joyce8/EMBER2024-capa huggingface dataset:
Function at 0x437e2b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x5b93d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0x2c], ecx
call fcn.0041d3a2
mov dword [ebp - 0x48], eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00426e7b
pop ecx
pop ecx
movzx eax, al
test eax, eax
je 0x437e6c
lea eax, [ebp + 8]
push eax
call fcn.004270df
pop ecx
jmp 0x437fed
mov ecx, dword [ebp - 0x2c]
call fcn.0042741b
test eax, eax
je 0x437eb0
mov ecx, dword [ebp - 0x2c]
call fcn.0042741b
mov esi, eax
mov ecx, dword [ebp - 0x2c]
call fcn.00426e3c
cmp esi, eax
jae 0x437eb0
lea eax, [ebp + 8]
push eax
call fcn.004279aa
pop ecx
mov byte [ebp - 0x2d], al
mov ecx, dword [ebp - 0x2c]
call fcn.00426bb4
mov cl, byte [ebp - 0x2d]
mov byte [eax], cl
mov eax, dword [ebp + 8]
jmp 0x437fed
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x4c], 0
jne 0x437ec3
call fcn.0041d3a2
jmp 0x437fed
mov ecx, dword [ebp - 0x2c]
call fcn.0043644f
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x38], 0
jne 0x437f16
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x4c]
mov dword [ebp - 0x4c], eax
lea eax, [ebp + 8]
push eax
call fcn.004279aa
pop ecx
mov byte [ebp - 0x50], al
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
call fcn.0042d2b8
pop ecx
pop ecx
movzx eax, al
test eax, eax
je 0x437f06
mov eax, dword [ebp + 8]
mov dword [ebp - 0x40], eax
jmp 0x437f0e
call fcn.0041d3a2
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
jmp 0x437fed
mov dword [ebp - 0x60], 0x20
lea eax, [ebp + 8]
push eax
call fcn.004279aa
pop ecx
mov byte [ebp - 0x31], al
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x38]
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x31]
push eax
mov eax, dword [ebp - 0x2c]
add eax, 0x40
push eax
mov ecx, dword [ebp - 0x54]
call fcn.00437df9
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x437f71
cmp dword [ebp - 0x38], 1
je 0x437f71
cmp dword [ebp - 0x38], 3
je 0x437fbc
jmp 0x437fe8
mov eax, dword [ebp - 0x58]
lea ecx, [ebp - 0x28]
sub eax, ecx
mov dword [ebp - 0x3c], eax
je 0x437fa1
mov eax, dword [ebp - 0x2c]
push dword [eax + 0x4c]
push dword [ebp - 0x3c]
push 1
lea eax, [ebp - 0x28]
push eax
call fcn.00525337
add esp, 0x10
cmp dword [ebp - 0x3c], eax
je 0x437fa1
call fcn.0041d3a2
jmp 0x437fed
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0x3d], 1
lea eax, [ebp - 0x31]
cmp dword [ebp - 0x5c], eax
je 0x437fb5
mov eax, dword [ebp + 8]
jmp 0x437fed
call fcn.0041d3a2
jmp 0x437fed
mov eax, dword [ebp - 0x2c]
push dword [eax + 0x4c]
push dword [ebp - 0x31]
call fcn.0042d2b8
pop ecx
pop ecx
movzx eax, al
test eax, eax
je 0x437fdb
mov eax, dword [ebp + 8]
mov dword [ebp - 0x44], eax
jmp 0x437fe3
call fcn.0041d3a2
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
jmp 0x437fed
call fcn.0041d3a2
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051dfa2
leave
ret 4
Function at 0x43b690
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 8], ecx
cmp dword [ebp + 0x10], 0
jg 0x43b6b0
jl 0x43b6a7
cmp dword [ebp + 0xc], 0
ja 0x43b6b0
xor eax, eax
xor edx, edx
jmp 0x43b7e5
mov eax, dword [ebp - 8]
cmp dword [eax + 0x38], 0
je 0x43b6cf
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov ecx, dword [ebp - 8]
call fcn.00427b85
jmp 0x43b7e5
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 8]
call fcn.0042662f
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jbe 0x43b73a
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
push eax
call fcn.0040ca47
pop ecx
pop ecx
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
call fcn.00426fe9
push eax
push dword [ebp + 8]
call fcn.0041c2ae
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
mov dword [ebp + 8], eax
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
push dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
call fcn.00426f8e
mov eax, dword [ebp - 8]
cmp dword [eax + 0x4c], 0
je 0x43b7d6
mov ecx, dword [ebp - 8]
call fcn.0043644f
