joyce8/EMBER2024-capa huggingface dataset:
Function at 0x325bce0
Capabilities:
Parse pe header

Disassembly:
mov cl, byte [esp + 4]
movsx eax, cl
add eax, 0xffffff9f
cmp eax, 0x19
ja case.default.0x325bcef
jmp dword [eax*4 + 0x325bd48]
mov al, 0x41
ret
mov al, 0x42
ret
mov al, 0x43
ret
mov al, 0x44
ret
mov al, 0x45
ret
mov al, 0x46
ret
mov al, 0x47
ret
mov al, 0x48
ret
mov al, 0x49
ret
mov al, 0x4a
ret
mov al, 0x4b
ret
mov al, 0x4c
ret
mov al, 0x4d
ret
mov al, 0x4e
ret
mov al, 0x4f
ret
mov al, 0x50
ret
mov al, 0x51
ret
mov al, 0x52
ret
mov al, 0x53
ret
mov al, 0x54
ret
mov al, 0x55
ret
mov al, 0x56
ret
mov al, 0x57
ret
mov al, 0x58
ret
mov al, 0x59
ret
mov al, 0x5a
ret
mov al, cl
ret

Function at 0x325bdb0
Capabilities:
Parse pe header

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
mov dl, byte [esi]
test dl, dl
je 0x325be60
mov cl, byte [edi]
test cl, cl
je 0x325be60
movsx eax, dl
add eax, 0xffffff9f
cmp eax, 0x19
ja case.default.0x325bdd9
jmp dword [eax*4 + 0x325be84]
mov dl, 0x41
jmp case.default.0x325bdd9
mov dl, 0x42
jmp case.default.0x325bdd9
mov dl, 0x43
jmp case.default.0x325bdd9
mov dl, 0x44
jmp case.default.0x325bdd9
mov dl, 0x45
jmp case.default.0x325bdd9
mov dl, 0x46
jmp case.default.0x325bdd9
mov dl, 0x47
jmp case.default.0x325bdd9
mov dl, 0x48
jmp case.default.0x325bdd9
mov dl, 0x49
jmp case.default.0x325bdd9
mov dl, 0x4a
jmp case.default.0x325bdd9
mov dl, 0x4b
jmp case.default.0x325bdd9
mov dl, 0x4c
jmp case.default.0x325bdd9
mov dl, 0x4d
jmp case.default.0x325bdd9
mov dl, 0x4e
jmp case.default.0x325bdd9
mov dl, 0x4f
jmp case.default.0x325bdd9
mov dl, 0x50
jmp case.default.0x325bdd9
mov dl, 0x51
jmp case.default.0x325bdd9
mov dl, 0x52
jmp case.default.0x325bdd9
mov dl, 0x53
jmp case.default.0x325bdd9
mov dl, 0x54
jmp case.default.0x325bdd9
mov dl, 0x55
jmp case.default.0x325bdd9
mov dl, 0x56
jmp case.default.0x325bdd9
mov dl, 0x57
jmp case.default.0x325bdd9
mov dl, 0x58
jmp case.default.0x325bdd9
mov dl, 0x59
jmp case.default.0x325bdd9
mov dl, 0x5a
push ecx
call fcn.0325bce0
add esp, 4
cmp dl, al
jne 0x325be60
mov dl, byte [esi + 1]
inc esi
inc edi
test dl, dl
jne 0x325bdc4
movzx eax, byte [esi]
push eax
call fcn.0325bce0
movzx ecx, byte [edi]
mov dl, al
push ecx
call fcn.0325bce0
add esp, 8
xor ecx, ecx
cmp dl, al
sete cl
pop edi
mov eax, ecx
pop esi
ret
Function at 0x325bef0
Capabilities:
Parse pe header

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
mov dl, byte [edi]
test dl, dl
je 0x325bfb5
nop dword [eax]
mov cl, byte [ebx]
test cl, cl
je 0x325bfb5
test esi, esi
je 0x325bfb9
movsx eax, dl
add eax, 0xffffff9f
cmp eax, 0x19
ja case.default.0x325bf2d
jmp dword [eax*4 + 0x325bfe8]
mov dl, 0x41
jmp case.default.0x325bf2d
mov dl, 0x42
jmp case.default.0x325bf2d
mov dl, 0x43
jmp case.default.0x325bf2d
mov dl, 0x44
jmp case.default.0x325bf2d
