joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40fbf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ad8d8
mov eax, dword fs:[0]
push eax
sub esp, 0x98
mov eax, dword [0x4d8104]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push 0
call fcn.00493885
mov dword [ebp - 0xa4], eax
lea eax, [ebp - 0xa4]
push eax
mov dword [ebp - 0xa0], edx
call fcn.004931fc
add esp, 8
test eax, eax
je 0x40fc60
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x9c], xmm0
movups xmm0, xmmword [eax + 0x10]
movups xmmword [ebp - 0x8c], xmm0
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x9c]
push eax
push str._Y__m__d__X
lea eax, [ebp - 0x60]
push 0x50
push eax
call fcn.004937e1
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x68], 0
add esp, 0x10
mov dword [ebp - 0x64], 0xf
mov byte [ebp - 0x78], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40fc92
sub ecx, edx
lea eax, [ebp - 0x60]
push ecx
push eax
lea ecx, [ebp - 0x78]
call fcn.00401a40
cmp dword [esi + 0x14], 0x10
mov eax, esi
mov dword [ebp - 4], 0
jb 0x40fcb9
mov eax, dword [esi]
push dword [esi + 0x10]
lea ecx, [ebp - 0x78]
push eax
call fcn.004018f0
mov ecx, dword [0x4da060]
test ecx, ecx
je 0x40fcf4
cmp dword [ebp - 0x64], 0x10
lea eax, [ebp - 0x78]
push ecx
push dword [ebp - 0x68]
cmovae eax, dword [ebp - 0x78]
push 1
push eax
call fcn.0048a456
push dword [0x4da060]
call fcn.00492f14
add esp, 0x14
mov edx, dword [ebp - 0x64]
cmp edx, 0x10
jb 0x40fd24
mov ecx, dword [ebp - 0x78]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40fd1a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40fd3e
push edx
push ecx
call fcn.00483e09
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00483e17
mov esp, ebp
pop ebp
ret
call fcn.0048969c
int3
Function at 0x41abe0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
sub esp, 0x18
mov eax, dword [0x4d8104]
xor eax, esp
mov dword [esp + 0x14], eax
push edi
mov edi, dword [esp + 0x20]
test edi, edi
je 0x41acba
lea eax, [esp + 4]
push eax
push edi
push 2
call fcn.00434e60
add esp, 0xc
test eax, eax
jne 0x41acba
lea eax, [esp + 8]
push eax
push edi
push 0x17
call fcn.00434e60
add esp, 0xc
test eax, eax
jne 0x41acba
push ebx
push ebp
push esi
mov esi, edi
xor ebx, ebx
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x41ac35
sub esi, ecx
push esi
push 0x2e
push edi
call fcn.00434e30
add esp, 0xc
test eax, eax
je 0x41ac69
sub eax, edi
push eax
push 0x2e
push edi
call fcn.00434e30
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x41ac6b
inc ebx
mov ecx, edi
sub ecx, ebx
add esi, ecx
test ebx, ebx
cmovne edi, ebx
xor ecx, ecx
xor ebp, ebp
mov ebx, 0x1505
lea eax, [edi + esi]
cmp edi, eax
cmova esi, ecx
test esi, esi
je 0x41aca4
mov al, byte [edi]
push eax
call fcn.004287c0
movsx ecx, al
lea edi, [edi + 1]
mov eax, ebx
inc ebp
shl eax, 5
add esp, 4
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp ebp, esi
jb 0x41ac83
pop esi
pop ebp
movzx eax, bl
pop ebx
pop edi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.00483e17
add esp, 0x18
ret
mov ecx, dword [esp + 0x18]
xor eax, eax
pop edi
xor ecx, esp
call fcn.00483e17
add esp, 0x18
ret
Function at 0x4246a0
Capabilities:
Write file on windows

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp dword [edi + 0x600], 0
je 0x4246e4
push esi
push 1
push edi
call fcn.00416a50
push dword [edi + 0x594]
mov eax, dword [edi + 0x600]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push edi
call eax
push 0
push edi
mov esi, eax
call fcn.00416a50
add esp, 0x24
mov eax, esi
pop esi
pop edi
ret
mov eax, dword [esp + 0xc]
