joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411ec0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
mov edx, dword [ebx + ecx*4 + 0x12c]
xor ecx, ecx
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [eax], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
cmp dword [ebx + 0x1b8], ecx
je 0x411efb
mov dword [eax], 1
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [ebx]
mov eax, dword [esi + 0x194]
push edi
mov edi, 0x493e0
cmp eax, ecx
jle 0x411f13
mov ecx, 1
mov edx, dword [esi + 0x198]
test edx, edx
jle 0x411f20
or ecx, 2
dec ecx
je 0x411f31
dec ecx
je 0x411f2d
dec ecx
jne 0x411f33
cmp eax, edx
jl 0x411f31
mov edi, edx
jmp 0x411f33
mov edi, eax
call fcn.004344b0
mov ecx, dword [esi + 0x4a4]
push ecx
mov ecx, dword [esi + 0x4a0]
push ecx
push edx
push eax
call fcn.004344e0
add esp, 0x10
sub edi, eax
je 0x411f58
test edi, edi
jns 0x411f75
mov edx, dword [ebp + 8]
push str.Connection_time_out
push edx
call fcn.0042d160
add esp, 8
pop edi
pop esi
mov eax, 0x1c
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 8]
push ebx
xor eax, eax
call fcn.00410ca0
add esp, 4
cmp eax, 1
je 0x411fcc
test eax, eax
jne 0x411fd5
push edi
lea esi, [ebp - 4]
call fcn.00411080
add esp, 4
test eax, eax
je 0x412014
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
push 2
mov dword [ebx + 0x1b8], 1
push ecx
mov dword [eax], 1
call fcn.0042ab90
push ebx
call fcn.004372c0
mov edx, edi
push edx
push ebx
call fcn.00411190
add esp, 0x14
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 2
jne 0x412001
push edi
lea esi, [ebp - 4]
call fcn.00411080
mov esi, dword [ebp - 4]
push esi
push ebx
call fcn.00431050
push eax
mov eax, dword [ebp + 8]
push 0x47f40c
push eax
call fcn.0042d0e0
add esp, 0x18
jmp 0x412017
mov ecx, dword [ebp + 8]
push str.Connection_failed_n
push ecx
call fcn.0042d0e0
add esp, 8
jmp 0x41202b
mov esi, dword [ebp - 4]
test esi, esi
je 0x41202b
mov edx, dword [ebp + 8]
push esi
mov dword [edx + 0x855c], esi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push eax
call fcn.004119d0
mov esi, eax
add esp, 4
test esi, esi
je 0x412070
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, dword [ebp + 8]
push eax
push ebx
mov dword [edi + 0x855c], eax
call fcn.00431050
mov ecx, dword [ebx + 0x94]
mov edx, dword [ebx + 0x7c]
push eax
push ecx
push edx
push str.Failed_connect_to__s:_ld___s
push edi
call fcn.0042d160
add esp, 0x1c
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x413640
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push ebx
xor ebx, ebx
lea ecx, [ebp - 0x10]
push ecx
mov ecx, dword [ebp + 8]
mov dword [eax], ebx
mov eax, dword [ebp + 0xc]
push edx
push eax
push ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [ebp - 8], eax
cmp eax, ebx
jne 0x4137d6
push edi
mov edi, dword [ebp - 0x10]
cmp edi, ebx
je 0x4137b8
push esi
cmp dword [edi + 4], 2
jne 0x41373c
cmp dword [edi + 0x18], ebx
je 0x41373c
mov eax, dword [edi + 0x10]
cmp eax, ebx
jbe 0x41373c
cmp eax, 0x10
jb 0x41373c
push 0x20
call dword [0x4944a4]
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x413749
mov edx, dword [edi]
mov dword [esi], edx
