joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42bbf0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x507829
mov eax, dword fs:[0]
push eax
sub esp, 0x3b8
mov eax, dword [0x546190]
xor eax, esp
mov dword [esp + 0x3b0], eax
push ebx
push esi
push edi
mov eax, dword [0x546190]
xor eax, esp
push eax
lea eax, [esp + 0x3c8]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
mov edi, ecx
mov dword [esp + 0x14], eax
xor esi, esi
lea ecx, [ecx]
cmp byte [edi + 0x14], bl
je 0x42bc97
mov ecx, dword [ebp + 0xc]
mov edx, dword [esp + 0x14]
mov eax, dword [edi + 0x10]
push ebx
sub ecx, esi
push ecx
add edx, esi
push edx
push eax
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x42bd3f
add esi, eax
cmp eax, ebx
jle 0x42bc71
cmp esi, dword [ebp + 0xc]
jl 0x42bc40
mov ecx, dword [esp + 0x3c8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3b0]
xor ecx, esp
call fcn.004ffd1c
mov esp, ebp
pop ebp
ret 8
push 0x24
mov esi, 0xf
push str.Trying_to_send_to_unconnected_socket
lea ecx, [esp + 0x24]
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], esi
call fcn.00439740
mov dword [esp + 0x3d0], ebx
mov dword [esp + 0x21c], ebx
mov dword [esp + 0x220], esi
mov byte [esp + 0x20c], bl
push 0x401440
push 0x43a620
push 0xa
push 0x28
lea ecx, [esp + 0x23c]
push ecx
mov byte [esp + 0x3e4], 1
call fcn.004ffe55
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x24]
push edx
lea ecx, [esp + 0x218]
mov byte [esp + 0x3dc], 2
call fcn.00439650
mov dword [esp + 0x224], ebx
sub esp, 0x1b0
lea eax, [esp + 0x3bc]
mov dword [esp + 0x1c4], esp
mov ecx, esp
push eax
mov byte [esp + 0x584], 3
call fcn.00438600
call fcn.004036c0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
mov esi, 0xf
mov edi, 1
mov dword [esp + 0x34], ebx
fst qword [esp + 0x14]
mov dword [esp + 0x38], esi
fstp qword [esp + 0x1c]
mov byte [esp + 0x24], bl
mov dword [esp + 0x3c], edi
push 0x17
mov dword [esp + 0x3d4], 4
push str.Send_failed__error:_0
lea ecx, [esp + 0x4c]
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], esi
call fcn.00439740
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x70], esi
mov byte [esp + 0x5c], bl
push 0x401440
push 0x43a620
push 0xa
push 0x28
lea ecx, [esp + 0x8c]
push ecx
mov byte [esp + 0x3e4], 6
call fcn.004ffe55
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x4c]
push edx
lea ecx, [esp + 0x68]
mov byte [esp + 0x3dc], 7
call fcn.00439650
fld qword [esp + 0x14]
push 0xffffffffffffffff
fstp qword [esp + 0x80]
push ebx
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x90]
mov dword [esp + 0x80], edi
call fcn.00439650
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x9c], ecx
sub esp, 0x1b0
lea edx, [esp + 0x20c]
mov dword [esp + 0x1c4], esp
mov ecx, esp
push edx
mov byte [esp + 0x584], 8
call fcn.00438600
call fcn.004036c0
int3
Function at 0x42be40
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x507829
mov eax, dword fs:[0]
push eax
sub esp, 0x3b8
mov eax, dword [0x546190]
xor eax, esp
mov dword [esp + 0x3b0], eax
push ebx
push esi
push edi
mov eax, dword [0x546190]
xor eax, esp
push eax
lea eax, [esp + 0x3c8]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
mov edi, ecx
mov dword [esp + 0x14], eax
xor esi, esi
lea ecx, [ecx]
cmp byte [edi + 0x14], bl
je 0x42bee9
mov ecx, dword [ebp + 0xc]
mov edx, dword [esp + 0x14]
mov eax, dword [edi + 0x10]
push ebx
sub ecx, esi
push ecx
add edx, esi
push edx
push eax
