joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4118d1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor esi, 0x89b5
sub esi, 0xa08b
pop esi
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x4117a4
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x1684], edx
jmp 0x4117fe
movzx ecx, word [ebp - 0x224]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x4116cc
movzx eax, word [ebp - 0x224]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x4116cc
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x4117e8
mov dword [ebp - 0x1680], 0xffffffff
jmp 0x4117f2
mov dword [ebp - 0x1680], 1
mov ecx, dword [ebp - 0x1680]
mov dword [ebp - 0x1684], ecx
cmp dword [ebp - 0x1684], 0
jne 0x411847
push ecx
push edx
add esp, 4
jmp 0x411814
and ecx, 0x154b4
sub ecx, 0xaa67
add ecx, 0x13c86
pop ecx
push ecx
push ecx
add esp, 4
or ecx, 0x16d1
or ecx, 0x5a83
pop ecx
mov edx, dword [ebp - 0x51c]
mov dword [ebp - 0x2fc], edx
jmp 0x4118af
push eax
push eax
add esp, 4
xor eax, 0x1c8e
and eax, 0x41c3
jmp 0x411861
pop eax
push ebx
push eax
add esp, 4
jmp 0x41186c
jmp 0x411872
add ebx, 0x11c56
pop ebx
mov eax, dword [ebp - 0x51c]
mov ecx, dword [eax]
mov dword [ebp - 0x51c], ecx
mov edx, dword [ebp - 0x51c]
cmp edx, dword [ebp - 0xce0]
je 0x4118a5
mov eax, dword [ebp - 0x51c]
cmp dword [eax + 0x30], 0
jne 0x411670
mov dword [ebp - 0x2fc], 0
push eax
push esi
add esp, 4
call 0x4118c0
add byte [edi + 0x3a], cl
cmp al, 0x38
dec ebp
add esp, 4
call 0x4118d1
add byte [edx + 0x4f], cl
cmp eax, 0x474a3c3c
dec esp
add esp, 4
and eax, 0x145ee
or eax, 0x5333
pop eax
mov ecx, dword [ebp - 0x2fc]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x338], edx
push edx
jmp 0x4118f9
add edx, 0x17664
or edx, 0x1963
add edx, 0x34a8
pop edx
push eax
push ebx
add esp, 4
call 0x41191e
add byte [edx + 0x45], al
xor dh, byte [edi]
xor al, 0x32
inc ebx
add esp, 4
pop eax
mov dword [ebp - 0x794], 0
mov eax, dword [ebp - 0x338]
mov dword [ebp - 0x1688], eax
cmp dword [ebp - 0x1688], 0
jne 0x411952
mov ecx, dword [ebp - 0x794]
mov dword [ebp - 0x520], ecx
jmp 0x411c43
add byte [eax], al
mov ecx, dword [ebp - 0x520]
mov dword [ebp - 0xab4], ecx
Function at 0x41191e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor esi, 0x89b5
sub esi, 0xa08b
pop esi
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x4117a4
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x1684], edx
jmp 0x4117fe
movzx ecx, word [ebp - 0x224]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x4116cc
movzx eax, word [ebp - 0x224]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x4116cc
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x4117e8
mov dword [ebp - 0x1680], 0xffffffff
jmp 0x4117f2
mov dword [ebp - 0x1680], 1
mov ecx, dword [ebp - 0x1680]
mov dword [ebp - 0x1684], ecx
cmp dword [ebp - 0x1684], 0
jne 0x411847
push ecx
push edx
add esp, 4
jmp 0x411814
and ecx, 0x154b4
sub ecx, 0xaa67
add ecx, 0x13c86
pop ecx
push ecx
push ecx
add esp, 4
or ecx, 0x16d1
or ecx, 0x5a83
pop ecx
mov edx, dword [ebp - 0x51c]
mov dword [ebp - 0x2fc], edx
jmp 0x4118af
push eax
push eax
add esp, 4
xor eax, 0x1c8e
and eax, 0x41c3
jmp 0x411861
pop eax
push ebx
push eax
add esp, 4
jmp 0x41186c
jmp 0x411872
add ebx, 0x11c56
pop ebx
mov eax, dword [ebp - 0x51c]
mov ecx, dword [eax]
mov dword [ebp - 0x51c], ecx
mov edx, dword [ebp - 0x51c]
cmp edx, dword [ebp - 0xce0]
je 0x4118a5
mov eax, dword [ebp - 0x51c]
cmp dword [eax + 0x30], 0
jne 0x411670
mov dword [ebp - 0x2fc], 0
push eax