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov ecx, dword [edi + 8]
mov dword [esi + 8], ecx
mov edx, dword [edi + 0xc]
push 0x10
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], 0x10
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x1c], ebx
call dword [0x4944a4]
add esp, 4
mov dword [esi + 0x18], eax
cmp eax, ebx
je 0x413752
mov ecx, dword [edi + 0x18]
mov edx, dword [ecx]
mov dword [eax], edx
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov edx, dword [ecx + 8]
mov dword [eax + 8], edx
mov ecx, dword [ecx + 0xc]
mov dword [eax + 0xc], ecx
mov eax, dword [edi + 0x14]
cmp eax, ebx
je 0x413727
push eax
call dword [0x4944b0]
add esp, 4
mov dword [esi + 0x14], eax
cmp eax, ebx
je 0x413765
cmp dword [ebp - 4], ebx
jne 0x41372f
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0xc]
cmp eax, ebx
je 0x413739
mov dword [eax + 0x1c], esi
mov dword [ebp - 0xc], esi
mov edi, dword [edi + 0x1c]
cmp edi, ebx
jne 0x413682
jmp 0x413780
mov dword [ebp - 8], 8
jmp 0x413780
push esi
mov dword [ebp - 8], 8
call dword [0x4944a8]
add esp, 4
jmp 0x413780
mov edx, dword [esi + 0x18]
push edx
mov dword [ebp - 8], 8
call dword [0x4944a8]
push esi
call dword [0x4944a8]
add esp, 8
mov eax, dword [ebp - 0x10]
pop esi
cmp eax, ebx
je 0x41378f
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
cmp dword [ebp - 8], ebx
je 0x4137b3
mov eax, dword [ebp - 4]
push eax
call fcn.004135f0
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 8]
add esp, 4
mov ecx, ebx
pop edi
mov dword [ebp - 4], ebx
mov dword [edx], ecx
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 4], ebx
jne 0x4137ca
push 0x2af9
mov dword [ebp - 8], 0x2af9
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 8]
mov dword [edx], ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4144d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push 0
push 0
push eax
push ecx
push 0
push 0
call fcn.0045fc20
add esp, 0x18
test eax, eax
je 0x4144f4
cmp eax, 0xffffffff
jne 0x4144f6
xor eax, eax
pop ebp
ret
Function at 0x4148c0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x494ce8]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x414910
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x41490a
shr eax, 8
cmp al, 2
jne 0x41490a
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045d571
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 2
call fcn.0045d571
mov esp, ebp
pop ebp
ret
Function at 0x4168c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
xor ecx, ecx
mov edi, eax
mov eax, dword [esi]
cmp dword [eax + 4], 2
sete cl
mov dword [ebp - 4], ecx
test ecx, ecx
je 0x4168e8
mov eax, dword [eax + 8]
mov ecx, dword [esi + 0xc]
push eax
push ebx
push 1
push edi
call ecx
jmp 0x41691b
cmp dword [esi + 8], 0
jne 0x41690e
mov edx, dword [eax + 8]
push 0x47fab8
push edx
call fcn.0045f284
add esp, 8
mov dword [esi + 8], eax
test eax, eax
jne 0x41690e
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 8]
push eax
push ebx
push 1
push edi
call fcn.00460e55
mov edi, eax
add esp, 0x10
test edi, edi
je 0x416928
cmp edi, ebx
jbe 0x416947
cmp dword [ebp - 4], 0
jne 0x416941
mov ecx, dword [esi + 8]
push ecx
call fcn.0045f01c
add esp, 4