mov dl, 0x45
jmp case.default.0x325bf2d
mov dl, 0x46
jmp case.default.0x325bf2d
mov dl, 0x47
jmp case.default.0x325bf2d
mov dl, 0x48
jmp case.default.0x325bf2d
mov dl, 0x49
jmp case.default.0x325bf2d
mov dl, 0x4a
jmp case.default.0x325bf2d
mov dl, 0x4b
jmp case.default.0x325bf2d
mov dl, 0x4c
jmp case.default.0x325bf2d
mov dl, 0x4d
jmp case.default.0x325bf2d
mov dl, 0x4e
jmp case.default.0x325bf2d
mov dl, 0x4f
jmp case.default.0x325bf2d
mov dl, 0x50
jmp case.default.0x325bf2d
mov dl, 0x51
jmp case.default.0x325bf2d
mov dl, 0x52
jmp case.default.0x325bf2d
mov dl, 0x53
jmp case.default.0x325bf2d
mov dl, 0x54
jmp case.default.0x325bf2d
mov dl, 0x55
jmp case.default.0x325bf2d
mov dl, 0x56
jmp case.default.0x325bf2d
mov dl, 0x57
jmp case.default.0x325bf2d
mov dl, 0x58
jmp case.default.0x325bf2d
mov dl, 0x59
jmp case.default.0x325bf2d
mov dl, 0x5a
push ecx
call fcn.0325bce0
add esp, 4
cmp dl, al
jne 0x325bfc2
mov dl, byte [edi + 1]
inc edi
dec esi
inc ebx
test dl, dl
jne 0x325bf10
test esi, esi
jne 0x325bfc2
pop edi
pop esi
mov eax, 1
pop ebx
ret
movzx eax, byte [edi]
push eax
call fcn.0325bce0
movzx ecx, byte [ebx]
mov dl, al
push ecx
call fcn.0325bce0
add esp, 8
xor ecx, ecx
cmp dl, al
sete cl
pop edi
pop esi
mov eax, ecx
pop ebx
ret

Function at 0x325f800
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
mov edx, ebx
push esi
push edi
lea ecx, [edx + 1]
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x325f810
mov edi, dword [esp + 0x14]
sub edx, ecx
mov esi, edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x325f822
sub esi, ecx
lea eax, [esi + edx]
test edx, edx
je 0x325f84a
mov ecx, eax
lea ebx, [ebx + 1]
shl eax, 5
shr ecx, 0x1b
xor ecx, eax
movsx eax, byte [ebx - 1]
xor eax, ecx
sub edx, 1
jne 0x325f832
test esi, esi
je 0x325f868
nop
mov ecx, eax
lea edi, [edi + 1]
shl eax, 5
shr ecx, 0x1b
xor ecx, eax
movsx eax, byte [edi - 1]
xor eax, ecx
sub esi, 1
jne 0x325f850
pop edi
pop esi
and eax, 0x7fffffff
pop ebx
ret
Function at 0x325faa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
push edi
push ebp
call fcn.03395863
mov edi, dword [esp + 0x10]
add esp, 4
mov dword [edi + 0x38], eax
test eax, eax
jne 0x325fac2
pop edi
mov eax, 0xc
pop ebp
ret
mov edx, ebp
push ebx
mov ebx, dword [edi + 0x3c]
lea ecx, [edx + 1]
nop dword [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x325fad0
push esi
mov esi, ebx
sub edx, ecx
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x325fae0
sub esi, ecx
lea eax, [esi + edx]
test edx, edx
je 0x325fb08
mov ecx, eax
lea ebp, [ebp + 1]
shl eax, 5
shr ecx, 0x1b
xor ecx, eax
movsx eax, byte [ebp - 1]
xor eax, ecx
sub edx, 1
jne 0x325faf0
test esi, esi
je 0x325fb28
nop dword [eax]
mov ecx, eax
lea ebx, [ebx + 1]
shl eax, 5
shr ecx, 0x1b
xor ecx, eax
movsx eax, byte [ebx - 1]
xor eax, ecx
sub esi, 1
jne 0x325fb10
mov ebp, dword [esp + 0x20]
