joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50b820
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x50ba04
add esp, 0xffffff80
lea edi, [esp + 0x30]
mov esi, dword [esp + 0x84]
call fcn.0045f7cc
lea eax, [esp + 0x30]
mov dword [esp], eax
call fcn.0050b290
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
lea edi, [esp + 0x58]
xor eax, eax
call fcn.0045f316
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], ecx
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], ecx
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], ecx
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], ecx
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], ecx
mov eax, dword [esp + 0x88]
xor ecx, ecx
jmp 0x50b8d2
mov edx, dword [esp + 0x10]
lea ecx, [edx + 1]
cmp ecx, 5
jge 0x50b9a5
mov dword [esp + 0x10], ecx
imul edx, ecx, 0x33
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1d
add edx, ebx
sar edx, 3
mov dword [esp + 0x1c], edx
shl edx, 3
sub ebx, edx
cmp ebx, 0x20
sbb edx, edx
lea esi, [esp + ecx*8 + 0x58]
mov edi, dword [esi]
mov dword [esp + 0xc], edi
mov esi, dword [esi + 4]
mov ecx, ebx
shl edi, cl
and edi, edx
mov dword [esp + 8], edi
xchg edi, eax
mov byte [esp + 0x20], al
xchg edi, eax
lea ebp, [ecx - 0x20]
mov dword [esp + 0x18], ebp
cmp ebp, 0x20
sbb edi, edi
mov dword [esp + 0x14], edi
xchg ebp, ebx
neg ebx
xchg ebp, ebx
cmp ebp, 0x20
sbb edi, edi
shl esi, cl
and esi, edx
mov ecx, ebp
mov edx, dword [esp + 0xc]
mov ebx, edx
shr edx, cl
and edx, edi
or edx, esi
mov ecx, dword [esp + 0x18]
shl ebx, cl
mov ebp, dword [esp + 0x14]
and ebx, ebp
or ebx, edx
mov edx, dword [esp + 8]
mov ebp, edx
shr edx, 8
mov esi, ebx
shl ebx, 0x18
or edx, ebx
mov byte [esp + 0x21], dl
mov edx, ebp
shr ebp, 0x10
mov ebx, esi
shl esi, 0x10
or esi, ebp
xchg esi, eax
mov byte [esp + 0x22], al
xchg esi, eax
mov ebp, ebx
shl ebx, 8
shr edx, 0x18
or edx, ebx
mov byte [esp + 0x23], dl
mov dword [esp + 0x24], ebp
mov edx, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], ebx
mov edx, dword [esp + 0x1c]
xor ecx, ecx
jmp 0x50b9d6
test byte [eax], al
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], 0x20
mov dword [esp + 0x94], 0x20
sub esp, 0xffffff80
ret
movzx esi, byte [eax + ebp]
or esi, ebx
xchg esi, ebx
mov byte [eax + ebp], bl
xchg esi, ebx
inc ecx
cmp ecx, 8
jge 0x50b8cb
movzx ebx, byte [esp + ecx + 0x28]
lea ebp, [edx + ecx]
cmp ebp, 0x20
jge 0x50b8cb
test byte [eax], al
cmp ebp, 0x20
jb 0x50b9c8
mov eax, ebp
mov ecx, 0x20
call fcn.0045f140
nop
call fcn.0045dcf0
jmp fcn.0050b820
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
sub eax, reloc.kernel32.dll_GetFileSize
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x409978
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409a4b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409a64
push ebx
push 0x409a70
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.00403388
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00402750
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004033e8
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x4099f8
mov al, 0x69
call fcn.0040961c
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.0040994c
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409a01
call fcn.0040994c
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409a52
lea eax, [ebp - 4]
call fcn.0040316c
ret

Function at 0x409b04
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409bb8
jmp 0x409bad
cmp dword [esi + 0x10], 0x1000
jne 0x409b99
test byte [esi + 0x15], 1
jne 0x409b99
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409b58
cmp eax, 2
je 0x409b58
cmp eax, 0x10
je 0x409b58
cmp eax, 0x20
jne 0x409b6d
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409b6d
mov bl, 1
xor ebp, ebp
jmp 0x409b7e
mov eax, dword [esi]
add eax, ebp
call fcn.00409afc
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409b71
test bl, bl
je 0x409b99
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409bb8
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409b30
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x49ebc7
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x49ec06
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x49ec06
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x49ec06
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x49ec06
cmp dword [ecx + 0x74], 0xe
jbe 0x49ec06
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4ac8ee
Capabilities:
Encode data using xor
Hash data using murmur3
Read file via mapping