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x42bf91
add esi, eax
cmp eax, ebx
jle 0x42bec1
cmp esi, dword [ebp + 0xc]
jl 0x42be90
mov eax, esi
mov ecx, dword [esp + 0x3c8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3b0]
xor ecx, esp
call fcn.004ffd1c
mov esp, ebp
pop ebp
ret 8
push 0x26
mov esi, 0xf
push str.Trying_to_recv_from_unconnected_socket
lea ecx, [esp + 0x24]
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], esi
call fcn.00439740
mov dword [esp + 0x3d0], ebx
mov dword [esp + 0x21c], ebx
mov dword [esp + 0x220], esi
mov byte [esp + 0x20c], bl
push 0x401440
push 0x43a620
push 0xa
push 0x28
lea ecx, [esp + 0x23c]
push ecx
mov byte [esp + 0x3e4], 1
call fcn.004ffe55
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x24]
push edx
lea ecx, [esp + 0x218]
mov byte [esp + 0x3dc], 2
call fcn.00439650
mov dword [esp + 0x224], ebx
sub esp, 0x1b0
lea eax, [esp + 0x3bc]
mov dword [esp + 0x1c4], esp
mov ecx, esp
push eax
mov byte [esp + 0x584], 3
call fcn.00438600
call fcn.004036c0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
mov esi, 0xf
mov edi, 1
mov dword [esp + 0x34], ebx
fst qword [esp + 0x14]
mov dword [esp + 0x38], esi
fstp qword [esp + 0x1c]
mov byte [esp + 0x24], bl
mov dword [esp + 0x3c], edi
push 0x1a
mov dword [esp + 0x3d4], 4
push str.Receive_failed__error:_0
lea ecx, [esp + 0x4c]
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], esi
call fcn.00439740
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x70], esi
mov byte [esp + 0x5c], bl
push 0x401440
push 0x43a620
push 0xa
push 0x28
lea ecx, [esp + 0x8c]
push ecx
mov byte [esp + 0x3e4], 6
call fcn.004ffe55
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x4c]
push edx
lea ecx, [esp + 0x68]
mov byte [esp + 0x3dc], 7
call fcn.00439650
fld qword [esp + 0x14]
push 0xffffffffffffffff
fstp qword [esp + 0x80]
push ebx
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x90]
mov dword [esp + 0x80], edi
call fcn.00439650
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x9c], ecx
sub esp, 0x1b0
lea edx, [esp + 0x20c]
mov dword [esp + 0x1c4], esp
mov ecx, esp
push edx
mov byte [esp + 0x584], 8
call fcn.00438600
call fcn.004036c0
int3
Function at 0x42c090
Capabilities:
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x507782
mov eax, dword fs:[0]
push eax
sub esp, 0x368
mov eax, dword [0x546190]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x370], esi
mov dword [esi + 4], ebx
lea eax, [ebp - 0x368]
push eax
mov dword [ebp - 4], ebx
push 0x202
mov dword [esi], vtable.net::InetSocket.0
mov byte [esi + 0xc], bl
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x42c179
push 0x11
mov esi, 0xf
push str.WSAStartup_failed
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], esi
call fcn.00439740
mov dword [ebp - 0x1c8], ebx
mov dword [ebp - 0x1c4], esi
mov byte [ebp - 0x1d8], bl
push 0x401440
push 0x43a620
push 0xa
push 0x28
lea ecx, [ebp - 0x1b8]
push ecx
mov byte [ebp - 4], 2
call fcn.004ffe55
push 0xffffffffffffffff
push ebx
lea edx, [ebp - 0x28]
push edx
lea ecx, [ebp - 0x1d8]
mov byte [ebp - 4], 3
call fcn.00439650
mov dword [ebp - 0x1c0], ebx
sub esp, 0x1b0
lea eax, [ebp - 0x1d8]
mov ecx, esp
mov dword [ebp - 0x36c], esp
push eax
mov byte [ebp - 4], 4
call fcn.00401420
call fcn.004036c0
mov eax, dword [ebp - 0x368]
cmp al, 2
jne 0x42c1b5
shr eax, 8
cmp al, 2
jne 0x42c1b5
push ebx
