joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40dded
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebp
push edi
mov edi, ecx
mov ebp, edx
test edi, edi
je 0x40de08
test ebp, ebp
je 0x40de08
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x40de10
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x10], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
cmp ecx, ebx
ja 0x40de50
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x40deac
mov ecx, ebx
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x40dea7
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x40de92
test dl, dl
je 0x40de8e
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x40de92
add ecx, 2
add eax, 2
test dl, dl
jne 0x40de72
xor eax, eax
jmp 0x40de97
sbb eax, eax
or eax, 1
test eax, eax
je 0x40deb6
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, eax
jb 0x40de5f
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret

Function at 0x40decd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push esi
push edi
mov edi, ecx
call fcn.0040dd2d
mov esi, eax
test esi, esi
je 0x40df89
push ebp
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x65657246
mov dword [esp + 0x14], 0x7262694c
mov dword [esp + 0x18], 0x797261
call fcn.0040dded
mov ebp, eax
test ebp, ebp
je 0x40df88
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x4d746547
mov dword [esp + 0x14], 0x6c75646f
mov dword [esp + 0x18], 0x6e614865
mov dword [esp + 0x1c], 0x41656c64
mov byte [esp + 0x20], 0
call fcn.0040dded
mov edx, eax
mov dword [esp + 0xc], edx
test edx, edx
je 0x40df88
mov ecx, dword [edi + 0x3c]
cmp dword [ecx + edi + 0x84], 0
je 0x40df88
push ebx
mov ebx, dword [ecx + edi + 0x80]
add ebx, edi
xor esi, esi
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x40df87
lea ebx, [ebx]
add eax, edi
push eax
call edx
push eax
call ebp
mov edx, dword [esp + 0x10]
lea esi, [esi + 1]
lea eax, [esi + esi*4]
mov eax, dword [ebx + eax*4 + 0xc]
test eax, eax
jne 0x40df6d
pop ebx
pop ebp
pop edi
pop esi
add esp, 0x18
ret
Function at 0x40e8b4
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
mov ebx, dword [ebp + 8]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
nop
nop
cmp dword [ebp - 8], esp
je 0x40e8f2
push 0x19
push 0x40aa294
push 6
call fcn.00441898
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x40e909
mov eax, 0
jmp 0x40e92a
push 0x10
push dword [ebp - 4]
call fcn.0040e930
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
mov eax, 0
sete al
jmp 0x40e92a
mov esp, ebp
pop ebp
ret 4

Function at 0x40e9ac
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], esp
push dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
nop
nop
cmp dword [ebp - 4], esp
je 0x40e9e6
push 0x24
push 0x40aa659
push 6
call fcn.00441898
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
mov eax, 0
setne al
jmp 0x40e9fa
mov esp, ebp
pop ebp
ret 8
Function at 0x412674
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 4
push 1
mov ebx, 0x184
call fcn.004427c0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4126b9
push ebx
call fcn.0044189e
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 4
push dword [ebp - 4]
push 0x23
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
nop
nop
cmp dword [ebp - 8], esp
je 0x4126f8
push 0x36
push 0x409e693
push 6
call fcn.00441898
add esp, 0xc
push 0x80000004
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x41270b
mov eax, 0x47b2ec
push eax
push 1
mov ebx, 0x9dc
call fcn.00442f20
add esp, 0x10
jmp 0x412723
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x412734
push ebx
call fcn.0044189e
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x4157bc
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
push 2
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
nop