cmp eax, 2
ja 0x42471d
push dword [edi + 0x590]
lea eax, [eax + eax*2]
push 1
add eax, 0x4b5c98
push 2
push eax
call fcn.0048a456
push dword [edi + 0x590]
push 1
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call fcn.0048a456
add esp, 0x20
xor eax, eax
pop edi
ret

Function at 0x424b40
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
sub esp, 0x10c
mov eax, dword [0x4d8104]
xor eax, esp
mov dword [esp + 0x108], eax
mov ecx, dword [esp + 0x114]
mov eax, dword [esp + 0x118]
push ebx
mov ebx, dword [esp + 0x124]
push ebp
mov ebp, dword [esp + 0x118]
mov dword [esp + 0xc], eax
push esi
push edi
mov eax, dword [ebp + ecx*4 + 0x420]
lea esi, [ebp + 0x448]
mov dword [esp + 0x10], eax
mov eax, ecx
shl eax, 4
add esi, eax
mov eax, dword [ebp + 0x568]
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [eax + 0x40], 3
je 0x424c4a
cmp dword [ebp + ecx*4 + 0x438], 0x4249f0
jne 0x424c4a
cmp dword [esi], 0
je 0x424bc4
test edi, edi
je 0x424c4a
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [esp + 0x20]
call fcn.00433710
add esp, 0x14
cmp eax, 0xffffffff
je 0x424c4a
test al, 1
je 0x424c4a
mov ecx, dword [esi]
test ecx, ecx
jne 0x424c1c
mov eax, dword [ebp]
mov eax, dword [eax + 0x91c]
add eax, eax
push eax
mov dword [esi + 4], eax
call dword [0x4d8074]
mov ecx, eax
add esp, 4
mov dword [esi], ecx
test ecx, ecx
je 0x424c38
mov edi, dword [esi + 4]
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
test ecx, ecx
je 0x424c43
mov eax, dword [esi + 8]
push 0
push edi
add eax, ecx
push eax
push dword [esp + 0x1c]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x424c4a
add dword [esi + 8], eax
jmp 0x424c4a
mov dword [ebx], 0x1b
or eax, 0xffffffff
jmp 0x424cba
mov dword [esi + 4], 0
push 0
push dword [esp + 0x130]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.WS2_32.dll_send]
mov esi, eax
mov dword [ebx], 0
cmp esi, 0xffffffff
jne 0x424cb8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp edi, 0x2733
jne 0x424c88
xor esi, esi
mov dword [ebx], 0x51
jmp 0x424cb8
push 0x100
lea eax, [esp + 0x1c]
push eax
push edi
call fcn.00411f50
push eax
push str.Send_failure:__s
push dword [ebp]
call fcn.00424730
mov eax, dword [ebp]
add esp, 0x18
mov dword [eax + 0xd94], edi
mov dword [ebx], 0x37
mov eax, esi
mov ecx, dword [esp + 0x118]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00483e17
add esp, 0x10c
ret
Function at 0x426f40
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
push edi
push 0x4b60ec
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
jne 0x426f5a
pop edi
pop ebx
pop ecx
ret
push ebp
push esi
push str.LoadLibraryExA
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [esp + 0x18]
mov ebp, eax
push 0x4b6108
push esi
call fcn.004948e0
add esp, 8
test eax, eax
je 0x426fa2
test ebp, ebp
je 0x426f93
push 8
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
test ebp, ebp
je 0x426fc8
push str.AddDllDirectory
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x426fc8
push 0x800
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, eax
mov dword [esp + 0x10], edx
test edx, edx
je 0x42707f
mov ecx, esi
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x426fe5
sub ecx, ebx
lea eax, [edx + 1]
add eax, ecx
push eax
call dword [0x4d8074]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x427075
push dword [esp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x427075
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x427017
sub ecx, edx
mov eax, 0x5c
mov word [ecx + ebx], ax
mov ecx, ebx
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x427030
