joyce8/EMBER2024-capa huggingface dataset:
Function at 0x464c90
Capabilities:
Connect socket

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, ebx
call fcn.00464bb4
mov cl, 1
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call fcn.00403894
push 0x10
lea eax, [ebx + 0x18]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_connect
mov edx, 0x464cf4
call fcn.0046449c
mov byte [ebx + 0x29], 0
test byte [ebx + 0x28], 0x10
jne 0x464ce6
cmp dword [ebx + 4], 0xffffffff
setne al
mov byte [ebx + 8], al
mov cl, 2
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call fcn.00403894
pop esi
pop ebx
ret

Function at 0x464e74
Capabilities:
Resolve dns

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, edx
mov eax, ebx
call fcn.004048d4
push eax
call sub.wsock32.dll_gethostbyname
mov ebx, eax
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 4
call fcn.00402fac
test ebx, ebx
je 0x464ebf
mov eax, ebx
mov edx, dword [eax + 0xc]
mov edx, dword [edx]
mov cl, byte [edx]
mov byte [esp + 4], cl
mov cl, byte [edx + 1]
mov byte [esp + 5], cl
mov cl, byte [edx + 2]
mov byte [esp + 6], cl
mov al, byte [edx + 3]
mov byte [esp + 7], al
mov eax, dword [esp + 4]
mov dword [esp], eax
mov eax, dword [esp]
pop ecx
pop edx
pop ebx
ret

Function at 0x464f9c
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x464fcd
mov ecx, dword [0x471350]
mov dl, 1
mov eax, dword [0x463e08]
call fcn.0040be14
call fcn.00403e64
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], ebx
inc ebx
jne 0x464ffa
mov ecx, dword [0x4712e0]
mov dl, 1
mov eax, dword [0x463e08]
call fcn.0040be14
call fcn.00403e64
xor eax, eax
push ebp
push 0x465076
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xffff
call fcn.00403894
cmp byte [ebp + 8], 0
je 0x465052
mov eax, dword [ebp + 0x10]
push eax
mov ax, word [ebp + 0xc]
push eax
push 1
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.00464f04
mov eax, dword [ebp - 4]
lea esi, [ebp - 0x18]
lea edi, [eax + 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 4]
call fcn.00464c90
jmp 0x46506c
mov eax, dword [ebp + 0x10]
push eax
mov ax, word [ebp + 0xc]
push eax
push 0
push 1
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.00464788
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x465093
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x465274
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00464a50
xor eax, eax
push ebp
push 0x4653e6
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x4653d0
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
je 0x4652bf
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x4652c9
call fcn.00403f10
jmp 0x4653ed
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.004182f4
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x1010]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov ecx, 0x1000
mov ebx, dword [eax]
call dword [ebx + 8]
mov ebx, eax
test ebx, ebx
jle 0x4653c5
push 0
push ebx
lea eax, [ebp - 0x1010]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x465377
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2733
je 0x465364
lea eax, [ebp - 0x10]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00403894
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
push ebp
call fcn.0046522c
pop ecx
mov eax, dword [ebp - 4]
mov dl, byte [0x4653f8]
cmp dl, byte [eax + 0x28]
je 0x4653cc
call fcn.0040bcfc
jmp 0x4653cc
mov eax, dword [ebp - 0xc]
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00418314
jmp 0x4653cc
cmp ecx, ebx
jge 0x465393
mov eax, dword [ebp - 0xc]
add eax, ecx
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00418314
jmp 0x4652c9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.004182f4
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00418328
cmp edx, dword [esp + 4]
jne 0x4653b4
cmp eax, dword [esp]
pop edx
pop eax
jne 0x4652c9
push ebp
call fcn.0046522c
pop ecx
jmp 0x4653cc
push ebp
call fcn.0046522c
pop ecx
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4653ed
mov eax, dword [ebp - 4]
call fcn.00464a5c
ret
mov al, byte [ebp - 5]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4653fc
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46551e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00464a50
xor eax, eax
push ebp
push 0x465501
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x46544c
call fcn.00403f10
jmp 0x465508
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x4654eb
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x4654eb
lea eax, [ebp - 0xc]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00403894
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x4654eb
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040b504
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x465538
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x471458]
mov dl, 1
mov eax, dword [0x463e08]
call fcn.0040be50
call fcn.00403e64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x465508
mov eax, dword [ebp - 4]
call fcn.00464a5c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x465525
lea eax, [ebp - 0x28]
call fcn.00404424
ret
Function at 0x465584
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4656ce
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00464a50
xor eax, eax
push ebp
