joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43ce70
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x5c5ebc]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], ecx
xor eax, eax
mov word [ebp - 0x210], ax
push str.Global_
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
call fcn.0043acd0
mov edx, dword [eax + 0x50]
push edx
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push str._is_running
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea edx, [ebp - 0x210]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ecx, dword [ebp - 0x214]
mov dword [ecx + 0x258], eax
mov edx, dword [ebp - 0x214]
cmp dword [edx + 0x258], 0
je 0x43cf28
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x43cf28
mov eax, dword [ebp - 0x214]
mov ecx, dword [eax + 0x258]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x214]
mov dword [edx + 0x258], 0
mov eax, dword [ebp - 0x214]
xor ecx, ecx
cmp dword [eax + 0x258], 0
sete cl
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00527aad
mov esp, ebp
pop ebp
ret

Function at 0x43cf50
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x43cf75
xor al, al
jmp 0x43cff7
push 0x24
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x43cf9c
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
jmp 0x43cff7
lea eax, [ebp - 0x24]
push eax
push 1
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_ControlService]
lea edx, [ebp - 0x24]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x43cfd5
cmp dword [ebp - 0x20], 3
jne 0x43cfd1
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x43cfd3
jmp 0x43cfd5
jmp 0x43cfac
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 0x20], 1
jne 0x43cff5
mov al, 1
jmp 0x43cff7
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x43fd00
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5658c7
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x5c5ebc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
call fcn.004df66c
mov eax, dword [ebp - 0x1c]
add eax, 0x88
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.0049a4d0
add esp, 8
push 0x579fe0
mov ecx, dword [ebp - 0x1c]
add ecx, 0xf8
call fcn.00415440
push 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x43fddf
mov dword [ebp - 0x14], 0
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0xc]
mov ecx, dword [ebp - 0x14]
cmp dword [eax + ecx*4], 0
je 0x43fddf
cmp dword [ebp - 0x14], 0xa
jge 0x43fddf
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0xc]
mov ecx, dword [ebp - 0x14]
mov edx, dword [eax + ecx*4]
mov eax, dword [edx]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
lea ecx, [ebp - 0x18]
push ecx
call fcn.00499f80
add esp, 8
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00415f60
push eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0xf8
call fcn.00415440
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00415e20
jmp 0x43fd70
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x441300
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x565b76
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push esi
mov eax, dword [0x5c5ebc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x34]
add ecx, 0x18c
call fcn.00415f60
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00499e90
add esp, 8
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
call fcn.00412150
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x28]
call fcn.00412130
mov ecx, dword [ebp - 0x34]
add ecx, 0x190
call fcn.00415f60
push eax
lea ecx, [ebp - 0x2c]
push ecx
call fcn.00499e90
add esp, 8
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
call fcn.00412150
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x2c]
call fcn.00412130
lea ecx, [ebp - 0x10]
call fcn.00415d60
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.00415d60
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.WS2_32.dll_ntohl]
mov esi, eax
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.WS2_32.dll_ntohl]
sub esi, eax
add esi, 1
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x14], 0x3e8
jg 0x4413e1
cmp dword [ebp - 0x14], 0
jg 0x441401
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.00415e20
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00415e20
jmp 0x4414d3
mov ecx, dword [ebp - 0x34]
cmp dword [ecx + 0x12c], 0
je 0x441457
mov dword [ebp - 0x24], 0
jmp 0x44141f
mov edx, dword [ebp - 0x24]
add edx, 1
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x14]
jge 0x441457
push 0
mov ecx, dword [ebp - 0x34]
mov edx, dword [ecx + 0x12c]
mov eax, dword [ebp - 0x24]
mov ecx, dword [edx + eax*4]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [ebp - 0x34]
mov eax, dword [edx + 0x12c]
mov ecx, dword [ebp - 0x24]
mov edx, dword [eax + ecx*4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x441416
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax + 0x12c]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x30]
push edx
call fcn.004dea57
add esp, 4
mov eax, dword [ebp - 0x34]
mov dword [eax + 0x12c], 0
push 0
mov ecx, dword [ebp - 0x34]
add ecx, 0x138
call fcn.00442510
push 1
push 0x4be
mov ecx, dword [ebp - 0x34]
call fcn.004e7012
mov ecx, eax
call fcn.004e7337
push 0
push 0x3e9
mov ecx, dword [ebp - 0x34]
call fcn.004e7012
mov ecx, eax
call fcn.004e7337
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.00415e20
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00415e20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x441940
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
call fcn.00496220
push 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
cmp dword [ebp - 0xc], 0
je 0x441980
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
and eax, 0xffffff
or eax, 0x1000000
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4419b4
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp - 0x14]
add ecx, 0x190
call fcn.0042e0f0
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x18c
call fcn.00415e40
push 0
mov ecx, dword [ebp - 0x14]
call fcn.004e27ff
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x44d010
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov byte [0x5c8530], 8
mov byte [0x5c8531], 0
xor eax, eax
mov word [0x5c8532], ax
mov cx, word [0x5c30b8]
mov word [0x5c8534], cx
mov edx, dword [0x5c30b8]
add edx, 1
mov dword [0x5c30b8], edx
mov ax, word [0x5c30b4]
mov word [0x5c8536], ax
mov ecx, dword [0x5c30b4]
add ecx, 1
mov dword [0x5c30b4], ecx
mov dword [ebp - 4], 0
jmp 0x44d079
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0x20
jge 0x44d090
mov eax, dword [ebp - 4]
add eax, 0x20
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x5c853d], al
jmp 0x44d070
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x5c8539], eax
push 0x2d
push 0x5c8530
mov ecx, dword [ebp - 8]
call fcn.0044d280
mov word [0x5c8532], ax
push 0x10
mov edx, dword [ebp + 0xc]
push edx
push 0
push 0x2d
push 0x5c8530
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_sendto]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x44d0df
push str.sendto__
mov ecx, dword [ebp - 8]
call fcn.0044d1d0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8

Function at 0x44d0f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x15c
mov eax, dword [0x5c5ebc]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x15c], ecx
mov dword [ebp - 8], 0x10
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0
push 0x141
lea edx, [ebp - 0x158]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_recvfrom]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x44d149
push str.recvfrom__
mov ecx, dword [ebp - 0x15c]
call fcn.0044d1d0
mov ecx, dword [ebp + 0x10]
mov dl, byte [ebp - 0x150]
mov byte [ecx], dl
mov eax, dword [ebp - 0x13b]
jmp 0x44d15e
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00527aad
mov esp, ebp
pop ebp
ret 0xc

Function at 0x44d170
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x110], 1
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10c], eax
mov dword [ebp - 8], 2
mov dword [ebp - 4], 0
lea ecx, [ebp - 8]
push ecx
push 0
push 0
lea edx, [ebp - 0x110]
push edx
push 1
call dword [sym.imp.WS2_32.dll_select]
jmp 0x44d1bb
mov esp, ebp
pop ebp
ret 4
Function at 0x44d1d0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x5c5ebc]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x414], ecx
mov byte [ebp - 0x410], 0
push 0x400
push 0
lea eax, [ebp - 0x40f]
push eax
call fcn.005281f0
add esp, 0xc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str._s___WSAError:__ld_r_n
lea edx, [ebp - 0x410]
push edx
call fcn.0052a9d1
add esp, 0x10
lea eax, [ebp - 0x410]
push eax
mov ecx, dword [ebp - 0x414]
add ecx, 8
push ecx
call fcn.0052a320
add esp, 8
push 0
lea edx, [ebp - 0x410]
push edx
call fcn.00529140
add esp, 4
push eax
lea eax, [ebp - 0x410]
push eax
mov ecx, dword [ebp - 0x414]
mov edx, dword [ecx]
push edx
call dword [sym.imp.WS2_32.dll_send]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00527aad
mov esp, ebp
pop ebp
ret 4
Function at 0x455490
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56713a
mov eax, dword fs:[0]
push eax
sub esp, 0x830
