joyce8/EMBER2024-capa huggingface dataset:
Function at 0x449d30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
xor edi, edi
mov eax, dword [esi + 0x6af90]
mov dword [esi + 0x6af80], 2
test eax, eax
je 0x449f3d
cmp eax, 3
jb 0x449da6
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
movzx ecx, byte [edx + esi + 0x1af72]
xor ecx, eax
and ecx, 0x7fff
and edx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov ebx, dword [esi + ecx*4 + 0x4af70]
mov dword [esi + edx*4 + 0x2af70], ebx
mov ecx, dword [esi + 0x6af7c]
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
test ebx, ebx
je 0x449de4
mov eax, dword [esi + 0x6af84]
sub eax, ebx
cmp eax, 0x7efa
ja 0x449de4
mov eax, dword [esi + 0x6af90]
cmp dword [esi + 0x6afa0], eax
jbe 0x449dcd
mov dword [esi + 0x6afa0], eax
push ebx
push esi
call fcn.0044ae60
mov ecx, dword [esi + 0x6af90]
mov edi, eax
add esp, 8
cmp edi, ecx
cmova edi, ecx
mov ecx, dword [esi + 0x6af84]
cmp edi, 3
jb 0x449eba
sub ecx, dword [esi + 0x6af88]
lea eax, [edi - 3]
push eax
push ecx
push esi
call fcn.00449b40
mov ecx, dword [esi + 0x6af90]
add esp, 0xc
sub ecx, edi
mov dword [ebp + 8], eax
mov dword [esi + 0x6af90], ecx
cmp edi, dword [esi + 0x6af98]
ja 0x449e89
cmp ecx, 3
jb 0x449e89
dec edi
nop word [eax + eax]
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
movzx ecx, byte [edx + esi + 0x1af72]
and edx, 0x7fff
xor ecx, eax
and ecx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov ebx, dword [esi + ecx*4 + 0x4af70]
mov dword [esi + edx*4 + 0x2af70], ebx
mov ecx, dword [esi + 0x6af7c]
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
sub edi, 1
jne 0x449e30
jmp 0x449ed7
add dword [esi + 0x6af84], edi
xor edi, edi
mov edx, dword [esi + 0x6af84]
movzx ecx, byte [edx + esi + 0x1af70]
mov dword [esi + 0x6af7c], ecx
movzx eax, byte [edx + esi + 0x1af71]
shl ecx, 5
xor eax, ecx
mov dword [esi + 0x6af7c], eax
jmp 0x449ee3
movzx eax, byte [ecx + esi + 0x1af70]
push eax
push 0
push esi
call fcn.00449b40
add esp, 0xc
mov dword [ebp + 8], eax
dec dword [esi + 0x6af90]
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
cmp dword [ebp + 8], 0
je 0x449f1a
mov eax, dword [esi + 0x6af74]
test eax, eax
js 0x449efd
lea ecx, [esi + 0x1af70]
add ecx, eax
jmp 0x449eff
xor ecx, ecx
push 0
sub edx, eax
push edx
push ecx
push esi
call fcn.0044a0d0
mov eax, dword [esi + 0x6af84]
add esp, 0x10
mov dword [esi + 0x6af74], eax
cmp dword [esi + 0x6af90], 0x106
jae 0x449f2f
push esi
call fcn.00449f70
add esp, 4
mov eax, dword [esi + 0x6af90]
test eax, eax
jne 0x449d55
mov ecx, dword [esi + 0x6af74]
test ecx, ecx
js 0x449f51
lea edx, [esi + 0x1af70]
add edx, ecx
jmp 0x449f53
xor edx, edx
mov eax, dword [esi + 0x6af84]
push 1
sub eax, ecx
push eax
push edx
push esi
call fcn.0044a0d0
add esp, 0x10
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x44bbb0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 0x84]
test ecx, ecx
je 0x44bc12
mov edx, dword [edi + 0x8c]
mov ebx, dword [edi + 0x88]
cmp edx, ebx
jae 0x44bc59
mov esi, dword [ebp + 8]
lea eax, [edx + ecx]
sub ebx, edx
cmp ebx, dword [ebp + 0xc]
cmova ebx, dword [ebp + 0xc]
push ebx
push eax
push esi
call fcn.00482d10
add dword [edi + 0x8c], ebx
add dword [edi + 0x74], ebx
push ebx
push esi
push dword [edi + 0x78]
call fcn.00449750
add esp, 0x18
mov dword [edi + 0x78], eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [edi + 0x7c]
test eax, eax
je 0x44bc52
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 4]
push 0
push ecx
push dword [ebp + 0xc]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x44bc59
mov esi, dword [ebp - 4]
add dword [edi + 0x74], esi
push esi
push ebx
push dword [edi + 0x78]
call fcn.00449750
add esp, 0xc
mov dword [edi + 0x78], eax
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [edi + 0x14], 0x1000000
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x44c010
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [esi + 0x2d], 0
je 0x44c0e5
mov ecx, dword [esi + 0x3c]
mov eax, ecx
mov ebx, dword [ebp + 0xc]
test ecx, ecx
je 0x44c048
cmp dword [esi + 0x40], ebx
jae 0x44c048
push ecx
call fcn.00481ea6
add esp, 4
mov dword [esi + 0x3c], 0
jmp 0x44c04c
test eax, eax
jne 0x44c05e
lea eax, [ebx + ebx]
push eax
call fcn.004817d0
add esp, 4
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], ebx
push ebx
push edi
push eax
call fcn.00482d10
xor edx, edx
add esp, 0xc
mov dword [ebp + 8], edx
test ebx, ebx
je 0x44c0e2
mov eax, dword [esi + 0x3c]
mov ecx, dword [esi + 0x30]
mov bl, byte [edx + eax]
mov edx, dword [esi + 0x38]
mov edi, edx
movsx eax, bl
and edi, 0xfffd
xor eax, ecx
or edi, 2
movzx eax, al
shr ecx, 8
xor ecx, dword [eax*4 + 0x51deb8]
movzx eax, cl
add eax, dword [esi + 0x34]
imul eax, eax, 0x8088405
mov dword [esi + 0x30], ecx
mov ecx, edi
xor ecx, 1
imul ecx, edi
inc eax
mov dword [esi + 0x34], eax
shr eax, 0x18
xor eax, edx
shr ecx, 8
movzx eax, al
xor cl, bl
shr edx, 8
xor edx, dword [eax*4 + 0x51deb8]
mov dword [esi + 0x38], edx
mov edx, dword [ebp + 8]
mov eax, dword [esi + 0x3c]
mov byte [edx + eax], cl
inc edx
mov dword [ebp + 8], edx
cmp edx, dword [ebp + 0xc]
jb 0x44c072
mov edi, dword [esi + 0x3c]
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x44c123
mov edx, dword [esi + 0x24]
mov ebx, dword [ebp + 0xc]
lea eax, [edx + ebx]
cmp eax, dword [esi + 0x28]
jb 0x44c10a
pop edi
mov dword [esi + 0x14], 0x30000
xor eax, eax
pop esi
pop ebx
pop ebp
ret 8
push ebx
add ecx, edx
push edi
push ecx
call fcn.00482d10
add esp, 0xc
mov eax, ebx
add dword [esi + 0x24], ebx
pop edi
pop esi
pop ebx
pop ebp
ret 8
mov eax, dword [esi + 4]
test eax, eax
je 0x44c145
push 0
lea ecx, [ebp + 8]
push ecx
push dword [ebp + 0xc]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret 8
pop edi
mov dword [esi + 0x14], 0x1000000
xor eax, eax
pop esi
pop ebx
pop ebp
ret 8
Function at 0x44c260
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x572c40]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x44c294
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x44c294
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov al, byte [ebx]
test al, al
je 0x44c347
push esi
mov esi, ebx
mov ecx, ebx
cmp al, 0x2f
je 0x44c2ab
cmp al, 0x5c
jne 0x44c2ad
mov esi, ecx
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x44c2a3
cmp esi, ebx
je 0x44c2f0
sub esi, ebx
lea eax, [ebp - 0x20c]
push esi
push ebx
push eax
call fcn.00482d10
add esp, 0xc
cmp esi, 0x104
jae 0x44c357
lea eax, [ebp - 0x20c]
mov byte [ebp + esi - 0x20c], 0
push eax
push edi
call fcn.0044c260
add esp, 8
mov byte [ebp - 0x108], 0
pop esi
test edi, edi
je 0x44c311
push edi
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.0048dd93
add esp, 0xc
push ebx
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.00484c83
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x44c347
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00481761
mov esp, ebp
pop ebp
ret
call fcn.00481bf7
int3
Function at 0x44cbf0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, ecx
mov dword [ebp - 8], ebx
cmp dword [ebx], 0
jne 0x44cd8b
cmp dword [ebx + 4], 0xffffffff
jne 0x44cd8b
push esi
lea esi, [ebx + 0x140]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x44cc27