push 0x4656b1
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp ebx, 0xffffffff
jne 0x4655e9
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x4655e9
lea eax, [ebp - 8]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x46569b
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x4655fc
call fcn.00403f10
jmp 0x4656b8
push 0
push ebx
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x46569b
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x46569b
lea eax, [ebp - 0xc]
push eax
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00403894
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x46569b
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040b504
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x4656e8
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x471458]
mov dl, 1
mov eax, dword [0x463e08]
call fcn.0040be50
call fcn.00403e64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4656b8
mov eax, dword [ebp - 4]
call fcn.00464a5c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4656d5
lea eax, [ebp - 0x28]
call fcn.00404424
ret
Function at 0x46a6c8
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x4130c8]
call fcn.00404e00
xor eax, eax
push ebp
push 0x46a80c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x470f94], 0
jne 0x46a71b
mov ecx, dword [0x471050]
mov dl, 1
mov eax, dword [0x4077dc]
call fcn.0040be14
call fcn.00403e64
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00402fac
mov eax, ebx
call fcn.00404c70
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x46a81c
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00406168
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404c80
test eax, eax
jle 0x46a7b3
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x46a7ac
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.004046a4
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.0040468c
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408654
test eax, eax
jne 0x46a7ac
mov ebx, 0x15
jmp 0x46a7b8
mov ebx, 0x10
jmp 0x46a7b8
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x470f94]
call fcn.0046a620
mov eax, dword [ebp - 8]
call fcn.0046a620
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00406180
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46a813
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404448
lea eax, [ebp - 0x10]
mov edx, dword [0x4130c8]
call fcn.00404ed0
ret
Function at 0x46d7c4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x46d7cc
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x46d963
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x46d93e
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x1c]
mov eax, dword [0x4713b0]
mov eax, dword [eax]
call fcn.0045a478
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 4]
call fcn.00408a80
lea eax, [ebp - 8]
mov ecx, 0x46d97c
mov edx, dword [ebp - 4]
call fcn.00404728
lea eax, [ebp - 0xc]
mov ecx, 0x46d998
mov edx, dword [ebp - 4]
call fcn.00404728
lea eax, [ebp - 0x10]
mov ecx, 0x46d9ac
mov edx, dword [ebp - 4]
call fcn.00404728
lea eax, [ebp - 0x14]
mov ecx, 0x46d9c8
mov edx, dword [ebp - 4]
call fcn.00404728
lea eax, [ebp - 0x18]
mov edx, 0x46d9dc
call fcn.004044bc
mov eax, dword [ebp - 0x18]
call fcn.004048d4
mov edx, eax
lea eax, [ebp - 0x20]
call fcn.00404614
mov eax, dword [ebp - 0x20]
call fcn.004089e8
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
call fcn.00466474
lea eax, [ebp - 0x18]
mov edx, 0x46d9fc
call fcn.004044bc
mov eax, dword [ebp - 0x18]
call fcn.004048d4
mov edx, eax
lea eax, [ebp - 0x24]
call fcn.00404614
mov eax, dword [ebp - 0x24]
call fcn.004089e8
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
call fcn.00466474
lea eax, [ebp - 0x18]
mov edx, 0x46da2c
call fcn.004044bc
mov eax, dword [ebp - 0x18]
call fcn.004048d4
mov edx, eax
lea eax, [ebp - 0x28]
call fcn.00404614
mov eax, dword [ebp - 0x28]
call fcn.004089e8
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.00466474
lea eax, [ebp - 0x18]
mov edx, 0x46da54
call fcn.004044bc
mov eax, dword [ebp - 0x18]
call fcn.004048d4
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.00404614
mov eax, dword [ebp - 0x2c]
call fcn.004089e8
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
call fcn.00466474
push 0
lea eax, [ebp - 0x30]
mov ecx, dword [ebp - 0x18]
mov edx, 0x46da80
call fcn.00404728
mov eax, dword [ebp - 0x30]
call fcn.004048d4
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46d948
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46d96a
lea eax, [ebp - 0x30]
mov edx, 0xc
call fcn.00404448
ret
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x452008], 0x8088405
inc edx
mov dword [ebx + 0x452008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cb9c
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cbcd
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cbb5
add dl, dl
jne 0x41cbd8
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cc29
xor eax, eax
add dl, dl
jne 0x41cbe5
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41ccc6
add dl, dl
jne 0x41cbf4
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cbff
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cc0a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cc15