push esi
add esp, 4
call 0x4118c0
add byte [edi + 0x3a], cl
cmp al, 0x38
dec ebp
add esp, 4
call 0x4118d1
add byte [edx + 0x4f], cl
cmp eax, 0x474a3c3c
dec esp
add esp, 4
and eax, 0x145ee
or eax, 0x5333
pop eax
mov ecx, dword [ebp - 0x2fc]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x338], edx
push edx
jmp 0x4118f9
add edx, 0x17664
or edx, 0x1963
add edx, 0x34a8
pop edx
push eax
push ebx
add esp, 4
call 0x41191e
add byte [edx + 0x45], al
xor dh, byte [edi]
xor al, 0x32
inc ebx
add esp, 4
pop eax
mov dword [ebp - 0x794], 0
mov eax, dword [ebp - 0x338]
mov dword [ebp - 0x1688], eax
cmp dword [ebp - 0x1688], 0
jne 0x411952
mov ecx, dword [ebp - 0x794]
mov dword [ebp - 0x520], ecx
jmp 0x411c43
add byte [eax], al
mov ecx, dword [ebp - 0x520]
mov dword [ebp - 0xab4], ecx
Function at 0x43b300
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
push esi
push 0x43b390
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
call dword [sym.imp.USER32.dll_EnumWindows]
lea edi, [esi + 0x28]
lea ecx, [esi + 0x20]
cmp ecx, edi
je 0x43b351
mov eax, dword [edi]
push eax
push dword [eax]
call fcn.0043b5d0
mov ecx, edi
call fcn.0043b570
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 8]
pop edi
mov dword [ecx + 4], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0x10]
mov dword [ecx + 0xc], eax
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x10], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [esi + 0x18]
mov dword [ecx], eax
mov eax, dword [esi + 0x1c]
mov dword [ecx + 4], eax
pop esi
pop ebp
ret 8

Function at 0x43b7c0
Capabilities:
Access peb ldr_data
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ba749
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4fb008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.ScreenDriver.0
lea esi, [edi + 4]
mov dword [ebp - 4], 0
lea eax, [esi + 8]
mov dword [esi], vtable.Thread.0
push eax
push 4
push esi
push 0x46ef80
push 0
mov byte [esi + 0xc], 0
push 0
mov byte [esi + 0xd], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
mov eax, dword [0x4ffe6c]
mov dword [edi], vtable.WinVideoRegionUpdaterImpl.0
mov dword [esi], vtable.WinVideoRegionUpdaterImpl.1.0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], vtable.Region.0
mov dword [edi + 0x24], eax
mov eax, dword [0x4ffe70]
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], 0x4ffe7c
lea eax, [edi + 0x34]
mov dword [edi + 0x30], vtable.LocalMutex.0
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [ebp + 8]
push ecx
mov byte [ebp - 4], 3
lea ecx, [edi + 0x50]
mov dword [edi + 0x4c], eax
call fcn.0041dc00
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
setne al
mov byte [esi + 0xc], al
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x43db60
Capabilities:
Access peb ldr_data
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bab3d
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4fb008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.ScreenGrabber.0
xorps xmm0, xmm0
mov dword [edi + 4], vtable.Rect.0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], vtable.FrameBuffer.0
mov dword [edi + 0x24], vtable.Dimension.0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x44], 0
movups xmmword [edi + 0x30], xmm0
mov word [edi + 0x40], 0
lea esi, [edi + 0x48]
mov dword [ebp - 4], 0
lea eax, [esi + 8]
mov dword [esi], vtable.Thread.0
push eax
push 4
push esi
push 0x46ef80
push 0
mov byte [esi + 0xc], 0
push 0
mov byte [esi + 0xd], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x400001cf
