joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb4d1b5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ebx
mov ecx, dword [ebp - 0x20]
mov esi, ecx
mov ecx, dword [ebp - 0x14]
lea ebx, [ecx + 1]
mov dword [ebp - 0x14], ebx
mov ebx, esi
or ebx, 0xffffff80
mov byte [ecx], bl
mov ecx, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
mov esi, ecx
mov edi, ebx
shrd esi, edi, 7
shr edi, 7
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], edi
mov ecx, dword [ebp - 0x20]
xor ch, 0
mov eax, ecx
mov ecx, dword [ebp - 0x1c]
xor ch, 0
mov edx, ecx
mov ecx, edx
or ecx, eax
test ecx, ecx
jne 0xb4d1dc
mov eax, dword [ebp - 0x14]
sub eax, 1
movzx edx, byte [eax]
mov eax, dword [ebp - 0x14]
sub eax, 1
and edx, 0x7f
mov byte [eax], dl
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
sub edx, eax
mov eax, edx
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0xb4d62f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], 0
add dword [ebp - 0x14], 1
mov ecx, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x24]
mov esi, ecx
mov edi, ebx
shrd esi, edi, 7
shr edi, 7
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], edi
mov ecx, dword [ebp - 0x28]
xor ch, 0
mov eax, ecx
mov ecx, dword [ebp - 0x24]
xor ch, 0
mov edx, ecx
mov ecx, edx
or ecx, eax
test ecx, ecx
jne 0xb4d64b
mov eax, dword [ebp - 0x14]
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0xb682cb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0x7f
jg 0xb682ff
cmp dword [ebp + 8], 0x40
jle 0xb68420
cmp dword [ebp + 8], 0x5a
jg 0xb68420
mov eax, dword [ebp + 8]
add eax, 0x20
mov dword [ebp - 4], eax
jmp 0xb68420
cmp dword [ebp + 8], 0xffff
jg 0xb68405
mov dword [ebp - 8], 0xa2
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0xffffffff
jmp 0xb6836f
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, edx
mov edx, eax
shr edx, 0x1f
add eax, edx
sar eax, 1
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, word [eax*4 + 0x1435920]
movzx eax, ax
mov edx, dword [ebp + 8]
sub edx, eax
mov eax, edx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
js 0xb68366
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0xc], eax
jmp 0xb6836f
mov eax, dword [ebp - 0x18]
sub eax, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
jge 0xb68323
mov eax, dword [ebp - 0x10]
shl eax, 2
add eax, 0x1435920
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, word [eax]
movzx edx, ax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax + 3]
movzx eax, al
add eax, edx
cmp dword [ebp + 8], eax
jge 0xb683e4
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax + 2]
movzx eax, al
and eax, 1
mov edx, eax
mov eax, dword [ebp - 0x14]
movzx eax, word [eax]
movzx eax, ax
xor eax, dword [ebp + 8]
and eax, edx
test eax, eax
jne 0xb683e4
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax + 2]
shr al, 1
movzx eax, al
movzx eax, word [eax + eax + 0x1435bc0]
movzx edx, ax
mov eax, dword [ebp + 8]
add eax, edx
and eax, 0xffff
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0
je 0xb68420
cmp dword [ebp + 0xc], 2
sete al
movzx eax, al
push eax
push dword [ebp - 4]
call fcn.00b68134
add esp, 8
mov dword [ebp - 4], eax
jmp 0xb68420
cmp dword [ebp + 8], 0x103ff
jle 0xb68420
cmp dword [ebp + 8], 0x10427
jg 0xb68420
mov eax, dword [ebp + 8]
add eax, 0x28
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
leave
ret
Function at 0xb6e2fb
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x20
mov dword [ebp - 0x1c], str.SELECT_stat_FROM__Q.sqlite_stat1_WHERE_tbl___q_rowid
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x20]
sub esp, 0xc
push 0
push 0
push 0
push 0
push 0
push 0
push str.sqlite_stat1
push eax
push dword [ebp + 8]
call fcn.00b4c294
add esp, 0x30
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0xb6e370
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x30], 0x100000
mov dword [eax + 0x34], 0
cmp dword [ebp - 0xc], 1
je 0xb6e366
mov eax, dword [ebp - 0xc]
jmp 0xb6e477
mov eax, 0
jmp 0xb6e477
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 0x24]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x20]
sub esp, 4
push edx
push eax
push dword [ebp - 0x1c]
call fcn.00aad7cd
add esp, 0x10
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0xb6e3a1
mov dword [ebp - 0xc], 7
jmp 0xb6e474
sub esp, 0xc
push 0
lea eax, [ebp - 0x24]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x20]
push dword [ebp + 8]
call fcn.00b1b3b8
add esp, 0x20
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0xb6e402
mov eax, dword [ebp - 0x24]
sub esp, 0xc
push eax
call fcn.00adce85
add esp, 0x10
cmp eax, 0x64
jne 0xb6e3ee
mov eax, dword [ebp - 0x24]
sub esp, 8
push 0
push eax
call fcn.00add4f9
add esp, 0x10
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x24]