mov eax, dword [0x5c5ebc]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x82c], ecx
mov ecx, 0x5c901c
call fcn.0041dca0
push str._LeftTime__r_n
lea ecx, [ebp - 0x14]
call fcn.00415da0
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
jmp 0x4554f1
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
mov ecx, 0x5c8fa0
call fcn.00411ad0
cmp dword [ebp - 0x18], eax
jae 0x45558b
mov ecx, dword [ebp - 0x18]
push ecx
mov ecx, 0x5c8fa0
call fcn.00411af0
push eax
lea ecx, [ebp - 0x14]
call fcn.00424520
push 0x57d938
lea ecx, [ebp - 0x14]
call fcn.00424520
xor edx, edx
mov word [ebp - 0x81c], dx
push 0x7fe
push 0
lea eax, [ebp - 0x81a]
push eax
call fcn.005281f0
add esp, 0xc
mov ecx, dword [ebp - 0x18]
push ecx
mov ecx, 0x5c8fa0
call fcn.00411af0
mov edx, dword [eax + 0x514]
push edx
mov eax, dword [eax + 0x510]
push eax
push 0x57d93c
lea ecx, [ebp - 0x81c]
push ecx
call fcn.00527b98
add esp, 0x10
lea edx, [ebp - 0x81c]
push edx
lea ecx, [ebp - 0x14]
call fcn.00424520
jmp 0x4554e8
push 0x57d94c
push str.LeftTime.ini
push 0x5c878c
lea eax, [ebp - 0x820]
push eax
call fcn.00411930
add esp, 0xc
mov dword [ebp - 0x830], eax
mov ecx, dword [ebp - 0x830]
call fcn.00415f60
push eax
call fcn.0052a29d
add esp, 8
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x820]
call fcn.00415e20
cmp dword [ebp - 0x10], 0
je 0x45567c
mov ecx, dword [ebp - 0x10]
push ecx
push 1
lea ecx, [ebp - 0x14]
call fcn.00415f60
push eax
lea edx, [ebp - 0x824]
push edx
call fcn.00499e90
add esp, 8
mov dword [ebp - 0x834], eax
mov eax, dword [ebp - 0x834]
mov dword [ebp - 0x838], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x838]
call fcn.00412150
push eax
call fcn.00529140
add esp, 4
push eax
lea ecx, [ebp - 0x14]
call fcn.00415f60
push eax
lea ecx, [ebp - 0x828]
push ecx
call fcn.00499e90
add esp, 8
mov dword [ebp - 0x83c], eax
mov ecx, dword [ebp - 0x83c]
call fcn.00412150
push eax
call fcn.00529a6e
add esp, 0x10
lea ecx, [ebp - 0x828]
call fcn.00412130
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x824]
call fcn.00412130
mov edx, dword [ebp - 0x10]
push edx
call fcn.00529b67
add esp, 4
mov eax, dword [0x5c901c]
mov ecx, 0x5c901c
mov edx, dword [eax + 0x14]
call edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00415e20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00527aad
mov esp, ebp
pop ebp
ret
Function at 0x4584a0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x567310
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x5c5ebc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x28]
call fcn.00415da0
mov dword [ebp - 4], 0
push 0x57da60
push 1
lea ecx, [ebp - 0x38]
push ecx
lea ecx, [ebp - 0x28]
call fcn.00458720
mov dword [ebp - 0x54], eax
mov edx, dword [ebp - 0x54]
push edx
call fcn.00431030
add esp, 8
mov byte [ebp - 0x31], al
lea ecx, [ebp - 0x38]
call fcn.00415e20
movzx eax, byte [ebp - 0x31]
test eax, eax
je 0x45854a
lea ecx, [ebp - 0x28]
call fcn.00415f90
sub eax, 1
push eax
lea ecx, [ebp - 0x3c]
push ecx
lea ecx, [ebp - 0x28]
call fcn.0044b1b0
mov dword [ebp - 0x58], eax
mov edx, dword [ebp - 0x58]
mov dword [ebp - 0x5c], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x28]
call fcn.00415e40
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3c]
call fcn.00415e20
lea ecx, [ebp - 0x24]
call fcn.004f7d2d
mov byte [ebp - 4], 2
push 0
lea ecx, [ebp - 0x28]
call fcn.00415f60
push eax
lea ecx, [ebp - 0x24]
call fcn.004f7dc5
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x24]
call fcn.004f7a0e
cmp dword [ebp - 0x30], 0
je 0x4585a4
mov dword [ebp - 0x40], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.004f7d56
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00415e20
mov eax, dword [ebp - 0x40]
jmp 0x45867f
push 0x5c
lea ecx, [ebp - 0x28]
call fcn.004586b0
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xffffffff
jne 0x4585e1
mov dword [ebp - 0x44], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.004f7d56
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00415e20
mov eax, dword [ebp - 0x44]
jmp 0x45867f
mov ecx, dword [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x48]
push edx
lea ecx, [ebp - 0x28]
call fcn.0044b1b0
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x64], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x64]
push ecx
lea ecx, [ebp - 0x28]
call fcn.00415e40
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x48]
call fcn.00415e20
lea ecx, [ebp - 0x28]
call fcn.00415f60
push eax
call fcn.004584a0
add esp, 4
test eax, eax
je 0x45865a
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.004f7d56
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00415e20
mov eax, dword [ebp - 0x4c]
jmp 0x45867f
mov dword [ebp - 0x50], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.004f7d56
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00415e20
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x46d850
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
mov esp, ebp
pop ebp
ret 4
Function at 0x478bb0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2024
call fcn.00528110
mov eax, dword [0x5c5ebc]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x2024], ecx
cmp dword [0x5cc11c], 0
je 0x478c18
xor eax, eax
mov word [ebp - 0x2020], ax
push 0x2000
push 0
lea ecx, [ebp - 0x201e]
push ecx
call fcn.005281f0
add esp, 0xc
lea edx, [ebp - 0x2020]
push edx
push 0x5cb910
push 0x5cb110
push 0x582624
push 0x5ca910
call fcn.0045ef00
add esp, 0x14
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x2024]
cmp dword [eax + 0x210], 0
je 0x478cef
cmp dword [ebp - 8], 0
je 0x478c5c
mov ecx, dword [ebp - 0x2024]
cmp dword [ecx + 0x238], 0
je 0x478c8c
mov edx, dword [ebp - 0x2024]
mov dword [edx + 0x238], 0
push 0
push 0
push 1
call fcn.00477fa0
add esp, 0xc
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0xc]
cmp eax, 0x2932e00
jbe 0x478cb3
push 0
push 0
push 1
call fcn.00477fa0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0x1770
jae 0x478cd2
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x478c34
mov dword [ebp - 4], 0
mov edx, dword [0x5da640]
push edx
mov ecx, 0x5ca8a8
call fcn.0048bf20
jmp 0x478c34
mov eax, 1
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00527aad
mov esp, ebp
pop ebp
ret 4

Function at 0x47c0d0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0xefcdab89
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x10325476
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx + 0x14], 0
pop ebp
ret
Function at 0x48bf20
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov dword [ebp - 0x424], ecx
push 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 8], 0
je 0x48bfb8
mov dword [ebp - 0x40c], 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x40c]
cmp dword [ecx + edx*4], 0
je 0x48bfa7
cmp dword [ebp - 0x40c], 0xff
jge 0x48bfa7
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x40c]
mov eax, dword [ecx + edx*4]
mov ecx, dword [ebp - 0x40c]
mov edx, dword [eax]
mov dword [ebp + ecx*4 - 0x408], edx
mov eax, dword [ebp - 0x40c]
add eax, 1
mov dword [ebp - 0x40c], eax
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
jmp 0x48bf51
mov edx, dword [ebp - 0x40c]
mov dword [ebp + edx*4 - 0x408], 0
cmp dword [ebp + 8], 0
je 0x48c078
mov ecx, dword [ebp - 0x424]
call fcn.0048c1a0
mov dword [0x5f9934], eax
mov dword [ebp - 0x410], 0
mov dword [ebp - 0x414], 0
mov eax, dword [ebp - 0x410]
cmp dword [ebp + eax*4 - 0x408], 0
je 0x48c062
cmp dword [ebp - 0x410], 0xff
jge 0x48c062
mov ecx, dword [ebp - 0x410]
mov edx, dword [ebp + ecx*4 - 0x408]
cmp edx, dword [0x5da238]
jne 0x48c028
mov eax, dword [ebp - 0x410]
add eax, 1
mov dword [ebp - 0x410], eax
jmp 0x48bfe6
mov ecx, dword [ebp - 0x414]
mov edx, dword [ebp - 0x410]
mov eax, dword [ebp + edx*4 - 0x408]
mov dword [ecx*4 + 0x5da23c], eax
mov ecx, dword [ebp - 0x410]
add ecx, 1
mov dword [ebp - 0x410], ecx
mov edx, dword [ebp - 0x414]
add edx, 1
mov dword [ebp - 0x414], edx
jmp 0x48bfe6
mov eax, dword [ebp - 0x414]
mov dword [eax*4 + 0x5da23c], 0
jmp 0x48c14b
mov dword [0x5f9934], 1
mov dword [ebp - 0x418], 0
mov ecx, dword [ebp - 0x418]
cmp dword [ebp + ecx*4 - 0x408], 0
je 0x48c14b
cmp dword [ebp - 0x418], 0xff
jge 0x48c14b
mov dword [ebp - 0x41c], 0
mov dword [ebp - 0x420], 0
jmp 0x48c0d5
mov edx, dword [ebp - 0x420]
add edx, 1
mov dword [ebp - 0x420], edx
cmp dword [ebp - 0x420], 0xff
jge 0x48c11b
mov eax, dword [ebp - 0x420]
cmp dword [eax*4 + 0x5da23c], 0
je 0x48c11b
mov ecx, dword [ebp - 0x420]
mov edx, dword [ebp - 0x418]
mov eax, dword [ecx*4 + 0x5da23c]
cmp eax, dword [ebp + edx*4 - 0x408]
jne 0x48c119
mov dword [ebp - 0x41c], 1
jmp 0x48c11b
jmp 0x48c0c6
cmp dword [ebp - 0x41c], 0
jne 0x48c137
mov ecx, dword [ebp - 0x418]
mov edx, dword [ebp + ecx*4 - 0x408]
mov dword [0x5da238], edx
mov eax, dword [ebp - 0x418]
add eax, 1
mov dword [ebp - 0x418], eax
jmp 0x48c08c
cmp dword [ebp - 4], 1
jne 0x48c173
mov ecx, dword [ebp - 0x408]
mov dword [0x5da238], ecx
mov edx, dword [ebp - 0x408]
mov dword [0x5da23c], edx
mov dword [0x5da240], 0
cmp dword [ebp - 4], 0
jne 0x48c18d
mov dword [0x5da238], 0
mov dword [0x5da23c], 0
mov esp, ebp
pop ebp
ret 4