push 1
push 0
mov dword [esi + 4], eax
mov dword [esi], vtable.GuiThread.0
mov dword [esi + 0x10], 0
call dword [sym.imp.USER32.dll_OpenInputDesktop]
mov dword [esi + 0x10], eax
mov byte [ebp - 4], 1
push ecx
lea ecx, [edi + 0x6c]
mov dword [edi], vtable.WindowsScreenGrabber.1.0
mov dword [esi], vtable.WindowsScreenGrabber.0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
call fcn.0041dc00
push ecx
lea ecx, [edi + 0x74]
mov byte [ebp - 4], 2
call fcn.0041dc00
mov dword [edi + 0x7c], vtable.Dimension.0
mov dword [edi + 0x80], 0
mov dword [edi + 0x84], 0
lea ecx, [edi + 0x8c]
xorps xmm0, xmm0
mov dword [ebp - 0x14], ecx
movups xmmword [ecx], xmm0
mov word [ecx + 0x10], 0
mov dword [ecx + 0x14], vtable.Rect.0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x24], 0
mov byte [ebp - 4], 5
call fcn.00470fa0
mov byte [ebp - 4], 6
mov ecx, 0x4fc558
mov eax, dword [vtable.LocalMutex.0]
call dword [eax + 4]
mov esi, dword [0x4ffe84]
mov byte [ebp - 4], 7
mov ecx, 0x4fc558
mov eax, dword [vtable.LocalMutex.0]
call dword [eax + 8]
mov byte [ebp - 4], 6
lea eax, [esi + 0x2c]
mov dword [edi + 0x88], eax
mov ecx, edi
mov eax, dword [edi]
mov eax, dword [eax + 0x28]
call eax
test al, al
je 0x43dd2e
mov eax, dword [edi]
lea ecx, [edi + 4]
push ecx
mov ecx, edi
call dword [eax + 0xc]
push dword [edi + 0x4c]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
setne al
mov byte [edi + 0x54], al
mov eax, dword [edi + 0x70]
test eax, eax
je 0x43dd50
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x43e5a0
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
setne al
mov byte [esi + 0xc], al
pop esi
ret
Function at 0x44ba10
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x30
push ebx
push esi
push dword [ebp + 8]
mov esi, ecx
mov eax, dword [esi + 8]
lea ecx, [esi + 8]
call dword [eax + 4]
mov eax, dword [ebp + 0xc]
xor edx, edx
sub eax, edx
je 0x44ba4a
sub eax, 1
je 0x44ba43
sub eax, 1
jne 0x44ba4f
mov edx, 0xc0000000
jmp 0x44ba4f
mov edx, 0x40000000
jmp 0x44ba4f
mov edx, bind
mov eax, dword [ebp + 0x10]
xor bl, bl
cmp eax, 5
ja case.default.0x44ba59
jmp dword [eax*4 + 0x44bb08]
mov bl, 1
mov eax, 4
jmp 0x44ba89
mov eax, 2
jmp 0x44ba89
mov eax, 1
jmp 0x44ba89
mov eax, 3
jmp 0x44ba89
mov eax, 5
jmp 0x44ba89
mov eax, dword [esp + 0xc]
push 0
push 0x80
push eax
movzx eax, byte [ebp + 0x14]
push 0
push eax
push edx
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x44bad4
test bl, bl
je 0x44bacc
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, 0xffffffff
jne 0x44bacc
test eax, eax
jne 0x44baec
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea ecx, [esp + 0x10]
call fcn.0041c920
push 0x4f89dc
lea eax, [esp + 0x14]
push eax
call fcn.00499378
push eax
lea ecx, [esp + 0x14]
call fcn.0041c9e0
push 0x4f89dc
lea eax, [esp + 0x14]
push eax
call fcn.00499378
nop dword [eax]
pushal
mov edx, -1167523772
inc esp
add byte [eax - 0x46], dh
inc esp
add byte [edi - 0x46], dh
inc esp
add byte [edx - 0x46], ah
inc esp
add byte [esi - 0x46], bh
inc esp
add byte [ebp - 0x75], dl
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
push esi
mov esi, ecx
lea eax, [esp + 0x10]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp dword [esp + 0x14], ecx
jg 0x44bb4e
jl 0x44bb81
cmp dword [esp + 0x10], eax
jb 0x44bb81
push 1
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x10]
push ecx
push eax
push dword [esi + 4]
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [esp + 8], eax
cmp eax, 0xffffffff