mov dword [ebp - 0x20], 0xfff
cmp dword [ebp - 4], 0xfff
jbe 0x43b7a8
mov eax, dword [ebp - 8]
push dword [eax + 0x4c]
push 0xfff
push 1
push dword [ebp + 8]
call fcn.00524d31
add esp, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x10]
mov dword [ebp + 8], eax
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
cmp dword [ebp - 0x10], 0xfff
je 0x43b7a6
xor eax, eax
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x24]
sbb edx, eax
mov eax, ecx
jmp 0x43b7e5
jmp 0x43b756
cmp dword [ebp - 4], 0
jbe 0x43b7d6
mov eax, dword [ebp - 8]
push dword [eax + 0x4c]
push dword [ebp - 4]
push 1
push dword [ebp + 8]
call fcn.00524d31
add esp, 0x10
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
xor eax, eax
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x24]
sbb edx, eax
mov eax, ecx
leave
ret 0xc
Function at 0x43b7e9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x38], 0
je 0x43b811
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
call fcn.00427c94
jmp 0x43b8ed
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 4]
call fcn.00426b8a
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
cmp dword [ebp + 0x10], 0
jl 0x43b8a2
jg 0x43b839
cmp dword [ebp + 0xc], 0
jbe 0x43b8a2
cmp dword [ebp - 8], 0
jl 0x43b8a2
jg 0x43b847
cmp dword [ebp - 0xc], 0
jbe 0x43b8a2
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 8]
jg 0x43b865
jl 0x43b859
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 0xc]
jae 0x43b865
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ecx
push dword [ebp - 0xc]
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
call fcn.0042741b
push eax
call fcn.0041c2ae
add esp, 0xc
mov eax, dword [ebp - 0xc]
add eax, dword [ebp + 8]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0x10]
sbb ecx, dword [ebp - 8]
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x10], ecx
push dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
call fcn.004273ea
cmp dword [ebp + 0x10], 0
jl 0x43b8e1
jg 0x43b8b0
cmp dword [ebp + 0xc], 0
jbe 0x43b8e1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x4c], 0
je 0x43b8e1
mov eax, dword [ebp - 4]
push dword [eax + 0x4c]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call fcn.00525337
add esp, 0x10
xor ecx, ecx
mov edx, dword [ebp + 0xc]
sub edx, eax
mov eax, dword [ebp + 0x10]
sbb eax, ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
sbb edx, dword [ebp + 0x10]
leave
ret 0xc
Function at 0x44464b
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54b7a2
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x5b93d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
push dword [ebp + 8]
mov ecx, dword [ebp - 0x14]
call fcn.0040dfc0
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
add eax, 0x18
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
add eax, 0x18
push eax
mov ecx, dword [ebp - 0x18]
call fcn.0040dfc0
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x10]
add eax, 0x30
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
add eax, 0x30
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.0040dfc0
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
leave
ret 4
Function at 0x451a0c
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54c85b
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x5b93d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
push dword [ebp + 0x14]
call fcn.00406b1d
pop ecx
mov dword [ebp - 0x18], eax
push dword [ebp + 0x10]
call fcn.00406b1d
pop ecx
mov dword [ebp - 0x1c], eax
mov al, byte [ebp - 0xe]
mov byte [ebp - 0xd], al
mov al, byte [ebp - 0xd]
mov byte [ebp - 0x20], al
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
mov ecx, dword [ebp - 0x14]
call fcn.00451961
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
add eax, 0x30
mov dword [ebp - 0x24], eax
push dword [ebp + 0xc]
call fcn.00406b1d
pop ecx
push eax
mov ecx, dword [ebp - 0x24]
call fcn.0045089f
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
leave
ret 0x10

Function at 0x451c10
