joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414460
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4cea68
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [0x504530]
push ebx
push ebp
xor ebx, ebx
push esi
mov dword [esp + 0xc], ebx
push edi
mov dword [esp + 0x20], eax
mov esi, ecx
mov word [esp + 0x18], bx
mov word [esp + 0x1a], bx
mov word [esp + 0x1c], bx
call fcn.004be803
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea edi, [eax + 0x10]
mov dword [esp + 0x14], edi
push esi
mov dword [esp + 0x30], ebx
call fcn.004ac8fd
inc eax
push eax
call fcn.004be903
mov ebx, eax
mov ax, word [esi]
add esp, 8
test ax, ax
mov ebp, ebx
je 0x41453e
nop
cmp ax, 0x25
jne 0x414520
mov ax, word [esi + 2]
test ax, ax
mov word [esp + 0x18], ax
je 0x41453e
mov ax, word [esi + 4]
test ax, ax
mov word [esp + 0x1a], ax
je 0x41453e
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push 0x4db6c0
push ecx
call fcn.004acfb3
add esp, 0xc
cmp eax, 1
jne 0x41453e
mov eax, dword [esp + 0x10]
cmp eax, 1
jl 0x41453e
mov byte [ebp], al
inc ebp
add esi, 4
jmp 0x414532
cmp ax, 0x2b
jne 0x41452c
mov byte [ebp], 0x20
jmp 0x414531
mov dl, byte [esi]
mov byte [ebp], dl
inc ebp
mov ax, word [esi + 2]
add esi, 2
test ax, ax
jne 0x4144d0
push 0
push 0
push 0xffffffffffffffff
push ebx
push 0
mov byte [ebp], 0
mov ebp, dword [0x506694]
push 0xfde9
call ebp
mov esi, eax
mov eax, dword [edi - 4]
mov ecx, 1
sub ecx, eax
mov eax, dword [edi - 8]
sub eax, esi
or eax, ecx
jge 0x41457b
push esi
lea ecx, [esp + 0x18]
call fcn.00403c80
mov edi, dword [esp + 0x14]
push esi
push edi
push 0xffffffffffffffff
push ebx
push 0
push 0xfde9
call ebp
test edi, edi
jne 0x414591
xor eax, eax
jmp 0x4145a2
push edi
call fcn.004ac8fd
add esp, 4
test eax, eax
jl 0x414660
cmp eax, dword [edi - 8]
jg 0x414660
mov dword [edi - 0xc], eax
push ebx
mov word [edi + eax*2], 0
call fcn.004be908
mov ecx, dword [edi - 0x10]
mov eax, dword [ecx]
lea ebp, [edi - 0x10]
add esp, 4
call dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
test edx, edx
lea ecx, [ebp + 0xc]
jl 0x4145e4
cmp eax, dword [ebp]
jne 0x4145e4
mov eax, ebp
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x414619
mov ecx, dword [ebp + 4]
mov edx, dword [eax]
push 2
push ecx
mov ecx, eax
call dword [edx]
test eax, eax
jne 0x4145f9
jmp fcn.00484f10
mov edx, dword [ebp + 4]
mov dword [eax + 4], edx
mov ecx, dword [ebp + 4]
inc ecx
add ecx, ecx
mov edx, ecx
shr ecx, 2
lea esi, [ebp + 0x10]
lea edi, [eax + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x34]
add eax, 0x10
mov dword [esi], eax
mov dword [esp + 0x2c], 0xffffffff
lea eax, [ebp + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x414642
mov ecx, dword [ebp]
mov edx, dword [ecx]
push ebp
call dword [edx + 4]
mov ecx, dword [esp + 0x24]
pop edi
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x14]
pop ebx
call fcn.004ae38e
add esp, 0x20
ret
push 0x80070057
call fcn.00403b70
int3
Function at 0x414670
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4cea68
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [0x504530]
push ebx
push ebp
xor ebp, ebp
push esi
mov dword [esp + 0xc], ebp
push edi
mov dword [esp + 0x20], eax
mov esi, ecx
mov word [esp + 0x18], bp
mov word [esp + 0x1a], bp
mov word [esp + 0x1c], bp
call fcn.004be803
