joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51a770
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x51a83c
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x51a850
mov dl, 4
mov eax, ebx
call fcn.0051a934
mov byte [ebx + 0x10290], 0
mov si, word [ebx + 0x10288]
cmp si, 0xffff
je 0x51a826
movzx eax, si
push eax
call sub.wsock32.dll_closesocket
test eax, eax
jne 0x51a818
test byte [ebx + 0x20], 8
jne 0x51a7d5
cmp word [ebx + 0x1004a], 0
je 0x51a7d5
mov edx, ebx
mov eax, dword [ebx + 0x1004c]
call dword [ebx + 0x10048]
cmp byte [ebx + 0x10089], 0
jne 0x51a826
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
cmp esi, 0xffff
jbe 0x51a7f8
call fcn.00403198
mov word [ebx + 0x10288], si
push 0x3d
push 0x465
mov eax, dword [ebx + 0x1028c]
push eax
movzx eax, si
push eax
call sub.wsock32.dll_WSAAsyncSelect
jmp 0x51a826
lea ecx, [ebp - 4]
mov dx, 0x2733
mov eax, ebx
call fcn.0051a868
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51a843
lea eax, [ebp - 4]
call fcn.00404088
ret

Function at 0x51a9dc
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
mov ebx, eax
mov ecx, 0x51aa18
mov dl, 8
mov eax, ebx
call fcn.0051a934
push 2
push 1
lea eax, [ebx + 0x24]
push eax
movzx eax, word [ebx + 0x10288]
push eax
call sub.wsock32.dll_recv
test eax, eax
jle 0x51aa0a
mov al, 1
pop ebx
ret
xor eax, eax
pop ebx
ret

Function at 0x51b994
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x51ba1d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x9b9a38
push 0x101
call sub.wsock32.dll_WSAStartup
mov ebx, eax
test ebx, ebx
je 0x51ba07
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.0040da28
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xb
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 0
mov eax, 0x51ba34
mov dword [ebp - 8], eax
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x18]
push eax
push 2
mov ecx, dword [0x9b895c]
mov dl, 1
mov eax, dword [0x51b1e0]
call fcn.0040e36c
call fcn.00403ab8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51ba24
lea eax, [ebp - 0x1c]
call fcn.00404088
ret

Function at 0x51c08c
Capabilities:
Connect socket

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, esi
call fcn.0051bfb0
mov cl, 1
mov edx, esi
mov eax, esi
mov bx, 0xffff
call fcn.0040343c
push 0x10
lea eax, [esi + 0x18]
push eax
mov eax, dword [esi + 4]
push eax
call sub.wsock32.dll_connect
mov edx, 0x51c0f0
call fcn.0051b8dc
mov byte [esi + 0x29], 0
test byte [esi + 0x28], 0x10
jne 0x51c0e2
cmp dword [esi + 4], 0xffffffff
setne al
mov byte [esi + 8], al
mov cl, 2
mov edx, esi
mov eax, esi
mov bx, 0xffff
call fcn.0040343c
pop esi
pop ebx
ret
Function at 0x51c114
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0051be48
xor eax, eax
push ebp
push 0x51c193
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404088
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
jne 0x51c14d
call fcn.00403b58
jmp 0x51c19a
mov dword [ebp - 8], 0x10
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_getsockname
test eax, eax
jne 0x51c17d
push dword [ebp - 0x14]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, ebx
call fcn.00404250
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51c19a
mov eax, dword [ebp - 4]
call fcn.0051be54
ret
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x51c248
Capabilities:
Resolve dns

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, edx
mov eax, ebx
call fcn.004044dc
push eax
call sub.wsock32.dll_gethostbyname
mov ebx, eax
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 4
call fcn.00402e48
test ebx, ebx
je 0x51c293
mov eax, ebx
mov edx, dword [eax + 0xc]
mov edx, dword [edx]
mov cl, byte [edx]
mov byte [esp + 4], cl
mov cl, byte [edx + 1]
mov byte [esp + 5], cl
mov cl, byte [edx + 2]
mov byte [esp + 6], cl
mov al, byte [edx + 3]
mov byte [esp + 7], al
mov eax, dword [esp + 4]
mov dword [esp], eax
mov eax, dword [esp]
pop ecx
pop edx
pop ebx
ret

Function at 0x51c370
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x51c3a1
mov ecx, dword [0x9b8634]
mov dl, 1
mov eax, dword [0x51b1e0]
call fcn.0040e330
call fcn.00403ab8
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], ebx
inc ebx
jne 0x51c3ce
mov ecx, dword [0x9b84cc]
mov dl, 1
mov eax, dword [0x51b1e0]
call fcn.0040e330
call fcn.00403ab8
xor eax, eax
push ebp
push 0x51c44d
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov bx, 0xffff
call fcn.0040343c
cmp byte [ebp + 8], 0
je 0x51c429
mov eax, dword [ebp + 0x10]
push eax
mov ax, word [ebp + 0xc]
push eax
push 1
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 8]
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.0051c2d8
mov eax, dword [ebp - 4]
lea esi, [ebp - 0x18]
lea edi, [eax + 0x18]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 4]
call fcn.0051c08c
jmp 0x51c443
mov eax, dword [ebp + 0x10]
push eax
mov ax, word [ebp + 0xc]
push eax
push 0
push 1
mov ecx, dword [ebp - 8]
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.0051bbc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51c46a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x51c630
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0051be48
xor edx, edx
push ebp
push 0x51c790
push dword fs:[edx]
mov dword fs:[edx], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x51c77a
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
je 0x51c67a
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x51c684
call fcn.00403b58
jmp 0x51c797
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.004165dc
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x1010]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov ecx, 0x1000
mov ebx, dword [eax]
call dword [ebx + 4]
mov ebx, eax
test ebx, ebx
jle 0x51c76f
push 0
push ebx
lea eax, [ebp - 0x1010]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
cmp eax, 0xffffffff
jne 0x51c72d
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2733
je 0x51c71d
lea eax, [ebp - 0x10]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov bx, 0xfffe
call fcn.0040343c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
push ebp
call fcn.0051c5e8
pop ecx
mov eax, dword [ebp - 4]
mov dl, byte [0x51c7a0]
cmp dl, byte [eax + 0x28]
je 0x51c776
call fcn.0040e20c
jmp 0x51c776
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0xc]
call fcn.004165ec
jmp 0x51c776
cmp eax, ebx
jge 0x51c746
mov edx, dword [ebp - 0xc]
add edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.004165ec
jmp 0x51c684
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.004165dc
mov ebx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.004165f8
cmp ebx, eax
jne 0x51c684
push ebp
call fcn.0051c5e8
pop ecx
jmp 0x51c776
push ebp
call fcn.0051c5e8
pop ecx
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51c797
mov eax, dword [ebp - 4]
call fcn.0051be54
ret
mov al, byte [ebp - 5]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x51cde8
Capabilities:
Get socket status

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ecx, edx
mov ebx, eax
mov eax, ecx
mov esi, 0x3e8
cdq
idiv esi
mov dword [esp], eax
mov eax, ecx
mov ecx, 0x3e8
cdq
idiv ecx
imul eax, edx, 0x3e8
mov dword [esp + 4], eax
