call esi
push str.PyErr_Print
push edi
mov dword [ebp - 8], eax
call esi
mov esi, eax
xor eax, eax
cmp ebx, eax
je 0x402174
cmp dword [ebp - 4], eax
je 0x402174
cmp dword [ebp - 0xc], eax
je 0x402174
cmp dword [ebp - 8], eax
je 0x402174
cmp esi, eax
je 0x402174
push 0x431840
call dword [ebp - 4]
call ebx
mov eax, edi
call fcn.00401cbb
push dword [ebp + 8]
call dword [ebp - 8]
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x40216d
call esi
call dword [ebp - 0xc]
mov eax, edi
jmp 0x402177
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403400
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e8a6e
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5299c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x534840
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x2c], vtable.IDisposable.0
lea ecx, [esi + 0x38]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [esi + 0x2c], vtable.TiXmlDocument.1.0
mov dword [ecx], 0x534840
mov dword [esi + 0x44], 0xffffffff
mov dword [esi + 0x40], 0xffffffff
push 0
push 0x4f6751
mov byte [ebp - 4], 2
mov dword [esi + 0x3c], 4
mov byte [esi + 0x48], 0
mov byte [esi + 0x30], 0
mov dword [esi + 0x34], 0
call fcn.00403230
mov dword [esi + 0x44], 0
mov eax, esi
mov dword [esi + 0x40], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x408150
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
add ecx, 0xdeadbeef
push ebx
mov ebx, dword [ebp + 8]
add ecx, edx
push esi
mov esi, ecx
mov dword [ebp + 0x10], esi
push edi
mov edi, ecx
cmp edx, 0xc
jbe switch.0x0040825c
add edx, 0xfffffff3
mov eax, 0xaaaaaaab
mul edx
mov eax, edx
shr eax, 3
inc eax
mov dword [ebp - 4], eax
nop dword [eax + eax]
movzx esi, byte [ebx + 7]
movzx eax, byte [ebx + 6]
movzx edx, byte [ebx + 0xb]
shl esi, 8
add esi, eax
shl edx, 8
movzx eax, byte [ebx + 5]
shl esi, 8
add esi, eax
movzx eax, byte [ebx + 4]
add edi, eax
shl esi, 8
movzx eax, byte [ebx + 0xa]
add edi, esi
movzx esi, byte [ebx + 8]
add edx, eax
movzx eax, byte [ebx + 9]
add esi, ecx
shl edx, 8
add edx, eax
shl edx, 8
add esi, edx
mov edx, dword [ebp + 8]
mov ebx, esi
rol ebx, 4
movzx ecx, byte [edx + 3]
movzx eax, byte [edx + 2]
shl ecx, 8
add ecx, eax
movzx eax, byte [edx + 1]
shl ecx, 8
add ecx, eax
movzx eax, byte [edx]
shl ecx, 8
add ecx, eax
sub ecx, esi
add esi, edi
add ecx, dword [ebp + 0x10]
xor ebx, ecx
sub edi, ebx
mov eax, ebx
add ebx, esi
rol eax, 6
xor eax, edi
sub esi, eax
mov edx, eax
rol edx, 8
add eax, ebx
xor edx, esi
sub ebx, edx
mov esi, edx
rol esi, 0x10
add edx, eax
xor esi, ebx
mov ebx, dword [ebp + 8]
mov edi, esi
sub eax, esi
ror edi, 0xd
add esi, edx
xor edi, eax
mov dword [ebp + 0x10], esi
sub edx, edi
mov ecx, edi
rol ecx, 4
add ebx, 0xc
xor ecx, edx
mov dword [ebp + 8], ebx
mov edx, dword [ebp + 0xc]
add edi, esi
sub edx, 0xc
sub dword [ebp - 4], 1
mov dword [ebp + 0xc], edx
jne 0x408190
cmp edx, 0xc
ja 0x4082c8
jmp dword [edx*4 + 0x408318]
movzx eax, byte [ebx + 0xb]
shl eax, 0x18
add ecx, eax
movzx eax, byte [ebx + 0xa]
shl eax, 0x10
add ecx, eax
movzx eax, byte [ebx + 9]
shl eax, 8
add ecx, eax
movzx eax, byte [ebx + 8]
add ecx, eax
movzx eax, byte [ebx + 7]
shl eax, 0x18
add edi, eax
movzx eax, byte [ebx + 6]
shl eax, 0x10
add edi, eax
movzx eax, byte [ebx + 5]
shl eax, 8
add edi, eax
movzx eax, byte [ebx + 4]
add edi, eax
movzx eax, byte [ebx + 3]
shl eax, 0x18
add esi, eax
movzx eax, byte [ebx + 2]
shl eax, 0x10
add esi, eax
movzx eax, byte [ebx + 1]
shl eax, 8
add esi, eax
movzx eax, byte [ebx]
add esi, eax
mov dword [ebp + 0x10], esi
xor ecx, edi
mov eax, edi
rol eax, 0xe
sub ecx, eax
mov eax, ecx
mov esi, ecx
xor esi, dword [ebp + 0x10]
rol eax, 0xb
sub esi, eax
xor edi, esi
mov eax, esi
ror eax, 7
sub edi, eax
mov eax, edi
xor ecx, edi
rol eax, 0x10
sub ecx, eax
mov eax, ecx
mov edx, ecx
rol eax, 4
xor edx, esi
sub edx, eax
mov eax, edx
xor edi, edx
rol eax, 0xe
sub edi, eax
mov eax, edi
xor ecx, edi
ror eax, 8
sub ecx, eax
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a9f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e8dd6
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5299c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea eax, [esi + 0x10030]
mov dword [esi], vtable.Utilities::CLogger.0
mov dword [eax + 4], 1
xorps xmm0, xmm0
mov dword [eax], vtable.Utilities::CLoggerWriteFile.0
mov dword [eax + 0x2c], 0
mov dword [eax + 0x30], 0xf
mov byte [eax + 0x1c], 0
mov dword [eax + 0x44], 0
mov dword [eax + 0x48], 0xf
mov byte [eax + 0x34], 0
mov dword [eax + 0x5c], 0
mov dword [eax + 0x60], 0xf
