joyce8/EMBER2024-capa huggingface dataset:
Function at 0x485943
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x4b1780]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, dword [eax + 0x3d0]
mov edi, dword [eax]
mov dword [ebp - 0x8c], eax
lea eax, [ebp - 0x88]
push eax
mov dword [ebp - 0x88], 0x80
lea eax, [ebp - 0x84]
push eax
mov eax, dword [esi + 0x154]
push 0
add eax, 4
push eax
push dword [esi + 0x15c]
push dword [esi + 0x14]
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [esi + 0x148], 0
mov dword [esi + 0x14c], eax
jne 0x4859d4
push dword [ebp - 0x88]
lea eax, [ebp - 0x84]
push eax
lea eax, [esi + 0xc8]
push eax
call fcn.0048c3e0
mov eax, dword [ebp - 0x88]
add esp, 0xc
mov dword [esi + 0x148], eax
mov ebx, dword [esi + 0x14c]
cmp ebx, 4
jge 0x485a06
push 0x40b3f0
push edi
call fcn.004749e8
pop ecx
pop ecx
mov dword [esi + 0xc], 7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048f991
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0x15c]
movzx eax, byte [ecx]
shl ax, 8
movzx edx, ax
movzx eax, byte [ecx + 1]
or edx, eax
mov dword [esi + 0xc], edx
sub edx, 3
je 0x485a88
dec edx
je 0x485afa
dec edx
je 0x485a61
dec edx
je 0x485a46
push 0x40b40c
push 0x413e64
push edi
call fcn.004749e8
jmp 0x485af7
lea eax, [ebx - 2]
push eax
lea eax, [ecx + 2]
push eax
push esi
call fcn.004856f6
add esp, 0xc
test eax, eax
je 0x485afa
jmp 0x4859f5
mov edx, ecx
movzx eax, byte [edx + 2]
shl ax, 8
movzx ecx, ax
movzx eax, byte [edx + 3]
or ecx, eax
lea eax, [edx + 4]
push eax
push 0x406ffc
push edi
mov dword [esi + 8], ecx
call fcn.00474a7e
jmp 0x485af7
cmp ebx, 4
jle 0x485afa
movzx eax, byte [ecx + 2]
shl ax, 8
movzx edx, ax
movzx eax, byte [ecx + 3]
or edx, eax
movzx eax, word [esi + 0x40]
inc eax
and eax, 0xffff
cmp eax, edx
jne 0x485afa
lea eax, [ebx - 4]
push eax
lea eax, [ecx + 4]
push eax
push 1
push dword [ebp - 0x8c]
call fcn.004747eb
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x485adb
push 5
push esi
call fcn.00486180
pop ecx
pop ecx
mov eax, ebx
jmp 0x4859f5
mov eax, dword [esi + 0x14c]
sub eax, 4
cdq
add dword [edi + 0x38], eax
adc dword [edi + 0x3c], edx
push dword [edi + 0x3c]
push dword [edi + 0x38]
push edi
call fcn.0047caa4
add esp, 0xc
push dword [ebp - 0x8c]
call fcn.0047cc8e
pop ecx
test eax, eax
je 0x4859f3
push 5
push esi
call fcn.00486180
pop ecx
pop ecx
push 0x2a
pop eax
jmp 0x4859f5
Function at 0x485b20
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 3
pop ebx
mov eax, dword [esi + 0x10]
mov edi, dword [eax]
mov eax, dword [ebp + 0xc]
sub eax, ebx
je 0x485c88
dec eax
dec eax
je 0x485c30
dec eax
je 0x485bc6
dec eax
je 0x485b64
push 0x40b318
push 0x413e64
push edi
call fcn.004749e8
add esp, 0xc
push 0x47
jmp 0x485d3b
inc dword [esi + 0x18]
movzx eax, word [esi + 0x40]
push dword [esi + 0x18]
inc eax
and eax, 0xffff
push eax
push 0x40b2e4
push edi
call fcn.00474a7e
mov eax, dword [esi + 0x18]
add esp, 0x10
cmp eax, dword [esi + 0x20]
jle 0x485b99
mov dword [esi + 8], 0xffffff9d
mov dword [esi], ebx
jmp 0x485d62
push dword [esi + 0x148]
lea eax, [esi + 0xc8]
push eax
push 0
push 4
push dword [esi + 0x160]
push dword [esi + 0x14]
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
jns 0x485d62
jmp 0x485d1b
xor eax, eax
xor ebx, ebx
mov word [esi + 0x40], ax
mov dword [esi + 0x18], ebx
mov eax, dword [esi + 0x160]
mov byte [eax], bl
mov eax, dword [esi + 0x160]
mov byte [eax + 1], 4
movzx edx, word [esi + 0x40]
mov eax, dword [esi + 0x160]
mov ecx, edx
shr ecx, 8
mov byte [eax + 2], cl
mov eax, dword [esi + 0x160]
mov byte [eax + 3], dl
lea eax, [esi + 0xc8]
push dword [esi + 0x148]
push eax
push ebx
push 4
push dword [esi + 0x160]
push dword [esi + 0x14]
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
js 0x485d1b
mov dword [esi], 1
jmp 0x485d58
mov eax, dword [esi + 0x160]
xor ebx, ebx
