joyce8/EMBER2024-capa huggingface dataset:
Function at 0x60b2c0
Capabilities:
Hash data using sha1

Disassembly:
mov ecx, dword [0x911770]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
lea eax, [esp - 4]
cmp eax, dword [ecx + 8]
jbe 0x60b3c5
sub esp, 0x84
nop
lea edi, [esp + 0x20]
xor eax, eax
call fcn.00471f08
nop
mov dword [esp + 0x20], 0x67452301
mov dword [esp + 0x24], 0xefcdab89
mov dword [esp + 0x28], 0x98badcfe
mov dword [esp + 0x2c], 0x10325476
mov dword [esp + 0x30], 0xc3d2e1f0
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
mov ecx, dword [esp + 0x88]
mov eax, dword [esp + 0x8c]
jmp 0x60b375
mov dword [esp + 0x1c], eax
mov dword [esp + 0x80], ecx
mov eax, dword [ecx]
mov edx, dword [ecx + 4]
mov ebx, dword [ecx + 8]
lea ebp, [esp + 0x20]
mov dword [esp], ebp
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
call sym.crypto_sha1._digest_.Write
mov eax, dword [esp + 0x80]
lea ecx, [eax + 0xc]
mov eax, dword [esp + 0x1c]
dec eax
test eax, eax
jg 0x60b33b
lea eax, [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call sym.crypto_sha1._digest_.Sum
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], ecx
mov dword [esp + 0x9c], edx
add esp, 0x84
ret
call sym.runtime.morestack_noctxt
jmp sym.crypto_tls.sha1Hash
Function at 0x60b3d0
Capabilities:
Hash data with md5

Disassembly:
mov ecx, dword [0x911770]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
lea eax, [esp - 0x7c]
cmp eax, dword [ecx + 8]
jbe 0x60b608
sub esp, 0xfc
lea eax, [0x6a6300]
mov dword [esp], eax
mov dword [esp + 4], 0x24
mov dword [esp + 8], 0x24
call sym.runtime.makeslice
mov eax, dword [esp + 0xc]
mov dword [esp + 0xf8], eax
nop
lea edi, [esp + 0x94]
xor eax, eax
call fcn.00471f09
nop
mov dword [esp + 0x94], 0x67452301
mov dword [esp + 0x98], 0xefcdab89
mov dword [esp + 0x9c], 0x98badcfe
mov dword [esp + 0xa0], 0x10325476
mov dword [esp + 0xe4], 0
mov dword [esp + 0xe8], 0
mov dword [esp + 0xec], 0
mov eax, dword [esp + 0x100]
mov ecx, eax
mov edx, dword [esp + 0x104]
jmp 0x60b4d2
mov dword [esp + 0x90], edx
mov dword [esp + 0xf4], eax
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov ebx, dword [eax + 8]
lea ebp, [esp + 0x94]
mov dword [esp], ebp
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
call sym.crypto_md5._digest_.Write
mov eax, dword [esp + 0xf4]
add eax, 0xc
mov ecx, dword [esp + 0x90]
lea edx, [ecx - 1]
mov ecx, dword [esp + 0x100]
test edx, edx
jg 0x60b486
lea edi, [esp + 0x34]
lea esi, [esp + 0x94]
call fcn.0047234a
lea eax, [esp + 0x34]
mov dword [esp], eax
call sym.crypto_md5._digest_.checkSum
lea edi, [esp + 0x20]
lea esi, [esp + 4]
call fcn.00472408
mov dword [esp], 0
mov dword [esp + 4], 0x10
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x10
lea eax, [0x6a6300]
mov dword [esp + 0x10], eax
call sym.runtime.growslice
mov eax, dword [esp + 0x14]
mov dword [esp + 0xf0], eax
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x30], ecx
mov dword [esp], eax
lea edx, [esp + 0x20]
mov dword [esp + 4], edx
mov dword [esp + 8], 0x10
call sym.runtime.memmove
mov eax, dword [esp + 0x30]
cmp eax, 0x24
jl 0x60b566
mov eax, 0x24
mov ecx, dword [esp + 0xf0]
mov edx, dword [esp + 0xf8]
cmp ecx, edx
je 0x60b588
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call sym.runtime.memmove
mov eax, dword [esp + 0x100]
mov dword [esp], eax
mov eax, dword [esp + 0x104]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x108]
mov dword [esp + 8], eax
call sym.crypto_tls.sha1Hash
mov eax, dword [esp + 0x10]
cmp eax, 0x14
jl 0x60b5bb
mov eax, 0x14
mov ecx, dword [esp + 0xf8]
lea edx, [ecx + 0x10]
mov ebx, dword [esp + 0xc]
cmp ebx, edx
je 0x60b5e4
mov dword [esp], edx
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
call sym.runtime.memmove
mov ecx, dword [esp + 0xf8]
mov dword [esp + 0x10c], ecx
mov dword [esp + 0x110], 0x24
mov dword [esp + 0x114], 0x24
add esp, 0xfc
ret
call sym.runtime.morestack_noctxt
jmp sym.crypto_tls.md5SHA1Hash
Function at 0x60f690
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x911770]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x60f838
sub esp, 0x48
movzx eax, word [esp + 0x78]
cmp ax, 0x303
jb 0x60f6bc
movzx ecx, byte [esp + 0x80]
jmp 0x60f6c9
movzx ecx, byte [esp + 0x80]
cmp cl, 0xe4
jne 0x60f701
mov edx, dword [esp + 0x6c]
test edx, edx
je 0x60f81f
cmp cl, 0xe4
je 0x60f6e0
cmp ax, 0x303
jmp 0x60f705
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x88], edx
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], ecx
add esp, 0x48
ret
cmp ax, 0x303
jae 0x60f793
cmp cl, 0xe3
jne 0x60f75d
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x58]
mov eax, dword [eax + 0x18]
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x90], edx
add esp, 0x48
ret
lea edi, [esp]
lea esi, [esp + 0x4c]
call fcn.004723ae
call sym.crypto_tls.finishedHash.Sum
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x90], edx
add esp, 0x48
ret
mov eax, dword [esp + 0x84]
mov dword [esp], eax
call sym.crypto.Hash.New
mov eax, dword [esp + 4]
mov dword [esp + 0x40], eax
mov ecx, dword [esp + 8]
mov dword [esp + 0x44], ecx
mov edx, dword [eax + 0x1c]
mov ebx, dword [esp + 0x6c]
mov ebp, dword [esp + 0x70]
mov esi, dword [esp + 0x74]
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], esi
call edx
mov eax, dword [esp + 0x40]
mov eax, dword [eax + 0x18]
mov ecx, dword [esp + 0x44]
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x90], edx
add esp, 0x48
ret
lea eax, [0x6a6280]
mov dword [esp], eax
lea eax, [0x756ea8]
mov dword [esp + 4], eax
call sym.runtime.gopanic
nop
call sym.runtime.morestack_noctxt
jmp sym.crypto_tls.finishedHash.hashForClientCertificate
Function at 0x614430
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x911770]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x61461c
sub esp, 0x68
mov eax, dword [esp + 0x70]
mov edx, dword [esp + 0x6c]
xor ecx, ecx
mov ebx, 1
jmp 0x61446d
mov ebp, dword [esp + 0x5c]
lea ecx, [ebp + 1]
cmp dl, 0x2d
sete bl
mov eax, dword [esp + 0x70]
mov edx, dword [esp + 0x6c]
cmp eax, ecx
jle 0x614610
mov dword [esp + 0x5c], ecx
mov byte [esp + 0x18], bl
movzx ebp, byte [edx + ecx]
xchg ebp, eax
mov byte [esp + 0x19], al
xchg ebp, eax
lea esi, [ebp - 0x20]
mov ecx, esi
mov edx, 1
shl edx, cl
neg ecx
mov byte [esp + 0x1b], cl
mov eax, 1
shr eax, cl
lea edi, [ebp - 0x60]
mov ecx, edi
mov ebx, 1
shl ebx, cl
mov dword [esp + 0x64], ebx
neg ecx
mov byte [esp + 0x1a], cl
mov ebx, 1
shr ebx, cl
mov dword [esp + 0x60], ebx
add ebp, 0xffffffc0
mov ecx, ebp
mov ebx, 1
shl ebx, cl
xchg esi, eax
cmp al, 0x20
xchg esi, eax
sbb esi, esi
and edx, esi
movzx esi, byte [esp + 0x1b]
xchg esi, eax
cmp al, 0x20
xchg esi, eax
sbb esi, esi
and eax, esi
or eax, edx
and eax, 0x3ff6cfa
cmp cl, 0x20
sbb edx, edx
and edx, ebx
xchg edi, eax
cmp al, 0x20
xchg edi, eax
sbb ebx, ebx
mov ebp, dword [esp + 0x64]
and ebp, ebx
movzx ebx, byte [esp + 0x1a]
cmp bl, 0x20
sbb ebx, ebx
mov esi, dword [esp + 0x60]
and esi, ebx
or ebp, esi
and ebp, 0x57ffffff
or ebp, eax
test ebp, ebp
setne al
test edx, 0xc7fffffe
setne dl
or eax, edx
test al, al
je 0x6145fc
movzx eax, byte [esp + 0x18]
test al, al
je 0x614551
movzx edx, byte [esp + 0x19]
lea ebx, [edx - 0x61]
cmp bl, 0x19
jbe 0x614564
test al, al
jne 0x614458
jmp 0x614556
movzx edx, byte [esp + 0x19]
lea eax, [edx - 0x41]
cmp al, 0x19
ja 0x614458
jmp 0x6145b0
lea eax, [esp + 0x3c]
mov dword [esp], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 8], eax
call sym.runtime.stringtoslicebyte
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
call sym.net_textproto.canonicalMIMEHeaderKey
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], ecx
add esp, 0x68
ret
lea eax, [esp + 0x1c]
mov dword [esp], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 8], eax
call sym.runtime.stringtoslicebyte
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
call sym.net_textproto.canonicalMIMEHeaderKey
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], ecx
add esp, 0x68
ret
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x74], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x78], eax
add esp, 0x68
ret
mov dword [esp + 0x74], edx
mov dword [esp + 0x78], eax
add esp, 0x68
ret
call sym.runtime.morestack_noctxt
jmp sym.net_textproto.CanonicalMIMEHeaderKey
Function at 0x621f80
Capabilities:
Hash data with crc32

Disassembly:
mov ecx, dword [0x911770]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x621ffd
sub esp, 8
lea eax, [0x6aa620]
mov dword [esp], eax
call sym.runtime.newobject
mov eax, dword [esp + 4]
xor ecx, ecx
jmp 0x621faf
mov dword [eax + edx*4], ecx
lea ecx, [edx + 1]
cmp ecx, 0x100
jge 0x621fbd
mov edx, ecx
xor ebx, ebx
jmp 0x621fe2
mov ecx, dword [0x911a40]
test ecx, ecx
je 0x621fd7
call sym.runtime.gcWriteBarrier2
mov dword [edi], eax
mov ecx, dword [0x8f1440]
mov dword [edi + 4], ecx
mov dword [0x8f1440], eax
add esp, 8
ret
inc ebx
cmp ebx, 8
jge 0x621fa9
test ecx, 1
je 0x621ff9
shr ecx, 1
xor ecx, 0xedb88320
jmp 0x621fe1
shr ecx, 1
jmp 0x621fe1
call sym.runtime.morestack_noctxt
jmp sym.hash_crc32.init
Function at 0x67ee90
Capabilities:
Hash data using sha1

Disassembly:
mov ecx, dword [0x911770]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
lea eax, [esp - 0x1c]
cmp eax, dword [ecx + 8]
jbe 0x67efdb
sub esp, 0x9c
nop
lea edi, [esp + 0x3c]
xor eax, eax
call fcn.00471f08
nop
mov dword [esp + 0x3c], 0x67452301
mov dword [esp + 0x40], 0xefcdab89
mov dword [esp + 0x44], 0x98badcfe
mov dword [esp + 0x48], 0x10325476
mov dword [esp + 0x4c], 0xc3d2e1f0
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0
mov dword [esp + 0x98], 0
lea ecx, [esp + 0x1c]
mov dword [esp], ecx
mov ecx, dword [esp + 0xa0]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0xa4]
mov dword [esp + 8], ecx
call sym.runtime.stringtoslicebyte
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
lea ebp, [esp + 0x3c]
mov dword [esp], ebp
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
call sym.crypto_sha1._digest_.Write
mov ecx, dword [str.258EAFA5_E914_47DA_95CA_C5AB0DC85B11]
mov edx, dword [0x8ead0c]
mov ebx, dword [0x8ead10]
lea ebp, [esp + 0x3c]
mov dword [esp], ebp
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
call sym.crypto_sha1._digest_.Write
lea ecx, [esp + 0x3c]
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call sym.crypto_sha1._digest_.Sum
mov ecx, dword [0x8f130c]
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ebp
call sym.encoding_base64._Encoding_.EncodeToString
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [esp + 0xa8], ecx
mov dword [esp + 0xac], edx
add esp, 0x9c
ret
call sym.runtime.morestack_noctxt
jmp sym.github.com_gorilla_websocket.computeAcceptKey
Function at 0x401449
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 0xc]
mov edx, eax
dec eax
test edx, edx
je 0x40148c
mov edx, dword [ecx + 0xc]
inc eax
push ebx
push edi
mov dword [ebp + 8], eax
mov eax, dword [ecx + 4]
movzx ebx, byte [esi]
mov edi, eax
and edi, 0xff
xor edi, ebx
inc esi
shr eax, 8
mov edi, dword [edx + edi*4]
xor eax, edi
dec dword [ebp + 8]
mov dword [ecx + 4], eax
jne 0x401469
pop edi
pop ebx
mov eax, dword [ecx + 4]
pop esi
pop ebp
ret 0xc

Function at 0x401dab
Capabilities:
Enumerate services

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, ecx
call fcn.00401f16
push 4
call fcn.004059cf
test eax, eax
pop ecx
je 0x401e85
lea eax, [ebp - 8]
xor ebx, ebx
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push ebx
mov esi, dword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
push dword [ebp + 0xc]
mov dword [ebp - 8], ebx
push dword [ebp + 8]
push dword [0x523a60]
call esi
test eax, eax
je 0x401dfe
push 1
pop eax
jmp 0x401e87
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x401e7e
cmp dword [ebp - 4], ebx
je 0x401e7e
push dword [ebp - 4]
call fcn.004af1a1
cmp eax, ebx
pop ecx
mov dword [ebp - 0xc], eax
jne 0x401e25
call fcn.004c23d5
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xc]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [0x523a60]
call esi
push eax
mov ecx, edi
call fcn.00405976
mov esi, eax
cmp esi, ebx
je 0x401e71
push dword [ebp - 0x10]
mov ecx, edi
push dword [ebp - 0xc]
call fcn.00401f3c
mov dword [edi + 0x38], ebx
push dword [edi + 0x14]
lea ecx, [edi + 0xc]
call fcn.004c5fe3
push dword [ebp - 0xc]
call fcn.004af0b8
pop ecx
mov eax, esi
jmp 0x401e87
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x40566a
Capabilities:
Start service

Disassembly:
push esi
mov esi, ecx
push 0x10
call fcn.00405992
test eax, eax
je 0x40569a
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
push eax
mov ecx, esi
call fcn.00405976
test eax, eax
je 0x40569a
push 1
pop eax
jmp 0x40569c
xor eax, eax
pop esi
ret 8

Function at 0x4056a0
Capabilities:
Pause service

Disassembly:
sub esp, 0x1c
push esi
mov esi, ecx
push 0x40
call fcn.00405992
test eax, eax
je 0x4056d2
lea eax, [esp + 4]
push eax
push 2
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_ControlService]
push eax
mov ecx, esi
call fcn.00405976
test eax, eax
je 0x4056d2
push 1
pop eax
jmp 0x4056d4
xor eax, eax
pop esi
add esp, 0x1c
ret

Function at 0x4056a3
Capabilities:
Pause service

Disassembly:
sub esp, 0x1c
push esi
mov esi, ecx
push 0x40
call fcn.00405992
test eax, eax
je 0x4056d2
lea eax, [esp + 4]
push eax
push 2
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_ControlService]
push eax
mov ecx, esi
call fcn.00405976
test eax, eax
je 0x4056d2
push 1
pop eax
jmp 0x4056d4
xor eax, eax
pop esi
add esp, 0x1c
ret

Function at 0x4056d9
Capabilities:
Continue service

Disassembly:
sub esp, 0x1c
push esi
mov esi, ecx
push 0x40
call fcn.00405992
test eax, eax
je 0x40570b
lea eax, [esp + 4]
push eax
push 3
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_ControlService]
push eax
mov ecx, esi
call fcn.00405976
test eax, eax
je 0x40570b
push 1
pop eax
jmp 0x40570d
xor eax, eax
pop esi
add esp, 0x1c
ret

Function at 0x4056dc
Capabilities:
Continue service

Disassembly:
sub esp, 0x1c
push esi
mov esi, ecx
push 0x40
call fcn.00405992
test eax, eax
je 0x40570b
lea eax, [esp + 4]
push eax
push 3
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_ControlService]
push eax
mov ecx, esi
call fcn.00405976
test eax, eax
je 0x40570b
push 1
pop eax
jmp 0x40570d
xor eax, eax
pop esi
add esp, 0x1c
ret

Function at 0x405712
Capabilities:
Stop service

Disassembly:
sub esp, 0x1c
push esi
mov esi, ecx
push 0x20
call fcn.00405992
test eax, eax
je 0x405744
lea eax, [esp + 4]
push eax
push 1
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_ControlService]
push eax
mov ecx, esi
call fcn.00405976
test eax, eax
je 0x405744
push 1
pop eax
jmp 0x405746
xor eax, eax
pop esi
add esp, 0x1c
ret

Function at 0x405715
Capabilities:
Stop service

Disassembly:
sub esp, 0x1c
push esi
mov esi, ecx
push 0x20
call fcn.00405992
test eax, eax
je 0x405744
lea eax, [esp + 4]
push eax
push 1
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_ControlService]
push eax
mov ecx, esi
call fcn.00405976
test eax, eax
je 0x405744
push 1
pop eax
jmp 0x405746
xor eax, eax
pop esi
add esp, 0x1c
ret

Function at 0x405a43
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x405a78
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x10
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov esi, eax
test esi, esi
je 0x405a78
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
call fcn.004c6033
mov eax, esi
pop esi
leave
ret 4
Function at 0x405a7f
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push esi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x405abd
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x101
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov esi, eax
test esi, esi
je 0x405abd
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
call fcn.004c6033
mov eax, esi
pop esi
leave
ret 4

Function at 0x405c5d
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, 0x4d72d4
call fcn.004aef44
sub esp, 0x2a4
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x405dc0
push str.WS2_32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x405dc0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
push str.WSAStartup
push eax
call esi
push str.gethostname
mov edi, eax
push dword [ebp - 0x10]
call esi
push str.gethostbyname
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x10]
call esi
push str.WSACleanup
mov dword [ebp - 0x18], eax
push dword [ebp - 0x10]
call esi
push str.inet_ntoa
mov dword [ebp - 0x14], eax
push dword [ebp - 0x10]
call esi
cmp edi, ebx
mov dword [ebp - 0x20], eax
je 0x405db1
cmp dword [ebp - 0x1c], ebx
je 0x405db1
cmp dword [ebp - 0x18], ebx
je 0x405db1
cmp dword [ebp - 0x14], ebx
je 0x405db1
cmp eax, ebx
je 0x405db1
lea eax, [ebp - 0x2b0]
push eax
push 0x101
call edi
cmp eax, ebx
jne 0x405db1
mov eax, dword [ebp + 0x10]
cmp eax, ebx
jne 0x405d3c
lea eax, [ebp - 0x120]
push 0xff
push eax
call dword [ebp - 0x1c]
neg eax
sbb eax, eax
inc eax
mov dword [ebp + 0x10], eax
lea eax, [ebp - 0x120]
je 0x405dae
push eax
call dword [ebp - 0x18]
mov edi, eax
cmp edi, ebx
je 0x405dae
mov eax, dword [edi + 0xc]
cmp dword [eax], ebx
je 0x405dab
xor esi, esi
mov eax, dword [esi + eax]
movzx ecx, byte [eax + 3]
movzx edx, byte [eax + 2]
shl ecx, 8
add ecx, edx
movzx edx, byte [eax + 1]
movzx eax, byte [eax]
shl ecx, 8
add ecx, edx
shl ecx, 8
add ecx, eax
push ecx
call dword [ebp - 0x20]
push eax
lea ecx, [ebp + 0x10]
call fcn.004c5f18
mov edx, dword [ebp + 8]
push eax
mov dword [ebp - 4], ebx
mov ecx, dword [edx + 8]
push ecx
mov ecx, edx
call fcn.004c3dff
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call fcn.004c5eaa
cmp dword [ebp + 0xc], ebx
jne 0x405dab
mov eax, dword [edi + 0xc]
add esi, 4
cmp dword [esi + eax], ebx
jne 0x405d4f
push 1
pop ebx
call dword [ebp - 0x14]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, ebx
pop esi
jmp 0x405dc2
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x405e85
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
cmp dword [ebp + 0xc], 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
je 0x406056
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x406056
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x406056
mov esi, dword [ebp + 0x18]
test esi, esi
je 0x406056
mov eax, dword [ebp + 8]
test eax, eax
jl 0x406056
cmp eax, 0x1a
jge 0x406056
add eax, 0x41
push eax
lea eax, [ebp - 0x10]
push str._c:_
push eax
call fcn.004b00aa
add esp, 0xc
mov eax, 0x105
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x1c], 0x104
push eax
push ecx
lea ecx, [ebp - 0x30]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x18]
push ecx
push eax
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x406056
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x140]
push eax
call fcn.004c6033
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
mov dword [ebx], eax
lea eax, [ebp - 0x14]
push eax
call fcn.00405e26
test eax, eax
je 0x406004
cmp dword [ebp - 0x14], 0
je 0x406004
push str.KERNEL32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [ebp + 0xc], eax
je 0x406051
push str.GetDiskFreeSpaceExA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x405fa8
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x38]
push ecx
lea ecx, [ebp - 0x10]
push ecx
call eax
test eax, eax
jle 0x405ff9
mov eax, dword [ebp - 0x24]
mov dword [edi], eax
mov eax, dword [ebp - 0x20]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [esi], eax
mov eax, dword [ebp - 0x28]
mov dword [esi + 4], eax
jmp 0x405ff9
lea eax, [ebp + 0x18]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x406056
mov eax, dword [ebp + 0x10]
mul dword [ebp + 0x14]
mov ebx, eax
push edx
push ebx
push 0
push dword [ebp + 0x18]
mov dword [ebp - 4], edx
call fcn.004af6a0
push dword [ebp - 4]
mov dword [edi], eax
mov dword [edi + 4], edx
push ebx
push 0
push dword [ebp + 8]
call fcn.004af6a0
mov dword [esi], eax
mov dword [esi + 4], edx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x406051
lea eax, [ebp + 0x18]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x406056
mov eax, dword [ebp + 0x10]
mul dword [ebp + 0x14]
mov ebx, eax
push edx
push ebx
push 0
push dword [ebp + 0x18]
mov dword [ebp - 4], edx
call fcn.004af6a0
push dword [ebp - 4]
mov dword [edi], eax
mov dword [edi + 4], edx
push ebx
push 0
push dword [ebp + 8]
call fcn.004af6a0
mov dword [esi], eax
mov dword [esi + 4], edx
push 1
pop eax
jmp 0x406058
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x14