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 8], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ffd1c
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
push 0x19
push str.Incorrect_WinSock_version
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
call fcn.00439740
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x1d8]
mov byte [ebp - 4], 5
call fcn.00438880
sub esp, 0x1b0
mov ecx, esp
mov dword [ebp - 0x36c], esp
push eax
mov byte [ebp - 4], 6
call fcn.00401420
call fcn.004036c0
int3
Function at 0x42c9b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5094e2
mov eax, dword fs:[0]
push eax
sub esp, 0x248
mov eax, dword [0x546190]
xor eax, esp
mov dword [esp + 0x240], eax
push ebx
push esi
push edi
mov eax, dword [0x546190]
xor eax, esp
push eax
lea eax, [esp + 0x258]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov esi, ecx
mov eax, dword [esi + 0x2c]
mov ecx, dword [ebp + 8]
xor ebx, ebx
mov dword [esp + 0x14], edi
cmp eax, ebx
jl 0x42ca0f
cmp edi, eax
jle 0x42ca0f
mov edi, eax
mov dword [esp + 0x14], eax
mov eax, dword [esi + 8]
push eax
push edi
push 1
push ecx
mov dword [esp + 0x28], eax
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
mov dword [esp + 0x10], eax
cmp eax, edi
jge 0x42cb11
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.MSVCR100.dll_ferror]
add esp, 4
test eax, eax
je 0x42cb0d
mov edx, dword [esi]
mov edx, dword [edx + 0x14]
lea eax, [esp + 0x84]
push eax
mov ecx, esi
call edx
mov dword [esp + 0x260], ebx
mov esi, 0xf
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], esi
mov byte [esp + 0x3c], bl
push 0xffffffffffffffff
push ebx
mov byte [esp + 0x268], 1
push eax
lea ecx, [esp + 0x48]
mov dword [esp + 0x60], 2
call fcn.00439650
fild dword [esp + 0x14]
mov dword [esp + 0x74], ebx
mov dword [esp + 0x78], esi
fstp qword [esp + 0x5c]
mov byte [esp + 0x64], bl
mov dword [esp + 0x7c], 1
push 0x21
mov byte [esp + 0x264], 3
push str.Failed_to_read_1_bytes_from_0
lea ecx, [esp + 0x24]
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], esi
call fcn.00439740
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x60]
push ecx
lea edx, [esp + 0x24]
push edx
lea ecx, [esp + 0xa8]
mov byte [esp + 0x26c], 4
call fcn.004389b0
sub esp, 0x1b0
mov dword [esp + 0x1c0], esp
mov ecx, esp
push eax
mov byte [esp + 0x414], 5
call fcn.00401420
call fcn.0042d0a0
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 0x2c]
cmp ecx, ebx
jle 0x42cb1d
sub ecx, eax
mov dword [esi + 0x2c], ecx
mov ecx, dword [esp + 0x258]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x240]
xor ecx, esp
call fcn.004ffd1c
mov esp, ebp
pop ebp
ret 8
Function at 0x42f830
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x509292
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x546190]
xor eax, esp
mov dword [esp + 0x238], eax
push ebx
push esi
push edi
mov eax, dword [0x546190]
xor eax, esp
push eax
lea eax, [esp + 0x250]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov esi, ecx
mov ebx, dword [esi + 8]
push ebx
push edi
push 1
push eax
mov dword [esp + 0x20], edi
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp eax, edi
jge 0x42f96d
push ebx
call dword [sym.imp.MSVCR100.dll_ferror]
add esp, 4
test eax, eax
je 0x42f96d
fild dword [esp + 0x10]
xor ebx, ebx
mov edi, 0xf
mov dword [esp + 0x6c], ebx
fstp qword [esp + 0x54]
mov dword [esp + 0x70], edi
mov byte [esp + 0x5c], bl
mov dword [esp + 0x74], 1
mov dword [esp + 0x258], ebx