nop
cmp dword [ebp - 8], esp
je 0x4157fd
push 0x19
push 0x40aa2bf
push 6
call fcn.00441898
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x41
jl 0x41581b
cmp dword [ebp - 4], 0x5a
jg 0x41581b
mov eax, 1
jmp 0x415820
mov eax, 0
test eax, eax
je 0x41582c
add dword [ebp - 4], 0x20
mov eax, dword [ebp - 4]
jmp 0x415834
mov esp, ebp
pop ebp
ret 4

Function at 0x415d0c
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x40
call fcn.00441892
add esp, 4
mov dword [ebp - 4], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 0x10
rep stosd dword es:[edi], eax
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 8]
mov dword [ebx], 0x40
mov dword [ebp - 8], esp
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
nop
nop
cmp dword [ebp - 8], esp
je 0x415d6d
push 0x2c
push 0x40aaede
push 6
call fcn.00441898
add esp, 0xc
mov eax, dword [ebp - 4]
push eax
push 0x40
call fcn.00441892
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x415d86
push eax
mov ebx, dword [ebp - 4]
push ebx
call fcn.0044189e
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x418a48
Capabilities:
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov eax, dword [0x5a3b98]
mov dword [ebp - 4], eax
mov eax, dword [0x5a3b9c]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov ecx, eax
cmp eax, 0
jne 0x418aa9
leave
ret 0xc
mov eax, dword [eax + 4]
cmp eax, 0
jne 0x418ab5
leave
ret 0xc
add eax, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp + 0xc], 0
je 0x418ac5
mov eax, ecx
jmp 0x418b1c
cmp dword [ebp - 4], 0
jne 0x418aec
push 0x6a4abc5b
call fcn.00418b91
push 0x864bde7e
push eax
call fcn.00418c04
call eax
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 1
cmp dword [ebp - 8], 0
jne 0x418b11
push 0x3cfa685d
call fcn.00418b91
push 0xc9616ee
push eax
call fcn.00418c04
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 1
push dword [ebp - 0x10]
push 0
push dword [ebp - 4]
call dword [ebp - 8]
push ebx
push edx
mov dword [ebp - 0x14], eax
mov edx, eax
mov ecx, dword [ebp - 0x10]
sub ecx, 8
cmp dword [ebp + 0xc], 0
jne 0x418b38
mov dword [edx], 1
mov dword [edx + 4], ecx
add edx, 8
dec ecx
mov dword [ebp - 0x10], ecx
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
lea ebx, [ebx + ecx + 8]
cmp dword [ebp + 0xc], 0
je 0x418b5e
push edx
mov eax, dword [ebp - 0x10]
mov ecx, 2
cdq
idiv ecx
mov dword [ebp - 0x10], eax
pop edx
xor ecx, ecx
cmp ecx, dword [ebp - 0x10]
jle 0x418b67
jmp 0x418b7e
cmp dword [ebp + 0xc], 0
je 0x418b75
mov al, byte [ebx]
xchg byte [edx], al
mov byte [ebx], al
jmp 0x418b79
mov al, byte [ebx]
mov byte [edx], al
inc ecx
inc edx
dec ebx
jmp 0x418b60
pop edx
pop ebx
cmp dword [ebp + 0xc], 0
jne 0x418b8b
jmp 0x418d8d
xor eax, eax
leave
ret 0xc
cmp dword [ebp - 0xc], 0
jne 0x418d9a
mov eax, dword [ebp - 0x14]
leave
ret 0xc
mov eax, dword [ebp - 4]
mov dword [0x5a3b98], eax
mov eax, dword [ebp - 8]
mov dword [0x5a3b9c], eax
mov eax, dword [ebp - 0x14]
leave
ret 0xc

Function at 0x418b91
Capabilities:
Access peb ldr_data

Disassembly:
pop edx
pop ecx
push edx
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword ds:[ebx + 0xc]
mov ebx, dword ds:[ebx + 0x14]
mov edi, ebx
mov esi, dword ds:[ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword ds:[esi]
test cx, cx
je 0x418be6
mov al, cl
cmp al, 0x61
jb 0x418bc0
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x418be6
mov al, cl
cmp al, 0x61
jb 0x418bd8
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, ds:[esi + 4]
jmp 0x418bb0
cmp edx, dword ss:[esp + 0x18]
je 0x418bf9
mov ebx, dword ds:[ebx]
cmp edi, dword ds:[ebx]
jne 0x418ba8
xor eax, eax
jmp 0x418bfd
mov eax, dword ds:[ebx + 0x10]
mov dword ss:[esp + 0x1c], eax
popal
ret
Function at 0x418c04
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword ss:[esp]