mov byte [eax + 0x4c], 0
movups xmmword [eax + 0xc], xmm0
mov dword [ebp - 4], 0
mov dword [eax + 8], 0
mov dword [esi + 0x1002c], eax
lea eax, [esi + 0x1000c]
push eax
mov byte [ebp - 4], 1
mov dword [esi + 0x10028], 1
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ecx, dword [esi + 0x1002c]
mov dword [esi + 0x10024], 0
test ecx, ecx
je 0x40aac2
mov eax, dword [ecx]
push 0
push 0
call dword [eax + 8]
mov eax, esi
mov dword [esi + 4], 0xb
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40b5f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 8]
test eax, eax
je 0x40b60b
push eax
push 1
push dword [ebp + 8]
push dword [ebp + 0xc]
call fcn.004d0480
add esp, 0x10
pop ebp
ret 8
Function at 0x40bce0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ecx + 8]
test edx, edx
jne 0x40bcf0
xor eax, eax
pop ebp
ret 4
mov ecx, dword [ebp + 8]
push edi
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40bcf7
push edx
sub ecx, edi
push 1
push ecx
push dword [ebp + 8]
call fcn.004d0480
add esp, 0x10
pop edi
pop ebp
ret 4

Function at 0x40df20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40df47
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x40df40
shr eax, 4
and eax, 1
mov dword [ecx], eax
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x40e110
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x5299c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x40e1b1
cmp byte [esi + 0x3d], 0
je 0x40e1b1
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x40e167
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x40e179
sub eax, 1
je 0x40e17d
sub eax, 2
je 0x40e1b1
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ab970
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x40e19a
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004d0480
add esp, 0x10
cmp edi, eax
jne 0x40e167
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ab970
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.004ab970
mov esp, ebp
pop ebp
ret
Function at 0x40f030
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x5299c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x40f060
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ab970
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x40f09c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x40f09c
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ab970
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x40f181
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x40f0c4
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x40f0f7
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.004cb438
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ab970
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x40f181
cmp eax, 1
jle 0x40f154
cmp eax, 3
jne 0x40f181
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.0040caf0
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ab970
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x40f171
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004d0480
add esp, 0x10
cmp edi, eax
jne 0x40f181
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x40f087
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ab970
mov esp, ebp
pop ebp
ret 4
Function at 0x40f930
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x40f954
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040fa20
pop edi
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov eax, dword [eax]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], eax
test eax, eax
je 0x40f975
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x40f977
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test ebx, ebx
jl 0x40f9ff
jg 0x40f98a
test esi, esi
je 0x40f9ff
test ecx, ecx
jl 0x40f9cc
jg 0x40f994
test eax, eax
je 0x40f9cc
cmp ebx, ecx
jg 0x40f9a6
jl 0x40f99e
cmp esi, eax
jae 0x40f9a6
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], ebx
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.004c2d10
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov eax, dword [edi + 0x2c]
add dword [ebp + 8], ecx
sub esi, ecx
sbb ebx, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x40f9d2
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test ebx, ebx
jl 0x40f9ff
jg 0x40f9dc
test esi, esi
je 0x40f9ff
cmp dword [edi + 0x4c], 0
je 0x40f9ff
mov ecx, edi
call fcn.0040e6e0
push dword [edi + 0x4c]
push esi
push 1
push dword [ebp + 8]
call fcn.004cb708
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
pop esi
sbb edx, ebx
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40faf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x40fb14
