joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41fad0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x41c
mov eax, dword [0x4a206c]
xor eax, esp
mov dword [esp + 0x414], eax
push esi
push edi
lea eax, [esp + 0x288]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x41fc57
xorps xmm0, xmm0
mov eax, 2
movups xmmword [0x4b07a0], xmm0
push 0
mov word [0x4b07a0], ax
call dword [sym.imp.WS2_32.dll_htons]
mov edx, 0x4b07a4
mov word [0x4b07a2], ax
mov ecx, str.0.0.0.0
call fcn.0041d4a0
test eax, eax
jne 0x41fc63
push ecx
call fcn.004121a0
add esp, 4
test eax, eax
jne 0x41fc68
push eax
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp edi, 0xffffffff
je 0x41fbbb
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x274
push eax
lea eax, [esp + 0x14]
push eax
push 0x2005
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
je 0x41fc6d
test dword [esp + 0x10], 0x20000
mov ecx, 1
mov eax, dword [0x4b07e0]
cmove eax, ecx
push edi
mov dword [0x4b07e0], eax
call dword [sym.imp.WS2_32.dll_closesocket]
cmp eax, 0xffffffff
jne 0x41fbcc
jmp 0x41fc7f
call esi
mov ecx, eax
call fcn.0041faa0
test eax, eax
je 0x41fc91
push 0
push 1
push 0x17
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
cmp edi, 0xffffffff
je 0x41fc33
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x274
push eax
lea eax, [esp + 0x14]
push eax
push 0x2005
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
je 0x41fc9f
test dword [esp + 0x10], 0x20000
mov ecx, 1
mov eax, dword [0x4b07dc]
cmove eax, ecx
push edi
mov dword [0x4b07dc], eax
call dword [sym.imp.WS2_32.dll_closesocket]
cmp eax, 0xffffffff
jne 0x41fc40
jmp 0x41fcad
call esi
mov ecx, eax
call fcn.0041faa0
test eax, eax
je 0x41fcbb
mov ecx, dword [esp + 0x41c]
pop edi
pop esi
xor ecx, esp
call fcn.0042b571
add esp, 0x41c
ret
mov edx, str.WSAStartup
mov ecx, eax
call fcn.0041c6e0
call fcn.0044ca25
call fcn.0044ca25
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, str.getsockopt
mov ecx, eax
call fcn.0041c6e0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, str.closesocket
mov ecx, eax
call fcn.0041c6e0
call esi
mov edx, str.socket
mov ecx, eax
call fcn.0041c6e0
call esi
mov edx, str.getsockopt
mov ecx, eax
call fcn.0041c6e0
call esi
mov edx, str.closesocket
mov ecx, eax
call fcn.0041c6e0
call esi
mov edx, str.socket
mov ecx, eax
call fcn.0041c6e0
int3
Function at 0x4219f0
Capabilities:
Send data
Send data on socket
Send http request