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54c85b
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x5b93d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
push dword [ebp + 0x14]
call fcn.00406b1d
pop ecx
mov dword [ebp - 0x18], eax
push dword [ebp + 0x10]
call fcn.00406b1d
pop ecx
mov dword [ebp - 0x1c], eax
mov al, byte [ebp - 0xe]
mov byte [ebp - 0xd], al
mov al, byte [ebp - 0xd]
mov byte [ebp - 0x20], al
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
mov ecx, dword [ebp - 0x14]
call fcn.00451961
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
add eax, 0x30
mov dword [ebp - 0x24], eax
push dword [ebp + 0xc]
call fcn.00406b1d
pop ecx
push eax
mov ecx, dword [ebp - 0x24]
call fcn.00450945
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
leave
ret 0x10

Function at 0x451ea5
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54c85b
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x5b93d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
push dword [ebp + 0x14]
call fcn.00406b1d
pop ecx
mov dword [ebp - 0x18], eax
push dword [ebp + 0x10]
call fcn.00406b1d
pop ecx
mov dword [ebp - 0x1c], eax
mov al, byte [ebp - 0xe]
mov byte [ebp - 0xd], al
mov al, byte [ebp - 0xd]
mov byte [ebp - 0x20], al
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
mov ecx, dword [ebp - 0x14]
call fcn.00451961
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
add eax, 0x30
mov dword [ebp - 0x24], eax
push dword [ebp + 0xc]
call fcn.00406b1d
pop ecx
push eax
mov ecx, dword [ebp - 0x24]
call fcn.0040e986
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
leave
ret 0x10
Function at 0x45ce98
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54d51b
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x5b93d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
push dword [ebp + 8]
call fcn.00406b1d
pop ecx
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00468bb9
pop ecx
pop ecx
and dword [ebp - 4], 0
mov dword [ebp - 0x18], 0x45b90f
mov eax, dword [ebp - 0x10]
add eax, 4
push eax
push 0
lea ecx, [ebp - 0x14]
call fcn.00450354
push eax
push dword [ebp - 0x18]
push 0
push 0
call fcn.0052d969
add esp, 0x18
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0
je 0x45cf18
lea ecx, [ebp - 0x14]
call fcn.00450362
jmp 0x45cf26
mov eax, dword [ebp - 0x10]
and dword [eax + 4], 0
push 6
call fcn.0050a019
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00450315
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
leave
ret 4

Function at 0x45cf41
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54d545
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x5b93d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
push dword [ebp + 8]
call fcn.00406b1d
pop ecx
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00468bb9
pop ecx
pop ecx
and dword [ebp - 4], 0
mov dword [ebp - 0x18], 0x45b989
mov eax, dword [ebp - 0x10]
add eax, 4
push eax
push 0
lea ecx, [ebp - 0x14]
call fcn.0044fddc
push eax
push dword [ebp - 0x18]
push 0
push 0
call fcn.0052d969
add esp, 0x18
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0
je 0x45cfc1
lea ecx, [ebp - 0x14]
call fcn.0044fdea
jmp 0x45cfcf
mov eax, dword [ebp - 0x10]
and dword [eax + 4], 0
push 6
call fcn.0050a019
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0044fd9d
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
leave
ret 4
Function at 0x47037f
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54f017
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x5b93d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
and dword [ebp - 4], 0
push 0x488b38
mov ecx, dword [ebp - 0x10]
call fcn.00473058
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x10]
mov cl, byte [ebp + 8]
mov byte [eax + 0x20], cl
mov eax, dword [ebp - 0x10]
add eax, 0x24
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x14]
call fcn.00405a92
mov byte [ebp - 4], 2
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x2c], ecx
mov dword [edx + 0x30], eax
mov eax, dword [ebp - 0x10]
add eax, 0x38
mov dword [ebp - 0x18], eax
push dword [ebp + 0x18]
mov ecx, dword [ebp - 0x18]
call fcn.0046f165
mov eax, dword [ebp - 0x10]
add eax, 0x98
mov dword [ebp - 0x1c], eax
push dword [ebp + 0x1c]
mov eax, dword [ebp - 0x10]
add eax, 0x38
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.0046e7a1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00410c6b
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
leave
ret 0x18

Function at 0x47043e
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54f017
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x5b93d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
and dword [ebp - 4], 0
push 0x488ce2
mov ecx, dword [ebp - 0x10]
call fcn.00473058
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x10]
mov cl, byte [ebp + 8]
mov byte [eax + 0x20], cl
mov eax, dword [ebp - 0x10]
add eax, 0x24
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x14]
call fcn.00405a92
mov byte [ebp - 4], 2
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x2c], ecx
mov dword [edx + 0x30], eax
mov eax, dword [ebp - 0x10]
add eax, 0x38
mov dword [ebp - 0x18], eax
push dword [ebp + 0x18]
mov ecx, dword [ebp - 0x18]
call fcn.0046f222
mov eax, dword [ebp - 0x10]
add eax, 0xa0
mov dword [ebp - 0x1c], eax
push dword [ebp + 0x1c]
mov eax, dword [ebp - 0x10]
add eax, 0x38
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.0046e7a1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00410c6b
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
leave
ret 0x18
Function at 0x4704fd
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54f017
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x5b93d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
and dword [ebp - 4], 0
push 0x488e8c
mov ecx, dword [ebp - 0x10]
call fcn.00473058
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x10]
mov cl, byte [ebp + 8]
mov byte [eax + 0x20], cl
mov eax, dword [ebp - 0x10]
add eax, 0x24
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x14]
call fcn.00405a92
mov byte [ebp - 4], 2
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x2c], ecx
mov dword [edx + 0x30], eax
mov eax, dword [ebp - 0x10]
add eax, 0x38
mov dword [ebp - 0x18], eax
push dword [ebp + 0x18]
mov ecx, dword [ebp - 0x18]
call fcn.0046f2df
mov eax, dword [ebp - 0x10]
add eax, 0xa0
mov dword [ebp - 0x1c], eax
push dword [ebp + 0x1c]
mov eax, dword [ebp - 0x10]
add eax, 0x38
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.0046e7a1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00410c6b
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
leave
ret 0x18

Function at 0x4705bc
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54f017
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x5b93d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
and dword [ebp - 4], 0
push 0x489036
mov ecx, dword [ebp - 0x10]
call fcn.00473058
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x10]
mov cl, byte [ebp + 8]
mov byte [eax + 0x20], cl
mov eax, dword [ebp - 0x10]
add eax, 0x24
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x14]
call fcn.00405a92
mov byte [ebp - 4], 2
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x2c], ecx
mov dword [edx + 0x30], eax
mov eax, dword [ebp - 0x10]
add eax, 0x38
mov dword [ebp - 0x18], eax
push dword [ebp + 0x18]
mov ecx, dword [ebp - 0x18]
call fcn.0046f359
mov eax, dword [ebp - 0x10]
add eax, 0xa8
mov dword [ebp - 0x1c], eax
push dword [ebp + 0x1c]
mov eax, dword [ebp - 0x10]
add eax, 0x38
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.0046e7a1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00410c6b
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
leave
ret 0x18
Function at 0x483df6
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0xffffffff
je 0x483f17
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x483e53
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
and eax, 8
je 0x483e53
xor eax, eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea ecx, [ebp - 0x1c]
call fcn.0042974a
lea eax, [ebp - 0x1c]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 0x80
push 0xffff
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004a21ae
add esp, 0x1c
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x483e6b
mov byte [ebp - 0xc], 1
jmp 0x483e6f
mov byte [ebp - 0xc], 0
push dword [ebp - 0xc]
push dword [ebp + 0x14]
call fcn.0048d19e
pop ecx
pop ecx
cmp dword [ebp - 4], 0
je 0x483f17
push 0x2733
lea ecx, [ebp - 0x24]
call fcn.00454784
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 0x14]
call fcn.00411798
pop ecx
pop ecx
movzx eax, al
test eax, eax
jne 0x483eca
push 0x4d5
lea ecx, [ebp - 0x2c]
call fcn.00454784
lea eax, [ebp - 0x2c]
push eax
push dword [ebp + 0x14]
call fcn.00411798
pop ecx
pop ecx
movzx eax, al
test eax, eax
je 0x483f17
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
push 0x8004667e
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
and eax, 0xfffffffc
mov ecx, dword [ebp + 0xc]
mov byte [ecx], al
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x483f06
mov byte [ebp - 0x10], 1
jmp 0x483f0a
mov byte [ebp - 0x10], 0
push dword [ebp - 0x10]
push dword [ebp + 0x14]
call fcn.0048d19e
pop ecx
pop ecx
mov eax, dword [ebp - 4]
leave
ret

Function at 0x4946da
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 8], eax
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0xc]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov eax, dword [ebp - 4]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.004a3c48
movzx eax, al
test eax, eax
je 0x49472d
push 0
mov eax, dword [ebp - 4]
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x49474e
push 0
mov eax, dword [ebp - 4]
push dword [eax + 4]
push 0x480de2
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
leave
ret
Function at 0x49684e
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp + 8]
and dword [ecx + eax], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp + 8]
and dword [ecx + eax], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax + 8], 0x67452301
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax + 8], 0xefcdab89
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp + 8]
mov dword [ecx + eax + 8], 0x98badcfe
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp + 8]
mov dword [ecx + eax + 8], 0x10325476
pop ebp
ret

Function at 0x4a028b
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
and dword [ebp - 4], 0
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
push 0
push 0
push dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push dword [ebp - 0xc]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_WSASend]
mov dword [ebp - 0x10], eax
push 1
push dword [ebp + 0x18]
call fcn.0048d19e
pop ecx
pop ecx
mov ecx, dword [ebp + 0x18]
call fcn.00407d38
cmp eax, 0x40
jne 0x4a02e6
push 0x2746
mov ecx, dword [ebp + 0x18]
call fcn.00454d8e
jmp 0x4a0302
mov ecx, dword [ebp + 0x18]
call fcn.00407d38
cmp eax, 0x4d2
jne 0x4a0302
push 0x274d
mov ecx, dword [ebp + 0x18]
call fcn.00454d8e
cmp dword [ebp - 0x10], 0
je 0x4a030d
or eax, 0xffffffff
jmp 0x4a0323
mov ecx, dword [ebp + 0x18]
call fcn.00417deb
push eax
push 0
mov ecx, dword [ebp + 0x18]
call fcn.00409ebd
mov eax, dword [ebp - 4]
leave
ret

Function at 0x4a275a
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 1
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_WSASocketW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4a2784
mov byte [ebp - 8], 1
jmp 0x4a2788
mov byte [ebp - 8], 0
push dword [ebp - 8]
push dword [ebp + 0x14]
call fcn.0048d19e
pop ecx
pop ecx
cmp dword [ebp - 4], 0xffffffff
jne 0x4a27a0
mov eax, dword [ebp - 4]
jmp 0x4a27c0
cmp dword [ebp + 8], 0x17
jne 0x4a27bd
and dword [ebp - 0xc], 0
push 4
lea eax, [ebp - 0xc]
push eax
push 0x1b
push 0x29
push dword [ebp - 4]
call dword [sym.imp.WS2_32.dll_setsockopt]
mov eax, dword [ebp - 4]
leave
ret