sub esp, 0xc
push eax
call fcn.00adc0c0
add esp, 0x10
mov dword [ebp - 0xc], eax
jmp 0xb6e40f
cmp dword [ebp - 0xc], 7
je 0xb6e40f
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 0
jne 0xb6e466
mov eax, dword [ebp - 0x18]
xor ah, 0
mov ebx, eax
mov eax, dword [ebp - 0x14]
xor ah, 0
mov esi, eax
mov eax, esi
or eax, ebx
test eax, eax
jne 0xb6e440
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x30], 0x100000
mov dword [eax + 0x34], 0
jmp 0xb6e466
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
test edx, edx
jg 0xb6e45d
test edx, edx
js 0xb6e453
cmp eax, 0x64
jae 0xb6e45d
mov eax, 0x64
mov edx, 0
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 0x30], eax
mov dword [ecx + 0x34], edx
sub esp, 0xc
push dword [ebp - 0x20]
call fcn.00aaa980
add esp, 0x10
mov eax, dword [ebp - 0xc]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0xb6e8b4
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ebp + 0x10], 0
je 0xb6e973
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x20]
sub esp, 8
push eax
push str.PRAGMA__Q.page_size
call fcn.00aad7cd
add esp, 0x10
mov dword [ebp - 0x10], eax
sub esp, 4
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.00b6e835
add esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0xb6e948
mov eax, dword [ebp - 0x14]
lea edx, [eax - 0x40]
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x10], edx
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax + 0x17]
movzx eax, al
imul eax, eax, 0x33
lea edx, [eax + 4]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x10]
cmp edx, eax
jge 0xb6ea0f
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax + 0x17]
movzx eax, al
imul eax, eax, 0x33
lea edx, [eax + 4]
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x10], edx
jmp 0xb6ea0f
sub esp, 0xc
push dword [ebp + 8]
call fcn.00b4ad2c
add esp, 0x10
sub esp, 8
push eax
push 0x142720c
call fcn.00aad7cd
add esp, 0x10
mov edx, eax
mov eax, dword [ebp + 0x14]
mov dword [eax], edx
jmp 0xb6ea0f
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 0x24]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x20]
sub esp, 4
push edx
push eax
push str.SELECT_length_data__FROM__q._q_node_WHERE_nodeno__1
call fcn.00aad7cd
add esp, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
add eax, 0x10
sub esp, 4
push eax
push dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.00b6e835
add esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0xb6e9dd
sub esp, 0xc
push dword [ebp + 8]
call fcn.00b4ad2c
add esp, 0x10
sub esp, 8
push eax
push 0x142720c
call fcn.00aad7cd
add esp, 0x10
mov edx, eax
mov eax, dword [ebp + 0x14]
mov dword [eax], edx
jmp 0xb6ea0f
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x10]
cmp eax, 0x1bf
jg 0xb6ea0f
mov dword [ebp - 0xc], 0x10b
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x24]
sub esp, 8
push eax
push str.undersize_RTree_blobs_in___q_node_
call fcn.00aad7cd
add esp, 0x10
mov edx, eax
mov eax, dword [ebp + 0x14]
mov dword [eax], edx
sub esp, 0xc
push dword [ebp - 0x10]
call fcn.00aaa980
add esp, 0x10
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0xb6f2d1
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x28]
test eax, eax
jne 0xb6f324
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
test eax, eax
jne 0xb6f324
mov eax, dword [ebp + 8]
mov edx, dword [eax + 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
push edx
push eax
push str.SELECT_data_FROM__Q._q_node_WHERE_nodeno_
push dword [ebp + 8]
call fcn.00b6f1aa
add esp, 0x10
mov edx, eax
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], edx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x28]
test eax, eax
jne 0xb6f40c
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push 1
push eax
call fcn.00addb20
add esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
sub esp, 0xc
push eax
call fcn.00adce85
add esp, 0x10
cmp eax, 0x64
jne 0xb6f3d1
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
sub esp, 8
push 0
push eax
call fcn.00add415
add esp, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
sub esp, 8
push 0
push eax
call fcn.00add3dc
add esp, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
cdq
sub esp, 8
push edx
push eax
call fcn.00aaa842
add esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0xb6f3b4
mov eax, dword [ebp + 8]
mov dword [eax + 0x28], 7
jmp 0xb6f3d1
mov eax, dword [ebp - 0x10]
sub esp, 4
push eax
push dword [ebp - 0x14]
push dword [ebp - 0xc]
call sub.msvcrt.dll_memcpy
add esp, 0x10
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 0x10]
mov dword [eax], edx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
sub esp, 8
push eax
push dword [ebp + 8]
call fcn.00b6f17d
add esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x28]
