joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10044900
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
xor eax, 0xffffffff
test ecx, ecx
mov esi, dword [ebp + 8]
je 0x10044929
xor al, byte [esi]
movzx edx, al
shr eax, 8
mov edx, dword [edx*4 + 0x539d100]
inc esi
xor eax, edx
dec ecx
jne 0x10044914
xor eax, 0xffffffff
pop esi
leave
ret 0xc

Function at 0x50ce50
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.QNhjSkbP
lea edi, [esi - 0x9000]
push edi
or ebp, 0xffffffff
jmp 0x50ce72
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x50ce79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x50ce68
mov eax, 1
add ebx, ebx
jne 0x50ce8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x50ce80
jne 0x50ce9c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x50ce80
xor ecx, ecx
sub eax, 3
jb 0x50ceb0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x50cf22
mov ebp, eax
add ebx, ebx
jne 0x50cebb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x50cec8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x50ceec
inc ecx
add ebx, ebx
jne 0x50ced8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x50cecd
jne 0x50cee9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x50cecd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x50cf0c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x50cefd
jmp 0x50ce6e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x50cf0c
add edi, ecx
jmp 0x50ce6e
pop esi
lea edi, [esi + 0xa000]
mov eax, dword [edi]
or eax, eax
je 0x50cf6b
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xeacc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xeb24]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x50cf29
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xeb2c]
or eax, eax
je 0x50cf65
mov dword [ebx], eax
add ebx, 4
jmp 0x50cf46
call dword [esi + 0xeb28]
mov ebp, dword [esi + 0xeb30]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x50cf9f
sub esp, 0xffffff80
jmp section.bUItIFMf

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
jmp fcn.00401219
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x40279c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40c02c], 0x8088405
inc edx
mov dword [0x40c02c], edx
mul edx
mov eax, edx
ret

Function at 0x4042e8
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x1bde303b
mov eax, 0x7a201d3e
xor eax, edi
mov ecx, eax
xor ecx, 0xffffffff
and ecx, 0x6359b48a
and eax, 0x9ca64b75
or eax, ecx
push eax
pop ebx
mov ecx, ebx
xor ecx, 0xffffffff
and ecx, 0xffffffff
and ebx, 0
or ebx, ecx
and ebx, 0x30a2d60f
and eax, 0xcf5d29f0
or eax, ebx
push 0x3710ca27
retf 0x3710
mov edx, 0x37501ba7
pop edi
xor edx, edi
mov edi, dword [edx]
mov edx, dword [edi]
mov edi, 0xca524053
xor edx, edi
mov ebx, edx
push ebx
pop ebx
mov esi, ebx
mov edx, esi
mov esi, edx
mov ecx, esi
mov edx, ecx
mov edi, 0xfffffffc
add esp, edi
mov dword [esp], edx
mov edi, 0
xor edi, ebx
mov eax, edi
mov esi, eax
mov eax, 0x60590f6c
xor eax, 0xededb89e
xor esi, eax
mov ecx, 0x724b480d
xor esi, ecx
and esi, 0x4107bfd8
and ebx, 0xbef84027
or ebx, esi
push ebx
pop eax
mov edx, eax
add esp, 0xfffffffc
mov dword [esp], edx
pop edi
xor edi, 0
jne 0x404011
push 0x17eee025
mov eax, 0x167a28a9
pop esi
push 0x5d81485
mov eax, 0x13062eb7
pop edx
xor eax, edx
mov ebx, 0x258391fa
xor ebx, 0x335dabc8
xor ebx, eax
mov edx, 0x2c610002
mov esi, 0x2c19c
xor edx, esi
push edx
mov edi, 0x3e9a64b3
xor edi, 0x12f9a52d
pop ecx
xor edi, ecx
xor ebx, edi
cmp ebx, 0
je 0x403f1d
