joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404190
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov byte [ebp - 0x240], 0
push 0x3f
push 0
lea eax, [ebp - 0x23f]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
cmp dword [ebp + 0xc], 0
jne 0x4041f8
push 0x3f
push str.NICK
lea ecx, [ebp - 0x240]
push ecx
call sub.MSVCRT.dll_strncpy
add esp, 0xc
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 0x240]
push eax
push 0x407f68
push 0x1ff
lea ecx, [ebp - 0x200]
push ecx
call sub.MSVCRT.dll__snprintf
add esp, 0x14
jmp 0x404316
cmp dword [ebp + 0xc], 1
jne 0x404241
push 0x3f
push str.USER
lea edx, [ebp - 0x240]
push edx
call sub.MSVCRT.dll_strncpy
add esp, 0xc
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x240]
push edx
push str._s__s_____x__:_s_r_n
push 0x1ff
lea eax, [ebp - 0x200]
push eax
call sub.MSVCRT.dll__snprintf
add esp, 0x18
jmp 0x404316
cmp dword [ebp + 0xc], 2
jne 0x404286
push 0x3f
push str.PONG
lea ecx, [ebp - 0x240]
push ecx
call sub.MSVCRT.dll_strncpy
add esp, 0xc
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 0x240]
push eax
push str._s__s_r_n
push 0x1ff
lea ecx, [ebp - 0x200]
push ecx
call sub.MSVCRT.dll__snprintf
add esp, 0x14
jmp 0x404316
cmp dword [ebp + 0xc], 3
jne 0x4042cc
push 0x3f
push str.JOIN
lea edx, [ebp - 0x240]
push edx
call sub.MSVCRT.dll_strncpy
add esp, 0xc
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x240]
push edx
push str._s__s__s_r_n
push 0x1ff
lea eax, [ebp - 0x200]
push eax
call sub.MSVCRT.dll__snprintf
add esp, 0x18
jmp 0x404316
cmp dword [ebp + 0xc], 4
jne 0x404312
push 0x3f
push str.PRIVMSG
lea ecx, [ebp - 0x240]
push ecx
call sub.MSVCRT.dll_strncpy
add esp, 0xc
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0x14]
push eax
lea ecx, [ebp - 0x240]
push ecx
push str._s__s_:_s_r_n
push 0x1ff
lea edx, [ebp - 0x200]
push edx
call sub.MSVCRT.dll__snprintf
add esp, 0x18
jmp 0x404316
xor eax, eax
jmp 0x40436e
push 0x40
push 0
lea eax, [ebp - 0x240]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
lea ecx, [ebp - 0x200]
push ecx
call sub.MSVCRT.dll_strlen
add esp, 4
push eax
lea edx, [ebp - 0x200]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 0x244], eax
push 0x200
push 0
lea ecx, [ebp - 0x200]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov eax, dword [ebp - 0x244]
mov esp, ebp
pop ebp
ret
Function at 0x4043e0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x409774]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x114], 0
jmp 0x40441d
mov ecx, dword [ebp - 0x114]
add ecx, 1
mov dword [ebp - 0x114], ecx
mov edx, dword [ebp - 0x114]
cmp edx, dword [ebp - 0x110]
jae 0x404441
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp + eax*4 - 0x10c]
cmp ecx, dword [ebp + 8]
jne 0x40443f
jmp 0x404441
jmp 0x40440e
mov edx, dword [ebp - 0x114]
cmp edx, dword [ebp - 0x110]
jne 0x404477
cmp dword [ebp - 0x110], 0x40
jae 0x404477
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x10c], ecx
mov edx, dword [ebp - 0x110]
add edx, 1
mov dword [ebp - 0x110], edx
xor eax, eax
jne 0x404402
lea ecx, [ebp - 8]
push ecx
push 0
push 0
lea edx, [ebp - 0x110]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_select]
mov esp, ebp
pop ebp
ret
Function at 0x404de0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
cmp dword [ebp + 8], 0
jbe 0x404ece
mov dword [ebp - 4], 0
push 0x800
push 0
lea eax, [ebp - 0x810]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
call fcn.004043e0
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x404e83
cmp dword [ebp - 4], 0x7ff
jne 0x404e30
jmp 0x404e83
push 0
push 1
mov edx, dword [ebp - 4]
lea eax, [ebp + edx - 0x810]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jg 0x404e56
xor eax, eax
jmp 0x404ed1
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0xc]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
movsx ecx, byte [ebp + eax - 0x811]
cmp ecx, 0xd
je 0x404e7f
mov edx, dword [ebp - 4]
movsx eax, byte [ebp + edx - 0x811]
cmp eax, 0xa
jne 0x404e81
jmp 0x404e83
jmp 0x404e10
cmp dword [ebp - 8], 0
jg 0x404e90
mov eax, dword [ebp - 8]
jmp 0x404ed1
cmp dword [ebp - 4], 2
jge 0x404e9d
jmp 0x404de9
mov ecx, dword [ebp - 4]
mov byte [ebp + ecx - 0x811], 0