jne 0x44bb7a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x44bba2
pop esi
mov esp, ebp
pop ebp
ret 8
lea eax, [esp + 0x18]
push str.Specified_file_pointer_position_is_more_than_file_length
push eax
call fcn.00405ab0
add esp, 8
lea eax, [esp + 0x18]
push 0x4f88b0
push eax
call fcn.00499378
push str.Cannot_set_file_pointer_to_specified_position
lea ecx, [esp + 0x1c]
call fcn.0041caa0
push 0x4f89dc
lea eax, [esp + 0x1c]
push eax
call fcn.00499378
int3
Function at 0x450540
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4fb008]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4ffd28], 0
jne 0x450578
push 0x4ffd28
mov dword [0x4ffd28], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
neg eax
sbb eax, eax
and dword [0x4ffd28], eax
cmp dword [0x4ffd2c], 6
jae 0x450591
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004976fb
mov esp, ebp
pop ebp
ret
push 0x28
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.PSAPI.DLL_GetProcessMemoryInfo]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x20]
xor ecx, ebp
call fcn.004976fb
mov esp, ebp
pop ebp
ret
Function at 0x451530
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bc1a0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x4fb008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x1c], ebx
mov eax, dword [ebx + 0x4c]
lea ecx, [ebx + 0x4c]
mov dword [ebp - 0x28], vtable.AutoLock.0
mov dword [ebp - 0x24], ecx
call dword [eax + 4]
push 0xa0
mov dword [ebp - 4], 0
call fcn.00497c14
mov edi, eax
add esp, 4
mov dword [ebp - 0x18], edi
test ebx, ebx
je 0x45159b
lea eax, [ebx + 8]
mov dword [ebp - 0x14], eax
lea eax, [ebx + 4]
mov dword [ebp - 0x10], eax
jmp 0x4515a9
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov bl, byte [ebx + 0x30]
lea eax, [edi + 8]
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
push 4
push edi
push 0x46ef80
push 0
mov dword [edi], vtable.Thread.0
mov byte [edi + 0xc], 0
push 0
mov byte [edi + 0xd], 0
call esi
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [ebp - 0x14]
mov dword [edi + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x18], eax
lea eax, [edi + 0x2c]
mov dword [edi], vtable.LogConn.0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], vtable.LocalMutex.0
mov edi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push eax
call edi
mov eax, dword [ebp - 0x18]
mov byte [eax + 0x44], bl
mov ebx, eax
lea eax, [ebx + 0x4c]
mov dword [ebx + 0x48], vtable.LocalMutex.0
push eax
call edi
lea edi, [ebx + 0x64]
lea eax, [edi + 8]
mov dword [ebp + 8], edi
push eax
push 4
push edi
push 0x46ef80
push 0
mov dword [edi], vtable.Thread.0
mov byte [edi + 0xc], 0
push 0
mov byte [edi + 0xd], 0
call esi
mov dword [edi + 4], eax
push ecx
mov byte [ebp - 4], 5
lea ecx, [edi + 0x10]
mov dword [edi], vtable.LogLevelSender.0
call fcn.0041dc00
lea eax, [edi + 0x24]
mov dword [edi + 0x18], 0
mov word [edi + 0x1c], 0
push eax
mov dword [edi + 0x20], vtable.LocalMutex.0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push dword [edi + 4]
mov esi, dword [sym.imp.KERNEL32.dll_ResumeThread]
call esi
cmp eax, 0xffffffff
setne al
mov byte [edi + 0xc], al
push dword [ebx + 4]
call esi
mov esi, dword [ebp - 0x1c]
cmp eax, 0xffffffff
mov byte [ebp - 4], 0
setne al
mov dword [ebp - 0x20], ebx
mov byte [ebx + 0xc], al
mov edi, dword [esi + 0x34]
mov ebx, dword [edi + 4]
lea eax, [ebp - 0x20]
push eax
push ebx
push edi
call fcn.0040ea60
mov edx, eax
mov ecx, 0x15555554
mov eax, dword [esi + 0x38]
sub ecx, eax
