joyce8/EMBER2024-capa huggingface dataset:
Function at 0x443e80
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x5d5de8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x5dcd54], 0
jne 0x443efa
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x104]
push str.gPakInterfaceP__d
push eax
call fcn.0056ce56
add esp, 0xc
lea ecx, [ebp - 0x104]
push ecx
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push 4
push 0
push 0
push 0xf001f
push eax
mov dword [0x5dcd54], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x5dcd58], eax
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005697e2
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov edx, dword [0x5dcd58]
mov eax, dword [edx]
xor ecx, ebp
call fcn.005697e2
mov esp, ebp
pop ebp
ret

Function at 0x444010
Capabilities:
Read file on windows

Disassembly:
call fcn.00443e80
test eax, eax
je 0x44402d
mov eax, dword [0x5dcd58]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
push esi
push edi
push 1
push ebx
call eax
ret
mov ecx, dword [esi + 8]
push ecx
push edi
push 1
push ebx
call fcn.0056e1b9
add esp, 0x10
ret
Function at 0x4462f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x595df8
mov eax, dword fs:[0]
push eax
sub esp, 0x50
push ebx
push esi
push edi
mov eax, dword [0x5d5de8]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
cmp byte [esi + 0x50c], 0
je 0x4464f8
mov edi, 0x10
cmp dword [esi + 0x544], edi
jb 0x446341
mov eax, dword [esi + 0x530]
jmp 0x446347
lea eax, [esi + 0x530]
push 0x5a6e84
push eax
call fcn.0056cd31
mov ebx, eax
add esp, 8
test ebx, ebx
mov dword [esp + 0x24], ebx
je 0x4464f8
push ebx
push 1
lea eax, [esp + 0x20]
push 4
push eax
mov dword [esp + 0x28], 0x42beef78
call fcn.0056b245
push ebx
push 1
lea ecx, [esp + 0x34]
push 4
push ecx
mov dword [esp + 0x3c], 2
call fcn.0056b245
push ebx
push 1
lea edx, [esi + 8]
push 4
push edx
call fcn.0056b245
movzx eax, word [esi + 0x3ac]
push ebx
push 1
lea ecx, [esp + 0x58]
push 2
push ecx
mov dword [esp + 0x60], eax
call fcn.0056b245
mov eax, dword [esi + 0x3ac]
add esp, 0x40
cmp dword [esi + 0x3b0], edi
jb 0x4463d2
mov ecx, dword [esi + 0x39c]
jmp 0x4463d8
lea ecx, [esi + 0x39c]
push ebx
push eax
push 1
push ecx
call fcn.0056b245
add esp, 0x10
lea eax, [esp + 0x3c]
call fcn.004727c0
mov dword [esp + 0x68], 0
mov eax, dword [esi + 0x5a4]
lea edi, [esp + 0x3c]
call fcn.00472a50
mov edx, dword [esi + 0x5a0]
mov edi, dword [edx]
add esi, 0x59c
mov dword [esp + 0x30], edi
cmp esi, esi
mov eax, dword [esi + 4]
mov dword [esp + 0x38], eax
je 0x446427
call fcn.0056999e
cmp edi, dword [esp + 0x38]
je 0x446475
cmp edi, dword [esi + 4]
jne 0x446437
call fcn.0056999e
lea ebx, [edi + 8]
lea eax, [esp + 0x3c]
call fcn.00472a80
cmp edi, dword [esi + 4]
jne 0x44644d
call fcn.0056999e
mov eax, dword [edi + 0x24]
lea edi, [esp + 0x3c]
call fcn.00472a50
mov edi, dword [esp + 0x30]
cmp edi, dword [esi + 4]
jne 0x446467
call fcn.0056999e
mov ecx, dword [edi]
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x30], ecx
mov edi, ecx
jmp 0x446417
lea eax, [esp + 0x3c]
call fcn.00472e90
push ebx
push 1
lea edx, [esp + 0x1c]
push 4
push edx
mov dword [esp + 0x24], eax
call fcn.0056b245
mov eax, dword [esp + 0x24]
add esp, 0x10
push ebx
push 1
push eax
lea esi, [esp + 0x48]
call fcn.00472e60
push eax
call fcn.0056b245
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x484]
push ebx
push 1
lea edx, [esp + 0x40]
push 4
push edx
mov dword [esp + 0x48], ecx
call fcn.0056b245
add esp, 0x20
add esi, 0x548
push ebx
mov eax, esi
call fcn.00472e90
push eax
push 1
call fcn.00472e60
push eax
call fcn.0056b245
push ebx
call fcn.0056b4f2
add esp, 0x14
lea ecx, [esp + 0x3c]
call fcn.00472810
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x446c00
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp byte [esi + 0x3ec], 0
push edi
mov edi, dword [ebp + 8]
je 0x446c43
cmp dword [esi + 0x408], 0x10
mov ecx, dword [esi + 0x404]
jb 0x446c2a
mov eax, dword [esi + 0x3f4]
jmp 0x446c30
lea eax, [esi + 0x3f4]
push ecx
push eax
mov eax, dword [edi + 0x14]
push eax
push 0
mov ecx, edi
call fcn.0043b500
test eax, eax
je 0x446c96
mov cl, byte [ebp + 0xc]
push 0xffffffffffffffff
push 0
mov byte [esi + 0x3ed], cl
push edi
lea ecx, [esi + 0x3f0]
mov byte [esi + 0x3ec], 1
call fcn.0043b2f0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x40c], eax
cmp dword [edi + 0x18], 0x10
jb 0x446c7a
mov eax, dword [edi + 4]
jmp 0x446c7d
lea eax, [edi + 4]
push 1
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jle 0x446c9e
pop edi
mov al, 1
pop esi
pop ebp
ret 8
mov edx, dword [esi]
mov eax, dword [edx + 0x8c]
push edi
mov ecx, esi
call eax
pop edi
xor al, al
pop esi
pop ebp
ret 8
Function at 0x44ae32
Capabilities:
Hide graphical window

Disassembly:
fldz
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0xf0]
sub esp, 8
fstp qword [esp]
call edx
mov eax, dword [esi + 0x350]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esi]
mov eax, dword [edx + 0x30]
mov byte [esi + 0x340], 1
mov ecx, esi
pop esi
jmp eax

Function at 0x44b300
Capabilities:
Hide graphical window

Disassembly:
push edi
mov edi, ecx
cmp dword [edi + 0x33c], 0
je 0x44b323
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [edi + 0x33c]
je 0x44b323
mov byte [edi + 0x4fd], 1
pop edi
ret
cmp byte [edi + 0x341], 0
jne 0x44b321
mov al, 1
mov byte [edi + 0x342], al
mov byte [edi + 0x341], al
mov eax, dword [edi]
mov edx, dword [eax + 0x50]
mov ecx, edi
call edx
cmp byte [edi + 0x50d], 0
je 0x44b37c
mov eax, dword [edi]
fld qword [edi + 0xe0]
mov edx, dword [eax + 0xf0]
sub esp, 8
mov ecx, edi
fstp qword [esp]
call edx
fld qword [edi + 0xe8]
mov eax, dword [edi]
mov edx, dword [eax + 0xf4]
sub esp, 8
mov ecx, edi
fstp qword [esp]
call edx
cmp byte [edi + 0x4fe], 0
je 0x44b39e
push esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
lea esp, [esp]
push 0xa
call esi
cmp byte [edi + 0x4fe], 0
jne 0x44b390
pop esi
mov ecx, dword [edi + 0x374]
test ecx, ecx
je 0x44b3af
mov eax, dword [ecx]
mov edx, dword [eax + 0x18]
call edx
cmp byte [edi + 0x344], 0
jne 0x44b3d3
mov eax, dword [edi + 0x36c]
test eax, eax
je 0x44b3d3
cmp dword [eax + 0x58], 0
je 0x44b3d3
mov eax, dword [eax + 0x58]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x4c]
push eax
call edx
mov eax, dword [edi + 0x350]
test eax, eax
je 0x44b3e6
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.0044b410
cmp byte [edi + 0x378], 0
je 0x44b3fd
mov eax, dword [edi]
mov edx, dword [eax + 0x5c]
mov ecx, edi
call edx
pop edi
jmp fcn.004ef530
Function at 0x44c4f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x5d5de8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x5da850], 0
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, 0x5a730c
jne 0x44c51b
mov eax, 0x5a7310
push eax
push str.ScrError.txt
mov byte [0x5da850], 0
call fcn.0056cd31
mov esi, eax
add esp, 8
test esi, esi
je 0x44c570
cmp dword [edi + 0x18], 0x10
jb 0x44c541
mov edi, dword [edi + 4]
jmp 0x44c544
add edi, 4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea eax, [ebp - 0x204]
push eax
call fcn.0056dc1c
add esp, 4
push eax
push edi
push str._s__s__u_n
push esi
call fcn.0056d18e
push esi
call fcn.0056b4f2
add esp, 0x18
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.005697e2
mov esp, ebp
pop ebp
ret 4
Function at 0x450c00
Capabilities:
Create thread

Disassembly:
cmp byte [esi + 0x4f9], 0
jne 0x450c36
push 1
mov byte [esi + 0x4fc], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push esi
push 0
push 0x450b90
mov byte [esi + 0x4f9], 1
call fcn.0056bb93
add esp, 0xc
ret

Function at 0x450d70
Capabilities:
Create thread

Disassembly:
cmp byte [esi + 0x4fe], 0
jne 0x450d9f
push 1
mov byte [esi + 0x4fe], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push esi
push 0
push 0x450d50
call fcn.0056bb93
add esp, 0xc
ret
Function at 0x451ad0
Capabilities:
Hide graphical window
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x134
mov eax, dword [0x5d5de8]
xor eax, esp
mov dword [esp + 0x130], eax
push ebx
push esi
mov esi, ecx
cmp byte [esi + 0x341], 0
push edi
jne 0x451cab
call fcn.00450d70
cmp byte [esi + 0x4f8], 0
je 0x451b0f
call fcn.00450c00
mov eax, dword [esi + 0x350]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x350]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
push 1
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ebx, dword [sym.imp.WINMM.dll_timeGetTime]
call ebx
mov edx, dword [esi]
mov edi, eax
mov eax, dword [edx + 0x174]
mov ecx, esi
mov byte [esi + 0x4cd], 1
mov dword [esi + 0x474], edi
mov dword [esi + 0x478], edi
mov dword [esi + 0x410], edi
call eax
mov ecx, esi
call fcn.00451100
mov byte [esi + 0x4cd], 0
call fcn.00446e30
call ebx
sub eax, edi
test eax, eax
mov dword [esp + 0x34], eax
fild dword [esp + 0x34]
jge 0x451b8b
fadd qword [0x5ba7b0]
fdiv qword [0x5ba928]
sub esp, 8
lea ecx, [esp + 0x40]
fstp qword [esp]
push str.Seconds_________g_r_n
push ecx
call fcn.0056ce56
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x10
lea edx, [esp + 0x38]
push edx
call edi
mov eax, dword [esi + 0x47c]
push eax
lea ecx, [esp + 0x3c]
push str.Sleep_Count_____d_r_n
push ecx
call fcn.0056ce56
add esp, 0xc
lea edx, [esp + 0x38]
push edx
call edi
mov eax, dword [esi + 0x484]
push eax
lea ecx, [esp + 0x3c]
push str.Update_Count____d_r_n
push ecx
call fcn.0056ce56
add esp, 0xc
lea edx, [esp + 0x38]
push edx
call edi
mov eax, dword [esi + 0x480]
push eax
lea ecx, [esp + 0x3c]
push str.Draw_Count______d_r_n
push ecx
call fcn.0056ce56
add esp, 0xc
lea edx, [esp + 0x38]
push edx
call edi
mov eax, dword [esi + 0x4d4]
push eax
lea ecx, [esp + 0x3c]
push str.Draw_Time_______d_r_n
push ecx
call fcn.0056ce56
add esp, 0xc
lea edx, [esp + 0x38]
push edx
call edi
mov eax, dword [esi + 0x4f4]
push eax
lea ecx, [esp + 0x3c]
push str.Screen_Blt______d_r_n
push ecx
call fcn.0056ce56
add esp, 0xc
lea edx, [esp + 0x38]
push edx
call edi
mov eax, dword [esi + 0x4f4]
mov ecx, dword [esi + 0x4d4]
add ecx, eax
test ecx, ecx
jle 0x451c91
mov eax, dword [esi + 0x480]
imul eax, eax, 0x3e8
cdq
idiv ecx
lea edx, [esp + 0x38]
push eax
push str.Avg_FPS_________d_r_n
push edx
call fcn.0056ce56
add esp, 0xc
lea eax, [esp + 0x38]
push eax
call edi
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
mov edx, dword [esi]
mov eax, dword [edx + 0x54]
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x5c]
mov ecx, esi
call eax
mov ecx, dword [esp + 0x13c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005697e2
mov esp, ebp
pop ebp
ret
Function at 0x451fe0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5930b8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x5d5de8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
cmp byte [eax], 0x22
mov ebx, 1
jne 0x45202c
add eax, ebx
push 0x22
push eax
call fcn.0056d0d0
add esp, 8
test eax, eax
je 0x452074
add eax, ebx
test eax, eax
je 0x452074
push 0x20
push eax
call fcn.0056d0d0
add esp, 8
test eax, eax
je 0x452074
add eax, 1
push eax
lea ecx, [ebp - 0x28]
call fcn.00438950
mov dword [ebp - 4], 0
mov eax, dword [esi]
mov edx, dword [eax + 0xb0]
lea ecx, [ebp - 0x28]
push ecx
mov ecx, esi
call edx
cmp dword [ebp - 0x10], 0x10
jb 0x452074
mov eax, dword [ebp - 0x24]
push eax
call fcn.00569095
add esp, 4
mov byte [esi + 0xf2], bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4537e0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [eax + 0x50d], 0
jne 0x4538e3
mov eax, dword [eax + 0x350]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4538e3
push ebx
push edi
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, dword [esi + 0x14]
add eax, 1
push eax
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp dword [esi + 0x18], 0x10
lea ecx, [esi + 4]
mov dword [ebp - 4], ecx
jb 0x453839
mov ecx, dword [ecx]
mov edx, eax
jmp 0x453840
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
test al, al
jne 0x453840
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ebx, dword [sym.imp.USER32.dll_SetClipboardData]
push edi
push 1
call ebx
push edi
push 7
call ebx
push edi
push 0x10
call ebx
cmp dword [esi + 0x18], 0x10
mov eax, dword [esi + 0x14]
mov ecx, dword [ebp - 4]
jb 0x453878
mov ecx, dword [ecx]
push 0
push 0
push eax
push ecx
push 1
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
lea edx, [edi + edi + 2]
push edx
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp dword [esi + 0x18], 0x10
mov ecx, dword [esi + 0x14]
mov edx, dword [ebp - 4]
mov dword [ebp - 8], eax
jb 0x4538b4
mov edx, dword [edx]
push edi
push eax
push ecx
push edx
push 1
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 8]
push ebx
mov word [eax + edi*2], 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4538f0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5968d9
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push edi
mov eax, dword [0x5d5de8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov edi, ecx
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x18], esi
mov byte [esi + 4], bl
mov dword [ebp - 4], ebx
cmp byte [edi + 0x50d], bl
mov dword [ebp - 0x14], 1
jne 0x453985
mov eax, dword [edi + 0x350]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x453985
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
cmp edi, ebx
je 0x45397c
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp eax, ebx
je 0x45397c
push eax
mov ecx, esi
call fcn.00438a40
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov edi, dword [ebp - 0x10]
push edi
mov ecx, esi
call fcn.004465d0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4693b0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x5d5de8]
xor eax, ebp
mov dword [ebp - 4], eax
push str.IMAGEHLP.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [0x5dcda0], eax
jne 0x4693e7
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005697e2
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SymInitialize
push eax
call esi
test eax, eax
mov dword [0x5dcda4], eax
je 0x4694a5
mov eax, dword [0x5dcda0]
push str.SymSetOptions
push eax
call esi
test eax, eax
mov dword [0x5dcda8], eax
je 0x4694a5
mov ecx, dword [0x5dcda0]
push str.SymCleanup
push ecx
call esi
test eax, eax
mov dword [0x5dcdb0], eax
je 0x4694a5
mov edx, dword [0x5dcda0]
push str.UnDecorateSymbolName
push edx
call esi
test eax, eax
mov dword [0x5dcdac], eax
je 0x4694a5
mov eax, dword [0x5dcda0]
push str.StackWalk
push eax
call esi
test eax, eax
mov dword [0x5dcdb4], eax
je 0x4694a5
mov ecx, dword [0x5dcda0]
push str.SymFunctionTableAccess
push ecx
call esi
test eax, eax
mov dword [0x5dcdb8], eax
je 0x4694a5
mov edx, dword [0x5dcda0]
push str.SymGetModuleBase
push edx
call esi
test eax, eax
mov dword [0x5dcdbc], eax
je 0x4694a5
mov eax, dword [0x5dcda0]
push str.SymGetSymFromAddr
push eax
call esi
test eax, eax
mov dword [0x5dcdc0], eax
jne 0x4694b6
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005697e2
mov esp, ebp
pop ebp
ret
push 4
call dword [0x5dcda8]
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [ebp - 0x108]
push 0x2f
push edx
call fcn.0056ec00
add esp, 8
test eax, eax
jne 0x4694fc
lea eax, [ebp - 0x108]
push 0x5c
push eax
call fcn.0056ec00
add esp, 8
test eax, eax
je 0x4694ff
mov byte [eax], 0
lea edx, [ebp - 0x108]
mov eax, edx
lea esi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x469510
sub eax, esi
jne 0x46951f
xor edx, edx
push 1
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x5dcda4]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
pop esi
call fcn.005697e2
mov esp, ebp
pop ebp
ret
Function at 0x46b030
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push edi
mov edi, eax
push 0x1c
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x46b051
xor al, al
pop edi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push esi
mov esi, dword [ebp - 0x1c]
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x46b070
pop esi
xor al, al
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x3c]
movzx ecx, word [eax + esi + 0x14]
add eax, esi
lea ecx, [ecx + eax + 0x18]
movzx eax, word [eax + 6]
push ebx
sub edi, esi
xor ebx, ebx
test eax, eax
mov dword [ebp - 4], eax
jbe 0x46b0b4
lea eax, [ecx + 0x10]
mov edx, dword [eax]
mov esi, dword [eax - 8]
cmp edx, esi
mov ecx, dword [eax - 4]
ja 0x46b09f
mov edx, esi
cmp edi, ecx
jb 0x46b0a9
add edx, ecx
cmp edi, edx
jbe 0x46b0bd
add ebx, 1
add eax, 0x28
cmp ebx, dword [ebp - 4]
jb 0x46b091
pop ebx
pop esi
xor al, al
pop edi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
add ebx, 1
mov dword [edx], ebx
pop ebx
sub edi, ecx
mov dword [eax], edi
pop esi
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x46d680
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 2
mov dword [ebp - 8], eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
jne 0x46d6bd
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea ecx, [ebp - 0x10]
push ecx
call edi
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
push 0
push 0x64
push edx
push eax
call fcn.0057b870
add dword [ebp - 0x10], eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], ecx
adc dword [ebp - 0xc], edx
mov ebx, dword [ebp - 4]
rdtsc
mov dword [ebx], eax
mov dword [ebx + 4], edx
lea edx, [ebp - 0x20]
push edx
call edi
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0xc]
jl 0x46d6f0
jg 0x46d708
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp - 0x10]
jb 0x46d6f0
lea edx, [ebp - 0x18]
mov dword [ebp - 4], edx
mov ebx, dword [ebp - 4]
rdtsc
sub eax, dword [ebx]
sbb edx, dword [ebx + 4]
mov dword [ebx], eax
mov dword [ebx + 4], edx
mov eax, dword [ebp - 8]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
push 0
push 0x64
push ecx
push edx
call fcn.00578a90
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46d9d0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
lea eax, [ebp - 0x18]
push edi
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 4]
rdtsc
mov dword [ebx], eax
mov dword [ebx + 4], edx
xor esi, esi
cmp dword [0x5dcde0], esi
jle 0x46da41
xor ebx, ebx
mov edi, dword [0x611a90]
test edi, edi
je 0x46da1c