mov dword [esi + 8], 0
mov edx, dword [esi]
mov eax, dword [edx]
mov dword [esi], eax
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4172b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x201c
call fcn.00460be0
mov eax, dword [0x494ce8]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2010], ecx
lea ecx, [ebp - 0x201c]
push ecx
push 0
mov dword [ebp - 0x2014], edx
push eax
lea edx, [ebp - 0x2008]
push edx
push 0
call fcn.00416ab0
add esp, 0x14
test eax, eax
jne 0x41749f
push ebx
push esi
mov esi, dword [ebp - 0x2008]
push edi
mov ebx, esi
mov dword [ebp - 0x200c], esi
test esi, esi
je 0x41749a
jmp 0x417320
cmp dword [ebx + 4], 3
jne 0x4173ea
xor edi, edi
lea esp, [esp]
xor eax, eax
cmp dword [ebx + 4], 2
sete al
mov dword [ebp - 0x2018], eax
test eax, eax
je 0x41735b
mov eax, dword [ebx + 8]
push eax
push 0x2000
lea ecx, [ebp - 0x2004]
push 1
push ecx
xor edx, edx
call edx
jmp 0x41738e
test edi, edi
jne 0x41737a
mov eax, dword [ebx + 8]
push 0x47fab8
push eax
call fcn.0045f284
mov edi, eax
add esp, 8
test edi, edi
je 0x417425
push edi
push 0x2000
lea ecx, [ebp - 0x2004]
push 1
push ecx
call fcn.00460e55
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41739f
cmp esi, 0x2000
jbe 0x4173b5
cmp dword [ebp - 0x2018], 0
jne 0x4173b3
push edi
call fcn.0045f01c
add esp, 4
xor edi, edi
mov ebx, dword [ebx]
cmp esi, 0xffffffff
je 0x417418
mov eax, dword [ebp - 0x2010]
push esi
lea edx, [ebp - 0x2004]
push edx
push eax
call dword [ebp - 0x2014]
add esp, 0xc
cmp esi, eax
jne 0x417418
cmp esi, 0x2000
je 0x417330
mov ebx, dword [ebp - 0x200c]
jmp 0x417407
mov ecx, dword [ebx + 0xc]
mov edx, dword [ebx + 8]
mov eax, dword [ebp - 0x2010]
push ecx
push edx
push eax
call dword [ebp - 0x2014]
add esp, 0xc
cmp dword [ebx + 0xc], eax
jne 0x417448
mov ebx, dword [ebx]
mov dword [ebp - 0x200c], ebx
test ebx, ebx
je 0x41746b
jmp 0x417320
test edi, edi
je 0x417425
push edi
call fcn.0045f01c
add esp, 4
lea ecx, [ebp - 0x2008]
push ecx
call fcn.00416750
add esp, 4
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045d571
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x2008]
push edx
call fcn.00416750
add esp, 4
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045d571
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x2008]
test esi, esi
je 0x41749a
cmp dword [esi + 4], 1
mov edi, dword [esi]
jg 0x41748a
mov eax, dword [esi + 8]
push eax
call dword [0x4944a8]
add esp, 4
push esi
call dword [0x4944a8]
add esp, 4
mov esi, edi
test edi, edi
jne 0x417475
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045d571
mov esp, ebp
pop ebp
ret
Function at 0x417550
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x494ce8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [esi]
push ebx
push edi
mov edi, dword [esi + 0x130]
push 1
push 0
push esi
mov dword [ebp - 0x18], eax
or ebx, 0xffffffff
mov dword [ebp - 0x1c], 0x10
call fcn.00410bf0
add esp, 0xc
test eax, eax
js 0x4175c4
jmp 0x417590
mov ecx, 0x3e8
cmp eax, ecx
jge 0x41759b
mov ecx, eax
push ecx
push 0xffffffffffffffff
push edi
call fcn.0042c700
add esp, 0xc
cmp eax, 0xffffffff
je 0x41765d
test eax, eax
jne 0x4175ea
push 1
push eax
