joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405630
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3a4
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x13c
lea eax, [ebp - 0x39c]
mov dword [ebp - 0x3a0], 0
mov esi, ecx
push 0
push eax
mov dword [ebp - 0x3a4], esi
call fcn.00452270
push 0x257
lea eax, [ebp - 0x25f]
mov byte [ebp - 0x260], 0
push 0
push eax
call fcn.00452270
add esp, 0x18
mov edx, esi
lea ebx, [ebx]
mov al, byte [edx]
inc edx
test al, al
jne 0x405690
lea edi, [ebp - 0x260]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4056a0
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x260]
dec ecx
lea ecx, [ecx]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4056c0
mov eax, dword [str..]
mov dword [ecx], eax
mov al, byte [0x482a70]
mov byte [ecx + 4], al
lea eax, [ebp - 0x3a0]
push eax
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40585d
mov esi, dword [ebp - 0x3a4]
mov ecx, esi
call fcn.00405460
lea eax, [ebp - 0x3a0]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x40585d
jmp 0x405720
mov ecx, 0x482a18
lea eax, [ebp - 0x374]
jmp 0x405730
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x405750
test dl, dl
je 0x40574c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x405750
add eax, 2
add ecx, 2
test dl, dl
jne 0x405730
xor eax, eax
jmp 0x405755
sbb eax, eax
or eax, 1
test eax, eax
je 0x405847
mov eax, 0x482a74
lea ecx, [ebp - 0x374]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x405788
test dl, dl
je 0x405784
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x405788
add ecx, 2
add eax, 2
test dl, dl
jne 0x405768
xor eax, eax
jmp 0x40578d
sbb eax, eax
or eax, 1
test eax, eax
je 0x405847
test byte [ebp - 0x3a0], 0x10
je 0x405847
push 0x258
lea eax, [ebp - 0x260]
push 0
push eax
call fcn.00452270
add esp, 0xc
mov edx, esi
lea ebx, [ebx]
mov al, byte [edx]
inc edx
test al, al
jne 0x4057c0
lea edi, [ebp - 0x260]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4057d0
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x260]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x4057f0
mov ax, word [0x482998]
lea edx, [ebp - 0x374]
mov word [edi], ax
mov esi, edx
jmp 0x405810
mov al, byte [edx]
inc edx
test al, al
jne 0x405810
lea edi, [ebp - 0x260]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x405820
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x260]
call fcn.00405460
mov esi, dword [ebp - 0x3a4]
lea eax, [ebp - 0x3a0]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405720
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00451570
mov esp, ebp
pop ebp
ret
Function at 0x405870
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3a4
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x13c
lea eax, [ebp - 0x39c]
mov dword [ebp - 0x3a0], 0
mov esi, ecx
push 0
push eax
mov dword [ebp - 0x3a4], esi
call fcn.00452270
add esp, 0xc
mov byte [ebp - 0x260], 0
lea eax, [ebp - 0x25f]
push 0x257
push 0
push eax
call fcn.00452270
add esp, 0xc
mov edx, esi
lea ecx, [ecx]
mov al, byte [edx]
inc edx
test al, al
jne 0x4058d0
lea edi, [ebp - 0x260]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4058e0
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x260]
dec ecx
lea ecx, [ecx]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x405900
mov eax, dword [str..]