and eax, 0x7fffffff
mov ebx, dword [esp + 0x18]
push ebp
push dword [esp + 0x20]
mov dword [edi + 0x40], eax
push ebx
call fcn.032606a0
mov esi, eax
add esp, 0xc
test esi, esi
je 0x325fba5
mov eax, dword [edi + 0x2c]
test eax, eax
je 0x325fb59
push dword [edi + 0x34]
push ebx
call eax
mov dword [edi + 0x14], esi
lea ecx, [esi + 0x50]
mov eax, dword [ecx]
lea edx, [edi + 8]
mov dword [edx + 4], ecx
mov dword [edx], eax
mov eax, dword [ecx]
mov dword [eax + 4], edx
mov dword [ecx], edx
mov ecx, dword [edi + 0x10]
add ecx, 0x4c
mov eax, dword [ecx]
mov dword [edi], eax
mov dword [edi + 4], ecx
mov eax, dword [ecx]
mov dword [eax + 4], edi
mov dword [ecx], edi
cmp dword [esi + 8], 0
je 0x325fc10
push esi
mov dword [esi + 8], 0
call fcn.03260520
add esp, 4
xor eax, eax
pop esi
pop ebx
pop edi
pop ebp
ret
push ebp
push dword [esp + 0x20]
push ebx
call fcn.03260290
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x325fbcf
push dword [edi + 0x38]
call fcn.03390752
add esp, 4
mov dword [edi + 0x38], esi
lea eax, [esi + 0xc]
pop esi
pop ebx
pop edi
pop ebp
ret
mov eax, dword [edi + 0x2c]
test eax, eax
je 0x325fbdc
push dword [edi + 0x34]
push ebx
call eax
mov dword [edi + 0x14], esi
lea ecx, [esi + 0x50]
mov eax, dword [ecx]
lea edx, [edi + 8]
mov dword [edx + 4], ecx
mov dword [edx], eax
mov eax, dword [ecx]
push esi
mov dword [eax + 4], edx
mov dword [ecx], edx
mov ecx, dword [edi + 0x10]
add ecx, 0x4c
mov eax, dword [ecx]
mov dword [edi], eax
mov dword [edi + 4], ecx
mov eax, dword [ecx]
mov dword [eax + 4], edi
mov dword [ecx], edi
call fcn.03260520
add esp, 4
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
ret
Function at 0x3270210
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
add ecx, 0xdeadbeef
push ebp
mov ebp, dword [esp + 8]
add ecx, edx
push esi
mov esi, ecx
mov dword [esp + 0x14], esi
push edi
mov edi, ecx
cmp edx, 0xc
jbe switch.0x0327031a
add edx, 0xfffffff3
mov eax, 0xaaaaaaab
mul edx
push ebx
mov eax, edx
shr eax, 3
inc eax
mov dword [esp + 0x14], eax
nop dword [eax]
movzx esi, byte [ebp + 7]
movzx eax, byte [ebp + 6]
movzx edx, byte [ebp + 0xb]
shl esi, 8
add esi, eax
shl edx, 8
movzx eax, byte [ebp + 5]
shl esi, 8
add esi, eax
movzx eax, byte [ebp + 4]
add edi, eax
shl esi, 8
movzx eax, byte [ebp + 0xa]
add edi, esi
movzx esi, byte [ebp + 8]
add edx, eax
movzx eax, byte [ebp + 9]
add esi, ecx
movzx ecx, byte [ebp + 3]
shl edx, 8
add edx, eax
shl ecx, 8
movzx eax, byte [ebp + 2]
add ecx, eax
shl edx, 8
movzx eax, byte [ebp + 1]
add esi, edx
shl ecx, 8
mov ebx, esi
add ecx, eax
rol ebx, 4
movzx eax, byte [ebp]
add ebp, 0xc
shl ecx, 8
add ecx, eax
sub ecx, esi
add esi, edi
add ecx, dword [esp + 0x1c]
xor ebx, ecx
sub edi, ebx
mov eax, ebx
rol eax, 6
add ebx, esi
xor eax, edi
sub esi, eax
mov edx, eax
rol edx, 8
add eax, ebx
xor edx, esi
mov esi, edx
