joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417a10
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x50
test eax, eax
push esi
je 0x417a36
mov eax, dword [0x6347f0]
test eax, eax
je 0x417a2c
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
pop esi
add esp, 0x50
ret
push ebx
push edi
lea eax, [esp + 0xc]
push 0x50
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, str.dsound.dll
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xd]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
mov dword [0x6347f0], eax
test eax, eax
pop ebx
je 0x417ad1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.DirectSoundCreate
push eax
call esi
mov ecx, dword [0x6347f0]
push str.DirectSoundEnumerateA
push ecx
mov dword [0x6347ec], eax
call esi
mov ecx, dword [0x6347ec]
mov dword [0x6347f4], eax
test ecx, ecx
je 0x417ac7
test eax, eax
je 0x417ac7
mov eax, 1
pop esi
add esp, 0x50
ret
mov dword [0x6347f0], 0
xor eax, eax
pop esi
add esp, 0x50
ret

Function at 0x4261b2
Capabilities:
Encode data using xor

Disassembly:
invalid
jae 0x4261a3
cmc
mov dword [0xfe665722], eax
or cl, ch
je 0x42622f
jb 0x426220
or al, 5
invalid
scasd eax, dword es:[edi]
sahf
pop edx
adc edx, eax
xchg esi, eax
add byte [edi], 0x2b
mov dword [edi], eax
cmp eax, 0xd6bf4445
aam 9
and byte [edi + 0x30a8449b], 0x49
mov edi, 0x8209d4d6
cmpsd dword [esi], dword es:[edi]
wait
inc esp
test al, 0x30
dec ecx
xchg dword [esi], eax
lds esi, [0xe73c554b]
out dx, al
xchg edi, eax
mov esp, 0x31da48fa
xor dword [ebx], edx
xchg esp, eax
enter 0xffffffffffffb3da, 0x22
fist dword [edx - 0x6b]
push edx
xchg ebp, eax
xchg ebp, eax
inc edx
or dl, byte [ebp + 0x56]
or byte [0xd5bf0c3c], ch
fist dword [edx + 0x26]
xor cl, byte [edi + 0x571dbdd0]
fidivr dword [eax]
add byte [ebp - 0x5a], ah
jb 0x426251
push es
and byte [ebx - 0x7f643c97], bl
push 0xffffffffffffff8b
push edx
cmp eax, eax
clc
lds esi, [ecx - 0x4ecffb76]
xor al, 0xbb
add byte [esi], dl
add byte [eax + edi*4 + 0x18761048], 0x75
mov al, byte [0x24c7afdb]
lcall 0x6550, 0x94463400
call 0x79f79a70
cmp ebp, ebx
mov esi, 0x4663346f
sbb dword [edi], ebp
fcomp qword [edx + 0x64]
mov dh, 0xab
mov bl, 0x62
push ss
iretd
Function at 0x46a02d
Capabilities:
Authenticate hmac

Disassembly:
retf
push eax
mov dl, 0xc9
add al, 0x33
mov al, byte [0xbdcf2a8d]
jbe 0x46a037
je 0x46a0b1
jne 0x46a0a9
insb byte es:[edi], dx
jp 0x46a09a
dec esp
sbb byte [eax + 0x264c7a59], 0x22
jge 0x46a084
mov esi, 0xeac15208
invalid
push cs
fcmovb st(0), st(5)
adc eax, 0x177497dc
pushfd
ficom word [esp]
adc eax, 0x74119f0c
sbb dword [edx + 0x5e175a63], esi
je 0x46a024
test al, 0x5e
add byte [edx + 0x5f], bl
push cs
jbe 0x46a0ec
push edi
and bl, dl
div dword [eax + 0x329a356a]
insb byte es:[edi], dx
mov eax, 0xf49cdb43
inc esp
inc esp
jl 0x46a115
add ah, 0xc2
xchg esi, eax
jp 0x46a03b
arpl word [edx], cx
mov byte [0x1a6447a2], al
xchg ebx, eax
push ds
xchg dword [ebx], ecx
fdisi8087_nop
jmp 0xd489b0b4
sbb dl, byte [ebx - 0x24f478e2]