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040fbd0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov eax, dword [eax]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], eax
test eax, eax
je 0x40fb35
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x40fb37
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test edi, edi
jl 0x40fbb4
jg 0x40fb4a
test esi, esi
je 0x40fbb4
test ecx, ecx
jl 0x40fb8e
jg 0x40fb54
test eax, eax
je 0x40fb8e
cmp edi, ecx
jg 0x40fb66
jl 0x40fb5e
cmp esi, eax
jae 0x40fb66
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], edi
push eax
push dword [ebp + 8]
push dword [ebp - 8]
call fcn.004c2d10
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x40fb91
mov edx, dword [ebp + 8]
test edi, edi
jl 0x40fbb4
jg 0x40fb9b
test esi, esi
je 0x40fbb4
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x40fbb4
push eax
push esi
push 1
push edx
call fcn.004d0480
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x414d20
Capabilities:
Get local ipv4 addresses

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e96a9
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x5299c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x20], 0
xor esi, esi
mov edi, dword [ebp + 8]
mov ebx, 3
push esi
push 0x4f6751
mov ecx, edi
mov dword [ebp - 4], 0
mov dword [edi + 0x10], esi
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
call fcn.00403090
xor eax, eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x14], eax
nop dword [eax]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x414ddc
lea ecx, [ebp - 0x14]
push ecx
push eax
push 0
push 0x10
push 2
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
mov esi, eax
mov eax, dword [ebp - 0x10]
cmp esi, 0x6f
jne 0x414ddc
push eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0
call eax
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
sub ebx, 1
je 0x414e46
mov eax, dword [ebp - 0x14]
jmp 0x414d90
test esi, esi
jne 0x414e2e
mov dword [ebp - 0x1c], eax
mov ecx, eax
test eax, eax
je 0x414e46
mov eax, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x10]
nop
mov esi, dword [ecx + 0x10]
test esi, esi
je 0x414e24
test ebx, ebx
je 0x414e0c
mov ecx, dword [ebp - 0x18]
push eax
push dword [esi + 0xc]
push edi
call ebx
test eax, eax
je 0x414e17
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x18]
push eax
push dword [esi + 0xc]
push edi
call dword [ebp + 0xc]
mov esi, dword [esi + 8]
mov eax, dword [ebp + 0x14]
test esi, esi
jne 0x414df7
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ecx + 8]
mov dword [ebp - 0x1c], ecx
test ecx, ecx
jne 0x414df0
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x414e46
push eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0
call eax
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4150d0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e9730
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x5299c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [ebp - 0x28]
push eax
call fcn.00414e60
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.004145d0
cmp dword [eax + 0x14], 0x10
mov ecx, eax
mov byte [ebp - 4], 1
jb 0x415126
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x28]
call fcn.00402f30
mov edx, dword [ebp - 0x2c]
cmp edx, 0x10
jb 0x415166
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x41515c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41521e
push edx
push ecx
call fcn.004ab6c8
add esp, 8
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
mov eax, 0x1505
mov ebx, dword [ebp - 0x18]
cmovae ecx, edx
xor esi, esi
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], eax
mov edi, eax
test ebx, ebx
je 0x4151c8
dec ecx
mov dword [ebp - 0x4c], ecx
nop dword [eax]
movzx ecx, byte [ecx + esi + 1]
lea edx, [esi + 1]
shl eax, 5
add eax, dword [ebp - 0x44]
xor eax, ecx
mov dword [ebp - 0x44], eax
cmp edx, ebx
jae 0x4151bb
mov eax, dword [ebp - 0x48]
movzx ecx, byte [esi + eax + 1]
mov eax, edi
shl eax, 5
add edi, eax
mov eax, dword [ebp - 0x44]
xor edi, ecx
mov ecx, dword [ebp - 0x4c]
add esi, 2
cmp esi, ebx
jb 0x415190
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
imul esi, edi, 0x5d588b65
add esi, dword [ebp - 0x44]
cmp eax, 0x10
jb 0x415200
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x4151f6
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x415223
push ecx
push edx
call fcn.004ab6c8
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ab970
mov esp, ebp
pop ebp
ret
call fcn.004c6d19
call fcn.004c6d19
int3