mov eax, dword [esi]
mov edx, dword [eax + 8]
lea ecx, [esp + 0x7c]
push ecx
mov ecx, esi
call edx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], edi
mov byte [esp + 0x34], bl
mov ecx, 2
push 0xffffffffffffffff
mov byte [esp + 0x25c], cl
push ebx
mov dword [esp + 0x54], ecx
push eax
lea ecx, [esp + 0x40]
call fcn.00439650
push 0x20
mov byte [esp + 0x25c], 3
push str.Failed_to_write_1_bytes_to_0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], edi
call fcn.00439740
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0xa0]
mov byte [esp + 0x264], 4
call fcn.004389b0
sub esp, 0x1b0
mov dword [esp + 0x1c0], esp
mov ecx, esp
push eax
mov byte [esp + 0x40c], 5
call fcn.00401420
call fcn.0042d0a0
mov ecx, dword [esp + 0x250]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x238]
xor ecx, esp
call fcn.004ffd1c
mov esp, ebp
pop ebp
ret 8
Function at 0x42fc00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x509222
mov eax, dword fs:[0]
push eax
sub esp, 0x248
mov eax, dword [0x546190]
xor eax, esp
mov dword [esp + 0x240], eax
push ebx
push esi
push edi
mov eax, dword [0x546190]
xor eax, esp
push eax
lea eax, [esp + 0x258]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov esi, ecx
mov ebx, dword [esi + 8]
push ebx
push edi
push 1
push eax
mov dword [esp + 0x28], edi
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
mov dword [esp + 0x14], eax
cmp eax, edi
jge 0x42fd48
push ebx
call dword [sym.imp.MSVCR100.dll_ferror]
add esp, 4
test eax, eax
je 0x42fd44
fild dword [esp + 0x18]
xor ebx, ebx
mov edi, 0xf
mov dword [esp + 0x74], ebx
fstp qword [esp + 0x5c]
mov dword [esp + 0x78], edi
mov byte [esp + 0x64], bl
mov dword [esp + 0x7c], 1
mov dword [esp + 0x260], ebx
mov eax, dword [esi]
mov edx, dword [eax + 0x14]
lea ecx, [esp + 0x84]
push ecx
mov ecx, esi
call edx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], edi
mov byte [esp + 0x3c], bl
mov ecx, 2
push 0xffffffffffffffff
mov byte [esp + 0x264], cl
push ebx
mov dword [esp + 0x5c], ecx
push eax
lea ecx, [esp + 0x48]
call fcn.00439650
push 0x21
mov byte [esp + 0x264], 3
push str.Failed_to_read_1_bytes_from_0
lea ecx, [esp + 0x24]
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], edi
call fcn.00439740
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x24]
push edx
lea ecx, [esp + 0xa8]
mov byte [esp + 0x26c], 4
call fcn.004389b0
sub esp, 0x1b0
mov dword [esp + 0x1c4], esp
mov ecx, esp
push eax
mov byte [esp + 0x414], 5
call fcn.00401420
call fcn.0042d0a0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x258]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x240]
xor ecx, esp
call fcn.004ffd1c
mov esp, ebp
pop ebp
ret 8

Function at 0x430970
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x509191
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x546190]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov edi, dword [eax + 4]
mov esi, dword [ebp + 8]
mov eax, dword [eax]
xor ebx, ebx
mov dword [esi + 4], ebx
mov dword [ebp - 4], ebx
mov dword [esi], vtable.io::ByteArrayInputStream.0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], 0xf
mov byte [esi + 0x14], bl
push eax
push esi
mov byte [ebp - 4], 2
call fcn.0042eeb0
mov eax, dword [ebp + 0xc]
push 0xffffffffffffffff
mov dword [ebp - 4], 3
lea ecx, [esi + 0x30]
push ebx
mov dword [esi], vtable.io::ZipEntryInputStream.0
push eax
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], 0xf