mov byte [eax], bl
mov eax, dword [esi + 0x160]
mov byte [eax + 1], 5
movzx edx, word [esi + 0x40]
mov eax, dword [esi + 0x160]
mov ecx, edx
shr ecx, 8
mov byte [eax + 2], cl
mov eax, dword [esi + 0x160]
mov byte [eax + 3], dl
lea eax, [esi + 0xc8]
push dword [esi + 0x148]
push eax
push ebx
push 4
push dword [esi + 0x160]
push dword [esi + 0x14]
call dword [sym.imp.WS2_32.dll_sendto]
push 3
pop eax
mov dword [esi], eax
jmp 0x485d62
mov ecx, dword [esi + 0x15c]
movzx eax, byte [ecx + 2]
shl ax, 8
movzx edx, ax
movzx eax, byte [ecx + 3]
or edx, eax
movzx eax, word [esi + 0x40]
inc eax
and eax, 0xffff
cmp eax, edx
je 0x485cc2
push eax
push edx
push 0x40b2a4
push edi
call fcn.00474a7e
add esp, 0x10
jmp 0x485d62
mov word [esi + 0x40], dx
xor ebx, ebx
mov dword [esi + 0x18], ebx
mov eax, dword [esi + 0x160]
mov byte [eax], bl
mov eax, dword [esi + 0x160]
mov byte [eax + 1], 4
movzx edx, word [esi + 0x40]
mov eax, dword [esi + 0x160]
mov ecx, edx
shr ecx, 8
mov byte [eax + 2], cl
mov eax, dword [esi + 0x160]
mov byte [eax + 3], dl
lea eax, [esi + 0xc8]
push dword [esi + 0x148]
push eax
push ebx
push 4
push dword [esi + 0x160]
push dword [esi + 0x14]
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
jns 0x485d3e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push dword [esi + 0x10]
call fcn.00469fe7
push eax
push 0x413e64
push edi
call fcn.004749e8
add esp, 0x14
push 0x37
pop eax
jmp 0x485d64
mov eax, dword [esi + 0x154]
xor ecx, ecx
add eax, 4
inc ecx
cmp dword [esi + 0x14c], eax
push 3
pop eax
cmovl ecx, eax
mov dword [esi], ecx
lea eax, [esi + 0x38]
push eax
call fcn.00490aaf
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x488730
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov ebx, dword [eax + 0x2c]
mov edi, dword [ebx]
mov esi, dword [edi + 0x1a4]
test esi, esi
jne 0x48874b
mov esi, dword [eax + 0x28]
push dword [eax + 0x24]
push dword [eax + 0x20]
call fcn.0047665a
push edx
push eax
call fcn.00476604
add esp, 0x10
sub esi, eax
cmp dword [edi + 0x19c], 0
je 0x488795
push dword [ebx + 0x124]
push dword [ebx + 0x120]
call fcn.0047665a
push edx
push eax
call fcn.00476604
mov ecx, dword [edi + 0x19c]
add esp, 0x10
sub ecx, eax
cmp esi, ecx
cmovl ecx, esi
mov esi, ecx
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
Function at 0x4893d4
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0x4b12e0]
mov edi, eax
pop ecx
test edi, edi
je 0x4894be
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x48943d
push ecx
call dword [esi]
push ebx
push dword [ebp + 0xc]
push dword [edi + 4]
call dword [esi + 4]
mov eax, dword [edi + 8]
add eax, dword [esi + 0xc]
push dword [edi + 4]
mov dword [ebp - 4], eax
push eax
call dword [esi + 8]
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], ebx
jmp 0x489443
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [edi + 4]
call dword [esi]
push dword [edi + 8]
call dword [esi]
mov eax, dword [ebp + 0x10]
xor ebx, ebx
pop ecx
pop ecx
test eax, eax
je 0x4894b6
mov dword [ebp - 8], eax
mov ebx, eax
mov eax, dword [ebp - 4]
push 1
mov al, byte [eax]
xor al, 0x36
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push eax
push dword [edi + 4]
call dword [esi + 4]
mov ecx, dword [ebp - 4]
push 1
mov al, byte [ecx]
xor al, 0x5c
inc ecx
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push eax
push dword [edi + 8]
mov dword [ebp - 4], ecx
call dword [esi + 4]
add esp, 0x18
dec ebx
jne 0x48945d
mov ebx, dword [ebp - 8]
jmp 0x4894b6
push 1
push 0x40bfec
push dword [edi + 4]
call dword [esi + 4]
push 1
push 0x40bfed
push dword [edi + 8]
call dword [esi + 4]
add esp, 0x18
inc ebx
cmp ebx, dword [esi + 0x10]
jb 0x489498
mov eax, edi
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x489515
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret
Function at 0x48a5fa