sub ecx, edx
sub ecx, esi
add ecx, ebx
nop dword [eax]
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x427040
test ebp, ebp
je 0x42706c
push 8
push 0
push ebx
call ebp
push ebx
mov edi, eax
call dword [0x4d8078]
add esp, 4
mov eax, edi
pop esi
pop ebp
pop edi
pop ebx
pop ecx
ret
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push ebx
call dword [0x4d8078]
add esp, 4
pop esi
pop ebp
mov eax, edi
pop edi
pop ebx
pop ecx
ret
Function at 0x42c3a0
Capabilities:
Create udp socket

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x42c3b4
mov eax, dword [eax]
mov eax, dword [eax + 0x78]
mov al, byte [eax + 0xe3]
ret
push 0
push 2
push 0x17
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
jne 0x42c3c8
xor al, al
ret
push eax
push 0
call fcn.00425060
add esp, 8
mov al, 1
ret
Function at 0x435b90
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information
Receive data
Receive data on socket
Send data
Send data on socket
Set socket configuration
Start tcp server

Disassembly:
sub esp, 0x34
mov eax, dword [0x4d8104]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
mov ebx, dword [esp + 0x48]
push esi
mov esi, dword [sym.imp.WS2_32.dll_socket]
push edi
push 6
push 1
push 2
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x18], 1
call esi
mov edi, eax
cmp edi, 0xffffffff
je 0x435d76
xorps xmm0, xmm0
mov eax, 2
push 0x7f000001
movlpd qword [esp + 0x20], xmm0
mov word [esp + 0x18], ax
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [esp + 0x18], eax
xor eax, eax
push 4
mov word [esp + 0x1a], ax
lea eax, [esp + 0x10]
push eax
push 4
push 0xffff
push edi
mov dword [ebx + 4], 0xffffffff
mov dword [ebx], 0xffffffff
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x435d64
push 0x10
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x435d64
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x435d64
push 1
push edi
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x435d64
push 0
push 1
push 2
call esi
mov dword [ebx], eax
cmp eax, 0xffffffff
je 0x435d64
push 0x10
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x435d64
push 0
push 0
push edi
call dword [sym.imp.WS2_32.dll_accept]
mov dword [ebx + 4], eax
cmp eax, 0xffffffff
je 0x435d64
push ebx
push 0x4b1d4c
lea eax, [esp + 0x2c]
push 0xc
push eax
call fcn.00427440
lea esi, [esp + 0x34]
add esp, 0x10
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x435cc2
push 0
sub esi, ecx
lea eax, [esp + 0x28]
push esi
push eax
push dword [ebx]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, esi
jne 0x435d64
push 0
push 0xc
lea eax, [esp + 0x38]
push eax
push dword [ebx + 4]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, esi
jne 0x435d64
lea ecx, [esp + 0x24]
lea edx, [esp + 0x30]
sub esi, 4
jb 0x435d17
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x435d1c
add ecx, 4
add edx, 4
sub esi, 4
jae 0x435d06
cmp esi, 0xfffffffc
je 0x435d49
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x435d64
cmp esi, 0xfffffffd
je 0x435d49
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x435d64
cmp esi, 0xfffffffe
je 0x435d49
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x435d64
cmp esi, 0xffffffff
je 0x435d49
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x435d64
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00483e17
add esp, 0x34
ret
mov esi, dword [sym.imp.WS2_32.dll_closesocket]
push edi
call esi
push dword [ebx]
call esi
push dword [ebx + 4]
call esi
mov ecx, dword [esp + 0x3c]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00483e17
add esp, 0x34
ret
Function at 0x439cc0
Capabilities:
Query environment variable

Disassembly:
push ebx
push ebp
xor ebp, ebp
push esi
push edi
lea esi, [ebp + 1]
push esi
push ebp
call dword [0x4d807c]
mov edi, eax
add esp, 8
test edi, edi
je 0x439d17
nop word [eax + eax]
push esi
push edi
push dword [esp + 0x1c]
mov ebp, edi
mov ebx, esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
test esi, esi
je 0x439d2f
cmp esi, ebx
je 0x439d2f
cmp esi, 0x8000
ja 0x439d2f
cmp esi, ebx
jb 0x439d28
push esi
push edi
call dword [0x4d807c]
mov edi, eax
add esp, 8
test edi, edi
jne 0x439ce0
push ebp
call dword [0x4d8078]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
push edi
call dword [0x4d8078]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x43dcd0
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
push edi
push 0
mov byte [esp + 0x16], al
lea eax, [esp + 0x14]
mov edi, dword [esi]
push 3
push eax
push dword [esi + 0x420]
mov byte [esp + 0x20], 0xff
mov byte [esp + 0x21], bl
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x43dd1c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push edi
call fcn.00424730
add esp, 0xc
push dword [esp + 0x18]
push ebx
push str.SENT
push dword [esi]
call fcn.0043d8e0
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x43de50
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
cmp dword [esp + 0xc], 0x1f
mov eax, dword [esp + 8]
push ebp
mov eax, dword [eax]
mov dword [esp + 4], eax
mov ebp, dword [eax + 0x138]
jne 0x43dfa0
push ebx
push esi
push edi
lea ebx, [ebp + 0x1cb0]
lea edi, [ebp + 0x1eb0]
mov dword [edi], ebx
cmp ebx, edi
jae 0x43de8b
mov byte [ebx], 0xff
inc dword [edi]
mov eax, dword [edi]
jmp 0x43de8d
mov eax, ebx
cmp eax, edi
jae 0x43dea1
mov byte [eax], 0xfa
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x43dea1
mov byte [eax], 0x1f
inc dword [edi]
movzx eax, word [ebp + 0x1ca8]
mov esi, dword [sym.imp.WS2_32.dll_htons]
push eax
call esi
movzx eax, ax
mov dword [esp + 0x1c], eax
movzx eax, word [ebp + 0x1caa]
push eax
call esi
mov edx, dword [esp + 0x1c]
movzx ecx, ax
mov eax, dword [edi]
cmp eax, edi
jae 0x43df0b
mov byte [eax], dl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x43df0b
mov byte [eax], dh
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x43df0b
mov byte [eax], cl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x43df0b
shr ecx, 8
mov byte [eax], cl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x43df0b
mov byte [eax], 0xff
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x43df0b
mov byte [eax], 0xf0
mov eax, dword [edi]
inc eax
mov esi, dword [esp + 0x10]
mov dword [ebp + 0x1eb4], eax
sub eax, ebx
sub eax, 2
mov dword [edi], ebx
push eax
lea eax, [ebp + 0x1cb2]
push eax
push 0x3e
push esi
call fcn.0043d9e0
add esp, 0x10
push 0
push 3
push ebx
mov ebx, dword [esp + 0x24]
push dword [ebx + 0x420]
call dword [sym.imp.WS2_32.dll_send]
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jns 0x43df5f
call edi
push eax
push str.Sending_data_failed___d_
push esi
call fcn.00424730
add esp, 0xc
push 4
lea eax, [ebp + 0x1cb3]
push eax
push ebx
call fcn.0043dd40
add esp, 0xc
lea eax, [ebp + 0x1cb7]
push 0
push 2
push eax
push dword [ebx + 0x420]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x43df9d
call edi
push eax
push str.Sending_data_failed___d_
push esi
call fcn.00424730
add esp, 0xc
pop edi
pop esi
pop ebx
pop ebp
pop ecx
ret
Function at 0x461e30
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, ecx
xor cl, cl
cmp dword [esi + 0x4c], 0xffffffff
je 0x462001
push ebx
mov eax, dword [esi + 0x4c]
cmp eax, 0x7c
je 0x462000
cmp eax, 0x29
jne 0x461e68
cmp dword [esi + 0x10], 0
jne 0x462000
test dword [esi + 0x50], 0x10000000
je 0x462005
cmp eax, 0x2e
jne 0x461ec5
push 5
lea ecx, [esi + 0x24]
call fcn.00465d20
mov eax, dword [esi]
mov ecx, dword [esi + 8]
cmp eax, ecx
je 0x461eb9
cmp word [eax], 0x5c
jne 0x461eb6
add eax, 2
cmp eax, ecx
je 0x461eb6
mov ecx, dword [esi + 0x50]
test cl, 8
jne 0x461ea2
movzx edx, word [eax]
cmp edx, 0x28
je 0x461eb4
cmp edx, 0x29
je 0x461eb4
test cl, 0x10
jne 0x461eb6
movzx ecx, word [eax]
cmp ecx, 0x7b
je 0x461eb4
cmp ecx, 0x7d
jne 0x461eb6
mov dword [esi], eax
add dword [esi], 2
mov ecx, esi
call fcn.00466b30
jmp 0x461fed
cmp eax, 0x5c
jne 0x461f2c
mov ecx, esi
call fcn.00465d90
mov eax, dword [esi + 0x50]
and eax, 0x80
je 0x461ef8
cmp word [esi + 0x48], 0x62
jne 0x461ef8
push 4
lea ecx, [esi + 0x24]
call fcn.00465d20
mov ecx, esi
call fcn.00465d90
jmp 0x461ff4
test eax, eax
je 0x461f20
cmp word [esi + 0x48], 0x42
jne 0x461f20
push 4
lea ecx, [esi + 0x24]
call fcn.00465d20
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.00465d90
jmp 0x461ff4
mov ecx, esi
call fcn.00462110
jmp 0x461fed
cmp eax, 0x5b
jne 0x461f4f
mov ecx, esi
call fcn.00465d90
mov ecx, esi
call fcn.004627d0
push 4
push 0x5d
mov ecx, esi
call fcn.00464c90
jmp 0x461fed
cmp eax, 0x28
jne 0x461f79
mov ecx, esi
call fcn.00465d90
mov ecx, esi
call fcn.00466d70
push 5
push 0x29
mov ecx, esi
mov bl, al
call fcn.00464c90
test bl, bl
je 0x461ff4
jmp 0x461fed
cmp eax, 0x5e
jne 0x461f91
push 2
lea ecx, [esi + 0x24]
call fcn.00465d20
mov ecx, esi
call fcn.00465d90
jmp 0x461ff4
cmp eax, 0x24
jne 0x461fa9
push 3
lea ecx, [esi + 0x24]
call fcn.00465d20
mov ecx, esi
call fcn.00465d90
jmp 0x461ff4
cmp eax, 0x2a
je 0x46201a
cmp eax, 0x2b
je 0x46201a
cmp eax, 0x3f
je 0x46201a
cmp eax, 0x7b
je 0x46201a
cmp eax, 0x7d
jne 0x461fcb
test dword [esi + 0x50], 0x10000000
je 0x46200c
cmp eax, 0x5d
jne 0x461fd9
test dword [esi + 0x50], 0x10000000
je 0x462013
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.004613c0
mov ecx, esi
call fcn.00465d90
mov ecx, esi
call fcn.00465de0
cmp dword [esi + 0x4c], 0xffffffff
mov cl, 1
jne 0x461e40
pop ebx
mov al, cl
pop esi
ret
push 5
call fcn.0046e928
push 6
call fcn.0046e928
push 4
call fcn.0046e928
push 0xa
call fcn.0046e928
int3

Function at 0x467d70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x467da1
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x467d90
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x469ae0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aea8b
mov eax, dword fs:[0]
push eax
sub esp, 0x8bc
mov eax, dword [0x4d8104]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov dword [ebp - 0x82c], 0
cmp byte [0x4da254], 0
je 0x469ccb
cmp dword [ebp + 0xc], 0
je 0x469ccb
push 0x800
lea eax, [ebp - 0x810]
push 0
push eax
call fcn.00486710
add esp, 0xc
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
lea eax, [ebp - 0x810]
push 0x400
push eax
call fcn.00407840
push dword [eax + 4]
push dword [eax]
call fcn.0048cd1f
add esp, 0x1c
mov dword [ebp - 0x8c8], 0x4c057c
push 0
lea eax, [ebp - 0x8c4]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x878]
mov dword [ebp - 0x82c], 1
mov dword [ebp - method.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.virtual_0], vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov dword [ebp - 0x87c], 0x48
call fcn.0046cef0
mov eax, dword [ebp - 0x8c8]
mov dword [ebp - 4], 2
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.virtual_0], vtable.std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov eax, dword [ebp - 0x8c8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x50]
mov dword [ebp + ecx - 0x8cc], eax
lea eax, [ebp - 0x8c4]
mov ecx, eax
mov dword [ebp - 0x830], eax
call fcn.0046ae50
mov dword [ebp - method.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.virtual_0], vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov dword [ebp - 0x88c], 0
mov dword [ebp - 0x888], 4
lea eax, [ebp - 0x810]
mov dword [ebp - 4], 4
push eax
push 0x4c0584
push edi
call fcn.00469a90
add esp, 4
push eax
lea eax, [ebp - 0x8c8]
push 0x4c058c
push eax
call fcn.0046a650
add esp, 8
push eax
call fcn.0046a060
add esp, 8
push eax
call fcn.0046a650
add esp, 8
push eax
call fcn.0046a650
push eax
call fcn.0046ab30
add esp, 0xc
lea eax, [ebp - 0x828]
lea ecx, [ebp - 0x8c8]
push eax
call fcn.0046dc70
cmp dword [eax + 0x14], 8
jb 0x469c7b
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [ebp - 0x814]
cmp eax, 8
jb 0x469ca0
inc eax
lea ecx, [ebp - 0x828]
push eax
push dword [ebp - 0x828]
call fcn.00467bb0
lea ecx, [ebp - 0x878]
call fcn.0046b260
lea eax, [ebp - 0x878]
mov dword [ebp - 4], 5
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.0046f463
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00483e17
mov esp, ebp
pop ebp
ret
Function at 0x469cf0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aeafc
mov eax, dword fs:[0]
push eax
sub esp, 0x4bc
mov eax, dword [0x4d8104]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov dword [ebp - 0x42c], 0
cmp byte [0x4da254], 0
je 0x469edb
cmp dword [ebp + 0xc], 0
je 0x469edb
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00486710
add esp, 0xc
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
lea eax, [ebp - 0x410]
push 0x400
push eax
call fcn.00407840
push dword [eax + 4]
push dword [eax]
call fcn.0048ccfb
add esp, 0x1c
mov dword [ebp - 0x4c8], 0x4b1bf8
push 0
lea eax, [ebp - 0x4c4]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x478]
mov dword [ebp - 0x42c], 1
mov dword [ebp - method.std::basic_ostream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov dword [ebp - 0x47c], 0x48
call fcn.00468630
mov eax, dword [ebp - 0x4c8]
mov dword [ebp - 4], 2
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__.virtual_0], vtable.std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, dword [ebp - 0x4c8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x50]
mov dword [ebp + ecx - 0x4cc], eax
lea eax, [ebp - 0x4c4]
mov ecx, eax
mov dword [ebp - 0x430], eax
call fcn.0045fdb0
mov dword [ebp - method.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.virtual_0], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov dword [ebp - 0x48c], 0
mov dword [ebp - 0x488], 4
lea eax, [ebp - 0x410]
mov dword [ebp - 4], 4
push eax
push 0x4c05cc
push edi
call fcn.00469a90
add esp, 4
push eax
lea eax, [ebp - 0x4c8]
push str.Autodesk___AdskProxyManager
push eax
call fcn.004029d0
add esp, 8
push eax
call fcn.004029d0
add esp, 8
push eax
call fcn.004029d0
add esp, 8
push eax
call fcn.004029d0
push eax
call fcn.0046aa80
add esp, 0xc
lea eax, [ebp - 0x428]
lea ecx, [ebp - 0x4c8]
push eax
call fcn.00469120
cmp dword [eax + 0x14], 0x10
jb 0x469e8b
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [ebp - 0x414]
cmp eax, 0x10
jb 0x469eb0
inc eax
lea ecx, [ebp - 0x428]
push eax
push dword [ebp - 0x428]
call fcn.00467aa0
lea ecx, [ebp - 0x478]
call fcn.00403b50
lea eax, [ebp - 0x478]
mov dword [ebp - 4], 5
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.0046f463
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00483e17
mov esp, ebp
pop ebp
ret