joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43e6e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x43e702
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
ret

Function at 0x43e760
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x43e782
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
ret

Function at 0x43e7e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x43e80a
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
ret

Function at 0x43e870
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x43e89a
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
ret

Function at 0x43e900
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesenc xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesenc xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesenc xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x43e95f
Function at 0x43e9e0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesdec xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x43ea3f
Function at 0x4410c0
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
push ebx
test eax, eax
je 0x4415e0
test edx, edx
je 0x4415e0
call fcn.004410d7
mov eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x441620
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.004410c0
mov edx, dword [esp + 0xc]
shl ecx, 4
test eax, eax
jne 0x441691
lea eax, [edx + ecx + 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
movups xmmword [eax], xmm0
movups xmmword [edx], xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmmword [edx - 0x10], xmm1
cmp eax, edx
ja 0x441656
movups xmm0, xmmword [edx]
aesimc xmm0, xmm0
movups xmmword [edx], xmm0
pxor xmm0, xmm0
pxor xmm1, xmm1
xor eax, eax
ret

Function at 0x441fa0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push esi
push edi
sub esp, 0x10
mov ebp, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
bswap eax
bswap ebx
bswap ecx
bswap edx
mov dword [edi], eax
mov dword [edi + 4], ebx
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
cmp ebp, 0x80
je 0x442024
mov eax, dword [esi + 0x10]
mov ebx, dword [esi + 0x14]
cmp ebp, 0xc0
je 0x441ffc
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0x1c]
jmp 0x442004
mov ecx, eax
mov edx, ebx
not ecx
not edx
bswap eax
bswap ebx
bswap ecx
bswap edx
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ecx
mov dword [edi + 0x2c], edx
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
nop
call fcn.00442029
Function at 0x450633
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
cmp dword [ebp + 0x10], 0
xorps xmm0, xmm0
push ebx
push esi
push edi
movlpd qword [esp + 0x10], xmm0
jb 0x450689
ja 0x450656
cmp dword [ebp + 0xc], 0
jbe 0x450689
mov ebx, dword [ebp + 8]
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
mov eax, dword [ebp + 0x14]
mov ecx, esi
mov edx, dword [ebp + 0x18]
and ecx, 7
shl ecx, 3
call fcn.006db780
xor byte [esi + ebx], al
add esi, 1
adc edi, 0
cmp edi, dword [ebp + 0x10]
jb 0x450661
ja 0x450689
cmp esi, dword [ebp + 0xc]
jb 0x450661
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4508e5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x7259d8
call fcn.006db31c
movzx eax, word [ebp + 0xc]
sub esp, 0x28
push ebx
push esi
push dword [ebp + 0x10]
xor ebx, ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x450929
call fcn.00450a9f
mov esi, eax
mov ecx, esi
call fcn.004518c4
mov ecx, dword [ebp + 0x14]
push esi
call fcn.004519aa
xor al, al
jmp 0x450a91
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x10], edi
test edi, edi
jne 0x45094b
call fcn.00450b3c
mov esi, eax
mov ecx, esi
call fcn.00451894
jmp 0x45098d
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x450969
call fcn.00450bcd
mov esi, eax
mov ecx, esi
call fcn.00451864
jmp 0x45098d
push 0x7af994
push edi
call fcn.006db311
mov ebx, eax
mov dword [ebp - 0x1c], ebx
pop ecx
pop ecx
test ebx, ebx
jne 0x45099d
call fcn.00450c62
mov esi, eax
mov ecx, esi
call fcn.00451834
mov ecx, dword [ebp + 0x14]
push esi
call fcn.004519aa
xor al, al
jmp 0x450a90
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push ebx
call fcn.006dccc0
xor eax, eax
mov dword [ebp - 0x18], 0x264c4e31
add esp, 0xc
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x34]
mov byte [ebp - 0x34], al
lea eax, [ebp - 0x18]
mov byte [ebp - 0x14], 0x43
push 5
push eax
mov dword [ebp - 0x20], 0xf
call fcn.004519c9
and dword [ebp - 4], 0
lea ecx, [ebp - 0x34]
cmp dword [ebp - 0x20], 0x10
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 0x24]
lea esi, [ebp - 0x34]
cmovae ecx, dword [ebp - 0x34]
cmovae edx, dword [ebp - 0x34]
add eax, ecx
mov ecx, dword [ebp - 0x20]
cmp ecx, 0x10
cmovae esi, dword [ebp - 0x34]
cmp esi, eax
je 0x450a27
sub edx, esi
mov ebx, eax
mov edi, edx
movzx eax, byte [esi]
push eax
call fcn.004d8bfa
mov byte [edi + esi], al
inc esi
pop ecx
cmp esi, ebx
jne 0x450a0c
mov edi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
push edi
cmp ecx, 0x10
lea eax, [ebp - 0x34]
push ebx
cmovae eax, dword [ebp - 0x34]
push 5
push eax
call fcn.00453f8e
push dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov edx, ebx
push edi
call fcn.00450690
push ebx
mov byte [ebp + 0xf], al
call fcn.006db30c
mov ecx, dword [ebp - 0x20]
add esp, 0x1c
cmp ecx, 0x10
jb 0x450a8d
mov eax, dword [ebp - 0x34]
inc ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], eax
cmp ecx, 0x1000
jb 0x450a84
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00450606
mov eax, dword [ebp - 0x18]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
push ecx
push eax
call fcn.006db2db
pop ecx
pop ecx
mov al, byte [ebp + 0xf]
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x45231f
Capabilities:
Set registry value