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi]
cmp dword [eax + 4], 2
jne 0x48a624
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x48a615
xor eax, eax
jmp 0x48a677
push dword [eax + 8]
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call ecx
jmp 0x48a655
cmp dword [esi + 8], 0
jne 0x48a645
push 0x4131a4
push dword [eax + 8]
call fcn.00493f38
mov dword [esi + 8], eax
pop ecx
pop ecx
test eax, eax
jne 0x48a645
or eax, 0xffffffff
jmp 0x48a677
push dword [esi + 8]
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call fcn.004923a8
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x48a675
cmp dword [esi + 8], eax
je 0x48a66f
push dword [esi + 8]
call fcn.00492876
and dword [esi + 8], edi
pop ecx
mov eax, dword [esi]
mov eax, dword [eax]
mov dword [esi], eax
mov eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x4a60b6
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4b1780]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00497207
mov dword [ebp - 0x14], eax
cmp dword [0x4b6de4], esi
jne 0x4a61a9
push 0x800
push esi
push 0x405104
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x4a6136
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4a6289
push esi
push esi
push 0x405104
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4a6289
push 0x410700
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4a6289
push eax
call ebx
push 0x41070c
push edi
mov dword [0x4b6de4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x41071c
push edi
mov dword [0x4b6de8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x410730
push edi
mov dword [0x4b6dec], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4b6df4], eax
test eax, eax
je 0x4a61a6
push 0x41074c
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4b6df0], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4a61ce
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4a61c1
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x4a61e3
push 4
pop eax
jmp 0x4a628b
cmp dword [ebp - 0x14], esi
je 0x4a61e3
push dword [0x4b6de4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4a61c8
mov eax, dword [0x4b6df0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x4a6241
cmp dword [0x4b6df4], edi
je 0x4a6241
push eax
call ebx
push dword [0x4b6df4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4a6241
test eax, eax
je 0x4a6241
call ecx
test eax, eax
je 0x4a6236
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4a6236
test byte [ebp - 8], 1
jne 0x4a6241
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4a6271
mov eax, dword [0x4b6de8]
cmp eax, edi
je 0x4a626e
push eax
call ebx
test eax, eax
je 0x4a626e
call eax
mov esi, eax
test esi, esi
je 0x4a626e
mov eax, dword [0x4b6dec]
cmp eax, edi
je 0x4a626e
push eax
call ebx
test eax, eax
je 0x4a626e
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4b6de4]
call ebx
test eax, eax
je 0x4a6289
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x4a628b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048f991
mov esp, ebp
pop ebp
ret
Function at 0x4dcad0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x9a000]
push edi
jmp 0x4dcaea
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4dcaf1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4dcae0
mov eax, 1
add ebx, ebx
jne 0x4dcb03
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4dcb14
jne 0x4dcb33
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4dcb33
dec eax
add ebx, ebx
jne 0x4dcb20
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4dcaf8
add ebx, ebx
jne 0x4dcb2f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4dcb85
xor ecx, ecx
sub eax, 3
jb 0x4dcb4b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4dcbba
sar eax, 1
mov ebp, eax
jmp 0x4dcb56
add ebx, ebx
jne 0x4dcb56
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4dcb24
inc ecx