loope 0x46a09a
dec dword [edi]
inc ebx
aam 0x46
sbb bh, byte [ecx + 0xc5124cc]
mov eax, dword [0xfd631419]
push ecx
or al, 0xa1
sbb dword [ebx], edx
std
cli
and eax, 0x796e8439
cmp al, 0xcb
mov bh, 0x23
jle 0x46a069
stosb byte es:[edi], al
fisub word [ebx - 0x10]
adc al, 0xb2
sahf
fcomp dword [esi + ecx*8]
dec edx
mov al, 0xb2
and ebp, dword ss:[ebx]
jl 0x46a072
push edx
xor byte [esi], bl
int 0x3d
dec eax
pop ds
sub esi, ecx
jge 0x46a0ba
ljmp 0xe47f:0xc944d939
fld dword [ecx + ecx*8 + 0x7f]
in al, 0xd5
adc al, 0x2e
xor dword [esi], eax
sub al, 0xb6
or eax, 0xb25ca2ef
out 0x33, eax
pop esi
invalid
ja 0x46a185
mov ebp, 0xedefb60b
pop edx
push cs
aas
pop ds
jno 0x46a190
cli
cmp dword [esi], ebx
add esi, dword [ebx + 0x5a]
cmp al, 0x3c
and ebx, dword [0xbeb399d3]
std
lcall 0x3fe5, 0xff8101e8
ret
sub byte es:[eax + 0x63], 0xb4
adc dword [ebx], ecx
mov ebp, 0x2fab61cd
das
por mm6, qword [edx]
mov al, byte [0x4e67e13e]
sub eax, 0xe4244b40
xor eax, 0x3add4bb4
mov ebx, 0x1ac8c5d
imul esi, dword [edi - 0x1c], 0xfffffffa
jg 0x46a204
inc eax
or eax, 0x40169bc0
wait
push ss
inc eax
dec edx
fbld tbyte cs:[edx + esi - 0x1194015e]
adc bl, 0xb
mov word [edx], es
cwde
imul ebp, edi, 0x36
cmpsb byte [esi], byte es:[edi]
lahf
arpl word [eax - 0x530fe94e], bp
or byte [edx], dl
dec edx
jmp 0x46a238
das
invalid
jp 0x46a1b1
mov dword [esi + 0x6abe9eec], edx
or al, 0xc8
invalid
sub esi, dword [eax + edx*2 + 0x10d2d1a5]
jae 0x46a215
inc esp
stosb byte es:[edi], al
dec ebp
mov gs, word [edi + ebp*4 - 0x2e404330]
jge 0x46a2bb
mov byte [edi + 0x5086518c], ch
dec eax
scasb al, byte es:[edi]
inc eax
add dword [ebx + 0x2d8a54ff], 0x5c
sbb dh, bl
mov eax, edx
and ah, byte [ebp + 0x7c]
mov edi, 0x9f8f8cdd
test al, 0xdf
cmp esp, esi
wait
xchg dword [edx - 0x67], ecx
stosb byte es:[edi], al
sbb ecx, eax
sbb al, 0xdf
add al, 0x72
retf 0xf2ba
cmp edx, dword [edi]
iretd
Function at 0x47ca5d
Capabilities:
Encode data using xor

Disassembly:
neg dword [ecx]
sub eax, 0x612ac182
dec ecx
sbb byte [edi + 0x5aafee84], 0xac
inc edx
dec edx
fisubr dword [ebx + 0x5d4e0b47]
wait
mov ah, 0x5c
cli
add edx, dword [ecx + 0x56]
sub al, 0x7c
and ch, byte [ecx + 0x68]
push ds
mov al, 0x62
pop edi
push edi
pop esi
sbb eax, 0xb9e57a00
jnp 0x47ca98
jno 0x47cac6
xor ebp, dword [edx - 0x4c1d0686]
pop edx
mov esi, ebx
add eax, 0x74d14c5c
dec esp
sal dword [ebp + ebx*8 - 0x48], 1
aas
cmp eax, 0xde43d773
mov ch, byte [edi]
xor eax, 0xa2d040b4
jnp 0x47ca3c
mov ch, byte [ecx]
xor eax, 0xa2d040b4
jnp 0x47ca3c
mov ch, byte [ecx]
scasd eax, dword es:[edi]
in eax, 0xf2
je 0x47ca87
sbb dword [esi], eax
or dword [esi + 0x6f], ebx
pop esi
outsd dx, dword [esi]
sub bl, cl
cli
leave
arpl word [ecx], ax
aam 0x6f
dec edi
sbb eax, 0x1191131d
inc esp
inc ebx
wait
cmpsd dword [esi], dword es:[edi]
adc eax, 0xa02b51b1
scasd eax, dword es:[edi]
push ecx
leave
pop ebp
cmp bh, byte gs:[edx - 0x11a532e]
invalid

Function at 0x47f36d
Capabilities:
Encode data using xor

Disassembly:
mov fs, word [esp + ebx - 0xc3d71b8]
jge 0x47f3bf
xchg esp, eax
pushal
push esi
imul ecx, dword [eax + 0x6f], 0xffffffb4
ret 0x9e39

Function at 0x4b6482
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xea040818
or ebp, dword [edx]
jno fcn.004b6482
inc ebx
mov al, 0xad
push ds
add ebx, dword [ebx - 0x3e2e76b9]
xchg dword [ecx + 0xce32e06], esi
dec ebp
add al, 0x73
sub dword [ecx - 0x5e8c4c7a], esi
jge 0x4b64db
jp 0x4b64a9
das
jl 0x4b64c2
and ch, byte [eax]
cmp byte [eax - 0x56], dh
leave
rol dword [esi + 0xabb5127], 1
pushfd
dec edi
imul dword [eax - 0x7303e605]
push es
push 0x71
sti
sub byte [edx], bh
sbb byte [ebx + 0x296c2f14], 0xfb
jmp 0xbf083b3e
shl ch, 0x9d
popfd
aam 0x77
mov dh, byte [edx - 0x4fe48f87]
mov byte [esi + 0x20], 0xcb
cmc
push edx
inc edx
sub cl, 0x1d
wait
xlatb
xor al, 0x42
sub byte [ebx], dl
jge 0x4b64dd
aas
push edi
ja 0x4b6500
lea eax, [ebx - 0x367249b]
cwde
cld
xor byte [esi + 0x27], bh
mov esp, 0xae648e89
sub dword gs:[ecx], 0xfffffff7
sbb dl, byte [ebx]
mov ch, dh
adc dword [ebx + 0x6f], eax
pop eax
cwde
add al, 0x60
fcomp dword [ebx - 0xd51fa4b]
popal
sub al, 0x79
sub ebp, edi
and eax, 0x282c441d
inc esp
mov dword [0x6cc3bafc], eax
nop
sbb byte fs:[edx + 0x38042c1c], 0xef
sub dword [edx - 0x4f], edx
inc ebx
fstp qword [edx + 0x4e05e265]
mov eax, 0x3dd9b091
lahf
rcl byte [ebx + 0x8994351], cl
test byte [eax - 0x31], bl
cmp dword [ecx], eax
das
inc esp
cmpsd dword [esi], dword es:[edi]
cmp eax, 0x3448ba71
aam 0xb2
aaa
xchg esi, eax
pop ecx
mov byte [0xee91f60d], al
cmp ah, byte [ecx]
and eax, 0xa04d9f34
test byte [esi + 0x7cb50151], bh
jb 0x4b652a
xchg esp, eax
push ebx
invalid
Function at 0x627efd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6313c8
cmp edx, dword [eax]
je 0x627f1f
add eax, 8
inc ecx
cmp eax, 0x631458
jl 0x627f10
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6313c8]
jne 0x62804d
mov eax, dword [0x635d9c]
cmp eax, 1
je 0x628027
test eax, eax
jne 0x627f50
cmp dword [0x6312f4], 1
je 0x628027
cmp edx, 0xfc
je 0x62804d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x627f87
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.006288e0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00628d70
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x627fca
lea eax, [ebp - 0x1a4]
push eax
call fcn.00628d70
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62dad4
push edi
call fcn.0062ac40
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.006288e0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.006288f0
lea eax, [ebp - 0xa0]
push 0x62dab4
push eax
call fcn.006288f0
push dword [esi + 0x6313cc]
lea eax, [ebp - 0xa0]
push eax
call fcn.006288f0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0062abb4
add esp, 0x2c
pop edi
jmp 0x62804d
lea eax, [ebp + 8]
lea esi, [esi + 0x6313cc]
push 0
push eax
push dword [esi]
call fcn.00628d70
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
je 0x430072
nop
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x63c423b8
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x75e07d26
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x411250
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
push 0x40133c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x401358
push eax
mov dword [0x2b7c3d0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push dword [0x2b7c3e4]
xor ebx, ebx
push ebx
mov dword [0x2b7c3c8], eax
call eax
lea ecx, [ebp - 4]
push ecx
push 0x40
push dword [0x2b7c3e4]
mov dword [0x2b5d048], eax
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor esi, esi
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetGeoInfoW]
cmp esi, 0x11c825e
jg 0x4112c4
inc esi
mov eax, esi
cdq
cmp edx, 0x6d
jl 0x41129f
jg 0x4112c4
cmp eax, 0xd69e5f85
jb 0x41129f
mov eax, dword [0x421734]
mov edx, dword [0x2b7c3e4]
mov dword [0x2be4074], eax
xor eax, eax
cmp edx, ebx
jbe 0x4112fb
mov ecx, dword [0x2be4074]
mov cl, byte [ecx + eax + 0xb2d3b]
mov edx, dword [0x2b5d048]
mov byte [edx + eax], cl
mov edx, dword [0x2b7c3e4]
inc eax
cmp eax, edx
jb 0x4112da
mov ecx, dword [0x2b5d048]
push 0x421008
call fcn.004111f8
push 0x7b
pop esi
cmp dword [0x2b7c3e4], 0x54d
jne 0x411335
xor eax, eax
mov dword [ebp - 0x18], ebx
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x34]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsW]
dec esi
jne 0x41130e
mov eax, dword [0x2b5d048]
mov dword [0x2b7c3d8], eax
call eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41890f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x423cc0]
jne 0x418919
repz ret
jmp fcn.0041e856
Function at 0x41b51b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041575a
and dword [ebp - 4], 0
cmp dword [0x2be46e8], 0
mov ebx, eax
jne 0x41b5cc
push 0x403548
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41b67d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40353c
push edi
call esi
test eax, eax
je 0x41b67d
push eax
call fcn.004156e8
mov dword [esp], 0x40352c
push edi
mov dword [0x2be46e8], eax
call esi
push eax
call fcn.004156e8
mov dword [esp], 0x403518
push edi
mov dword [0x2be46ec], eax
call esi
push eax
call fcn.004156e8
mov dword [esp], 0x4034fc
push edi
mov dword [0x2be46f0], eax
call esi
push eax
call fcn.004156e8
pop ecx
mov dword [0x2be46f8], eax
test eax, eax
je 0x41b5cc
push 0x4034e4
push edi
call esi
push eax
call fcn.004156e8
pop ecx
mov dword [0x2be46f4], eax
mov eax, dword [0x2be46f4]
cmp eax, ebx
je 0x41b624
cmp dword [0x2be46f8], ebx
je 0x41b624
push eax
call fcn.00415763
push dword [0x2be46f8]
mov esi, eax
call fcn.00415763
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41b624
test edi, edi
je 0x41b624
call esi
test eax, eax
je 0x41b61b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41b61b
test byte [ebp - 0xc], 1
jne 0x41b624
or dword [ebp + 0x10], 0x200000
jmp 0x41b65d
mov eax, dword [0x2be46ec]
cmp eax, ebx
je 0x41b65d
push eax
call fcn.00415763
pop ecx
test eax, eax