push esi
call fcn.00410bf0
add esp, 0xc
test eax, eax
jns 0x417590
mov ecx, dword [ebp - 0x18]
push str.Timeout_while_waiting_for_server_connect
push ecx
call fcn.0042d160
add esp, 8
pop edi
mov eax, 0x1c
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045d571
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x14]
push eax
push edi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x417615
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x14]
push edx
push edi
mov dword [ebp - 0x1c], 0x10
call dword [sym.imp.WS2_32.dll_accept]
mov ebx, eax
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
cmp ebx, 0xffffffff
jne 0x41762c
mov eax, dword [ebp - 0x18]
push str.Error_accept__ing_server_connect
push eax
jmp 0x417666
mov ecx, dword [ebp - 0x18]
push str.Connection_accepted_from_server_n
push ecx
call fcn.0042d0e0
push 1
push ebx
mov dword [esi + 0x130], ebx
call fcn.00429150
add esp, 0x10
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045d571
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x18]
push str.Error_while_waiting_for_server_connect
push edx
call fcn.0042d160
mov ecx, dword [ebp - 4]
add esp, 8
pop edi
xor ecx, ebp
mov eax, 0x1e
pop ebx
call fcn.0045d571
mov esp, ebp
pop ebp
ret
Function at 0x418610
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, eax
mov ebx, dword [esi]
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
push edi
add eax, edx
xor edi, edi
cmp eax, 2
je 0x418648
push str.Couldnt_set_desired_mode
push ebx
call fcn.0042d160
add esp, 8
lea eax, [edi + 0x11]
pop edi
pop esi
pop ebx
pop ebp
ret
cmp ecx, 0xc8
je 0x41865f
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push ebx
call fcn.0042d0e0
add esp, 0xc
mov eax, dword [ebp + 8]
cmp eax, 0x13
jne 0x418673
call fcn.004181e0
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x14
jne 0x418686
mov ebx, esi
call fcn.00418250
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x15
jne 0x41869f
push 0xd
push 1
push esi
call fcn.0041aa90
add esp, 0xc
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x16
jne 0x4186b3
push 0xe
push 1
push esi
call fcn.0041aa90
add esp, 0xc
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x41cb00
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x494ce8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call fcn.00461148
add esp, 4
mov byte [ebp - 0x108], 0
test eax, eax
je 0x41cb64
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp byte [ebp - 0x108], 0
je 0x41cb64
lea edx, [ebp - 0x108]
push edx
call dword [0x4944b0]
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045d571
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.0045d571
mov esp, ebp
pop ebp
ret
Function at 0x41d800
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea eax, [ecx + eax*2 + 0xc]
push edi
push eax
call dword [0x4944a4]
mov edi, eax
add esp, 4
test edi, edi
jne 0x41d82b
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], eax
mov edx, dword [esi + 0xc]
add edx, eax
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], edx
cmp ebx, dword [esi + 0x10]
jbe 0x41d872
push eax
mov eax, dword [esi]
call eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push ebx