lea eax, [esp + 8]
call fcn.00518ad8
lea edx, [esp + 8]
mov eax, dword [ebx + 4]
mov eax, dword [eax + 4]
call fcn.00518ac8
push esp
push 0
push 0
lea eax, [esp + 0x14]
push eax
push 0
call sub.wsock32.dll_select
test eax, eax
setg al
add esp, 0x10c
pop esi
pop ebx
ret
Function at 0x51db34
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7e4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x81c], ecx
mov dword [ebp - 0x818], ecx
mov dword [ebp - 0x814], ecx
mov dword [ebp - 0x810], ecx
mov dword [ebp - 0x80c], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x51dd2d
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x51dc25
cmp dword [ebp - 4], 0
jle 0x51dbab
lea edx, [ebp - 0x80c]
mov eax, 0x51d254
call fcn.004070c8
mov ecx, dword [ebp - 0x80c]
mov dl, 1
mov eax, dword [0x409664]
call fcn.0040e274
call fcn.00403ab8
jmp 0x51dc25
cmp word [ebx + 0xa32], 0
jne 0x51dbde
lea edx, [ebp - 0x810]
mov eax, 0x51d254
call fcn.004070c8
mov ecx, dword [ebp - 0x810]
mov dl, 1
mov eax, dword [0x409664]
call fcn.0040e274
call fcn.00403ab8
jmp 0x51dc25
mov byte [ebp - 5], 0
lea edx, [ebp - 5]
mov ecx, esi
mov eax, dword [ebx + 0xa34]
call dword [ebx + 0xa30]
cmp byte [ebp - 5], 0
jne 0x51dc22
lea edx, [ebp - 0x814]
mov eax, 0x51d254
call fcn.004070c8
mov ecx, dword [ebp - 0x814]
mov dl, 1
mov eax, dword [0x409664]
call fcn.0040e274
call fcn.00403ab8
jmp 0x51dc25
inc dword [ebp - 4]
mov eax, esi
call fcn.004165f8
test eax, eax
je 0x51db7c
mov byte [ebx + 0x864], 0
mov eax, ebx
call fcn.0051d960
cmp dword [ebx + 0x83c], 0
jne 0x51dc72
lea edx, [ebp - 0x818]
mov eax, 0x51d274
call fcn.004070c8
mov ecx, dword [ebp - 0x818]
mov dl, 1
mov eax, dword [0x51d27c]
call fcn.0040e274
call fcn.00403ab8
lea edx, [ebp - 0x81c]
mov eax, 0x51d24c
call fcn.004070c8
mov ecx, dword [ebp - 0x81c]
mov dl, 2
mov eax, ebx
call fcn.0051dec0
mov word [ebx + 0x838], 2
mov ax, word [ebx + 0x830]
push eax
call sub.wsock32.dll_htons
mov word [ebx + 0x83a], ax
mov edi, 0x10
xor edx, edx
mov eax, esi
call fcn.004165ec
mov eax, esi
call fcn.004165f8
mov ecx, eax
lea edx, [ebp - 0x805]
mov eax, esi
call fcn.00416630
push edi
lea eax, [ebx + 0x838]
push eax
push 0
mov eax, esi
call fcn.004165f8
push eax
lea eax, [ebp - 0x805]
push eax
mov eax, dword [ebx + 0xa40]
push eax
call sub.wsock32.dll_sendto
cmp word [ebx + 0xa22], 0
je 0x51dd0f
mov edx, ebx
mov eax, dword [ebx + 0xa24]
call dword [ebx + 0xa20]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51dd34
lea eax, [ebp - 0x81c]
mov edx, 5
call fcn.004040ac
ret
Function at 0x51df80
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x51e054
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0x800
lea eax, [ebx + 0x24]
push eax
mov eax, dword [ebx + 0xa40]
push eax
call sub.wsock32.dll_recvfrom
mov dword [ebx + 0x828], eax
cmp word [ebx + 0xa1a], 0
je 0x51e03e
lea eax, [ebp - 8]
push eax
xor eax, eax
mov al, byte [ebp - 0x14]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0
xor eax, eax
mov al, byte [ebp - 0x13]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0
xor eax, eax
mov al, byte [ebp - 0x12]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0
xor eax, eax
mov al, byte [ebp - 0x11]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
lea edx, [ebp - 0x38]
mov ecx, 3
mov eax, 0x51e068
call fcn.0040bab4
mov ax, word [ebp - 0x16]
push eax
call sub.wsock32.dll_ntohs
mov edx, dword [ebp - 8]
push edx
movzx eax, ax
push eax
mov ecx, dword [ebx + 0x828]
mov edx, ebx
mov eax, dword [ebx + 0xa1c]
call dword [ebx + 0xa18]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51e05b