Disassembly:
cmp byte [ecx + 4], 0
jne 0x45232c
xor al, al
jmp 0x4523bf
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
xor ebx, ebx
mov esi, ebx
lea ebp, [edi + 0x10]
mov eax, dword [ebp]
test eax, eax
je 0x452390
push 0x7af994
push eax
call fcn.006db311
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x4523b9
cmp dword [edi + 0x14], 0x10
jb 0x45235d
mov edi, dword [edi]
push dword [ebp]
push edi
push esi
call fcn.006dccc0
push dword [ebp]
cmp dword [0x7efe0c], 0x10
mov eax, 0x7efdf8
push esi
push dword [0x7efe08]
cmovae eax, dword [0x7efdf8]
push eax
call fcn.00453f8e
mov eax, dword [ebp]
add esp, 0x1c
push eax
push esi
push 3
push ebx
push dword [0x7efdf4]
push dword [0x7efde8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
neg eax
sbb al, al
lea ebx, [eax + 1]
test esi, esi
je 0x4523b9
push esi
call fcn.006db30c
pop ecx
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
ret 4

Function at 0x453005
Capabilities:
Read file on windows

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x14]
xor esi, esi
mov dword [edi], esi
mov eax, dword [ecx + 0x100]
cmp eax, 0xffffffff
jne 0x45301f
push 6
pop eax
jmp 0x453047
push dword [esp + 0x10]
push dword [esp + 0x10]
push eax
call fcn.006ef042
add esp, 0xc
mov dword [edi], eax
cmp eax, 0xffffffff
je 0x45303d
cmp eax, dword [esp + 0x10]
je 0x453045
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, esi
pop edi
pop esi
ret 0xc

Function at 0x4535d8
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov dword [ecx], 0x67452301
mov byte [ecx + 0x68], al
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret
Function at 0x453f8e
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x414
push ebx
xor edx, edx
push esi
push edi
mov dword [esp + 0x14], edx
mov eax, edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], edx
movd xmm0, eax
pshufd xmm0, xmm0, 0
paddd xmm0, xmmword [0x7d9d10]
movups xmmword [esp + eax*4 + 0x20], xmm0
add eax, 4
cmp eax, 0x100
jl 0x453fad
mov edi, edx
mov ebx, edx
mov esi, edx
mov edx, dword [ebp + 8]
mov al, byte [edi + edx]
mov ecx, dword [esp + esi*4 + 0x20]
add al, bl
add al, cl
movzx ebx, al
mov eax, dword [esp + ebx*4 + 0x20]
mov dword [esp + esi*4 + 0x20], eax
lea eax, [edi + 1]
xor edi, edi
mov dword [esp + ebx*4 + 0x20], ecx
inc esi
cmp eax, dword [ebp + 0xc]
cmovl edi, eax
cmp esi, 0x100
jl 0x453fd6
cmp dword [ebp + 0x14], 0
mov eax, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
push 0
mov dword [esp + 0x14], eax
pop edx
jle 0x45405c
mov esi, dword [ebp + 0x10]
inc bl
movzx ebx, bl
mov ecx, dword [esp + ebx*4 + 0x20]
mov al, cl
add al, byte [esp + 0x10]
movzx eax, al
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x10]
mov eax, dword [esp + eax*4 + 0x20]
mov dword [esp + ebx*4 + 0x20], eax
mov dword [esp + edx*4 + 0x20], ecx
add cl, al
mov edx, dword [esp + 0x14]
movzx eax, cl
mov al, byte [esp + eax*4 + 0x20]
xor byte [edx + esi], al
inc edx
mov dword [esp + 0x14], edx
cmp edx, dword [ebp + 0x14]
jl 0x45401c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4712a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x7eba44]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov eax, ecx
mov ebx, edx
xor esi, esi
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x44], eax
push edi
mov edi, dword [ebp + 8]
test eax, eax
je 0x47135f
test ebx, ebx
je 0x47134c
test edi, edi
je 0x47134a
lea ecx, [ebp - 0x3c]
mov dword [edi], esi
push ecx
push eax
call fcn.006ee957
add esp, 8
test eax, eax
jne 0x47134a
mov eax, dword [ebp - 0x28]
inc eax
push 1
push eax
call fcn.006e6b64
mov esi, eax
add esp, 8
test esi, esi
je 0x47134a
push 0x7d576c
push dword [ebp - 0x44]
call fcn.006e62e4
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x471347
mov ecx, dword [ebp - 0x28]
sub ecx, dword [edi]
push ebx
push ecx
push 1
push esi
call fcn.006e66a4
add esp, 0x10
test eax, eax
je 0x47133e
add dword [edi], eax
mov eax, dword [ebp - 0x28]
sub eax, dword [edi]
push ebx
push eax
push 1
push esi
call fcn.006e66a4
add esp, 0x10
test eax, eax
jne 0x471326
push ebx
call fcn.006e6467
add esp, 4
mov ebx, dword [ebp - 0x40]
mov dword [ebx], esi
mov ecx, dword [ebp - 8]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006dbabd
mov esp, ebp
pop ebp
ret
xor esi, esi
test ebx, ebx
je 0x47134c
jmp 0x47134a

