joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420e5c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push ebp
mov esi, ecx
mov ebp, dword [esp + 0xc]
mov eax, dword [ebp]
lea ecx, [esi + 0x50]
mov dword [esi], eax
mov edx, dword [ebp + 4]
mov dword [esi + 4], edx
mov eax, dword [ebp + 8]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [esi + 0x18], eax
movzx eax, word [ebp + 0x1c]
mov word [esi + 0x1c], ax
mov eax, dword [ebp + 0x20]
mov dword [esi + 0x20], eax
mov al, byte [ebp + 0x24]
mov byte [esi + 0x24], al
mov eax, dword [ebp + 0x28]
mov dword [esi + 0x28], eax
mov eax, dword [ebp + 0x2c]
mov dword [esi + 0x2c], eax
mov eax, dword [ebp + 0x30]
mov dword [esi + 0x30], eax
mov eax, dword [ebp + 0x34]
mov dword [esi + 0x34], eax
mov eax, dword [ebp + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [ebp + 0x3c]
mov dword [esi + 0x3c], eax
mov eax, dword [ebp + 0x40]
mov dword [esi + 0x40], eax
mov eax, dword [ebp + 0x44]
mov dword [esi + 0x44], eax
mov eax, dword [ebp + 0x48]
mov dword [esi + 0x48], eax
mov eax, dword [ebp + 0x4c]
mov dword [esi + 0x4c], eax
lea eax, [ebp + 0x50]
push eax
call fcn.004224b4
mov eax, dword [ebp + 0x68]
lea ecx, [esi + 0x78]
mov dword [esi + 0x68], eax
mov edx, dword [ebp + 0x6c]
mov dword [esi + 0x6c], edx
mov eax, dword [ebp + 0x70]
mov dword [esi + 0x70], eax
mov eax, dword [ebp + 0x74]
mov dword [esi + 0x74], eax
lea eax, [ebp + 0x78]
push eax
call fcn.004224b4
mov edx, dword [ebp + 0x90]
mov dword [esi + 0x90], edx
mov eax, dword [ebp + 0x94]
mov dword [esi + 0x94], eax
mov eax, dword [ebp + 0x98]
mov dword [esi + 0x98], eax
mov eax, dword [ebp + 0x9c]
mov dword [esi + 0x9c], eax
mov eax, dword [ebp + 0xa0]
mov dword [esi + 0xa0], eax
mov eax, dword [ebp + 0xa4]
mov dword [esi + 0xa4], eax
mov eax, dword [ebp + 0xa8]
mov dword [esi + 0xa8], eax
mov eax, dword [ebp + 0xac]
mov dword [esi + 0xac], eax
mov eax, dword [ebp + 0xb0]
mov dword [esi + 0xb0], eax
mov eax, dword [ebp + 0xb4]
mov dword [esi + 0xb4], eax
mov eax, dword [ebp + 0xb8]
mov dword [esi + 0xb8], eax
mov eax, dword [ebp + 0xbc]
mov dword [esi + 0xbc], eax
mov eax, dword [ebp + 0xc0]
mov dword [esi + 0xc0], eax
mov al, byte [ebp + 0xc4]
mov byte [esi + 0xc4], al
mov ebp, dword [ebp + 0xc8]
mov eax, esi
mov dword [esi + 0xc8], ebp
pop ebp
pop esi
ret 4
Function at 0x427374
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
lea edx, [esp]
mov dword [esp], 0xffffffff
lea eax, [esp + 4]
push 0
push eax
push 4
push edx
push dword [esp + 0x1c]
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
jne 0x4273af
push 4
push dword [esp + 8]
push 0x6ee480
call fcn.004403f0
xor eax, eax
add esp, 0x14
ret
mov eax, 1
add esp, 8
ret

Function at 0x4273b8
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
sub esp, 8
mov edi, ecx
mov esi, dword [esp + 0x14]
lea edx, [esp + 4]
lea eax, [esp]
push 0
push eax
push 4
push edx
push esi
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x4273ee
mov edx, dword [esp + 4]
cmp edx, 0xffffffff
jne 0x427408
xor eax, eax
add esp, 8
pop esi
pop edi
ret 4
push 4
push dword [esp + 4]
push 0x6ee4e0
call fcn.004403f0
xor eax, eax
add esp, 0x14
pop esi
pop edi
ret 4
mov eax, dword [edi]
cmp edx, eax
ja 0x427481
lea edx, [edi + 4]
lea eax, [esp]
push 0
push eax
push 4
push edx
push esi
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x42743f
push 4
push dword [esp + 4]
push 0x6ee580
call fcn.004403f0
xor eax, eax
add esp, 0x14
pop esi
pop edi
ret 4
add edi, 0xc
lea eax, [esp]
push 0
push eax
push dword [esp + 0xc]
push edi
push esi
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x427474
push dword [esp + 4]
push dword [esp + 4]
push 0x6ee5e0
call fcn.004403f0
xor eax, eax
add esp, 0x14
pop esi
pop edi
ret 4
mov eax, 1
add esp, 8
pop esi
pop edi
ret 4
push eax
push edx
push 0x6ee540
call fcn.004403f0
xor eax, eax
add esp, 0x14
pop esi
pop edi
ret 4
Function at 0x427aac
Capabilities:
Inspect section memory permissions

Disassembly:
push edi
push esi
push ebp
push ebx
mov ebx, ecx
mov esi, dword [esp + 0x14]
mov ebp, 0x1f
test esi, 0x40000000
jne 0x427e05
mov ebp, 0x1e
test esi, 0x20000000
jne 0x427dfb
mov ebp, 0x1d
test esi, 0x10000000
jne 0x427df1
mov ebp, 0x1c
test esi, 0x8000000
jne 0x427de7
mov ebp, 0x1b
test esi, 0x4000000
jne 0x427ddd
mov ebp, 0x1a
test esi, 0x2000000
jne 0x427dd3
mov ebp, 0x19
test esi, 0x1000000
jne 0x427dc9
mov ebp, 0x18
test esi, 0x800000
jne 0x427dbf
mov ebp, 0x17
test esi, 0x400000
jne 0x427db5
mov ebp, 0x16
test esi, 0x200000
jne 0x427dab
mov ebp, 0x15
test esi, 0x100000
jne 0x427da1
mov ebp, 0x14
test esi, 0x80000
jne 0x427d97
mov ebp, 0x13
test esi, 0x40000
jne 0x427d8d
mov ebp, 0x12
test esi, 0x20000
jne 0x427d83
mov ebp, 0x11
test esi, 0x10000
jne 0x427d79
mov ebp, 0x10
test esi, 0x8000
jne 0x427d6f
mov ebp, 0xf
test esi, 0x4000
jne 0x427d65
mov ebp, 0xe
test esi, 0x2000
jne 0x427d5b
mov ebp, 0xd
test esi, 0x1000
jne 0x427d51
mov ebp, 0xc
test esi, 0x800
jne 0x427d47
mov ebp, 0xb
test esi, 0x400
jne 0x427d3d
mov ebp, 0xa
test esi, 0x200
jne 0x427d33
mov ebp, 9
test esi, 0x100
jne 0x427d2c
mov ebp, 8
test esi, 0x80
jne 0x427d25
mov ebp, 7
test esi, 0x40
jne 0x427d1e
mov ebp, 6
test esi, 0x20
jne 0x427d17
mov ebp, 5
test esi, 0x10
jne 0x427d10
mov ebp, 4
test esi, 8
jne 0x427d09
mov ebp, 3
test esi, 4
jne 0x427d02
mov ebp, 2
test esi, 2
jne 0x427cfb
mov ebp, 1
mov edi, esi
and edi, 1
jne 0x427cb6
xor ebp, ebp
push 5
mov ecx, ebx
push ebp
call fcn.004292a4
test ebp, ebp
je 0x427ccd
push ebp
mov ecx, ebx
push esi
call fcn.004292a4
test edi, edi
jne 0x427ce6
push 7
mov eax, dword [esp + 0x1c]
mov ecx, ebx
push eax
call fcn.004292a4
pop ebx