sub ecx, edx
mov al, byte [ecx + ebx + 0x13f]
cmp al, 0x5c
je 0x44cc52
cmp al, 0x2f
je 0x44cc52
push 0x51d4a8
push 0x104
push esi
call fcn.00484c83
add esp, 0xc
push edi
mov edi, dword [ebp + 0x10]
cmp edi, 1
jne 0x44cc7d
mov esi, dword [ebp + 8]
push edi
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x44cc98
pop edi
pop esi
mov eax, 0x2000000
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp edi, 2
je 0x44cc95
cmp edi, 3
je 0x44cc95
pop edi
pop esi
mov eax, 0x10000
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov esi, dword [ebp + 8]
xor ebx, ebx
xor al, al
mov byte [ebp - 1], al
mov byte [ebp + 0x13], bl
cmp edi, 1
je 0x44ccde
cmp edi, 2
jne 0x44ccfa
push ebx
push 0x80
push 3
push ebx
push 1
push connect
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x44ccd8
pop edi
pop esi
mov eax, 0x200
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov byte [ebp + 0x13], 1
jmp 0x44cce4
mov ebx, esi
mov byte [ebp + 0x13], 0
push 1
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
setne al
mov byte [ebp - 1], al
push 0x20
call fcn.004817a0
add esp, 4
mov esi, eax
cmp edi, 1
je 0x44cd35
cmp edi, 2
je 0x44cd35
mov eax, dword [ebp + 8]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0xc]
mov word [esi], 0x100
mov byte [esi + 0x10], 0
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], 0
mov dword [esi + 0xc], 0
jmp 0x44cd66
mov al, byte [ebp + 0x13]
mov byte [esi + 0x10], al
mov al, byte [ebp - 1]
mov byte [esi], 1
mov byte [esi + 1], al
mov dword [esi + 4], ebx
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
test al, al
je 0x44cd66
push 1
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [esi + 0xc], eax
push esi
call fcn.004501a0
mov ecx, dword [ebp - 8]
add esp, 4
mov edx, 0x200
mov dword [ecx], eax
xor ecx, ecx
test eax, eax
pop edi
cmove ecx, edx
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, 0x1000000
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x44fb70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, esi
imul ebx, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
cmp byte [edi], 0
je 0x44fbae
push 0
lea eax, [ebp + 0xc]
push eax
push ebx
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x44fba2
mov byte [edi + 8], 1
mov eax, dword [ebp + 0xc]
xor edx, edx
pop edi
div esi
pop esi
pop ebx
pop ebp
ret
mov edx, dword [edi + 0x1c]
mov esi, dword [edi + 0x18]
mov ecx, dword [edi + 0x14]
sub esi, edx
lea eax, [edx + ebx]
cmp eax, dword [edi + 0x18]
cmovbe esi, ebx
add ecx, edx
push esi
push ecx
push dword [ebp + 8]
call fcn.00482d10
add dword [edi + 0x1c], esi
add esp, 0xc
mov eax, esi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x44fbe0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x44fbee
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
not eax
cmp esi, 8
jb 0x44fcad
push edi
mov edi, esi
shr edi, 3
movzx ecx, byte [edx]
sub esi, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x51f768]
movzx ecx, byte [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x51f768]
movzx ecx, byte [edx + 2]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x51f768]
movzx ecx, byte [edx + 3]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x51f768]
movzx ecx, byte [edx + 4]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x51f768]
movzx ecx, byte [edx + 5]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x51f768]
movzx ecx, byte [edx + 6]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x51f768]
movzx ecx, byte [edx + 7]
add edx, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x51f768]
sub edi, 1
jne 0x44fc06
pop edi
test esi, esi
je 0x44fccb
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x51f768]
sub esi, 1
jne 0x44fcb1
not eax
pop esi
pop ebp
ret
Function at 0x44ffd0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x450189
cmp dword [edi + 0x18], 0
je 0x450189
cmp dword [edi + 0x7c], 0
je 0x44fffb
push edi
call fcn.0044fcd0
add esp, 4
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
push edi
call fcn.00450660
add esp, 0x10
test eax, eax
je 0x45001e
mov eax, 0xffffff99
pop edi
mov esp, ebp
pop ebp
ret
push esi
push 0x84
call fcn.00484f13
mov esi, eax
add esp, 4
test esi, esi
je 0x450061
push 0x4000
call fcn.00484f13
mov ecx, dword [ebp + 8]
add esp, 4
mov dword [esi + 0x44], ecx
mov ecx, dword [ebp - 4]
mov dword [esi], eax
mov dword [esi + 0x48], ecx
mov dword [esi + 0x4c], 0
test eax, eax
jne 0x45006c
push esi
call fcn.00484ef8
add esp, 4
pop esi
mov eax, 0xffffff98
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x3c]
mov ecx, dword [edi + 0x34]
mov dword [esi + 0x54], eax
mov eax, dword [edi]
mov dword [esi + 0x60], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0x40], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x64], ecx
mov dword [esi + 0x68], eax
mov dword [esi + 0x18], 0
test ecx, ecx
je 0x4500c8
lea eax, [esi + 4]
mov dword [esi + 0x24], 0
push eax
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
call fcn.0044e060
add esp, 4
test eax, eax
jne 0x4500c8
mov dword [esi + 0x40], 1
mov eax, dword [edi + 0x40]
mov cl, byte [edi + 0x30]
mov dword [esi + 0x58], eax
and cl, 1
mov eax, dword [edi + 0x44]
mov dword [esi + 0x5c], eax
mov eax, dword [edi + 0x30]
shr eax, 3
mov byte [esi + 0x6c], cl
test al, 1
je 0x4500ec
mov al, byte [edi + 0x39]
jmp 0x4500ef
mov al, byte [edi + 0x3f]
mov byte [esi + 0x80], al
mov edx, 0xc
xor eax, eax
mov dword [esi + 0x70], 0x12345678
test cl, cl
mov dword [esi + 0x74], 0x23456789
mov dword [esi + 0x78], 0x34567890
cmovne eax, edx
mov edx, dword [ebp + 0xc]
mov dword [esi + 0x7c], eax
test edx, edx
je 0x45016b
mov al, byte [edx]
test al, al
je 0x45016b
mov ecx, dword [esi + 0x70]
movsx eax, al
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x51f768]
movzx eax, cl
add eax, dword [esi + 0x74]
imul eax, eax, 0x8088405
mov dword [esi + 0x70], ecx
mov ecx, dword [esi + 0x78]
inc eax
mov dword [esi + 0x74], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x51f768]
mov dword [esi + 0x78], ecx
add edx, 1
jne 0x450120
mov eax, dword [ebp - 8]
add eax, 0x1e
mov dword [edi + 0x7c], esi
add eax, dword [edi + 0x78]
mov dword [esi + 0x3c], eax
xor eax, eax
mov dword [esi + 8], 0
pop esi
pop edi
mov esp, ebp
pop ebp
ret
mov eax, 0xffffff9a
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x450d20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, 1
cmp byte [esi], 0
je 0x450d57
push 0
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xb]
push eax
push dword [esi + 4]
lea ebx, [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x450d52
mov byte [ebx], 1
mov edi, dword [ebp - 4]
jmp 0x450d84
mov ebx, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
lea eax, [ebx + 1]
cmp eax, ecx
jbe 0x450d68
mov edi, ecx
sub edi, ebx
mov eax, dword [esi + 0x14]
add eax, ebx
push edi
push eax
lea eax, [ebp + 0xb]
push eax
call fcn.00482d10
lea eax, [ebx + edi]
add esp, 0xc
mov dword [esi + 0x1c], eax
lea ebx, [esi + 8]
cmp edi, 1
jne 0x450d9b
mov eax, dword [ebp + 0xc]
movzx ecx, byte [ebp + 0xb]
mov dword [eax], ecx
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0
je 0x450d92
cmp byte [ebx], 0
je 0x450d92