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cc1f
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cbc4
mov eax, 1
add dl, dl
jne 0x41cc37
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cc42
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cc2e
sub eax, ebx
mov ebx, 1
jne 0x41cc75
mov ecx, 1
add dl, dl
jne 0x41cc5b
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cc66
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cc52
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cbc4
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41cc8c
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cc97
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cc83
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cbc4
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41cce7
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cbc4
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41e0b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43b56f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov ecx, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41e161
add edx, ebx
mov eax, edx
mov esi, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
add edx, ebx
mov dword [ebp - 0x10], edx
mov edi, dword [eax + 0x20]
add edi, ebx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 4]
cmp edx, 0xffff
jbe 0x41e14a
test esi, esi
jbe 0x41e161
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088ac
test eax, eax
jne 0x41e13c
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41e161
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41e119
jmp 0x41e161
mov ecx, edx
sub ecx, dword [eax + 0x10]
cmp ecx, dword [eax + 0x14]
jae 0x41e161
mov eax, ecx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43b576
ret
Function at 0x41e9a4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov word [ebp - 2], dx
xor eax, eax
push ebp
push 0x43bf53
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x41e9df
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x41e9f8
lea eax, [ebp - 0x10]
mov edx, dword [0x454248]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x41ea0b
lea eax, [ebp - 0x10]
mov edx, dword [0x454248]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x41ea17
adc edx, 0
mov edx, dword [edx*4 + 0x4530d8]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406af4
mov esi, eax
cmp esi, 0xffffffff
je 0x41eb25
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push edi
push esi
call fcn.00406d3c
test eax, eax
je 0x41eb18
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x41eb18
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406d9c
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x18
push edi
push esi
call fcn.00406d3c
test eax, eax
je 0x41eb18
mov eax, edi
cmp dword [eax], 0x4550
jne 0x41eb18
add eax, 4
mov dx, word [eax]
cmp dx, 0x14c
jb 0x41eb18
cmp dx, 0x150
ja 0x41eb18
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0xe0
push edi
push esi
call fcn.00406d3c
test eax, eax
je 0x41eb18
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 2]
jne 0x41eb18
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406aac
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x41eb3d
inc ebx
cmp ebx, 0x19
jne 0x41e9d1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43bf5a
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x4030a4
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push reloc.WS2_32.dll_getpeername
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x4030c2
mov eax, 0x4b7c17
push eax
push 1
mov ebx, 0x42b720
call fcn.0042b1be
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4030ec
mov eax, 0
jmp 0x403160
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
jle 0x40314d
add eax, 8
mov edi, eax
mov ebx, edi
push edi
xor al, al
pop esi
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edi, eax
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x403136
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x403125
xor ecx, eax
xor edx, ebx
dec edi
jne 0x403116
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop ecx
pop edx
pop edi
pop ebx
pop esi
leave
ret 4
mov esp, ebp
pop ebp
ret 4
Function at 0x417087
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
jmp 0x4170a9
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pushal
mov eax, 1
mov eax, 2
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 6
popal
push edx
mov edx, 1
mov edx, 2
mov edx, 4
mov edx, 2
mov edx, 5
mov edx, 4
mov edx, 2
mov edx, 5
mov edx, 5
pop edx
mov dword [ebp - 4], 0
push eax
push ecx
push edx
push ebx
push esi
push edi
nop
nop
nop
push ebx
push ecx
push edx
mov eax, ioctlsocket
cpuid
shr ecx, 0x10
mov esi, ecx
nop
pop edx
pop ecx
pop ebx
nop
push ebx
push ecx
push edx
mov eax, reloc.WS2_32.dll_getpeername
cpuid
shr edx, 0x18
shr ecx, 0x18
add edx, ecx
add esi, edx
nop
pop edx
pop ecx
pop ebx
nop
nop
nop
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x64]
add esi, eax
nop
mov eax, 1
cpuid
xor ebx, ebx
mov bl, al
add esi, ebx
nop
mov eax, 1
cpuid
xor ebx, ebx
mov bl, cl
add esi, ebx
nop
mov eax, 1
cpuid
xor ebx, ebx
mov bl, dl
add esi, ebx
nop
imul esi, esi, 0x666
mov dword [ebp - 4], esi
nop
pop edi
pop esi
pop ebx
pop edx
pop ecx
pop eax
mov eax, dword [ebp - 4]
jmp 0x4171cf
mov esp, ebp
pop ebp
ret