mov edx, dword ss:[esp + 8]
mov dword ss:[esp + 8], ecx
mov ecx, dword ss:[esp + 4]
add esp, 8
xor eax, eax
pushal
mov ebx, ecx
mov eax, dword ds:[ebx + 0x3c]
mov eax, dword ds:[ebx + eax + 0x78]
test eax, eax
je 0x418d16
lea esi, ds:[ebx + eax]
test edx, 0xffff0000
je 0x418d1d
mov ecx, dword ds:[esi + 0x18]
mov edi, dword ds:[esi + 0x20]
lea edi, ds:[ebx + edi]
mov ebp, dword ds:[edi + ecx*4 - 4]
lea ebp, ds:[ebx + ebp]
xor eax, eax
xor edx, edx
mov al, byte ss:[ebp]
test al, al
je 0x418c6f
cmp al, 0x61
jb 0x418c67
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x418c59
cmp edx, dword ss:[esp + 0x14]
je 0x418c80
dec ecx
jne 0x418c4c
xor eax, eax
jmp 0x418d16
mov edx, dword ds:[esi + 0x24]
lea edx, ds:[ebx + edx]
mov edx, dword ds:[edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword ds:[esi + 0x1c]
lea eax, ds:[ebx + eax]
mov eax, dword ds:[eax + edx*4]
lea eax, ds:[ebx + eax]
cmp eax, esi
jbe 0x418d16
mov ecx, dword ds:[ebx + 0x3c]
mov ecx, dword ds:[ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x418d16
mov ebp, eax
xor eax, eax
xor edx, edx
mov al, byte ss:[ebp]
cmp al, 0x61
jb 0x418cc6
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
inc ebp
cmp al, 0x2e
je 0x418cd5
jmp 0x418cbc
ror edx, 0xd
add edx, 0x44
ror edx, 0x1a
add edx, 0x4c
ror edx, 0x1a
add edx, 0x4c
ror edx, 0xd
mov ecx, edx
call 0x418d1d
test eax, eax
je 0x418d16
mov ecx, eax
xor eax, eax
xor edx, edx
mov al, byte ss:[ebp]
test al, al
je 0x418d11
cmp al, 0x61
jb 0x418d09
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x418cfb
call 0x418c1a
mov dword ss:[esp + 0x1c], eax
popal
ret
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword ds:[ebx + 0xc]
mov ebx, dword ds:[ebx + 0x14]
mov edi, ebx
mov esi, dword ds:[ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword ds:[esi]
test cx, cx
je 0x418d6f
mov al, cl
cmp al, 0x61
jb 0x418d49
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x418d6f
mov al, cl
cmp al, 0x61
jb 0x418d61
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, ds:[esi + 4]
jmp 0x418d39
cmp edx, dword ss:[esp + 0x18]
je 0x418d82
mov ebx, dword ds:[ebx]
cmp edi, dword ds:[ebx]
jne 0x418d31
xor eax, eax
jmp 0x418d86
mov eax, dword ds:[ebx + 0x10]
mov dword ss:[esp + 0x1c], eax
popal
ret
Function at 0x418c1a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword ss:[esp]
mov edx, dword ss:[esp + 8]
mov dword ss:[esp + 8], ecx
mov ecx, dword ss:[esp + 4]
add esp, 8
xor eax, eax
pushal
mov ebx, ecx
mov eax, dword ds:[ebx + 0x3c]
mov eax, dword ds:[ebx + eax + 0x78]
test eax, eax
je 0x418d16
lea esi, ds:[ebx + eax]
test edx, 0xffff0000
je 0x418d1d
mov ecx, dword ds:[esi + 0x18]
mov edi, dword ds:[esi + 0x20]
lea edi, ds:[ebx + edi]
mov ebp, dword ds:[edi + ecx*4 - 4]
lea ebp, ds:[ebx + ebp]
xor eax, eax
xor edx, edx
mov al, byte ss:[ebp]
test al, al
je 0x418c6f
cmp al, 0x61
jb 0x418c67
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x418c59
cmp edx, dword ss:[esp + 0x14]
je 0x418c80
dec ecx
jne 0x418c4c
xor eax, eax
jmp 0x418d16
mov edx, dword ds:[esi + 0x24]
lea edx, ds:[ebx + edx]
mov edx, dword ds:[edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword ds:[esi + 0x1c]
lea eax, ds:[ebx + eax]
mov eax, dword ds:[eax + edx*4]
lea eax, ds:[ebx + eax]
cmp eax, esi
jbe 0x418d16
mov ecx, dword ds:[ebx + 0x3c]
mov ecx, dword ds:[ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x418d16
mov ebp, eax
xor eax, eax
xor edx, edx
mov al, byte ss:[ebp]
cmp al, 0x61
jb 0x418cc6
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
inc ebp
cmp al, 0x2e
je 0x418cd5
jmp 0x418cbc
ror edx, 0xd
add edx, 0x44
ror edx, 0x1a
add edx, 0x4c
ror edx, 0x1a
add edx, 0x4c
ror edx, 0xd
mov ecx, edx
call 0x418d1d
test eax, eax
je 0x418d16
mov ecx, eax
xor eax, eax
xor edx, edx
mov al, byte ss:[ebp]
