joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000ecef
Capabilities:
Hash data using djb2

Disassembly:
push esi
mov esi, ecx
test esi, esi
jne 0x1000ecfb
or eax, 0xffffffff
pop esi
ret
movzx eax, word [esi]
push ebx
push edi
mov edi, 0x1505
xor ebx, ebx
jmp 0x1000ed23
movzx ecx, ax
add eax, 0xffffffbf
cmp ax, 0x19
lea edx, [ecx + 0x20]
cmova edx, ecx
imul edi, edi, 0x21
xor edi, edx
inc ebx
movzx eax, word [esi + ebx*2]
test ax, ax
jne 0x1000ed09
imul eax, edi, 0x41c64e6d
imul ecx, edi, 0x10dcd
pop edi
pop ebx
pop esi
add eax, 0x3039
shr eax, 0x10
inc ecx
and ecx, 0xffff0000
or eax, ecx
ret

Function at 0x401600
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
mov esi, dword [esp + 0x18]
push edi
xor ebx, ebx
lea edi, [esi + 0x10]
mov dword [esp + 0x10], ebx
push edi
mov dword [esp + 0x18], ebx
call ebp
mov edx, dword [esi + 8]
lea eax, [esp + 0x20]
lea ecx, [esp + 0x10]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ClearCommError]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [esp + 0x24], ebx
je 0x4016f6
push edi
call ebp
mov edx, dword [esi + 8]
lea ebx, [esi + 0x40]
lea eax, [esp + 0x14]
push ebx
push eax
lea ecx, [esp + 0x24]
push 1
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4016a1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
mov dword [esp + 0x10], eax
je 0x40167f
push str.ReadFile__
jmp 0x40169a
mov ecx, dword [esi + 8]
lea eax, [esp + 0x14]
push 1
push eax
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x4016a1
push str.GetOverlappedResults___in_ReadFile__
mov ecx, esi
call fcn.004014c0
mov ebx, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push edi
call ebx
mov eax, dword [esp + 0x1c]
mov edx, dword [esi + 0x88]
mov ecx, dword [esi + 0x84]
and eax, 0xff
push edx
push eax
mov edx, dword [ecx + 0x20]
push 0x407
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
push edi
call ebp
mov edx, dword [esi + 8]
lea eax, [esp + 0x20]
lea ecx, [esp + 0x10]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ClearCommError]
push edi
call ebx
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x401646
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x41f220
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x34
push esi
push edi
lea edi, [ecx + 0xe760]
mov ecx, 0xd
lea esi, [esp + 8]
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x39d1b717
mov dword [esp + 0x10], 0x3b656042
mov dword [esp + 0x14], 0x3c4154ca
mov dword [esp + 0x18], 0x3ce703b0
mov dword [esp + 0x1c], 0x3d64f766
mov dword [esp + 0x20], 0x3dc8e8a7
mov dword [esp + 0x24], 0x3e21ff2e
mov dword [esp + 0x28], 0x3e75dcc6
mov dword [esp + 0x2c], 0x3eb205bc
mov dword [esp + 0x30], 0x3ef86c22
mov dword [esp + 0x34], 0x3f283e42
mov dword [esp + 0x38], 0x3f5e4f76
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
add esp, 0x34
ret
Function at 0x41f550
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x104
push esi
push edi
lea edi, [ecx + 0xe898]
mov ecx, 0x41
lea esi, [esp + 8]
mov dword [esp + 8], 0x3e4aa64c
mov dword [esp + 0xc], 0x3e32b021
mov dword [esp + 0x10], 0x3dd566cf
mov dword [esp + 0x14], 0x3dd566cf
mov dword [esp + 0x18], 0x3dd566cf
mov dword [esp + 0x1c], 0x3e416f00
mov dword [esp + 0x20], 0x3e295e9e
mov dword [esp + 0x24], 0x3dc2c3ca
mov dword [esp + 0x28], 0x3db8ef35
mov dword [esp + 0x2c], 0x3db05532
mov dword [esp + 0x30], 0x3e3a5e35
mov dword [esp + 0x34], 0x3e22680a
mov dword [esp + 0x38], 0x3db4d6a1