push ecx
push edx
call eax
mov ebx, dword [edi + 8]
mov ecx, dword [edi + 4]
add ebx, dword [esi + 0xc]
mov edx, dword [esi + 8]
push ecx
push ebx
call edx
mov eax, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], eax
jmp 0x41d875
mov ebx, dword [ebp + 0xc]
mov ecx, dword [edi + 4]
mov edx, dword [esi]
push ecx
call edx
mov eax, dword [edi + 8]
mov ecx, dword [esi]
push eax
call ecx
mov eax, dword [ebp + 0x10]
add esp, 8
mov dword [ebp - 4], 0
test eax, eax
je 0x41d8d6
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea esp, [esp]
mov dl, byte [ebx]
xor dl, 0x36
mov byte [ebp + 0xb], dl
mov ecx, dword [edi + 4]
mov edx, dword [esi + 4]
push 1
lea eax, [ebp + 0xb]
push eax
push ecx
call edx
mov al, byte [ebx]
xor al, 0x5c
mov byte [ebp + 0xb], al
mov edx, dword [edi + 8]
mov eax, dword [esi + 4]
push 1
lea ecx, [ebp + 0xb]
push ecx
push edx
inc ebx
call eax
add esp, 0x18
dec dword [ebp - 8]
jne 0x41d8a0
mov ecx, dword [ebp - 4]
pop ebx
cmp ecx, dword [esi + 0x10]
jae 0x41d90f
nop
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push 1
push str.6_s:_d
push edx
call eax
mov ecx, dword [edi + 8]
mov edx, dword [esi + 4]
push 1
push 0x4808af
push ecx
call edx
mov eax, dword [ebp - 4]
inc eax
add esp, 0x18
mov dword [ebp - 4], eax
cmp eax, dword [esi + 0x10]
jb 0x41d8e0
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41e1d0
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x48
push 1
mov esi, eax
mov ebx, ecx
call dword [0x4944b4]
mov edi, eax
xor eax, eax
add esp, 8
mov dword [ebp - 4], 0xc
mov dword [ebx + 0x39c], edi
cmp edi, eax
je 0x41e28e
mov ecx, dword [ebp + 8]
mov dword [ebx + 0x38c], esi
push esi
mov dword [ebx + 0x394], eax
mov dword [ebx + 0x398], eax
mov dword [ebx + 0x390], eax
push ecx
lea esi, [edi + 0x10]
mov dword [edi + 4], 0xffffffff
mov dword [edi], eax
call fcn.0041dff0
add esp, 8
test eax, eax
je 0x41e28e
mov edx, dword [ebx + 0x388]
push edx
call sym.ali213_engine_v1.exe_curl_free
mov eax, dword [ebp + 8]
push eax
call dword [0x4944b0]
add esp, 8
mov dword [ebx + 0x388], eax
test eax, eax
je 0x41e28e
push 0
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [edi + 4], eax
cmp eax, 0xffffffff
je 0x41e28e
lea eax, [edi + 0x10]
push eax
push 0x41e090
call fcn.004144d0
add esp, 8
mov dword [edi], eax
test eax, eax
jne 0x41e2b0
call fcn.00461078
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
add ebx, 0x388
push ebx
call fcn.0041e120
mov edx, dword [ebp - 4]
add esp, 4
push edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4251a0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x494ce8]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov eax, edx
push edi
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x5c], 0x67452301
mov dword [ebp - 0x58], 0xefcdab89
mov dword [ebp - 0x54], 0x98badcfe
mov dword [ebp - 0x50], 0x10325476
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4251e7
sub eax, edi
push eax
push edx
lea eax, [ebp - 0x5c]
push eax
call fcn.00425020
lea ecx, [ebp - 0x5c]
push ecx
push esi
call fcn.004250d0
mov ecx, dword [ebp - 4]
add esp, 0x14
pop edi
xor ecx, ebp
pop esi
call fcn.0045d571
mov esp, ebp