test al, al
je 0x418d11
cmp al, 0x61
jb 0x418d09
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x418cfb
call 0x418c1a
mov dword ss:[esp + 0x1c], eax
popal
ret
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword ds:[ebx + 0xc]
mov ebx, dword ds:[ebx + 0x14]
mov edi, ebx
mov esi, dword ds:[ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword ds:[esi]
test cx, cx
je 0x418d6f
mov al, cl
cmp al, 0x61
jb 0x418d49
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x418d6f
mov al, cl
cmp al, 0x61
jb 0x418d61
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, ds:[esi + 4]
jmp 0x418d39
cmp edx, dword ss:[esp + 0x18]
je 0x418d82
mov ebx, dword ds:[ebx]
cmp edi, dword ds:[ebx]
jne 0x418d31
xor eax, eax
jmp 0x418d86
mov eax, dword ds:[ebx + 0x10]
mov dword ss:[esp + 0x1c], eax
popal
ret
Function at 0x418d1d
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword ss:[esp]
mov edx, dword ss:[esp + 8]
mov dword ss:[esp + 8], ecx
mov ecx, dword ss:[esp + 4]
add esp, 8
xor eax, eax
pushal
mov ebx, ecx
mov eax, dword ds:[ebx + 0x3c]
mov eax, dword ds:[ebx + eax + 0x78]
test eax, eax
je 0x418d16
lea esi, ds:[ebx + eax]
test edx, 0xffff0000
je 0x418d1d
mov ecx, dword ds:[esi + 0x18]
mov edi, dword ds:[esi + 0x20]
lea edi, ds:[ebx + edi]
mov ebp, dword ds:[edi + ecx*4 - 4]
lea ebp, ds:[ebx + ebp]
xor eax, eax
xor edx, edx
mov al, byte ss:[ebp]
test al, al
je 0x418c6f
cmp al, 0x61
jb 0x418c67
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x418c59
cmp edx, dword ss:[esp + 0x14]
je 0x418c80
dec ecx
jne 0x418c4c
xor eax, eax
jmp 0x418d16
mov edx, dword ds:[esi + 0x24]
lea edx, ds:[ebx + edx]
mov edx, dword ds:[edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword ds:[esi + 0x1c]
lea eax, ds:[ebx + eax]
mov eax, dword ds:[eax + edx*4]
lea eax, ds:[ebx + eax]
cmp eax, esi
jbe 0x418d16
mov ecx, dword ds:[ebx + 0x3c]
mov ecx, dword ds:[ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x418d16
mov ebp, eax
xor eax, eax
xor edx, edx
mov al, byte ss:[ebp]
cmp al, 0x61
jb 0x418cc6
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
inc ebp
cmp al, 0x2e
je 0x418cd5
jmp 0x418cbc
ror edx, 0xd
add edx, 0x44
ror edx, 0x1a
add edx, 0x4c
ror edx, 0x1a
add edx, 0x4c
ror edx, 0xd
mov ecx, edx
call 0x418d1d
test eax, eax
je 0x418d16
mov ecx, eax
xor eax, eax
xor edx, edx
mov al, byte ss:[ebp]
test al, al
je 0x418d11
cmp al, 0x61
jb 0x418d09
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x418cfb
call 0x418c1a
mov dword ss:[esp + 0x1c], eax
popal
ret
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword ds:[ebx + 0xc]
mov ebx, dword ds:[ebx + 0x14]
mov edi, ebx
mov esi, dword ds:[ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword ds:[esi]
test cx, cx
je 0x418d6f
mov al, cl
cmp al, 0x61
jb 0x418d49
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x418d6f
mov al, cl
cmp al, 0x61
jb 0x418d61
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, ds:[esi + 4]
jmp 0x418d39
cmp edx, dword ss:[esp + 0x18]
je 0x418d82
mov ebx, dword ds:[ebx]
cmp edi, dword ds:[ebx]
jne 0x418d31
xor eax, eax
jmp 0x418d86
mov eax, dword ds:[ebx + 0x10]
mov dword ss:[esp + 0x1c], eax
popal
ret
Function at 0x419098
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x5a3ba0], 0
jne 0x4190c0
call fcn.00419290
test eax, eax
je 0x4190c0
jmp 0x4190c0
call fcn.00419768
mov dword [0x5a3ba4], eax
mov dword [ebp - 4], esp
mov eax, dword [0x5a3b38]
push eax
push 0x24
call fcn.00441892
add esp, 4
mov edi, eax
pop ebx
push eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], eax
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
nop
nop
cmp dword [ebp - 4], esp
je 0x419182
push 0x354
push 0x40ab1c2
push 6
call fcn.00441898
add esp, 0xc
push eax
mov ebx, dword [ebp - 8]
push ebx
mov edi, dword [ebp - 0xc]