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea edi, [eax + 0x10]
mov dword [esp + 0x14], edi
push esi
mov dword [esp + 0x30], ebp
call fcn.004ac8fd
mov ecx, dword [edi - 4]
mov edx, 1
sub edx, ecx
mov ecx, dword [edi - 8]
sub ecx, eax
add esp, 4
or ecx, edx
jge 0x4146ed
push eax
lea ecx, [esp + 0x18]
call fcn.00403c80
mov edi, dword [esp + 0x14]
mov ax, word [esi]
cmp ax, bp
mov ebx, edi
je 0x414768
cmp ax, 0x25
jne 0x414749
mov ax, word [esi + 2]
cmp ax, bp
mov word [esp + 0x18], ax
je 0x414768
mov ax, word [esi + 4]
cmp ax, bp
mov word [esp + 0x1a], ax
je 0x414768
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push 0x4db6c0
push ecx
call fcn.004acfb3
add esp, 0xc
cmp eax, 1
jne 0x414768
mov eax, dword [esp + 0x10]
cmp eax, 1
jl 0x414768
mov word [ebx], ax
add ebx, 2
add esi, 4
jmp 0x41475c
cmp ax, 0x2b
jne 0x414756
mov word [ebx], 0x20
jmp 0x414759
mov word [ebx], ax
add ebx, 2
mov ax, word [esi + 2]
add esi, 2
cmp ax, bp
jne 0x4146f7
cmp edi, ebp
mov word [ebx], bp
jne 0x414773
xor eax, eax
jmp 0x414784
push edi
call fcn.004ac8fd
add esp, 4
cmp eax, ebp
jl 0x414835
cmp eax, dword [edi - 8]
jg 0x414835
mov dword [edi - 0xc], eax
mov word [edi + eax*2], bp
mov ecx, dword [edi - 0x10]
mov edx, dword [ecx]
lea ebx, [edi - 0x10]
call dword [edx + 0x10]
mov edx, dword [ebx + 0xc]
cmp edx, ebp
lea ecx, [ebx + 0xc]
jl 0x4147ba
cmp eax, dword [ebx]
jne 0x4147ba
mov eax, ebx
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x4147ef
mov ecx, dword [ebx + 4]
mov edx, dword [eax]
push 2
push ecx
mov ecx, eax
call dword [edx]
cmp eax, ebp
jne 0x4147cf
jmp fcn.00484f10
mov edx, dword [ebx + 4]
mov dword [eax + 4], edx
mov ecx, dword [ebx + 4]
inc ecx
add ecx, ecx
mov edx, ecx
shr ecx, 2
lea esi, [ebx + 0x10]
lea edi, [eax + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x34]
add eax, 0x10
mov dword [esi], eax
mov dword [esp + 0x2c], 0xffffffff
lea eax, [ebx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x414817
mov ecx, dword [ebx]
mov edx, dword [ecx]
push ebx
call dword [edx + 4]
mov ecx, dword [esp + 0x24]
pop edi
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x14]
pop ebx
call fcn.004ae38e
add esp, 0x20
ret
push 0x80070057
call fcn.00403b70
int3
Function at 0x416cd0
Capabilities:
Check for time delay via gettickcount
Send data
Send data on socket

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebp, eax
mov eax, dword [0x534510]
xor esi, esi
or ebx, 0xffffffff
cmp eax, 0x64
mov dword [esp + 0x14], ebp
mov dword [esp + 0xc], esi
ja 0x416d55
lea eax, [edi + 0x23c]
lea ecx, [edi + 0x29c]
lea edx, [ebp - 0x3e8]
sub ecx, eax
mov ebx, 0x18
mov edi, edi
cmp dword [ecx + eax], edx
jb 0x416d17
add esi, dword [eax]
add eax, 4
dec ebx
jne 0x416d10
mov ebx, dword [0x534120]
mov eax, dword [0x534174]
shl ebx, 7
test eax, eax
je 0x416d31
mov ebx, eax
mov ecx, dword [0x534510]
cmp ecx, 0x64
jae 0x416d4b
imul ecx, ebx
mov eax, 0x51eb851f
mul ecx
shr edx, 5
mov ebx, edx
cmp esi, ebx
jb 0x416d53
xor ebx, ebx
jmp 0x416d55
sub ebx, esi
test ebx, ebx
mov dword [esp + 0x10], 0
jbe 0x416e0e
jmp 0x416d70
mov esi, dword [edi + 0xc4]
test esi, esi
je 0x416e0e
mov edi, edi
mov eax, dword [esp + 0x10]
cmp eax, dword [esi + 0x18]
je 0x416dac
mov edx, dword [edi + 0x228]
xor ecx, ecx
cmp ecx, edx
sbb edx, edx
neg edx