pop ebp
ret

Function at 0x429790
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [eax + 0x2c]
push esi
push edi
mov edi, dword [ebx]
mov esi, dword [edi + 0x19c]
test esi, esi
jne 0x4297ab
mov esi, dword [eax + 0x28]
mov ecx, dword [eax + 0x24]
mov edx, dword [eax + 0x20]
push ecx
push edx
call fcn.004344b0
push edx
push eax
call fcn.004344e0
add esp, 0x10
sub esi, eax
cmp dword [edi + 0x194], 0
je 0x4297f8
mov eax, dword [ebx + 0x120]
mov ecx, dword [ebx + 0x11c]
push eax
push ecx
call fcn.004344b0
push edx
push eax
call fcn.004344e0
mov ecx, dword [edi + 0x194]
sub ecx, eax
add esp, 0x10
mov eax, ecx
cmp esi, ecx
jge 0x4297fa
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x42b4f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov al, byte [ebp + 8]
movsx ecx, al
add ecx, 0xffffff9f
cmp ecx, 0x19
ja case.default.0x42b501
jmp dword [ecx*4 + 0x42b570]
mov al, 0x41
pop ebp
ret
mov al, 0x42
pop ebp
ret
mov al, 0x43
pop ebp
ret
mov al, 0x44
pop ebp
ret
mov al, 0x45
pop ebp
ret
mov al, 0x46
pop ebp
ret
mov al, 0x47
pop ebp
ret
mov al, 0x48
pop ebp
ret
mov al, 0x49
pop ebp
ret
mov al, 0x4a
pop ebp
ret
mov al, 0x4b
pop ebp
ret
mov al, 0x4c
pop ebp
ret
mov al, 0x4d
pop ebp
ret
mov al, 0x4e
pop ebp
ret
mov al, 0x4f
pop ebp
ret
mov al, 0x50
pop ebp
ret
mov al, 0x51
pop ebp
ret
mov al, 0x52
pop ebp
ret
mov al, 0x53
pop ebp
ret
mov al, 0x54
pop ebp
ret
mov al, 0x55
pop ebp
ret
mov al, 0x56
pop ebp
ret
mov al, 0x57
pop ebp
ret
mov al, 0x58
pop ebp
ret
mov al, 0x59
pop ebp
ret
mov al, 0x5a
pop ebp
ret
Function at 0x42b5e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dl, byte [edi]
test dl, dl
je 0x42b691
mov cl, byte [esi]
test cl, cl
je 0x42b691
movsx eax, dl
add eax, 0xffffff9f
cmp eax, 0x19
ja case.default.0x42b60a
jmp dword [eax*4 + 0x42b6b8]
mov dl, 0x41
jmp case.default.0x42b60a
mov dl, 0x42
jmp case.default.0x42b60a
mov dl, 0x43
jmp case.default.0x42b60a
mov dl, 0x44
jmp case.default.0x42b60a
mov dl, 0x45
jmp case.default.0x42b60a
mov dl, 0x46
jmp case.default.0x42b60a
mov dl, 0x47
jmp case.default.0x42b60a
mov dl, 0x48
jmp case.default.0x42b60a
mov dl, 0x49
jmp case.default.0x42b60a
mov dl, 0x4a
jmp case.default.0x42b60a
mov dl, 0x4b
jmp case.default.0x42b60a
mov dl, 0x4c
jmp case.default.0x42b60a
mov dl, 0x4d
jmp case.default.0x42b60a
mov dl, 0x4e
jmp case.default.0x42b60a
mov dl, 0x4f
jmp case.default.0x42b60a
mov dl, 0x50
jmp case.default.0x42b60a
mov dl, 0x51
jmp case.default.0x42b60a
mov dl, 0x52
jmp case.default.0x42b60a
mov dl, 0x53
jmp case.default.0x42b60a
mov dl, 0x54
jmp case.default.0x42b60a
mov dl, 0x55
jmp case.default.0x42b60a
mov dl, 0x56
jmp case.default.0x42b60a
mov dl, 0x57
jmp case.default.0x42b60a
mov dl, 0x58
jmp case.default.0x42b60a
mov dl, 0x59
jmp case.default.0x42b60a
mov dl, 0x5a
push ecx
call fcn.0042b4f0
add esp, 4
cmp dl, al
jne 0x42b691
mov dl, byte [edi + 1]
inc edi
inc esi
test dl, dl
jne 0x42b5f5
movzx eax, byte [edi]
push eax
call fcn.0042b4f0
mov dl, al
movzx eax, byte [esi]
push eax
call fcn.0042b4f0
add esp, 8
xor ecx, ecx
cmp dl, al
sete cl
pop edi
pop esi
mov eax, ecx
pop ebp
ret
Function at 0x42b720