Function at 0x4713f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
push ebx
push esi
push edi
push dword [ebp + 0xc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x47145c
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test esi, esi
je 0x47145c
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x47145c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
lea ecx, [esi + 1]
mov ebx, eax
push 1
push ecx
call fcn.006e6b64
mov edi, eax
add esp, 8
test edi, edi
je 0x47145c
push esi
push ebx
push edi
call fcn.006dccc0
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov eax, edi
pop edi
mov dword [ecx], esi
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x4717c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 4], 0
test esi, esi
je 0x4717f6
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
test eax, eax
je 0x4717f6
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x471800
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
jne 0x47180f
or eax, 0xffffffff
pop ebp
ret
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
xor eax, eax
pop ebp
ret
Function at 0x4719f0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x7eba44]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov byte [ebp - 0x6a], 1
xor esi, esi
mov byte [ebp - 0x69], 0
mov ebx, edx
test edi, edi
je 0x471b47
test ebx, ebx
je 0x471b47
cmp dword [ebx], esi
je 0x471b47
cmp dword [ebx + 4], esi
je 0x471b47
mov eax, dword [edi + 0x18]
test eax, eax
je 0x471a42
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 0x38]
push eax
push dword [edi]
call fcn.006ee957
xor ecx, ecx
add esp, 8
test eax, eax
cmove ecx, dword [ebp - 0x24]
cmp dword [edi + 0xc], ecx
ja 0x471a6d
cmp byte [edi + 9], 0
je 0x471a69
mov byte [ebp - 0x69], 1
jmp 0x471a6d
mov byte [ebp - 0x6a], 0
lea eax, [ebp - 0x68]
push eax
push dword [edi]
call fcn.006ee957
add esp, 8
test eax, eax
jne 0x471a88
cmp byte [ebp - 0x69], al
je 0x471b09
mov eax, dword [edi + 0x2c]
test eax, eax
js 0x471a98
push eax
call fcn.006ee9f3
add esp, 4
mov ecx, dword [edi]
mov dword [edi + 0x2c], 0xffffffff
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x471aa4
sub ecx, edx
push 1
lea eax, [ecx + 5]
push eax
call fcn.006e6b64
add esp, 8
mov dword [ebp - 0x70], eax
test eax, eax
je 0x471b37
push dword [edi]
push str._s.bak
push eax
call fcn.004540c0
add esp, 0xc
push dword [ebp - 0x70]
call fcn.006f11d8
add esp, 4
push dword [ebp - 0x70]
push dword [edi]
call fcn.006f1242
push dword [ebp - 0x70]
call fcn.006e60fe
add esp, 0xc
push 0x180
push 0x8109
push dword [edi]
call fcn.006eda2b
add esp, 0xc
mov dword [edi + 0x2c], eax
cmp dword [edi + 0x2c], esi
jl 0x471b47
cmp byte [ebp - 0x6a], 0
je 0x471b37
mov eax, dword [ebx + 4]
sub eax, esi
push eax
mov eax, dword [ebx]
add eax, esi
push eax
push dword [edi + 0x2c]
call fcn.006efca3
add esp, 0xc
test eax, eax
je 0x471b37
add esi, eax
mov eax, dword [ebx + 4]
cmp esi, eax
jb 0x471b17
mov eax, dword [edi + 0x18]
test eax, eax
je 0x471b47
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006dbabd
mov esp, ebp
pop ebp
ret

Function at 0x472220
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov byte [0x7efd9d], 1
mov byte [0x7efd9c], 0
mov dword [0x7efe58], 0
test eax, eax
je 0x472254
push eax
call fcn.006e718e
add esp, 4
mov dword [0x7efe50], eax
test eax, eax
je 0x4722ac
mov eax, dword [ebp + 0xc]
mov dl, 1
xor ecx, ecx
mov dword [0x7efda0], eax
call fcn.0048a690
mov dword [0x7efe34], eax
test eax, eax
je 0x4722ac
mov ecx, str.csp_log
call fcn.00471590
mov dword [0x7efe54], eax
test eax, eax
je 0x4722ac
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
push 0
push 0
push 0x471c30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x7efe58], eax
test eax, eax
je 0x4722ac
xor eax, eax
pop ebp
ret
call fcn.00471e80
or eax, 0xffffffff
pop ebp
ret
Function at 0x4ac210
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x7eba44]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x90]
mov dword [ebp - 0x90], 0x80
push eax
lea eax, [ebp - 0x88]
mov ebx, edx
push eax
push ebx
mov edi, ecx
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jns 0x4ac411
mov eax, dword [0x7f02b8]
test eax, eax
je 0x4ac3fe
cmp dword [eax + 0x14], 4
jl 0x4ac3fe
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
push eax
call fcn.006e72af
add esp, 4
push eax
call esi
push eax
push ebx
test edi, edi
mov eax, 0x7d3deb
cmovne eax, edi
push eax
push 0x5c8
push str.d:_srcmaster_2022ClientOSSServicecsproxy_src_sock.c
push str.__s:_d_:_n___s_n__getsockname___failed_for___d___error__d:_s
push 4
call fcn.00472f60
mov edi, eax
add esp, 0x20
mov dword [ebp - 0x8c], edi
test edi, edi
je 0x4ac3fe
mov edi, dword [0x7f02b8]
test edi, edi
je 0x4ac3f0
cmp byte [edi + 8], 0
je 0x4ac3f0
cmp dword [edi + 0x14], 4
jl 0x4ac3f0
mov esi, eax
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x4ac2e0
mov eax, dword [edi + 0x20]
sub esi, ecx
add eax, esi
cmp dword [edi + 0x28], eax
jb 0x4ac3f0
test esi, esi
je 0x4ac3f0
push 8
push 1
call fcn.006e6b64
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x4ac3f0
push 1
push esi
call fcn.006e6b64
add esp, 8
mov dword [ebx], eax
test eax, eax
jne 0x4ac34a
push dword [ebp - 0x8c]
mov dword [ebx + 4], eax
call fcn.006e60fe
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006dbabd
mov esp, ebp
pop ebp
ret
push esi
push dword [ebp - 0x8c]
push eax
call fcn.006dccc0
mov eax, dword [edi + 0x24]
add esp, 0xc
mov dword [ebx + 4], esi
test eax, eax
je 0x4ac370
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [edi + 0x24]
add dword [edi + 0x20], esi
test eax, eax
je 0x4ac380
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [edi + 0x1c]
test esi, esi
je 0x4ac3f0
cmp byte [esi + 0x10], 0
je 0x4ac39d
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4ac39d
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esi + 0xc]
push 0xc
push 1
call fcn.006e6b64
add esp, 8
test edi, edi
je 0x4ac3cb
test eax, eax
je 0x4ac3da
mov ecx, dword [edi + 8]
mov dword [eax], ebx
mov dword [eax + 8], ecx
mov dword [edi + 8], eax
mov dword [eax + 4], edi
test ecx, ecx
je 0x4ac3d4
mov dword [ecx + 4], eax
jmp 0x4ac3d7
test eax, eax
je 0x4ac3da
mov dword [eax], ebx
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
inc dword [esi + 4]
cmp byte [esi + 0x10], 0
je 0x4ac3f0
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4ac3f0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [ebp - 0x8c]
call fcn.006e60fe
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006dbabd
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
movzx eax, word [ebp - 0x88]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.006dbabd
mov esp, ebp
pop ebp
ret