mov ecx, dword [0x611a94]
sub ecx, edi
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp esi, eax
jb 0x46da27
call fcn.0056999e
mov edi, dword [0x611a90]
lea ecx, [ebx + edi]
push ecx
call fcn.0046d880
add esi, 1
add esp, 4
add ebx, 0x18
cmp esi, dword [0x5dcde0]
jl 0x46d9f5
lea edx, [ebp - 0x10]
mov dword [0x5dcde0], 0
mov dword [ebp - 4], edx
mov ebx, dword [ebp - 4]
rdtsc
mov dword [ebx], eax
mov dword [ebx + 4], edx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
sbb ecx, dword [ebp - 0x14]
add dword [0x5dc438], eax
pop edi
pop esi
adc dword [0x5dc43c], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46de30
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, dword [0x611a88]
cmp eax, 0x270
jl 0x46def5
xor ecx, ecx
mov eax, dword [ecx*4 + 0x6110cc]
xor eax, dword [ecx*4 + 0x6110c8]
add ecx, 1
and eax, 0x7fffffff
xor eax, dword [ecx*4 + 0x6110c4]
mov edx, eax
shr eax, 1
and edx, 1
xor eax, dword [edx*4 + 0x5daac0]
xor eax, dword [ecx*4 + 0x6116f8]
cmp ecx, 0xe3
mov dword [ecx*4 + 0x6110c4], eax
jl 0x46de42
cmp ecx, 0x26f
jge 0x46dec1
lea ecx, [ecx*4 + 0x6110c8]
mov eax, dword [ecx + 4]
xor eax, dword [ecx]
add ecx, 4
and eax, 0x7fffffff
xor eax, dword [ecx - 4]
mov edx, eax
shr eax, 1
and edx, 1
xor eax, dword [edx*4 + 0x5daac0]
xor eax, dword [ecx - 0x390]
cmp ecx, 0x611a84
mov dword [ecx - 4], eax
jl 0x46de92
mov ecx, dword [0x611a84]
mov eax, dword [0x6110c8]
xor eax, ecx
and eax, 0x7fffffff
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
xor eax, dword [ecx*4 + 0x5daac0]
xor eax, dword [0x6116f8]
mov dword [0x611a84], eax
xor eax, eax
mov dword [0x611a88], eax
mov ecx, dword [eax*4 + 0x6110c8]
add eax, 1
mov edx, ecx
mov dword [0x611a88], eax
shr edx, 0xb
xor ecx, edx
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov edx, ecx
and edx, 0xffffdf8c
shl edx, 0xf
xor ecx, edx
mov eax, ecx
shr eax, 0x12
xor eax, ecx
and eax, 0x7fffffff
ret

Function at 0x46e220
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x324
push ebx
xor ebx, ebx
cmp byte [esi + 0xf6], bl
jne 0x46e306
jmp 0x46e240
cmp byte [ebp + 8], bl
mov dword [ebp - 0x110], ebx
mov dword [ebp - 0x218], ebx
je 0x46e267
mov eax, dword [esi + 8]
mov dword [ebp - 0x10c], eax
mov eax, 1
mov dword [ebp - 0x110], eax
jmp 0x46e26c
mov eax, 1
cmp byte [ebp + 0xc], bl
je 0x46e280
mov ecx, dword [esi + 8]
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x218], eax
mov edx, dword [esi + 8]
mov dword [ebp - 0x320], eax
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x320]
push ecx
mov dword [ebp - 0x31c], edx
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x110]
push eax
push 0x40
mov dword [ebp - 8], ebx
mov dword [ebp - 4], 0x186a0
call sub.WSOCK32.dll_select
cmp eax, 0xffffffff
je 0x46e30f
mov edx, dword [esi + 8]
lea ecx, [ebp - 0x320]
push ecx
push edx
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
jne 0x46e30f
mov ecx, dword [esi + 8]
lea eax, [ebp - 0x110]
push eax
push ecx
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
jne 0x46e306
mov eax, dword [esi + 8]
lea edx, [ebp - 0x218]
push edx
push eax
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
jne 0x46e306
cmp byte [esi + 0xf6], bl
je 0x46e240
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, 6
mov eax, esi
call fcn.0046e210
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x46ede0
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x5dcd5c]
test eax, eax
mov cl, 1
mov byte [0x611bcc], cl
je 0x46edfa
cmp byte [eax + 0x50d], 0
jne 0x46ee14
push 0x611ad8
push 0
push 0x46eb60
mov byte [0x611bcd], cl
call fcn.0056bb93
add esp, 0xc
ret