call fcn.00439650
add esi, 0x48
mov byte [ebp - 4], 4
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov ebx, dword [ebp + 0x10]
call fcn.00430aa0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4333e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
push esi
push edi
xor edx, edx
mov edi, edi
mov eax, edx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x5615e0], ecx
inc edx
cmp edx, 0x100
jb 0x4333f0
cmp edx, 0x800
jae 0x4334c9
lea ebx, [ebx]
mov eax, dword [edx*4 + 0x5611e0]
mov ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x5615e0]
inc edx
mov dword [edx*4 + 0x5615dc], eax
cmp edx, 0x800
jb 0x4334a0
lea esi, [esp + 0x10]
mov dword [0x54a754], 0x434000
call fcn.004340c0
test eax, eax
je 0x433593
mov eax, dword [esp + 0x20]
mov ebx, dword [esp + 0x1c]
mov esi, eax
shr eax, 4
shr esi, 8
and eax, 0xf00f
and esi, 0xff00f
xor edi, edi
mov dword [esp + 0xc], eax
mov ecx, 0x5485ec
xor edx, edx
lea esp, [esp]
mov eax, dword [ecx - 8]
cmp eax, dword [esp + 0x14]
jne 0x433526
mov eax, dword [esp + 0x18]
cmp dword [ecx - 4], eax
jne 0x433526
cmp dword [ecx], ebx
je 0x43355f
add edx, 0xc
inc edi
add ecx, 0xc
cmp edx, 0x24
jb 0x433510
or ecx, 0xffffffff
sub ecx, 0
je 0x433578
dec ecx
je 0x433563
dec ecx
jne 0x433593
cmp esi, 6
jb 0x433593
jne 0x433589
cmp dword [esp + 0xc], 0xf
jb 0x433593
mov dword [0x54a754], 0x4340b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edi
jmp 0x433535
cmp esi, 5
jb 0x433593
jne 0x433589
mov eax, dword [esp + 0xc]
cmp eax, 6
jb 0x433593
cmp eax, 0xa
jmp 0x433587
cmp esi, 6
jb 0x433593
jne 0x433589
cmp dword [esp + 0xc], 0x100c
je 0x433593
mov dword [0x54a754], 0x4340b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x434180
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test ecx, ecx
jne 0x43418b
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
pop ebp
jmp fcn.004341a0
Function at 0x435f30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ecx]
and esi, 7
mov dword [ebp - 4], 0
cmp eax, 5
jae 0x435f52
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
lea edx, [edx + eax - 4]
push ebx
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], edx
push edi
mov edi, dword [ebp - 4]
mov eax, dword [ebp + 8]
add edi, eax
cmp edi, edx
jae 0x435f80
mov cl, byte [edi]
and cl, 0xfe
cmp cl, 0xe8
je 0x435f80
inc edi
cmp edi, edx
jb 0x435f71
mov ebx, edi
sub ebx, eax
mov eax, ebx
sub eax, dword [ebp - 8]
mov dword [ebp - 4], ebx
cmp edi, edx
jae 0x436087
cmp eax, 3
jbe 0x435fb7
xor esi, esi
mov al, byte [edi + 4]
mov dword [ebp - 8], ebx
test al, al
je 0x435ff4
cmp al, 0xff
je 0x435ff4
and esi, 3
add esi, esi
or esi, 1
inc ebx
mov dword [ebp - 4], ebx
jmp 0x435f65
lea ecx, [eax - 1]
shl esi, cl
and esi, 7
je 0x435f9b
movzx eax, byte [esi + 0x517e00]
mov ecx, edi
sub ecx, eax
cmp byte [esi + 0x517df8], 0
mov al, byte [ecx + 4]
je 0x435fe0
test al, al
je 0x435fe0
cmp al, 0xff
jne 0x435f9b
and esi, 3
add esi, esi
mov dword [ebp - 8], ebx
or esi, 1
inc ebx
mov dword [ebp - 4], ebx
jmp 0x435f65
movzx ecx, byte [edi + 2]
movzx edx, al
movzx eax, byte [edi + 3]
shl edx, 8
or edx, eax
movzx eax, byte [edi + 1]
shl edx, 8
or edx, ecx
shl edx, 8
or edx, eax
sub edx, ebx
lea eax, [edx - 5]
test esi, esi
je 0x436057
movzx edx, byte [esi + 0x517e00]
add edx, edx
add edx, edx
add edx, edx
mov ecx, 0x18
sub ecx, edx
mov ebx, eax
shr ebx, cl
mov cl, bl
test cl, cl
je 0x43603e
cmp cl, 0xff
jne 0x436054
mov ebx, dword [ebp - 4]
mov ecx, 0x20
sub ecx, edx
mov edx, 1
shl edx, cl
dec edx
xor edx, eax
jmp 0x436012
mov ebx, dword [ebp - 4]
mov ecx, eax
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [edi + 4], cl
mov edx, eax
shr edx, 0x10
mov ecx, eax
shr ecx, 8
add ebx, 5
mov byte [edi + 3], dl
mov edx, dword [ebp - 0xc]
mov byte [edi + 2], cl
mov byte [edi + 1], al
mov dword [ebp - 4], ebx
jmp 0x435f65
cmp eax, 3
jbe 0x43609c
mov edx, dword [ebp + 0xc]
pop edi
xor esi, esi
mov eax, ebx
pop ebx
mov dword [edx], esi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0xc]
lea ecx, [eax - 1]
shl esi, cl
pop edi
mov eax, ebx
pop ebx
and esi, 7
mov dword [edx], esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4385b0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7d8
mov eax, dword [0x546190]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push ecx
lea edx, [ebp - 0x7d8]
push 0x7d0
push edx
call dword [sym.imp.MSVCR100.dll__vsnprintf]
add esp, 0x10
lea eax, [ebp - 0x7d8]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ffd1c
mov esp, ebp
pop ebp
ret

Function at 0x4386d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x546190]
xor eax, esp
mov dword [esp + 0x1c], eax
lea edx, [esp + 4]
call fcn.00439160
cmp dword [esp + 0x18], 0x10
lea eax, [esp + 4]
jl 0x4386fc
mov eax, dword [esp + 4]
push eax
push str.EXCEPTION:__s_n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 8
cmp dword [esp + 0x18], 0x10
lea eax, [esp + 4]
jl 0x43871a
mov eax, dword [esp + 4]
push 2
push str.C_Exception_Generated_
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 3
jne 0x438737
push 0xffffffffffffffff
call dword [sym.imp.MSVCR100.dll_exit]
cmp dword [esp + 0x18], 0x10
jl 0x43874c
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004ffd1c
mov esp, ebp
pop ebp
ret
Function at 0x43ab50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5072e7
mov eax, dword fs:[0]
push eax
sub esp, 0x1dc
mov eax, dword [0x546190]
xor eax, esp
mov dword [esp + 0x1d4], eax
push ebx
push esi
mov eax, dword [0x546190]
xor eax, esp
push eax
lea eax, [esp + 0x1e8]
mov dword fs:[0], eax
xor ebx, ebx
push ebx
mov esi, ecx
mov eax, dword [esi + 8]
push ebx
push eax
push 0x43ab30
push ebx
push ebx
call dword [sym.imp.MSVCR100.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 0xc], eax
cmp eax, ebx
jne 0x43ac6a
mov esi, dword [esi + 8]
cmp esi, ebx
je 0x43abd4
mov ecx, dword [esi]
cmp ecx, ebx
je 0x43abca
mov edx, dword [ecx]
mov eax, dword [edx + 8]
push 1
call eax
push esi
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
push 0x16
mov esi, 0xf
push str.Creating_thread_failed
lea ecx, [esp + 0x1c]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], esi
call fcn.00439740
mov dword [esp + 0x1f0], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], esi
mov byte [esp + 0x2c], bl
push 0x401440
push 0x43a620
push 0xa
push 0x28
lea ecx, [esp + 0x5c]
push ecx
mov byte [esp + 0x204], 1
call fcn.004ffe55
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x38]
mov byte [esp + 0x1fc], 2
call fcn.00439650
mov dword [esp + 0x44], ebx
sub esp, 0x1b0
lea eax, [esp + 0x1dc]
mov dword [esp + 0x1c0], esp
mov ecx, esp
push eax
mov byte [esp + 0x3a4], 3
call fcn.00438600
call fcn.004036c0
mov ecx, dword [esp + 0x1e8]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x1d4]
xor ecx, esp
call fcn.004ffd1c
mov esp, ebp
pop ebp
ret