add byte [eax], al
add byte [ebx], dh
shl byte [ebx + 0x40c02c], 0xc6
add eax, 0x40c033
add al, dh
add eax, 0x40c034
add al, dh
add eax, 0x40c035
add esp, dword [esi - 0x39]
add eax, 0x40c3dc
add byte [eax], al
mov word [0x40c3ec], 1
call fcn.0040285c
mov eax, 0x40c038
mov edx, 0x404398
call fcn.00403c25
mov eax, 0x40c204
mov edx, 0x404398
call fcn.00403c25
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404391
ret

Function at 0x40520c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405245
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403278
jmp 0x40524e
mov eax, ebx
mov edx, esi
call fcn.0040322c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x405258
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405279
mov al, byte [esp]
jmp 0x40527b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4069dc
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x406a24
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00406978
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406a2b
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x406c2c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x406cba
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x406c77
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [ebp - 0x108]
mov eax, esi
call fcn.00403278
jmp 0x406ca4
call sub.kernel32.dll_GetCommandLineA_1
cmp byte [eax], 0
jne 0x406c8b
lea eax, [ebp - 4]
call fcn.00403198
jmp 0x406c9a
lea edx, [ebp - 4]
call fcn.00406af0
test ebx, ebx
je 0x406c9a
dec ebx
jmp 0x406c7c
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040322c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406cc1
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x406cc8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.00404de0
add esp, 0x104
pop ebx
ret
Function at 0x42bf10
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x23000]
push edi
or ebp, 0xffffffff
jmp 0x42bf32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x42bf39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x42bf28
mov eax, 1
add ebx, ebx
jne 0x42bf4b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x42bf40
jne 0x42bf5c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42bf40
xor ecx, ecx
sub eax, 3
jb 0x42bf70
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42bfe2
mov ebp, eax
add ebx, ebx
jne 0x42bf7b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x42bf88
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x42bfac
inc ecx
add ebx, ebx
jne 0x42bf98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x42bf8d
jne 0x42bfa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42bf8d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x42bfcc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42bfbd
jmp 0x42bf2e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42bfcc
add edi, ecx
jmp 0x42bf2e
pop esi
mov edi, esi
mov ecx, 0x1e3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42bfea
cmp byte [edi], 5
jne 0x42bfea
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x42bfef
lea edi, [esi + 0x29000]
mov eax, dword [edi]
or eax, eax
je 0x42c067
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x31ca4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x31ce0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x42c01c
mov ecx, edi
jns 0x42c04b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x31ce4]
or eax, eax
je 0x42c061
mov dword [ebx], eax
add ebx, 4
jmp 0x42c039
call dword [esi + 0x31ce8]
popal
jmp 0x401ff4
Function at 0x4168e8
Capabilities:
Set registry value

Disassembly:
push ebx
mov edx, 8
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x4168ee
call fcn.00428a20
mov edx, dword [esp + 0x28]
lea ecx, [esp]
call fcn.0041f000
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 4]
call fcn.0041f000
mov edx, dword [esp + 0x30]
lea ecx, [esp + 8]
call fcn.0041f000
mov dword [esp + 0xc], 0
call fcn.00410bce
and eax, eax
je 0x41693e
mov eax, 1
jmp 0x416940
xor eax, eax
and eax, eax
je 0x41694e
mov dword [esp + 0x18], 0xf013f
jmp 0x416956
mov dword [esp + 0x18], 0xf003f
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x1c]
push 0
mov eax, 0x469028
push eax
push closesocket
call sub.ADVAPI32.dll_RegOpenKeyExW
mov ebx, eax
and ebx, ebx
jne 0x4169dc
lea eax, [esp + 0x14]
push eax
push dword [esp + 4]
push dword [esp + 0x18]
call sub.ADVAPI32.dll_RegCreateKeyW
mov ebx, eax
and ebx, ebx
jne 0x4169d3
push dword [esp + 8]
call fcn.00420170
mov ebx, eax
inc ebx
add ebx, ebx
push ebx
push dword [esp + 0xc]
push 2
push 0
push dword [esp + 0x14]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegSetValueExW
mov ebx, eax
and ebx, ebx
jne 0x4169ca
mov dword [esp + 0xc], 1
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegCloseKey
mov eax, dword [esp + 0xc]
jmp 0x4169e4
push dword [esp + 4]
call fcn.00428b50
push dword [esp + 8]
call fcn.00428b50
push dword [esp]
call fcn.00428b50
add esp, 0x20
pop ebx
ret 0xc
Function at 0x4170eb
Capabilities:
Get common file path

Disassembly:
push ebp
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00428a20
push dword [esp + 0x20]
call fcn.0041f3f0
lea edx, [esp]
push edx
push 0
push 0xb
push 1
push 2
call fcn.0042825e
push 0
push 0
call sub.KERNEL32.dll_GetSystemDirectoryW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x417159
mov edx, 0x469028
push edx
call fcn.00428a80
pop edx
push eax
push edx
call fcn.00428b80
pop eax
push eax
call fcn.0041f3c0
pop edx
add eax, edx
jmp 0x4171d5
mov eax, dword [esp + 0x10]
inc eax
lea edx, [esp]
push edx
push eax
call fcn.004283ac
mov ebx, dword [esp + 0x10]
add ebx, ebx
push ebx
mov ebp, dword [esp + 4]
lea eax, [ebp]
push eax
call fcn.004285e0
push dword [esp + 0x10]
lea eax, [ebp]
push eax
call sub.KERNEL32.dll_GetSystemDirectoryW
mov dword [esp + 0x10], eax
push edx
call fcn.00428a80
pop edx
push eax
push edx
call fcn.00428a80
pop edx
push eax
push 0x19
push 0xffffffff
mov ebp, dword [esp + 0x10]
lea eax, [ebp]
push eax
call fcn.00428730
mov edx, 0x469182
push edx
call fcn.00428b80
pop eax
push eax
call fcn.0041f3c0
pop edx
add eax, edx
jmp 0x4171d5
push eax
push dword [esp + 4]
call fcn.0042847d
pop eax
add esp, 0x14
pop ebx
pop ebp
ret

Function at 0x420c32
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
push dword [0x46e314]
call fcn.00427888
mov ebp, eax
or ebx, 0xffffffff
xor eax, eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, dword [esp + 0x1c]
movzx edx, word [eax]
test dx, dx
je 0x420d32
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0x20
mov dword [esp + 0x14], 0x22
cmp dx, word [esp + 0x10]
jne 0x420c88
push 0x20
pop edx
add eax, 2
cmp word [eax], dx
je 0x420c80
movzx edx, word [eax]
mov dword [esp + 0x1c], 1
cmp dx, word [esp + 0x14]
jne 0x420cc8
add eax, 2
mov esi, eax
movzx ecx, word [eax]
test cx, cx
je 0x420d0a
push 0x22
pop edx
cmp cx, dx
je 0x420cba
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x420caa
xor ecx, ecx
cmp word [eax], cx
je 0x420d0a
mov ecx, eax
add eax, 2
jmp 0x420d0c
test dx, dx
je 0x420d12
push 0x20
mov esi, eax
pop ecx
cmp dx, cx
je 0x420cba
add eax, 2
push 0x22
pop edx
cmp word [eax], dx
jne 0x420d00
add eax, 2
movzx ecx, word [eax]
test cx, cx
je 0x420d0a
cmp cx, dx
je 0x420cfd
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x420ced
push 0x20
pop ecx
movzx edx, word [eax]
test dx, dx
jne 0x420cd2
jmp 0x420cba
mov ecx, eax
mov edx, dword [esp + 0x1c]
jmp 0x420d14
xor edx, edx
cmp dword [ebp], ebx
jne 0x420d1d
test edi, edi
jne 0x420d3a
test edx, edx
je 0x420d22
inc ebx
xor edx, edx
mov esi, edx
movzx edx, word [eax]
test dx, dx
jne 0x420c76
test edi, edi
jne 0x420d4b
mov eax, ebx
jmp 0x420d4f
test esi, esi
je 0x420d4b
sub ecx, esi
mov eax, esi
sar ecx, 1
mov dword [edi], ecx
inc dword [ebp]
jmp 0x420d4f
xor ecx, ecx
mov dword [edi], ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x4213f0
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x46d9e8], 0
jne 0x4213fe
call fcn.00421370
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push dword [0x46d9ec]
call esi
test eax, eax
jne 0x421421
call fcn.00421370
push dword [0x46d9ec]
call esi
mov edx, dword [esp + 0x14]
lea esi, [eax + 8]
mov edi, 0x11
lea ecx, [ecx]
imul ecx, edx, 0x53a9b4fb
lea esi, [esi + 4]
mov edx, 1
sub edx, ecx
imul ecx, edx, 0x53a9b4fb
mov dword [esi + 0x40], edx
mov edx, 1
sub edx, ecx
mov dword [esi - 4], edx
dec edi
jne 0x421430
mov dword [eax], edi
lea ebp, [edi + 0x1f]
mov dword [eax + 4], 0xa
mov ebx, dword [eax]
mov edi, dword [eax + 4]
mov edx, dword [eax + ebx*4 + 8]
mov ecx, dword [eax + ebx*4 + 0x4c]
mov esi, dword [eax + edi*4 + 8]
ror ecx, 0xd
add ecx, dword [eax + edi*4 + 0x4c]
dec edi
ror edx, 5
add edx, esi
mov dword [eax + ebx*4 + 8], ecx
mov dword [eax + ebx*4 + 0x4c], edx
dec ebx
jns 0x421490
mov ebx, 0x10
test edi, edi
jns 0x421499
mov edi, 0x10
mov dword [eax], ebx
mov dword [eax + 4], edi
dec ebp
jne 0x421462
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x4214b0
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x46d9e8], 0
jne 0x4214be
call fcn.00421370
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push dword [0x46d9ec]
call esi
mov edx, eax
test edx, edx
jne 0x4214e5
call fcn.00421370
push dword [0x46d9ec]
call esi
mov edx, eax
mov ebx, dword [edx]
mov esi, dword [edx + 4]
mov ebp, dword [esp + 0x14]
inc ebp
mov edi, dword [edx + ebx*4 + 0x4c]
mov eax, dword [edx + ebx*4 + 8]
mov ecx, dword [edx + esi*4 + 8]
ror edi, 0xd
add edi, dword [edx + esi*4 + 0x4c]
dec esi
ror eax, 5
add eax, ecx
mov dword [edx + ebx*4 + 8], edi
mov dword [edx + ebx*4 + 0x4c], eax
dec ebx
jns 0x421518
mov ebx, 0x10
test esi, esi
jns 0x421521
mov esi, 0x10
mov dword [edx], ebx
mov eax, edi
mov dword [edx + 4], esi
test ebp, ebp
je 0x421530
mul ebp
mov eax, edx
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x4220e3
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
push fcn.0042202e
push 0x10
push 0x2c
call fcn.00427acc
push 0
push 0
push 8
mov dword [0x46da08], eax
call fcn.004278f3
cmp word [0x46da00], 0
mov dword [0x46e340], eax
jne 0x4221c8
push edi
lea eax, [esp + 4]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
xor edi, edi
inc edi
test eax, eax
jne 0x42213b
mov word [0x46da00], di
jmp 0x422143
xor eax, eax
mov word [0x46da00], ax
push str.ws2_32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x46da1c], eax
test eax, eax
je 0x4221c7
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x45f128
push eax
call esi
push 0x45f134
push dword [0x46da1c]
mov dword [0x46da0c], eax
call esi
push str.getnameinfo
push dword [0x46da1c]
mov dword [0x46da10], eax
call esi
push str.WSAStringToAddressA
push dword [0x46da1c]
mov dword [0x46da14], eax
call esi
cmp dword [0x46da0c], 0
mov dword [0x46da18], eax
pop esi
je 0x4221c7
cmp dword [0x46da10], 0
je 0x4221c7
cmp dword [0x46da14], 0
je 0x4221c7
test eax, eax
je 0x4221c7
mov dword [0x46da04], edi
pop edi
add esp, 0x190
ret
Function at 0x4222f9
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x840
push ebx
push ebp
push esi
push edi
push dword [0x46e340]
xor esi, esi
mov dword [esp + 0x14], esi
call fcn.00427888
mov ebp, dword [esp + 0x854]
xor edi, edi
inc edi
mov ebx, eax
mov dword [esp + 0x20], ebx
cmp word [ebp + 0x20], di
jne 0x422368
push esi
push esi
push dword [ebp]
call dword [sym.imp.WS2_32.dll_accept]
mov esi, eax
cmp esi, 0xffffffff
je 0x4224ca
lea eax, [ebp + 0x28]
push 0x18
push eax
call fcn.00428206
pop ecx
pop ecx
mov ecx, eax
mov dword [esp + 0x10], edi
mov dword [ecx], edi
mov dword [ecx + 8], esi
mov dword [ecx + 0xc], ebp
mov eax, dword [ebp + 0x24]
mov dword [ebx + 4], eax
mov dword [ebx], ecx
jmp 0x4224ca
cmp word [ebp + 0x22], si
je 0x42239c
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x1c
push eax
lea eax, [esp + 0x38]
push eax
push esi
push 0x800
lea eax, [esp + 0x60]
push eax
push dword [ebp]
call dword [sym.imp.WS2_32.dll_recvfrom]
mov edi, eax
mov dword [esp + 0x14], edi
jmp 0x4223c8
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x10
push eax
lea eax, [esp + 0x28]
push eax
push esi
push 0x800
lea eax, [esp + 0x60]
push eax
push dword [ebp]
call dword [sym.imp.WS2_32.dll_recvfrom]
mov edi, eax
mov dword [esp + 0x14], eax
test edi, edi
jle 0x4224ca
lea ebx, [ebp + 0x28]
mov dword [esp + 0x10], 2
mov esi, dword [ebx]
jmp 0x42240c
xor eax, eax
cmp word [ebp + 0x22], ax
je 0x4223f1
push dword [esp + 0x1c]
lea eax, [esp + 0x38]
jmp 0x4223f9
push dword [esp + 0x18]
lea eax, [esp + 0x28]
push eax
lea eax, [esi + 0xc]
push eax
call sub.MSVCRT.dll_memcmp
add esp, 0xc
test eax, eax
je 0x422412
mov esi, dword [esi]
test esi, esi
jne 0x4223df
jmp 0x42241c
lea ebx, [esi + 8]
test esi, esi
jne 0x42245b
lea ebx, [ebp + 0x28]
push 0x40
push ebx
call fcn.00428206
mov ebx, eax
mov eax, dword [esp + 0x18]
pop ecx
pop ecx
mov dword [ebx], eax
lea edi, [ebx + 4]
mov dword [ebx + 0x24], ebp
mov al, byte [ebp + 0x22]
mov byte [ebx + 0x20], al
xor eax, eax
cmp word [ebp + 0x22], ax
je 0x422451
push 7
pop ecx
lea esi, [esp + 0x34]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x14]
jmp 0x42245d
lea esi, [esp + 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x42244b
xor eax, eax
cmp dword [ebx + 0x2c], 0
jne 0x42248b
push edi
push eax
push dword [0x46d49c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push edi
lea ecx, [esp + 0x54]
mov dword [ebx + 0x2c], eax
push ecx
push eax
mov dword [ebx + 0x30], edi
mov dword [ebx + 0x34], eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
jmp 0x4224be
mov eax, dword [ebx + 0x30]
add eax, edi
push eax
push dword [ebx + 0x2c]
push 8
push dword [0x46d49c]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, eax
lea eax, [esp + 0x50]
push edi
push eax
mov eax, dword [ebx + 0x30]
add eax, ecx
mov dword [ebx + 0x2c], ecx
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add dword [ebx + 0x30], edi
mov eax, dword [esp + 0x20]
mov dword [eax], ebx
mov ecx, dword [ebp + 0x24]
mov dword [eax + 4], ecx
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x840
ret