joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4226e3
Capabilities:
Get socket status
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x920
xor eax, eax
inc eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov esi, ebx
cmp dword [edi], eax
jne 0x422766
mov esi, dword [edi + 8]
mov dword [ebp - 0x120], eax
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
lea eax, [ebp - 0x120]
mov dword [ebp - 0x11c], esi
push eax
lea eax, [esi + 1]
mov dword [ebp - 0xc], ebx
push eax
mov dword [ebp - 8], ebx
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
js 0x42275d
je 0x422762
lea eax, [ebp - 0x120]
push eax
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x422762
lea eax, [ebp + 8]
push eax
push 0x4004667f
push esi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
jne 0x42275d
cmp dword [ebp + 8], ebx
je 0x42275d
push 2
jmp 0x42275f
push 4
pop esi
jmp 0x4227c0
mov esi, ebx
jmp 0x4227c0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x10
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push 0x800
lea eax, [ebp - 0x920]
push eax
push dword [edi + 0x28]
call dword [sym.imp.WS2_32.dll_recvfrom]
mov dword [ebp + 8], eax
test eax, eax
jle 0x4227c0
push 2
pop esi
push eax
push ebx
push dword [0x46d49c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 8]
push ecx
mov dword [edi + 0x30], ecx
lea ecx, [ebp - 0x920]
push ecx
push eax
mov dword [edi + 0x2c], eax
mov dword [edi + 0x34], eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x422da0
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
lea eax, [ebp - 0x100]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push 0xff
push eax
mov dword [0x46e344], esi
mov dword [0x46e354], esi
mov dword [0x46e358], edi
mov dword [0x46e35c], esi
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x422e4c
cmp edi, 0x10000000
jne 0x422e28
cmp dword [0x46da04], esi
je 0x422e4c
mov eax, dword [0x46da20]
test eax, eax
je 0x422e04
push eax
call dword [0x46da10]
mov dword [0x46da20], esi
push 0x46da20
push esi
push esi
lea eax, [ebp - 0x100]
push eax
call dword [0x46da0c]
test eax, eax
jne 0x422e4c
mov eax, dword [0x46da20]
mov dword [0x46e35c], eax
jmp 0x422e49
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x422e4c
push 0x10
push eax
push 0x46e348
call sub.MSVCRT.dll_memcpy
add esp, 0xc
xor esi, esi
inc esi
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x422f69
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, ebx
cmp dword [esi], 1
jne 0x422f8f
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
jmp 0x422fcc
cmp dword [esi + 0x2c], ebx
je 0x422fcc
mov edi, dword [ebp + 0x10]
cmp edi, dword [esi + 0x30]
jle 0x422f9f
mov edi, dword [esi + 0x30]
push edi
push dword [esi + 0x34]
push dword [ebp + 0xc]
call sub.MSVCRT.dll_memcpy
sub dword [esi + 0x30], edi
add esp, 0xc
add dword [esi + 0x34], edi
cmp dword [esi + 0x30], ebx
jne 0x422fcc
push dword [esi + 0x2c]
push ebx
push dword [0x46d49c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi + 0x2c], ebx
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x42305d
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
xor esi, esi
cmp eax, 0xffffffff
jne 0x423080
lea eax, [ebp + 0xc]
push eax
push 0x4004667f
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4230c7
push 2
push eax
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4230c0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2745
je 0x4230c4
cmp eax, 0x2746
je 0x4230c4
cmp eax, 0x2749
je 0x4230c4
cmp eax, 0x274a
je 0x4230c4
xor esi, esi
jmp 0x4230c7
test esi, esi
jne 0x4230c7
push 0xfffffffffffffffe
pop esi
mov eax, esi
pop esi
pop ebp
ret 0xc

Function at 0x423559
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
lea eax, [ebp - 0x40]
push 0x40
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
cmp dword [ebp + 8], 6
jne 0x42358a
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x60]
jmp 0x42360c
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x4235e6
mov eax, dword [ebp + 8]
sub eax, 0
je 0x4235de
dec eax
je 0x4235d6
dec eax
je 0x4235ce
dec eax
je 0x4235c6
dec eax
je 0x4235be
dec eax
jne 0x4235e6
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
jmp 0x42360e
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
jmp 0x42360e
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
jmp 0x42360e
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
jmp 0x42360e
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
jmp 0x42360e
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
jmp 0x42360e
cmp dword [ebp + 8], 7
jne 0x42360a
push 0x2c
lea eax, [ebp - 0x90]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call sub.PSAPI.DLL_GetProcessMemoryInfo
test eax, eax
je 0x42360a
mov eax, dword [ebp - 0x68]
jmp 0x42360c
xor eax, eax
xor edx, edx
mov esp, ebp
pop ebp
ret 4
Function at 0x423696
Capabilities:
Check if file exists

Disassembly:
xor eax, eax
push ebp
mov ebp, eax
mov eax, dword [0x46da3c]
push esi
test eax, eax
jne 0x4236bb
push fcn.004237c3
push 0x10
push 0x258
call fcn.00427acc
mov dword [0x46da3c], eax
push dword [esp + 0xc]
push eax
call fcn.00427a38
mov esi, eax
test esi, esi
je 0x4237bc
push edi
mov edi, dword [esp + 0x14]
test edi, edi
jne 0x4236dd
mov edi, 0x45f070
push ebx
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x4236ed
xor eax, eax
cmp word [ebx], ax
jne 0x4236f2
mov ebx, 0x45f1ac
push edi
call sub.MSVCRT.dll_wcslen
push ebx
mov dword [esp + 0x24], eax
call sub.MSVCRT.dll_wcslen
add eax, dword [esp + 0x24]
pop ecx
pop ecx
lea eax, [eax*2 + 4]
push eax
xor eax, eax
push eax
push dword [0x46d49c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x18], eax
test eax, eax
je 0x4237a3
push edi
push eax
call sub.MSVCRT.dll_wcscpy
mov eax, dword [esp + 0x24]
pop ecx
pop ecx
test eax, eax
je 0x423753
cmp word [edi + eax*2 - 2], 0x5c
mov edi, dword [esp + 0x18]
je 0x423757
push 0x45f1b4
push edi
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
jmp 0x423757
mov edi, dword [esp + 0x18]
push ebx
push edi
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea eax, [esi + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x42377b
xor eax, eax
mov ebp, esi
mov dword [esi + 4], eax
jmp 0x423791
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x42378f
mov dword [esi + 4], 1
mov ebp, esi
xor eax, eax
push edi
push eax
push dword [0x46d49c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebp, ebp
jne 0x4237ba
cmp dword [esp + 0x14], 0xffffffff
je 0x4237ae
mov esi, dword [esp + 0x14]
push esi
push dword [0x46da3c]
call fcn.004279aa
pop ebx
pop edi
pop esi
mov eax, ebp
pop ebp
ret 0xc

Function at 0x423a54
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
cmp dword [ebp + 8], 0
je 0x423acc
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [ebp - 4], ax
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_wcslen
lea ecx, [ebp - 0x20c]
add esp, 0x10
lea eax, [ecx + eax*2]
jmp 0x423aad
movzx ecx, word [eax - 2]
cmp ecx, 0x20
je 0x423aaa
cmp ecx, 0x5c
je 0x423aaa
cmp ecx, 0x2f
jne 0x423ab7
add eax, 0xfffffffe
lea ecx, [ebp - 0x20c]
cmp eax, ecx
ja 0x423a97
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x423ace
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x423e78
Capabilities:
Copy file

Disassembly:
cmp dword [esp + 4], 0
je 0x423e98
cmp dword [esp + 8], 0
je 0x423e98
push 0
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
jmp 0x423e9a
xor eax, eax
ret 8

Function at 0x423f41
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push edi
xor edi, edi
cmp dword [ebp + 8], edi
je 0x424016
push ebx
push edi
push pe_nt_image_headers32
push 3
push edi
push 3
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x424015
push esi
mov esi, dword [ebp + 0x10]
push esi
call fcn.0042580c
push esi
mov word [ebp - 0x20], ax
call fcn.00425832
push esi
mov word [ebp - 0x1e], ax
call fcn.00425854
push esi
mov word [ebp - 0x1c], ax
call fcn.00425875
push esi
mov word [ebp - 0x1a], ax
call fcn.00425896
push esi
mov word [ebp - 0x18], ax
call fcn.004258b7
push esi
mov word [ebp - 0x16], ax
call fcn.004258d8
mov word [ebp - 0x14], ax
xor eax, eax
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
cmp dword [ebp + 0xc], 1
mov eax, edi
mov ecx, edi
pop esi
jne 0x423ff4
lea eax, [ebp - 8]
jmp 0x424002
cmp dword [ebp + 0xc], 2
jne 0x423fff
lea ecx, [ebp - 8]
jmp 0x424002
lea edi, [ebp - 8]
push ecx
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x424038
Capabilities:
Delete file
Set file attributes

Disassembly:
cmp dword [esp + 4], 0
je 0x424061
test byte [esp + 8], 2
je 0x424055
push pe_nt_image_headers32
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x424063
xor eax, eax
ret 8

Function at 0x4240f0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [esi + 0x14], 0
jne 0x42412c
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 4
xor eax, eax
pop esi
pop ecx
ret 4
Function at 0x424b20
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
cmp dword [esi + 0x14], 0
jne 0x424b41
push esi
call fcn.004240f0
mov dword [esi + 0x14], 1
mov dword [esi + 0xc], 0
mov ebx, dword [esi + 0xc]
mov edi, dword [esp + 0x18]
mov eax, dword [esi + 0x10]
cmp ebx, edi
jl 0x424bb5
add eax, dword [esi + 4]
mov ecx, edi
sub eax, ebx
dec ecx
je 0x424ba2
dec ecx
je 0x424b8d
sub ecx, 2
je 0x424b7a
push edi
push eax
push dword [esp + 0x1c]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
mov ecx, dword [eax]
mov eax, dword [esp + 0x14]
mov dword [eax], ecx
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
mov cx, word [eax]
mov eax, dword [esp + 0x14]
mov word [eax], cx
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
mov ecx, dword [esp + 0x14]
mov dl, byte [eax]
mov eax, edi
mov byte [ecx], dl
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
push ebp
mov ebp, dword [esp + 0x18]
sub eax, ebx
add eax, dword [esi + 4]
push ebx
push eax
push ebp
call sub.MSVCRT.dll_memcpy
mov eax, dword [esi + 8]
add esp, 0xc
sub edi, ebx
add ebp, ebx
push 0
cmp edi, eax
jl 0x424bfa
lea eax, [esp + 0x18]
push eax
push edi
push ebp
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
pop ebp
pop edi
mov dword [esi + 0xc], 0
add eax, ebx
pop esi
pop ebx
ret 0xc
lea ecx, [esp + 0x18]
push ecx
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
cmp edi, eax
jle 0x424c1b
mov edi, eax
push edi
push dword [esi + 4]
push ebp
call sub.MSVCRT.dll_memcpy
sub dword [esi + 0xc], edi
lea eax, [ebx + edi]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x424c40
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
mov dword [esp + 4], 0
cmp dword [esi + 0x1c], 0
jne 0x424d47
cmp dword [esi + 0x14], 1
jne 0x424c8b
mov eax, dword [esi + 0xc]
lea ecx, [esp + 0xc]
push 1
neg eax
cdq
push ecx
push eax
push dword [esi]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esi + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
push edi
mov edi, dword [esp + 0x20]
cmp eax, edi
jle 0x424d08
mov ecx, dword [esi + 8]
add ecx, dword [esi + 4]
sub ecx, eax
mov eax, edi
dec eax
je 0x424cf3
dec eax
je 0x424cdc
sub eax, 2
je 0x424cc7
push edi
push dword [esp + 0x20]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov ax, word [eax]
mov word [ecx], ax
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov al, byte [eax]
mov byte [ecx], al
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
push esi
call fcn.004240f0
mov eax, dword [esi + 8]
cmp edi, eax
jl 0x424d35
push 0
lea eax, [esp + 0xc]
push eax
push edi
push dword [esp + 0x28]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
add esp, 0xc
ret 0xc
mov ecx, dword [esi + 4]
sub ecx, dword [esi + 0xc]
push edi
push dword [esp + 0x20]
add ecx, eax
jmp 0x424cb1
xor eax, eax
pop esi
add esp, 0xc
ret 0xc
Function at 0x425270
Capabilities:
Read file on windows

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [edi + 4], 0
je 0x425297
push 1
lea eax, [esp + 0x10]
push eax
push edi
call fcn.00424b20
mov dword [esp + 4], eax
jmp 0x4252b1
push 0
lea eax, [esp + 8]
push eax
push 1
lea eax, [esp + 0x18]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 4]
cmp eax, 1
je 0x4252bd
xor eax, eax
pop edi
pop ecx
ret 8
mov cl, byte [esp + 0xc]
test cl, cl
js 0x4252d9
mov eax, dword [esp + 0x10]
pop edi
mov byte [eax], cl
mov byte [eax + 1], 0
mov eax, 1
pop ecx
ret 8
mov al, cl
and al, 0xe0
push esi
cmp al, 0xc0
jne 0x4252e9
mov esi, 2
jmp 0x425305
mov al, cl
and al, 0xf0
cmp al, 0xe0
jne 0x4252f8
mov esi, 3
jmp 0x425305
mov al, cl
and al, 0xf8
cmp al, 0xf0
jne 0x425362
mov esi, 4
mov edx, dword [esp + 0x14]
mov byte [edx], cl
cmp dword [edi + 4], 0
je 0x425334
lea eax, [esi - 1]
push eax
lea eax, [edx + 1]
push eax
push edi
call fcn.00424b20
mov edx, eax
lea ecx, [esi - 1]
xor eax, eax
cmp edx, ecx
setne al
dec eax
and eax, esi
pop esi
pop edi
pop ecx
ret 8
push 0
lea eax, [esp + 0xc]
push eax
lea eax, [esi - 1]
push eax
lea eax, [edx + 1]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [esp + 8]
lea ecx, [esi - 1]
xor eax, eax
cmp edx, ecx
setne al
dec eax
and eax, esi
pop esi
pop edi
pop ecx
ret 8
mov eax, dword [esp + 0x14]
pop esi
pop edi
mov word [eax], 0x3f
mov eax, 1
pop ecx
ret 8

Function at 0x425b9c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x14], edi
je 0x425bfa
add ebx, 2
lea eax, [ebx*2 + 2]
push eax
push edi
push dword [0x46d49c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x425bfa
cmp dword [ebp + 0xc], 0
je 0x425be9
push dword [ebp + 0xc]
push edi
call sub.MSVCRT.dll_wcscpy
push 0x45f1dc
push edi
call sub.MSVCRT.dll_wcscat
add esp, 0x10
jmp 0x425bf6
push 0x45f1dc
push edi
call sub.MSVCRT.dll_wcscpy
pop ecx
pop ecx
mov esi, edi
jmp 0x425bfd
mov esi, dword [ebp + 0xc]
push 0
lea eax, [ebp + 0x10]
push eax
push ebx
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
test eax, eax
jne 0x425c64
mov eax, dword [0x46bd04]
dec eax
dec eax
je 0x425c3e
sub eax, 0x16
je 0x425c36
push 0
lea eax, [ebp + 0x10]
push eax
lea eax, [ebx + ebx]
push eax
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x425c64
push esi
call fcn.0045ea90
jmp 0x425c44
push esi
call fcn.0045eb30
mov esi, eax
lea eax, [ebp + 0x10]
push 0
push eax
push esi
call sub.MSVCRT.dll_strlen
pop ecx
push eax
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call fcn.0045ea80
test edi, edi
je 0x425c77
push edi
push 0
push dword [0x46d49c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x425dfb
Capabilities:
Hash data using sha1

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [esp + 8]
and dword [ecx + 0x18], 0
and dword [ecx + 0x14], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x10], 0xc3d2e1f0
mov dword [ecx + 0x5c], eax
ret

Function at 0x427888
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push dword [0x46df60]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
jne 0x4278e9
push esi
push dword [0x46df5c]
push 8
push dword [0x46d49c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
push edi
push dword [0x46df60]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esi, dword [0x46df58]
jmp 0x4278d9
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x4278d7
mov eax, dword [esi + 8]
add eax, edi
push eax
call ecx
pop ecx
mov esi, dword [esi]
test esi, esi
jne 0x4278c7
push edi
push 0x427826
call fcn.0045e7f0
pop esi
mov eax, dword [esp + 8]
add eax, edi
pop edi
ret 4

Function at 0x4278f3
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
mov ecx, esi
push edi
and ecx, 3
je 0x427909
push 4
pop eax
sub eax, ecx
add esi, eax
mov eax, dword [0x46df5c]
mov ebx, dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x427940
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
push 8
push dword [0x46d49c]
mov dword [0x46df60], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
push dword [0x46df60]
call ebx
mov eax, dword [0x46df5c]
mov edi, eax
add eax, esi
push eax
push dword [0x46df60]
mov dword [0x46df5c], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
push 8
push dword [0x46d49c]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ebp, eax
push ebp
push dword [0x46df60]
call ebx
mov esi, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
test esi, esi
jne 0x427980
test ebx, ebx
je 0x4279a1
push 0x14
push 0x46df58
call fcn.00428206
pop ecx
pop ecx
mov dword [eax], edi
mov dword [eax + 4], esi
mov dword [eax + 8], ebx
test esi, esi
je 0x4279a1
lea ecx, [edi + ebp]
push ecx
call esi
pop ecx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x428ac0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x46bd08]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 8]
sub edx, dword [ebp + 0xc]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x428b06
mov ecx, dword [ebp - 4]
add ecx, 0xa
push ecx
push 0
mov edx, dword [0x46e3c4]
push edx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
jmp 0x428b27
mov edx, dword [ebp - 4]
add edx, 0xa
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push 0
mov edx, dword [0x46e3c4]
push edx
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
shr edx, 1
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
add ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call fcn.00428ea0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
mov dword [ecx + 8], edx
mov esp, ebp
pop ebp
ret 8

Function at 0x428be0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x46bd08]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
mov edx, dword [ebp - 4]
add eax, dword [edx + 8]
mov esp, ebp
pop ebp
ret

Function at 0x428c10
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x46bd08]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
add edx, 2
mov eax, dword [ebp - 4]
mov dword [eax + 8], edx
mov esp, ebp
pop ebp
ret

Function at 0x428d40
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x46bd08]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
cmp edx, dword [ecx]
jb 0x428d7e
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 8]
cmp dword [ebp + 8], ecx
ja 0x428d7e
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
sub ecx, dword [eax]
add ecx, 1
mov eax, ecx
jmp 0x428d80
xor eax, eax
mov esp, ebp
pop ebp
ret 4