mov dword [esp + 0x3c], 0x3da2339c
mov dword [esp + 0x40], 0x3d941206
mov dword [esp + 0x44], 0x3e34f0d8
mov dword [esp + 0x48], 0x3e1ce076
mov dword [esp + 0x4c], 0x3da9c77a
mov dword [esp + 0x50], 0x3d8fc505
mov dword [esp + 0x54], 0x3d7c5048
mov dword [esp + 0x58], 0x3e3089a0
mov dword [esp + 0x5c], 0x3e189375
mov dword [esp + 0x60], 0x3da12d77
mov dword [esp + 0x64], 0x3d8068dc
mov dword [esp + 0x68], 0x3d597f63
mov dword [esp + 0x6c], 0x3e2d0e56
mov dword [esp + 0x70], 0x3e14fdf4
mov dword [esp + 0x74], 0x3d9a0275
mov dword [esp + 0x78], 0x3d676c8b
mov dword [esp + 0x7c], 0x3d3da512
mov dword [esp + 0x80], 0x3e2a3055
mov dword [esp + 0x84], 0x3e121ff3
mov dword [esp + 0x88], 0x3d944674
mov dword [esp + 0x8c], 0x3d51b717
mov dword [esp + 0x90], 0x3d26b50b
mov dword [esp + 0x94], 0x3e27d567
mov dword [esp + 0x98], 0x3e0fc505
mov dword [esp + 0x9c], 0x3d8f9097
mov dword [esp + 0xa0], 0x3d3edfa4
mov dword [esp + 0xa4], 0x3d1374bc
mov dword [esp + 0xa8], 0x3e25c91d
mov dword [esp + 0xac], 0x3e0dd2f2
mov dword [esp + 0xb0], 0x3d8bac71
mov dword [esp + 0xb4], 0x3d2e7d56
mov dword [esp + 0xb8], 0x3d03e426
mov dword [esp + 0xbc], 0x3e2425af
mov dword [esp + 0xc0], 0x3e0c154d
mov dword [esp + 0xc4], 0x3d883127
mov dword [esp + 0xc8], 0x3d20902e
mov dword [esp + 0xcc], 0x3cecbfb1
mov dword [esp + 0xd0], 0x3e22b6ae
mov dword [esp + 0xd4], 0x3e0aa64c
mov dword [esp + 0xd8], 0x3d855326
mov dword [esp + 0xdc], 0x3d144674
mov dword [esp + 0xe0], 0x3cd4fdf4
mov dword [esp + 0xe4], 0x3e2161e5
mov dword [esp + 0xe8], 0x3e096bba
mov dword [esp + 0xec], 0x3d82de01
mov dword [esp + 0xf0], 0x3d09374c
mov dword [esp + 0xf4], 0x3cc154ca
mov dword [esp + 0xf8], 0x3e205bc0
mov dword [esp + 0xfc], 0x3e086595
mov dword [esp + 0x100], 0x3d809d49
mov dword [esp + 0x104], 0x3cfec56d
mov dword [esp + 0x108], 0x3cb020c5
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
add esp, 0x104
ret
Function at 0x41f7f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x34
push esi
push edi
lea edi, [ecx + 0xe99c]
mov ecx, 0xd
lea esi, [esp + 8]
mov dword [esp + 8], 0x3d8db8bb
mov dword [esp + 0xc], 0x3d85bc02
mov dword [esp + 0x10], 0x3d7f9724
mov dword [esp + 0x14], 0x3d762b6b
mov dword [esp + 0x18], 0x3d6ecbfb
mov dword [esp + 0x1c], 0x3d68a71e
mov dword [esp + 0x20], 0x3d63bcd3
mov dword [esp + 0x24], 0x3d5fa440
mov dword [esp + 0x28], 0x3d5c5d64
mov dword [esp + 0x2c], 0x3d597f63
mov dword [esp + 0x30], 0x3d570a3d
mov dword [esp + 0x34], 0x3d549518
mov dword [esp + 0x38], 0x3d52f1aa
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
add esp, 0x34
ret

Function at 0x423510
Capabilities:
Get common file path

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x49bc90
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x2e4]
test eax, eax
je 0x423675
mov ebp, dword [eax + 4]
test ebp, ebp
je 0x423675
lea ecx, [esp + 0x10]
call fcn.0049aadc
lea edi, [esi + 0x4368]
mov dword [esp + 0x28], 0
mov ecx, edi
call dword [sym.imp.JsTools3D.dll_public:_void___thiscall_CLzMetaFile::Clear_void_]
lea ecx, [esp + 0xc]
call fcn.0049aadc
push 0x1ea
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 1
call sub.MFC42.DLL_CString::GetBufferSetLength
push eax
push 0x1ea
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0xffffffffffffffff
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::ReleaseBuffer
mov eax, dword [ebp + 0x1184]
test eax, eax
jne 0x4235b4