sub ebx, edx
rol esi, 0x10
add edx, eax
xor esi, ebx
mov edi, esi
sub eax, esi
ror edi, 0xd
add esi, edx
xor edi, eax
mov dword [esp + 0x1c], esi
sub edx, edi
mov ecx, edi
rol ecx, 4
add edi, esi
xor ecx, edx
mov edx, dword [esp + 0x18]
sub edx, 0xc
sub dword [esp + 0x14], 1
mov dword [esp + 0x18], edx
jne 0x3270250
pop ebx
cmp edx, 0xc
ja 0x3270388
jmp dword [edx*4 + 0x32703d4]
movzx eax, byte [ebp + 0xb]
shl eax, 0x18
add ecx, eax
movzx eax, byte [ebp + 0xa]
shl eax, 0x10
add ecx, eax
movzx eax, byte [ebp + 9]
shl eax, 8
add ecx, eax
movzx eax, byte [ebp + 8]
add ecx, eax
movzx eax, byte [ebp + 7]
shl eax, 0x18
add edi, eax
movzx eax, byte [ebp + 6]
shl eax, 0x10
add edi, eax
movzx eax, byte [ebp + 5]
shl eax, 8
add edi, eax
movzx eax, byte [ebp + 4]
add edi, eax
movzx eax, byte [ebp + 3]
shl eax, 0x18
add esi, eax
movzx eax, byte [ebp + 2]
shl eax, 0x10
add esi, eax
movzx eax, byte [ebp + 1]
shl eax, 8
add esi, eax
movzx eax, byte [ebp]
add esi, eax
mov dword [esp + 0x18], esi
xor ecx, edi
mov eax, edi
rol eax, 0xe
sub ecx, eax
mov eax, ecx
mov esi, ecx
xor esi, dword [esp + 0x18]
rol eax, 0xb
sub esi, eax
xor edi, esi
mov eax, esi
ror eax, 7
sub edi, eax
mov eax, edi
xor ecx, edi
rol eax, 0x10
sub ecx, eax
mov eax, ecx
mov edx, ecx
rol eax, 4
xor edx, esi
sub edx, eax
mov eax, edx
xor edi, edx
rol eax, 0xe
sub edi, eax
mov eax, edi
xor ecx, edi
ror eax, 8
sub ecx, eax
pop edi
pop esi
mov eax, ecx
pop ebp
ret

Function at 0x3274360
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
ret
Function at 0x3275090
Capabilities:
Create thread

Disassembly:
push esi
push 0x34191a0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x3417520]
test esi, esi
jne 0x32751a4
push 0x48
call fcn.0339076d
mov esi, eax
add esp, 4
test esi, esi
je 0x327519e
lea eax, [esi + 0x38]
mov dword [esi + 0x18], 0
push edi
mov dword [esi + 0x3c], eax
lea edi, [esi + 0x1c]
mov dword [eax], eax
lea eax, [esi + 0xc]
push edi
mov dword [esi + 0x10], eax
mov dword [eax], eax
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0x34], eax
call fcn.0325c3f0
mov dword [esi], eax
test eax, eax
je 0x3275182
push esi
push 0x3275c90
push 0x12
push 0xffffffffffffffff
push eax
call fcn.0327d340
add esp, 0x14
mov dword [esi + 8], eax
test eax, eax
je 0x3275178
or dword [esi + 0x18], 1
push 0
push 0x10000
push esi
push 0x3275bf0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esi + 8]
mov dword [esi + 0x14], eax
test eax, eax
je 0x3275164
push 0
push ecx
call fcn.0327d640
add esp, 8
jmp 0x327519d
and dword [esi + 0x18], 0xfffffffe
push ecx
call fcn.0327d440
add esp, 4
mov dword [esi + 8], 0
push dword [esi]
call fcn.0327cc70
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push dword [esi + 0x34]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.03390752
add esp, 4
xor esi, esi
pop edi
mov dword [0x3417520], esi
