joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4468c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x494685
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x4b7080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, dword [ebp + 0xc]
mov edi, edx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x10], edx
cmp dword [edx + 0x14], 0xf
jbe 0x4468fb
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x446919
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x446907
push esi
push edx
lea eax, [ebp - 0x18]
push eax
call fcn.004477e0
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x446936
mov dword [ebx], eax
mov byte [ebx + 4], 0
jmp 0x446a80
cmp dword [0x4bef18], 0x71c71c7
jne 0x44694d
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x20], 0x4bef14
mov dword [ebp - 4], 0
push 0x24
mov dword [ebp - 0x1c], 0
call fcn.00492451
add esp, 4
mov edi, eax
mov dword [ebp - 0x1c], edi
push dword [ebp - 0x10]
lea ecx, [edi + 8]
call fcn.00404060
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x18]
mov dword [edi + 0x20], ecx
mov dword [ebp - 4], 1
mov ecx, dword [0x4bef18]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4a9480]
mov eax, dword [0x4bef2c]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x4a9480]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
movss xmm1, dword [0x4bef10]
comiss xmm2, xmm1
jbe 0x446a2d
divss xmm0, xmm1
call fcn.00401520
call fcn.00493120
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [0x4bef2c]
cmp eax, ecx
jae 0x446a0f
cmp eax, 0x200
jae 0x446a0d
shl eax, 3
cmp eax, ecx
jae 0x446a0f
mov eax, ecx
push eax
call fcn.00446ba0
push esi
lea eax, [edi + 8]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.004477e0
mov ecx, dword [0x4bef18]
mov edx, dword [eax]
jmp 0x446a30
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 4]
inc ecx
mov dword [0x4bef18], ecx
mov dword [edi + 4], eax
mov dword [edi], edx
mov dword [eax], edi
mov dword [edx + 4], edi
mov ecx, dword [0x4bef1c]
mov dword [ebp - 0x10], eax
mov eax, dword [0x4bef28]
and eax, esi
mov esi, dword [ecx + eax*8]
cmp esi, dword [0x4bef14]
jne 0x446a64
mov dword [ecx + eax*8], edi
jmp 0x446a76
cmp esi, edx
jne 0x446a6d
mov dword [ecx + eax*8], edi
jmp 0x446a7a
mov edx, dword [ebp - 0x10]
cmp dword [ecx + eax*8 + 4], edx
jne 0x446a7a
mov dword [ecx + eax*8 + 4], edi
mov dword [ebx], edi
mov byte [ebx + 4], 1
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x446ba0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 0x10
bsr ecx, eax
push esi
mov esi, 1
mov eax, esi
shl eax, cl
mov ecx, dword [ebp + 8]
push edi
cmp ecx, eax
jbe 0x446bcb
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
or eax, 1
bsr ecx, eax
mov eax, dword [0x4bef14]
push eax
mov dword [ebp - 8], eax
lea ecx, [ecx + 1]
shl esi, cl
mov ecx, 0x4bef1c
lea eax, [esi + esi]
push eax
call fcn.00442e90
lea eax, [esi - 1]
mov dword [0x4bef2c], esi
mov esi, dword [0x4bef14]
mov dword [0x4bef28], eax
mov eax, dword [ebp - 8]
mov esi, dword [esi]
mov edi, esi
cmp esi, eax
je 0x446cfd
push ebx
cmp dword [esi + 0x1c], 0xf
lea ecx, [esi + 8]
mov edi, dword [edi]
mov edx, dword [ecx + 0x10]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], ecx
jbe 0x446c30
mov edx, dword [ecx]
mov dword [ebp - 4], edx
xor edx, edx
mov ebx, 0x811c9dc5
cmp dword [ecx + 0x10], edx
jbe 0x446c59
mov eax, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
movzx ecx, byte [edx + eax]
inc edx
xor ecx, ebx
imul ebx, ecx, 0x1000193
cmp edx, edi
jb 0x446c42
mov edi, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
and ebx, dword [0x4bef28]
mov ecx, dword [0x4bef1c]
lea ecx, [ecx + ebx*8]
mov dword [ebp - 4], ecx
cmp dword [ecx], eax
jne 0x446c76
mov dword [ecx], esi
mov dword [ecx + 4], esi
jmp 0x446cf2
mov ebx, dword [ecx + 4]
lea eax, [ebx + 8]
push eax
lea eax, [esi + 8]
push eax
call fcn.004045d0
test al, al
jne 0x446cb0
mov ebx, dword [ebx]
cmp ebx, esi
je 0x446ca8
mov edx, dword [esi + 4]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], esi
jmp 0x446cef
mov eax, dword [ebp - 4]
cmp dword [eax], ebx
je 0x446cd2
mov ebx, dword [ebx + 4]
lea eax, [ebx + 8]
push eax
lea eax, [esi + 8]
push eax
call fcn.004045d0
test al, al
je 0x446d05
mov eax, dword [ebp - 4]
cmp dword [eax], ebx
jne 0x446cb7
mov edx, dword [esi + 4]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], esi
mov eax, dword [ebp - 8]
mov esi, edi
cmp edi, eax
jne 0x446c14
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov edx, dword [esi + 4]
mov ebx, dword [ebx]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
jmp 0x446cef
Function at 0x448360
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x4b7080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push dword [0x4be910]
xor ebx, ebx
push 0x18
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x448400
lea eax, [ebp - 0x228]
mov dword [ebp - 0x228], 0x224
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x448400
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Module32Next]
nop
mov eax, str.PhysX3CharacterKinematic_x86.dll
lea ecx, [ebp - 0x208]
nop dword [eax + eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4483e0
test dl, dl
je 0x4483dc
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4483e0
add ecx, 2
add eax, 2
test dl, dl
jne 0x4483c0
xor eax, eax
jmp 0x4483e5
sbb eax, eax
or eax, 1
test eax, eax
je 0x4483f9
lea eax, [ebp - 0x228]
push eax
push esi
call edi
test eax, eax
jne 0x4483b0
jmp 0x4483ff
mov ebx, dword [ebp - 0x214]
pop edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.00492363
mov esp, ebp
pop ebp
ret
Function at 0x44e5f0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4b7080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0x14]
push esi
push 0
push 4
push eax
mov eax, dword [0x4be91c]
add eax, 0xdfd8
push eax
push dword [0x4be878]
call ebx
movss xmm0, dword [0x4a90d0]
comiss xmm0, dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jb 0x44e662
cmp byte [0x4be880], 0
je 0x44e662
push 0
push 4
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x42960000
push eax
mov eax, dword [0x4be91c]
add eax, 0xdfd8
push eax
push dword [0x4be878]
call esi
cmp byte [0x4be908], 0
je 0x44e68d
push 0
push 4
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x3f99999a
push eax
mov eax, dword [0x4be91c]
add eax, 0xdf00
push eax
push dword [0x4be878]
call esi
cmp byte [0x4be8fb], 0
push 0
push 4
je 0x44e6ac
movss xmm0, dword [0x4b7c28]
lea eax, [ebp - 0x1c]
movss dword [ebp - 0x1c], xmm0
jmp 0x44e6b6
mov dword [ebp - 0x10], 0x3fe66666
lea eax, [ebp - 0x10]
push eax
mov eax, dword [0x4be91c]
add eax, 0xdfd4
push eax
push dword [0x4be878]
call esi
cmp byte [0x4be8f0], 0
je 0x44e702
push 0x20
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x44e702
push 0
push 4
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x41880000
push eax
mov eax, dword [0x4be91c]
add eax, 0xe980
push eax
push dword [0x4be878]
call esi
cmp byte [0x4be8f1], 0
push 0
push 4
je 0x44e71b
mov dword [ebp - 0x18], 0xc2810000
lea eax, [ebp - 0x18]
jmp 0x44e725
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [0x4be91c]
add eax, 0xdcd0
push eax
push dword [0x4be878]
call esi
cmp byte [0x4be82e], 0
je 0x44e7ca
cmp byte [0x4be8f1], 0
push 0
push 4
je 0x44e75f
mov dword [ebp - 0x10], 0xc2810000
lea eax, [ebp - 0x10]
jmp 0x44e769
mov dword [ebp - 0x1c], 0
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [0x4be91c]
add eax, 0xdcd0
push eax
push dword [0x4be878]
call esi
cmp byte [0x4be923], 0
je 0x44e7ca
cmp byte [0x4be914], 0
je 0x44e7a8
push 0x56
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x44e7a8
mov dword [ebp - 0xc], 0xc2810000
lea eax, [ebp - 0xc]
jmp 0x44e7b2
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push 0
push 4
push eax
mov eax, dword [0x4be91c]
add eax, 0xdcd0
push eax
push dword [0x4be878]
call esi
push 0
push 4
lea eax, [ebp - 0x20]
push eax
mov eax, dword [0x4be930]
add eax, 0xb98750
push eax
push dword [0x4be878]
call ebx
mov eax, dword [ebp - 0x20]
add eax, 0x184
cmp byte [0x4be88e], 0
push 0
push 4
je 0x44e806
mov dword [ebp - 8], 0
lea ecx, [ebp - 8]
jmp 0x44e810
mov dword [ebp - 0x10], 1
lea ecx, [ebp - 0x10]
push ecx
push eax
push dword [0x4be878]
call esi
push 0
push 4
lea eax, [ebp - 0x20]
push eax
mov eax, dword [0x4be930]
add eax, 0xb98444
push eax
push dword [0x4be878]
call ebx
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 8]
push 0
push 4
add eax, 0x184
mov dword [ebp - 8], 0
cmp byte [0x4be90b], 0
push ecx
push eax
push dword [0x4be878]
jne 0x44e863
mov dword [ebp - 8], 1
call esi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00492363
mov esp, ebp
pop ebp
ret
Function at 0x44ea20
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4b7080]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x4be83e], 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 1
je 0x44ea4d
mov byte [ebp - 0x1f], 1
lea eax, [ebp - 0x1f]
jmp 0x44ea54
mov byte [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
mov eax, dword [0x4be930]
add eax, 0x43e46a
push eax
push dword [0x4be878]
call esi
cmp byte [0x4be8f3], 0
push 0
push 1
je 0x44ea7e
mov byte [ebp - 0x1d], 1
lea eax, [ebp - 0x1d]
jmp 0x44ea85
mov byte [ebp - 0x1e], 0
lea eax, [ebp - 0x1e]
push eax
mov eax, dword [0x4be930]
add eax, 0x4409a2
push eax
push dword [0x4be878]
call esi
push 0
push 4
lea eax, [ebp - 0x14]
push eax
mov eax, dword [0x4be930]
add eax, 0xf57fb4
push eax
push dword [0x4be878]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp byte [0x4be916], 0
je 0x44ead7
push 0x47
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x44ead7
mov byte [ebp - 0x1e], 0
lea eax, [ebp - 0x1e]
jmp 0x44eade
mov byte [ebp - 0x1d], 1
lea eax, [ebp - 0x1d]
push 0
push 1
push eax
mov eax, dword [ebp - 0x14]
add eax, 0xd3ff4
push eax
push dword [0x4be878]
call esi
cmp byte [0x4be8fa], 0
push 0
push 6
je 0x44eb13
mov dword [ebp - 0x14], 0xe1dc8b8b
lea eax, [ebp - 0x14]
mov word [ebp - 0x10], 0
jmp 0x44eb23
mov dword [ebp - 0x1c], 0xe1dc8b8d
lea eax, [ebp - 0x1c]
mov word [ebp - 0x18], 0
push eax
mov eax, dword [0x4be930]
add eax, 0x440a49
push eax
push dword [0x4be878]
call esi
push 0
push 6
lea eax, [ebp - 0xc]
mov word [ebp - 8], 0
push eax
mov eax, dword [0x4be930]
add eax, 0x43f233
mov dword [ebp - 0xc], 0x105887c7
cmp byte [0x4be929], 0
push eax
push dword [0x4be878]
jne 0x44eb6d
mov dword [ebp - 0xc], 0x10589fd9
call esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00492363
mov esp, ebp
pop ebp
ret
Function at 0x455d50
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
Function at 0x458890
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x4588bc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x4588e4
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x4588ea
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x458952
jg 0x458901
test esi, esi
je 0x458952
test ecx, ecx
jl 0x45894d
jg 0x45890b
test eax, eax
je 0x45894d
cmp edi, ecx
jg 0x45891f
jl 0x458915
cmp esi, eax
jae 0x45891f
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x458955
mov ecx, dword [ebp + 8]
jmp 0x45895f
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x458979
jg 0x45895f
test esi, esi
je 0x458979
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x458979
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x458990
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], esi
test eax, eax
jg 0x4589bc
jl 0x4589b0
test ecx, ecx
jne 0x4589bc
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x4589d5
push eax
push ecx
push esi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, ecx
mov eax, dword [eax]
mov dword [ebp - 8], eax
test eax, eax
je 0x458a23
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [ebp - 0xc], edx
mov eax, dword [eax]
test eax, eax
je 0x458a29
mov edi, dword [ebp - 4]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [ebp - 8]
push edi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [ebp - 4], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp - 4]
jmp 0x458a29
lea eax, [ebx + 0x2c]
mov dword [ebp - 0xc], eax
cmp dword [ebx + 0x4c], 0
je 0x458a96
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x458a52
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x458a84
nop
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x458a96
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x458a60
test edi, edi
je 0x458a96
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x458e10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x4b7080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x458e40
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00492363
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x458e7c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x458e7c
lea ecx, [edi - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00492363
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x458f53
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x458ea4
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x458eb0
movsx eax, bl
jmp 0x458ee8
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x458f12
sub eax, 1
je 0x458f12
sub eax, 2
jne 0x458f53
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmove ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00492363
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x458f30
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x458f53
lea ecx, [ebp - 0x25]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 0x30], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00492363
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00492363
mov esp, ebp
pop ebp
ret 4
Function at 0x4595e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4b7080]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x45969c
cmp byte [esi + 0x3d], 0
je 0x45969c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x45968a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x459651
sub eax, 1
je 0x459655
sub eax, 2
jne 0x45968a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00492363
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x459673
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x45968a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00492363
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00492363
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.00492363
mov esp, ebp
pop ebp
ret

Function at 0x45a3e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x494b7d
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x4b7080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 4
call fcn.00492451
mov ecx, eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
mov dword [ecx], eax
lea edi, [esi + 4]
mov dword [ebp - 4], 0
push edi
push 0
push ecx
push 0x45b6e0
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x1c
mov dword [esi], eax
test eax, eax
je 0x45a462
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00492363
mov esp, ebp
pop ebp
ret 4
push 6
mov dword [edi], 0
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x460545
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
push 0x44
mov eax, 0x495286
call fcn.00492c55
mov edi, dword [ebp + 8]
xor eax, eax
mov ebx, dword [ebp + 0xc]
push 0x20
push eax
mov dword [ebp - 4], eax
mov esi, eax
lea eax, [ebp - 0x50]
push eax
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov dword [ebp - 0x48], 1
add esp, 0xc
mov dword [ebp - 0x44], eax
cmp dword [ebx + 0x10], eax
je 0x460594
cmp dword [ebx + 0x14], 0x10
mov esi, ebx
jb 0x460588
mov esi, dword [ebx]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], 4
jmp 0x4605af
cmp dword [edi + 0x10], eax
je 0x4605a3
cmp dword [edi + 0x14], 0x10
mov esi, edi
jb 0x4605a3
mov esi, dword [edi]
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x50], eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x28]
push eax
call fcn.00459c00
pop ecx
pop ecx
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x30]
push ecx
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 1
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
push esi
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x460692
mov esi, dword [ebp - 0x30]
test esi, esi
je 0x46068b
mov ebx, dword [sym.imp.WS2_32.dll_setsockopt]
push 0x81
push 0
push 0
push dword [esi + 0xc]
push dword [esi + 8]
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_WSASocketW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x46062a
push dword [esi + 0xc]
push dword [esi + 8]
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
cmp edi, 0xffffffff
je 0x46067d
cmp byte [ebp + 0x1c], 0
je 0x460642
push 4
xor ecx, ecx
lea eax, [ebp - 0x2c]
push eax
inc ecx
push ecx
push 6
push edi
mov dword [ebp - 0x2c], ecx
call ebx
cmp dword [ebp + 0x44], 0
je 0x460651
push edi
lea ecx, [ebp + 0x20]
call fcn.004685b7
cmp dword [esi + 4], 0x17
jne 0x460668
and dword [ebp - 0x2c], 0
lea eax, [ebp - 0x2c]
push 4
push eax
push 0x1b
push 0x29
push edi
call ebx
push esi
push edi
lea ecx, [ebp + 0x48]
call fcn.00467f41
test al, al
jne 0x4606ad
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
mov esi, dword [esi + 0x1c]
test esi, esi
jne 0x4605f5
mov esi, dword [ebp - 0x30]
push esi
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
or edi, 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00402e20
lea ecx, [ebp + 0x20]
call fcn.0046d738
mov eax, edi
call fcn.00492c13
ret
push dword [ebp - 0x30]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
jmp 0x460695

Function at 0x466524
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x4b7080]
xor eax, esp
mov dword [esp + 0x190], eax
push esi
mov esi, ecx
lea eax, [esp + 4]
push eax
push 2
mov byte [esi], 0
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x466552
mov byte [esi], 1
mov ecx, dword [esp + 0x194]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00492363
add esp, 0x194
ret