Disassembly:
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebx + 0x10]
test dword [edi + 0xe4], 0x2000
jne 0x421a21
push str.Cannot_resume_connections_without_enabling_MHD_ALLOW_SUSPEND_RESUME__n
push 0xa7b
push 0x4a4d68
push dword [0x4b03b8]
call dword [0x4b03b0]
add esp, 0x10
push esi
lea esi, [edi + 0x9c]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebx + 0xe4], 1
push esi
mov byte [edi + 0xc7], 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [edi + 0xbc], 0xffffffff
pop esi
je 0x421a82
push 0
push 1
push 0x4a3b64
push dword [edi + 0xc0]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x421a82
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x421a82
push str.Failed_to_signal_resume_via_inter_thread_communication_channel.
push edi
call fcn.00428de0
add esp, 8
pop edi
pop ebx
ret
Function at 0x421e00
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x30
mov eax, dword [0x4a206c]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0xc], 0x1c
xorps xmm0, xmm0
mov dword [esp + 0x30], 0
movups xmmword [esp + 0x18], xmm0
mov eax, dword [edi + 0xb4]
movq qword [esp + 0x28], xmm0
cmp eax, 0xffffffff
je 0x421fdf
cmp byte [edi + 0xc5], 0
jne 0x421fdf
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x1c]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_accept]
mov ebx, eax
mov byte [esp + 0x10], 0
cmp ebx, 0xffffffff
je 0x421f08
cmp dword [esp + 0xc], 0
jle 0x421f08
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 1
push eax
push 0x8004667e
push ebx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x421eb4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.00428610
push eax
push str.Failed_to_set_nonblocking_mode_on_incoming_connection_socket:__s_n
push edi
call fcn.00428de0
add esp, 0xc
jmp 0x421eb9
mov byte [esp + 0x10], 1
push 0
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
jne 0x421ed6
push str.Failed_to_set_noninheritable_mode_on_incoming_connection_socket._n
push edi
call fcn.00428de0
add esp, 8
push dword [esp + 0x10]
lea eax, [esp + 0x1c]
mov edx, ebx
push 0
push dword [esp + 0x14]
mov ecx, edi
push eax
call fcn.00421000
add esp, 0x10
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.0042b571
add esp, 0x30
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2726
je 0x421fdf
cmp esi, 0x2746
je 0x421fdf
cmp esi, 0x2733
je 0x421f46
mov ecx, esi
call fcn.00428610
push eax
push str.Error_accepting_connection:__s_n
push edi
call fcn.00428de0
add esp, 0xc
cmp ebx, 0xffffffff
je 0x421f74
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
je 0x421f74
push 0x4a4364
push 0xb83
push 0x4a5c88
push dword [0x4b03b8]
call dword [0x4b03b0]
add esp, 0x10
cmp esi, 0x2728
je 0x421f84
cmp esi, 0x2747
jne 0x421fdf
cmp dword [edi + 0xcc], 0
jne 0x421fb0
push str.Hit_process_or_system_resource_limit_at_FIRST_connection._This_is_really_bad_as_there_is_no_sane_way_to_proceed._Will_try_busy_waiting_for_system_resources_to_become_magically_available._n
push edi
call fcn.00428de0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.0042b571
add esp, 0x30
ret
lea esi, [edi + 0x9c]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
mov byte [edi + 0xc6], 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [edi + 0xcc]
push str.Hit_process_or_system_resource_limit_at__u_connections__temporarily_suspending_accept__._Consider_setting_a_lower_MHD_OPTION_CONNECTION_LIMIT._n
push edi
call fcn.00428de0
add esp, 0xc
mov ecx, dword [esp + 0x34]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0042b571
add esp, 0x30
ret
Function at 0x4223c0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, ecx
mov dword [esp + 8], edx
push esi
push edi
mov edi, dword [sym.imp.WS2_32.dll___WSAFDIsSet]
mov byte [ebp + 0xc8], 0
mov eax, dword [ebp + 0xbc]
mov dword [esp + 0x18], ebp
cmp eax, 0xffffffff
je 0x422410
push edx
push eax
call edi
test eax, eax
je 0x42240c
mov esi, dword [sym.imp.WS2_32.dll_recv]
push 0
push 4
lea eax, [esp + 0x1c]
push eax
push dword [ebp + 0xbc]
call esi
test eax, eax
jg 0x4223f7
mov edx, dword [esp + 0x10]
mov eax, dword [ebp + 0xb4]
cmp eax, 0xffffffff
je 0x422433
cmp byte [ebp + 0xc5], 0
jne 0x422433
push edx
push eax
call edi
test eax, eax
je 0x422433
mov ecx, ebp
call fcn.00421e00
test dword [ebp + 0xe4], 4
jne 0x4224bc
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x4224bc
mov ebp, dword [esp + 0x10]
nop word [eax + eax]
mov ebx, dword [esi + 0xa0]
mov eax, dword [esi + 4]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ebx
cmp ebx, 0xffffffff
je 0x4224b2
push dword [esp + 0x24]
push ebx
call edi
push dword [esp + 0x20]
mov edi, eax
push ebx
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
push ebp
push dword [esp + 0x14]
mov ebx, eax
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
test edi, edi
setne cl
test ebx, ebx
movzx ecx, cl
push ecx
setne cl
test eax, eax
movzx ecx, cl
push ecx
setne dl
mov ecx, esi
call fcn.004206b0
mov eax, dword [esp + 0x1c]
add esp, 8
mov edi, dword [sym.imp.WS2_32.dll___WSAFDIsSet]
mov esi, eax
test eax, eax
jne 0x422450
mov ebp, dword [esp + 0x18]
mov ecx, ebp
call fcn.00422000
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret
Function at 0x4243a0
Capabilities:
Send data
Send data on socket
Send http request

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0xe4]
mov ecx, eax
mov ebx, eax
shr ecx, 2
shr ebx, 0xf
and ecx, 0xffffff01
and ebx, 0xffffff01
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ebx
test eax, 0x2000
je 0x4243e2
mov ecx, esi
mov byte [esi + 0xc7], 1
call fcn.00421a90
lea eax, [esi + 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test bl, bl
je 0x424527
mov edi, dword [esi + 0x14]
test edi, edi
je 0x424441
nop
mov eax, dword [edi + 0xd8]
test eax, eax
je 0x424509
cmp byte [eax + 4], 0
jne 0x424422
push str.Initiated_daemon_shutdown_while__upgraded__connection_was_not_closed._n
push esi
call fcn.00428de0
add esp, 8
mov eax, dword [edi + 0xd8]
mov byte [eax + 4], 1
mov byte [edi + 0xe4], 1
mov byte [esi + 0xc7], 1
mov edi, dword [edi + 4]
test edi, edi
jne 0x424400
mov edi, dword [esi + 0xc]
test edi, edi
je 0x4244a0
mov ebx, dword [sym.imp.WS2_32.dll_shutdown]
mov ebp, dword [sym.imp.WS2_32.dll_WSAGetLastError]
push 2
push dword [edi + 0xa0]
call ebx
test dword [esi + 0xe4], 4
je 0x424499
cmp dword [esi + 0xbc], 0xffffffff
je 0x424499
push 0
push 1
push 0x4a5cf4
push dword [esi + 0xc0]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x424499
call ebp
cmp eax, 0x2733
jne 0x42454f
mov edi, dword [edi + 4]
test edi, edi
jne 0x424454
cmp byte [esp + 0x14], 0
mov ebx, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
je 0x424580
mov edi, dword [esi + 0xc]
test edi, edi
je 0x424580
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [edi + 0xa6], 0
jne 0x42456d
lea eax, [esi + 0x9c]
push eax
call ebx
push 0xffffffffffffffff
push dword [edi + 0x50]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4245e1
push dword [edi + 0x50]
call ebp
lea eax, [esi + 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [edi + 0xa6], 1
mov edi, dword [esi + 0xc]
jmp 0x424570
push 0x4a5eac
push 0x181e
push 0x4a7c78
push dword [0x4b03b8]
call dword [0x4b03b0]
add esp, 0x10
cmp dword [esi + 0x10], 0
je 0x424441
push str.MHD_stop_daemon___called_while_we_have_suspended_connections._n
push 0x183d
push 0x4a7d30
push dword [0x4b03b8]
call dword [0x4b03b0]
add esp, 0x10
push 0x4a7d90
push 0x1846
push 0x4a7de8
push dword [0x4b03b8]
call dword [0x4b03b0]
add esp, 0x10
mov edi, dword [edi + 4]
test edi, edi
jne 0x4244c2
nop dword [eax + eax]
lea eax, [esi + 0x9c]
push eax
call ebx
cmp byte [esp + 0x18], 0
je 0x42459e
mov ecx, esi
mov byte [esi + 0xc7], 1
call fcn.00421a90
mov eax, dword [esi + 0xc]
test eax, eax
je 0x4245d3
nop word [eax + eax]
test dword [esi + 0xe4], 4
je 0x4245c5
cmp byte [eax + 0xa6], 0
je 0x4245ff
mov ecx, eax
call fcn.00422ff0
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x4245b0
mov ecx, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
jmp fcn.00422000
push 0x4a5e3c
push 0x1854
push 0x4a7ea0
push dword [0x4b03b8]
call dword [0x4b03b0]
add esp, 0x10
push 0x4a601c
push 0x1872
push 0x4a7fe8
push dword [0x4b03b8]
call dword [0x4b03b0]
add esp, 0x10
int3
Function at 0x424c40
Capabilities:
Set socket configuration

Disassembly:
push ecx
mov dword [esp], 1
test ecx, ecx
je 0x424c6a
push 4
lea eax, [esp + 4]
push eax
push 1
push 6
push dword [ecx + 0xa0]
call dword [sym.imp.WS2_32.dll_setsockopt]
neg eax
sbb eax, eax
inc eax
pop ecx
ret
push 0x4abea4
push 0x234
push 0x4abeb8
push 0x4abf10
push 2
call fcn.00449f5a
add esp, 4
push eax
call fcn.00408050
add esp, 0x14
push 2
call fcn.00449f5a
add esp, 4
push eax
call fcn.0044a5b8
add esp, 4
call fcn.0044ca25
int3

Function at 0x424cb0
Capabilities:
Set socket configuration

Disassembly:
push ecx
mov dword [esp], 0
test ecx, ecx
je 0x424cda
push 4
lea eax, [esp + 4]
push eax
push 1
push 6
push dword [ecx + 0xa0]
call dword [sym.imp.WS2_32.dll_setsockopt]
neg eax
sbb eax, eax
inc eax
pop ecx
ret
push str.NULL___connection
push 0x286
push 0x4abf60
push 0x4abfb8
push 2
call fcn.00449f5a
add esp, 4
push eax
call fcn.00408050
add esp, 0x14
push 2
call fcn.00449f5a
add esp, 4
push eax
call fcn.0044a5b8
add esp, 4
call fcn.0044ca25
int3
Function at 0x428aa0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information
Set socket configuration
Start tcp server

Disassembly:
sub esp, 0x4c
mov eax, dword [0x4a206c]
xor eax, esp
mov dword [esp + 0x44], eax
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x1c], edi
test edi, edi
jne 0x428ac6
push 0x271e
jmp 0x428c5d
mov ebx, dword [sym.imp.WS2_32.dll_closesocket]
xor ebp, ebp
mov dword [esp + 0x14], ebp
mov edi, dword [sym.imp.WS2_32.dll_socket]
push 6
push 1
push 2
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x24], 1
mov dword [esp + 0x2c], 0
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x428c47
push 0x7f000001
mov dword [esp + 0x28], 2
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x24]
push 0x10
push eax
push esi
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
jne 0x428c33
push 1
push esi
call dword [sym.imp.WS2_32.dll_listen]
test eax, eax
jne 0x428c33
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x28]
push eax
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x428c33
push 6
push 1
push 2
call edi
mov edi, eax
cmp edi, 0xffffffff
je 0x428c33
lea eax, [esp + 0x18]
push eax
push 0x8004667e
push edi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
jne 0x428c78
push 0x10
lea eax, [esp + 0x28]
push eax
push edi
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x428ba9
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x428c78
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x10
push eax
lea eax, [esp + 0x38]
push eax
push esi
call dword [sym.imp.WS2_32.dll_accept]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x428bd5
push esi
call ebx
push edi
call ebx
mov ebp, dword [esp + 0x14]
jmp 0x428c36
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x10
push eax
lea eax, [esp + 0x48]
push eax
push edi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x428c29
mov ax, word [esp + 0x34]
cmp ax, word [esp + 0x44]
jne 0x428c29
mov ax, word [esp + 0x36]
cmp ax, word [esp + 0x46]
jne 0x428c29
mov eax, dword [esp + 0x38]
cmp eax, dword [esp + 0x48]
jne 0x428c29
lea eax, [esp + 0x18]
push eax
push 0x8004667e
push ebp
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x428c7e
push ebp
call ebx
push edi
call ebx
mov ebp, dword [esp + 0x14]
push esi
call ebx
inc ebp
mov dword [esp + 0x14], ebp
cmp ebp, 0x320
jl 0x428ad2
mov eax, dword [esp + 0x1c]
push 0x274d
mov dword [eax], 0xffffffff
mov dword [eax + 4], 0xffffffff
call dword [sym.imp.WS2_32.dll_WSASetLastError]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.0042b571
add esp, 0x4c
ret
push esi
call ebx
push edi
jmp 0x428c34
push esi
call ebx
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x54]
mov dword [eax + 4], edi
pop edi
pop esi
mov dword [eax], ebp
mov eax, 1
pop ebp
pop ebx
xor ecx, esp
call fcn.0042b571
add esp, 0x4c
ret
Function at 0x4290f0
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
push 0xc
mov edi, edx
mov ebx, ecx
call fcn.00446ef7
mov esi, eax
add esp, 4
test esi, esi
je 0x42913f
mov eax, dword [esp + 0x14]
push 0
push 0
push esi
push 0x4290c0
push dword [esp + 0x20]
mov dword [esi], eax
mov eax, dword [esp + 0x2c]
push 0
mov dword [esi + 4], eax
mov dword [esi + 8], edi
call fcn.0044cbc7
add esp, 0x18
mov dword [ebx], eax
cmp eax, 0xffffffff
jne 0x429145
push esi
call fcn.00446c84
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
ret
pop edi
pop esi
mov eax, 1
pop ebx
ret

Function at 0x42b567
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x49d318
call fcn.0042c340
push 1
call fcn.0042b669
pop ecx
test al, al
jne 0x42b418
push 7
call fcn.0042c128
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.0042b634
mov byte [ebp - 0x24], al
mov eax, dword [0x4af4b0]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x42b411
test eax, eax
jne 0x42b482
mov dword [0x4af4b0], ecx
push 0x485444
push 0x485420
call fcn.004515cb
pop ecx
pop ecx
test eax, eax
je 0x42b465
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x42b561
push 0x48541c
push 0x4853d8
call fcn.0045156f
pop ecx
pop ecx
mov dword [0x4af4b0], 2
jmp 0x42b487
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.0042b7d6
pop ecx
call fcn.0042c11c
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x42b4b7
push esi
call fcn.0042b74c
pop ecx
test al, al
je 0x42b4b7
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.0042bdc5
call esi
call fcn.0042c122
mov esi, eax
cmp dword [esi], edi
je 0x42b4d5
push esi
call fcn.0042b74c
pop ecx
test al, al
je 0x42b4d5
push dword [esi]
call fcn.00449e44
pop ecx
call fcn.0044b7c7
mov edi, dword [eax]
call fcn.0044b7c1
mov esi, eax
call fcn.00451556
push eax
push edi
push dword [esi]
call main
add esp, 0xc
mov esi, eax
call fcn.0042c244
test al, al
jne 0x42b505
push esi
call fcn.00449e7c
test bl, bl
jne 0x42b50e
call fcn.00449e1f
push 0
push 1
call fcn.0042b7f3
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x42b561
call fcn.0042c386
ret
call fcn.0042c067
jmp 0x42b3f9

Function at 0x42e038
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x4451ea
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x4892e4
push 0x4892dc
push str.FlsAlloc
push 0
call fcn.0044516a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x44521c
push dword [ebp + 8]
mov ecx, esi
call fcn.0042bdc5
call esi
pop esi
pop ebp
ret
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsAlloc]
Function at 0x44525e
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x4892f4
push 0x4892ec
push str.FlsGetValue
push 2
call fcn.0044516a
add esp, 0x10
mov esi, eax
push dword [ebp + 8]
test esi, esi
je 0x44528f
mov ecx, esi
call fcn.0042bdc5
call esi
jmp 0x445295
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
pop esi
pop ebp
ret

Function at 0x445298
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x4892fc
push 0x4892f4
push str.FlsSetValue
push 3
call fcn.0044516a
add esp, 0x10
mov esi, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
test esi, esi
je 0x4452cc
mov ecx, esi
call fcn.0042bdc5
call esi
jmp 0x4452d2
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
pop ebp
ret

Function at 0x44d3bd
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
and eax, 0x3f
mov edx, dword [ebp + 0xc]
push ebx
sar ecx, 6
push esi
push edi
imul edi, eax, 0x30
mov eax, dword [ecx*4 + 0x4afd10]
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x44d3fe
cmp byte [edx], 0xa
jne 0x44d3fe
or byte [eax + edi + 0x28], 4
jmp 0x44d403
and byte [eax + edi + 0x28], 0xfb
lea eax, [edx + ecx]
mov ebx, edx
mov dword [ebp - 8], eax
mov esi, edx
cmp edx, eax
jae 0x44d4f4
mov al, byte [ebx]
cmp al, 0x1a
je 0x44d4d5
cmp al, 0xd
je 0x44d42c
mov byte [esi], al
inc esi
inc ebx
jmp 0x44d4ca
lea eax, [ebx + 1]
cmp eax, dword [ebp - 8]
jae 0x44d44c
cmp byte [eax], 0xa
jne 0x44d441
push 2
mov byte [esi], 0xa
pop eax
jmp 0x44d447
xor eax, eax
mov byte [esi], 0xd
inc eax
add ebx, eax
inc esi
jmp 0x44d4ca
push 0
mov ebx, eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x44d4c3
cmp dword [ebp - 0x14], 0
je 0x44d4c3
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x4afd10]
test byte [eax + edi + 0x28], 0x48
je 0x44d49a
mov dl, byte [ebp - 1]
cmp dl, 0xa
jne 0x44d48a
mov byte [esi], dl
jmp 0x44d4c6
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x4afd10]
mov byte [eax + edi + 0x2a], dl
jmp 0x44d4c6
cmp byte [ebp - 1], 0xa
jne 0x44d4ac
mov edx, dword [ebp + 0xc]
cmp esi, edx
jne 0x44d4ac
mov byte [esi], 0xa
jmp 0x44d449
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0044d378
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x44d4c7
mov byte [esi], 0xd
inc esi
mov edx, dword [ebp + 0xc]
cmp ebx, dword [ebp - 8]
jb 0x44d415
jmp 0x44d4f4
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x4afd10]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x44d4ef
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x44d4f4
mov cl, byte [ebx]
mov byte [esi], cl
inc esi
sub esi, edx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44d4ff
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
and eax, 0x3f
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
sar ecx, 6
imul edi, eax, 0x30
mov dword [ebp - 8], ecx
push 0xa
mov eax, dword [ecx*4 + 0x4afd10]
pop ebx
mov edx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], edx
mov edx, dword [ebp + 0xc]
test esi, esi
je 0x44d543
cmp word [edx], bx
jne 0x44d543
or byte [edi + eax + 0x28], 4
jmp 0x44d548
and byte [edi + eax + 0x28], 0xfb
lea eax, [edx + esi*2]
mov ebx, edx
mov dword [ebp - 0xc], eax
mov esi, edx
cmp edx, eax
jae 0x44d69c
mov dword [ebp - 0x10], 0xd
movzx eax, word [ebx]
cmp eax, 0x1a
je 0x44d67c
cmp ax, word [ebp - 0x10]
je 0x44d581
mov word [esi], ax
add esi, 2
add ebx, 2
jmp 0x44d671
lea eax, [ebx + 2]
cmp eax, dword [ebp - 0xc]
jae 0x44d5a7
push 0xa
pop ecx
cmp word [eax], cx
jne 0x44d597
push ecx
pop eax
push 4
jmp 0x44d59c
push 0xd
pop eax
push 2
mov word [esi], ax
pop eax
add ebx, eax
jmp 0x44d66b
push 0
mov ebx, eax
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x44d662
cmp dword [ebp - 0x18], 0
je 0x44d662
mov ecx, dword [ebp - 8]
push 0xa
mov eax, dword [ecx*4 + 0x4afd10]
test byte [edi + eax + 0x28], 0x48
pop eax
je 0x44d62e
mov dx, word [ebp - 4]
cmp dx, ax
jne 0x44d5f2
mov word [esi], ax
jmp 0x44d626
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ecx*4 + 0x4afd10]
mov word [ebp - 0x20], dx
push 0xa
mov byte [edi + eax + 0x2a], dl
mov ecx, dword [ecx*4 + 0x4afd10]
mov al, byte [ebp - 0x1f]
pop edx
mov byte [edi + ecx + 0x2b], al
mov ecx, dword [ebp - 8]
mov eax, dword [ecx*4 + 0x4afd10]
mov byte [edi + eax + 0x2c], dl
mov edx, dword [ebp + 0xc]
add esi, 2
jmp 0x44d671
cmp word [ebp - 4], ax
jne 0x44d643
mov edx, dword [ebp + 0xc]
cmp esi, edx
jne 0x44d643
mov word [esi], ax
add esi, 2
jmp 0x44d671
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0044d378
mov edx, dword [ebp + 0xc]
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x44d66e
jmp 0x44d665
mov edx, dword [ebp + 0xc]
push 0xd
pop eax
mov word [esi], ax
add esi, 2
mov ecx, dword [ebp - 8]
cmp ebx, dword [ebp - 0xc]
jb 0x44d561
jmp 0x44d69c
mov ecx, dword [ecx*4 + 0x4afd10]
mov al, byte [edi + ecx + 0x28]
test al, 0x40
jne 0x44d693
or al, 2
mov byte [edi + ecx + 0x28], al
jmp 0x44d69c
mov cx, word [ebx]
mov word [esi], cx
add esi, 2
sub esi, edx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x456b65
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004569e2

Function at 0x45b23a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045aedc