push 0x34191a0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor ecx, ecx
mov eax, 0xc
test esi, esi
pop esi
cmovne eax, ecx
ret
Function at 0x3275200
Capabilities:
Create thread

Disassembly:
push esi
push 0x48
call fcn.0339076d
mov esi, eax
add esp, 4
test esi, esi
jne 0x3275213
pop esi
ret
lea eax, [esi + 0x38]
mov dword [esi + 0x18], 0
push edi
mov dword [esi + 0x3c], eax
lea edi, [esi + 0x1c]
mov dword [eax], eax
lea eax, [esi + 0xc]
push edi
mov dword [esi + 0x10], eax
mov dword [eax], eax
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0x34], eax
call fcn.0325c3f0
mov dword [esi], eax
test eax, eax
je 0x32752ea
cmp dword [esp + 0xc], 0
jne 0x327527d
or dword [esi + 0x18], 4
mov eax, esi
pop edi
pop esi
ret
push esi
push 0x3275c90
push 0x12
push 0xffffffffffffffff
push eax
call fcn.0327d340
add esp, 0x14
mov dword [esi + 8], eax
test eax, eax
je 0x32752e0
or dword [esi + 0x18], 1
push 0
push 0x10000
push esi
push 0x3275bf0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esi + 8]
mov dword [esi + 0x14], eax
test eax, eax
je 0x32752cc
push 0
push ecx
call fcn.0327d640
add esp, 8
mov eax, esi
pop edi
pop esi
ret
and dword [esi + 0x18], 0xfffffffe
push ecx
call fcn.0327d440
add esp, 4
mov dword [esi + 8], 0
push dword [esi]
call fcn.0327cc70
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push dword [esi + 0x34]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.03390752
add esp, 4
xor eax, eax
pop edi
pop esi
ret
Function at 0x3276de0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xa4
mov eax, dword [0x3415a34]
xor eax, esp
mov dword [esp + 0xa0], eax
mov eax, dword [esp + 0xa8]
push ebp
mov ebp, dword [esp + 0xb0]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xb4]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x3276e41
push eax
call fcn.032783b0
add esp, 4
test eax, eax
jne 0x3276e41
mov eax, 0x16
pop ebp
mov ecx, dword [esp + 0xa0]
xor ecx, esp
call fcn.0338ca36
add esp, 0xa4
ret
push esi
push dword [ebp + 4]
call fcn.03257660
mov esi, eax
add esp, 4
test esi, esi
jne 0x3276e6d
lea eax, [esi + 0xc]
pop esi
pop ebp
mov ecx, dword [esp + 0xa0]
xor ecx, esp
call fcn.0338ca36
add esp, 0xa4
ret
push edi
lea eax, [esp + 0x10]
push eax
push esi
call fcn.03257570
mov edi, eax
add esp, 8
test edi, edi
jne 0x327701c
mov ecx, dword [esp + 0x10]
or ecx, dword [esp + 0x14]
je 0x327701c
mov dword [esp + 0xc], eax
lea eax, [esp + 0x20]
push ebx
push eax
call fcn.03274360
push 0x33bd458
lea eax, [esp + 0x18]
push esi
push eax
call fcn.03257610
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x3276f72
push 0x4000
call fcn.0339076d
mov edi, eax
add esp, 4
test edi, edi
jne 0x3276ef2
push dword [esp + 0x10]
call fcn.0339d055
add esp, 4
lea ebx, [edi + 0xc]
push esi
call fcn.03390752
add esp, 4
mov eax, ebx
jmp 0x3276fb4
push dword [esp + 0x10]
push 0x4000
push 1
push edi
call fcn.0339db83
add esp, 0x10
test eax, eax
je 0x3276f1b
push eax
lea eax, [esp + 0x28]
push edi
push eax
call fcn.03274390
add esp, 0xc
jmp 0x3276ef2
push dword [esp + 0x10]
call fcn.0339d945
add esp, 4
test eax, eax
je 0x3276f57
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x80]
push eax
call fcn.03274470
lea eax, [esp + 0x94]
push eax
lea eax, [esp + 0x88]
push eax
call fcn.03274bd0
add esp, 0x10
jmp 0x3276f5c
mov ebx, 0x271b
push dword [esp + 0x10]
call fcn.0339d055
push edi
call fcn.03390752
add esp, 8
test ebx, ebx
je 0x3276f7f
push esi
call fcn.03390752
add esp, 4
mov eax, ebx
jmp 0x3276fb4
push dword [esp + 0x18]
lea eax, [esp + 0x90]
push dword [esp + 0x18]
push eax
push dword [ebp + 8]
push dword [ebp + 0xc]
push dword [ebp]
call fcn.03277b10
mov edi, eax
add esp, 0x18
test edi, edi
jne 0x3276fcd
push esi
call fcn.03390752
add esp, 4
mov eax, 0xc
pop ebx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0xa0]
xor ecx, esp
call fcn.0338ca36
add esp, 0xa4
ret
push dword [esp + 0x1c]
call fcn.03277e90
mov edx, eax
add esp, 4
test edx, edx
jne 0x3276ff0
push edi
call fcn.03390752
push esi
call fcn.03390752
add esp, 8
jmp 0x3276faf
mov dword [edx + 0x28], 0
mov dword [edx + 0x20], 0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [edx + 0x10], eax
mov eax, dword [esp + 0x20]
mov dword [edx + 0x14], ecx
mov dword [edx + 8], esi
mov dword [edx + 0x2c], edi
mov dword [eax], edx
xor eax, eax
jmp 0x3276fb4
push esi
call fcn.03390752
mov ecx, dword [esp + 0xb0]
add esp, 4
test edi, edi
mov eax, 0x3d
cmovne eax, edi
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0338ca36
add esp, 0xa4
ret
Function at 0x32773e0
Capabilities:
Delete file

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esi + 0x30]
mov eax, dword [esi + 0x38]
and edi, 1
test eax, eax
je 0x3277451
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx + 0x58]
test eax, eax
je 0x3277444
dec eax
mov dword [ecx + 0x58], eax
mov eax, dword [esi + 0x38]
cmp dword [eax + 0x58], 0
jne 0x3277444
test byte [eax + 0x28], 0x40
je 0x3277444
push str.upload_request_destroy
push 0x18b
push str..._srcuploadupload_request.c
push str.__s:_d___s:_signal_user_thread__due_to_BDNC_CTX_F_WAIT_4_UPLOADS__n
push 3
call fcn.0325f280
mov eax, dword [esi + 0x38]
add esp, 0x14
push dword [eax + 0x20]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi + 0x38]
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esi + 0x28]
test eax, eax
jne 0x327747a
mov eax, dword [esi + 0x20]
test eax, eax
je 0x3277468
push eax
call fcn.0339d055
add esp, 4
test edi, edi
je 0x3277475
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esi + 8]
jmp 0x32774c2
test edi, edi
je 0x327749a
cmp eax, 1
jne 0x327749a
mov eax, dword [esi + 0x88]
test eax, eax
je 0x32774cf
push dword [esi + 0x8c]
push dword [esi + 8]
call eax
jmp 0x32774cf
cmp eax, 2
jne 0x32774cf
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x32774af
push eax
call fcn.03390752
add esp, 4
mov eax, dword [esi + 0x24]
test eax, eax
je 0x32774bf
push eax
call fcn.03390752
add esp, 4
mov eax, dword [esi + 0x20]
test eax, eax
je 0x32774cf
push eax
call fcn.03390752
add esp, 4
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x32774df
push eax
call fcn.03390752
add esp, 4
mov eax, dword [esi + 0x44]
test eax, eax
je 0x32774ef
push eax
call fcn.03390752
add esp, 4
mov eax, dword [esi + 0x68]
test eax, eax
je 0x32774ff
push eax
call fcn.03390752
add esp, 4
mov eax, dword [esi + 0x90]
test eax, eax
je 0x3277512
push eax
call fcn.0325a1d0
add esp, 4
push esi
call fcn.03390752
add esp, 4
pop edi
pop esi
ret

Function at 0x3278b10
Capabilities:
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 4]
push eax
push 0x8004667e
push esi
mov dword [esp + 0x10], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x3278b49
push esi
push str.fcntl__d__F_GETFL_
push esi
call fcn.0328a550
add esp, 0xc
or eax, 0xffffffff
pop esi
pop ecx
ret
xor eax, eax
pop esi
pop ecx
ret
Function at 0x3278c20
Capabilities:
Hash data using murmur3

Disassembly:
push ecx
mov ecx, dword [0x341757c]
mov dword [esp], 0
test ecx, ecx
je 0x3278c3d
push ecx
push 0
call fcn.0329a5d0
add esp, 8
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [0x3412a84]
test edi, edi
je 0x3278ca1
mov eax, esi
xor edx, edx
shr eax, 0x10
xor eax, esi
imul ecx, eax, 0x85ebca6b
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
div dword [0x3412a88]
mov ecx, dword [edi + edx*4]
lea edx, [edi + edx*4]
test ecx, ecx
je 0x3278c8f
cmp dword [ecx + 4], esi
je 0x3278c8f
mov eax, dword [ecx]
mov edx, ecx
mov ecx, eax
test eax, eax
jne 0x3278c80
mov eax, dword [edx]
test eax, eax
je 0x3278ca1
mov eax, dword [eax + 8]
mov dword [esp + 8], eax
jmp 0x3278dc8
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
push esi
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
je 0x3278cf7
mov edx, dword [esp + 8]
test edx, edx
je 0x3278d28
mov ecx, edx
lea edi, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x3278cd0
sub ecx, edi
je 0x3278d28
cmp byte [edx + ecx - 1], 0xa
jne 0x3278d28
sub ecx, 1
mov byte [edx + ecx], al
je 0x3278d28
cmp byte [ecx + edx - 1], 0xd
jne 0x3278d28
mov byte [ecx + edx - 1], al
jmp 0x3278d28
push 0x32
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [esp + 8], eax
test eax, eax
jne 0x3278d17
mov eax, str.LocalAlloc_failed_during_Winsock_error
mov dword [esp + 8], eax
jmp 0x3278dc8
push esi
push str.winsock_error_0x_08x
push 0x32
push eax
call fcn.03278e00
add esp, 0x10
push 0xc
call fcn.0339076d
mov edi, eax
add esp, 4
test edi, edi
jne 0x3278d4d
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, str.malloc_failed_during_Winsock_error