add ebx, ebx
jne 0x4dcb64
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4dcb24
add ebx, ebx
jne 0x4dcb71
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4dcb66
jne 0x4dcb82
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4dcb66
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4dcba4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4dcb96
jmp 0x4dcae6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4dcba4
add edi, ecx
jmp 0x4dcae6
pop esi
mov edi, esi
mov ecx, 0x377e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4dcbc2
cmp byte [edi], 0x11
jne 0x4dcbc2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4dcbc7
lea edi, [esi + 0xd8000]
mov eax, dword [edi]
or eax, eax
je 0x4dcc3f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1089f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x108b44]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4dcbf4
mov ecx, edi
jns 0x4dcc23
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x108b48]
or eax, eax
je 0x4dcc39
mov dword [ebx], eax
add ebx, 4
jmp 0x4dcc11
call dword [esi + 0x108b58]
mov ebp, dword [esi + 0x108b4c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4dcc73
sub esp, 0xffffff80
jmp 0x416310
Function at 0x40d0d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x470550
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x484008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.00466620
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.0040d000
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call fcn.004011d0
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.00401400
mov ecx, dword [ebp - 0x10]
call fcn.0040d380
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x4116e0
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x484008]
xor eax, ebp
mov dword [ebp + 0x194], eax
push 0x208
push 0
lea eax, [ebp - 0x74]
push eax
call fcn.004276a0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x74]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
lea edx, [ebp - 0x74]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0xffffffff
je 0x4117a6
mov eax, dword [ebp + 0x1a4]
push eax
mov ecx, dword [ebp - 0x78]
push ecx
call fcn.0046f070
mov dword [ebp - 0x80], 0
mov edx, dword [ebp + 0x1a4]
mov eax, dword [edx]
push eax
call fcn.00425ae9
add esp, 4
mov dword [ebp - 0x7c], eax
mov ecx, dword [ebp + 0x1a0]
mov edx, dword [ebp - 0x7c]
mov dword [ecx], edx
push 0
lea eax, [ebp - 0x80]
push eax
mov ecx, dword [ebp + 0x1a4]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp + 0x1a0]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0x78]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x194]
xor ecx, ebp
call fcn.004259b9
add ebp, 0x198
mov esp, ebp
pop ebp
ret 8
Function at 0x42c739
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x476264
push 0x47625c
push str.FlsAlloc
push 0x1e
call fcn.0042c617
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42c76d
push dword [ebp + 8]
mov ecx, esi
call dword [0x474310]
call esi
jmp 0x42c773
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x42c7b7
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x476274
push 0x47626c
push str.FlsGetValue
push 0x20
call fcn.0042c617
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42c7ee
push dword [ebp + 8]
mov ecx, esi
call dword [0x474310]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x42ddc8
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x42de65
push ebx
push esi
call fcn.0042dd91
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0042c2f9
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x42de12
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x42de64
push edi
push eax
call fcn.0042c453
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x42de32
call fcn.0042c419
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x42de63