pop ebp
pop esi
pop edi
ret 8
push 0xc
mov eax, dword [esp + 0x1c]
mov ecx, ebx
push eax
call fcn.004292a4
pop ebx
pop ebp
pop esi
pop edi
ret 8
mov edi, esi
and edi, 1
jmp 0x427cb6
mov edi, esi
and edi, 1
jmp 0x427cb6
mov edi, esi
and edi, 1
jmp 0x427cb6
mov edi, esi
and edi, 1
jmp 0x427cb6
mov edi, esi
and edi, 1
jmp 0x427cb6
mov edi, esi
and edi, 1
jmp 0x427cb6
mov edi, esi
and edi, 1
jmp 0x427cb6
mov edi, esi
and edi, 1
jmp 0x427cb6
mov edi, esi
and edi, 1
jmp 0x427cb6
mov edi, esi
and edi, 1
jmp 0x427cb6
mov edi, esi
and edi, 1
jmp 0x427cb6
mov edi, esi
and edi, 1
jmp 0x427cb6
mov edi, esi
and edi, 1
jmp 0x427cb6
mov edi, esi
and edi, 1
jmp 0x427cb6
mov edi, esi
and edi, 1
jmp 0x427cb6
mov edi, esi
and edi, 1
jmp 0x427cb6
mov edi, esi
and edi, 1
jmp 0x427cb6
mov edi, esi
and edi, 1
jmp 0x427cb6
mov edi, esi
and edi, 1
jmp 0x427cb6
mov edi, esi
and edi, 1
jmp 0x427cb6
mov edi, esi
and edi, 1
jmp 0x427cb6
mov edi, esi
and edi, 1
jmp 0x427cb6
mov edi, esi
and edi, 1
jmp 0x427cb6
mov edi, esi
and edi, 1
jmp 0x427cb6
mov edi, esi
and edi, 1
jmp 0x427cb6
mov edi, esi
and edi, 1
jmp 0x427cb6
mov edi, esi
and edi, 1
jmp 0x427cb6
mov edi, esi
and edi, 1
jmp 0x427cb6
mov edi, esi
and edi, 1
jmp 0x427cb6
mov edi, esi
and edi, 1
jmp 0x427cb6
Function at 0x42ebdc
Capabilities:
Receive data
Receive data on socket

Disassembly:
push edi
push esi
push ebp
push ebx
push ecx
mov eax, 0x3318
call fcn.0046eee0
mov ecx, dword [esp + 0x3318]
mov ebx, ecx
mov ebp, dword [esp + 0x3330]
mov eax, dword [esp + 0x3334]
mov ecx, ebx
push eax
push ebp
call fcn.0042ee6c
movzx eax, al
test eax, eax
jne 0x42ed51
mov esi, dword [ebp*4 + 0x6e4b00]
test esi, esi
jne 0x42ec30
xor eax, eax
add esp, 0x331c
pop ebx
pop ebp
pop esi
pop edi
ret 8
mov dword [esp], 0x10
lea ebp, [esp + 0x14]
lea edx, [esp + 4]
lea eax, [esp]
push eax
push edx
push 0
push 0x1000
push ebp
push esi
call dword [sym.imp.ws2_32.dll_recvfrom]
mov ebp, eax
lea edx, [esp + 4]
mov ecx, ebx
push edx
call fcn.0042ef2c
cmp ebp, 0xffffffff
je 0x42ed63
mov dword [esp + 0x3214], ebp
lea edi, [esp + 0x2214]
lea esi, [esp + 0x14]
mov ecx, ebp
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x2214]
lea esi, [esp + 0x3318]
lea edx, [esp + 0x3314]
push edx
mov ecx, ebx
push esi
push edi
push dword [ebx + 8]
call fcn.0042ef48
movzx edx, al
test edx, edx
jne 0x42ecc2
xor eax, eax
add esp, 0x331c
pop ebx
pop ebp
pop esi
pop edi
ret 8
push 0
push dword [esp + 0x3318]
push dword [esp + 0x3320]
mov ecx, dword [esp + 0x3340]
call fcn.00426c38
movzx edx, al
test edx, edx
jne 0x42ed0c
mov ecx, ebx
call fcn.0042f688
push eax
push 0x6eeb0c
call fcn.00440328
inc dword [0x52f7b8]
xor eax, eax
add esp, 0x3324
pop ebx
pop ebp
pop esi
pop edi
ret 8
mov edx, dword [esp + 0x3334]
mov esi, dword [edx + 4]
add esi, 7
shr esi, 3
cmp esi, dword [edx]
jb 0x42ed47
mov ecx, ebx
call fcn.0042f688
push eax
push 0x6eeb44
call fcn.00440328
inc dword [0x52f7b8]
xor eax, eax
add esp, 0x3324
pop ebx
pop ebp
pop esi
pop edi
ret 8
push ebp
push esi
call fcn.00431f78
add esp, 8
mov eax, 1
add esp, 0x331c
pop ebx
pop ebp
pop esi
pop edi
ret 8
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x42ed9b
cmp eax, 0x2746
je 0x42edbf
mov eax, dword [0x65ba98]
mov edx, dword [eax + 0x210]
test edx, edx
jne 0x42edaa
call fcn.0043203c
push eax
push 0x6eeafc
push 1
call fcn.00440498
add esp, 0xc
xor eax, eax
add esp, 0x331c
pop ebx
pop ebp
pop esi
pop edi
ret 8
call fcn.0043203c
push eax
push 0x6eeafc
call fcn.00440328
add esp, 8
jmp 0x42ed9b
mov dword [esp + 0x1114], 0x6ecc18
mov eax, 0x6eeae0
test eax, eax
je 0x42ee60
mov edi, 0x6eeae0
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x42edee
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x42ede6
cmp eax, 0x1000
jl 0x42ee07
mov eax, 0xfff
mov dword [esp + 0x1118], 0xfff
jmp 0x42ee0e
mov dword [esp + 0x1118], eax
test eax, eax
je 0x42ee2b
lea edx, [esp + 0x111c]
push eax
push edi
push edx
call fcn.0046edc0
add esp, 0xc
mov eax, dword [esp + 0x1118]
mov byte [esp + eax + 0x111c], 0
lea eax, [esp + 0x1114]
mov dword [esp + 0x211c], 1
mov dword [esp + 0x1114], 0x6ecc1c
push 0x48b270
push eax
call fcn.0046f152
jmp 0x42ed77
mov edi, 0x6eeacc
jmp 0x42eddc
Function at 0x4300bc
Capabilities:
Get hostname
Resolve dns

Disassembly:
push edi
push ebp
sub esp, 0x12c
mov ebp, ecx
lea eax, [esp]
push 0x12c
push eax
call dword [sym.imp.ws2_32.dll_gethostname]
cmp eax, 0xffffffff
je 0x430142
lea eax, [esp]
push eax
call dword [sym.imp.ws2_32.dll_gethostbyname]
mov edi, eax
test edi, edi
je 0x43012b
mov eax, dword [edi + 0xc]
mov edx, dword [eax]
push dword [edx]
call dword [sym.imp.ws2_32.dll_htonl]
mov dword [ebp + 4], 3
mov edx, eax
shr edx, 0x18
mov byte [ebp + 8], dl
mov edx, eax
shr edx, 0x10
mov byte [ebp + 9], dl
mov edx, eax
shr edx, 8
mov byte [ebp + 0xa], dl
mov byte [ebp + 0xb], al
mov eax, 0xffff
mov word [ebp + 0xc], ax
add esp, 0x12c
pop ebp
pop edi
ret
call fcn.0043203c
push eax
push 0x6eeda0
push 2
call fcn.00440498
add esp, 0xc
jmp 0x4300ea
call fcn.0043203c
push eax
push 0x6eed80
push 2
call fcn.00440498
add esp, 0xc
jmp 0x4300da
Function at 0x430f60
Capabilities:
Create udp socket
Resolve dns
Set socket configuration

Disassembly:
push edi
push esi
push ebp
push ebx
sub esp, 0x9c
mov dword [esp], edx
mov ebp, eax
mov edx, 1
mov dword [esp + 4], edx
mov ecx, 2
mov dword [esp + 8], edx
push 0x11
push ecx
push ecx
call dword [sym.imp.ws2_32.dll_socket]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x43116c
lea edx, [esp + 4]
push edx
push 0x8004667e
push ebx
call dword [sym.imp.ws2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
je 0x43114f
lea edx, [esp + 8]
push 4
push edx
push 0x20
push 0xffff
push ebx
call dword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x431132
test ebp, ebp
je 0x431009
mov dl, byte [ebp]
test dl, dl
je 0x431009
mov esi, 0x6ed264
mov edi, ebp
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x431000
or dl, dl
je 0x430ffc
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x431000
add edi, 2
add esi, 2
or dl, dl
jne 0x430fe0
xor eax, eax
jmp 0x431005
sbb eax, eax
or eax, 1
test eax, eax
jne 0x431016
mov dword [esp + 0x10], 0
jmp 0x43109f
lea edx, [esp + 0xc]
xor ecx, ecx
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov ecx, 2
xor edx, edx
lea esi, [esp + 0x1c]
mov word [esp + 0xc], cx
mov edi, ebp
mov word [esp + 0xe], dx
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x43103e
lea ebp, [esp + 0x1c]
mov dl, byte [esp + 0x1c]
test dl, dl
je 0x431065
cmp dl, 0x3a
je 0x431112
inc ebp
mov dl, byte [ebp]
test dl, dl
jne 0x431054
mov dl, byte [esp + 0x1c]
cmp dl, 0x30
jl 0x431084
cmp dl, 0x39
jg 0x431084
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.ws2_32.dll_inet_addr]
mov dword [esp + 0x10], eax
jmp 0x43109f
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.ws2_32.dll_gethostbyname]
test eax, eax
je 0x43109f
mov ebp, dword [eax + 0xc]
mov ecx, dword [ebp]
mov edx, dword [ecx]
mov dword [esp + 0x10], edx
mov edx, dword [esp]
cmp edx, 0xffffffff
jne 0x4310b0
xor edx, edx
mov word [esp + 0xe], dx
jmp 0x4310c1
mov ecx, edx
movzx edx, cx
push edx
call dword [sym.imp.ws2_32.dll_htons_1]
mov word [esp + 0xe], ax
mov ecx, 2
lea edx, [esp + 0xc]
mov word [esp + 0xc], cx
push 0x10
push edx
push ebx
call dword [sym.imp.ws2_32.dll_bind]
cmp eax, 0xffffffff
je 0x4310eb
mov eax, ebx
add esp, 0x9c
pop ebx
pop ebp
pop esi
pop edi
ret
call fcn.0043203c
push eax
push 0x6ef3b4
call fcn.00440328
add esp, 8
push ebx
call dword [sym.imp.ws2_32.dll_closesocket]
xor eax, eax
add esp, 0x9c
pop ebx
pop ebp
pop esi
pop edi
ret
mov byte [ebp], 0
inc ebp
push ebp
call fcn.0046e284
pop ecx
movzx edx, ax
push edx
call dword [sym.imp.ws2_32.dll_htons_1]
mov word [esp + 0xe], ax
jmp 0x43105e
call fcn.0043203c
push eax
push 0x6ef388
call fcn.00440328
xor eax, eax
add esp, 0xa4
pop ebx
pop ebp
pop esi
pop edi
ret
call fcn.0043203c
push eax
push 0x6ef358
call fcn.00440328
xor eax, eax
add esp, 0xa4
pop ebx
pop ebp
pop esi
pop edi
ret
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x273f
je 0x431192
call fcn.0043203c
push eax
mov eax, dword [esp + 4]
push eax
push ebp
push 0x6ef32c
call fcn.00440328
add esp, 0x10
xor eax, eax
add esp, 0x9c
pop ebx
pop ebp
pop esi
pop edi
ret
Function at 0x4312fc
Capabilities:
Resolve dns

Disassembly:
push edi
push esi
push ebx
sub esp, 0x80
mov edi, dword [esp + 0x90]
mov ebx, dword [esp + 0x94]
xor eax, eax
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov edx, 2
xor eax, eax
lea esi, [esp]
mov word [ebx], dx
mov word [ebx + 2], ax
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x431331
lea esi, [esp]
mov al, byte [esp]
test al, al
je 0x431350
cmp al, 0x3a
je 0x431391
inc esi
mov al, byte [esi]
test al, al
jne 0x431345
mov al, byte [esp]
cmp al, 0x30
jl 0x43136a
cmp al, 0x39
jg 0x43136a
lea eax, [esp]
push eax
call dword [sym.imp.ws2_32.dll_inet_addr]
mov dword [ebx + 4], eax
jmp 0x431382
lea eax, [esp]
push eax
call dword [sym.imp.ws2_32.dll_gethostbyname]
test eax, eax
je 0x4313ac
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
mov dword [ebx + 4], eax
mov eax, 1
add esp, 0x80
pop ebx
pop esi
pop edi
ret
mov byte [esi], 0
inc esi
push esi
call fcn.0046e284
pop ecx
movzx edx, ax
push edx
call dword [sym.imp.ws2_32.dll_htons_1]
mov word [ebx + 2], ax
jmp 0x43134a
xor eax, eax
add esp, 0x80
pop ebx
pop esi
pop edi
ret

Function at 0x432330
Capabilities:
Initialize winsock library

Disassembly:
mov ecx, dword [0x660f10]
mov eax, dword [ecx]
push 8
push 0
push 0x6ef250
call dword [eax + 0x18]
mov dword [0x52f7f0], eax
mov ecx, dword [0x660f10]
mov eax, dword [ecx]
push 8
push 0
push 0x6ef25c
call dword [eax + 0x18]
mov dword [0x52f7ec], eax
mov ecx, dword [0x660f10]
mov eax, dword [ecx]
push 8
push 0
push 0x6ef26c
call dword [eax + 0x18]
mov dword [0x52f7e8], eax
mov ecx, dword [0x660f10]
mov eax, dword [ecx]
push 4
push 0x70e5
push 0x6ef27c
call dword [eax + 0x18]
mov dword [0x52f7e4], eax
mov ecx, dword [0x660f10]
mov eax, dword [ecx]
push 8
push 0
push 0x6ef288
call dword [eax + 0x18]
mov dword [0x52f7e0], eax
mov ecx, dword [0x660f10]
mov eax, dword [ecx]
push 8
push 0
push 0x6ef294
call dword [eax + 0x18]
mov dword [0x52f7dc], eax
mov ecx, dword [0x660f10]
mov eax, dword [ecx]
push 4
push 0x70e6
push 0x6ef2ac
call dword [eax + 0x18]
mov dword [0x52f7d8], eax
mov ecx, dword [0x660f10]
mov eax, dword [ecx]
push 4
push 0x6ed264
push 0x6ef2bc
call dword [eax + 0x1c]
mov dword [0x52f7d4], eax
push 0x664900
push 0x101
call dword [sym.imp.ws2_32.dll_WSAStartup]
test eax, eax
je 0x432424
push 0x6ef2c4
push 2
call fcn.00440498
add esp, 8
push 0x6ef2e0
call fcn.00440328
pop ecx
mov edx, 0x6e4b00
xor eax, eax
mov dword [edx], eax
mov dword [edx + 4], eax
ret
Function at 0x4413f8
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x2c], ebx
xor ebx, ebx
pushfd
pop eax
mov edx, eax
xor eax, 0x200000
push eax
popfd
pushfd
pop eax
xor eax, edx
je 0x441455
mov eax, 0x80000000
push ebx
cpuid
pop ebx
cmp eax, 0x80000000
jbe 0x441444
mov eax, 0x80000001
push ebx
cpuid
pop ebx
test edx, 0xc0400000
je 0x441444
or ebx, 1
mov eax, 1
push ebx
cpuid
pop ebx
shr edx, 0x18
and edx, 6
or ebx, edx
mov dword [ebp - 0x28], ebx
mov ebx, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x10]
cmp eax, 1
jbe 0x441478
mov eax, dword [ebp - 0x28]
or eax, 8
mov dword [ebp - 0x28], eax
jmp 0x44147b
mov eax, dword [ebp - 0x28]
cmp eax, 0xf
ja case.0x441487.4
mov edx, dword [eax*4 + 0x6f1d80]
jmp edx
push eax
push 0x6f1ee0
call fcn.004403f0
add esp, 8
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x442138
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6f2218
push 0x46fc6c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], ebx
mov eax, esp
and eax, 0xffff
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
cmp eax, 0x8000
je 0x442190
jg 0x442334
add eax, 0x8000
call fcn.0046eee0
and esp, 0xfffffff0
mov dword [ebp - 0x18], esp
mov eax, esp
call dword [sym.imp.kernel32.dll_GetCurrentThread]
push 1
push eax
call dword [sym.imp.kernel32.dll_SetThreadAffinityMask]
mov dword [ebp - 0x30], 1
call dword [sym.imp.kernel32.dll_GetVersion]
mov dword [ebp - 0x2c], eax
test eax, 0x8000
jne 0x4422e2
movzx eax, al
cmp eax, 5
jb 0x4422ad
mov dword [ebp - 4], 0
jmp 0x4421db
mov al, byte [0x48b3ac]
test al, al
jne 0x442216
mov dword [ebp - 0x28], 0x380
stmxcsr dword [ebp - 0x48]
mov edx, dword [ebp - 0x48]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x28]
xor eax, 0xffffffff
and edx, eax
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x44], edx
ldmxcsr dword [ebp - 0x44]
push 0x80018
push 0
call fcn.0046fd6b
add esp, 8
push 0x30000
push 0x10000
call fcn.0046fd6b
add esp, 8
mov ecx, 0x663100
call fcn.00444be4
mov eax, 0x663100
mov dword [0x660eec], eax
mov dword [ebp - 0x20], eax
mov edx, dword [0x663100]
push 0x6f299c
push eax
call dword [edx + 0x3c]
add esp, 8
push dword [ebp + 0x10]
call fcn.0044234c
pop ecx
mov dword [ebp - 0x30], eax
mov eax, dword [0x660eec]
mov dword [ebp - 0x1c], eax
mov edx, dword [eax]
push 0x6f29bc
push eax
call dword [edx + 0x3c]
add esp, 8
mov ecx, 0x663100
call fcn.00444ba0
mov dword [0x660eec], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x30]
mov esp, dword [ebp - 0x18]
mov edi, dword [ebp - 0x40]
mov esi, dword [ebp - 0x3c]
mov ebx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10
push 0x10
push 0x6f295c
push 0x6f296c
push 0
call dword [sym.imp.user32.dll_MessageBoxA]
mov eax, 2
mov esp, dword [ebp - 0x18]
mov edi, dword [ebp - 0x40]
mov esi, dword [ebp - 0x3c]
mov ebx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10
push 0x10
push 0x6f295c
push 0x6f2924
push 0
call dword [sym.imp.user32.dll_MessageBoxA]
mov eax, 2
mov esp, dword [ebp - 0x18]
mov edi, dword [ebp - 0x40]
mov esi, dword [ebp - 0x3c]
mov ebx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10
add eax, 0xffff8000
call fcn.0046eee0
and esp, 0xfffffff0
mov dword [ebp - 0x18], esp
mov eax, esp
jmp 0x442190
Function at 0x4438d0
Capabilities:
Hide graphical window

Disassembly:
push esi
sub esp, 0x28
xor edx, edx
mov dword [0x660f2c], eax
mov dword [esp], 3
mov dword [esp + 4], 0x443618
mov dword [esp + 8], edx
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
push edx
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
push 0x65
push eax
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [esp + 0x14], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [esp + 0x18], eax
lea eax, [esp]
mov dword [esp + 0x1c], 7
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0x6f2c8c
push eax
call dword [sym.imp.user32.dll_RegisterClassA]
mov esi, 0x80cf0000
mov ecx, dword [0x660f10]
mov eax, dword [ecx]
push 0x6f2c7c
call dword [eax + 0x30]
test eax, eax
je 0x44395b
mov esi, 0x80000000
xor edx, edx
mov eax, 0x64
push edx
push dword [0x660f2c]
push edx
push edx
push eax
push eax
push edx
push edx
push esi
push 0x663b40
push 0x6f2c8c
push 0x40000
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x660f28], eax
push 0
push eax
call dword [sym.imp.user32.dll_ShowWindow]
mov edx, dword [0x660f28]
mov eax, 1
mov dword [0x66443c], edx
add esp, 0x28
pop esi
ret

Function at 0x444be4
Capabilities:
Get memory capacity

Disassembly:
push edi
push ebp
sub esp, 0x20
call fcn.00444af8
mov edx, dword [0x661ba4]
test edx, edx
je 0x444c01
mov eax, dword [0x661ba0]
test eax, eax
jne 0x444c3f
test edx, edx
je 0x444c0c
push edx
call dword [sym.imp.kernel32.dll_FreeLibrary]
mov dword [0x661ba0], 0
push 0x6f2e10
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov dword [0x661ba4], eax
test eax, eax
je 0x444c3f
push 0x6f2e18
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x661ba0], eax
test eax, eax
je 0x444c88
lea eax, [esp]
push eax
call dword [sym.imp.kernel32.dll_GlobalMemoryStatus]
mov ebp, dword [esp + 8]
lea edi, [ebp - 0x8000000]
cmp edi, 0x1000000
jge 0x444c60
mov edi, 0x1000000
add ebp, 0xfc000000
cmp ebp, 0x1000000
jge 0x444c73
mov ebp, 0x1000000
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push ebp
push edi
push eax
call dword [sym.imp.kernel32.dll_SetProcessWorkingSetSize]
add esp, 0x20
pop ebp
pop edi
ret
push dword [0x661ba4]
call dword [sym.imp.kernel32.dll_FreeLibrary]
mov dword [0x661ba4], 0
jmp 0x444c3f
Function at 0x453ee7
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x485394
push 0x80000002
call dword [sym.imp.advapi32.dll_RegOpenKeyA]
test eax, eax
jne 0x453f40
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x453f40
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp + 8]
jne 0x453f40
xor eax, eax
inc eax
jmp 0x453f42
xor eax, eax
leave
ret 0x10

Function at 0x454f10
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x485394
push 0x80000002
call dword [sym.imp.advapi32.dll_RegOpenKeyA]
test eax, eax
jne 0x454f69
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x454f69
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp + 8]
jne 0x454f69
xor eax, eax
inc eax
jmp 0x454f6b
xor eax, eax
leave
ret 0x10