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x24]
push ecx
push ebp
call fcn.00415ef0
test eax, eax
jne 0x416db5
mov esi, dword [esi + 0x10]
test esi, esi
jne 0x416d80
jmp 0x416e0e
mov ebp, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ecx, dword [edi + 4]
push 0x10
lea edx, [esi + 0x14]
push edx
push 0
push ebp
push eax
push ecx
call dword [sym.imp.WS2_32.dll_sendto]
cmp ebx, ebp
mov edx, dword [esi + 0x18]
mov dword [esp + 0x10], edx
jb 0x416de0
sub ebx, ebp
jmp 0x416de2
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [esp + 0xc]
mov ecx, dword [edi + 0x30c]
add edx, ebp
mov ebp, dword [esp + 0x14]
inc ecx
test ebx, ebx
mov dword [edi + 0x10], eax
mov dword [esp + 0xc], edx
mov dword [edi + 0x30c], ecx
ja 0x416d70
lea eax, [edi + 0x23c]
test eax, eax
je 0x416e77
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x416e77
mov esi, dword [edi + 0x304]
mov eax, dword [edi + 0x2fc]
mov edx, ebp
sub edx, esi
cmp edx, 0x64
jae 0x416e49
mov edx, dword [edi + eax*4 + 0x23c]
lea eax, [edi + eax*4 + 0x23c]
add edx, ecx
mov dword [eax], edx
jmp 0x416e77
inc eax
xor edx, edx
mov ecx, 0x18
div ecx
mov eax, dword [esp + 0xc]
mov dword [edi + 0x2fc], edx
mov dword [edi + edx*4 + 0x29c], ebp
mov edx, dword [edi + 0x2fc]
mov dword [edi + edx*4 + 0x23c], eax
mov dword [edi + 0x304], ebp
mov edx, dword [edi + 0x230]
mov eax, dword [esp + 0xc]
add edx, eax
mov dword [edi + 0x230], edx
mov ecx, dword [0x5062d0]
add ecx, eax
mov eax, dword [0x5062d4]
pop esi
adc eax, 0
pop ebp
mov dword [0x5062d4], eax
mov dword [0x5062d0], ecx
mov eax, 1
pop ebx
add esp, 0x14
ret
Function at 0x416f80
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x18
mov eax, dword [0x504530]
mov edx, dword [edi + 4]
push esi
mov dword [esp + 0x18], eax
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0xc]
push ecx
push 0
push 0x1000
push 0x574858
push edx
mov dword [esp + 0x1c], 0x10
call dword [sym.imp.WS2_32.dll_recvfrom]
mov esi, eax
cmp esi, 1
jge 0x416fcc
xor eax, eax
pop esi
mov ecx, dword [esp + 0x14]
call fcn.004ae38e
add esp, 0x18
ret
lea eax, [edi + 0x158]
test eax, eax
push ebx
je 0x417036
test esi, esi
jle 0x417036
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [edi + 0x220]
mov ecx, eax
mov eax, dword [edi + 0x218]
mov edx, ecx
sub edx, ebx
cmp edx, 0x64
jae 0x41700c
mov ecx, dword [edi + eax*4 + 0x158]
lea eax, [edi + eax*4 + 0x158]
add ecx, esi
mov dword [eax], ecx
jmp 0x417036
xor edx, edx
inc eax
mov ebx, 0x18
div ebx
mov dword [edi + 0x218], edx
mov dword [edi + edx*4 + 0x1b8], ecx
mov edx, dword [edi + 0x218]
mov dword [edi + edx*4 + 0x158], esi
mov dword [edi + 0x220], ecx
add dword [edi + 0x14c], esi
mov ecx, dword [0x5062d8]
mov eax, esi
cdq
add ecx, eax
adc dword [0x5062dc], edx
push 0
lea eax, [esp + 0x14]
push eax
mov ebx, 0x533f44
mov dword [0x5062d8], ecx
call fcn.00472370
test eax, eax
pop ebx
jne 0x41707c
lea ecx, [esp + 8]
push ecx
mov eax, esi
mov esi, 0x574858
mov ecx, edi
call fcn.00417090
mov ecx, dword [esp + 0x18]
mov eax, 1
pop esi
call fcn.004ae38e
add esp, 0x18
ret
Function at 0x41a5a0
Capabilities:
Create http request

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4ce618
push eax
mov dword fs:[0], esp
push ebx
push ebp
push esi
push 0
mov esi, ecx
mov ebx, edx
call fcn.004ad6ed
add esp, 4