lea eax, [ebp - 8]
call fcn.00404088
ret

Function at 0x51e614
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov byte [ebp - 2], cl
mov byte [ebp - 1], dl
mov ebx, eax
mov eax, 0x40
call fcn.00402858
mov dword [ebp - 8], eax
mov edx, 0x40
mov eax, dword [ebp - 8]
call fcn.004090cc
xor eax, eax
push ebp
push 0x51e699
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebp - 8]
mov byte [esi + 0x30], bl
mov al, byte [ebp + 8]
mov byte [esi + 2], al
mov al, byte [ebp - 1]
mov byte [esi + 0xa], al
mov byte [esi + 0xb], 0
mov al, byte [ebp - 2]
mov byte [esi + 0xc], al
mov byte [esi + 0xd], 0
mov byte [esi], 0x32
mov eax, dword [ebp - 8]
push eax
call sub.netapi32.dll_Netbios
mov al, byte [esi + 0x31]
mov byte [ebp - 3], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51e6a0
mov edx, 0x40
mov eax, dword [ebp - 8]
call fcn.00402870
ret
Function at 0x52240c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x52257d
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x522558
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x111], 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x105
lea eax, [ebp - 0x111]
push eax
lea eax, [ebp - 0x118]
mov edx, ebx
call fcn.00404230
lea eax, [ebp - 0x118]
mov edx, 0x522594
call fcn.00404320
mov eax, dword [ebp - 0x118]
call fcn.004044dc
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x5224ca
lea eax, [ebp - 0x111]
call fcn.0040b2dc
mov ecx, eax
lea edx, [ebp - 0x111]
mov eax, esi
call fcn.00404170
jmp 0x5224d1
mov eax, esi
call fcn.00404088
cmp bl, 0x61
jae 0x5224f2
lea edx, [ebp - 0x11c]
mov eax, dword [esi]
call fcn.0040ef78
mov edx, dword [ebp - 0x11c]
mov eax, esi
call fcn.004040dc
jmp 0x52250c
lea edx, [ebp - 0x120]
mov eax, dword [esi]
call fcn.0040eeec
mov edx, dword [ebp - 0x120]
mov eax, esi
call fcn.004040dc
lea eax, [ebp - 0x124]
push eax
mov eax, dword [esi]
mov dword [ebp - 0x12c], eax
mov byte [ebp - 0x128], 0xb
lea edx, [ebp - 0x12c]
xor ecx, ecx
mov eax, 0x5225a0
call fcn.0040bab4
mov edx, dword [ebp - 0x124]
mov eax, esi
call fcn.004040dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52255f
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x525a40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004044dc
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x525a59
test al, 0x10
jne 0x525a5d
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x527cdc
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x527e8b
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [esi], 0
mov dword [ebp - 0x10], 0x10
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x25]
push eax
call sub.kernel32.dll_GetComputerNameA
mov eax, dword [0x9b7e60]
mov eax, dword [eax]
mov edx, 0x527ea4
call fcn.004b5788
lea edx, [ebp - 0x2c]
call fcn.004b8238
mov edx, dword [ebp - 0x2c]
lea ecx, [ebp - 8]
mov eax, dword [0x9b7e60]
mov eax, dword [eax]
call fcn.004b58a4
mov eax, dword [ebp - 8]
mov edx, 0x527eb4
call fcn.00404428
je 0x527d70
mov eax, dword [ebp - 8]
mov edx, 0x527ec4
call fcn.00404428
jne 0x527d73
mov byte [ebx], 1
lea eax, [ebp - 4]
push eax
xor ecx, ecx
mov edx, 0x527ed8
mov eax, 0x527ef0
call fcn.00529a34
cmp dword [ebp - 4], 0
jne 0x527e1b
mov dl, 1
mov eax, dword [0x4127b0]
call fcn.00403230
mov ebx, eax
mov eax, dword [0x9b7e60]
mov eax, dword [eax]
mov ecx, ebx
mov edx, 0x527ea4
call fcn.004b5af8
lea ecx, [ebp - 4]
mov edx, 0x527f00
mov eax, ebx
call fcn.00415714
cmp dword [ebp - 4], 0
je 0x527e1b
mov edx, dword [ebp - 4]
mov eax, 0x527f14
call fcn.00404604
test eax, eax
jle 0x527e1b
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040af5c
mov eax, dword [ebp - 0xc]
call fcn.00404318
test eax, eax
jle 0x527dfa
lea eax, [ebp - 4]
call fcn.00404088
jmp 0x527e1b
lea eax, [ebp - 4]
push eax
mov edx, dword [ebp - 4]
mov eax, 0x527f14
call fcn.00404604
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404520
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 4]
call fcn.0040a2b8
mov eax, dword [ebp - 0x30]
push eax
lea eax, [ebp - 0x38]
lea edx, [ebp - 0x25]
mov ecx, 0x15
call fcn.004042c8
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x34]
call fcn.0040a2b8
mov edx, dword [ebp - 0x34]
pop eax
call fcn.00404428
je 0x527e56
cmp dword [ebp - 4], 0
jne 0x527e59
mov byte [esi], 1
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.004040dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x527e92
lea eax, [ebp - 0x38]
mov edx, 4
call fcn.004040ac
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004040ac
ret
Function at 0x52d0d8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x52d256
push dword fs:[eax]
mov dword fs:[eax], esp
test byte [ebx + 0x20], 0x10
je 0x52d118
mov eax, esi
mov edx, 0x52d26c
call fcn.004040dc
jmp 0x52d212
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0x14]
mov eax, dword [0x9b8724]
mov eax, dword [eax]
call fcn.0045b7f0
mov eax, dword [ebp - 0x14]
call fcn.004044dc
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jne 0x52d150
mov eax, esi
mov edx, 0x52d288
call fcn.004040dc
jmp 0x52d212
lea eax, [edi + 1]
call fcn.0040b580
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
push edi
push 0
lea edx, [ebp - 0x18]
mov eax, dword [0x9b8724]
mov eax, dword [eax]
call fcn.0045b7f0
mov eax, dword [ebp - 0x18]
call fcn.004044dc
push eax
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x52d2a8
push dword [ebx + 0x148]
push 0x52d2c4
push dword [ebx + 0x144]
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.004043d8
mov eax, dword [ebp - 0x1c]
call fcn.004044dc
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x52d206
cmp dword [ebp - 8], 1
jle 0x52d1f8
mov eax, dword [ebp - 8]
inc eax
call fcn.0040b580
mov edi, eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov eax, edi
call fcn.0040b398
mov eax, esi
mov edx, edi
call fcn.00404250
mov eax, dword [ebp - 0xc]
call fcn.0040b5cc
mov eax, edi
call fcn.0040b5cc
jmp 0x52d212
mov eax, esi
mov edx, 0x52d2d0
call fcn.004040dc
jmp 0x52d212
mov eax, esi
mov edx, 0x52d2e8
call fcn.004040dc
cmp byte [ebx + 0x140], 0
je 0x52d23b
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.0052d3e8
push dword [ebp - 0x20]
push 0x52d310
push dword [esi]
mov eax, esi
mov edx, 3
call fcn.004043d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52d25d
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.004040ac
ret
Function at 0x56c4b8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x108], edx
mov esi, eax
xor eax, eax
push ebp
push 0x56c68d
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
cmp dword [esi + 0x2c], 0
jne 0x56c674
mov eax, dword [esi + 0x24]
call fcn.00404318
test eax, eax
jne 0x56c50d
mov eax, dword [esi + 0x28]
call fcn.00404318
test eax, eax
jne 0x56c50d
mov eax, esi
call fcn.0056c72c
jmp 0x56c674
cmp dword [esi + 0x94], 0
jne 0x56c544
lea eax, [ebp - 0x101]
mov edx, dword [esi + 0x24]
call fcn.0040b3cc
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x9b9c9c]
mov eax, dword [eax + 0x38]
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [esi + 0x94], eax
cmp dword [esi + 0x98], 0
jne 0x56c57b
lea eax, [ebp - 0x101]
mov edx, dword [esi + 0x28]
call fcn.0040b3cc
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x9b9c9c]
mov eax, dword [eax + 0x38]
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [esi + 0x98], eax
mov ecx, dword [esi + 0x98]
mov edx, dword [esi + 0x94]
mov eax, esi
call fcn.0056c76c
mov ebx, eax
test bl, bl
jne 0x56c629
mov eax, dword [esi + 0x24]
call fcn.00404318
test eax, eax
jne 0x56c5b3
mov eax, dword [esi + 0xb0]
call fcn.00404318
test eax, eax
je 0x56c629
mov eax, dword [esi + 0xb0]
call fcn.00404318
test eax, eax
je 0x56c5d5
lea eax, [ebp - 0x101]
mov edx, dword [esi + 0xb0]
call fcn.0040b3cc
jmp 0x56c601
push dword [esi + 0x24]
push 0x56c6a8
push dword [esi + 0x28]
lea eax, [ebp - 0x108]
mov edx, 3
call fcn.004043d8
mov edx, dword [ebp - 0x108]
lea eax, [ebp - 0x101]
call fcn.0040b3cc
push 7
lea eax, [ebp - 0x101]
push eax
call sub.kernel32.dll_WinExec
cmp eax, 0x20
jb 0x56c629
mov ecx, dword [esi + 0x98]
mov edx, dword [esi + 0x94]
mov eax, esi
call fcn.0056c76c
mov ebx, eax
test bl, bl
jne 0x56c636
mov eax, esi
call fcn.0056c72c
jmp 0x56c674
mov eax, dword [esi + 0x4c]
test eax, eax
je 0x56c645
mov dword [esi + 0x9c], eax
jmp 0x56c64f
mov dword [esi + 0x9c], 1
mov eax, esi
call fcn.0056c7e4
test al, al
je 0x56c674
mov eax, esi
mov bx, 0xffef
call fcn.0040343c
xor ecx, ecx
xor edx, edx
mov eax, esi
call fcn.0056cb5c
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56c694
lea eax, [ebp - 0x108]
call fcn.00404088
ret
Function at 0x580e38
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
test dl, dl
je 0x580e4f
add esp, 0xfffffff0
call fcn.004035a0
mov byte [ebp - 1], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x580fd5
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, ebx
call fcn.0041b474
mov dword [ebx + 0x90], 0xffffffff
xor eax, eax
mov dword [ebx + 0xe4], eax
mov byte [ebx + 0x24], 1
mov byte [ebx + 0x84], 1
xor eax, eax
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x94], 0
xor eax, eax
mov dword [ebx + 0x48], eax
mov dl, 1
mov eax, dword [0x57b178]
call fcn.00403230
mov dword [ebx + 0x74], eax
lea edx, [ebp - 8]
mov eax, dword [0x9b8900]
call fcn.004070c8
mov eax, dword [ebp - 8]
push eax
mov ecx, ebx
mov dl, 1
mov eax, dword [0x5797fc]
call fcn.0057f87c
mov esi, eax
mov dword [ebx + 0x78], esi
mov byte [esi + 4], 0
mov byte [esi + 0x2c], 1
lea edx, [ebp - 0xc]
mov eax, dword [0x9b87cc]
call fcn.004070c8
mov eax, dword [ebp - 0xc]
push eax
mov ecx, ebx
mov dl, 1
mov eax, dword [0x5797fc]
call fcn.0057f87c
mov dword [ebx + 0x80], eax
mov dl, 1
mov eax, dword [0x412264]
call fcn.00403230
mov dword [ebx + 0x30], eax
mov dl, 1
mov eax, dword [0x412264]
call fcn.00403230
mov dword [ebx + 0x7c], eax
mov dword [ebx + 0x28], 0x80000000
mov byte [ebx + 0x64], 1
mov word [ebx + 0x38], 0
mov ecx, ebx
mov dl, 1
mov eax, dword [0x57acf0]
call fcn.0057ffb0
mov dword [ebx + 0x58], eax
lea edx, [ebx + 0x70]
mov eax, dword [0x9b8994]
call fcn.004070c8
lea edx, [ebx + 0x60]
mov eax, dword [0x9b88d0]
call fcn.004070c8
mov dl, 1
mov eax, dword [0x412264]
call fcn.00403230
mov dword [ebx + 0x3c], eax
xor eax, eax
mov dword [ebx + 0x68], eax
mov dl, 1
mov eax, dword [0x412264]
call fcn.00403230
mov dword [ebx + 0x54], eax
mov al, byte [0x580ffc]
mov byte [ebx + 0x95], al
mov dword [ebx + 0x40], 0xffffffff
mov dword [ebx + 0x50], 0xffffffff
mov byte [ebx + 0xea], 1
mov byte [ebx + 0xe8], 1
mov byte [ebx + 0xeb], 0
lea eax, [ebx + 0xe0]
call fcn.00404088
mov al, byte [0x581000]
mov byte [ebx + 0x9c], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x580fdc
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004040ac
ret