joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4151e1
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x41c108
call fcn.0041599a
push 1
call fcn.00415264
pop ecx
test al, al
jne 0x415098
push 7
call fcn.00415762
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.0041522f
mov byte [ebp - 0x24], al
mov eax, dword [0x41fc3c]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x415091
test eax, eax
jne 0x415102
mov dword [0x41fc3c], ecx
push 0x418358
push 0x418344
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x4150e5
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x4151db
push 0x418340
push 0x418318
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x41fc3c], 2
jmp 0x415107
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.004153d1
pop ecx
call fcn.00415756
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x415137
push esi
call fcn.00415347
pop ecx
test al, al
je 0x415137
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.004156eb
call esi
call fcn.0041575c
mov esi, eax
cmp dword [esi], edi
je 0x415155
push esi
call fcn.00415347
pop ecx
test al, al
je 0x415155
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
call fcn.00415878
movzx eax, ax
push eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_narrow_winmain_command_line
push eax
push edi
push 0x400000
call main
mov esi, eax
call fcn.004158ab
test al, al
jne 0x415180
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
test bl, bl
jne 0x415189
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push edi
push 1
call fcn.004153ee
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x4151db
call fcn.004159df
ret
call fcn.00414f1f
jmp 0x415079

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x5f1f74ca
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x67f04b32
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x4f361f
Capabilities:
Encode data using xor

Disassembly:
test ax, bx
jmp 0x58cbb3
push dword [esp + 0xc]
inc dl
sub esp, 0xffffffe8
jle 0x4d859d
stc
stc
popf
jmp 0x58e2bf
popf
push edi
mov byte [esp], bh
inc esi
call fcn.0078eb33
js 0x58dedb
push 0x8f04116a
inc esi
pushfd
pushfd
pushal
call fcn.004fb8f2
push esp
nop
inc esp
xor ch, byte [edi]
mov eax, dword [0xe1c6565a]
invalid

Function at 0x4f38cc
Capabilities:
Get number of processors

Disassembly:
pushal
mov byte [esp + 8], 0x4b
lea esp, [esp + 0x28]
jb 0x58ddf5
pushal
cmp dx, 0xe73b
mov byte [esp + 0xc], 0xd0
test bh, ah
cmp eax, dword [ebp - 0x10]
pushal
lea esp, [esp + 0x40]
jae 0x58ddf5
pushal
test ch, 0xf5
mov ebx, eax
movsx cx, cl
mov edi, eax
shr ch, 6
ror ecx, 8
add ch, 0x74
stc
mov ecx, 0x104
pushfd
call fcn.00590252
xchg byte [ebx], ah
mov dh, 0xa4
cwde
lodsb al, byte [esi]
pop edx
loopne 0x4d79ee
sub al, 0x2c
adc ch, byte [eax + esi*2]
inc esp
in al, dx
int3
add al, 0xb2
push eax
out 0x64, al
mov eax, 0x4db1f6b8
idiv dword [ebx + 0x3f]
xchg dl, ah
mov byte [0xcfa6070f], al
or edi, ebx
daa
invalid
pushfd
lea esp, [esp + 0x4c]
je fcn.0058ddea
cmc
bt di, bx
cmp di, cx
test bh, bl
add eax, edi
stc
push ecx
stc
cmp eax, edx
push dword [esp]
jmp 0x4d7929

