joyce8/EMBER2024-capa huggingface dataset:
Function at 0xaa29a3
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 3]
jnp 0xaa29c6
mov byte [esp + 4], ch
mov dword [esp], edi
jmp 0xaa2ec1
mov byte [esp + 2], ah
push word [esp]
push dx
jmp 0xaa29dd

Function at 0xaa29f1
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 1]
lea esp, [esp + 3]
mov dword [esp], eax
push edx
mov word [esp + 1], bp
push dword [esp]
jo 0xaa2966
jno 0xaa2950
pop dword [esp + 1]
lea esp, [esp + 2]
mov dword [esp + 0x24], esp
pushfd
mov dword [esp], ecx
jmp 0xaa2a52
lea esp, [esp + 2]
lea esp, [esp + 2]
mov dword [esp + 0x20], ebp
push ax
mov word [esp], dx
call fcn.00aa2a2e
call fcn.00aa2c5e

Function at 0xaa2b6d
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0a93e70
jmp 0xaa2abe
seto cl
cpuid
sub esp, 0xf
ja 0xaa2af7
lea esp, [esp + 3]
jmp 0xaa2b34
pushfd
jmp 0xaa298b
lea esp, [esp + 3]
jmp 0xaa2b34
jmp 0xaa2ae1
mov cl, 0x40
call 0xaa2b48
mov ebx, dword [esp]
jmp 0xaa2af9
lea ebp, [esp + 0xc]
bswap edx
and cx, 0xd4a8
jl 0xaa2b7a
rdtsc
not cx
jmp 0xaa2c04
mov edi, dword [esp + 0x38]
neg ecx
jl 0xaa2b0f
mov ebx, dword [esp]
mov cl, 0x40
jmp 0xaa2b14
mov dword [esp + 0x3c], edi
lea esp, [esp + 0x3c]
jmp 0xaa2adb
jmp 0xaa2b98
rdtsc
not cx
jmp 0xaa2c04
inc cx
jl 0xaa2bc7
jge 0xaa2bc7
lea ecx, [ebp*4]
lea eax, [esp + ebp]
mov edx, 0xe9585cdd
jmp 0xaa2c2c
sub esp, 0xb4
mov esi, esp
lea edx, [ecx + ebx]
rdtsc
jmp 0xaa2bdd
jmp 0xaa2c42
mov edx, dword [esp]
lea ecx, reloc.KERNEL32.dll_LockFile
jmp 0xaa2c4d
mov dl, byte [esp]
mov cl, ch
mov eax, ebp
rol edi, 0
jo 0xaa2c13
not ecx
jmp 0xaa2c15
not ecx
mov edx, dword [esp]
lea ecx, reloc.KERNEL32.dll_LockFile
call fcn.00aa2c74

Function at 0xaa2c5e
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
lea esp, [esp + 2]
xchg dword [esp], edi
lea edi, [edi + 1]
xchg dword [esp], edi
call fcn.00aa2a6e

Function at 0xaa2c74
Capabilities:
Execute anti-debugging instructions

Disassembly:
push eax
lea ecx, [eax + ebx]
lea esp, [esp]
jmp 0xaa2cad
mov byte [esp + 5], ah
lea esp, [esp + 8]
neg edi
xchg cx, ax
mov cx, di
jmp 0xaa2c97

Function at 0xb7e041
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp + 8], ecx
cmc
xchg bp, ax
jmp 0xb7e06b
mov cx, word [esp + 0x14]
mov ebp, 0x51f54404
setg bh
bsr ax, cx
mov dword [esp + 0xa], ebx
jmp 0xb7e09f
pop esi
mov dword [esp + 2], eax
xchg bp, bx
mov ebp, 0xeab3d72b
xchg dx, di
lea ecx, [esp + ebp]
jmp 0xb7e123
mov ebx, dword [esp + 8]
rdtsc
push dword [esp + 0xc]
mov dword [esp + 2], ebp
call fcn.00b7e133
dec ecx
call 0x94774731
aad 0x58
mov di, 0xd593
pop eax
clc
mov esi, edx
rdtsc
mov ah, byte [esp + 3]
jmp 0xb7e10d
Function at 0xb84753
Capabilities:
Execute anti-debugging instructions

Disassembly:
not cx
xchg cx, ax
mov byte [esp + 6], dh
xchg dword [esp], eax
xchg word [esp], ax
bsr cx, si
jmp 0xb84776
pop dword [esp + 3]
jmp 0xb84730
cld
mov ah, 0x98
pop si
not cl
mov esi, ecx
mov byte [esp + 3], cl
jmp 0xb847a5
neg ax
lea eax, [edi*4]
sub esp, 6
dec cx
mov dword [esp + 7], edx
mov eax, dword [esp + 0xe]
jmp 0xb84759
mov ah, 0xf9
lea ecx, [edx*4]
pop esi
mov ch, bl
xchg si, ax
jmp 0xb847d7
setae cl
mov ecx, dword [esp + 1]
mov eax, 0x5f111f06
mov cx, word [esp]
jmp 0xb8478f
xchg cx, ax
setg ch
push word [esp + 5]
xchg cl, al
mov cx, word [esp + 0xa]
xchg word [esp + 5], cx
jmp 0xb847c1

Function at 0xb848b4
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 1]
lea esp, [esp + 3]
jmp 0xb84902
push ecx
call fcn.00b848ec

Function at 0xb848e3
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [esp + 0x24]
lea esp, [esp + 0x28]
popfd
lea esp, [esp + 4]
jmp 0xb848ca
setg al
dec al
lea eax, [ebx + esi]
sub esp, 0x11
cmc
lea esp, [esp + 1]
jmp 0xb84882
mov ebx, gs
xchg ecx, eax
out dx, eax
mul cl
and byte [ebx - 0x66], ah
push ebx
mov word [esp + 1], di
mov dword [esp], eax
call fcn.00b848b4
in al, dx
jne 0xb848c0
invalid
lea eax, [ecx + esi]
mov ecx, dword [esp + 0x10]
jmp 0xb848a2

Function at 0xb848ec
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 2]
mov dword [esp + 4], edx
push edx
push dword [esp]
push dword [esp]
jmp 0xb8491e
mov dword [esp + 0xc], ebx
call fcn.00b84908

Function at 0xb84908
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 2], dl
push word [esp]
lea esp, [esp + 2]
push dword [esp]
jmp 0xb84927
mov dword [esp + 0x10], esp
push dx
call 0xb84933
lds esp, [esi - 0x71]
add al, 0x24
add byte [eax], al
add ch, al
pop word [esp]
call fcn.00b84992
outsb dx, byte [esi]
mul byte [ebx + eax - 2]
dec ecx
jl 0xb8492f
jnp 0xb84964
in eax, dx
insb byte es:[edi], dx
mov ds, word [ecx]
mov ax, word [esp]
xchg cx, ax
not ax
mov cl, dh
call fcn.00b848e3

Function at 0xb84933
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 2], dl
push word [esp]
lea esp, [esp + 2]
push dword [esp]
jmp 0xb84927
mov dword [esp + 0x10], esp
push dx
call 0xb84933
lds esp, [esi - 0x71]
add al, 0x24
add byte [eax], al
add ch, al
pop word [esp]
call fcn.00b84992
outsb dx, byte [esi]
mul byte [ebx + eax - 2]
dec ecx
jl 0xb8492f
jnp 0xb84964
in eax, dx
insb byte es:[edi], dx
mov ds, word [ecx]
mov ax, word [esp]
xchg cx, ax
not ax
mov cl, dh
call fcn.00b848e3

Function at 0xb8495b
Capabilities:
Access peb ldr_data
Execute anti-debugging instructions

Disassembly:
call fcn.00b8405e
pushal
mov dword [esp + 0x34], edi
lea esp, [esp + 0x34]
jmp 0xb849b4
mov eax, dword [eax]
jmp 0xb84a15
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0xb8499e
mov eax, dword [eax + 8]
push eax
jmp 0xb84059
Function at 0x405e3d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422ac4], 0
push esi
jne 0x405e74
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405e4e
mov dword [ecx*4 + 0x422ac0], eax
inc ecx
cmp ecx, 0x100
jl 0x405e49
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405ea5
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422ac0]
xor eax, esi
inc ecx
dec edx
jne 0x405e87
pop edi
not eax
pop esi
ret 0xc

Function at 0x4073a3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, 0x401000
call 0x4073a3
lcall 0x5de5, 0x8b10c483
jmp loc.007f72f0
Function at 0x401000
Capabilities:
Set current directory

Disassembly:
sub esp, 0x310
mov eax, dword [0x44618c]
mov dword [esp + 0x30c], eax
push 0x104
lea eax, [esp + 4]
push eax
push 0
mov byte [esp + 0xc], 0
mov byte [esp + 0x214], 0
mov byte [esp + 0x110], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov al, byte [esp]
test al, al
je 0x4010d1
push 0
push 0
lea ecx, [esp + 0x10c]
push ecx
lea edx, [esp + 0x214]
push edx
lea eax, [esp + 0x10]
push eax
call fcn.0040d7c7
mov al, byte [esp + 0x118]
add esp, 0x14
test al, al
lea ecx, [esp + 0x104]
jne 0x40107c
mov ecx, 0x4376b1
mov al, byte [esp + 0x208]
test al, al
lea eax, [esp + 0x208]
jne 0x401093
mov eax, 0x4376b1
push ecx
push eax
lea ecx, [esp + 8]
push str._s_s
push ecx
call fcn.0040d76f
mov al, byte [esp + 0x10]
add esp, 0x10
test al, al
je 0x4010d1
lea edx, [esp]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
setne al
mov ecx, dword [esp + 0x30c]
call fcn.0040d940
add esp, 0x310
ret
mov ecx, dword [esp + 0x30c]
xor al, al
call fcn.0040d940
add esp, 0x310
ret

Function at 0x401fe0
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [esp + 0x110]
mov ecx, dword [eax]
mov edx, dword [esp + 0x114]
lea eax, [esp]
push eax
push 0
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
mov dword [esp + 0x1c], 1
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], 0
call dword [sym.imp.WS2_32.dll_select]
xor edx, edx
test eax, eax
setg dl
mov al, dl
add esp, 0x10c
ret 8

Function at 0x402040
Capabilities:
Set socket configuration

Disassembly:
push ecx
mov ecx, dword [esp + 8]
mov edx, dword [ecx]
lea eax, [esp]
push eax
push 0x8004667e
push edx
mov dword [esp + 0xc], 0
call dword [sym.imp.WS2_32.dll_ioctlsocket]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
pop ecx
ret 4

Function at 0x402070
Capabilities:
Connect socket

Disassembly:
sub esp, 0x14
mov eax, dword [0x44618c]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x20]
push ecx
mov word [esp + 4], 2
mov dword [esp + 8], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 2], ax
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
push 0x10
lea edx, [esp + 4]
push edx
push ecx
call dword [sym.imp.WS2_32.dll_connect]
mov ecx, dword [esp + 0x10]
xor edx, edx
cmp eax, 0xffffffff
setne dl
mov al, dl
call fcn.0040d940
add esp, 0x14
ret 0xc

Function at 0x4020d0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
xor esi, esi
test edi, edi
jle 0x402125
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
push 0
mov eax, edi
sub eax, esi
push eax
lea ecx, [esi + ebx]
push ecx
push ebp
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jge 0x402113
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2747
jne 0x40212e
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x402121
jne 0x40211f
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x402121
add esi, eax
cmp esi, edi
jl 0x4020e6
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret 0xc
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0xc
Function at 0x402140
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x1c
push esi
mov esi, dword [esp + 0x24]
push 4
lea eax, [esp + 8]
push eax
push 8
push 0xffff
push esi
mov dword [esp + 0x18], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x402172
xor al, al
pop esi
add esp, 0x1c
ret 8
xor eax, eax
push eax
push eax
xor edx, edx
mov dword [esp + 0x20], edx
xor ecx, ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x24], edx
lea edx, [esp + 0x2c]
push edx
push 0xc
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x24], eax
mov dword [esp + 0x34], eax
lea eax, [esp + 0x24]
push eax
push 0xc
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x20]
push ecx
push 0x98000004
push esi
mov dword [esp + 0x2c], 1
mov dword [esp + 0x34], 1
call dword [sym.imp.WS2_32.dll_WSAIoctl]
cmp eax, 0xffffffff
setne al
pop esi
add esp, 0x1c
ret 8

Function at 0x4021e0
Capabilities:
Check for time delay via gettickcount
Get socket status

Disassembly:
sub esp, 0x110
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [esp + 0x120]
mov ebp, dword [sym.imp.WS2_32.dll_select]
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 2
lea edi, [esi + 1]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0
mov edx, ecx
push edx
push edi
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], 1
call ebp
test eax, eax
jg 0x40226e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x402260
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x124]
sub eax, edx
cmp eax, ecx
jae 0x402260
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x402213
pop edi
pop esi
xor al, al
pop ebp
add esp, 0x110
ret 8
pop edi
pop esi
mov al, 1
pop ebp
add esp, 0x110
ret 8

Function at 0x4022b0
Capabilities:
Create tcp socket
Initialize winsock library
Set socket configuration

Disassembly:
sub esp, 0x198
mov eax, dword [0x44618c]
push edi
mov dword [esp + 0x198], eax
lea eax, [esp + 8]
push eax
push 0x202
mov edi, ecx
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x4022f1
xor al, al
pop edi
mov ecx, dword [esp + 0x194]
call fcn.0040d940
add esp, 0x198
ret 0x18
push esi
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov esi, dword [esp + 0x1a4]
mov dword [esi], eax
jne 0x402325
pop esi
xor al, al
pop edi
mov ecx, dword [esp + 0x194]
call fcn.0040d940
add esp, 0x198
ret 0x18
lea ecx, [esp + 8]
push ecx
push 0x8004667e
push eax
mov dword [esp + 0x14], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
je 0x40230c
mov edx, dword [esp + 0x1ac]
mov eax, dword [esp + 0x1a8]
push edx
push eax
push esi
mov ecx, edi
call fcn.00402070
push 3
push esi
mov ecx, edi
call fcn.00401fe0
test al, al
je 0x40230c
push esi
mov ecx, edi
call fcn.00402040
mov ecx, dword [esi]
push 0x7d0
push ecx
mov ecx, edi
call fcn.00402140
mov ecx, dword [esp + 0x19c]
pop esi
mov al, 1
pop edi
call fcn.0040d940
add esp, 0x198
ret 0x18
Function at 0x4023a0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
xor ebx, ebx
test esi, esi
push edi
mov dword [esp + 0x10], ecx
jle 0x40240a
mov edi, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
jmp 0x4023c0
mov ecx, dword [esp + 0x10]
push 0xbb8
push edi
call fcn.004021e0
test al, al
je 0x402414
push 0
push esi
push ebp
push edi
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x402414
test eax, eax
jne 0x4023fa
cmp ebx, 0x3e8
jae 0x402414
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
jmp 0x402406
test ebx, ebx
je 0x402400
xor ebx, ebx
sub esi, eax
js 0x402414
add ebp, eax
test esi, esi
jg 0x4023c0
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
pop ecx
ret 0xc
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0xc
Function at 0x404811
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x404826
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x404838
xor eax, eax
jmp 0x40486a
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x40485c
cmp esi, eax
jae 0x404834
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x40484e
cmp esi, eax
jae 0x404834
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop ebp
ret
Function at 0x4050a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
je 0x4050f3
call fcn.00431185
mov edi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
je 0x4050f3
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x4050e9
xor eax, eax
jmp 0x40520c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], 1
je 0x405123
mov eax, dword [esi]
push edi
push dword [ebp - 4]
mov ecx, esi
push ebx
call dword [eax + 0x1c]
cmp dword [ebp - 8], 0
mov dword [ebp - 0xc], eax
je 0x405123
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x405209
mov ecx, dword [eax + 0x40]
and dword [ebp + 0xc], 0
test ecx, ecx
mov dword [ebp + 8], ecx
mov dword [ebp - 8], ecx
je 0x405150
lea ecx, [eax + 0x3c]
lea eax, [ebp + 8]
push eax
call fcn.00405b59
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
xor eax, eax
cmp dword [edi + 8], eax
mov dword [ebp - 4], eax
jbe 0x405209
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x405199
mov ecx, dword [ecx + 4]
mov edx, dword [edi + 0xc]
mov ecx, dword [ecx + 0x28]
cmp ecx, dword [edx + eax*8]
jne 0x405199
mov eax, dword [ebp + 8]
test eax, eax
mov dword [ebp - 8], eax
je 0x405193
mov ecx, dword [ebx + 0x48]
lea eax, [ebp + 8]
add ecx, 0x3c
push eax
call fcn.00405b59
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
jmp 0x4051f9
and dword [ebp + 0xc], 0
jmp 0x4051f9
mov ecx, dword [edi + 0xc]
shl eax, 3
cmp dword [eax + ecx], 0
mov dword [ebp - 0x10], eax
je 0x4051f9
push 0xc
call fcn.00424a3d
mov esi, eax
test esi, esi
pop ecx
je 0x4051db
mov eax, dword [edi + 0xc]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebx + 0x1c]
add eax, edx
push dword [eax]
mov edi, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
and dword [esi + 4], 0
mov dword [esi + 8], edi
mov edi, dword [ebp + 0x10]
mov dword [esi], eax
jmp 0x4051dd
xor esi, esi
mov ecx, dword [ebx + 0x48]
add ecx, 0x3c
cmp dword [ebp - 8], 0
push esi
je 0x4051f4
push dword [ebp - 8]
call fcn.00424510
jmp 0x4051f9
call fcn.004244e7
mov eax, dword [ebp - 4]
inc eax
cmp eax, dword [edi + 8]
mov dword [ebp - 4], eax
jb 0x40515e
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x40e2fe
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.0040e4f0
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40e399
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x449218]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x40e399
cmp eax, 1
je 0x40e3ba
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40e399
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x40e366
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x40e395
xor eax, eax
inc eax
jmp 0x40e3d9
cmp edi, eax
jae 0x40e39d
xor eax, eax
jmp 0x40e3d9
cmp eax, esi
jae 0x40e3a4
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x449218]
jmp 0x40e3bd
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40e6ff
Capabilities:
Terminate process

Disassembly:
push 8
push 0x43ad98
call fcn.0040f3c4
push 8
call fcn.004121b9
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x449258], esi
jne 0x40e733
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x449254], esi
mov al, byte [ebp + 0x10]
mov byte [0x449250], al
cmp dword [ebp + 0xc], edi
jne 0x40e77d
cmp dword [0x44ad4c], edi
je 0x40e76d
mov eax, dword [0x44ad48]
sub eax, 4
mov dword [0x44ad48], eax
cmp eax, dword [0x44ad4c]
jb 0x40e76d
mov eax, dword [eax]
cmp eax, edi
je 0x40e74e
call eax
jmp 0x40e74e
push 0x4450b0
mov eax, 0x4450a8
call fcn.0040e67d
pop ecx
push 0x4450bc
mov eax, 0x4450b4
call fcn.0040e67d
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x40e7ae
cmp dword [ebp + 0x10], edi
jne 0x40e7bc
mov dword [0x449258], esi
push dword [ebp + 8]
call fcn.0040e63b
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x40e7bb
push 8
call fcn.00412104
pop ecx
ret
call fcn.0040f3ff
ret
Function at 0x40e966
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x43ada8
call fcn.0040f3c4
mov edi, 0x94
mov eax, edi
call fcn.0040e4f0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x449218], ecx
mov eax, dword [esi + 4]
mov dword [0x449224], eax
mov edx, dword [esi + 8]
mov dword [0x449228], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x44921c], esi
cmp ecx, 2
je 0x40e9c6
or esi, 0x8000
mov dword [0x44921c], esi
shl eax, 8
add eax, edx
mov dword [0x449220], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x40ea01
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40ea01
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x40ea19
cmp eax, 0x20b
je 0x40ea06
mov dword [ebp - 0x1c], esi
jmp 0x40ea2d
cmp dword [ecx + 0x84], 0xe
jbe 0x40ea01
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x40ea27
cmp dword [ecx + 0x74], 0xe
jbe 0x40ea01
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.00412204
pop ecx
test eax, eax
jne 0x40ea41
push 0x1c
call fcn.0040e942
pop ecx
call fcn.00411ded
test eax, eax
jne 0x40ea52
push 0x10
call fcn.0040e942
pop ecx
call fcn.00412fbc
mov dword [ebp - 4], esi
call fcn.00413840
test eax, eax
jge 0x40ea6b
push 0x1b
call fcn.0040e91d
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x44ad40], eax
call fcn.0041371e
mov dword [0x44925c], eax
call fcn.0041367c
test eax, eax
jge 0x40ea91
push 8
call fcn.0040e91d
pop ecx
call fcn.00413449
test eax, eax
jge 0x40eaa2
push 9
call fcn.0040e91d
pop ecx
push 1
call fcn.0040e695
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x40eab8
push eax
call fcn.0040e91d
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.004133ec
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x40ead9
movzx eax, word [ebp - 0x40]
jmp 0x40eadc
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.00423cc2
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x40eafa
push edi
call fcn.0040e7c2
call fcn.0040e7e4
jmp 0x40eb2c
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.0040f3ff
ret