test eax, eax
jne 0xb6f40c
cmp dword [ebp - 0xc], 0
jne 0xb6f40c
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push str.Node__lld_missing_from_database
push dword [ebp + 8]
call fcn.00b6f225
add esp, 0x10
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0xb6f411
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x30
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x20], str.SELECT_parentnode_FROM__Q._q_parent_WHERE_nodeno_1
mov dword [ebp - 0x1c], str.SELECT_nodeno_FROM__Q._q_rowid_WHERE_rowid_1
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
add edx, 4
mov eax, dword [eax + edx*4 + 8]
test eax, eax
jne 0xb6f480
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + eax*4 - 0x20]
push ecx
push edx
push eax
push dword [ebp + 8]
call fcn.00b6f1aa
add esp, 0x10
mov ecx, eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
add edx, 4
mov dword [eax + edx*4 + 8], ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x28]
test eax, eax
jne 0xb6f585
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
add edx, 4
mov eax, dword [eax + edx*4 + 8]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push 1
push dword [ebp - 0xc]
call fcn.00addb20
add esp, 0x10
sub esp, 0xc
push dword [ebp - 0xc]
call fcn.00adce85
add esp, 0x10
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x65
jne 0xb6f4fc
cmp dword [ebp + 0xc], 0
je 0xb6f4d5
mov eax, str.__rowid
jmp 0xb6f4da
mov eax, str.__parent
sub esp, 4
push eax
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push str.Mapping___lld_____lld__missing_from__s_table
push dword [ebp + 8]
call fcn.00b6f225
add esp, 0x20
jmp 0xb6f572
cmp dword [ebp - 0x10], 0x64
jne 0xb6f572
sub esp, 8
push 0
push dword [ebp - 0xc]
call fcn.00add4f9
add esp, 0x10
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov ecx, eax
xor ecx, dword [ebp - 0x38]
mov ebx, ecx
mov eax, edx
xor eax, dword [ebp - 0x34]
mov esi, eax
mov eax, esi
or eax, ebx
test eax, eax
je 0xb6f572
cmp dword [ebp + 0xc], 0
je 0xb6f541
mov eax, str.__rowid
jmp 0xb6f546
mov eax, str.__parent
sub esp, 4
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push str.Found___lld_____lld__in__s_table__expected___lld_____lld_
push dword [ebp + 8]
call fcn.00b6f225
add esp, 0x30
sub esp, 8
push dword [ebp - 0xc]
push dword [ebp + 8]
call fcn.00b6f17d
add esp, 0x10
jmp 0xb6f586
nop
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0xb700e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateEventA]
call eax
sub esp, 0x10
mov dword [0x14519a0], eax
mov eax, dword [0x14519a0]
test eax, eax
jne 0xb7014a
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x3d
mov dword [esp + 4], 1
mov dword [esp], str.runtime:_failed_to_create_runtime_initialization_wait_event._n
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
mov dword [esp], 0x1451988
mov eax, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call eax
sub esp, 4
nop
leave
ret

Function at 0xb70472
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0xb704cc
mov eax, dword [sym.imp.msvcrt.dll__beginthread]
call eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0xb704c9
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov edx, dword [sym.imp.msvcrt.dll__iob]
add edx, 0x40
mov dword [esp + 8], eax
mov dword [esp + 4], str.runtime:_failed_to_create_new_OS_thread___d__n
mov dword [esp], edx
call sub.msvcrt.dll_fprintf
call sub.msvcrt.dll_abort
nop
leave
ret

Function at 0xb70a00
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.00b70a60
Function at 0xb70a60
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x1451d20]
test esi, esi
jle 0xb70b64
mov edi, dword [0x1451d24]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0xb70a94
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0xb70b15
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0xb70a80
mov dword [esp], eax
mov ebx, eax
call fcn.00b713b0
test eax, eax
mov edi, eax
je 0xb70b8b
mov eax, dword [0x1451d24]
lea ebx, [esi + esi*2]
shl ebx, 2
add eax, ebx
mov dword [eax + 8], edi
mov dword [eax], 0
call fcn.00b714b0
add eax, dword [edi + 0xc]
mov edx, dword [0x1451d24]
mov dword [edx + ebx + 4], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0xb70b6b
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0xb70b0e
sub eax, 0x40
and eax, 0xffffffbf
jne 0xb70b20
add dword [0x1451d20], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
mov eax, dword [esp + 0x20]
add ebx, dword [0x1451d24]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0xb70b0e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00b70a00
xor esi, esi
jmp 0xb70a9e
mov eax, dword [0x1451d24]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00b70a00
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00b70a00