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
call fcn.0044189e
add esp, 4
pop eax
call fcn.004197bc
mov dword [0x5a3ba8], eax
call fcn.00419898
mov dword [0x5a3b78], eax
call fcn.004198f0
mov dword [0x5a3bac], eax
call fcn.00419914
mov dword [0x5a3bb0], eax
call fcn.00419938
mov dword [0x5a3bb4], eax
call fcn.0041995c
mov dword [0x5a3bb8], eax
call fcn.00419980
mov dword [0x5a3bbc], eax
call fcn.00402550
mov dword [0x5a3b54], eax
call fcn.004199a4
mov dword [0x5a3bc0], eax
call fcn.004199e0
push 1
push 1
push 1
push 1
call fcn.00419b68
mov dword [0x5a3b44], eax
push 0x5a3b70
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 8]
mov esp, ebp
pop ebp
ret
Function at 0x41961a
Capabilities:
Access peb ldr_data
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov esi, dword [ebp + 8]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
lea ecx, [eax + 0x14]
mov eax, dword [eax + 0x14]
cmp eax, ecx
je 0x419750
mov edx, eax
mov eax, dword [eax]
test eax, eax
je 0x41963d
cmp dword [edx + 0x10], esi
jne 0x419635
xor eax, eax
mov dword [esp + 0x14], 0x8000000
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], SysReAllocString
mov eax, dword [edx + 0x20]
mov dword [esp], eax
call dword [ebp + 0x10]
sub esp, 0x1c
mov ebx, eax
cmp eax, 0xffffffff
je 0x419750
mov ecx, dword [esi + 0x3c]
mov eax, dword [ebp + 0xc]
add ecx, esi
sub eax, esi
lea edx, [ecx + 0xf8]
movzx ecx, word [ecx + 6]
mov dword [ebp - 0x24], eax
imul ecx, ecx, 0x28
add ecx, edx
cmp edx, ecx
je 0x419749
mov esi, dword [edx + 0xc]
cmp eax, esi
jb 0x4196ca
mov edi, dword [edx + 0x10]
add edi, esi
cmp edi, eax
jb 0x4196ca
add eax, dword [edx + 0x14]
sub eax, esi
jne 0x4196cf
jmp 0x419749
add edx, 0x28
jmp 0x4196a9
xor edi, edi
mov dword [esp + 4], eax
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
mov dword [esp], ebx
call dword [ebp + 0x14]
sub esp, 0x10
inc eax
je 0x419749
xor esi, esi
lea eax, [ebp - 0x24]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x20]
mov dword [esp + 0x10], esi
mov dword [esp + 8], 8
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [ebp + 0x18]
sub esp, 0x14
test eax, eax
je 0x419749
cmp dword [ebp - 0x24], 8
jne 0x419749
cmp byte [ebp - 0x20], 0xb8
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
jne 0x419749
shrd eax, edx, 8
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
add eax, 5
mov dword [ebp - 0x1c], eax
mov dword [esp], ebx
call dword [ebp + 0x1c]
push ebx
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
jmp 0x419754
mov dword [esp], ebx
call dword [ebp + 0x1c]
push eax
xor eax, eax
xor edx, edx
leave
ret 0x18

Function at 0x419768
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push esi
call 0x419771
pop eax
mov esi, dword fs:[0x30]
mov esi, dword [esi + 0xc]
mov esi, dword [esi + 0x1c]
push esi
mov ebx, dword [esi + 8]
cmp eax, ebx
jb 0x419794
mov ecx, dword [esi + 0x10]
add ecx, ebx
cmp eax, ecx
ja 0x419794
mov eax, ebx
jmp 0x4197a9
mov esi, dword [esi]
mov ebx, dword [esi]
cmp ebx, dword [esp]
jne 0x419780
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
pop esi
pop esi
leave
ret
Function at 0x41a3d2
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.0041a582
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x41a4d0
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x41a473
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x41a4b6
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x41a48a
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x41a4a5
test al, 0x40
je 0x41a49c
mov ecx, dword [edi + 0x20]
jmp 0x41a4a3
test al, 0x80
je 0x41a4b6
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x41a4b6
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x41a442
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret