joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45a810
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x2018
call fcn.0048f720
mov eax, dword [0x5750c8]
xor eax, esp
mov dword [esp + 0x2014], eax
mov eax, dword [ebp + 8]
push ebx
push edi
mov edi, ecx
push esi
mov dword [esp + 0x10], edi
mov dword [esp + 0x18], eax
call sym.FruitNinja.exe_zip_source_open
add esp, 4
test eax, eax
jns 0x45a886
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
push esi
call sym.FruitNinja.exe_zip_source_error
add esp, 0xc
add edi, 8
je 0x45a86f
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [edi], eax
mov dword [edi + 4], ecx
or eax, 0xffffffff
pop edi
pop ebx
mov ecx, dword [esp + 0x2014]
xor ecx, esp
call fcn.0045f06e
mov esp, ebp
pop ebp
ret
mov dword [esp + 0x10], 0
mov edi, edi
cmp dword [esi + 0x10], 0
je 0x45a9a4
mov eax, dword [esi]
push 1
push 0
lea edx, [esp + 0x20]
push 0x2000
push edx
test eax, eax
jne 0x45a8bc
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push eax
call ecx
add esp, 0x14
jmp 0x45a8db
mov ecx, dword [esi + 8]
mov edx, dword [esi + 4]
push ecx
push eax
call edx
add esp, 0x18
test edx, edx
jl 0x45a988
jg 0x45a8db
test eax, eax
jb 0x45a988
mov ebx, edx
mov edi, eax
test ebx, ebx
jl 0x45a92f
jg 0x45a8e9
test edi, edi
je 0x45a925
mov eax, dword [esp + 0x14]
push eax
push edi
lea ecx, [esp + 0x20]
push 1
push ecx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp eax, edi
je 0x45a890
call dword [sym.imp.MSVCR100.dll__errno]
mov ecx, dword [eax]
mov eax, dword [esp + 0xc]
add eax, 8
je 0x45a91d
mov dword [eax], 6
mov dword [eax + 4], ecx
mov dword [esp + 0x10], 0xffffffff
test ebx, ebx
jg 0x45a967
jl 0x45a92f
test edi, edi
jae 0x45a967
cmp dword [esp + 0x10], 0
jne 0x45a95f
mov edi, dword [esp + 0xc]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x18]
push eax
push esi
call sym.FruitNinja.exe_zip_source_error
add esp, 0xc
add edi, 8
je 0x45a95f
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x10], 0xffffffff
push esi
call sym.FruitNinja.exe_zip_source_close
mov ecx, dword [esp + 0x2020]
mov eax, dword [esp + 0x14]
add esp, 4
pop edi
pop ebx
xor ecx, esp
call fcn.0045f06e
mov esp, ebp
pop ebp
ret
cmp eax, 0xfffffffe
jne 0x45a99b
cmp edx, 0xffffffff
jne 0x45a99b
mov dword [esi + 0xc], 2
jmp 0x45a936
mov dword [esi + 0xc], 1
jmp 0x45a936
mov dword [esi + 0xc], 3
jmp 0x45a936
Function at 0x45a9b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5750c8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x18], esi
add esi, 8
mov edi, edx
push esi
mov eax, ebx
call fcn.0045bf10
add esp, 4
test eax, eax
js 0x45aa52
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x18]
test al, 1
je 0x45aaa4
push ebx
call dword [sym.imp.MSVCR100.dll_ftell]
mov dword [ebp - 0x18], eax
mov eax, edi
mov ecx, dword [eax + 0xc]
add esp, 4
push ecx
mov ecx, dword [eax + 8]
push ebx
mov edx, esi
lea edi, [ebp - 0x14]
call fcn.0045cc20
add esp, 8
test eax, eax
js 0x45aa52
mov edx, dword [ebp - 0x14]
push edx
push str._08lX
lea eax, [ebp - 0x10]
push 9
push eax
call dword [sym.imp.MSVCR100.dll_sprintf_s]
mov ecx, dword [ebp - 0x18]
push 0
add ecx, 0xfffffff8
push ecx
push ebx
call dword [sym.imp.MSVCR100.dll_fseek]
add esp, 0x1c
test eax, eax
jns 0x45aa65
call dword [sym.imp.MSVCR100.dll__errno]
mov eax, dword [eax]
test esi, esi
je 0x45aa52
mov dword [esi], 4
mov dword [esi + 4], eax
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045f06e
mov esp, ebp
pop ebp
ret
push ebx
push 1
lea edx, [ebp - 0x10]
push 8
push edx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp eax, 1
je 0x45aaa4