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0042c2f9
add esp, 0x20
test eax, eax
jne 0x42de51
push edi
call fcn.0042c419
jmp 0x42de59
push ebx
call fcn.0042c419
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x435100
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
mov eax, dword [edx]
movzx edx, word [eax + 0x14]
lea eax, [ecx + edx + 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
jmp 0x435136
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
add edx, 0x28
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
movzx edx, word [ecx + 6]
cmp dword [ebp - 8], edx
jge 0x435244
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], 0
jne 0x435159
jmp 0x435124
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x24]
and eax, 0x20000000
je 0x43516f
mov dword [ebp - 0x10], 1
jmp 0x435176
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x24]
and eax, 0x40000000
je 0x435192
mov dword [ebp - 0x14], 1
jmp 0x435199
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x24]
and eax, 0x80000000
je 0x4351b5
mov dword [ebp - 0x18], 1
jmp 0x4351bc
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x24]
and eax, 0x20
je 0x4351db
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x20], 1
mov ecx, dword [ebp - 0x1c]
shl ecx, 4
mov edx, dword [ebp - 0x20]
lea eax, [ecx + edx*8 + 0x484888]
mov ecx, dword [ebp - 0x28]
mov edx, dword [eax + ecx*4]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x24]
and ecx, 0x4000000
je 0x43520e
mov edx, dword [ebp - 0xc]
or edx, 0x200
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 0xc]
mov dword [ebp - 0x2c], ecx
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x43523f
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x435246
jmp 0x435124
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x435250
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
movzx edx, word [eax + 0x14]
lea eax, [ecx + edx + 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
jmp 0x435286
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
add edx, 0x28
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
movzx edx, word [ecx + 6]
cmp dword [ebp - 8], edx
jge 0x4352fe
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 0x3c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
push eax
call fcn.00435340
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x14]
mov eax, dword [ebp - 4]
add edx, dword [eax + 0x10]
cmp dword [ebp + 0xc], edx
jb 0x4352c6
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
cmp edx, dword [ebp - 0xc]
jbe 0x4352cd
mov eax, 0xc1
jmp 0x435300
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 0xc]
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.004293d0
add esp, 0xc
jmp 0x435274
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc

Function at 0x435360
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
jmp 0x435378
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x100
jae 0x4353ca
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 0
jmp 0x435399
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 8
jae 0x4353bb
mov eax, dword [ebp - 8]
shr eax, 1
mov ecx, dword [ebp - 8]
and ecx, 1
xor edx, edx
sub edx, ecx
and edx, 0xedb88320
xor eax, edx
mov dword [ebp - 8], eax
jmp 0x435390
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [eax*4 + 0x488680], ecx
jmp 0x43536f
mov dword [ebp - 4], 0x100
jmp 0x4353dc
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0x800
jae 0x435414
mov eax, dword [ebp - 4]
mov ecx, dword [eax*4 + 0x488280]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
and edx, 0xff
mov eax, dword [ebp - 0x10]
shr eax, 8
xor eax, dword [edx*4 + 0x488680]
mov ecx, dword [ebp - 4]
mov dword [ecx*4 + 0x488680], eax
jmp 0x4353d3
mov dword [0x488668], 0x435490
mov dword [0x488664], 0x435490
mov esp, ebp
pop ebp
ret