joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406170
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push 0x1c
mov esi, eax
call dword [sym.imp.MSVCR90.dll_malloc]
xor edx, edx
add esp, 4
cmp eax, edx
jne 0x4061c2
push str.Not_enough_memory
push str._nError:__s__n
call fcn.00406b70
push 0x7d0
push str.Code__d
push 2
lea eax, [esp + 0x18]
push str.signal_termination_handler
push eax
mov dword [esp + 0x20], str.Signal_termination_handler_called
call fcn.00406a30
add esp, 0x1c
push 3
call dword [sym.imp.MSVCR90.dll_exit]
mov ecx, dword [esp + 0x10]
mov dword [eax + 4], ecx
mov dword [eax], edi
fld dword [edi + esi*4]
lea ecx, [esi + esi*2]
fstp dword [eax + 8]
mov esi, dword [esp + 0xc]
fld dword [esi + ecx*8 + 0x24]
lea ecx, [esi + ecx*8]
fstp dword [eax + 0xc]
pop esi
fld dword [ecx + 0x28]
mov dword [eax + 0x14], edx
fstp dword [eax + 0x10]
mov dword [eax + 0x18], edx
pop ecx
ret

Function at 0x4072a0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x108
mov eax, dword [0x478018]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
lea eax, [esp + 8]
push str.Unable_to_open__s
push eax
call dword [sym.imp.MSVCR90.dll_sprintf]
lea ecx, [esp + 0x10]
push ecx
push str._nError:__s__n
call fcn.00406b70
push 0xbb8
push str.Code__d
push 2
lea edx, [esp + 0x20]
push str.signal_termination_handler
push edx
mov dword [esp + 0x28], str.Signal_termination_handler_called
call fcn.00406a30
add esp, 0x28
push 3
call dword [sym.imp.MSVCR90.dll_exit]
int3

Function at 0x407310
Capabilities:
Terminate process

Disassembly:
push ecx
test eax, eax
ja 0x407352
push str.Illegal_malloc_request_size
push str._nError:__s__n
call fcn.00406b70
push 0x7d1
push str.Code__d
push 2
lea eax, [esp + 0x14]
push str.signal_termination_handler
push eax
mov dword [esp + 0x1c], str.Signal_termination_handler_called
call fcn.00406a30
add esp, 0x1c
push 3
call dword [sym.imp.MSVCR90.dll_exit]
push eax
call dword [sym.imp.MSVCR90.dll_malloc]
add esp, 4
test eax, eax
jne 0x40739d
push str.Not_enough_memory
push str._nError:__s__n
call fcn.00406b70
push 0x7d0
push str.Code__d
push 2
lea ecx, [esp + 0x14]
push str.signal_termination_handler
push ecx
mov dword [esp + 0x1c], str.Signal_termination_handler_called
call fcn.00406a30
add esp, 0x1c
push 3
call dword [sym.imp.MSVCR90.dll_exit]
pop ecx
ret
Function at 0x407500
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
mov esi, dword [edx + 4]
cmp esi, dword [edx]
jle 0x407546
push str.Heap_size_exceeded
push str._nError:__s__n
call fcn.00406b70
push 0xbb8
push str.Code__d
push 2
lea eax, [esp + 0x18]
push str.signal_termination_handler
push eax
mov dword [esp + 0x20], str.Signal_termination_handler_called
call fcn.00406a30
add esp, 0x1c
push 3
call dword [sym.imp.MSVCR90.dll_exit]
lea ecx, [esi + 1]
mov dword [edx + 4], ecx
cmp esi, 1
je 0x40757b
mov ecx, esi
sar ecx, 1
fld dword [edx + ecx*8 + 8]
fld dword [edi]
fcompp
fnstsw ax
test ah, 5
jp 0x40757b
fld dword [edx + ecx*8 + 8]
fstp dword [edx + esi*8 + 8]
mov eax, dword [edx + ecx*8 + 0xc]
mov dword [edx + esi*8 + 0xc], eax
mov esi, ecx
cmp ecx, 1
jne 0x407551
fld dword [edi]
mov ecx, dword [edi + 4]
fstp dword [edx + esi*8 + 8]
mov dword [edx + esi*8 + 0xc], ecx
pop esi
pop ecx
ret

Function at 0x4076a7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x478018]
jne 0x4076b1
repz ret
jmp fcn.00407bae
Function at 0x412cb8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x24
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov eax, dword [edx + 0x78]
mov ebx, dword [edx + 0x8c]
cmp eax, ebx
mov eax, dword [edx + 0x34]
mov ebx, dword [edx + 0x7c]
jl 0x412cdd
shr ebx, 2
dec ebx
shl ebx, 0x10
or ebx, eax
mov dword [esp], ebx
mov eax, dword [edx + 0x90]
mov ebx, dword [edx + 0x74]
cmp ebx, eax
jl 0x412cf5
mov ebx, eax
mov dword [esp + 0x18], ebx
mov esi, dword [edx + 0x38]
mov dword [esp + 4], esi
mov ebp, dword [edx + 0x6c]
lea edi, [ebp + esi]
mov dword [esp + 0x20], edi
mov eax, edi
neg eax
and eax, 3
mov dword [esp + 0x14], eax
mov eax, dword [edx + 0x2c]
sub eax, 0x106
sub ebp, eax
jg 0x412d24
xor ebp, ebp
mov eax, dword [edx + 0x78]
mov dword [esp + 0x1c], eax
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [edi]
mov dword [esp + 0x10], ebx
movzx ebx, word [eax + edi - 1]
mov dword [esp + 0xc], ebx
mov edi, dword [edx + 0x40]
mov edx, dword [esp]
jmp 0x412d66
and ecx, edx
movzx ecx, word [edi + ecx*2]
cmp ecx, ebp
jbe 0x412e3a
sub edx, 0x10000
js 0x412e3a
movzx eax, word [ecx + esi - 1]
cmp eax, ebx
jne 0x412d4c
mov eax, dword [esp + 4]
movzx eax, word [ecx + eax]
cmp eax, dword [esp + 0x10]
jne 0x412d4c
mov dword [esp], edx
mov esi, dword [esp + 4]
mov edi, dword [esp + 0x20]
add esi, ecx
mov eax, dword [esp + 0x14]
mov edx, 0xfffffef8
lea edi, [eax + edi + 0x108]
lea esi, [eax + esi + 0x108]
mov eax, dword [edx + esi]
xor eax, dword [edx + edi]
jne 0x412dbd
mov eax, dword [edx + esi + 4]
xor eax, dword [edx + edi + 4]
jne 0x412dba
add edx, 8
jne 0x412da1
jmp 0x412e2b
add edx, 4
test eax, 0xffff
jne 0x412dca
add edx, 2
shr eax, 0x10
sub al, 1
adc edx, 0
lea eax, [edx + edi]
mov edi, dword [esp + 0x20]
sub eax, edi
cmp eax, 0x102
jge 0x412e2b
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
cmp eax, ebx
jg 0x412dfe
mov esi, dword [esp + 8]
mov edi, dword [edx + 0x40]
mov ebx, dword [esp + 0xc]
mov edx, dword [esp]
jmp 0x412d4c
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov dword [edx + 0x70], ecx
cmp eax, ebx
jge 0x412e3a
mov esi, dword [esp + 4]
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [eax + edi - 1]
mov edi, dword [edx + 0x40]
mov dword [esp + 0xc], ebx
mov edx, dword [esp]
jmp 0x412d4c
mov edx, dword [esp + 0x38]
mov dword [esp + 0x1c], 0x102
mov dword [edx + 0x70], ecx
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
mov eax, dword [edx + 0x74]
cmp ebx, eax
jg 0x412e4b
mov eax, ebx
add esp, 0x24
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x414440
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x41446f
push esi
call fcn.00414ba0
add esp, 4
cmp byte [esi + 0x40], 0
je 0x414468
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x4144e9
mov eax, dword [esi + 0x1a0]
cmp byte [eax + 0x10], 0
je 0x4144d9
mov eax, dword [esi + 8]
test eax, eax
je 0x414494
mov ecx, dword [eax]
push esi
call ecx
add esp, 4
mov edx, dword [esi + 0x1a0]
mov eax, dword [edx]
push esi
call eax
add esp, 4
test eax, eax
je 0x4144d5
cmp eax, 2
je 0x4144d9
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x414485
cmp eax, 3
je 0x4144bc
cmp eax, 1
jne 0x414485
inc dword [ecx + 4]
mov eax, dword [esi + 8]
mov ecx, dword [eax + 4]
cmp ecx, dword [eax + 8]
jl 0x414485
mov edx, dword [esi + 0x120]
add dword [eax + 8], edx
jmp 0x414485
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
mov dword [esi + 0x84], eax
call fcn.00414210
pop esi
ret
cmp eax, 0xcc
je 0x41450b
mov ecx, dword [esi]
mov dword [ecx + 0x14], 0x15
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call edx
add esp, 4
call fcn.00414210
pop esi
ret

Function at 0x419240
Capabilities:
Query environment variable

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
xor ebx, ebx
push edi
mov dword [edi + 4], ebx
call fcn.00419dc0
push 0x54
push edi
mov dword [esp + 0x18], eax
call fcn.00422430
mov esi, eax
add esp, 0xc
cmp esi, ebx
jne 0x419286
push edi
call fcn.004471a0
mov eax, dword [edi]
mov dword [eax + 0x14], 0x38
mov ecx, dword [edi]
mov dword [ecx + 0x18], ebx
mov edx, dword [edi]