call dword [sym.imp.MSVCR100.dll__errno]
mov eax, dword [eax]
test esi, esi
je 0x45aa91
mov dword [esi], 6
mov dword [esi + 4], eax
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045f06e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.0045f06e
mov esp, ebp
pop ebp
ret

Function at 0x45ac20
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebx]
mov eax, esi
push edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x45ac30
sub eax, edx
add eax, 8
push eax
call dword [sym.imp.MSVCR100.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
jne 0x45ac63
lea eax, [ebx + 8]
test eax, eax
je 0x45ac5c
mov dword [eax], 0xe
mov dword [eax + 4], edi
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
push esi
push str._s.XXXXXX
push edi
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x180
push edi
call dword [sym.imp.MSVCR100.dll__mktemp]
add esp, 4
push eax
call dword [sym.imp.MSVCR100.dll__creat]
lea esi, [eax + 1]
neg esi
sbb esi, esi
and esi, eax
push 0x553b94
push esi
call dword [sym.imp.MSVCR100.dll__fdopen]
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x45acdf
call dword [sym.imp.MSVCR100.dll__errno]
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
add eax, 8
je 0x45acc0
mov dword [eax], 0xc
mov dword [eax + 4], ecx
push esi
call dword [sym.imp.MSVCR100.dll__close]
push edi
call dword [sym.imp.MSVCR100.dll_remove]
push edi
call dword [sym.imp.MSVCR100.dll_free]
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
push 0x8000
push ebx
call dword [sym.imp.MSVCR100.dll__fileno]
add esp, 4
push eax
call dword [sym.imp.MSVCR100.dll__setmode]
mov eax, dword [ebp + 0xc]
add esp, 8
mov dword [eax], ebx
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x45ba90
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
cmp eax, dword [ebx + 0x34]
jb 0x45bacf
ja 0x45baaf
mov esi, dword [ebp + 0xc]
cmp esi, dword [ebx + 0x30]
jb 0x45bad2
add ebx, 8
je 0x45bc39
mov dword [ebx], 0x12
mov dword [ebx + 4], 0
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
push ecx
push eax
lea edi, [ebx + 8]
push esi
mov ecx, ebx
call fcn.0045ba00
add esp, 0xc
mov dword [esp + 0xc], eax
test eax, eax
je 0x45bc39
test byte [ebp + 0x14], 8
jne 0x45bb49
mov eax, dword [ebx + 0x40]
lea edx, [esi*8]
sub edx, esi
lea ecx, [eax + edx*4]
mov eax, dword [ecx]
cmp eax, 2
je 0x45bb12
cmp eax, 3
jne 0x45bb49
mov esi, dword [ebp + 0x18]
mov ecx, dword [ecx + 4]
push esi
push ecx
call sym.FruitNinja.exe_zip_source_stat
add esp, 8
test eax, eax
jns 0x45bc03
test edi, edi
je 0x45bc39
mov dword [edi], 0xf
mov dword [edi + 4], 0
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 0x20]
test eax, eax
je 0x45bc28
mov eax, dword [eax + 4]
cdq
cmp dword [ebp + 0x10], edx
ja 0x45bc28
jb 0x45bb6b
cmp esi, eax
jae 0x45bc28
mov esi, dword [ebp + 0x18]
push esi
call sym.FruitNinja.exe_zip_stat_init
mov edx, dword [ebx + 0x20]
mov ecx, dword [edx]
mov eax, dword [ebp + 0xc]
shl eax, 6
mov edx, dword [ecx + eax + 0x10]
mov dword [esi + 0x30], edx
mov ecx, dword [ebx + 0x20]
mov edx, dword [ecx]
mov ecx, dword [edx + eax + 0x18]
mov dword [esi + 0x18], ecx
xor edx, edx
mov dword [esi + 0x1c], edx
mov ecx, dword [ebx + 0x20]
mov ecx, dword [ecx]
mov edi, dword [ecx + eax + 8]
mov dword [esi + 0x28], edi
mov ecx, dword [ecx + eax + 0xc]
mov dword [esi + 0x2c], ecx
mov ecx, dword [ebx + 0x20]
mov ecx, dword [ecx]
mov ecx, dword [ecx + eax + 0x14]
mov dword [esi + 0x20], ecx
mov dword [esi + 0x24], edx
mov ecx, dword [ebx + 0x20]
mov ecx, dword [ecx]
mov cx, word [ecx + eax + 6]
mov word [esi + 0x34], cx
mov ecx, dword [ebx + 0x20]
mov ecx, dword [ecx]
add esp, 4
test byte [ecx + eax + 4], 1
je 0x45bbf4
mov ecx, dword [ebx + 0x20]
mov ecx, dword [ecx]
test byte [ecx + eax + 4], 0x40
je 0x45bbe9
mov eax, 0xffff
jmp 0x45bbf6
mov ecx, 1
mov word [esi + 0x36], cx
jmp 0x45bbfa
xor eax, eax
mov word [esi + 0x36], ax
mov dword [esi], 0xfc
mov dword [esi + 4], edx
mov ecx, dword [ebp + 0xc]
mov eax, dword [esp + 0xc]
mov edx, dword [ebp + 0x10]
or dword [esi], 3
mov dword [esi + 0x10], ecx
mov ecx, dword [esi + 4]
mov dword [esi + 8], eax
mov dword [esi + 0x14], edx
mov dword [esi + 4], ecx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x45bc39
mov dword [edi], 0x12
mov dword [edi + 4], 0
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45bf10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, eax
push esi
call dword [sym.imp.MSVCR100.dll_ftell]
mov dword [edi + 0xc], eax
xor eax, eax
add esp, 4
mov dword [ebp - 8], eax
cmp dword [edi + 4], eax
jle 0x45bf5f
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ebx, dword [edi]
add ebx, dword [ebp - 4]
push eax
push 0
call fcn.0045c730
add esp, 8
test eax, eax
jne 0x45c096
mov eax, dword [ebp - 8]
add dword [ebp - 4], 0x40
inc eax
mov dword [ebp - 8], eax
cmp eax, dword [edi + 4]
jl 0x45bf34
push esi
call dword [sym.imp.MSVCR100.dll_ftell]
sub eax, dword [edi + 0xc]
add esp, 4
push esi
push 4
push 1
push 0x5548d0
mov dword [edi + 8], eax
call dword [sym.imp.MSVCR100.dll_fwrite]
mov ebx, dword [sym.imp.MSVCR100.dll_putc]
push esi
push 0
call ebx
push esi
push 0
call ebx
push esi
push 0
call ebx
push esi
push 0
call ebx
movzx eax, word [edi + 4]
mov dword [ebp - 8], eax
and eax, 0xff
push esi
push eax
call ebx
mov eax, dword [ebp - 8]
shr eax, 8
push esi
push eax
call ebx
movzx eax, word [edi + 4]
add esp, 0x40
mov dword [ebp - 8], eax
and eax, 0xff
push esi
push eax
call ebx
mov eax, dword [ebp - 8]
shr eax, 8
push esi
push eax
call ebx
mov eax, dword [edi + 8]
mov dword [ebp - 4], eax
and eax, 0xff
push esi
push eax
call ebx
mov ecx, dword [ebp - 4]
shr ecx, 8
and ecx, 0xff
push esi
push ecx
call ebx
mov edx, dword [ebp - 4]
shr edx, 0x10
and edx, 0xff
push esi
push edx
call ebx
mov eax, dword [ebp - 4]
shr eax, 0x18
push esi
push eax
call ebx
mov eax, dword [edi + 0xc]
mov dword [ebp - 4], eax
and eax, 0xff
push esi
push eax
call ebx
mov eax, dword [ebp - 4]
shr eax, 8
and eax, 0xff
push esi
push eax
call ebx
mov ecx, dword [ebp - 4]
add esp, 0x40
shr ecx, 0x10
and ecx, 0xff
push esi
push ecx
call ebx
mov eax, dword [ebp - 4]
shr eax, 0x18
push esi
push eax
call ebx
movzx eax, word [edi + 0x14]
mov dword [ebp - 8], eax
and eax, 0xff
push esi
push eax
call ebx
mov eax, dword [ebp - 8]
shr eax, 8
push esi
push eax
call ebx
movzx edx, word [edi + 0x14]
mov eax, dword [edi + 0x10]
push esi
push edx
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
push esi
call dword [sym.imp.MSVCR100.dll_ferror]
add esp, 0x34
test eax, eax
je 0x45c09f
call dword [sym.imp.MSVCR100.dll__errno]
mov ecx, dword [ebp + 8]
mov eax, dword [eax]
test ecx, ecx
je 0x45c096
mov dword [ecx], 6
mov dword [ecx + 4], eax
or eax, 0xffffffff
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45cb20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
lea eax, [edi + 1]
jne 0x45cb2e
mov eax, edi
push esi
push eax
call dword [sym.imp.MSVCR100.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
jne 0x45cb51
test ebx, ebx
je 0x45cb4c
mov dword [ebx], 0xe
mov dword [ebx + 4], eax
xor eax, eax
pop esi
pop ebp
ret
mov eax, dword [ebp + 8]
push eax
push edi
push 1
push esi
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
cmp eax, edi
jae 0x45cb8a
push esi
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
call dword [sym.imp.MSVCR100.dll__errno]
mov eax, dword [eax]
test ebx, ebx
je 0x45cb85
mov dword [ebx], 5
mov dword [ebx + 4], eax
xor eax, eax
pop esi
pop ebp
ret
cmp dword [ebp + 0xc], 0
je 0x45cbad
lea ecx, [esi + edi]
mov byte [ecx], 0
mov eax, esi
cmp esi, ecx
jae 0x45cbad
lea esp, [esp]
cmp byte [eax], 0
jne 0x45cba8
mov byte [eax], 0x20
inc eax
cmp eax, ecx
jb 0x45cba0
mov eax, esi
pop esi
pop ebp
ret

Function at 0x45cc20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x200c
call fcn.0048f720
mov eax, dword [0x5750c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push 0
push 0
mov esi, edx
push 0
mov ebx, ecx
mov dword [ebp - 0x2008], eax
mov dword [ebp - 0x200c], esi
call dword [sym.imp.zlibwapi.dll_Ordinal_3]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x2008]
push 0
push ecx
push edx
mov dword [edi], eax
call dword [sym.imp.MSVCR100.dll_fseek]
add esp, 0xc
test eax, eax
je 0x45cc9c
call dword [sym.imp.MSVCR100.dll__errno]
mov eax, dword [eax]
test esi, esi
je 0x45cc89
mov dword [esi], 4
mov dword [esi + 4], eax
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045f06e
mov esp, ebp
pop ebp
ret
test ebx, ebx
jle 0x45cce8
mov eax, 0x2000
cmp ebx, 0x2000
jg 0x45ccaf
mov eax, ebx
mov ecx, dword [ebp - 0x2008]
push ecx
push eax
lea edx, [ebp - 0x2004]
push 1
push edx
call dword [sym.imp.MSVCR100.dll_fread]
mov esi, eax
add esp, 0x10
test esi, esi
je 0x45ccfa
mov ecx, dword [edi]
push esi
lea eax, [ebp - 0x2004]
push eax
push ecx
call dword [sym.imp.zlibwapi.dll_Ordinal_3]
sub ebx, esi
mov dword [edi], eax
test ebx, ebx
jg 0x45cca0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045f06e
mov esp, ebp
pop ebp
ret
call dword [sym.imp.MSVCR100.dll__errno]
mov ecx, dword [ebp - 0x200c]
mov eax, dword [eax]
test ecx, ecx
je 0x45cd15
mov dword [ecx], 5
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
or eax, 0xffffffff
pop ebx
call fcn.0045f06e
mov esp, ebp
pop ebp
ret
Function at 0x45ed10
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor esi, esi
xor edi, edi
cmp dword [ebp + 0x14], esi
jb 0x45edbd
ja 0x45ed2e
cmp dword [ebp + 0x10], esi
jbe 0x45edbd
mov ebx, dword [0x5b2bd0]
cmp dword [ebp + 0x18], 0
mov eax, dword [ebp + 0xc]
mov cl, byte [esi + eax]
jne 0x45ed5e
mov ax, word [edx + 0x10]
or ax, 2
movzx eax, ax
mov ebx, eax
xor ebx, 1
imul ebx, eax
sar ebx, 8
xor cl, bl
mov ebx, dword [0x5b2bd0]
mov eax, dword [ebp + 8]
test eax, eax
je 0x45ed68
mov byte [esi + eax], cl
mov eax, dword [edx + 8]
movzx ecx, cl
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ebx + ecx*4]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 0xc]
mov dword [edx + 8], ecx
mov ecx, dword [edx + 0x10]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 0xc], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [ebx + eax*4]
add esi, 1
adc edi, 0
mov dword [edx + 0x10], ecx
cmp edi, dword [ebp + 0x14]
jb 0x45ed34
ja 0x45edbd
cmp esi, dword [ebp + 0x10]
jb 0x45ed34
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x45f06e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5750c8]
jne 0x45f078
repz ret
jmp fcn.0045f624
Function at 0x464190
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x513bd8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5750c8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x44], 0
je 0x4642c2
cmp byte [edi + 0x4a], 0
je 0x4642c2
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffff
call edx
movzx eax, ax
mov ecx, 0xffff
cmp cx, ax
je 0x4642b6
mov ecx, 0xf
xor eax, eax
mov byte [ebp - 0x2c], 0
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 8
cmp ecx, 0x10
jae 0x464211
lea eax, [ebp - 0x2c]
mov byte [eax + 8], 0
mov dword [ebp - 4], 0
lea ebx, [edi + 0x4c]
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x18]
mov ecx, eax
cmp edx, 0x10
jae 0x464231
lea ecx, [ebp - 0x2c]
mov eax, ecx
add ecx, dword [ebp - 0x1c]
lea edx, [ebp - 0x30]
push edx
push ecx
mov ecx, dword [edi + 0x44]
push eax
push ebx
call dword [sym.imp.MSVCP100.dll_public:_int___thiscall_std::codecvt_wchar_t__char__int_::unshift_int___char___char___char___const]
sub eax, 0
je 0x464256
dec eax
je 0x46425a
sub eax, 2
lea ecx, [ebp - 0x2c]
jne 0x4642b1
jmp 0x4642bd
mov byte [edi + 0x4a], 0
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
cmp edx, 0x10
jae 0x46426a
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, ecx
je 0x464294
cmp edx, 0x10
jae 0x464279
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x4642ae
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [edi + 0x4a], 0
je 0x4642ba
test esi, esi
jne 0x464225
push esi
push 8
lea ecx, [ebp - 0x2c]
call fcn.004579a0
jmp 0x46421f
lea ecx, [ebp - 0x2c]
call fcn.00405c60
xor al, al
jmp 0x4642c4
lea ecx, [ebp - 0x2c]
call fcn.00405c60
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045f06e
mov esp, ebp
pop ebp
ret
Function at 0x4672e0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x514230
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x5750c8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
push 0x40
xor esi, esi
xor eax, eax
push 0x53d200
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x38], esi
mov word [ebp - 0x48], ax
call fcn.00463920
xor ecx, ecx
push 0xd
mov word [ebp - 0x2c], cx
push 0x53d1e4
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], esi
call fcn.00463920
lea edx, [ebp - 0x2c]
push edx
lea eax, [ebp - 0x48]
push eax
push reloc.WSOCK32.dll_accept
push edi
mov byte [ebp - 4], 1
call fcn.00467030
add esp, 0x10
cmp dword [ebp - 0x18], 8
jb 0x46737f
mov ecx, dword [ebp - 0x2c]
push ecx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
xor edx, edx
cmp dword [ebp - 0x34], 8
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], esi
mov word [ebp - 0x2c], dx
jb 0x4673a1
mov eax, dword [ebp - 0x48]
push eax
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045f06e
mov esp, ebp
pop ebp
ret

Function at 0x468119
Capabilities:
Terminate thread

Disassembly:
push 0xc
mov eax, 0x5144bc
call fcn.004679e1
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
call fcn.0046d5a9
cmp eax, ebx
je 0x468142
mov ecx, eax
call fcn.0046c84c
call fcn.0046c817
cmp dword [0x57c7c0], ebx
jne 0x468152
xor eax, eax
inc eax
jmp 0x468212
mov dword [0x57c7c0], ebx
mov esi, 0x57c7c8
mov ecx, esi
call fcn.00468f9c
mov ecx, esi
call fcn.00468cae
push 0xc8
push dword [0x57c7bc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x57c7bc]
cmp eax, ebx
je 0x468196
push 1
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
jne 0x468196
or dword [ebp - 0x14], 0xffffffff
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x53d2e8
call fcn.004077b0
mov byte [ebp - 4], 1
mov byte [ebp - 4], bl
mov ecx, esi
call fcn.004683a2
mov ecx, esi
call fcn.00469ae8
push 0x57c834
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov dword [0x57c850], ebx
mov dword [0x57c854], ebx
push 0x53d310
push 0x25
push 0x5757b0
call dword [sym.imp.MSVCR100.dll_strcpy_s]
add esp, 0xc
mov eax, dword [0x57c7bc]
cmp eax, ebx
je 0x4681f9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x57c7bc], ebx
mov dword [0x57c7b8], ebx
mov dword [0x57c7c4], ebx
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
call fcn.00467a86
ret
Function at 0x468226
Capabilities:
Create thread

Disassembly:
push 0x2c
mov eax, 0x5144e7
call fcn.00467a4d
mov dword [ebp - 0x1c], 0xf
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov byte [ebp - 0x30], bl
mov dword [ebp - 4], ebx
call fcn.0046d5a9
mov ecx, eax
mov dword [ebp - 0x38], ecx
cmp ecx, ebx
jne 0x46826b
push 2
pop edi
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp - 0x30]
call fcn.00405c10
mov eax, edi
jmp 0x46839c
call fcn.0046c82f
mov edi, eax
cmp edi, ebx
jne 0x46829d
mov esi, 0x57c7c8
mov ecx, esi
call fcn.00468ab6
mov edi, eax
cmp edi, ebx
jne 0x468295
mov ecx, esi
call fcn.00468e03
mov edi, eax
cmp edi, ebx
je 0x4682a4
mov ecx, dword [ebp - 0x38]
call fcn.0046c84c
call fcn.0046c817
jmp 0x468255
mov byte [ebp - 4], 1
cmp dword [0x57c7c0], ebx
je 0x4682c6
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp - 0x30]
call fcn.00405c10
xor eax, eax
jmp 0x46839c
xor edi, edi
inc edi
mov dword [0x57c7c0], edi
push 0x57c834
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x57c850], ebx
push ebx
push ebx
push ebx
push 0x467abe
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x57c7bc], eax
cmp eax, ebx
jne 0x468314
call fcn.00468119
or dword [ebp - 4], 0xffffffff
push ebx
push edi
lea ecx, [ebp - 0x30]
call fcn.00405c10
or eax, 0xffffffff
jmp 0x46839c
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x57c7c4], edi
jne 0x468367
lea eax, [ebp - 0x30]
push eax
mov ecx, esi
call fcn.00469883
mov dword [ebp - 0x34], eax
cmp eax, ebx
jne 0x468360
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x38], esp
lea eax, [ebp - 0x30]
push eax
call fcn.00407250
mov byte [ebp - 4], 2
mov byte [ebp - 4], 1
mov ecx, esi
call fcn.0046a0e8
mov dword [ebp - 0x34], eax
cmp eax, ebx
je 0x46836e
call fcn.00468119
jmp 0x46838b
mov eax, dword [0x57c7b8]
jmp 0x468359
mov dword [ebp - 4], ebx
jmp 0x46838b
or dword [ebp - 4], 0xffffffff
push ebx
push edi
lea ecx, [ebp - 0x30]
call fcn.00405c10
mov eax, dword [ebp - 0x34]
call fcn.00467aa9
ret

Function at 0x4683e3
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x1c
mov eax, 0x51452f
call fcn.004679e1
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x14], 0x1e
xor esi, esi
mov dword [ebp - 4], esi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push esi
push 1
push 1
push esi
push esi
push dword [0x5758a0]
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
jne 0x468464
cmp dword [ebp - 0x1c], 2
jne 0x468464
push 4
pop edi
mov dword [ebp - 0x20], edi
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
push esi
push str.TimeOut
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, esi
jne 0x46845d
cmp dword [ebp - 0x24], edi
je 0x468464
mov dword [ebp - 0x14], 0x1e
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 3
jb 0x468477
cmp eax, 0xb4
jbe 0x46847a
push 0x1e
pop eax
imul eax, eax, 0xa
mov ecx, dword [ebp - 0x28]
mov dword [ecx + 0x68], eax
call fcn.00467a86
ret
Function at 0x46849a
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x18
mov eax, 0x51454a
call fcn.004679e1
xor ebx, ebx
mov byte [ebp - 0x11], bl
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push 1
push 1
push ebx
push ebx
push dword [0x57589c]
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x468508
cmp dword [ebp - 0x1c], 2
jne 0x468508
push 4
pop esi
mov dword [ebp - 0x20], esi
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
push ebx
push dword [0x5758a4]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x468508
cmp dword [ebp - 0x24], esi
jne 0x468508
mov byte [ebp - 0x11], 1
jmp 0x468511
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x11]
call fcn.00467a86
ret 4