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
mov dl, byte [ebx]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
test dl, dl
je 0x42b7e5
lea esp, [esp]
mov cl, byte [esi]
test cl, cl
je 0x42b7e5
test edi, edi
je 0x42b7e9
movsx eax, dl
add eax, 0xffffff9f
cmp eax, 0x19
ja case.default.0x42b75d
jmp dword [eax*4 + 0x42b818]
mov dl, 0x41
jmp case.default.0x42b75d
mov dl, 0x42
jmp case.default.0x42b75d
mov dl, 0x43
jmp case.default.0x42b75d
mov dl, 0x44
jmp case.default.0x42b75d
mov dl, 0x45
jmp case.default.0x42b75d
mov dl, 0x46
jmp case.default.0x42b75d
mov dl, 0x47
jmp case.default.0x42b75d
mov dl, 0x48
jmp case.default.0x42b75d
mov dl, 0x49
jmp case.default.0x42b75d
mov dl, 0x4a
jmp case.default.0x42b75d
mov dl, 0x4b
jmp case.default.0x42b75d
mov dl, 0x4c
jmp case.default.0x42b75d
mov dl, 0x4d
jmp case.default.0x42b75d
mov dl, 0x4e
jmp case.default.0x42b75d
mov dl, 0x4f
jmp case.default.0x42b75d
mov dl, 0x50
jmp case.default.0x42b75d
mov dl, 0x51
jmp case.default.0x42b75d
mov dl, 0x52
jmp case.default.0x42b75d
mov dl, 0x53
jmp case.default.0x42b75d
mov dl, 0x54
jmp case.default.0x42b75d
mov dl, 0x55
jmp case.default.0x42b75d
mov dl, 0x56
jmp case.default.0x42b75d
mov dl, 0x57
jmp case.default.0x42b75d
mov dl, 0x58
jmp case.default.0x42b75d
mov dl, 0x59
jmp case.default.0x42b75d
mov dl, 0x5a
push ecx
call fcn.0042b4f0
add esp, 4
cmp dl, al
jne 0x42b7e5
mov dl, byte [ebx + 1]
inc ebx
dec edi
inc esi
test dl, dl
jne 0x42b740
test edi, edi
jne 0x42b7f3
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
movzx eax, byte [ebx]
push eax
call fcn.0042b4f0
mov dl, al
movzx eax, byte [esi]
push eax
call fcn.0042b4f0
add esp, 8
xor ecx, ecx
cmp dl, al
sete cl
pop edi
pop esi
pop ebx
mov eax, ecx
pop ebp
ret
Function at 0x42b880
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0x10]
cmp edi, 1
jb 0x42b92c
mov edx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
sub esi, edx
lea esp, [esp]
mov al, byte [edx]
movsx ecx, al
add ecx, 0xffffff9f
cmp ecx, 0x19
ja case.default.0x42b8ad
jmp dword [ecx*4 + 0x42b930]
mov al, 0x41
jmp case.default.0x42b8ad
mov al, 0x42
jmp case.default.0x42b8ad
mov al, 0x43
jmp case.default.0x42b8ad
mov al, 0x44
jmp case.default.0x42b8ad
mov al, 0x45
jmp case.default.0x42b8ad
mov al, 0x46
jmp case.default.0x42b8ad
mov al, 0x47
jmp case.default.0x42b8ad
mov al, 0x48
jmp case.default.0x42b8ad
mov al, 0x49
jmp case.default.0x42b8ad
mov al, 0x4a
jmp case.default.0x42b8ad
mov al, 0x4b
jmp case.default.0x42b8ad
mov al, 0x4c
jmp case.default.0x42b8ad
mov al, 0x4d
jmp case.default.0x42b8ad
mov al, 0x4e
jmp case.default.0x42b8ad
mov al, 0x4f
jmp case.default.0x42b8ad
mov al, 0x50
jmp case.default.0x42b8ad
mov al, 0x51
jmp case.default.0x42b8ad
mov al, 0x52
jmp case.default.0x42b8ad
mov al, 0x53
jmp case.default.0x42b8ad
mov al, 0x54
jmp case.default.0x42b8ad
mov al, 0x55
jmp case.default.0x42b8ad
mov al, 0x56
jmp case.default.0x42b8ad
mov al, 0x57
jmp case.default.0x42b8ad
mov al, 0x58
jmp case.default.0x42b8ad
mov al, 0x59
jmp case.default.0x42b8ad
mov al, 0x5a
mov byte [esi + edx], al
mov al, byte [edx]
inc edx
test al, al
je 0x42b92b
dec edi
jne 0x42b8a0
pop esi
pop edi
pop ebp
ret