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x451440
Capabilities:
Create thread

Disassembly:
push 0
push 0x118
push 0xb66960
push 0xffffffffffffffff
push str._DFC_UpdateCheck
call fcn.004322a0
mov eax, dword [0xb66a74]
add esp, 0x14
test eax, eax
jne 0x45146d
mov byte [0xb66a71], 1
jmp 0x451472
cmp eax, 7
jg 0x45147c
mov dword [0xb66a74], 7
cmp byte [0xb66a71], 0
je 0x4514c0
push 0
call fcn.0048e759
add esp, 4
sub eax, dword [0xb66a68]
mov ecx, eax
sbb edx, dword [0xb66a6c]
call fcn.00481ef0
movd xmm1, dword [0xb66a74]
cvtdq2pd xmm1, xmm1
mulsd xmm1, qword [0x51fef0]
comisd xmm0, xmm1
ja fcn.00451380
ret

Function at 0x451870
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push 0x120
push 0xb66a80
push 0xffffffffffffffff
push 0x51fef8
call fcn.004322a0
add esp, 0x14
cmp dword [0xb66b94], 1
jge 0x4518a2
mov dword [0xb66b94], 0xe
cmp dword [0xb66b98], 1
jge 0x4518b5
mov dword [0xb66b98], 0x1e
cmp byte [0xb66b90], 0
je 0x451944
push 0
call fcn.0048e759
add esp, 4
sub eax, dword [0xb66b88]
mov ecx, eax
sbb edx, dword [0xb66b8c]
call fcn.00481ef0
movd xmm2, dword [0xb66b94]
cvtdq2pd xmm2, xmm2
mulsd xmm2, qword [0x51ff30]
mulsd xmm2, qword [0x51d6a8]
mulsd xmm2, qword [0x51d6a8]
comisd xmm0, xmm2
jbe 0x451944
cmp byte [0xb66ba1], 0
jne 0x451944
lea eax, [ebp - 4]
mov byte [0xb66ba1], 1
push eax
push 0
push 0
push fcn.00451950
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x45193d
mov byte [0xb66ba1], al
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x453480
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
xor eax, eax
push esi
xor esi, esi
mov dword [ebp - 0x10], eax
cmp dword [ebp + 8], eax
je 0x45361b
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x45361b
mov ecx, dword [ebx]
test ecx, ecx
je 0x45361b
add ecx, 2
mov eax, 0x55555556
imul ecx
mov eax, 0x6bca1af3
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
shl ecx, 2
imul ecx
add ecx, 2
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
lea eax, [ecx + eax*2]
push eax
call fcn.00484f13
mov ecx, eax
add esp, 4
mov dword [ebp - 0xc], ecx
test ecx, ecx
je 0x453611
push edi
mov edi, dword [ebx]
test edi, edi
jle 0x45360c
mov ebx, dword [ebp + 8]
mov eax, ebx
not eax
mov dword [ebp - 8], 2
mov dword [ebp - 0x18], eax
lea eax, [ecx + 1]
mov dword [ebp - 0x1c], eax
lea eax, [ecx + 3]
mov dword [ebp - 0x14], 0xfffffffe
lea edx, [ebx + 2]
sub dword [ebp - 0x14], ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov bl, byte [edx - 2]
mov ecx, dword [ebp - 0x18]
add ecx, edx
mov byte [ebp - 1], bl
xor bl, bl
mov byte [ebp + 0xb], 0
cmp ecx, edi
mov ecx, dword [ebp - 0xc]
jge 0x45354c
mov bl, byte [edx - 1]
mov byte [ebp + 0xb], bl
xor bl, bl
cmp eax, edi
jge 0x45354c
mov bl, byte [edx]
mov bh, byte [ebp + 0xb]
mov al, bl
shr al, 6
and bh, 0xf
shl bh, 2
and bl, 0x3f
or bh, al
movzx eax, byte [ebp - 1]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi], al
mov al, byte [ebp - 1]
and al, 3
shl al, 4
movzx ecx, al
movzx eax, byte [ebp + 0xb]
shr eax, 4
or ecx, eax
movzx eax, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov ecx, dword [ebp - 0x1c]
mov byte [ecx + esi], al
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
add ecx, 2
add ecx, esi
add eax, edx
mov dword [ebp + 8], ecx
cmp eax, edi
jge 0x4535b0
movzx eax, bh
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jmp 0x4535b2
mov al, 0x3d
mov ecx, dword [ebp + 8]
mov byte [ecx], al
cmp dword [ebp - 8], edi
jge 0x4535c7
movzx eax, bl
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jmp 0x4535c9
mov al, 0x3d
mov ecx, dword [ebp - 0x20]
mov byte [ecx + esi], al
mov ecx, dword [ebp - 0x10]
inc ecx
mov dword [ebp - 0x10], ecx
cmp ecx, 0x13
mov ecx, dword [ebp - 0xc]
jne 0x4535ed
mov word [ecx + esi + 4], 0xa0d
add esi, 2
xor eax, eax
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp + 0xc]
add edx, 3
mov eax, dword [ebp - 0x14]
add esi, 4
add dword [ebp - 8], 3
add eax, edx
mov edi, dword [ebx]
cmp eax, edi
mov eax, dword [ebp - 8]
jl 0x453526
mov byte [ecx + esi], 0
pop edi
mov dword [ebx], esi
mov eax, ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x453eb0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov edi, dword [esi + 0x608]
lea ecx, [esi + 0x2c]
mov dword [ebp - 4], edx
mov ebx, eax
test edi, edi
jg 0x453fd1
cmp dword [esi + 0x10], 0
jle 0x453f84
push 0x5dc
push ecx
push dword [esi + 0x610]
xor edi, edi
call fcn.00455a70
add esp, 0xc
mov dword [esi + 0x608], eax
test eax, eax
jg 0x453f1f
push eax
push dword [esi + 0x610]
call fcn.00455460
mov edi, eax
add esp, 8
cmp edi, 2
jne 0x453f1f
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov ecx, dword [ebp - 4]
cmp edx, ecx
ja 0x453f43
jb 0x453f32
cmp eax, ebx
jae 0x453f43
xorps xmm0, xmm0
movlpd qword [ebp - 0xc], xmm0
mov ecx, dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
sub eax, ebx
sbb edx, ecx
test edx, edx
ja 0x453fb8
jb 0x453f52
cmp eax, dword [esi + 0x1c]
ja 0x453fb8
mov eax, dword [esi + 0x28]
test eax, eax
je 0x453f5e
cmp byte [eax], 0
jne 0x453f78
mov eax, dword [esi + 0x608]
test eax, eax
jg 0x453f74
lea ecx, [esi + 0x2c]
cmp edi, 2
je 0x453ee1
test edi, edi
je 0x453faf
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0xa
mov ecx, esi
call fcn.00453a00
cmp eax, 0xffffffff
je 0x453f78
test eax, eax
je 0x453fc6
push 0
push 0x5dc
lea eax, [esi + 0x2c]
push eax
push dword [esi + 0x18]
call sub.WSOCK32.dll_recv
mov dword [esi + 0x608], eax
test eax, eax
jle 0x453f78
jmp 0x453ebb
pop edi
pop esi
mov eax, 0xfffffffe
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp edi, dword [ebp + 0xc]
cmovg edi, dword [ebp + 0xc]
push edi
push ecx
push dword [ebp + 8]
call fcn.00482d10
mov ecx, dword [esi + 0x608]
lea eax, [esi + 0x2c]
sub ecx, edi
push ecx
lea ecx, [esi + 0x2c]
add ecx, edi
push ecx
push eax
call fcn.00482d10
add esp, 0x18
mov eax, edi
sub dword [esi + 0x608], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x482103
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x482142
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x482142
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x482142
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x482142
cmp dword [ecx + 0x74], 0xe
jbe 0x482142
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4979a3
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x52a1d8
push 0x52a1d0
push str.FlsAlloc
push 0x1f
call fcn.00497862
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4979d7
push dword [ebp + 8]
mov ecx, esi
call dword [0x519680]
call esi
jmp 0x4979dd
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x497a21
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x52a1e8
push 0x52a1e0
push str.FlsGetValue
push 0x21
call fcn.00497862
mov esi, eax
add esp, 0x10
test esi, esi
je 0x497a58
push dword [ebp + 8]
mov ecx, esi
call dword [0x519680]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x497a60
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x52a1f0
push 0x52a1e8
push str.FlsSetValue
push 0x22
call fcn.00497862
mov esi, eax
add esp, 0x10
test esi, esi
je 0x497a9a
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x519680]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]