joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401750
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [edx]
or byte [ebx - 0x292937f3], cl
add byte [eax - 0x7d], dl
rol dword [eax + 0x68], 0xc4
rcl dl, cl
add byte [ecx - 0x66], dl
adc eax, 0x8540c180
mov eax, dword [0x4102ac]
add esp, 0xc
test eax, eax
je 0x401787
push eax
push 0x8b40d20c
or dh, byte [edi]
shl dword fs:[ebx], 0xce
add esp, 8
push 0x13
call dword [sym.imp.MSVCRT.dll_exit]
mov bl, 0x55
movsb byte es:[edi], byte [esi]
in al, dx
sub esp, 0x1d0000b8
mov eax, dword [0x410278]
test dword [edx - 0x5f], ebx
dec esp
inc eax
ret

Function at 0x40676f
Capabilities:
Connect socket

Disassembly:
xor byte [ebx + 0x10458bec], cl
xchg ebx, eax
dec ebp
adc al, 0x56
pop ss
jne 0x406755
push edi
mov edi, dword [ebp + 0xc]
mov edx, dword [esi + 0x10]
push 0
push edi
iretd
add byte [edi - 0x31], dl
mov dword [esi + 8], eax
jge 0x4067ab
or al, 0xbc
insd dword es:[edi], dx
push es
test dword [eax], 0x1314468b
add byte [edi + 0x4d], dl
call fcn.00406dd0
add esp, 0x73
imul ebx, dword [esi + 0x5d], 0x909090c3
pop edx
nop
nop
mov eax, 0xa4909040
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
mov ebp, 0x53506a57
call 0xff5c4a60
mov esi, dword [ecx]
sbb dword [ebx + 0x1ac03395], ecx
and eax, 0x14b9
add byte [edx + 0x38], ch
dec esp
stosd dword es:[edi], eax
mov dword [esi], edx
mov dword [edx], ebx
mov eax, dword [esi]
mov ecx, dword [eax]
push ecx
call fcn.00404960
pop eax
xchg ecx, eax
xor ebp, dword [ebx + ecx*4 - 0x29]
test eax, 0xe
rep stosd dword es:[edi], eax
mov ecx, dword [edi + 0x6a]
cmp byte [ecx + 0xe8b1050], cl
mov ebp, esi
adc byte [ecx - 0x6bf974e6], cl
or byte [ebx - 0x1d7518], al
pop ebp
mov edi, eax
xor eax, eax
mov edx, dword [eax - 0x47]
mov eax, ecx
add byte [ebx + esi*8 + 0x4f068b52], ch
add byte [ebx + 0x6a], dl
add dword [ecx + 0xe8b1450], ecx
loope 0x406842
adc al, 0xfe
sbb cl, byte [ebx + 0x3472c706]
das
add byte [eax], al
imul ecx, dword [ebx + 0x48c1830e], 0x51
call 0xee406010
pop edi
pop esi
fcomp qword [ebp - 0x3d]
cmp edx, dword [eax - 0x1373aa70]
push ebp
mov esp, gs
in al, dx
xor dword [eax], 0x20d
push ebx
mov ebx, dword [ebp + 6]
fst qword [edi - 0x75]
inc ebx
add al, 0x83
clc
dec dword [edi]
test byte [ecx + eax + 0x618bb300], dl
mov al, byte [0x840fc985]
mov dword [ecx], eax
add byte [eax], al
mov esi, dword [ebp + 0xc]
mov ecx, dword [esi + 0x14]
lea edi, [edi + 0x50525128]
call dword [sym.imp.WSOCK32.dll_connect]
cmp eax, 0xffffffff
nop dword [edi]
add dword [eax], eax
add byte [ebx + 0x40c1d835], cl
add bh, bh
salc
push edx
ror byte [edi], 0x2a
stc
add byte [edx], al
add bh, bh
salc
add eax, 0xafcfe
cmp eax, 0xb2366
invalid
Function at 0x402ed5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x402ee4
pop dword [ebp - 0x1c]
mov eax, 0x1430ae27
add eax, 0xec0f80bd
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x406b88d9
sub dword [ebp - 0x2c], 0xf219438e
mov dword [ebp - 0x28], 0x9699b2d4
sub dword [ebp - 0x28], 0x6466668f
mov dword [ebp - 0x24], 0x7a34e9e4
sub dword [ebp - 0x24], 0x2de8a5b6
mov dword [ebp - 0x20], 0x2d782ee0
add dword [ebp - 0x20], 0xd287d120
lea eax, [ebp - 0x2c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0xdc2499a1
add dword [ebp - 0x2c], 0x984dcfb5
mov dword [ebp - 0x28], 0x9f2029dd
sub dword [ebp - 0x28], 0x5db3c868
mov dword [ebp - 0x24], 0xb17881da
sub dword [ebp - 0x24], 0x4e09156e
mov dword [ebp - 0x20], 0xaa7472a0
sub dword [ebp - 0x20], 0xaa7472a0
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0xf8f1689d
add eax, 0x74f1863
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x34b67
push 0
call eax
mov ecx, 0x685a9600
sub ecx, 0x685a574b
xor esi, esi
add esi, eax
mov edx, 0x46e400
add edx, dword [ebp - 0x1c]
mov edi, 0x5907b370
sub edi, 0xe5805f16
add dword [ebp - 0x14], 0xb7088b5
mov ebx, dword [edx]
mov dword [ebp - 0xc], 0xc157e266
add ebx, edi
xor dword [ebp - 8], edi
mov dword [esi], ebx
sub dword [ebp - 0x14], 0x85940e5
add esi, 0xacf7d7bb
sub esi, 0xacf7d7b7
add edx, 0xe295d949
add edx, 0x1d6a26bb
loop 0x402ffd
add eax, 0x5fa8fd64
sub eax, 0x5fa80fbd
mov ebx, eax
add eax, 0x7996c918
sub eax, 0x7996c913
mov ecx, 0xd207c755
sub ecx, 0xd1c7c755
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x40317b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
cmp eax, esi
jl 0x4031a6
mov ecx, dword [0x42a298]
push esi
add eax, ecx
push esi
push eax
mov dword [0x418ed4], eax
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_SetFilePointer]
push 4
call fcn.00403283
cmp eax, esi
jl 0x40327d
lea eax, [ebp + 8]
push 4
push eax
push dword [0x40a01c]
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp + 8]
add dword [0x418ed4], 4
call fcn.00403283
mov ebx, eax
cmp ebx, esi
jl 0x40327b
cmp dword [ebp + 0x10], esi
jne 0x403249
cmp dword [ebp + 8], esi
jle 0x40327b
mov esi, 0x414ed0
cmp dword [ebp + 8], 0x4000
mov eax, dword [ebp + 8]
jl 0x40320b
mov eax, 0x4000
push eax
push esi
push dword [0x40a01c]
mov dword [ebp - 4], eax
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call fcn.00402ed5
test eax, eax
je 0x403245
mov eax, dword [ebp - 4]
sub dword [ebp + 8], eax
add dword [0x418ed4], eax
add ebx, eax
cmp dword [ebp + 8], 0
jg 0x4031fa
jmp 0x40327b
push 0xfffffffffffffffe
jmp 0x40326f
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x403254
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push esi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x403272
push 0xfffffffffffffffd
pop eax
jmp 0x40327d
mov ebx, dword [ebp - 4]
add dword [0x418ed4], ebx
mov eax, ebx
pop esi
pop ebx
leave
ret 0x10
Function at 0x4023c0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
movzx eax, byte [0x4225ac]
test eax, eax
je 0x4023d6
jmp 0x402432
mov ecx, dword [0x4225a8]
shl ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
push edx
push 0x20
lea eax, [ebp - 0x108]
push eax
call sub.NTOSKRNL.EXE_memset
add esp, 0xc
mov ecx, 0x100
sub ecx, dword [ebp - 4]
sub ecx, 1
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
lea ecx, [ebp + eax - 0x108]
push ecx
call dword [sym.imp.NTOSKRNL.EXE_strncpy]
add esp, 0xc
mov byte [ebp - 9], 0
lea edx, [ebp - 0x108]
push edx
push 0x401108
call sub.NTOSKRNL.EXE_DbgPrint
add esp, 8
mov esp, ebp
pop ebp
ret 4

Function at 0x402440
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
movzx eax, byte [0x4225ac]
test eax, eax
je 0x402456
jmp 0x4024cd
mov ecx, dword [0x4225a8]
shl ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
push edx
push 0x20
lea eax, [ebp - 0x108]
push eax
call sub.NTOSKRNL.EXE_memset
add esp, 0xc
mov ecx, dword [ebp - 4]
mov byte [ebp + ecx - 0x108], 0
lea edx, [ebp + 0xc]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, 0x100
sub edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 4]
lea ecx, [ebp + eax - 0x108]
push ecx
call dword [sym.imp.NTOSKRNL.EXE__vsnprintf]
add esp, 0x10
add eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
lea edx, [ebp - 0x108]
push edx
push 0x401108
call sub.NTOSKRNL.EXE_DbgPrint
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x402e70
Capabilities:
Complete processing asynchronous io request

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 0x18], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov dword [edx + 0x1c], eax
mov dl, byte [ebp + 0x14]
mov ecx, dword [ebp + 8]
call dword [sym.imp.NTOSKRNL.EXE_IofCompleteRequest]
mov eax, dword [ebp + 0xc]
pop ebp
ret 0x10
Function at 0x40cd40
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 9]
call fcn.00402e20
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x14]
mov eax, dword [edx + 4]
call eax
call fcn.00418160
mov ecx, dword [ebp - 0x14]
mov byte [ecx + 0x19c], 0
mov dword [ebp - 0x10], 0
jmp 0x40cd7f
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 3
jge 0x40cdc7
push 0x100
mov eax, dword [ebp - 0x14]
add eax, 0x94
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x14]
mov eax, dword [edx + 0x18]
call eax
push eax
call fcn.00404bf0
push 0x32
call fcn.004096c0
mov ecx, dword [ebp - 0x14]
call fcn.0040a140
movzx ecx, al
test ecx, ecx
je 0x40cdbe
jmp 0x40cdc7
push 0x32
call fcn.004096c0
jmp 0x40cd76
mov edx, dword [ebp - 0x14]
add edx, 0x2c
push edx
call dword [sym.imp.NTOSKRNL.EXE_KeClearEvent]
mov eax, dword [ebp - 0x14]
push eax
push 0x409260
push 0
push 0
push 0
push 0x1f03ff
lea ecx, [ebp - 4]
push ecx
call dword [sym.imp.NTOSKRNL.EXE_PsCreateSystemThread]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jge 0x40ce16
push 0
push 1
mov edx, dword [ebp - 0x14]
add edx, 0x2c
push edx
call dword [sym.imp.NTOSKRNL.EXE_KeSetEvent]
lea ecx, [ebp - 9]
call fcn.00402e40
jmp 0x40ce28
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.NTOSKRNL.EXE_ZwClose]
lea ecx, [ebp - 9]
call fcn.00402e40
mov esp, ebp
pop ebp
ret
Function at 0x418060
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x1c], 0x1f4
mov cl, 0x1f
call dword [sym.imp.HAL.DLL_KfRaiseIrql]
mov byte [ebp - 0x29], al
rdtsc
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [0x422cb8]
call fcn.0040d220
rdtsc
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], eax
mov cl, byte [ebp - 0x29]
call dword [sym.imp.HAL.DLL_KfLowerIrql]
mov eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x24]
sbb edx, dword [ebp - 0xc]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], edx
cmp dword [ebp - 4], 0
jg 0x4180de
jl 0x4180cd
cmp dword [ebp - 8], 0x3fffffff
jae 0x4180de
cmp dword [ebp - 0x34], 0
jl 0x41810e
jg 0x4180de
cmp dword [ebp - 0x38], 0x3fffffff
jb 0x41810e
push 0
push 2
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.00418300
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
push 0
push 2
mov edx, dword [ebp - 0x34]
push edx
mov eax, dword [ebp - 0x38]
push eax
call fcn.00418300
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
jmp 0x4180bc
mov ecx, 1
test ecx, ecx
je 0x418119
jmp 0x41813c
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x38]
push edx
call fcn.00418300
push eax
push 0x402344
call fcn.00402e60
add esp, 8
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret

Function at 0x401c2e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
and byte [ebp - 0x100], 0
push edi
push 0x3f
xor eax, eax
pop ecx
lea edi, [ebp - 0xff]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 8
lea eax, [ebp - 0x100]
push 0x404008
push eax
call fcn.00401ca0
mov ecx, 0x401bdc
mov eax, 0x4017fd
sub ecx, eax
push ecx
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.00401d18
push 0x100
lea eax, [ebp - 0x100]
push 0
push eax
call fcn.004020d0
add esp, 0x24
call fcn.00401846
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40501c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x405028
push 0x405024
push 0x405020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x405028]
push dword [0x405024]
push dword [0x405020]
mov dword [0x405014], esp
call fcn.0040129c
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret
Function at 0x40193b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push esi
xor esi, esi
call fcn.00407266
push eax
call fcn.00407429
sub byte [esi + 0x435a80], 0x1e
pop ecx
call fcn.00407266
push eax
call fcn.00407429
add byte [esi + 0x435a80], 0xe6
pop ecx
call fcn.00407266
push eax
call fcn.00407429
add byte [esi + 0x435a80], 0xa2
pop ecx
call fcn.00407266
push eax
call fcn.00407429
xor byte [esi + 0x435a80], 0xe1
pop ecx
call fcn.00407266
push eax
call fcn.00407429
add byte [esi + 0x435a80], 0x12
pop ecx
call fcn.00407266
push eax
call fcn.00407429
xor byte [esi + 0x435a80], 0x40
pop ecx
call fcn.00407266
push eax
call fcn.00407429
add byte [esi + 0x435a80], 0xc5
pop ecx
call fcn.00407266
push eax
call fcn.00407429
add byte [esi + 0x435a80], 0xf8
pop ecx
call fcn.00407266
push eax
call fcn.00407429
xor byte [esi + 0x435a80], 0x2f
pop ecx
call fcn.00407266
push eax
call fcn.00407429
xor byte [esi + 0x435a80], 0x87
pop ecx
call fcn.00407266
push eax
call fcn.00407429
add byte [esi + 0x435a80], 0x43
pop ecx
call fcn.00407266
push eax
call fcn.00407429
add byte [esi + 0x435a80], 0x96
pop ecx
call fcn.00407266
push eax
call fcn.00407429
add byte [esi + 0x435a80], 0xe6
pop ecx
call fcn.00407266
push eax
call fcn.00407429
add byte [esi + 0x435a80], 0x3c
inc esi
pop ecx
cmp esi, 0x23000
jb 0x401945
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x401a61
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ebp, [esi + 0x10]
mov edi, dword [ebp]
mov ebx, edi
xor ebx, 0x14d
mov dword [esp + 0x18], ebp
cmp dword [esi + 0x14], 0x10
jb 0x401a84
mov esi, dword [esi]
shr edi, 2
push esi
push edi
push str._x_and__p
mov dword [esp + 0x20], edi
call fcn.004010d6
add esp, 0xc
test edi, edi
je 0x401ae1
mov ebp, esi
push 4
lea eax, [esp + 0x14]
push ebp
push eax
call fcn.0040a920
imul ecx, dword [esp + 0x1c], 0x5bd1e991
add esp, 0xc
imul ebx, ebx, 0x5bd1e991
add ebp, 4
mov eax, ecx
shr eax, 0x18
xor eax, ecx
imul eax, eax, 0x5bd1e991
xor ebx, eax
mov dword [esp + 0x10], eax
sub edi, 1
jne 0x401aa0
mov edi, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
mov eax, dword [ebp]
xor ecx, ecx
and eax, 3
sub eax, 1
je 0x401b0a
sub eax, 1
je 0x401b00
sub eax, 1
jne 0x401b18
movsx ecx, byte [esi + edi*4 + 2]
shl ecx, 0x10
movsx eax, byte [esi + edi*4 + 1]
shl eax, 8
xor ecx, eax
movsx eax, byte [esi + edi*4]
xor eax, ecx
imul eax, eax, 0x5bd1e991
xor ebx, eax
mov eax, ebx
shr eax, 0xd
xor eax, ebx
imul ecx, eax, 0x5bd1e991
pop edi
pop esi
pop ebp
pop ebx
mov eax, ecx
shr eax, 0xf
xor eax, ecx
add esp, 0xc
ret
Function at 0x403130
Capabilities:
Get disk information

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44c4a0
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x48
mov eax, dword [0x46b074]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x44], eax
nop word [eax + eax]
add eax, 0x41
mov dword [ebp - 0x1a], 0x3a
movzx eax, ax
mov dword [ebp - 0x4c], eax
mov word [ebp - 0x1c], ax
xor eax, eax
mov dword [ebp - 4], 0
push eax
push 0x104
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x40], 0x104
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], ax
call fcn.00403420
cmp dword [ebp - 0x20], 8
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x34]
cmovae eax, dword [ebp - 0x34]
push ecx
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.MPR.dll_WNetGetConnectionW]
mov byte [ebp - 4], 1
lea esi, [ebp - 0x34]
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x44]
cmp dword [ebp - 0x20], 8
cmovae esi, dword [ebp - 0x34]
lea ecx, [eax + eax]
add esi, ecx
lea eax, [ebp - 0x34]
cmp dword [ebp - 0x20], 8
cmovae eax, dword [ebp - 0x34]
add eax, ecx
cmp dword [ebp - 0x20], 8
lea ecx, [ebp - 0x34]
cmovae ecx, dword [ebp - 0x34]
push eax
push ecx
lea ecx, [ebp - 0x50]
call fcn.00403610
add esp, 8
lea ecx, [ebp - 0x34]
push esi
push dword [eax]
lea eax, [ebp - 0x54]
push eax
call fcn.004033a0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x24], 0
jne 0x40328c
mov ecx, dword [ebp - 0x3c]
mov eax, 1
shl eax, cl
test dword [ebp - 0x48], eax
je 0x4032c5
mov eax, dword [ebp - 0x4c]
lea ecx, [ebp - 0x34]
mov word [ebp - 0x38], ax
lea eax, [ebp - 0x38]
push 1
push eax
call fcn.00401b50
push 1
push 0x45e59c
lea ecx, [ebp - 0x34]
call fcn.00403590
mov eax, dword [edi + 4]
cmp dword [edi + 8], eax
je 0x4032b9
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
movups xmm0, xmmword [ebp - 0x34]
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x24]
movq qword [eax + 0x10], xmm0
add dword [edi + 4], 0x18
jmp 0x4032fb
lea ecx, [ebp - 0x34]
push ecx
push eax
mov ecx, edi
call fcn.00403690
mov edx, dword [ebp - 0x20]
cmp edx, 8
jb 0x4032fb
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4032f1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40332b
push edx
push ecx
call fcn.00422d4e
add esp, 8
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp eax, 0x1a
jb 0x4031a0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00422d0d
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.0043d6f9
int3
Function at 0x404100
Capabilities:
Get disk information

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44c550
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x30
mov eax, dword [0x46b074]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [ebp - 0x3c], eax
xor esi, esi
nop
lea eax, [esi + 0x41]
mov dword [ebp - 0x1a], 0x3a
movzx eax, ax
lea edx, [ebp - 0x1c]
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov word [ebp - 0x1c], ax
call fcn.00403b30
cmp dword [ebp - 0x24], 0
jne 0x4041f0
mov eax, 1
mov ecx, esi
shl eax, cl
test dword [ebp - 0x3c], eax
jne 0x4041f0
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x34]
mov word [ebp - 0x38], ax
lea eax, [ebp - 0x38]
push 1
push eax
call fcn.00401b50
push 2
push 0x45e5b8
lea ecx, [ebp - 0x34]
call fcn.00403590
mov eax, dword [edi + 4]
cmp dword [edi + 8], eax
je 0x4041e4
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
movups xmm0, xmmword [ebp - 0x34]
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x24]
movq qword [eax + 0x10], xmm0
add dword [edi + 4], 0x18
jmp 0x404226
lea ecx, [ebp - 0x34]
push ecx
push eax
mov ecx, edi
call fcn.00403690
mov edx, dword [ebp - 0x20]
cmp edx, 8
jb 0x404226
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40421c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404250
push edx
push ecx
call fcn.00422d4e
add esp, 8
inc esi
cmp esi, 0x1a
jb 0x404160
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00422d0d
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.0043d6f9
int3
Function at 0x407960
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44cb70
mov eax, dword fs:[0]
push eax
sub esp, 0x2d4
mov eax, dword [0x46b074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x2dc], ebx
push 0x190
lea eax, [ebp - 0x2d8]
mov dword [ebx], 0
push 0
push eax
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
call fcn.0043a370
add esp, 0xc
lea eax, [ebp - 0x2d8]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x407b88
push 0x104
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.0043a370
add esp, 0xc
lea eax, [ebp - 0x118]
push 0x104
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
je 0x407b82
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 0x2e0], eax
test eax, eax
je 0x407b82
mov edi, dword [eax + 0xc]
xor esi, esi
movsx eax, word [eax + 0xa]
dec eax
test eax, eax
jle 0x407b82
nop word [eax + eax]
mov eax, dword [edi]
test eax, eax
je 0x407b82
push dword [eax]
add edi, 4
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov edx, eax
test edx, edx
je 0x407b6e
mov dword [ebp - 0x120], 0
lea ebx, [eax + 1]
mov dword [ebp - 0x11c], 0xf
mov byte [ebp - 0x130], 0
nop dword [eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407a80
sub eax, ebx
lea ecx, [ebp - 0x130]
push eax
push edx
call fcn.00409ab0
lea edx, [ebp - 0x130]
lea ecx, [ebp - 0x148]
call fcn.00405390
mov edx, dword [ebp - 0x11c]
cmp edx, 0x10
jb 0x407ae1
mov ecx, dword [ebp - 0x130]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x407ad7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407ba6
push edx
push ecx
call fcn.00422d4e
add esp, 8
cmp dword [ebp - 0x138], 0
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x11c], 0xf
mov byte [ebp - 0x130], 0
je 0x407b2c
lea edx, [ebp - 0x148]
mov ecx, edx
call fcn.00407bb0
mov ebx, dword [ebp - 0x2dc]
test al, al
je 0x407b32
lea eax, [ebp - 0x148]
mov ecx, ebx
push eax
call fcn.00403340
jmp 0x407b32
mov ebx, dword [ebp - 0x2dc]
mov edx, dword [ebp - 0x134]
cmp edx, 8
jb 0x407b6e
mov ecx, dword [ebp - 0x148]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407b64
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407ba6
push edx
push ecx
call fcn.00422d4e
add esp, 8
mov eax, dword [ebp - 0x2e0]
inc esi
movsx eax, word [eax + 0xa]
dec eax
cmp esi, eax
jl 0x407a40
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00422d0d
mov esp, ebp
pop ebp
ret
call fcn.0043d6f9
int3