nop
lea esi, [esi]

Function at 0xb71030
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x1451d38
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x1451d30]
sub esp, 4
test ebx, ebx
je 0xb71085
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0xb7107e
test esi, esi
je 0xb7107e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0xb71060
mov dword [esp], 0x1451d38
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x406025
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x42b040]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0
push 0xf
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
mov dword [ebp - 0x12c], 0x128
lea eax, [ebp - 0x12c]
push eax
push edi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x4060c9
push esi
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x108]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x406089
test dl, dl
je 0x406085
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x406089
add eax, 2
add ecx, 2
test dl, dl
jne 0x406069
xor eax, eax
jmp 0x40608e
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4060b7
push dword [ebp - 0x124]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4060b7
push 9
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x12c]
push eax
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x406060
pop esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00406861
leave
ret

Function at 0x406763
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
jne 0x40679c
push 0x403685
push str.Error:_Could_not_hide_console_window
push 0x42d060
call fcn.004031af
pop ecx
pop ecx
mov ecx, eax
call fcn.00403d89
xor eax, eax
inc eax
leave
ret
push esi
push 0xa
lea eax, [ebp - 4]
push eax
push str.6666
call fcn.0040dbcf
mov ecx, dword [ebp - 4]
add esp, 0xc
mov esi, eax
cmp byte [ecx], 0
jne 0x4067e9
call fcn.0040d1c8
cmp dword [eax], 0x22
je 0x4067e9
cmp esi, 0xffff
ja 0x4067dd
push esi
push str.127.0.0.1
call fcn.004066e5
pop ecx
pop ecx
xor eax, eax
jmp 0x406809
push 0x403685
push str.Error:_Port_number_out_of_range
jmp 0x4067f3
push 0x403685
push str.Error:_Invalid_port_number
push 0x42d060
call fcn.004031af
pop ecx
pop ecx
mov ecx, eax
call fcn.00403d89
xor eax, eax
inc eax
pop esi
leave
ret

Function at 0x407260
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40729f
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40729f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40729f
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40729f
cmp dword [ecx + 0x74], 0xe
jbe 0x40729f
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x408db1
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x408dd2
jl 0x408dc9
test edi, edi
jne 0x408dd2
xor eax, eax
xor edx, edx
jmp 0x408e93
cmp dword [ebx + 0x38], 0
je 0x408de7
push eax
push edi
push dword [ebp + 8]
call fcn.00408e99
jmp 0x408e93
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x408e2e
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x408e2e
cmp eax, edi
jb 0x408e08
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.00409a40
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x408e34
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x408e88
mov ecx, ebx
call fcn.0040860f
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x408e73
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.004119cf
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x408e88
jmp 0x408e46
test edx, edx
je 0x408e88
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.004119cf
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc
Function at 0x4147ab
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x414848
push ebx
push esi
call fcn.00414774
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00414708
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4147f5
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x414847
push edi
push eax
call fcn.004133b7
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x414815
call fcn.0041318d
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x414846
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00414708
add esp, 0x20
test eax, eax
jne 0x414834
push edi
call fcn.0041318d
jmp 0x41483c
push ebx
call fcn.0041318d
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x417168
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.00412ea0
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4171d7
cmp esi, dword [ebp - 4]
je 0x4171d2
cmp dword [ebp + 0xc], 0
je 0x4171d2
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4171af
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.00416cba
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x4171d9
xor eax, eax
inc eax
jmp 0x4171d9
xor eax, eax
pop edi
pop esi
leave
ret