mov eax, dword [edx]
push edi
call eax
add esp, 8
mov dword [esi], fcn.00418730
mov dword [esi + 4], fcn.00418880
mov dword [esi + 8], fcn.00418940
mov dword [esi + 0xc], fcn.004189f0
mov dword [esi + 0x10], 0x418aa0
mov dword [esi + 0x14], 0x418b10
mov dword [esi + 0x18], 0x418b80
mov dword [esi + 0x1c], 0x418e60
mov dword [esi + 0x20], 0x418fa0
mov dword [esi + 0x24], fcn.004190f0
mov dword [esi + 0x28], 0x419200
mov dword [esi + 0x30], 0x3b9aca00
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], 0x54
push str.JPEGMEM
mov dword [edi + 4], esi
call dword [sym.imp.MSVCR90.dll_getenv]
add esp, 4
cmp eax, ebx
je 0x419361
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x10]
push ecx
push str._ld_c
push eax
mov byte [esp + 0x24], 0x78
call dword [sym.imp.MSVCR90.dll_sscanf]
add esp, 0x10
test eax, eax
jle 0x419361
mov al, byte [esp + 0x14]
cmp al, 0x6d
je 0x41933c
cmp al, 0x4d
jne 0x419354
mov eax, dword [esp + 0xc]
imul eax, eax, 0x3e8
imul eax, eax, 0x3e8
pop edi
mov dword [esi + 0x2c], eax
pop esi
pop ebx
pop ecx
ret
mov eax, dword [esp + 0xc]
imul eax, eax, 0x3e8
mov dword [esi + 0x2c], eax
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x420810
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x18
push esi
push edi
mov edi, dword [esp + 0x24]
cmp dword [edi + 0x4c], 1
mov esi, dword [edi + 0x1b8]
mov dword [esp + 0x18], esi
jne 0x420837
mov dword [esp + 8], 0x1fe
mov byte [esi + 0x1c], 1
jmp 0x420843
mov dword [esp + 8], 0
mov byte [esi + 0x1c], 0
mov ecx, dword [edi + 0x64]
mov edx, dword [esp + 8]
mov eax, dword [edi + 4]
mov eax, dword [eax + 8]
push ecx
add edx, 0x100
push edx
push 1
push edi
call eax
xor ecx, ecx
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x14]
add esp, 0x10
cmp dword [edi + 0x64], ecx
mov dword [esp + 0x14], ecx
jle 0x420956
push ebx
lea edx, [esi + 0x20]
push ebp
mov dword [esp + 0x14], edx
jmp 0x420888
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
mov edi, dword [edx]
cdq
idiv edi
cmp dword [esp + 0x10], 0
mov dword [esp + 0x18], eax
je 0x4208a9
mov eax, dword [esi + 0x18]
add dword [eax + ecx*4], 0xff
lea eax, [eax + ecx*4]
mov edx, dword [esi + 0x18]
mov ebp, dword [edx + ecx*4]
lea eax, [edi + 0xfe]
lea esi, [edi + edi - 2]
cdq
idiv esi
xor ebx, ebx
mov dword [esp + 0x24], ebp
xor esi, esi
mov edx, eax
cmp esi, edx
jle 0x4208ff
mov ecx, ebx
lea ebp, [edi + edi - 2]
imul ecx, ecx, 0x1fe
jmp 0x4208e0
add ecx, 0x1fe
lea eax, [ecx + edi + 0xfe]
cdq
idiv ebp
inc ebx
mov edx, eax
cmp esi, edx
jg 0x4208e0
mov ecx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x24]
mov al, byte [esp + 0x18]
imul bl
mov byte [esi + ebp], al
inc esi
cmp esi, 0xff
jle 0x4208c6
cmp dword [esp + 0x10], 0
je 0x42093d
mov eax, 1
lea edx, [ebp - 1]
movzx ebx, byte [ebp]
mov byte [edx], bl
movzx ebx, byte [ebp + 0xff]
mov byte [eax + ebp + 0xff], bl
inc eax
dec edx
cmp eax, 0xff
jle 0x420920
mov eax, dword [esp + 0x2c]
add dword [esp + 0x14], 4
inc ecx
cmp ecx, dword [eax + 0x64]
mov dword [esp + 0x1c], ecx
jl 0x420880
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x18
ret
Function at 0x4014e0
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4014ff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x401506
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x40151d
mov ecx, dword [ebp - 4]
push ecx
call fcn.00402a70
add esp, 4
or eax, 0xffffffff
jmp 0x40151f
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x408500
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x422910]
jne 0x40850a
repz ret
jmp fcn.0040c9e0
Function at 0x417910
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [0x85d858], 0x37
jne 0x417951
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.cacopisocalelav_lubofunikaremufunopi_wecatanebuneboneporohuhag
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push str.Vevesolukizan_waxufi_sadeheray
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov eax, dword [0x8552a4]
add eax, dword [ebp + 8]
mov ecx, dword [0x85d85c]
add ecx, dword [ebp + 8]
mov dl, byte [ecx + 0x12336]
mov byte [eax], dl
mov esp, ebp
pop ebp
ret 4
Function at 0x417ed0
Capabilities:
Accept command line arguments
Create pipe
Get common file path
Initialize winhttp library
Read .ini file
Shutdown system

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1e90
call fcn.0040ab10
mov dword [ebp - 4], 0
jmp 0x417eef
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x32d05d76
jge 0x417fa5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x85d858], 0x16
jne 0x417f22
push str.gupaseyexudipatixiyohuje
push 0
push str.vulumofuxifafayusafakayajitu
push str.solufitow
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x85d858], 0x9e
jne 0x417f95
push 0
lea ecx, [ebp - 0xc58]
push ecx
push 0
push str.xizanilifelorizifadedozuyov_ruwimepozowopocoxuc_cejezovewevocelalixenihuvol
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
push 0
lea edx, [ebp - 0x858]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
push 0
lea eax, [ebp - 0x1058]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
lea ecx, [ebp - 0x1278]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileShortNameA]
cmp dword [ebp - 4], 0x9be51dc
jle 0x417fa0
jmp 0x417fa5
jmp 0x417ee6
push 0x432490
mov edx, dword [0x85d858]
push edx
mov eax, dword [0x8552a4]
push eax
call fcn.00417e00
mov dword [ebp - 0x127c], 0
jmp 0x417fd7
mov ecx, dword [ebp - 0x127c]
add ecx, 1
mov dword [ebp - 0x127c], ecx
cmp dword [ebp - 0x127c], 0x3e79e
jge 0x418018
cmp dword [0x85d858], 0x10
jne 0x418005
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.dehufozidizuledulutanen_mabigumilujudonihinimuvuved_canabi
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
cmp dword [ebp - 0x127c], 0x1e673
jne 0x418016
call fcn.004178f0
jmp 0x417fc8
mov dword [ebp - 0x1280], 0
jmp 0x418033
mov edx, dword [ebp - 0x1280]
add edx, 1
mov dword [ebp - 0x1280], edx
cmp dword [ebp - 0x1280], 0xdd9a7
jge 0x41808f
cmp dword [0x85d858], 0xc01
jne 0x41808d
lea eax, [ebp - 0x1284]
push eax
push str.mihekamutuvatikime
call dword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownA]
push 0
call dword [sym.imp.ADVAPI32.dll_AbortSystemShutdownA]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
jmp 0x418024
jmp dword [0x8552a4]
Function at 0x4b5790
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4b57bd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4b57bd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x10006958
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x10006966
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x10006962
xor edx, edx
mov ecx, 0x10b
cmp word [eax + 0x18], cx
sete dl
mov eax, edx
pop ebp
ret
Function at 0x652e44b0
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x100
push esi
push edi
push str.WSOCK32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
cmp esi, 0x20
mov dword [ebx + 0x68], esi
jge 0x652e4535
lea eax, [esp + 8]
push eax
push 0x1a1f
call fcn.652e69a0
lea edi, [esp + 0x10]
add esp, 8
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x652e44e4
mov ecx, dword [str.WSOCK32.DLL]
mov edx, dword [0x652f5014]
mov eax, dword [0x652f5018]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [edi + 8], eax
lea edi, [esp + 8]
dec edi
lea ebx, [ebx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x652e4510
mov cx, word [0x652f500c]
lea edx, [esp + 8]
push edx
mov word [edi], cx
call dword [ebx + 0x64]
pop edi
xor eax, eax
pop esi
add esp, 0x100
ret
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebp
push str.closesocket
push esi
xor ebp, ebp
call edi
test eax, eax
mov dword [ebx], eax
je 0x652e469a
push str.connect
push esi
call edi
test eax, eax
mov dword [ebx + 4], eax
je 0x652e469a
push str.listen
push esi
call edi
test eax, eax
mov dword [ebx + 8], eax
je 0x652e469a
push str.accept
push esi
call edi
test eax, eax
mov dword [ebx + 0xc], eax
je 0x652e469a
push str.bind
push esi
call edi
test eax, eax
mov dword [ebx + 0x10], eax
je 0x652e469a
push str.getsockopt
push esi
call edi
test eax, eax
mov dword [ebx + 0x18], eax
je 0x652e469a
push str.recv
push esi
call edi
test eax, eax
mov dword [ebx + 0x20], eax
je 0x652e469a
push str.send
push esi
call edi
test eax, eax
mov dword [ebx + 0x24], eax
je 0x652e469a
push str.setsockopt
push esi
call edi
test eax, eax
mov dword [ebx + 0x28], eax
je 0x652e469a
push str.socket
push esi
call edi
test eax, eax
mov dword [ebx + 0x2c], eax
je 0x652e469a
push str.getsockname
push esi
call edi
test eax, eax
mov dword [ebx + 0x14], eax
je 0x652e469a
push str.WSAGetLastError
push esi
call edi
test eax, eax
mov dword [ebx + 0x44], eax
je 0x652e469a
push str.WSACleanup
push esi
mov dword [ebx + 0x48], eax
call edi
test eax, eax
mov dword [ebx + 0x4c], eax
je 0x652e469a
push str.WSAStartup
push esi
call edi
test eax, eax
mov dword [ebx + 0x50], eax
je 0x652e469a
push str.gethostbyname
push esi
call edi
test eax, eax
mov dword [ebx + 0x34], eax
je 0x652e469a
push str.getprotobyname
push esi
call edi
test eax, eax
mov dword [ebx + 0x3c], eax
je 0x652e469a
push str.inet_addr
push esi
call edi
test eax, eax
mov dword [ebx + 0x38], eax
je 0x652e469a
push str.gethostname
push esi
call edi
test eax, eax
mov dword [ebx + 0x40], eax
je 0x652e469a
push str.htons
push esi
call edi
test eax, eax
mov dword [ebx + 0x1c], eax
je 0x652e469a
mov ebp, 1
mov eax, ebp
pop ebp
pop edi
pop esi
add esp, 0x100
ret
mov eax, dword [ebx + 0x64]
push 0x1a24
push eax
call fcn.652e52b0
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebp
pop ebp
pop edi
pop esi
add esp, 0x100
ret
Function at 0x652e55d0
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [0x652fb1ec]
push edi
xor edi, edi
cmp eax, edi
jne 0x652e5608
mov dword [0x652fb1ec], 1
call fcn.652e7100
push edi
mov dword [0x652fb1dc], edi
mov dword [0x652fb1e0], edi
mov dword [0x652fb1e4], edi
call fcn.652e5410
add esp, 4
pop edi
ret
push esi
call fcn.652e7140
mov esi, eax
cmp esi, edi
jne 0x652e561f
push edi
call fcn.652e5410
add esp, 4
mov esi, eax
mov eax, dword [0x652fb1e0]
cmp eax, esi
jne 0x652e5631
mov ecx, dword [0x652fb1e4]
inc ecx
jmp 0x652e564b
push esi
push 0x652fb1dc
call fcn.652e5330
mov eax, esi
add esp, 8
mov dword [0x652fb1e0], eax
mov ecx, 1
mov esi, dword [0x652fb1ec]
inc esi
dec ecx
mov dword [0x652fb1ec], esi
pop esi
mov dword [0x652fb1e4], ecx
jne 0x652e5677
mov dword [0x652fb1e0], edi
push 0x652fb1dc
mov edi, eax
call fcn.652e53a0
add esp, 4
pop edi
ret
Function at 0x652e8900
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
mov eax, str.Unknown_error
je 0x652e8910
mov eax, esi
push 0
push str.SQLAnywhere_Fatal_Error
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
test esi, esi
je 0x652e892d
push esi
call fcn.652eb710
add esp, 4
push 1
call fcn.652eb6df
pop esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x652e8be0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xd0
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
push edi
mov ebx, 0x652fa278
jmp 0x652e8c00
mov ecx, 0xa
mov esi, str.SoftwareSybaseAdaptive_Server_Anywhere
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x18]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x652e8c16
mov ax, word [0x652f6d4c]
mov word [edi], ax
mov eax, dword [esp + 0xe4]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x652e8c30
lea edi, [esp + 0x18]
sub eax, edx
dec edi
mov edi, edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x652e8c40
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebx]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x24]
push edx
push eax
call ebp
test eax, eax
jne 0x652e8cba
mov edx, dword [esp + 0xec]
lea ecx, [esp + 0xf0]
push ecx
mov ecx, dword [esp + 0xec]
push edx
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x1c]
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x652e8cba
mov ecx, dword [esp + 0xf4]
cmp dword [esp + 0x14], ecx
je 0x652e8cd6
add ebx, 4
cmp ebx, 0x652fa280
jl 0x652e8c00
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xd0
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xd0
ret
Function at 0x652ea495
Capabilities:
Accept command line arguments
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 1
push esi
jne 0x652ea582
mov eax, 0x94
call fcn.652eed90
mov esi, esp
push esi
mov dword [esi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x652ea5f7
mov ecx, dword [esi + 0x10]
mov dword [0x652fbb7c], ecx
mov eax, dword [esi + 4]
mov dword [0x652fbb88], eax
mov edx, dword [esi + 8]
mov dword [0x652fbb8c], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
cmp ecx, 2
mov dword [0x652fbb80], esi
je 0x652ea500
or esi, 0x8000
mov dword [0x652fbb80], esi
shl eax, 8
add eax, edx
push 1
mov dword [0x652fbb84], eax
call fcn.652ecee6
test eax, eax
pop ecx
je 0x652ea5f7
call fcn.652ece5d
test eax, eax
jne 0x652ea52d
call fcn.652ecf37
jmp 0x652ea5f7
call fcn.652eed06
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x652fd394], eax
call fcn.652eebe4
mov dword [0x652fbb60], eax
call fcn.652ee6c5
test eax, eax
jl 0x652ea57b
call fcn.652eeb42
test eax, eax
jl 0x652ea576
call fcn.652ee90f
test eax, eax
jl 0x652ea576
call fcn.652eb5a7
test eax, eax
jne 0x652ea576
inc dword [0x652fbb5c]
jmp 0x652ea608
call fcn.652ee8c3
call fcn.652ecc50
jmp 0x652ea523
test eax, eax
jne 0x652ea5b2
cmp dword [0x652fbb5c], eax
jle 0x652ea5f7
dec dword [0x652fbb5c]
cmp dword [0x652fbbb8], eax
jne 0x652ea5a1
call fcn.652eb701
call fcn.652ee8c3
call fcn.652ecc50
call fcn.652ecf37
jmp 0x652ea608
cmp eax, 2
jne 0x652ea5fb
push 0x88
push 1
call fcn.652ee60a
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x652ea5f7
push esi
push dword [0x652fa60c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
push esi
je 0x652ea5f1
call fcn.652ecc6e
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
or dword [esi + 4], 0xffffffff
mov dword [esi], eax
jmp 0x652ea608
call fcn.652ea18b
pop ecx
xor eax, eax
jmp 0x652ea60b
cmp eax, 3
jne 0x652ea608
push 0
call fcn.652eccf2
pop ecx
xor eax, eax
inc eax
lea esp, [ebp - 4]
pop esi
pop ebp
ret 0xc

Function at 0x652eb174
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push edi
mov edi, dword [esp + 0xc]
xor ebx, ebx
test edi, edi
jne 0x652eb190
call fcn.652eb855
mov dword [eax], 0x16
or eax, 0xffffffff
jmp 0x652eb202
push esi
push 0x88
push 1
call fcn.652ee60a
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x652eb1e8
push esi
call fcn.652ecc6e
mov eax, dword [esp + 0x1c]
pop ecx
push esi
push 4
push esi
push 0x652eb0d4
push dword [esp + 0x24]
mov dword [esi + 0x4c], edi
push 0
mov dword [esi + 0x50], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
mov dword [esi + 4], edi
je 0x652eb1e0
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x652eb1ff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.652ea18b
test ebx, ebx
pop ecx
je 0x652eb1fa
push ebx
call fcn.652eb867
pop ecx
or eax, 0xffffffff
jmp 0x652eb201
mov eax, edi
pop esi
pop edi
pop ebx
ret