Function at 0x4f70be
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
lea esp, [esp + 0xc]
jne 0x4fce7d
bt ax, bp
neg edi
movzx di, bl
clc
mov edi, dword [edx + 0x24]
test si, 0xfd46
cmc
cmp ch, dh
test esi, 0x38f5fd46
cmc
add edi, eax
cmc
call fcn.0078dc03
mov bl, 2
call fcn.0058e1c3
lea esp, [esp + 0x44]
call int.004f7a3b
push 0xd9d5cb63
pushfd
pushal
call fcn.0078c1e4
jbe 0x4f675a
dec edx
cmp byte [edx - 0x40b0a556], ch
push ds
mov edx, dword [edi - 0x39]
loope 0x4f673f
xchg ebx, eax
mov ebx, 0xe3a48399
invalid
sub eax, eax
mov byte [esp + 4], bh
lea esp, [esp + 8]
jp 0x78cc74
push edi
lea esp, [esp + 4]
call int.004f7a3b
pushal
pushfd
pushfd
call fcn.004f4b4e
adc ecx, dword [edi + 0x13]
adc dword [ecx - 0x7b8ba556], esp
fdivr st(2)
loopne 0x4f712f
aam 0x76
call 0x1cae69c2
stosd dword es:[edi], eax
jl 0x4f713c
sbb ah, bl
dec esp
imul ecx, dword [esp + ebp*8 + 0x40], 0x61
jo 0x4f7155
sal byte [edi - 0x10], 1
ja 0x4f70f5
aaa
adc al, 0x9b
stc
xor byte [eax - 0xb0cb7fb], ah
push edi
and byte [0x41b1fa4c], dh
pop ecx
jg 0x4f7103
movsd dword es:[edi], dword [esi]
cmc
clc
push ebp
pop ebp
fnstenv [edx - 0x7e]
pop esi
mov eax, dword [0x7863e881]
add ch, byte [eax - 0x59]
call 0x6851e98d
cmpsd dword [esi], dword es:[edi]
xor al, 2
adc al, 0x57
popfd
loope 0x4f7149
pop ss
ljmp 0xa758:0x8414eddc
jae 0x4f7125
mov ah, 0x59
push esi
dec ebp
mov cl, 0x30
and eax, 0xa611ea4d
cmp eax, 0x55597e5d
retf
imul ebp, esi, 0xb156d6f3
dec edx
dec edx
xchg esi, eax
pop esi
pop ds
outsb dx, byte [esi]
dec ebp
push ss
movsd dword es:[edi], dword [esi]
jp 0x4f7131
out 0xc6, al
retf 0x1971
pushal
pushfd
pushal
jmp 0x4f6770

Function at 0x4fd2e8
Capabilities:
Encode data using xor

Disassembly:
pushfd
lea esp, [esp + 0x10]
jne 0x4f9026
push 0x5d0fb6a3
bsf cx, cx
and cl, bh
mov ecx, dword [ebx]
bt dx, 6
clc
or ecx, ecx
pushfd
call fcn.00585f32
Function at 0x7896f8
Capabilities:
Encode data using xor

Disassembly:
mov byte [esp + 8], ch
lea esp, [esp + 0x34]
je fcn.0058ddea
clc
test cl, dl
add eax, edi
test al, bl
bt edx, esp
cmc
cmp cl, 0x98
cmp eax, edx
pushfd
lea esp, [esp + 4]
jb 0x58ddf5
call fcn.004f706e
aad 0xf4
sal dword [edi - 0x32a57e86], 0x3d
popal
adc eax, 0xda101b0
scasb al, byte es:[edi]
sub dword [ecx], ecx
and dword [ebx + 0x40653b1d], eax
jne 0x789769
pop ebp
cli
sub al, 0x31
dec ebp
jbe 0x789774
push ds
and eax, 0x930d0225
sub eax, 0x5838d7f4
jg 0x7897c4
jmp 0x789757
cmp al, 0x26
adc eax, 0x42ef4e2e
and bh, dh
push cs
test al, 0xee
push edi
ret 0x3163
mov cl, 0x25
popfd
push edi
push ecx
sub dl, byte [esi + 0x63]
push cs
mov eax, 0x40626a77
push 0x62
inc eax
add dh, byte [eax]
adc dh, byte [edx + 0x55]
pop edx
call 0x56508baf
and dword [edx], ebx
inc ecx
jae 0x7897c8
mov esp, 0x773c8201
pop ss
mov dh, 0x1b
sbb edi, dword [edx - 0x400cf751]
xchg ebx, eax
cmpsb byte [esi], byte es:[edi]
retf
jb 0x789812
insb byte es:[edi], dx
inc esp
popal
test al, 0xec
sbb byte [ebp + eax*2 - 0x13], al
invalid
bound eax, qword [eax + 0x5a]
std
cdq
pop edi
jmp [esi - 0x6b]
pop ebp
pop ebp
cmp eax, 0x690bad18
jl 0x78985a
mov al, 0xb
retf
push ecx
shr byte [edi + edx*4], 1
loope 0x789805
push esi
movsd dword es:[edi], dword [esi]
push ds
cdq
mov esp, 0x6a52e89
pop esp
dec esi
adc byte [ecx - 0xc], bl
cmp al, 0x11
out 0x12, al
fstp qword [ecx + ebp]
xchg dword [edx + 0x7b42be01], esi
js 0x7897e5
pop es
adc bl, byte [edx]
cmp byte [edi], dh
pop edi
jp 0x78986c
push cs
pop ds
xchg dword ds:[edx - 0x7150580e], esi
inc edi
mov dl, 0x82
and byte [edi + 0x6389d8b6], 0x22
inc ebp
mov ebp, 0xd5ecddf1
mov ah, 0xbd
mul ebp
das
pop ebx
imul bp, word [ebx + 0x4e], 0x1b
mov esp, 0xbb0bf047
xchg edi, eax
aaa
ret
daa
nop
mov bl, 0x93
cmp ebx, dword [ecx - 0xf3ce351]
jae 0x7898cd
inc ebx
pop edi
push esi
cli
xchg ebx, eax
inc eax
mov edi, fs
pop ds
sub al, byte [edi - 0xa]
cmp ecx, dword [edi + esi + 0x665ea4f3]
movzx esi, cl
mov word [esp + 4], 0x4c09
call fcn.0058603a
imul esi, dword [0x81795769], 0x9ebe2e5a
dec edx
invalid
xchg byte [edi - 0x629a40ea], dh
mov edx, 0x28d80e39
invalid
Function at 0x435779
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x4e4628]
cmp eax, 0xffffffff
jne 0x435885
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
mov dword [esp], 0xa9b100
call sub.msvcrt.dll_memset
mov dword [0xa9b100], 0x44
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
mov dword [esp], 0xa9b144
call sub.msvcrt.dll_memset
mov dword [esp + 0x24], 0xa9b144
mov dword [esp + 0x20], 0xa9b100
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x8000000
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.cmd.exe__c_ver
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateProcessA]
call eax
sub esp, 0x28
test eax, eax
setne al
test al, al
je 0x43587b
mov eax, dword [0xa9b144]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
mov eax, dword [0xa9b144]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [0xa9b148]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov dword [0x4e4628], 1
jmp 0x435885
mov dword [0x4e4628], 0
mov eax, dword [0x4e4628]
leave
ret
Function at 0x4433a7
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0xa8a5b0]
test eax, eax
jne 0x4433e8
mov dword [0xa8a5b0], 1
mov word [0xa86bf0], 0x101
movzx eax, word [0xa86bf0]
movzx eax, ax
mov dword [esp + 4], 0xa86a60
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_WSAStartup]
call eax
sub esp, 8
leave
ret

Function at 0x4433f9
Capabilities:
Create tcp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
call fcn.004433a7
cmp dword [ebp - 0xc], 0
js 0x44342b
cmp dword [ebp - 0xc], 0
js 0x443435
cmp dword [ebp - 0xc], 0
jg 0x44342b
cmp dword [ebp - 0x10], 0xffff
jbe 0x443435
mov eax, 0
jmp 0x443581
mov dword [esp + 8], 6
mov dword [esp + 4], 1
mov dword [esp], 2
mov eax, dword [sym.imp.WS2_32.dll_socket]
call eax
sub esp, 0xc
mov dword [0xa8a590], eax
mov eax, dword [0xa8a590]
cmp eax, 0xffffffff
jne 0x44346f
mov eax, 0
jmp 0x443581
mov word [0xa8a594], 2
mov dword [0xa8a598], 0
mov eax, dword [ebp - 0x10]
movzx eax, ax
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_htons]
call eax
sub esp, 4
mov word [0xa8a596], ax
mov eax, dword [0xa8a590]
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0xa8a594
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_bind]
call eax
sub esp, 0xc
mov dword [0xa8a5a4], eax
mov eax, dword [0xa8a5a4]
cmp eax, 0xffffffff
jne 0x4434e8
mov eax, dword [0xa8a590]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_closesocket]
call eax
sub esp, 4
mov eax, 0
jmp 0x443581
mov eax, dword [0xa8a590]
mov dword [esp + 4], 0x7fffffff
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_listen]
call eax
sub esp, 8
mov dword [0xa8a5a4], eax
mov eax, dword [0xa8a5a4]
cmp eax, 0xffffffff
jne 0x44352a
mov eax, dword [0xa8a590]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_closesocket]
call eax
sub esp, 4
mov eax, 0
jmp 0x443581
mov dword [0xa8a5a8], 1
mov eax, dword [0xa8a590]
mov dword [esp + 8], 0xa8a5a8
mov dword [esp + 4], 0x8004667e
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_ioctlsocket]
call eax
sub esp, 0xc
mov dword [esp + 4], 1
mov dword [esp], 4
call sub.msvcrt.dll_calloc
mov dword [0xa8a5ac], eax
mov eax, dword [0xa8a5ac]
mov edx, dword [0xa8a590]
mov dword [eax], edx
mov eax, dword [0xa8a5ac]
leave
ret
Function at 0x443583
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
call fcn.004433a7
cmp dword [ebp - 0xc], 0
js 0x4435b5
cmp dword [ebp - 0xc], 0
js 0x4435bf
cmp dword [ebp - 0xc], 0
jg 0x4435b5
cmp dword [ebp - 0x10], 0xffff
jbe 0x4435bf
mov eax, 0
jmp 0x4436f5
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_gethostbyname]
call eax
sub esp, 4
mov dword [0xa8a56c], eax
mov eax, dword [0xa8a56c]
test eax, eax
jne 0x4435e7
mov eax, 0
jmp 0x4436f5
mov dword [esp + 8], 6
mov dword [esp + 4], 1
mov dword [esp], 2
mov eax, dword [sym.imp.WS2_32.dll_socket]
call eax
sub esp, 0xc
mov dword [0xa8a570], eax
mov eax, dword [0xa8a570]
cmp eax, 0xffffffff
jne 0x443621
mov eax, 0
jmp 0x4436f5
mov word [0xa8a574], 2
mov eax, dword [0xa8a56c]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [0xa8a578], eax
mov eax, dword [ebp - 0x10]
movzx eax, ax
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_htons]
call eax
sub esp, 4
mov word [0xa8a576], ax
mov eax, dword [0xa8a570]
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0xa8a574
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_connect]
call eax
sub esp, 0xc
mov dword [0xa8a584], eax
mov eax, dword [0xa8a584]
cmp eax, 0xffffffff
jne 0x44369e
mov eax, dword [0xa8a570]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_closesocket]
call eax
sub esp, 4
mov eax, 0
jmp 0x4436f5
mov dword [0xa8a588], 1
mov eax, dword [0xa8a570]
mov dword [esp + 8], 0xa8a588
mov dword [esp + 4], 0x8004667e
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_ioctlsocket]
call eax
sub esp, 0xc
mov dword [esp + 4], 1
mov dword [esp], 4
call sub.msvcrt.dll_calloc
mov dword [0xa8a58c], eax
mov eax, dword [0xa8a58c]
mov edx, dword [0xa8a570]
mov dword [eax], edx
mov eax, dword [0xa8a58c]
leave
ret

Function at 0x4436f7
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [0xa8a548], eax
mov dword [0xa8a54c], 0x10
mov eax, dword [0xa8a548]
mov eax, dword [eax]
mov dword [esp + 8], 0xa8a54c
mov dword [esp + 4], 0xa8a550
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_accept]
call eax
sub esp, 0xc
mov dword [0xa8a560], eax
mov eax, dword [0xa8a560]
cmp eax, 0xffffffff
jne 0x443749
mov eax, 0
jmp 0x4437a0
mov dword [0xa8a564], 1
mov eax, dword [0xa8a560]
mov dword [esp + 8], 0xa8a564
mov dword [esp + 4], 0x8004667e
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_ioctlsocket]
call eax
sub esp, 0xc
mov dword [esp + 4], 1
mov dword [esp], 4
call sub.msvcrt.dll_calloc
mov dword [0xa8a568], eax
mov eax, dword [0xa8a568]
mov edx, dword [0xa8a560]
mov dword [eax], edx
mov eax, dword [0xa8a568]
leave
ret
Function at 0x4437c7
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [0xa8a540], eax
mov eax, dword [0xa8a540]
mov eax, dword [eax]
mov dword [esp + 0xc], 0
mov edx, dword [ebp + 0x10]
mov dword [esp + 8], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_send]
call eax
sub esp, 0x10
mov dword [0xa8a544], eax
leave
ret

Function at 0x443869
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
mov dword [0xa8a52c], eax
mov eax, dword [0xa8a52c]
mov eax, dword [eax + 0xc]
mov dword [0xa8a530], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
test eax, eax
jne 0x4438bb
mov dword [esp], 0x400
call sub.msvcrt.dll_malloc
mov edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0x400
jmp 0x4438bb
nop
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
cmp edx, eax
jne 0x4438f8
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
lea edx, [eax + eax]
mov eax, dword [ebp + 8]
mov dword [eax + 8], edx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_realloc
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [eax + 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov ecx, edx
sub ecx, eax
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
add edx, eax
mov eax, dword [0xa8a530]
mov eax, dword [eax]
mov dword [esp + 0xc], 0
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_recv]
call eax
sub esp, 0x10
mov dword [0xa8a534], eax
mov eax, dword [0xa8a534]
cmp eax, 0xffffffff
jne 0x443956
mov eax, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call eax
mov dword [0xa8a538], eax
jmp 0x443989
mov eax, dword [0xa8a534]
test eax, eax
jle 0x443988
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
mov eax, dword [0xa8a534]
add edx, eax
mov eax, dword [ebp + 8]
mov dword [eax + 4], edx
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
cmp edx, eax
je 0x4438ba
jmp 0x443989
nop
leave
ret
Function at 0x4458ce
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00445507
test eax, eax
sete al
test al, al
je 0x4458fa
mov eax, 0xfffffffe
mov edx, 0xffffffff
jmp 0x445996
mov edx, dword [0x64049c]
mov eax, dword [ebp + 8]
shl eax, 4
lea ecx, [eax*8]
mov ebx, ecx
sub ebx, eax
mov eax, ebx
add eax, edx
mov dword [0xa8a31c], eax
mov eax, dword [0x640498]
mov edx, dword [ebp + 8]
shl edx, 2
add eax, edx
mov dword [0xa8a320], eax
mov edi, 0xa8a328
mov eax, dword [0xa8a320]
mov eax, dword [eax]
mov dword [esp + 4], 0xa8a32c
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetFileSize]
call eax
sub esp, 8
mov dword [edi], eax
mov eax, dword [0xa8a328]
mov edx, dword [0xa8a32c]
mov ebx, eax
and bh, 0xff
mov esi, edx
and esi, 0
mov eax, ebx
xor eax, 0xffffffff
or eax, esi
test eax, eax
jne 0x44598b
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
test eax, eax
setne al
test al, al
je 0x44598b
mov eax, 0xfffffffd
mov edx, 0xffffffff
jmp 0x445996
mov eax, dword [0xa8a328]
mov edx, dword [0xa8a32c]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4472a5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x30
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00445507
test eax, eax
sete al
test al, al
je 0x4472e3
mov eax, 0xfffffffe
jmp 0x44749f
mov edx, dword [0x64049c]
mov eax, dword [ebp + 8]
shl eax, 4
lea ecx, [eax*8]
mov ebx, ecx
sub ebx, eax
mov eax, ebx
add eax, edx
mov dword [0xa8a264], eax
mov eax, dword [0xa8a264]
movzx eax, byte [eax + 0xa]
test al, al
jne 0x44731a
mov eax, 0xfffffffd
jmp 0x44749f
cmp dword [ebp - 0x14], 0
jns 0x44732a
mov eax, 0xfffffffc
jmp 0x44749f
mov eax, dword [ebp - 0xc]
mov edx, eax
xor edx, 0xffffffff
mov eax, dword [ebp - 0x10]
xor eax, 0xffffffff
or eax, edx
test eax, eax
je 0x447374
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00447167
mov dword [0xa8a268], eax
mov eax, dword [0xa8a268]
test eax, eax
setne al
test al, al
je 0x447374
mov eax, dword [0xa8a268]
jmp 0x44749f
mov eax, dword [0x640498]
mov edx, dword [ebp + 8]
shl edx, 2
add eax, edx
mov dword [0xa8a26c], eax
jmp 0x447485
cmp dword [ebp - 0x14], 0
jle 0x4473a5
mov dword [0xa8a270], 0xffffffff
add dword [ebp - 0x18], 1
adc dword [ebp - 0x14], 0xffffffff
jmp 0x4473bb
mov eax, dword [ebp - 0x18]
mov dword [0xa8a270], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov edx, dword [0xa8a270]
mov eax, dword [0xa8a26c]
mov eax, dword [eax]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xa8a278
mov dword [esp + 8], edx
mov edx, dword [ebp + 0x14]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WriteFile]
call eax
sub esp, 0x14
test eax, eax
sete al
test al, al
je 0x447427
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [0xa8a280], eax
mov eax, dword [0xa8a280]
cmp eax, 5
je 0x447419
mov eax, dword [0xa8a280]
cmp eax, 0x21
jne 0x447420
mov eax, 0xfffffff9
jmp 0x44749f
mov eax, 0xfffffff7
jmp 0x44749f
mov eax, dword [0xa8a278]
mov edx, dword [0xa8a27c]
add dword [ebp + 0x14], eax
mov esi, dword [0xa8a264]
mov eax, dword [0xa8a264]
mov ecx, dword [eax + 0x10]
mov ebx, dword [eax + 0x14]
mov eax, dword [0xa8a278]
mov edx, dword [0xa8a27c]
add eax, ecx
adc edx, ebx
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
mov eax, dword [0xa8a270]
mov ecx, eax
mov ebx, 0
mov eax, dword [0xa8a278]
mov edx, dword [0xa8a27c]
mov esi, ebx
xor esi, edx
xor eax, ecx
or eax, esi
test eax, eax
je 0x447485
mov eax, 0xffffffff
jmp 0x44749f
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
or eax, edx
test eax, eax
setne al
test al, al
jne 0x44738b
mov eax, 0
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x4620b0
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [esp + 0xc]
mov dword [0xaacaa0], eax
jmp fcn.004618a0
Function at 0x463880
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x1c
cmp byte [0x4e48bc], 0
je 0x4638c0
mov eax, dword [0xaacb38]
test eax, eax
je 0x4638dd
mov dword [esp + 4], 0
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0xaacb38]
mov byte [eax + 0x38], 0
sub esp, 8
add esp, 0x1c
ret
mov dword [esp + 4], str.glutHideWindow
mov dword [esp], 0x501414
call fcn.00467500
mov eax, dword [0xaacb38]
test eax, eax
jne 0x463895
cmp dword [0x4e4914], 2
je 0x463895
mov dword [esp + 4], str.glutHideWindow
mov dword [esp], 0x5014c0
call fcn.00467500
mov eax, dword [0xaacb38]
jmp 0x463895

Function at 0x467300
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, 1
push ebx
sub esp, 0x14
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [esp], 0xa0
call ebx
sub esp, 4
test ax, ax
js 0x467333
mov dword [esp], 0xa1
call ebx
movsx esi, ax
sub esp, 4
shr esi, 0x1f
mov dword [esp], 0xa2
call ebx
mov edx, 2
sub esp, 4
test ax, ax
js 0x46735d
mov dword [esp], 0xa3
call ebx
mov edx, eax
sub esp, 4
shr edx, 0xe
and edx, 2
or esi, edx
mov dword [esp], 0xa4
call ebx
mov edx, 4
sub esp, 4
test ax, ax
js 0x467389
mov dword [esp], 0xa5
call ebx
mov edx, eax
sub esp, 4
shr edx, 0xd
and edx, 4
mov eax, esi
add esp, 0x14
or eax, edx
pop ebx
pop esi
ret

Function at 0x467500
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov ebx, dword [0x4e4948]
test ebx, ebx
je 0x467528
lea eax, [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [0x4e4948]
add esp, 0x18
pop ebx
ret
mov eax, dword [sym.imp.msvcrt.dll__iob]
lea ebx, [esp + 0x24]
mov dword [esp + 8], 9
mov dword [esp + 4], 1
mov dword [esp], str.freeglut
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [0x4e491c]
test eax, eax
je 0x467579
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 4], str.__s_:
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp], 0xa
add eax, 0x40
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputc
cmp byte [0x4e48bc], 0
jne 0x4675c2
mov dword [esp], 1
call sub.msvcrt.dll_exit
call fcn.00461610
jmp 0x4675b6