je 0x41b65d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41b65d
mov eax, dword [0x2be46f0]
cmp eax, ebx
je 0x41b65d
push eax
call fcn.00415763
pop ecx
test eax, eax
je 0x41b65d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x2be46e8]
call fcn.00415763
pop ecx
test eax, eax
je 0x41b67d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41b67f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x437100
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x1c
mov ecx, dword [ecx + 0xc]
call fcn.004209f0
cmp byte [eax + 0x14], 0
jne 0x437115
add esp, 0x1c
ret
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
test eax, eax
je 0x437140
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.USER32.dll_ShowWindow]
sub esp, 8
add esp, 0x1c
ret
mov dword [esp], 0xfffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
add esp, 0x1c
jmp dword [sym.imp.KERNEL32.dll_FreeConsole]
Function at 0x4383f0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x3000
mov dword [esp], 0
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
sub esp, 0x10
add esp, 0x1c
ret
Function at 0x451010
Capabilities:
Get hostname

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
lea edx, [edi + 8]
lea esi, [edi + 4]
push ebx
xor ebp, ebp
xor ebx, ebx
and edx, 0xfffffffc
mov eax, esi
sub eax, edx
sub esp, 0xec
add eax, 0x20
mov ecx, dword [esp + 0x100]
mov dword [edi + 4], 0
and eax, 0xfffffffc
mov dword [esi + 0x1c], 0
mov dword [edx + ebp], ebx
add ebp, 4
cmp ebp, eax
jb 0x450ed8
test ecx, ecx
je 0x450eeb
cmp byte [ecx], 0
jne 0x450f53
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
mov dword [esp + 4], eax
lea eax, [esp + 0x10]
mov dword [esp], eax
call fcn.0047b770
test eax, eax
js 0x450f46
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
test ecx, ecx
jle 0x450f3a
xor ebx, ebx
xor eax, eax
nop
lea esi, [esi]
mov ebp, dword [edx + ebx + 0xc]
test ebp, ebp
jne 0x450f30
cmp word [edx + ebx + 0x10], 2
je 0x450f74
add eax, 1
add ebx, 0x48
cmp ecx, eax
jne 0x450f20
mov dword [esp + 4], ecx
mov dword [esp], edx
call fcn.0047bd60
add esp, 0xec
pop ebx
pop esi
pop edi
pop ebp
ret 4
mov dword [esp], esi
mov dword [esp + 8], 0x1f
mov dword [esp + 4], ecx
call sub.msvcrt.dll_strncpy
add esp, 0xec
pop ebx
pop esi
pop edi
pop ebp
ret 4
mov ecx, dword [edi + 0x238]
call fcn.004209f0
mov ebp, dword [eax + 0x18]
mov dword [esp], 0xb
call fcn.006332c0
mov dword [eax + 2], 0
add ebx, dword [esp + 0x10]
mov edi, eax
mov dword [eax + 6], 0
mov byte [eax + 0xa], 0
mov word [eax], bp
mov edx, dword [ebx + 4]
mov dword [eax + 2], edx
movzx edx, word [ebx + 8]
lea ebx, [esp + 0x18]
mov word [eax + 6], dx
mov eax, 0x7063
mov byte [edi + 0xa], 0x75
mov word [edi + 8], ax
mov dword [esp + 0xc], 0xc8
mov dword [esp + 8], ebx
mov dword [esp + 4], 0xb
mov dword [esp], edi
call fcn.0040e2d0
mov dword [esp + 8], esi
mov dword [esp + 4], 8
mov dword [esp], ebx
call fcn.0041b660
mov dword [esp], edi
call fcn.00633290
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