lea edx, [ebp - 0x810]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00404bd0
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jge 0x404ec9
mov eax, dword [ebp - 8]
jmp 0x404ed1
jmp 0x404de9
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x405b50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x40c], 0
mov dword [ebp - 4], 0
push 0
lea ecx, [ebp - 4]
push ecx
push 0x400
lea edx, [ebp - 0x408]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x405b9c
jmp 0x405bc6
cmp dword [ebp - 4], 0
jne 0x405ba4
jmp 0x405bc6
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x408]
push edx
mov eax, dword [ebp - 0x40c]
push eax
call fcn.004054d0
add esp, 0xc
mov dword [ebp - 0x40c], eax
jmp 0x405b73
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp - 0x40c]
mov esp, ebp
pop ebp
ret
Function at 0x414920
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x414a07
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x4149f6
jg 0x414960
test edx, edx
je 0x4149f6
nop dword [eax]
call fcn.0043dd70
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x4149b3
jg 0x414977
test esi, esi
je 0x4149b3
cmp ebx, eax
jg 0x414987
jl 0x414981
cmp edi, esi
jae 0x414987
mov esi, edi
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0xc]
push esi
push dword [esp + 0x14]
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.004fe5a0
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x4149da
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
movzx eax, byte [eax]
push eax
call edx
cmp eax, 0xffffffff
je 0x4149f0
mov ecx, dword [esp + 0xc]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x10], esi
test ebx, ebx
jg 0x414960
jl 0x4149f0
test edi, edi
jne 0x414960
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x414a29
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x414a2b
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x414aa9
jg 0x414a3e
test esi, esi
je 0x414aa9
test eax, eax
jl 0x414a8d
jg 0x414a48
test ebx, ebx
je 0x414a8d
cmp edi, eax
jg 0x414a58
jl 0x414a52
cmp esi, ebx
jae 0x414a58
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [ebp + 8]
push dword [esp + 0x18]
call fcn.004fe5a0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
sub esi, ebx
sbb edi, dword [esp + 0x14]
add edx, ebx
mov eax, dword [ecx + 0x30]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
test edi, edi
jl 0x414aa9
jg 0x414a90
test esi, esi
je 0x414aa9
jmp 0x414a90
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x414aa9
push eax
push esi
push 1
push edx
call fcn.00505dc6
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4150c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x566090]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x4150f0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fc7af
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x41512c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x41512c
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fc7af
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x415216
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x415154
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x415187
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.0050126b
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fc7af
mov esp, ebp
pop ebp
ret 4
mov byte [ebp - 0x25], bl
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x4151e9
sub eax, 1
je 0x4151e9
sub eax, 2
jne 0x415216
push dword [esi + 0x4c]
movsx eax, byte [ebp - 0x25]
push eax
call fcn.0050126b
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fc7af
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x415206
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00505dc6
add esp, 0x10
cmp edi, eax
jne 0x415216
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x415117
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fc7af
mov esp, ebp
pop ebp
ret 4
Function at 0x4172d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x566090]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x41738c
cmp byte [esi + 0x3d], 0
je 0x41738c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x41737a
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x417342
sub eax, 1
je 0x417346
sub eax, 2
jne 0x41737a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fc7af
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x417363
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00505dc6
add esp, 0x10
cmp edi, eax
jne 0x41737a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fc7af
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fc7af
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.004fc7af
mov esp, ebp
pop ebp
ret

Function at 0x417490
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x527d20
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x566090]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004fc7f3
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.004e6569
mov dword [esi + 4], eax
lea ebx, [edi + 4]
mov eax, dword [ebp - 0x10]
lea edx, [edi + 8]
mov dword [ebp - 0x14], ebx
lea ecx, [eax + 0x18]
mov ebx, dword [ebp - 0x10]
add esp, 8
mov dword [ebp - 0x18], edx
mov edx, dword [ebp - 0x10]
mov dword [edi + 0x34], esi
add edi, 0x14
mov dword [ebx], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
lea esi, [eax + 0x24]
mov byte [ebx + 0x48], 0
add eax, 0x28
mov byte [ebx + 0x3d], 0
mov ebx, dword [ebp - 0x14]
mov dword [edx + 0xc], ebx
mov ebx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x10], edx
mov dword [ebx + 0x20], ecx
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x2c], esi
mov ebx, dword [ebp - 0x14]
mov dword [edx], 0
mov edx, dword [ebp - 0x10]
mov dword [ecx], 0
mov ecx, dword [0x56ad84]
mov dword [eax], 0
mov eax, dword [0x56ad80]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [esi], 0
mov dword [edx + 0x40], eax
mov eax, edx
mov dword [edx + 0x4c], 0
mov dword [edx + 0x44], ecx
mov dword [edx + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x423210
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x423241
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x423230
pop edi
mov eax, esi
pop esi
pop ebp
ret 8

Function at 0x424150
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52869c
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x566090]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edi
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [edi], eax
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
lea esi, [edi + 0x38]
mov dword [edi + 0x30], 0
mov byte [edi + 0x34], 0
mov dword [ebp - 0x14], esi
mov dword [esi + 0x24], 0
mov byte [ebp - 4], 4
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x424204
mov eax, dword [ecx]
push esi
call dword [eax]
mov dword [esi + 0x24], eax
mov al, byte [ebp + 0xc]
lea ecx, [edi + 0x70]
mov byte [ebp - 4], 5
mov byte [edi + 0x60], al
push 9
mov byte [edi + 0x68], 9
call fcn.00418680
lea eax, [ebp - 0xd]
mov byte [ebp - 4], 6
push eax
lea ecx, [edi + 0x10]
mov byte [ebp - 0xd], 1
call fcn.00425190
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x424248
mov esi, dword [ecx]
lea eax, [ebp + 0x10]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x30
Function at 0x43c9f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
xor ecx, ecx
test esi, esi
je 0x43ca1b
mov edx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x43ca04
pop edi
mov eax, edx
pop esi
pop ebp
ret
mov eax, dword [ebp + 8]
pop esi
pop ebp
ret

Function at 0x43d760
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x203c
call fcn.004fd900
mov eax, dword [0x566090]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x203c], eax
lea esi, [ebp - 0x2038]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
push edi
push eax
lea eax, [ebp - 0x34]
push str.__.10lu___.6lu__x
push eax
call fcn.0043d740
mov al, byte [ebp - 0x34]
add esp, 0x10
test al, al
je 0x43d7c2
lea ecx, [ebp - 0x34]
mov edx, esi
sub ecx, edx
mov byte [esi], al
inc esi
mov al, byte [ecx + esi]
test al, al
jne 0x43d7b8
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x43d7db
mov al, byte [ecx]
test al, al
je 0x43d7db
sub ecx, esi
mov byte [esi], al
inc esi
mov al, byte [ecx + esi]
test al, al
jne 0x43d7d1
mov eax, dword [ebp + 0x14]
lea edi, [ebp - 0x3a]
test eax, eax
mov ecx, 0x546a68
cmovne ecx, eax
lea eax, [ebp + 0x18]
push eax
push ecx
push ecx
mov dword [ebp + 0x14], ecx
sub edi, esi
push ecx
mov edx, edi
mov ecx, esi
call fcn.00443990
add esp, 0x10
cmp eax, edi
cmova eax, edi
cmp dword [ebp + 0xc], 8
mov word [esi + eax], 0xa
mov esi, dword [ebp - 0x203c]
mov eax, dword [esi]
mov ebx, dword [eax]
jne 0x43d827
cmp dword [esi + 8], 2
je 0x43d827
or ebx, 2
mov edx, esi
lea ecx, [ebp - 0x2038]
call fcn.00441560
mov edi, eax
test bl, 1
je 0x43d848
lea eax, [ebp - 0x2038]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test bl, 2
je 0x43d85c
push edi
lea eax, [ebp - 0x2038]
mov ecx, esi
push eax
call fcn.0043e290
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fc7af
mov esp, ebp
pop ebp
ret
Function at 0x43e140
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
push ebx
push esi
mov esi, ecx
xor bl, bl
push edi
mov edi, dword [eax]
mov dword [ebp - 8], esi
nop dword [eax + eax]
mov eax, dword [0x56adf8]
cmp eax, dword [edi + 4]
jg 0x43e24a
mov eax, dword [esi + 0x1c]
test eax, eax
jne 0x43e18c
mov ecx, esi
call fcn.004407b0
test al, al
jne 0x43e160
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x43e1a4
push eax
push ecx
push 1
push dword [ebp + 8]
call fcn.00505dc6
add esp, 0x10
jmp 0x43e1b5
push dword [ebp + 8]
push 0x546a68
push eax
call fcn.0043e110
add esp, 0xc
cmp dword [0x56ae04], 0
mov ecx, eax
jl 0x43e21e
jg 0x43e1cb
cmp dword [0x56ae00], 0
jb 0x43e21e
lea eax, [esi + 0x28]
mov dword [ebp + 0xc], eax
mov eax, ecx
mov esi, dword [ebp + 0xc]
cdq
mov ebx, eax
mov dword [ebp - 4], edx
mov dword [ebp + 8], ebx
nop
mov eax, dword [esi]
add ebx, eax
mov edi, dword [esi + 4]
mov edx, edi
mov ecx, dword [ebp - 4]
mov dword [ebp + 0xc], eax
adc ecx, edi
lock cmpxchg8b qword [esi]
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp eax, ecx
jne 0x43e1e0
cmp edx, edi
jne 0x43e1e0
mov esi, dword [ebp - 8]
cmp edi, dword [0x56ae04]
jl 0x43e21c
jg 0x43e218
cmp ecx, dword [0x56ae00]
jb 0x43e21c
mov bl, 1
jmp 0x43e21e
xor bl, bl
lea edx, [esi + 0x30]
mov eax, 1
lock xadd dword [edx], eax
inc eax
cmp eax, 1
jne 0x43e23f
xor ecx, ecx
xchg dword [edx], ecx
push dword [esi + 0x1c]
call fcn.005076bd
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x56adf8
call fcn.004fc956
add esp, 4
cmp dword [0x56adf8], 0xffffffff
jne 0x43e171
mov eax, dword [esi + 0x34]
push 0x56adf8
mov ecx, dword [eax + 0x10]
mov eax, dword [eax + 0x14]
mov dword [0x56ae00], ecx
mov dword [0x56ae04], eax
call fcn.004fc90c
add esp, 4
jmp 0x43e171
Function at 0x43e540
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x529ad5
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x566090]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword fs:[0x2c]
mov edx, dword [eax]
mov eax, dword [0x56ae28]
cmp eax, dword [edx + 4]
jg 0x43e6e3
mov ecx, dword [0x56ae34]
test ecx, ecx
jl 0x43e6c8
mov esi, dword [0x56ae30]
jg 0x43e5a4
cmp esi, 2
jb 0x43e6c8
mov eax, dword [edi + 0x28]
cdq
sub eax, esi
sbb edx, ecx
sub eax, 1
sbb edx, 0
mov dword [ebp - 0x5c], edx
js 0x43e6c8
jg 0x43e5c5
test eax, eax
jb 0x43e6c8
push eax
lea eax, [ebp - 0x58]
push eax
lea ecx, [edi + 0x30]
call fcn.0043f7f0
mov esi, eax
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
lea ecx, [edi + 0x30]
call fcn.0043fe50
push esi
push eax
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.00441c30
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x43e632
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x43e628
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43e720
push edx
push ecx
call fcn.004fc7e0
add esp, 8
mov edx, dword [ebp - 0x44]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x43e680
mov ecx, dword [ebp - 0x58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x43e676
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43e720
push edx
push ecx
call fcn.004fc7e0
add esp, 8
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x43e6c8
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x43e6be
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43e725
push edx
push ecx
call fcn.004fc7e0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fc7af
mov esp, ebp
pop ebp
ret
push 0x56ae28
call fcn.004fc956
add esp, 4
cmp dword [0x56ae28], 0xffffffff
jne 0x43e585
mov eax, dword [edi + 0x18]
mov ecx, dword [edi + 0x1c]
push 0x56ae28
mov dword [0x56ae30], eax
mov dword [0x56ae34], ecx
call fcn.004fc90c
add esp, 4
jmp 0x43e585
call fcn.0050175f
call fcn.0050175f
int3