mov dword [ecx], eax
mov al, byte [0x482a70]
mov byte [ecx + 4], al
lea eax, [ebp - 0x3a0]
push eax
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x405a9d
mov esi, dword [ebp - 0x3a4]
mov ecx, esi
call fcn.00405460
lea eax, [ebp - 0x3a0]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x405a9d
jmp 0x405960
mov ecx, 0x482a18
lea eax, [ebp - 0x374]
jmp 0x405970
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x405990
test dl, dl
je 0x40598c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x405990
add eax, 2
add ecx, 2
test dl, dl
jne 0x405970
xor eax, eax
jmp 0x405995
sbb eax, eax
or eax, 1
test eax, eax
je 0x405a87
mov eax, 0x482a74
lea ecx, [ebp - 0x374]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4059c8
test dl, dl
je 0x4059c4
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4059c8
add ecx, 2
add eax, 2
test dl, dl
jne 0x4059a8
xor eax, eax
jmp 0x4059cd
sbb eax, eax
or eax, 1
test eax, eax
je 0x405a87
test byte [ebp - 0x3a0], 0x10
je 0x405a87
push 0x258
lea eax, [ebp - 0x260]
push 0
push eax
call fcn.00452270
add esp, 0xc
mov edx, esi
lea ebx, [ebx]
mov al, byte [edx]
inc edx
test al, al
jne 0x405a00
lea edi, [ebp - 0x260]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x405a10
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x260]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x405a30
mov ax, word [0x482998]
lea edx, [ebp - 0x374]
mov word [edi], ax
mov esi, edx
jmp 0x405a50
mov al, byte [edx]
inc edx
test al, al
jne 0x405a50
lea edi, [ebp - 0x260]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x405a60
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x260]
call fcn.00405630
mov esi, dword [ebp - 0x3a4]
lea eax, [ebp - 0x3a0]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405960
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00451570
mov esp, ebp
pop ebp
ret
Function at 0x405e90
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x486370
push 0x459d70
mov eax, dword fs:[0]
push eax
sub esp, 0x4e8
mov eax, dword [0x4a4300]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
call fcn.00403a90
mov byte [ebp - 0x278], 0
push 0x257
push 0
cmp eax, 1
lea eax, [ebp - 0x277]
push eax
jne 0x405f3e
call fcn.00452270
add esp, 0xc
push 0x4a8890
push 0x258
lea eax, [ebp - 0x278]
push eax
push 0
push str.Start
push str.PATH
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x405f29
push 0x482ab0
call fcn.004027e0
add esp, 4
call fcn.00401440
lea ecx, [ebp - 0x278]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x405f32
jmp 0x406137
call fcn.00452270
add esp, 0xc
push 0x4a8890
push 0x258
lea eax, [ebp - 0x278]
push eax
push 0
push str.Game
push str.PATH
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
call esi
lea eax, [ebp - 0x278]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x405f81
test al, 0x10
jne 0x405fd8
mov dword [ebp - 0x4f4], 0
mov dword [ebp - 4], 0
call fcn.00405ab0
mov dword [ebp - 0x4f4], eax
mov dword [ebp - 4], 0xfffffffe
jmp 0x405fc2
test eax, eax
jne 0x405fd8
push 0x482ab0
call fcn.004027e0
add esp, 4
call fcn.00401440
push 0x4a8890
push 0x258
lea eax, [ebp - 0x278]
push eax
push 0
push str.Game
push str.PATH
call esi
test eax, eax
jne 0x406124
push 4
push 0x482770
push 0x482aec
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x4060ef
mov byte [ebp - 0x4d0], 0
push 0x257
push 0
lea eax, [ebp - 0x4cf]
push eax
call fcn.00452270
add esp, 0xc
mov dword [ebp - 0x4f0], 0
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x4ec], xmm0
movq qword [ebp - 0x4dc], xmm0
mov dword [ebp - 0x4d4], 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x4f0], eax
mov dword [ebp - 0x4ec], 0
lea eax, [ebp - 0x4d0]
mov dword [ebp - 0x4e8], eax
mov dword [ebp - 0x4e4], 0x482a78
mov dword [ebp - 0x4e0], 0x43
mov dword [ebp - 0x4dc], 0
mov dword [ebp - 0x4d4], 0
lea eax, [ebp - 0x4f0]
push eax
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderA]
test eax, eax
je 0x4060ef
lea ecx, [ebp - 0x4d0]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
cmp eax, 1
jne 0x4060ef
push 0x4a8890
lea eax, [ebp - 0x4d0]
push eax
push str.Game
push str.PATH
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push 0x4a8890
push 0x258
lea eax, [ebp - 0x278]
push eax
push 0
push str.Game
push str.PATH
call esi
test eax, eax
jne 0x406124
push 0x482ab0
call fcn.004027e0