jmp 0x450f3a
push ebp
push edi
push esi
push ebx
mov esi, ecx
add ecx, 0xa8
lea edi, [esi + 0x28]
sub esp, 0x2c
mov dword [ecx - 0xa8], 0x652d30
mov ebp, dword [esp + 0x40]
and edi, 0xfffffffc
call fcn.00401600
lea eax, [esi + 0x24]
mov dword [esi + 0x24], 0
mov dword [esi + 0xa0], 0
mov dword [esi + 0x238], ebp
mov ebx, eax
mov dword [esp + 0x1c], eax
xor eax, eax
sub ebx, edi
sub ebx, 0xffffff80
and ebx, 0xfffffffc
mov ecx, ebx
shr ebx, 2
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, ebp
call fcn.004209f0
mov edi, dword [esp + 0x1c]
mov edx, dword [eax + 0x4c]
mov ecx, ebx
mov dword [esi + 0x24], 0
xor eax, eax
mov dword [edi + 0x7c], 0
lea edi, [esi + 0x28]
and edi, 0xfffffffc
test edx, edx
rep stosd dword es:[edi], eax
je 0x45109d
cmp byte [edx], 0
jne 0x4510d1
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], 0x7f
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_gethostname]
sub esp, 8
mov ecx, ebp
call fcn.004209f0
mov eax, dword [eax + 0x3c]
mov ecx, esi
mov dword [esp + 0x40], eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp 0x450ea0
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], 0x7f
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_strncpy
jmp 0x4510b5
Function at 0x45aa80
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [esp + 0x40]
mov dword [esp + 4], 0x45a750
mov dword [esp], 0x6ab5c4
call fcn.00472630
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
sub esp, 0x10
test eax, eax
mov dword [ebx + 0x1c], eax
je 0x45ac60
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x24], 0
lea ebp, [ebx + 0x70]
mov dword [esp], ebx
call fcn.00473330
lea eax, [ebx + 0x68]
mov dword [ebx + 4], 0
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x68], eax
mov dword [ebx + 0x6c], eax
lea eax, [ebx + 8]
mov dword [ebx + 0x38], 0
mov dword [ebx + 0x34], 0
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
lea eax, [ebx + 0x10]
mov dword [ebx + 0x3c], 0
mov dword [ebx + 0x40], 0
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x44], 0
mov dword [ebx + 0x48], 0
mov dword [ebx + 0x4c], 0
mov dword [ebx + 0x50], 0
mov dword [ebx + 0x54], 0
mov dword [ebx + 0x58], 0
mov dword [ebx + 0x5c], 0
mov dword [ebx + 0x60], 0
mov dword [ebx + 0x64], 0
mov dword [ebx + 0x18], 0
mov dword [esp], ebp
call fcn.00472810
test eax, eax
mov esi, eax
je 0x45abb2
mov eax, dword [ebx + 0x1c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebx + 0x1c], 0xffffffff
mov eax, esi
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebx + 0x88]
mov dword [esp + 8], 0x4585d0
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.0045a530
test eax, eax
mov esi, eax
jne 0x45ac90
mov eax, dword [ebx + 0xb4]
test al, 0x20
je 0x45ac10
mov edx, eax
and edx, 0xffffffdf
test al, 1
mov dword [ebx + 0xb4], edx
jne 0x45ad00
and eax, 0x40
mov ecx, eax
mov eax, edx
test ecx, ecx
je 0x45ac10
mov edx, dword [ebx + 0x8c]
sub dword [edx + 4], 1
nop
lea esi, [esi]
or al, 0x80
mov dword [ebx + 0xb4], eax
mov dword [esp], 0x6ab5a0
call fcn.00472870
mov edi, dword [0x6ab5bc]
cmp edi, dword [0x6ab5b8]
mov eax, dword [0x6ab5c0]
je 0x45aca0
mov dword [eax + edi*4], ebx
add edi, 1
mov dword [esp], 0x6ab5a0
mov dword [0x6ab5bc], edi
call fcn.004728c0
add esp, 0x2c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x40], eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.0045b940
mov dword [esp], 0x6ab5a0
mov esi, 0xe
call fcn.004728c0
mov esi, esi
lea edi, [edi]
mov dword [esp], ebp
call fcn.00472850
jmp 0x45ab92
add edi, 8
mov eax, dword [0x6ab5c0]
lea ecx, [edi*4]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 0x1c], ecx
call fcn.00458a80
test eax, eax
je 0x45ac76
mov edx, dword [0x6ab5b8]
mov dword [0x6ab5c0], eax
cmp edi, edx
jle 0x45aced
mov ecx, dword [esp + 0x1c]
lea edx, [eax + edx*4]
add ecx, eax
nop
lea esi, [esi]
mov dword [edx], 0
add edx, 4
cmp ecx, edx
jne 0x45ace0
mov dword [0x6ab5b8], edi
mov edi, dword [0x6ab5bc]
jmp 0x45ac37
mov eax, edx
jmp 0x45ac10
Function at 0x45bf70
Capabilities:
Get common file path

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov esi, edx
mov ebx, eax
sub esp, 0x2c
mov dword [esp], eax
call sub.msvcrt.dll_wcslen
test eax, eax
je 0x45bfb7
lea ebp, [eax - 1]
mov ecx, eax
movzx eax, word [ebx + ebp*2]
cmp ax, 0x5c
je 0x45c001
cmp ax, 0x2f
jne 0x45bfb3
jmp 0x45c001
sub ebp, 1
movzx eax, word [ebx + ebp*2]
cmp ax, 0x2f
je 0x45c001
cmp ax, 0x5c
je 0x45c001
test ebp, ebp
jne 0x45bfa0
test esi, esi
je 0x45bfed
mov dword [esp], 0x20a
call fcn.00458a30
test eax, eax
mov dword [esi], eax
je 0x45c0a9
mov dword [esp + 4], eax
mov dword [esp], 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
sub esp, 8
test eax, eax
je 0x45c092
mov dword [esp], ebx
call sub.msvcrt.dll__wcsdup
mov dword [edi], eax
add esp, 0x2c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
test ebp, ebp
je 0x45bfb7
test esi, esi
je 0x45c04b
lea eax, [ebp + ebp + 4]
mov dword [esp + 0x1c], ecx
mov dword [esp], eax
mov dword [esp + 0x18], eax
call fcn.00458a30
test eax, eax
mov dword [esi], eax
je 0x45c0a9
lea edx, [ebp + 1]
mov dword [esp + 4], ebx
mov dword [esp], eax
mov dword [esp + 8], edx
call sub.msvcrt.dll_wcsncpy
mov eax, dword [esi]
mov edx, dword [esp + 0x18]
xor ecx, ecx
mov word [eax + edx - 2], cx
mov ecx, dword [esp + 0x1c]
mov edx, ecx
sub edx, ebp
lea esi, [edx + edx]
mov dword [esp + 0x18], edx
mov dword [esp], esi
call fcn.00458a30
test eax, eax
mov dword [edi], eax
je 0x45c0a9
mov edx, dword [esp + 0x18]
mov dword [esp], eax
lea ecx, [edx - 1]
lea edx, [ebx + ebp*2 + 2]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
call sub.msvcrt.dll_wcsncpy
mov eax, dword [edi]
xor edx, edx
mov word [eax + esi - 2], dx
xor eax, eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esi]
mov dword [esp], eax
call fcn.00458a40
mov dword [esi], 0
mov eax, 0xffffffff
jmp 0x45c08a
mov dword [esp + 4], 0x644c28
mov dword [esp], 0xe
call fcn.0045b880
lea esi, [esi]