Disassembly:
xchg ebx, eax
inc ebp
push eax
add byte [ecx], dh
adc dh, byte [edi]
add dword [ecx + 0x5047c00d], ecx
add cl, al
enter 0x311c, 0x15
mov eax, 0xe2005043
lds ecx, [ebx + 0x12c0c1c1]

Function at 0x4acb96
Capabilities:
Hash data using murmur3
Read file via mapping

Disassembly:
sbb eax, 0x504631
ror esi, 0x16
xor dword [0x504524], edx
sub eax, 0x24b8e8a
add eax, 0x24b8e8a
or dword [0x504110], ebx
rol esi, 0x16
mov dword [0x50428f], edx
or dword [0x5041a8], ecx
add esi, eax
and dword [0x504744], 0x1dd0226d
xor edx, eax
call fcn.0040477a
sub dword [0x5046bc], 0x11b79e80
inc esi
push eax
add byte [eax + 0x4811b79e], al

Function at 0x4acbdb
Capabilities:
Hash data using murmur3
Read file via mapping

Disassembly:
inc esi
push eax
add byte [eax + 0x4811b79e], al
rol esi, 0xd
push 0
rol esi, 0x1a
inc eax
invalid
invalid

Function at 0x4acbee
Capabilities:
Hash data using murmur3
Read file via mapping

Disassembly:
push eax
cmc
inc dword [ecx + 0x5045aa2d]
add byte [eax + 0x3319d0e7], ah
int3

Function at 0x4acc01
Capabilities:
Hash data using murmur3
Read file via mapping

Disassembly:
xchg esi, eax
inc ebp
push eax
add byte [edx - 0x76f13e88], ah
or eax, 0x5047bc

Function at 0x4acc67
Capabilities:
Hash data using murmur3
Read file via mapping

Disassembly:
call fcn.00402719
xor eax, 0xeac30f2
mov dword [0x5041cc], ecx
neg edx
inc esi
xchg eax, eax
rol esi, 1
neg eax
ror eax, 0xa
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]

Function at 0x4acc8b
Capabilities:
Hash data using murmur3
Read file via mapping

Disassembly:
dec esi
call fcn.0040872c
not esi
xor esi, dword [0x504a13]
mov dword [0x5041cc], ecx
rol edx, 4
xor ecx, dword [0x504ca4]
xor esi, eax
xor dword [0x504497], ecx
ror edi, 0x16
rol edi, 0x16
xor esi, eax
ror edx, 4
not esi
call fcn.00403208
inc esi
push ebx
call fcn.004020ca
xor esi, ebx
dec eax
xor ebx, esp
sub ecx, dword [0x504fae]
xchg esi, esi
dec esi
xchg eax, eax
invalid
out dx, al
invalid
invalid
nop
Function at 0x4acd43
Capabilities:
Hash data using murmur3
Read file via mapping

Disassembly:
sub esi, dword [ebp + esi*8 - 1]
xor dword [0x504491], ecx
mov dword [0x504230], ecx
xor eax, 0x979e088
add dword [0x504736], edx
ror ecx, 0x14
xor esi, eax
not esi
sub ecx, esi
ror esi, 0x16
push 0
rol edi, 0x13
mov dword [0x504154], ebx
call fcn.00402818
sub dword [0x5043fd], edi
add ecx, ebx
xor esi, 0x1c3824
xor dword [0x5043e4], ecx
inc eax
sub edi, esp
call fcn.0040703c
xor edi, 0x92526f5
and dword [0x5046bc], 0x35ab280
xor eax, edi
call fcn.0040477a
xor esi, dword [0x504fdf]
add esi, eax
mov dword [0x5042d0], ecx
xor edi, ebx
call fcn.004063ef
inc esi
sub eax, 0x1193106
add eax, 0x1193106
dec esi
call fcn.00408c0b
xor edi, ebx
sub esi, eax
call fcn.00401ab2
xor eax, edi
mov dword [0x504754], 0x37899d4c
xor edi, 0x92526f5
add edi, esp
dec eax
or dword [0x504231], ecx
xor esi, 0x1c3824
sub ecx, ebx
mov dword [0x5045fc], edi
call fcn.00402386
ror edi, 0x13
push 0x22
sub ecx, dword [0x504eb8]
xor esi, eax
xor edx, dword [0x504a2e]
xor dword [0x504775], edx
inc esi
mov dword [0x5045d0], edi
xor esi, eax
add dword [0x504334], ecx
call fcn.00402719
ror ebx, 6
and dword [0x5046f0], 0x28768690
mov dword [0x50459f], edx
sub ebx, dword [0x5048b7]
xchg edx, eax
sub ecx, dword [0x504aca]
sub ebx, eax
xor edx, esp
xor edx, esp
add ebx, eax
xchg edx, eax
sub dword [0x50462f], esi
xor dword [0x504513], 0x216bb76f
rol ebx, 6
call fcn.00407a90
mov dword [0x5041d8], ebx
xor esi, eax
and dword [0x5047b8], esi
dec esi
mov dword [0x504170], edi
xor esi, eax
push eax
call fcn.00405755
mov dword [0x504858], edi
sub esi, dword [0x5049eb]
add esi, eax
sub edi, dword [0x504dac]
neg edx
sub dword [0x5043f6], 0x233fcd0
mov dword [0x5043f1], edi
call fcn.00402be2
rol esi, 6
add eax, edx
dec eax
xor ebx, dword [0x504ab0]
rol edx, 0xd
xor ecx, dword [0x504ac1]
inc eax
or dword [0x50464c], ebx
xor edx, dword [0x5048b6]
dec eax
ror edx, 0xd
inc eax
sub eax, edx
ror esi, 6
call fcn.00405755
xor dword [0x504149], ebx
neg edx
sub esi, eax
call fcn.00403b24
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
call fcn.00403527
rol esi, 0x17
not esi
xor esi, eax
mov dword [0x504474], ecx
mov dword [0x50425c], 0x12e3d2
call fcn.004022be
ror ecx, 4
call fcn.004066b8
xor esi, eax
call fcn.00403208
xor dword [0x5046a4], 0x34311c12
call fcn.00401ce8
sub ebx, 0x26b5ef40
rol edi, 0x13
neg esi
neg esi
ror edi, 0x13
add ebx, 0x26b5ef40
call fcn.00402719
xor esi, eax
call fcn.00408326
rol ecx, 4
sub dword [0x504504], 0x2d337121
xor esi, eax
not esi
ror esi, 0x17
call fcn.00405e62
mov ecx, ebx
xor esi, eax
ror ecx, 1
xor esi, dword [0x504d7e]
add esi, 0x3d2c43b
and dword [0x50484e], edx
xchg eax, eax
xor esi, edi
call fcn.0040732a
inc edi
sub eax, 0xb44e2e4
xor ecx, edx
dec ecx
call fcn.0040500f
xor ecx, ebx
dec esi
ror esi, 0x1e
xor ebx, esp
xor ebx, esp
rol esi, 0x1e
push ds

Function at 0x4ad7b5
Capabilities:
Encode data using xor

Disassembly:
fdiv dword [ebx]
fimul dword [eax - 0x77]
or eax, 0x504200
Function at 0x4b2920
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4b294d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4b294d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4b2d21
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4da968
push 0x4da960
push str.FlsAlloc
push 0x1e
call fcn.004b33b4
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4b2d55
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
jmp 0x4b2d5b
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4b2d9f
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4da978
push 0x4da970
push str.FlsGetValue
push 0x20
call fcn.004b33b4
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4b2dd6
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x4baac7
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004baad2
Function at 0x401c46
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, reloc.gdi32.dll_SetWorldTransform
push edi
mov eax, dword [ebp + 0x14]
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
mov dword [eax], 0
sub edi, edi
cmp dword [ebp + 0x18], 1
jne reloc.gdi32.dll_SetWorldTransform
mov edx, reloc.gdi32.dll_SetWorldTransform
jmp reloc.gdi32.dll_SetWorldTransform
cmp dword [ebp + 0x18], 2
jne reloc.gdi32.dll_SetWorldTransform
mov edx, reloc.gdi32.dll_CancelDC
jmp reloc.gdi32.dll_SetWorldTransform
sub edx, edx
or edx, reloc.gdi32.dll_SetWorldTransform
lea eax, [ebp - 4]
push eax
push edx
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyExA
or eax, eax
jne reloc.gdi32.dll_SetWorldTransform
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA
and eax, eax
jne reloc.gdi32.dll_SetWorldTransform
cmp dword [ebp - 8], 0
je reloc.gdi32.dll_SetWorldTransform
cmp dword [ebp - 0xc], 1
jne reloc.gdi32.dll_SetWorldTransform
cmp dword [ebp - 8], 1
je reloc.gdi32.dll_SetWorldTransform
mov eax, dword [ebp - 8]
inc eax
push eax
call fcn.00401888
mov edi, eax
lea eax, [ebp - 8]
push eax
push edi
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
push edi
call fcn.00401871
sub edi, edi
jmp reloc.gdi32.dll_SetWorldTransform
mov eax, dword [ebp + 0x14]
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
push dword [ebp - 8]
pop dword [eax]
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
mov eax, edi
and eax, eax
jne reloc.gdi32.dll_SetWorldTransform
cmp dword [ebp + 0x18], 2
jae reloc.gdi32.dll_SetWorldTransform
mov eax, dword [ebp + 0x18]
inc eax
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401c46
pop edi
leave
ret 0x14

Function at 0x401d7f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov eax, dword [ebp + 8]
not eax
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
or ecx, ecx
je reloc.gdi32.dll_SetWorldTransform
mov edx, eax
shr edx, 8
xor al, byte [edi]
and eax, 0xff
mov eax, dword [eax*4 + 0x419c00]
xor eax, edx
inc edi
loop reloc.gdi32.dll_SetWorldTransform
not eax
pop edi
leave
ret 0xc

Function at 0x401f38
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
cmp byte [eax], 0
jne reloc.gdi32.dll_SetWorldTransform
mov eax, 0
leave
ret 4
push dword [ebp + 8]
call sub.kernel32.dll_GetFileAttributesA
cmp eax, reloc.gdi32.dll_SetWorldTransform
je reloc.gdi32.dll_SetWorldTransform
test eax, 0x10
setne al
movzx eax, al
jmp reloc.gdi32.dll_SetWorldTransform
mov eax, 0
leave
ret 4
Function at 0x4038dc
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
add esp, reloc.gdi32.dll_SetWorldTransform
push dword [ebp + 0xc]
pop dword [ebp - reloc.gdi32.dll_SetMagicColors]
mov dword [ebp - reloc.gdi32.dll_GetFontResourceInfoW], 0
mov dword [ebp - reloc.gdi32.dll_AbortPath], 1
lea eax, reloc.gdi32.dll_CancelDC
push dword [ebp + 8]
pop dword [eax]
lea eax, reloc.gdi32.dll_SetMagicColors
push eax
push 0
push 0
lea eax, reloc.gdi32.dll_AbortPath
push eax
push 0
call sub.wsock32.dll_select
cmp eax, reloc.gdi32.dll_SetWorldTransform
je reloc.gdi32.dll_SetWorldTransform
or eax, eax
jne reloc.gdi32.dll_SetWorldTransform
xor eax, eax
jmp reloc.gdi32.dll_SetWorldTransform
mov eax, 1
leave
ret 8

Function at 0x40393c
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, reloc.gdi32.dll_SetWorldTransform
push ebx
sub ebx, ebx
push reloc.shlwapi.dll_StrFromTimeIntervalW
push dword [ebp + 8]
call fcn.004038dc
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
push reloc.shlwapi.dll_StrFromTimeIntervalW
push dword [ebp + 8]
call fcn.004038dc
and eax, eax
jne reloc.gdi32.dll_SetWorldTransform
jmp reloc.gdi32.dll_SetWorldTransform
push 0
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp + 8]
call sub.wsock32.dll_recv
test eax, eax
jle reloc.gdi32.dll_SetWorldTransform
mov eax, dword [ebp + 0x14]
cmp byte [ebp - 1], al
jne reloc.gdi32.dll_SetWorldTransform
mov bl, 1
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
push 0
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp + 0xc]
call dword [edx + reloc.wsock32.dll_WSAIsBlocking]
push dword [ebp + 0xc]
call fcn.00401091
cmp eax, dword [ebp + 0x10]
jb reloc.gdi32.dll_SetWorldTransform
jmp reloc.gdi32.dll_SetWorldTransform
test ebx, ebx
je reloc.gdi32.dll_SetWorldTransform
mov eax, ebx
pop ebx
leave
ret 0x10

Function at 0x4039ae
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, reloc.gdi32.dll_SetWorldTransform
push ebx
sub ebx, ebx
push reloc.shlwapi.dll_StrFromTimeIntervalW
push dword [ebp + 8]
call fcn.004038dc
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
push reloc.shlwapi.dll_StrFromTimeIntervalW
push dword [ebp + 8]
call fcn.004038dc
and eax, eax
jne reloc.gdi32.dll_SetWorldTransform
jmp reloc.gdi32.dll_SetWorldTransform
cmp dword [ebp + 0x10], 0x800
jbe reloc.gdi32.dll_SetWorldTransform
mov eax, reloc.gdi32.dll_SetWorldTransform
jmp reloc.gdi32.dll_SetWorldTransform
mov eax, dword [ebp + 0x10]
push 0
push eax
lea eax, [ebp - 0x800]
push eax
push dword [ebp + 8]
call sub.wsock32.dll_recv
test eax, eax
jns reloc.gdi32.dll_SetWorldTransform
jmp reloc.gdi32.dll_SetWorldTransform
jne reloc.gdi32.dll_SetWorldTransform
inc ebx
jmp reloc.gdi32.dll_SetWorldTransform
push eax
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
push 0
push eax
lea eax, [ebp - 0x800]
push eax
push dword [ebp + 0xc]
call dword [edx + reloc.wsock32.dll_WSAIsBlocking]
pop eax
sub dword [ebp + 0x10], eax
cmp dword [ebp + 0x10], 0
jne reloc.gdi32.dll_SetWorldTransform
inc ebx
jmp reloc.gdi32.dll_SetWorldTransform
test ebx, ebx
je reloc.gdi32.dll_SetWorldTransform
mov eax, ebx
pop ebx
leave
ret 0xc
Function at 0x403c09
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, reloc.gdi32.dll_SetWorldTransform
mov word [ebp - 4], 1
mov word [ebp - 2], reloc.shlwapi.dll_StrChrA
push 4
lea eax, [ebp - 4]
push eax
push reloc.shlwapi.dll_StrCSpnW
push reloc.gdi32.dll_SetWorldTransform
push dword [ebp + 8]
call sub.wsock32.dll_setsockopt
leave
ret 4
Function at 0x404d2b
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, reloc.gdi32.dll_SetWorldTransform
mov dword [ebp - 0x148], 0
mov eax, dword [ebp + 0xc]
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
cmp byte [eax], 0
jne reloc.gdi32.dll_SetWorldTransform
jmp reloc.gdi32.dll_SetWorldTransform
push dword [ebp + 0xc]
call fcn.00402573
and eax, eax
jne reloc.gdi32.dll_SetWorldTransform
push reloc.shlwapi.dll_PathIsUNCServerShareW
push dword [ebp + 0xc]
call fcn.00401db1
jmp reloc.gdi32.dll_SetWorldTransform
push reloc.shlwapi.dll_SHRegGetUSValueW
push dword [ebp + 0xc]
call fcn.00401db1
mov dword [ebp - 0x148], eax
push reloc.gdi32.dll_SetWorldTransform
lea eax, [ebp - 0x140]
push eax
call fcn.0040189f
lea eax, [ebp - 0x140]
push eax
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call sub.kernel32.dll_FindFirstFileA
mov dword [ebp - 0x144], eax
inc eax
je reloc.gdi32.dll_SetWorldTransform
lea edx, [ebp - 0x140]
test dword [edx], 0x10
je reloc.gdi32.dll_SetWorldTransform
lea eax, [edx + 0x2c]
push eax
push reloc.shlwapi.dll_StrRStrIA
call sub.kernel32.dll_lstrcmpiA
and eax, eax
jne reloc.gdi32.dll_SetWorldTransform
jmp reloc.gdi32.dll_SetWorldTransform
lea edx, [ebp - 0x140]
lea eax, [edx + 0x2c]
push eax
push reloc.shlwapi.dll_StrRStrIA
call sub.kernel32.dll_lstrcmpiA
and eax, eax
jne reloc.gdi32.dll_SetWorldTransform
jmp reloc.gdi32.dll_SetWorldTransform
push reloc.shlwapi.dll_PathIsUNCServerShareW
push dword [ebp + 0xc]
call fcn.00401db1
lea edx, [ebp - 0x140]
lea edx, [edx + 0x2c]
push edx
push eax
call fcn.00401e05
push eax
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.00404d2b
call fcn.00401871
jmp reloc.gdi32.dll_SetWorldTransform
lea eax, [edx + 0x2c]
mov dword [ebp - 0x14c], eax
push reloc.shlwapi.dll_StrRStrIA
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call sub.shlwapi.dll_StrStrIA
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
push reloc.shlwapi.dll_PathIsUNCServerShareW
push dword [ebp + 0xc]
call fcn.00401db1
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push eax
call fcn.00401e05
push eax
push eax
cmp dword [ebp + 0x10], 0
je reloc.gdi32.dll_SetWorldTransform
push reloc.shlwapi.dll_ChrCmpIA
push eax
call sub.shlwapi.dll_StrStrIA
jmp reloc.gdi32.dll_SetWorldTransform
mov eax, 1
pop edx
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
push edx
push dword [ebp + 8]
call fcn.00404d14
call fcn.00401871
lea eax, [ebp - 0x140]
push eax
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne reloc.gdi32.dll_SetWorldTransform
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call sub.kernel32.dll_FindClose
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401871
leave
ret 0xc