mov ebp, eax
call fcn.0041a7c0
test esi, esi
je 0x41a5eb
push 0
call fcn.004ad6ed
mov edx, dword [esi + 0x18]
mov ecx, dword [esi + 0x30]
sub eax, edx
add esp, 4
cmp eax, ecx
jb 0x41a78f
mov eax, edi
dec eax
je 0x41a60e
dec eax
je 0x41a607
dec eax
je 0x41a600
push str.ERROR:_CDiscoveryServices::RequestWebCache___was_passed_an_invalid_protocol
jmp 0x41a77d
push str.CDiscoveryServices::RequestWebCache___seeking_ed2k_hosts
jmp 0x41a613
push str.CDiscoveryServices::RequestWebCache___seeking_G2_hosts
jmp 0x41a613
push str.CDiscoveryServices::RequestWebCache___seeking_gnutella_hosts
mov eax, 3
push 0x534540
call fcn.00478d50
mov eax, dword [esp + 0x24]
add esp, 8
cmp eax, 4
mov dword [ebx + 0x2c], esi
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x28], 0
ja case.default.0x41a63f
jmp dword [eax*4 + 0x41a7a8]
test esi, esi
je 0x41a6fe
mov esi, dword [esi + 8]
push esi
push 0x41e1
jmp 0x41a6b2
push 0
push esi
push 1
push edi
push ebx
call fcn.0041a420
mov dword [ebx + 0x34], eax
mov eax, dword [ebx + 0x2c]
test eax, eax
je 0x41a6fe
mov eax, dword [eax + 8]
push eax
push 0x41e6
push 0x534540
mov eax, 1
call fcn.00478c60
mov dword [ebx + 0x40], ebp
mov dword [ebx + 0x44], edi
jmp 0x41a6fb
push 1
push esi
push 0
push edi
push ebx
mov dword [ebx + 0x34], esi
call fcn.0041a420
test eax, eax
mov dword [ebx + 0x2c], eax
je 0x41a6fe
mov eax, dword [eax + 8]
push eax
push 0x41e7
push 0x534540
mov eax, 1
call fcn.00478c60
mov dword [ebx + 0x3c], edi
jmp 0x41a6f8
cmp edi, 3
je 0x41a6d5
push str.ERROR:_CDiscoveryServices::RequestWebCache___was_passed_wcmServerMet_with_non_ed2k_protocol
jmp 0x41a77d
test esi, esi
je 0x41a6fe
mov esi, dword [esi + 8]
push esi
push 0x41e1
push 0x534540
mov eax, 1
call fcn.00478c60
mov dword [ebx + 0x3c], 3
mov dword [ebx + 0x38], ebp
add esp, 0xc
mov eax, dword [ebx + 0x2c]
test eax, eax
je 0x41a78f
lea esi, [esp + 0x1c]
call fcn.00475690
push 0
push 0
push 0
mov dword [esp + 0x20], 0
mov eax, dword [esp + 0x28]
push 0
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
test eax, eax
mov dword [ebx + 0x24], eax
jne 0x41a73d
mov ecx, esi
call fcn.00403b90
jmp 0x41a78f
push 0
push 0
push 0
push 0
push ebx
push 0x41a850
call fcn.004bf71e
mov ecx, dword [eax + 0x28]
mov dword [ebx + 0x20], ecx
lea ecx, [esp + 0x1c]
call fcn.00403b90
mov eax, 1
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
push str.ERROR:_CDiscoveryServices::RequestWebCache___was_passed_an_invalid_mode
mov eax, 2
push 0x534540
call fcn.00478d50
add esp, 8
mov ecx, dword [esp + 0xc]
pop esi
pop ebp
xor eax, eax
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 4
Function at 0x41a7c0
Capabilities:
Terminate thread

Disassembly:
push ecx
mov eax, dword [ebx + 0x24]
test eax, eax
je 0x41a7cf
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, dword [ebx + 0x20]
test eax, eax
mov dword [ebx + 0x24], 0
je 0x41a847
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, 0xa
mov ecx, dword [ebx + 0x20]
lea eax, [esp + 0xc]
push eax
push ecx
call ebp
test eax, eax
je 0x41a813
cmp dword [esp + 0xc], 0x103
jne 0x41a813
push 0x64
call edi
dec esi
test esi, esi
jg 0x41a7f1
test esi, esi
jne 0x41a83d
mov edx, dword [ebx + 0x20]
push esi
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push str.WARNING:_Terminating_CDiscoveryServices_thread.
push 0x534540
mov eax, 3
call fcn.00478d50
add esp, 8
push 0x64
call edi
pop edi
pop esi
mov dword [ebx + 0x20], 0
pop ebp
pop ecx
ret
Function at 0x41e120
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4cf038
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x1c]
mov eax, dword [esi]
mov ecx, dword [eax - 0x10]
mov edx, dword [ecx]
push edi
xor edi, edi
mov dword [esp + 8], edi
call dword [edx + 0x10]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], edi
mov eax, dword [eax]
mov edx, dword [eax - 0xc]
mov ecx, dword [esi]
mov esi, dword [ecx - 0xc]
push edx
push eax
push esi
push ecx
lea ecx, [esp + 0x30]
push ecx
call fcn.004127e0
mov esi, dword [esp + 0x34]
add esi, 0xfffffff0
push esi
call fcn.00403fa0
mov edi, dword [esp + 0x34]
add eax, 0x10
mov dword [edi], eax
add esp, 0x18
mov dword [esp + 0x14], 0xffffffff
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x41e1b2
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov ecx, dword [esp + 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x423e40
Capabilities:
Check for time delay via gettickcount
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x28]
push ebp
push 0
push 0x80
push 1
push 0
push 0
push 0x40000000
push eax
call dword [0x506600]
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0xc], ebp
je 0x423fc9
push ebx
push esi
push edi
push 0x200000
call fcn.004be903
mov ebx, dword [esp + 0x40]
mov esi, dword [esp + 0x44]
mov ecx, ebx
add esp, 4
or ecx, esi
mov edi, eax
je 0x423f93
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x24], 0x200000
mov dword [esp + 0x28], 0
jmp 0x423eb0
mov esi, dword [esp + 0x40]
test esi, esi
jb 0x423ec4
ja 0x423ebe
cmp ebx, 0x200000
jbe 0x423ec4
lea eax, [esp + 0x24]
jmp 0x423ec8
lea eax, [esp + 0x3c]
mov edx, dword [eax]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], 0
call ebp
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x34]
push 0
mov esi, eax
lea eax, [esp + 0x14]
push eax
push ecx
push edi
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x423f8b
mov eax, dword [esp + 0x10]
test eax, eax
je 0x423f8b
mov edx, dword [esp + 0x18]
push 0
lea ecx, [esp + 0x18]
push ecx
push eax
push edi
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x423f8b
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x14], eax
jne 0x423f8b
mov edx, dword [esp + 0x40]
sub ebx, eax
mov eax, dword [esp + 0x30]
mov ecx, dword [eax + 0x198]
sbb edx, 0
test ecx, ecx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], edx
jne 0x423f8b
call ebp
sub eax, esi
shr eax, 1
mov dword [esp + 0x20], eax
cmp eax, 0x32
mov dword [esp + 0x1c], 0x32
lea eax, [esp + 0x1c]
ja 0x423f66
lea eax, [esp + 0x20]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [esp + 0x30]
mov eax, dword [edx + 0x198]
test eax, eax
jne 0x423f8b
mov ecx, dword [esp + 0x40]
mov eax, ebx
or eax, ecx
jne 0x423eac
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x40]
push edi
call fcn.004be908
add esp, 4
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
ja 0x423fab
test ebx, ebx
jbe 0x423fb6
mov ecx, dword [esp + 0x38]
push ecx
call dword [0x50660c]
pop edi
or ebx, esi
pop esi
pop ebx
jne 0x423fc9
mov eax, 1
pop ebp
add esp, 0x1c
ret 0x14
xor eax, eax
pop ebp
add esp, 0x1c
ret 0x14
Function at 0x425000
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4cf065
push eax
mov dword fs:[0], esp
push ebp
mov ebp, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x18]
push edi
push 6
mov edi, ecx
call fcn.004244f0
xor edi, edi
mov dword [esp + 0x14], edi
mov dword [esi], 0x4dcc50
call fcn.00426670
mov dword [esi + 0x524], eax
mov dword [esi + 0x528], edi
xor eax, eax
cmp ebp, edi
setne al
mov byte [esp + 0x14], 1
push str.BitTorrent
mov dword [esi + 0x510], ebp
mov dword [esi + 0x4d8], eax
call fcn.004ac8fd
add esp, 4
push eax
push str.BitTorrent
lea ecx, [esi + 0x30]
call fcn.00403ee0
mov dword [esi + 0x514], 1
mov dword [esi + 0x518], edi
mov dword [esi + 0x51c], edi
mov dword [esi + 0x52c], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x530], eax
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0xc
ret 8
Function at 0x432430
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4cc88b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [edi + 0x3a8]
push ebx
xor ebx, ebx
cmp eax, ebx
push esi
jne 0x432484
push 0x68
call fcn.004be8d8
add esp, 4
mov dword [esp + 8], eax
cmp eax, ebx
mov dword [esp + 0x14], ebx
je 0x432474
push ebx
push ebx
push eax
call fcn.0045f8e0
jmp 0x432476
xor eax, eax
mov dword [esp + 0x14], 0xffffffff
mov dword [edi + 0x3a8], eax
mov eax, dword [edi + 0x3a8]
mov esi, dword [eax + 4]
cmp dword [esi + 0xc4], ebx
je 0x4324a7
lea ecx, [edi + 0xc]
push ecx
lea ecx, [esi + 0x18]
call fcn.00403e70
push esi
call fcn.0046fa80
cmp dword [edi + 0x20], ebx
push ebp
mov edx, 1
je 0x4324d7
mov dword [esi + 0x38], edx
lea eax, [edi + 0x24]
mov ebp, dword [eax]
lea ecx, [esi + 0x3c]
mov dword [ecx], ebp
mov ebp, dword [eax + 4]
mov dword [ecx + 4], ebp
mov ebp, dword [eax + 8]
mov dword [ecx + 8], ebp
mov ebp, dword [eax + 0xc]
mov dword [ecx + 0xc], ebp
mov eax, dword [eax + 0x10]
mov dword [ecx + 0x10], eax
cmp dword [edi + 0x3c], ebx
je 0x432507
mov dword [esi + 0x50], edx
lea ecx, [edi + 0x40]
mov ebp, dword [ecx]
lea eax, [esi + 0x58]
mov dword [eax], ebp
mov ebp, dword [ecx + 4]
mov dword [eax + 4], ebp
mov ebp, dword [ecx + 8]
mov dword [eax + 8], ebp
mov ebp, dword [ecx + 0xc]
mov dword [eax + 0xc], ebp
mov ebp, dword [ecx + 0x10]
mov dword [eax + 0x10], ebp
mov ecx, dword [ecx + 0x14]
mov dword [eax + 0x14], ecx
cmp dword [edi + 0x74], ebx
je 0x432536
mov dword [esi + 0x70], edx
lea eax, [edi + 0x78]
mov ebp, dword [eax]
lea ecx, [esi + 0x74]
mov dword [ecx], ebp
mov ebp, dword [eax + 4]
mov dword [ecx + 4], ebp
mov ebp, dword [eax + 8]
mov dword [ecx + 8], ebp
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
mov ecx, dword [edi + 0x3a8]
mov dword [ecx + 0x14], edx
jmp 0x43253f
mov eax, dword [edi + 0x3a8]
mov dword [eax + 0x14], ebx
cmp dword [edi + 0x8c], ebx
je 0x432575
mov dword [esi + 0x84], edx
lea ecx, [edi + 0x90]
mov ebp, dword [ecx]
lea eax, [esi + 0x88]
mov dword [eax], ebp
mov ebp, dword [ecx + 4]
mov dword [eax + 4], ebp
mov ebp, dword [ecx + 8]
mov dword [eax + 8], ebp
mov ebp, dword [ecx + 0xc]
mov dword [eax + 0xc], ebp
mov ecx, dword [ecx + 0x10]
mov dword [eax + 0x10], ecx
mov dword [esi + 0xb0], edx
mov eax, dword [edi + 0xc]
mov ebp, dword [eax - 0xc]
xor ecx, ecx
cmp ebp, ebx
sete cl
mov dword [esi + 0xb8], ebx
mov dword [esi + 0xc0], edx
mov dword [esi + 0xbc], ebx
mov dword [esi + 0xb4], ecx
mov eax, dword [edi + 0x18]
mov ecx, dword [edi + 0x1c]
mov ebp, eax
and ebp, ecx
cmp ebp, 0xffffffff
pop ebp
jne 0x4325d6
or eax, 0xffffffff
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], eax
mov dword [esi + 0xb4], edx
mov dword [esi + 0x34], eax
pop esi
pop ebx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
mov dword [esi + 0x2c], ecx
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x28], eax
mov edx, dword [edi + 0x18]
mov dword [esi + 0x30], edx
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x34], eax
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x435480
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esi + 0xf0]
sub esp, 0xc
test eax, eax
push ebp
push edi
je 0x43549b
mov ecx, dword [eax + 0x28]
or ecx, dword [eax + 0x2c]
je 0x43549b
xor edi, edi
jmp 0x4354a0
mov edi, 1
or ebp, 0xffffffff
test eax, eax
jne 0x4354ce
mov eax, dword [esi + 0x10]
push 0
push 0x80
push 3
push 0
push 3
push closesocket
push eax
call dword [0x506600]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x43567c
xor eax, eax
test edi, edi
setne al
lea eax, [eax*8 + 2]
test eax, eax
mov dword [esp + 0xc], eax
jle 0x43565c
push ebx
lea esp, [esp]
mov eax, dword [esi + 0x39c]
test eax, eax
ja 0x435508
mov eax, dword [esi + 0x398]
test eax, eax
jbe 0x43565b
mov eax, dword [esi + 0x398]
mov ecx, dword [0x5746e4]
mov dword [esp + 0xc], eax
cmp ecx, eax
mov eax, 0x5746e4
jb 0x435525
lea eax, [esp + 0xc]
mov ebx, dword [esi + 0xf0]
test ebx, ebx
mov eax, dword [eax]
mov edi, dword [0x5746e8]
mov edx, dword [esi + 0x394]
mov dword [esp + 0xc], eax
je 0x435554
push 0
push eax
mov eax, dword [esi + 0x390]
push edi
push edx
push eax
call fcn.004415b0
jmp 0x43558e
mov eax, dword [esi + 0x390]
mov cl, 0x20
call fcn.004bc980
mov edx, dword [esi + 0x390]
push 0
lea ecx, [esp + 0x18]
push ecx
push edx
push ebp
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [esp + 0xc]
push 0
lea eax, [esp + 0x10]
push eax
push ecx
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esi + 0x384]
cmp eax, 3
jne 0x4355ae
mov edx, dword [esp + 0xc]
push edx
lea eax, [esi + 0x2b8]
push eax
mov eax, edi
call fcn.0049b880
jmp 0x43560c
cmp eax, 4
jne 0x4355de
mov eax, dword [esp + 0xc]
test eax, eax
mov ebx, eax
je 0x435610
push eax
lea ecx, [esi + 0x310]
push edi
push ecx
call fcn.0049ca7b
mov eax, dword [esi + 0x370]
add esp, 0xc
add eax, ebx
mov dword [esi + 0x370], eax
jmp 0x43560c
cmp eax, 5
jne 0x43560c
mov eax, dword [esp + 0xc]
test eax, eax
mov ebx, eax
je 0x435610
push eax
lea edx, [esi + 0x1b8]
push edi
push edx
call fcn.0049e3d0
mov eax, dword [esi + 0x214]
add esp, 0xc
add eax, ebx
mov dword [esi + 0x214], eax
mov eax, dword [esp + 0xc]
mov edi, dword [esi + 0x390]
mov edx, dword [esi + 0x394]
mov ebx, dword [esi + 0x398]
xor ecx, ecx
add edi, eax
adc edx, ecx
sub ebx, eax
mov eax, dword [esp + 0x10]
mov dword [esi + 0x390], edi
mov edi, dword [esi + 0x39c]
sbb edi, ecx
dec eax
test eax, eax
mov dword [esi + 0x394], edx
mov dword [esi + 0x398], ebx
mov dword [esi + 0x39c], edi
mov dword [esp + 0x10], eax
jg 0x4354f0
pop ebx
cmp ebp, 0xffffffff
je 0x435668
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x398]
or eax, dword [esi + 0x39c]
jne 0x43567c
push esi
call fcn.00435690
pop edi
pop ebp
add esp, 0xc
ret