lea eax, [esp + 0x10]
push 0x4ae1c4
push eax
call sub.MFC42.DLL_CString::Format
add esp, 8
cmp dword [ebp + 0x1184], 1
jne 0x4235cf
lea ecx, [esp + 0x10]
push 0x4ae1b0
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 8
push str.YYSCtmp.wmf
lea ecx, [esp + 0x10]
call fcn.0049ab6c
push ecx
lea edx, [esp + 0x10]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
call sub.MFC42.DLL_CString::CString_2
push ecx
lea eax, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
mov byte [esp + 0x34], 2
call sub.MFC42.DLL_CString::CString_2
push ecx
mov byte [esp + 0x34], 3
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x4ae1a0
call sub.MFC42.DLL_CString::CString_1
mov byte [esp + 0x34], 1
call dword [sym.imp.JsTools3D.dll_int___cdecl_SaveResouceDataToFile_class_CString__class_CString__class_CString_]
add esp, 0xc
cmp eax, 1
jne 0x42363a
mov ecx, dword [esp + 0xc]
push ecx
mov ecx, edi
call dword [sym.imp.JsTools3D.dll_public:_int___thiscall_CLzMetaFile::LoadData_char_const__]
lea ecx, [esi + 0x4140]
mov dword [esi + 0x4258], 0xffffff
mov dword [esi + 0x426c], edi
call dword [sym.imp.JsTools3D.dll_public:_int___thiscall_CDxfWnd::All_void_]
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x20]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0x20
ret
Function at 0x434060
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x49c2b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
push edi
lea ecx, [esp + 0xc]
call fcn.0049aadc
lea ecx, [esp + 8]
mov dword [esp + 0x20], 0
call fcn.0049aadc
mov ecx, dword [esp + 0x28]
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
mov byte [esp + 0x20], 1
shr eax, 0x1f
add edx, eax
mov eax, ecx
mov esi, edx
mov ecx, 0x3e8
cdq
idiv ecx
push esi
push 0x4ae374
mov edi, edx
lea edx, [esp + 0x14]
push edx
call sub.MFC42.DLL_CString::Format
push edi
lea eax, [esp + 0x18]
push 0x4ae374
push eax
call sub.MFC42.DLL_CString::Format
mov edx, dword [sym.imp.JsTools3D.dll_int_G_guifan]
mov ecx, dword [esp + 0x44]
push 0
push ecx
mov eax, dword [edx]
lea ecx, [esp + 0x34]
push eax
push ecx
call dword [sym.imp.LzDesign.dll_class_CString___cdecl_GF_GetGangJinSign_int__int__int_]
add esp, 0x28
lea edx, [esp + 0xc]
mov byte [esp + 0x20], 2
push edx
push eax
lea eax, [esp + 0x18]
push eax
call sub.MFC42.DLL_operator_1
push str.__15
lea ecx, [esp + 0x30]
push eax
push ecx
mov byte [esp + 0x2c], 3
call sub.MFC42.DLL_operator
lea edx, [esp + 8]
mov byte [esp + 0x20], 4
push edx
push eax
lea eax, [esp + 0x30]
push eax
call sub.MFC42.DLL_operator_1
mov ecx, dword [esp + 0x30]
push eax
mov byte [esp + 0x24], 5
call sub.MFC42.DLL_CString::operator
lea ecx, [esp + 0x28]
mov byte [esp + 0x20], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x2c]
mov byte [esp + 0x20], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 2
call sub.MFC42.DLL_CString::CString
mov byte [esp + 0x20], 1
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov byte [esp + 0x20], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x18]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc
Function at 0x46d060
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x78
mov eax, dword [esp + 0x7c]
push esi
push edi
mov edi, ecx
fild dword [edi + 0x30]
fmul dword [eax + 0x123c]
fst dword [esp + 8]
fcomp dword [0x4a4014]
fnstsw ax
test ah, 1
je 0x46d08d
mov dword [esp + 8], 0x41700000
mov dword [esp + 0x48], 0xf
mov dword [esp + 0x4c], 0x14
mov dword [esp + 0x50], 0x19
mov dword [esp + 0x54], 0x1e
mov dword [esp + 0x58], 0x23
mov dword [esp + 0x5c], 0x28
mov dword [esp + 0x60], 0x2d
mov dword [esp + 0x64], 0x32
mov dword [esp + 0x68], 0x37
mov dword [esp + 0x6c], 0x3c
mov dword [esp + 0x70], 0x41
mov dword [esp + 0x74], 0x46
mov dword [esp + 0x78], 0x4b
mov dword [esp + 0x7c], 0x50
xor esi, esi
lea ecx, [esp + 0x4c]
fild dword [ecx - 4]
fld dword [esp + 8]
fsub st(1)
fabs
fld dword [0x4b8f70]
fcompp
fnstsw ax
test ah, 0x41
je 0x46d174
fild dword [ecx]
fstp dword [esp + 0xc]
fld dword [esp + 8]
fsub dword [esp + 0xc]
fabs
fld dword [0x4b8f70]
fcompp
fnstsw ax
test ah, 0x41
je 0x46d1ab
fld dword [esp + 8]
fcomp st(1)
fnstsw ax
test ah, 0x41
fstp st(0)
jne 0x46d15e
fld dword [esp + 8]
fcomp dword [esp + 0xc]
fnstsw ax
test ah, 1
jne 0x46d1e2
inc esi
add ecx, 4
cmp esi, 0xe
jl 0x46d103
pop edi
mov eax, 1
pop esi
add esp, 0x78
ret 4
mov edx, dword [esp + esi*4 + 0x48]
lea ecx, [esp + 0x1c]
push ecx
push edx
fstp st(0)
call dword [sym.imp.LzDesign.dll_int___cdecl_get_rc_property_int__struct_Con_Prop__]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x34]
add esp, 8
mov dword [edi + 0x44], eax
mov dword [edi + 0x3c], ecx
mov dword [edi + 0x40], edx
pop edi
mov eax, 1
pop esi
add esp, 0x78
ret 4
mov ecx, dword [esp + esi*4 + 0x4c]
lea eax, [esp + 0x1c]
push eax
push ecx
fstp st(0)
call dword [sym.imp.LzDesign.dll_int___cdecl_get_rc_property_int__struct_Con_Prop__]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x34]
add esp, 8
mov dword [edi + 0x44], edx
mov dword [edi + 0x3c], eax
mov dword [edi + 0x40], ecx
pop edi
mov eax, 1
pop esi
add esp, 0x78
ret 4
mov eax, dword [esp + esi*4 + 0x48]
lea edx, [esp + 0x1c]
push ebx
mov ebx, dword [sym.imp.LzDesign.dll_int___cdecl_get_rc_property_int__struct_Con_Prop__]
push edx
push eax
mov dword [esp + 0x24], eax
call ebx
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x38]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + esi*4 + 0x58]
lea eax, [esp + 0x28]
mov dword [esp + 0x20], edx
push eax
push ecx
call ebx
fild dword [esp + 0x2c]
add esp, 0x10
mov eax, 1
fsubr dword [esp + 0xc]
fld dword [esp + 0x24]
fsub dword [esp + 0x10]
pop ebx
fmul st(1)
fmul dword [0x4a438c]
fadd dword [esp + 0xc]
fstp dword [edi + 0x44]
fld dword [esp + 0x34]
fsub dword [esp + 0x10]
fmul st(1)
fmul dword [0x4a438c]
fadd dword [esp + 0x10]
fstp dword [edi + 0x3c]
fld dword [esp + 0x2c]
fsub dword [esp + 0x14]
fmul st(1)
fmul dword [0x4a438c]
fadd dword [esp + 0x14]
fstp dword [edi + 0x40]
pop edi
pop esi
fstp st(0)
add esp, 0x78
ret 4
Function at 0x477073
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc00
lea eax, [ebp - 0x400]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00476fe0
add esp, 8
push 0x4ba504
lea edx, [ebp - 0x400]
push edx
push 0x4ba510
lea eax, [ebp - 0x800]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea ecx, [ebp - 0x800]
push ecx
push 0x400
lea edx, [ebp - 0xc00]
push edx
push 0x4ba518
push str.LicType
push 0x4ba524
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x4ba52c
lea eax, [ebp - 0xc00]
push eax
call dword [sym.imp.MSVCRT.dll__strupr]
add esp, 4
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x477106
mov dword [0x4d041c], 2
jmp 0x477152
push 0x4ba530
lea ecx, [ebp - 0xc00]
push ecx
call dword [sym.imp.MSVCRT.dll__strupr]
add esp, 4
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x47713e
mov dword [0x4d041c], 1
push 1
call fcn.004741a0
add esp, 4
jmp 0x477152
mov dword [0x4d041c], 1
push 0
call fcn.004741a0
add esp, 4
lea edx, [ebp - 0x800]
push edx
push 0
push str.NetType
push str.LockSet
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x4d03d4], eax
lea eax, [ebp - 0x800]
push eax
push 0x40
push 0x4d03d8
push str.127.0.0.1
push 0x4ba550
push 0x4ba554
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0x800]
push ecx
push 0x1f40
push str.Port
push str.ServerInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x4d0418], eax
mov dword [0x4d1844], 0
mov dword [0x4d1848], 0
lea edx, [ebp - 0x800]
push edx
push 0
push str.Repeat
push str.LogSet4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x4ba4ec], eax
cmp dword [0x4ba4ec], 0x1388
jle 0x4771fc
mov dword [0x4ba4ec], 0x1388
lea eax, [ebp - 0x400]
push eax
push 0x4d184c
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [0x4d041c]
mov esp, ebp
pop ebp
ret

Function at 0x47cba1
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
push 0x4d0a20
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 1
mov dword [0x4d0e0c], 0x4d0a20
push 0x4d1a54
push 0
push 0x4d0e08
push 0x4782d2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4d1a50], eax
cmp dword [0x4d1a50], 0
jne 0x47cbf9
mov dword [ebp - 4], 0
jmp 0x47cc06
mov ecx, dword [0x4d1a50]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x47f1df
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
push esi
mov dword [ebp - 0x27c], ecx
mov dword [ebp - 0x274], 0x4bb300
lea eax, [ebp - 0x130]
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x26c], 0xc8
mov dword [ebp - 0x278], 0
lea ecx, [ebp - 0x260]
mov dword [ebp - 0x268], ecx
mov dword [ebp - 4], 0xc8
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0x268]
push eax
lea ecx, [ebp - 0x134]
push ecx
lea edx, [ebp - 0x264]
push edx
lea eax, [ebp - 0x278]
push eax
mov ecx, dword [ebp - 0x26c]
push ecx
mov edx, dword [ebp - 0x270]
push edx
mov eax, dword [ebp - 0x274]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
cmp dword [ebp - 0x278], 0
jne 0x47f27a
mov dword [ebp - 0x278], 0x3c1a3dec
mov ecx, dword [ebp - 0x278]
shr ecx, 0x10
mov edx, dword [ebp + 8]
mov word [edx], cx
mov eax, dword [ebp - 0x278]
and eax, 0xffff
mov ecx, dword [ebp + 0xc]
mov word [ecx], ax
mov edx, dword [ebp + 8]
xor eax, eax
mov ax, word [edx]
cdq
sub eax, edx
mov ecx, eax
sar ecx, 1
mov edx, dword [ebp + 0xc]
xor eax, eax
mov ax, word [edx]
cdq
mov esi, 3
idiv esi
add ecx, eax
mov eax, dword [ebp + 0x10]
mov word [eax], cx
mov ecx, dword [ebp + 8]
mov dx, word [ecx]
xor dx, 0xa4b3
mov eax, dword [ebp + 8]
mov word [eax], dx
mov ecx, dword [ebp + 0xc]
mov dx, word [ecx]
xor dx, 0x1e3f
mov eax, dword [ebp + 0xc]
mov word [eax], dx
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x48e860
Capabilities:
Initialize winsock library

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x49e552
push eax
mov al, byte [0x4bb459]
mov dword fs:[0], esp
sub esp, 0x1a0
test al, al
je 0x48ea74
mov eax, dword [esp + 0x1b0]
mov byte [0x4bb459], 0
test eax, eax
mov byte [0x4bb458], 1
je 0x48e8ac
push eax
mov ecx, 0x4d2270
call fcn.0049ab8a
mov eax, dword [esp + 0x1b4]
test eax, eax
je 0x48e8bc
mov dword [0x4d2274], eax
lea ecx, [esp]
call fcn.0049aadc
mov eax, dword [esp + 0x1b8]
mov dword [esp + 0x1a8], 0
test eax, eax
je 0x48e8de
push eax
jmp 0x48e8e3
push 0x4bb474
lea ecx, [esp + 4]
call fcn.0049ab8a
lea ecx, [esp + 0xc]
call fcn.0049aadc
lea eax, [esp + 4]
push 0x1e
push eax
lea ecx, [esp + 8]
mov byte [esp + 0x1b0], 1
call sub.MFC42.DLL_CString::Left
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x1ac], 2
call sub.MFC42.DLL_CString::operator
lea ecx, [esp + 4]
mov byte [esp + 0x1a8], 1
call sub.MFC42.DLL_CString::CString
push str.__NCB_080529_1120
lea ecx, [esp + 4]
call fcn.0049ab8a
lea ecx, [esp + 8]
call fcn.0049aadc
lea ecx, [esp + 4]
push 0x11
push ecx
lea ecx, [esp + 8]
mov byte [esp + 0x1b0], 3
call sub.MFC42.DLL_CString::Left
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x1ac], 4
call sub.MFC42.DLL_CString::operator
lea ecx, [esp + 4]
mov byte [esp + 0x1a8], 3
call sub.MFC42.DLL_CString::CString
push 0x4bb45c
lea ecx, [esp + 0xc]
call fcn.0049ab6c
lea edx, [esp + 8]
lea eax, [esp + 0xc]
push edx
lea ecx, [esp + 8]
push eax
push ecx
call sub.MFC42.DLL_operator_1
push eax
mov ecx, 0x4d226c
mov byte [esp + 0x1ac], 5
call sub.MFC42.DLL_CString::operator
lea ecx, [esp + 4]
mov byte [esp + 0x1a8], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov byte [esp + 0x1a8], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x1a8], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp]
mov dword [esp + 0x1a8], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, dword [0x4d2274]
test eax, eax
je 0x48ea53
mov edx, dword [0x4d2270]
mov eax, dword [edx - 8]
test eax, eax
je 0x48ea53
lea eax, [esp + 0x10]
push eax
push 4
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x48ea2c
mov byte [0x4bb458], 0
call fcn.004929a0
mov cl, byte [0x4bb458]
test cl, cl
jne 0x48ea80
or eax, 0xffffffff
mov ecx, dword [esp + 0x1a0]
mov dword fs:[0], ecx
add esp, 0x1ac
ret
mov byte [0x4bb458], 0
mov eax, 0xfffffffe
mov ecx, dword [esp + 0x1a0]
mov dword fs:[0], ecx
add esp, 0x1ac
ret
mov al, byte [0x4bb458]
neg al
sbb eax, eax
neg eax
dec eax
mov ecx, dword [esp + 0x1a0]
mov dword fs:[0], ecx
add esp, 0x1ac
ret
Function at 0x493560
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
mov dword [esi], 0x4a488c
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esi + 0xc]
push 0xc8
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x493593
mov edx, dword [esi + 0xc]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esi + 8]
push ecx
call edi
mov edx, dword [esi + 4]
push edx
call edi
add esi, 0x20
push esi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
pop edi
pop esi
ret

Function at 0x4937a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x49e878
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
or eax, 0xffffffff
push esi
mov dword [esp + 0x14], eax
push edi
mov dword [esp + 0x1c], eax
mov al, byte [esp + 0x30]
mov edi, ecx
mov byte [esp + 0x10], al
mov byte [esp + 0x11], 0
mov byte [esp + 0x1c], al
mov byte [esp + 0x1d], 0
call dword [sym.imp.MSVCRT.dll__getpid]
mov word [esp + 0x1e], ax
call dword [sym.imp.MSVCRT.dll_rand]
lea esi, [edi + 0x14]
mov dword [esp + 0x18], eax
test esi, esi
mov dword [esp + 8], 0x4a48a8
mov dword [esp + 0xc], esi
je 0x49380f
lea ecx, [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [edi + 0xc]
lea ecx, [edi + 4]
lea edx, [esp + 0x10]
mov dword [esp + 0x28], 0
push edx
push 1
push eax
call fcn.00493ba0
test esi, esi
je 0x493838
add esi, 4
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x20]
pop edi
xor eax, eax
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret 4