mov dword [esp + 8], eax
jmp 0x3278dc8
mov dword [edi + 4], esi
mov eax, dword [esp + 8]
mov dword [edi + 8], eax
mov esi, dword [0x3412a84]
mov eax, dword [0x3412a8c]
test esi, esi
je 0x3278d6e
cmp eax, dword [0x3412a90]
jb 0x3278d88
inc eax
push eax
push 0x3412a84
call fcn.0327bb40
mov eax, dword [0x3412a8c]
add esp, 8
mov esi, dword [0x3412a84]
inc eax
xor edx, edx
mov dword [0x3412a8c], eax
mov ecx, dword [edi + 4]
shr ecx, 0x10
xor ecx, dword [edi + 4]
imul ecx, ecx, 0x85ebca6b
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
div dword [0x3412a88]
mov eax, dword [esi + edx*4]
mov dword [edi], eax
mov dword [esi + edx*4], edi
mov eax, dword [esp + 8]
lea ecx, [esi + edx*4]
mov ecx, dword [0x341757c]
pop edi
pop esi
test ecx, ecx
je 0x3278de3
push ecx
push 0
call fcn.0329a5e0
mov eax, dword [esp + 8]
add esp, 8
pop ecx
ret
Function at 0x3279f20
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x4c
mov eax, dword [0x3415a34]
xor eax, esp
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x54]
mov edx, dword [esp + 0x58]
mov ecx, dword [esp + 0x50]
mov dword [esp + 4], eax
mov dword [eax], 0
mov eax, dword [esp + 0x5c]
neg eax
mov dword [esp], edx
push ebp
sbb eax, eax
mov dword [edx], 0
push 0
and eax, 0x8000
push eax
push ecx
call fcn.0339c464
mov ebp, eax
add esp, 0xc
test ebp, ebp
jns 0x3279f80
or eax, 0xffffffff
pop ebp
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.0338ca36
add esp, 0x4c
ret
push ebx
lea eax, [esp + 0x18]
push eax
push ebp
call fcn.0339f769
add esp, 8
test eax, eax
jne 0x327a064
cmp dword [esp + 0x34], eax
ja 0x327a064
mov eax, dword [esp + 0x30]
jb 0x3279fb2
cmp eax, 0x7ffffffe
ja 0x327a064
inc eax
push eax
call fcn.0339076d
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x327a064
mov ecx, dword [esp + 0x30]
push esi
xor esi, esi
push edi
nop
mov eax, dword [esp + 0x3c]
mov edx, ecx
sub edx, esi
sbb eax, 0
mov dword [esp + 0x1c], eax
js 0x3279ff2
jg 0x3279feb
cmp edx, 0x7fffffff
jbe 0x3279ff2
mov ecx, 0x7fffffff
jmp 0x3279ff4
sub ecx, esi
push ecx
lea eax, [ebx + esi]
push eax
push ebp
call fcn.0339e5fa
mov edi, eax
add esp, 0xc
test edi, edi
jle 0x327a012
mov ecx, dword [esp + 0x38]
add esi, edi
cmp esi, ecx
jb 0x3279fd0
push ebp
call fcn.0339dfab
add esp, 4
test edi, edi
pop edi
jns 0x327a040
push ebx
call fcn.03390752
add esp, 4
mov eax, 0xfffffffe
pop esi
pop ebx
pop ebp
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.0338ca36
add esp, 0x4c
ret
mov eax, dword [esp + 0xc]
mov byte [ebx + esi], 0
mov dword [eax], esi
mov eax, dword [esp + 0x10]
pop esi
mov dword [eax], ebx
xor eax, eax
pop ebx
pop ebp
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.0338ca36
add esp, 0x4c
ret
push ebp
call fcn.0339dfab
mov ecx, dword [esp + 0x54]
add esp, 4
mov eax, 0xfffffffe
pop ebx
pop ebp
xor ecx, esp
call fcn.0338ca36
add esp, 0x4c
ret