cmp ecx, 1
jb 0x4516fe
inc eax
mov dword [esi + 0x38], eax
mov dword [edi + 4], edx
mov dword [ebx], edx
lea ecx, [esi + 0x4c]
mov dword [ebp - 4], 6
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.list_T__too_long
call fcn.004986f6
int3
Function at 0x4554c0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1b0
mov eax, dword [0x4fb008]
xor eax, esp
mov dword [esp + 0x1ac], eax
cmp byte [0x4ffd1e], 0
jne 0x455510
lea eax, [esp + 0x18]
push eax
push 0x102
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x455531
mov ecx, dword [esp + 0x1ac]
xor ecx, esp
mov byte [0x4ffd1e], 1
call fcn.004976fb
mov esp, ebp
pop ebp
ret
lea eax, [esp + 4]
push str.WindowsSocket_already_initialized.
push eax
call fcn.00405ab0
add esp, 8
lea eax, [esp + 4]
push 0x4f88b0
push eax
call fcn.00499378
lea eax, [esp + 4]
push str.Failed_to_initialize_WindowsSocket.
push eax
call fcn.00405ab0
add esp, 8
lea eax, [esp + 4]
push 0x4f88b0
push eax
call fcn.00499378
int3

Function at 0x455bf0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x13c
mov eax, dword [0x4fb008]
xor eax, esp
mov dword [esp + 0x138], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_select]
push esi
push edi
mov edi, dword [sym.imp.WS2_32.dll___WSAFDIsSet]
mov esi, ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0x10
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0x30d40
nop word [eax + eax]
mov eax, dword [esi + 0x24]
lea ecx, [esp + 0x18]
push ecx
push 0
push 0
lea ecx, [esp + 0x44]
mov dword [esp + 0x48], eax
push ecx
inc eax
mov dword [esp + 0x48], 1
push eax
call ebx
cmp byte [esi + 0x28], 0
jne 0x455cc4
cmp eax, 0xffffffff
je 0x455cc4
test eax, eax
jle 0x455c40
lea eax, [esp + 0x38]
push eax
push dword [esi + 0x24]
call edi
test eax, eax
je 0x455c40
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x18]
push dword [esi + 0x24]
call dword [sym.imp.WS2_32.dll_accept]
cmp eax, 0xffffffff
je 0x455cac
mov ecx, dword [esp + 0x144]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004976fb
mov esp, ebp
pop ebp
ret 4
lea ecx, [esp + 0x20]
call fcn.00456230
push 0x4f8bd4
lea eax, [esp + 0x24]
push eax
call fcn.00499378
lea ecx, [esp + 0x20]
call fcn.00456230
push 0x4f8bd4
lea eax, [esp + 0x24]
push eax
call fcn.00499378
int3
Function at 0x46f030
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4be2d8
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push esi
mov eax, dword [0x4fb008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.GlobalMutex.0
mov dword [ebp - 0x20], vtable.StringStorage.0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 1
push eax
push 1
mov ecx, eax
call fcn.00404970
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x4cc34c
push ecx
call fcn.0049ae40
push dword [ebp + 8]
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 2
push 0x4de0a0
push str._s_s
push eax
call fcn.00404740
add esp, 0x1c
push dword [ebp - 0x1c]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
test eax, eax
je 0x46f11c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [esi + 4]
cmp eax, 0xb7
je 0x46f116
call fcn.0046f1a0
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x20], vtable.StringStorage.0
call fcn.00404840
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x48]
call fcn.0041c920
push 0x4f89dc
lea eax, [ebp - 0x48]
push eax
call fcn.00499378
int3

Function at 0x46f330
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4be34e
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4fb008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea eax, [edi + 8]