add esp, 4
call fcn.00401440
lea ecx, [ebp - 0x278]
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x406130
sub ecx, edx
je 0x406146
lea ecx, [ebp - 0x278]
call fcn.004041e0
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00451570
mov esp, ebp
pop ebp
ret
Function at 0x4069e0
Capabilities:
Create thread
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x214
mov eax, dword [0x4a4300]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
xor eax, eax
push 0x18e
push eax
mov word [esp + 0x10], ax
lea eax, [esp + 0x12]
push eax
call fcn.00452270
add esp, 0xc
lea eax, [esp + 8]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x406b52
mov eax, dword [0x4ab490]
test eax, eax
je 0x406a3f
push str._STS_DUILIB_CreateLoadWnd
call eax
call eax
push 0x63
lea eax, [esp + 0x1ad]
mov byte [esp + 0x1ac], 0
push 0
push eax
call fcn.00452270
add esp, 0xc
lea ecx, [esp + 0x198]
xorps xmm0, xmm0
movdqu xmmword [esp + 0x198], xmm0
call fcn.0040b360
test eax, eax
je 0x406b88
lea eax, [esp + 0x198]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
push 0x64
mov esi, eax
mov dword [esp + 8], 6
lea eax, [esp + 0x1ac]
push 0
push eax
call fcn.00452270
add esp, 0xc
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x1ac]
push eax
push 0
push esi
call dword [sym.imp.IPHLPAPI.DLL_SendARP]
neg eax
sbb eax, eax
inc eax
je 0x406b88
call fcn.0040b4d0
test eax, eax
je 0x406b64
call fcn.00402ee0
call fcn.00402de0
mov ecx, dword [0x4a8884]
test eax, eax
mov esi, 1
cmove ecx, esi
mov dword [0x4a8884], ecx
call fcn.00402e60
mov ecx, dword [0x4a888c]
cmp eax, esi
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push 0
push 0
push 0x4067f0
push 0
cmove ecx, esi
push 0
mov dword [0x4a888c], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x406b36
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 4], 0
je 0x406b76
mov ecx, dword [esp + 0x214]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00451570
mov esp, ebp
pop ebp
ret
push 0x482d90
call fcn.004027e0
add esp, 4
call fcn.00401440
push 0x482df4
call fcn.004027e0
add esp, 4
call fcn.00401440
push 0x482e28
call fcn.004027e0
add esp, 4
call fcn.00401440
push 0x482dc4
call fcn.004027e0
add esp, 4
call fcn.00401440
int3
Function at 0x407410
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
call fcn.0040fa20
mov ebx, eax
mov esi, edx
mov dword [ebp - 0x210], ebx
mov dword [ebp - 0x20c], esi
call fcn.0040fa20
sub eax, ebx
sbb edx, esi
test edx, edx
jg 0x4074a9
jl 0x407453
cmp eax, 0x7530
ja 0x4074a9
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
nop
push 0x48307c
call esi
push 0x48307c
call fcn.004580ba
add esp, 4
mov ecx, edi
call fcn.0040c200
cmp eax, 1
je 0x4074bc
push 0x3e8
call ebx
call fcn.0040fa20
sub eax, dword [ebp - 0x210]
sbb edx, dword [ebp - 0x20c]
mov dword [ebp - 0x214], edx
js 0x407460
jg 0x4074a9
cmp eax, 0x7530
jbe 0x407460
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00451570
mov esp, ebp
pop ebp
ret
push 0x1ff
lea eax, [ebp - 0x207]
mov byte [ebp - 0x208], 0
push 0
push eax
call fcn.00452270
add esp, 0xc
call fcn.0040fa20
sub eax, dword [ebp - 0x210]
sbb edx, dword [ebp - 0x20c]
push edx
push eax
lea eax, [ebp - 0x208]
push 0x48309c
push eax
call fcn.004573bf
add esp, 0x10
lea eax, [ebp - 0x208]
push eax
call esi
lea eax, [ebp - 0x208]
push eax
call fcn.004580ba
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
mov eax, 1
pop edi
pop esi
pop ebx
call fcn.00451570
mov esp, ebp
pop ebp
ret

Function at 0x4075a0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
call fcn.0040fa20
mov esi, edx
mov ebx, eax
mov dword [ebp - 0x20c], esi
call fcn.0040fa20
sub eax, ebx
sbb edx, esi
test edx, edx
jg 0x407614
jl 0x4075dd
cmp eax, 0x7530
ja 0x407614
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x4830c4
call esi
mov ecx, edi
call fcn.0040c3e0
cmp eax, 1
je 0x407627
call fcn.0040fa20
sub eax, ebx
sbb edx, dword [ebp - 0x20c]
mov dword [ebp - 0x214], edx
js 0x4075e3
jg 0x407614
cmp eax, 0x7530
jbe 0x4075e3
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00451570
mov esp, ebp
pop ebp
ret
push 0x1ff
lea eax, [ebp - 0x207]
mov byte [ebp - 0x208], 0
push 0
push eax
call fcn.00452270
add esp, 0xc
call fcn.0040fa20
sub eax, ebx
sbb edx, dword [ebp - 0x20c]
push edx
push eax
lea eax, [ebp - 0x208]
push str._DEBUG___lld__
push eax
call fcn.004573bf
add esp, 0x10
lea eax, [ebp - 0x208]
push eax
call esi
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00451570
mov esp, ebp
pop ebp
ret

Function at 0x407ba0
Capabilities:
Hash data with md5

Disassembly:
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x10], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret
Function at 0x4084a0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
push ebx
push esi
push edi
mov dword [ebp - 0xc0], eax
mov esi, edx
xor eax, eax
mov byte [ebp - 0x18], 0
push 0x42
push eax
mov word [ebp - 0x64], ax
mov edi, ecx
lea eax, [ebp - 0x62]
movq qword [ebp - 0x17], xmm0
push eax
mov dword [ebp - 0xf], 0
mov word [ebp - 0xb], 0
mov byte [ebp - 9], 0
call fcn.00452270
push esi
mov edx, edi
mov dword [ebp - 0xa8], 0
lea ecx, [ebp - 0xbc]
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xbc], 0x67452301
mov dword [ebp - 0xb8], 0xefcdab89
mov dword [ebp - 0xb4], 0x98badcfe
mov dword [ebp - 0xb0], 0x10325476
call fcn.00407bd0
add esp, 0x10
lea edx, [ebp - 0xbc]
lea ecx, [ebp - 0x18]
call fcn.00407ca0
xor edi, edi
lea esi, [ebp - 0x62]
mov bl, byte [ebp + edi - 0x18]
movzx eax, bl
push eax
push str._02x
lea eax, [esi - 2]
push 2
push eax
call fcn.00401420
shl bl, 4
movzx eax, bl
push eax
push str._02x
push 2
push esi
call fcn.00401420
inc edi
add esp, 0x20
add esi, 4
cmp edi, 0x10
jl 0x408552
xor eax, eax
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x64]
push eax
push 0x21
push dword [ebp - 0xc0]
call fcn.004545dc
mov ecx, dword [ebp - 8]
add esp, 0xc
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00451570
mov esp, ebp
pop ebp
ret

Function at 0x408740
Capabilities:
Hash data using djb2

Disassembly:
push ebx
push esi
mov ebx, edx
xor esi, esi
mov eax, 0x1505
push edi
mov edi, ecx
test ebx, ebx
je 0x40876a
mov dl, byte [esi + edi]
test dl, dl
je 0x40876a
mov ecx, eax
inc esi
shl eax, 5
add eax, ecx
movzx ecx, dl
add eax, ecx
cmp esi, ebx
jb 0x408752
pop edi
pop esi
pop ebx
ret

Function at 0x408cb0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, ecx
mov dword [ebp - 8], eax
push edi
mov edi, edx
test eax, eax
je 0x408d28
test edi, edi
je 0x408d28
push ebx
mov ebx, dword [ebp + 8]
xor edx, edx
push esi
mov esi, 0x1505
test ebx, ebx
je 0x408cf1
mov cl, byte [edx + edi]
test cl, cl
je 0x408cee
mov eax, esi
inc edx
shl esi, 5
add esi, eax
movzx eax, cl
add esi, eax
cmp edx, ebx
jb 0x408cd6
mov eax, dword [ebp - 8]
lea ecx, [ebp - 4]
mov dword [ebp - 4], 0
push ecx
push esi
push ebx
mov edx, edi
mov ecx, eax
call fcn.00408b00
add esp, 0xc
mov ecx, eax
cmp dword [ebp - 4], 0
pop esi
pop ebx
je 0x408d28
mov edx, dword [ebp - 8]
pop edi
mov eax, dword [edx + 4]
mov ecx, dword [eax + ecx*4]
mov eax, dword [edx + 0x10]
mov eax, dword [eax + ecx*4]
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x40a960
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x334
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x257
lea eax, [ebp - 0x327]
mov dword [ebp - 0x330], ecx
push 0
push eax
mov byte [ebp - 0x328], 0
call fcn.00452270
add esp, 0xc
lea eax, [ebp - 0x328]
push 0x258
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0x80
push 4
push 0
push 5
push SysReAllocString
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40aada
lea eax, [ebp - 0x32c]
mov dword [ebp - 0x32c], 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push eax
push dword [ebp - 0x32c]
mov dword [ebp - 0x334], eax
push 2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40aad3
test esi, esi
je 0x40aad3
push 0
push 0
push 0
push 5
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
test ebx, ebx
jne 0x40aa50
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00451570
mov esp, ebp
pop ebp
ret
xor eax, eax
push 0xc6
push eax
mov word [ebp - 0xd0], ax
lea eax, [ebp - 0xce]
push eax
call fcn.00452270
mov edx, dword [ebp - 0x334]
lea eax, [ebp - 0xd0]
add esp, 0xc
mov ecx, ebx
push eax
call fcn.004084a0
mov ebx, dword [ebp - 0x330]
add esp, 4
push 0x64
push 0
push ebx
call fcn.00452270
add esp, 0xc
lea eax, [ebp - 0xd0]
push eax
push 0x48276c
push ebx
call fcn.004573bf
add esp, 0xc
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
test edi, edi
je 0x40aabd
push edi
call esi
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00451570
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00451570
mov esp, ebp
pop ebp
ret
Function at 0x40ae60
Capabilities:
Extract resource via kernel32 functions
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.TEXT
push 0x84
push 0
mov ebx, ecx
mov dword [ebp - 0x260], 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x40aee5
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x40aee5
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x40aee5
cmp eax, 0x2000
ja 0x40aee5
push eax
push esi
push ebx
call fcn.00451c20
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00451570
mov esp, ebp
pop ebp
ret
push 0x257
lea eax, [ebp - 0x25b]
mov byte [ebp - 0x25c], 0
push 0
push eax
call fcn.00452270
add esp, 0xc
lea eax, [ebp - 0x25c]
push 0x258
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x25c]
dec ecx
lea ecx, [ecx]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x40af20
mov eax, dword [str..json]
push 0
push 0x80
push 3
mov dword [ecx], eax
mov ax, word [0x483320]
push 0
push 0
mov word [ecx + 4], ax
lea eax, [ebp - 0x25c]
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40af74
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00451570
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 0x260]
push eax
push 0x2000
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor eax, eax
cmp eax, dword [ebp - 0x260]
pop edi
sbb eax, eax
xor ecx, ebp
pop esi
neg eax
pop ebx
call fcn.00451570
mov esp, ebp
pop ebp
ret

Function at 0x40b360
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0xff
lea eax, [ebp - 0x107]
mov byte [ebp - 0x108], 0
push 0
push eax
mov esi, ecx
call fcn.00452270
add esp, 0xc
lea eax, [ebp - 0x108]
push 0x100
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
jne 0x40b3bb
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00451570
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x12c], 0
push eax
lea eax, [ebp - 0x128]
xorps xmm0, xmm0
push eax
push 0
lea eax, [ebp - 0x108]
movdqu xmmword [ebp - 0x128], xmm0
push eax
movdqu xmmword [ebp - 0x118], xmm0
mov dword [ebp - 0x124], 2
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x40b3aa
mov eax, dword [ebp - 0x12c]
push 0x10
mov eax, dword [eax + 0x18]
push dword [eax + 4]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
push esi
call fcn.00456c20
add esp, 0xc
push dword [ebp - 0x12c]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.00451570
mov esp, ebp
pop ebp
ret
Function at 0x40b9b0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 6
push 1
push 2
mov ebx, ecx
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x40ba77
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
lea eax, [ebp - 8]
push 4
push eax
push 1
push 6
push esi
mov dword [ebp - 8], 1
call edi
xor eax, eax
mov dword [ebp - 8], 1
push 4
mov word [ebp - 6], ax
lea eax, [ebp - 8]
push eax
push 0xffffff7f
push 0xffff
push esi
call edi
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x2000
push eax
push 0x1001
push 0xffff
push esi
call edi
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x2000
push eax
push 0x1002
push 0xffff
push esi
call edi
push ecx
mov ecx, esi
call fcn.0040fc80
add esp, 4
mov dword [ebp - 8], 1
lea eax, [ebp - 8]
push eax
push 0x8004667e
push esi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x40ba8a
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00451570
mov esp, ebp
pop ebp
ret
push 4
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 1
push eax
push 4
push 0xffff
push esi
call edi
test eax, eax
jne 0x40ba70
mov edi, dword [sym.imp.WS2_32.dll_htons]
xorps xmm0, xmm0
mov dword [ebp - 0x12], eax
mov word [ebp - 0xe], ax
mov eax, 2
push 0
movq qword [ebp - 0x1a], xmm0
mov word [ebp - 0x1c], ax
call edi
push 0
mov word [ebp - 0x1a], ax
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push 0x10
push eax
push esi
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
jne 0x40ba70
mov dword [ebp - 0x22], eax
xorps xmm0, xmm0
mov word [ebp - 0x1e], ax
mov eax, 2
push 0xfff1
movq qword [ebp - 0x2a], xmm0
mov word [ebp - 0x2c], ax
call edi
mov word [ebp - 0x2a], ax
lea eax, [ebp - 0x2c]
push 0x10
push eax
push esi
mov dword [ebp - 0x28], ebx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x40bb30
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x40ba70
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00451570
mov esp, ebp
pop ebp
ret