joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42ce4e
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x42ceeb
push ebx
push esi
call fcn.0042ce17
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0042cdab
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x42ce98
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x42ceea
push edi
push eax
call fcn.0042a174
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x42ceb8
call fcn.0042a13a
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x42cee9
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0042cdab
add esp, 0x20
test eax, eax
jne 0x42ced7
push edi
call fcn.0042a13a
jmp 0x42cedf
push ebx
call fcn.0042a13a
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x42d158
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4399d8
push 0x4399d0
push str.FlsAlloc
push 0x1f
call fcn.0042d074
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42d18c
push dword [ebp + 8]
mov ecx, esi
call dword [0x437264]
call esi
jmp 0x42d192
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x42d1d6
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4399e8
push 0x4399e0
push str.FlsGetValue
push 0x21
call fcn.0042d074
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42d20d
push dword [ebp + 8]
mov ecx, esi
call dword [0x437264]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x42d215
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4399f0
push 0x4399e8
push str.FlsSetValue
push 0x22
call fcn.0042d074
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42d24f
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x437264]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x4340f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43411d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43411d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x405d9a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x448574], 0
push esi
jne 0x405dd1
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405dab
mov dword [ecx*4 + 0x448570], eax
inc ecx
cmp ecx, 0x100
jl 0x405da6
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405e02
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x448570]
xor eax, esi
inc ecx
dec edx
jne 0x405de4
pop edi
not eax
pop esi
ret 0xc

Function at 0x427432
Capabilities:
Encode data using xor

Disassembly:
pop ebp
clc
pushal
lea edi, [ebp + 0x42]
mov si, 0x256
cld
mov cl, byte [edi]
xor cl, 0x59
rol cl, 0xc4
xor cl, 0x18
mov byte [edi], cl
inc edi
dec si
jne 0x42743d
jmp 0x427495
fmul st(0)
fdivr dword [esi + 0x7d0c6bc0]
invalid
Function at 0x4235a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58c038
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x5ed130]
xor eax, ebp
mov dword [ebp - 0x18], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x68], ecx
mov eax, dword [ebp - 0x68]
cmp dword [eax + 0x3c], 0
je 0x4235e0
mov ecx, dword [ebp - 0x68]
movzx edx, byte [ecx + 0x41]
test edx, edx
jne 0x4235ec
mov al, 1
jmp 0x42378f
mov dword [ebp - 0x10], 8
call fcn.0041a230
push eax
mov eax, dword [ebp - 0x68]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x68]
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 0x3c], eax
call fcn.0041a230
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.0041a210
add esp, 8
movzx eax, al
test eax, eax
je 0x42362f
xor al, al
jmp 0x42378f
push 0
push 8
lea ecx, [ebp - 0x34]
call fcn.0041fc50
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x48]
push edx
lea ecx, [ebp - 0x34]
call fcn.00402300
mov ecx, eax
call fcn.00423830
mov esi, eax
lea ecx, [ebp - 0x34]
call fcn.00438d80
add esi, eax
push esi
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x34]
call fcn.00402300
mov ecx, eax
call fcn.00423830
push eax
mov ecx, dword [ebp - 0x68]
add ecx, 0x44
push ecx
mov edx, dword [ebp - 0x68]
mov ecx, dword [edx + 0x3c]
call fcn.00425e90
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
je 0x4236aa
cmp dword [ebp - 0x6c], 1
je 0x4236b1
cmp dword [ebp - 0x6c], 3
je 0x42374b
jmp 0x423763
mov eax, dword [ebp - 0x68]
mov byte [eax + 0x41], 0
lea ecx, [ebp - 0x58]
push ecx
lea ecx, [ebp - 0x34]
call fcn.00402300
mov ecx, eax
call fcn.00423830
mov edx, dword [ebp - 0x14]
sub edx, eax
mov dword [ebp - 0x38], edx
je 0x423714
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 1
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x34]
call fcn.00402300
mov ecx, eax
call fcn.00423830
push eax
call fcn.00443593
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x423714
mov byte [ebp - 0x61], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00401600
mov al, byte [ebp - 0x61]
jmp 0x42378f
mov ecx, dword [ebp - 0x68]
movzx edx, byte [ecx + 0x41]
test edx, edx
jne 0x423737
mov byte [ebp - 0x62], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00401600
mov al, byte [ebp - 0x62]
jmp 0x42378f
cmp dword [ebp - 0x38], 0
jne 0x423749
push 0
push 8
lea ecx, [ebp - 0x34]
call fcn.004020d0
jmp 0x42377b
mov byte [ebp - 0x63], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00401600
mov al, byte [ebp - 0x63]
jmp 0x42378f
mov byte [ebp - 0x64], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00401600
mov al, byte [ebp - 0x64]
jmp 0x42378f
jmp 0x423642
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0043dd0c
mov esp, ebp
pop ebp
ret
Function at 0x42e570
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ecx
push ebx
xor ebx, ebx
push edi
mov dword [esp + 8], ebx
cmp dword [esi + 0x100ac], ebx
je 0x42e61f
cmp dword [esi + 0x7c], ebx
jbe 0x42e61f
push ebp
mov ebp, 0xffffff5c
lea edi, [esi + 0xa4]
sub ebp, esi
lea esp, [esp]
movzx ecx, byte [edi]
mov eax, dword [esi + 0x100d0]
mov ebx, dword [esi + 0x100dc]
xor ecx, eax
mov edx, dword [esi + 0x100d8]
shr eax, 8
and ecx, 0xff
mov ecx, dword [ebx + ecx*4]
xor ecx, eax
movzx eax, cl
add eax, dword [esi + 0x100d4]
mov dword [esi + 0x100d0], ecx
mov ecx, dword [esi + 0x100d8]
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 0x100d4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
and edx, 0xfffd
shr ecx, 8
xor ecx, dword [ebx + eax*4]
or edx, 2
mov eax, edx
xor eax, 1
imul eax, edx
mov dword [esi + 0x100d8], ecx
shr eax, 8
xor byte [edi], al
inc edi
lea ecx, [edi + ebp]
cmp ecx, dword [esi + 0x7c]
jb 0x42e5a0
xor ebx, ebx
pop ebp
mov edi, dword [esi + 0x7c]
mov ecx, dword [esi + 0x2c]
mov edx, edi
push edx
mov edx, dword [esi + 0x1c]
lea eax, [esi + 0xa4]
push eax
mov eax, dword [esi + 8]
push ecx
push edx
call eax
add esp, 0x10
cmp eax, edi
je 0x42e648
mov dword [esp + 8], 0xffffffff
add dword [esi + 0x100c0], edi
mov ecx, dword [esi + 0x48]
mov eax, dword [esp + 8]
adc dword [esi + 0x100c4], ebx
add dword [esi + 0x100c8], ecx
pop edi
mov dword [esi + 0x48], ebx
adc dword [esi + 0x100cc], ebx
mov dword [esi + 0x7c], ebx
pop ebx
pop ecx
ret

Function at 0x43dd0c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5ed130]
jne 0x43dd16
repz ret
jmp fcn.00449f06
Function at 0x457897
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0044a4c7
and dword [ebp - 4], 0
cmp dword [0x5fa9fc], 0
mov ebx, eax
jne 0x457948
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4579f9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x590ab4
push edi
call esi
test eax, eax
je 0x4579f9
push eax
call fcn.0044a455
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x5fa9fc], eax
call esi
push eax
call fcn.0044a455
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x5faa00], eax
call esi
push eax
call fcn.0044a455
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x5faa04], eax
call esi
push eax
call fcn.0044a455
pop ecx
mov dword [0x5faa0c], eax
test eax, eax
je 0x457948
push 0x590a5c
push edi
call esi
push eax
call fcn.0044a455
pop ecx
mov dword [0x5faa08], eax
mov eax, dword [0x5faa08]
cmp eax, ebx
je 0x4579a0
cmp dword [0x5faa0c], ebx
je 0x4579a0
push eax
call fcn.0044a4d0
push dword [0x5faa0c]
mov esi, eax
call fcn.0044a4d0
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4579a0
test edi, edi
je 0x4579a0
call esi
test eax, eax
je 0x457997
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x457997
test byte [ebp - 0xc], 1
jne 0x4579a0
or dword [ebp + 0x10], 0x200000
jmp 0x4579d9
mov eax, dword [0x5faa00]
cmp eax, ebx
je 0x4579d9
push eax
call fcn.0044a4d0
pop ecx
test eax, eax
je 0x4579d9
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4579d9
mov eax, dword [0x5faa04]
cmp eax, ebx
je 0x4579d9
push eax
call fcn.0044a4d0
pop ecx
test eax, eax
je 0x4579d9
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x5fa9fc]
call fcn.0044a4d0
pop ecx
test eax, eax
je 0x4579f9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4579fb
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x461990
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x586e68
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5ed130]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.0041a4f0
mov dword [esp + 0x18], 0
test edi, edi
je 0x4619d4
add edi, 0x28
jmp 0x4619d6
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x4619ee
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_std::runtime_error_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_class_std::runtime_error_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x463100
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x587028
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5ed130]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.004013d0
mov dword [esi], vtable.std::invalid_argument.0
mov dword [esp + 0x18], 0
test edi, edi
je 0x46314a
add edi, 0x28
jmp 0x46314c
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x463164
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_std::invalid_argument_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_class_std::invalid_argument_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x46a550
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x587683
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x5ed130]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.00466140
xor ebx, ebx
lea ecx, [esi + 0x18]
mov dword [esp + 0x18], ebx
call fcn.00466140
lea ecx, [esi + 0x40]
mov byte [esp + 0x18], 1
call fcn.00466140
mov byte [esi + 0x30], bl
mov byte [esi + 0x31], bl
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov byte [esi + 0x3c], 1
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x475560
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5880d8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5ed130]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.0041a4f0
mov dword [esi], vtable.boost::regex_error.0
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov ecx, dword [edi + 0x2c]
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], vtable.boost::exception.0
mov ecx, dword [edi + 0x34]
mov dword [esp + 0x18], 0
mov dword [esi + 0x34], ecx
test ecx, ecx
je 0x4755c5
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
mov ecx, dword [edi + 0x38]
mov dword [esi + 0x38], ecx
mov edx, dword [edi + 0x3c]
mov dword [esi + 0x3c], edx
mov eax, dword [edi + 0x40]
mov dword [esi + 0x40], eax
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::regex_error_.1.0
mov dword [esi + 0x30], vtable.boost::exception_detail::error_info_injector_class_boost::regex_error_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x475ba0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xf0
mov eax, 0x5e051a
mov dword [esp], eax
mov dword [esp + 4], 0x592074
mov dword [esp + 8], 0x592070
mov dword [esp + 0xc], 0x59206c
mov dword [esp + 0x10], 0x5907dc
mov dword [esp + 0x14], str.._
mov dword [esp + 0x18], 0x5e0518
mov dword [esp + 0x1c], 0x59080c
mov dword [esp + 0x20], 0x592068
mov dword [esp + 0x24], 0x592064
mov dword [esp + 0x28], 0x592060
mov dword [esp + 0x2c], 0x5907d8
mov dword [esp + 0x30], 0x59205c
mov dword [esp + 0x34], 0x592058
mov dword [esp + 0x38], 0x5e0574
mov dword [esp + 0x3c], 0x592054
mov dword [esp + 0x40], str.______
mov dword [esp + 0x44], 0x592044
mov dword [esp + 0x48], 0x591d44
mov dword [esp + 0x4c], 0x591e04
mov dword [esp + 0x50], 0x5907f8
mov dword [esp + 0x54], 0x5907f0
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], 0x592040
mov dword [esp + 0x64], 0x59203c
mov dword [esp + 0x68], 0x592038
mov dword [esp + 0x6c], 0x5907e8
mov dword [esp + 0x70], 0x591d48
mov dword [esp + 0x74], 0x591d38
mov dword [esp + 0x78], 0x591d18
mov dword [esp + 0x7c], 0x591d08
mov dword [esp + 0x80], 0x591d00
mov dword [esp + 0x84], 0x591cf8
mov dword [esp + 0x88], 0x591cf0
mov dword [esp + 0x8c], 0x591d40
mov dword [esp + 0x90], 0x592034
mov dword [esp + 0x94], 0x58e8f4
mov dword [esp + 0x98], 0x5e05c0
mov dword [esp + 0x9c], eax
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], eax
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb8], eax
mov dword [esp + 0xbc], 0x5e05bc
mov dword [esp + 0xc0], 0x591dd0
mov dword [esp + 0xc4], 0x591db4
mov dword [esp + 0xc8], 0x58e700
mov dword [esp + 0xcc], str.ZYXWVUTSRQPONMLKJIHGFDBA
mov dword [esp + 0xd0], 0x591df8
mov dword [esp + 0xd4], 0x590830
mov dword [esp + 0xd8], 0x591d10
mov dword [esp + 0xdc], 0x591dd4
mov dword [esp + 0xe0], 0x591ddc
mov dword [esp + 0xe4], 0x592030
mov dword [esp + 0xe8], 0x591de8
mov dword [esp + 0xec], 0x591dcc
cmp cl, 0x3c
jae 0x475dbd
movzx eax, cl
mov eax, dword [esp + eax*4]
add esp, 0xf0
ret
Function at 0x475fd0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x475fdb
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x4760de
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x592518]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x592518]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x592518]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x592518]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x592518]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x592518]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x592518]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x592518]
xor eax, edx
inc ecx
dec edi
jne 0x475ff6
pop edi
test esi, esi
je 0x476100
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x592518]
xor eax, edx
inc ecx
dec esi
jne 0x4760e2
pop esi
pop ebx
not eax
ret
Function at 0x47c040
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x5ed130]
xor eax, esp
mov dword [esp + 0x190], eax
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x47c095
mov eax, dword [esp]
cmp al, 2
jne 0x47c08f
shr eax, 8
cmp al, 2
jne 0x47c08f
call fcn.0047d070
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.0043dd0c
add esp, 0x194
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x190]
xor ecx, esp
mov eax, 2
call fcn.0043dd0c
add esp, 0x194
ret
Function at 0x487050
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x487082
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2733
neg eax
sbb eax, eax
and eax, 0xffffffe7
add eax, 0x51
ret
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
xor eax, eax
ret

Function at 0x4871c0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xa4
mov eax, dword [0x5ed130]
xor eax, esp
mov dword [esp + 0xa0], eax
mov eax, dword [esp + 0xb8]
push ebx
mov ebx, dword [esp + 0xb0]
push ebp
mov ebp, dword [esp + 0xb8]
push esi
mov esi, dword [esp + 0xb4]
cmp dword [esi + 0x2d0], 0
push edi
je case.default.0x487220
test eax, eax
je case.default.0x487220
mov eax, dword [eax + 0x84]
test eax, eax
je case.default.0x487220
lea edx, [ebx - 1]
mov ecx, str.Data
cmp edx, 3
ja case.default.0x487220
jmp dword [edx*4 + 0x48733c]
mov ecx, str.Header
mov edx, str.from
jmp 0x48723d
mov ecx, str.Header
mov edx, 0x5941ac
push eax
push edx
push ecx
push str.__s__s__s_
lea eax, [esp + 0x20]
push 0xa0
push eax
call fcn.0048a610
lea eax, [esp + 0x28]
add esp, 0x18
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x487260
sub eax, edx
mov edi, eax
mov eax, dword [esi + 0x19c]
test eax, eax
je 0x4872b5
mov ecx, dword [esi + 0x12c]
push ecx
push edi
lea edx, [esp + 0x18]
push edx
push 0
push esi
call eax
add esp, 0x14
test eax, eax
jne 0x487320
mov eax, dword [esi + 0x19c]
test eax, eax
je 0x4872e3
mov ecx, dword [esi + 0x12c]
mov edx, dword [esp + 0xc4]
push ecx
push edx
push ebp
push ebx
push esi
call eax
add esp, 0x14
jmp 0x487320
mov eax, dword [esi + 0x128]
push eax
push 1
push 2
push 0x594188
call fcn.00443593
mov ecx, dword [esi + 0x128]
push ecx
push 1
lea edx, [esp + 0x28]
push edi
push edx
call fcn.00443593
add esp, 0x20
jmp case.default.0x487220
test ebx, ebx
jl 0x48731e
cmp ebx, 2
jg 0x48731e
mov eax, dword [esi + 0x128]
push eax
push 1
lea ecx, [ebx + ebx*2 + 0x594188]
push 2
push ecx
call fcn.00443593
mov edx, dword [esi + 0x128]
mov eax, dword [esp + 0xd4]
push edx
push 1
push eax
push ebp
call fcn.00443593
add esp, 0x20
xor eax, eax
mov ecx, dword [esp + 0xb0]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043dd0c
add esp, 0xa4
ret
Function at 0x487560
Capabilities:
Send data
Send data on socket

Disassembly:
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi + eax*4 + 0x130]
push edi
push 0
push ecx
push edx
push eax
call dword [sym.imp.WS2_32.dll_send]
mov ebx, dword [esp + 0x20]
mov edi, eax
mov dword [ebx], 0
cmp edi, 0xffffffff
jne 0x4875dd
push ebp
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebp, eax
cmp ebp, 0x2733
jne 0x4875b4
pop ebp
pop edi
pop esi
mov dword [ebx], 0x51
xor eax, eax
pop ebx
ret
push ebp
push esi
call fcn.0048c1e0
push eax
mov eax, dword [esi]
push str.Send_failure:__s
push eax
call fcn.004873e0
mov ecx, dword [esi]
add esp, 0x14
mov dword [ecx + 0x85dc], ebp
mov dword [ebx], 0x37
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x488ae0
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x14
xor eax, eax
cmp dword [esi + 0x458], eax
push 4
lea ecx, [esp + 4]
push ecx
setne al
push 8
push 0xffff
push edi
mov dword [esp + 0x14], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jge 0x488b1e
push edi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
push esi
call fcn.00487350
add esp, 0xc
add esp, 0x14
ret
mov edx, dword [esi + 0x45c]
push edx
mov dword [esp + 0xc], 1
call fcn.004a86b0
imul eax, eax, 0x3e8
mov dword [esp + 4], eax
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x460]
push eax
call fcn.004a86b0
imul eax, eax, 0x3e8
add esp, 8
push 0
push 0
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 0xc
lea edx, [esp + 0x20]
push edx
push 0x98000004
push edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x34], eax
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x488b97
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
push esi
call fcn.00487350
add esp, 0x10
add esp, 0x14
ret