mov dword [edi], vtable.Thread.0
push eax
push 4
push edi
push 0x46ef80
push 0
mov byte [edi + 0xc], 0
push 0
mov byte [edi + 0xd], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 4], eax
mov dword [ebp - 4], 0
lea esi, [edi + 0x10]
push 0
mov dword [edi], vtable.ThreadCollector.0
push 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0040d0b0
mov dword [esi], eax
lea eax, [edi + 0x1c]
mov dword [edi + 0x18], vtable.LocalMutex.0
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push ecx
lea ecx, [edi + 0x34]
mov byte [ebp - 4], 2
call fcn.0041dc00
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
setne al
mov byte [edi + 0xc], al
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000cb21
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x1000cb30
pop dword [ebp - 0x28]
mov eax, 0x9ccee9e5
sub eax, 0x8cce1eb5
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x157e8d51
sub dword [ebp - 0x38], 0xc72c4806
mov dword [ebp - 0x34], 0x2a877ed0
sub dword [ebp - 0x34], 0xf854328b
mov dword [ebp - 0x30], 0xfb55c10d
sub dword [ebp - 0x30], 0xaf097cdf
mov dword [ebp - 0x2c], 0x343d0fab
add dword [ebp - 0x2c], 0xcbc2f055
lea eax, [ebp - 0x38]
push eax
mov eax, 0xf7565a7a
sub eax, 0xe75648b6
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x6f44ee66
sub dword [ebp - 0x38], 0xfad28510
mov dword [ebp - 0x34], 0xd30f23f7
add dword [ebp - 0x34], 0x6e5d3d7e
mov dword [ebp - 0x30], 0x43d3e7f5
sub dword [ebp - 0x30], 0xe0647b89
mov dword [ebp - 0x2c], 0x5835db96
add dword [ebp - 0x2c], 0xa7ca246a
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x41400
push 0
call eax
mov ecx, 0xc54f224a
add ecx, 0x3ab11ddf
mov ebx, eax
mov esi, 0x9fb6c24c
add esi, 0x704d89b4
add esi, dword [ebp - 0x28]
mov edi, 0x2571ca32
sub edi, 0xd471f87
mov dword [ebp - 0xc], 0x65361961
mov edx, dword [esi]
xor dword [ebp - 4], 0xdb954281
sub edx, edi
mov dword [ebx], edx
mov dword [ebp - 8], 0x3bb414e1
add ebx, 0xac7d5c78
sub ebx, 0xac7d5c74
add esi, 0x43022bbf
add esi, 0xbcfdd445
loop 0x1000cc4d
add eax, 0x6d025394
add eax, 0x92fe9fe3
xor ebx, ebx
add ebx, eax
add eax, 0xab58c502
add eax, 0x54a73b03
mov ecx, 0xa71a017c
sub ecx, 0x971a017c
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x1002f347
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100036e8]
jne 0x1002f6eb
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x10039080], eax
mov dword [0x1003907c], ecx
mov dword [0x10039078], edx
mov dword [0x10039074], ebx
mov dword [0x10039070], esi
mov dword [0x1003906c], edi
mov word [0x10039098], ss
mov word [0x1003908c], cs
mov word [0x10039068], ds
mov word [0x10039064], es
mov word [0x10039060], fs
mov word [0x1003905c], gs
pushfd
pop dword [0x10039090]
mov eax, dword [ebp]
mov dword [0x10039084], eax
mov eax, dword [ebp + 4]
mov dword [0x10039088], eax
lea eax, [ebp + 8]
mov dword [0x10039094], eax
mov eax, dword [ebp - 0x320]
mov dword [0x10038fd0], 0x10001
mov eax, dword [0x10039088]
mov dword [0x10038f84], eax
mov dword [0x10038f78], 0xc0000409
mov dword [0x10038f7c], 1
mov eax, dword [0x100036e8]
mov dword [ebp - 0x328], eax
mov eax, dword [0x10038d38]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x10038fc8], eax
push 1
call sub.msvcr100.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x100036f0
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x10038fc8], 0
jne 0x1002f7d7
push 1
call sub.msvcr100.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret