joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418d10
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x88
mov eax, dword [0x456130]
xor eax, esp
mov dword [esp + 0x84], eax
push ebx
push ebp
mov ebp, dword [esp + 0x94]
push esi
mov esi, dword [ebp + 0x3d0]
push edi
mov edi, dword [ebp]
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 0x80
mov edx, dword [esi + 0x154]
mov eax, dword [esi + 0x15c]
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esi + 0x14]
push 0
add edx, 4
push edx
push eax
push ecx
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [esi + 0x148], 0
mov dword [esi + 0x14c], eax
jne 0x418d99
mov edx, dword [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esi + 0xc8]
push ecx
call fcn.00430c80
mov edx, dword [esp + 0x1c]
add esp, 0xc
mov dword [esi + 0x148], edx
mov ecx, dword [esi + 0x14c]
cmp ecx, 4
jge 0x418dd4
push str.Received_too_short_packet
push edi
call fcn.0040e9d0
add esp, 8
mov dword [esi + 0xc], 7
xor eax, eax
mov ecx, dword [esp + 0x94]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00431acd
add esp, 0x88
ret
mov edx, dword [esi + 0x15c]
movzx eax, byte [edx]
movzx edx, byte [edx + 1]
shl ax, 8
movzx eax, ax
or eax, edx
mov dword [esi + 0xc], eax
add eax, 0xfffffffd
cmp eax, 3
ja case.default.0x418df9
jmp dword [eax*4 + 0x418f10]
cmp ecx, 4
jle case.0x418df9.4
mov eax, dword [esi + 0x15c]
movzx edx, byte [eax + 2]
movzx eax, byte [eax + 3]
shl dx, 8
movzx edx, dx
or edx, eax
movzx eax, word [esi + 0x40]
inc eax
and eax, 0xffff
cmp eax, edx
jne case.0x418df9.4
add ecx, 0xfffffffc
push ecx
mov ecx, dword [esi + 0x15c]
add ecx, 4
push ecx
push 1
push ebp
call fcn.0040ee10
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x418e64
mov ecx, 5
mov eax, esi
call fcn.00418c90
mov eax, ebx
jmp 0x418dbb
mov eax, dword [esi + 0x14c]
sub eax, 4
cdq
add dword [edi + 0x38], eax
mov eax, dword [edi + 0x38]
adc dword [edi + 0x3c], edx
mov edx, dword [edi + 0x3c]
push edx
push eax
push edi
call fcn.004266f0
jmp 0x418ee5
mov eax, dword [esi + 0x15c]
movzx ecx, byte [eax + 2]
movzx eax, byte [eax + 3]
shl cx, 8
movzx edx, cx
mov ecx, dword [esi + 0x15c]
add ecx, 4
push ecx
or edx, eax
push 0x449514
push edi
mov dword [esi + 8], edx
call fcn.0040e940
jmp 0x418ee5
mov edx, dword [esi + 0x15c]
add ecx, 0xfffffffe
push ecx
add edx, 2
push edx
push esi
call fcn.00417c10
add esp, 0xc
test eax, eax
je case.0x418df9.4
jmp 0x418dbb
push str.Internal_error:_Unexpected_packet
push 0x449374
push edi
call fcn.0040e9d0
add esp, 0xc
push ebp
call fcn.004267b0
add esp, 4
test eax, eax
je 0x418db9
mov ecx, 5
mov eax, esi
call fcn.00418c90
mov eax, 0x2a
jmp 0x418dbb
Function at 0x41ab60
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x456130]
xor eax, esp
mov dword [esp + 0x190], eax
lea eax, [esp]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x41ab95
push eax
push str.WSAStartup_failed___d_
push esi
call fcn.0040e9d0
add esp, 0xc
jmp 0x41abce
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [esp]
cmp al, 2
jne 0x41abc0
shr eax, 8
test al, al
jne 0x41abc0
xor eax, eax
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.00431acd
add esp, 0x194
ret
push str.insufficient_winsock_version_to_support_telnet
push esi
call fcn.0040e9d0
add esp, 8
mov ecx, dword [esp + 0x190]
xor ecx, esp
mov eax, 2
call fcn.00431acd
add esp, 0x194
ret

Function at 0x41ad60
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
mov edx, dword [edi + 0x130]
mov al, byte [esp + 8]
push esi
mov esi, dword [edi]
push 0
push 3
lea ecx, [esp + 0xc]
push ecx
push edx
mov byte [esp + 0x14], 0xff
mov byte [esp + 0x15], al
mov byte [esp + 0x16], bl
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x41ada4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push esi
call fcn.0040e9d0
add esp, 0xc
mov esi, dword [esp + 0xc]
mov ecx, dword [edi]
push str.SENT
mov eax, ebx
call fcn.0041ac60
add esp, 4
pop esi
pop ecx
ret
Function at 0x41ba30
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
cmp dword [esp + 0xc], 0x1f
mov eax, dword [esp + 8]
mov eax, dword [eax]
push ebx
mov ebx, dword [eax + 0x86bc]
mov dword [esp + 4], eax
jne 0x41bb98
push ebp
push esi
push edi
lea edi, [ebx + 0x1cb0]
lea ebp, [ebx + 0x1eb0]
mov dword [ebp], edi
cmp edi, ebp
jae 0x41ba69
mov byte [edi], 0xff
inc dword [ebp]
mov eax, dword [ebp]
cmp eax, ebp
jae 0x41ba76
mov byte [eax], 0xfa
inc dword [ebp]
mov eax, dword [ebp]
cmp eax, ebp
jae 0x41ba83
mov byte [eax], 0x1f
inc dword [ebp]
movzx ecx, word [ebx + 0x1ca8]
mov esi, dword [sym.imp.WS2_32.dll_htons]
push ecx
call esi
movzx edx, ax
movzx eax, word [ebx + 0x1caa]
push eax
mov dword [esp + 0x20], edx
call esi
movzx ecx, ax
mov eax, dword [ebp]
cmp eax, ebp
jae 0x41bab7
mov dl, byte [esp + 0x1c]
mov byte [eax], dl
inc dword [ebp]
mov eax, dword [ebp]
cmp eax, ebp
jae 0x41bac7
mov dl, byte [esp + 0x1d]
mov byte [eax], dl
inc dword [ebp]
mov eax, dword [ebp]
cmp eax, ebp
jae 0x41bad3
mov byte [eax], cl
inc dword [ebp]
mov eax, dword [ebp]
cmp eax, ebp
jae 0x41badf
mov byte [eax], ch
inc dword [ebp]
mov eax, dword [ebp]
cmp eax, ebp
jae 0x41baec
mov byte [eax], 0xff
inc dword [ebp]
mov eax, dword [ebp]
cmp eax, ebp
jae 0x41baf9
mov byte [eax], 0xf0
inc dword [ebp]
mov eax, dword [ebp]
mov esi, dword [esp + 0x10]
mov dword [ebx + 0x1eb4], eax
sub eax, edi
sub eax, 2
push eax
lea edx, [ebx + 0x1cb2]
push edx
push 0x3e
mov dword [ebp], edi
call fcn.0041afb0
mov ebp, dword [sym.imp.WS2_32.dll_send]
add esp, 0xc
push 0
push 3
push edi
mov edi, dword [esp + 0x24]
mov eax, dword [edi + 0x130]
push eax
call ebp
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jns 0x41bb57
call esi
mov ecx, dword [esp + 0x10]
push eax
push str.Sending_data_failed___d_
push ecx
call fcn.0040e9d0
add esp, 0xc
lea edx, [ebx + 0x1cb3]
push 4
push edx
call fcn.0041b810
mov eax, dword [edi + 0x130]
add esp, 8
push 0
push 2
add ebx, 0x1cb7
push ebx
push eax
call ebp
test eax, eax
jns 0x41bb95
call esi
mov ecx, dword [esp + 0x10]
push eax
push str.Sending_data_failed___d_
push ecx
call fcn.0040e9d0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x41c750
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x18
mov eax, dword [0x456130]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
mov ebx, dword [esi + 0x134]
push ebp
mov ebp, dword [esi]
push edi
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
push ebx
or edi, 0xffffffff
mov dword [esp + 0x18], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x41c7a4
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x14]
push eax
push ebx
mov dword [esp + 0x18], 0x10
call dword [sym.imp.WS2_32.dll_accept]
mov edi, eax
push ebx
push esi
call fcn.0040f890
add esp, 8
cmp edi, 0xffffffff
jne 0x41c7d8
push str.Error_accept__ing_server_connect
push ebp
call fcn.0040e9d0
add esp, 8
pop edi
pop ebp
mov eax, 0x1e
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.00431acd
add esp, 0x18
ret
push str.Connection_accepted_from_server_n
push ebp
call fcn.0040e940
push 1
push edi
mov dword [esi + 0x134], edi
call fcn.0042a490
mov ecx, dword [esp + 0x30]
add esp, 0x10
pop edi
pop ebp
pop ebx
xor ecx, esp
mov dword [esi + 0x13c], 1
xor eax, eax
call fcn.00431acd
add esp, 0x18
ret
Function at 0x41d7f0
Capabilities:
Check http status code

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, eax
mov ebx, dword [esi]
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
push edi
add eax, edx
xor edi, edi
cmp eax, 2
je 0x41d82a
push str.Couldnt_set_desired_mode
push ebx
call fcn.0040e9d0
add esp, 8
lea eax, [edi + 0x11]
pop edi
pop esi
pop ebp
pop ebx
ret
cmp ecx, 0xc8
je 0x41d841
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push ebx
call fcn.0040e940
add esp, 0xc
cmp ebp, 0x13
jne 0x41d852
call fcn.0041d3b0
mov edi, eax
pop edi
pop esi
pop ebp
pop ebx
ret
cmp ebp, 0x14
jne 0x41d867
push esi
call fcn.0041d420
add esp, 4
mov edi, eax
pop edi
pop esi
pop ebp
pop ebx
ret
cmp ebp, 0x15
jne 0x41d880
push 0xd
push 1
push esi
call fcn.00420110
add esp, 0xc
mov edi, eax
pop edi
pop esi
pop ebp
pop ebx
ret
cmp ebp, 0x16
jne 0x41d894
push 0xe
push 1
push esi
call fcn.00420110
add esp, 0xc
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x427930
Capabilities:
Parse pe header

Disassembly:
mov al, byte [esp + 4]
movsx ecx, al
add ecx, 0xffffff9f
cmp ecx, 0x19
ja case.default.0x42793f
jmp dword [ecx*4 + 0x427994]
mov al, 0x41
ret
mov al, 0x42
ret
mov al, 0x43
ret
mov al, 0x44
ret
mov al, 0x45
ret
mov al, 0x46
ret
mov al, 0x47
ret
mov al, 0x48
ret
mov al, 0x49
ret
mov al, 0x4a
ret
mov al, 0x4b
ret
mov al, 0x4c
ret
mov al, 0x4d
ret
mov al, 0x4e
ret
mov al, 0x4f
ret
mov al, 0x50
ret
mov al, 0x51
ret
mov al, 0x52
ret
mov al, 0x53
ret
mov al, 0x54
ret
mov al, 0x55
ret
mov al, 0x56
ret
mov al, 0x57
ret
mov al, 0x58
ret
mov al, 0x59
ret
mov al, 0x5a
ret
Function at 0x427a00
Capabilities:
Parse pe header

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
mov cl, byte [edi]
test cl, cl
je 0x427b1f
mov al, byte [esi]
test al, al
je 0x427b1f
movsx edx, cl
add edx, 0xffffff9f
cmp edx, 0x19
ja case.default.0x427a29
jmp dword [edx*4 + 0x427b44]
mov cl, 0x41
jmp case.default.0x427a29
mov cl, 0x42
jmp case.default.0x427a29
mov cl, 0x43
jmp case.default.0x427a29
mov cl, 0x44
jmp case.default.0x427a29
mov cl, 0x45
jmp case.default.0x427a29
mov cl, 0x46
jmp case.default.0x427a29
mov cl, 0x47
jmp case.default.0x427a29
mov cl, 0x48
jmp case.default.0x427a29
mov cl, 0x49
jmp case.default.0x427a29
mov cl, 0x4a
jmp case.default.0x427a29
mov cl, 0x4b
jmp case.default.0x427a29
mov cl, 0x4c
jmp case.default.0x427a29
mov cl, 0x4d
jmp case.default.0x427a29
mov cl, 0x4e
jmp case.default.0x427a29
mov cl, 0x4f
jmp case.default.0x427a29
mov cl, 0x50
jmp case.default.0x427a29
mov cl, 0x51
jmp case.default.0x427a29
mov cl, 0x52
jmp case.default.0x427a29
mov cl, 0x53
jmp case.default.0x427a29
mov cl, 0x54
jmp case.default.0x427a29
mov cl, 0x55
jmp case.default.0x427a29
mov cl, 0x56
jmp case.default.0x427a29
mov cl, 0x57
jmp case.default.0x427a29
mov cl, 0x58
jmp case.default.0x427a29
mov cl, 0x59
jmp case.default.0x427a29
mov cl, 0x5a
movsx edx, al
add edx, 0xffffff9f
cmp edx, 0x19
ja case.default.0x427aa1
jmp dword [edx*4 + 0x427bac]
mov al, 0x41
jmp case.default.0x427aa1
mov al, 0x42
jmp case.default.0x427aa1
mov al, 0x43
jmp case.default.0x427aa1
mov al, 0x44
jmp case.default.0x427aa1
mov al, 0x45
jmp case.default.0x427aa1
mov al, 0x46
jmp case.default.0x427aa1
mov al, 0x47
jmp case.default.0x427aa1
mov al, 0x48
jmp case.default.0x427aa1
mov al, 0x49
jmp case.default.0x427aa1
mov al, 0x4a
jmp case.default.0x427aa1
mov al, 0x4b
jmp case.default.0x427aa1
mov al, 0x4c
jmp case.default.0x427aa1
mov al, 0x4d
jmp case.default.0x427aa1
mov al, 0x4e
jmp case.default.0x427aa1
mov al, 0x4f
jmp case.default.0x427aa1
mov al, 0x50
jmp case.default.0x427aa1
mov al, 0x51
jmp case.default.0x427aa1
mov al, 0x52
jmp case.default.0x427aa1
mov al, 0x53
jmp case.default.0x427aa1
mov al, 0x54
jmp case.default.0x427aa1
mov al, 0x55
jmp case.default.0x427aa1
mov al, 0x56
jmp case.default.0x427aa1
mov al, 0x57
jmp case.default.0x427aa1
mov al, 0x58
jmp case.default.0x427aa1
mov al, 0x59
jmp case.default.0x427aa1
mov al, 0x5a
cmp cl, al
jne 0x427b1f
mov cl, byte [edi + 1]
inc edi
inc esi
test cl, cl
jne 0x427a14
movzx eax, byte [edi]
push eax
call fcn.00427930
mov dl, al
movzx eax, byte [esi]
push eax
call fcn.00427930
add esp, 8
xor ecx, ecx
cmp dl, al
sete cl
pop edi
pop esi
mov eax, ecx
ret
Function at 0x427c20
Capabilities:
Parse pe header

Disassembly:
push ebx
mov ebx, dword [esp + 8]
mov cl, byte [ebx]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x18]
test cl, cl
je 0x427d54
lea esp, [esp]
mov al, byte [esi]
test al, al
je 0x427d54
test edi, edi
je 0x427d58
movsx edx, cl
add edx, 0xffffff9f
cmp edx, 0x19
ja case.default.0x427c5d
jmp dword [edx*4 + 0x427d88]
mov cl, 0x41
jmp case.default.0x427c5d
mov cl, 0x42
jmp case.default.0x427c5d
mov cl, 0x43
jmp case.default.0x427c5d
mov cl, 0x44
jmp case.default.0x427c5d
mov cl, 0x45
jmp case.default.0x427c5d
mov cl, 0x46
jmp case.default.0x427c5d
mov cl, 0x47
jmp case.default.0x427c5d
mov cl, 0x48
jmp case.default.0x427c5d
mov cl, 0x49
jmp case.default.0x427c5d
mov cl, 0x4a
jmp case.default.0x427c5d
mov cl, 0x4b
jmp case.default.0x427c5d
mov cl, 0x4c
jmp case.default.0x427c5d
mov cl, 0x4d
jmp case.default.0x427c5d
mov cl, 0x4e
jmp case.default.0x427c5d
mov cl, 0x4f
jmp case.default.0x427c5d
mov cl, 0x50
jmp case.default.0x427c5d
mov cl, 0x51
jmp case.default.0x427c5d
mov cl, 0x52
jmp case.default.0x427c5d
mov cl, 0x53
jmp case.default.0x427c5d
mov cl, 0x54
jmp case.default.0x427c5d
mov cl, 0x55
jmp case.default.0x427c5d
mov cl, 0x56
jmp case.default.0x427c5d
mov cl, 0x57
jmp case.default.0x427c5d
mov cl, 0x58
jmp case.default.0x427c5d
mov cl, 0x59
jmp case.default.0x427c5d
mov cl, 0x5a
movsx edx, al
add edx, 0xffffff9f
cmp edx, 0x19
ja case.default.0x427cd5
jmp dword [edx*4 + 0x427df0]
mov al, 0x41
jmp case.default.0x427cd5
mov al, 0x42
jmp case.default.0x427cd5
mov al, 0x43
jmp case.default.0x427cd5
mov al, 0x44
jmp case.default.0x427cd5
mov al, 0x45
jmp case.default.0x427cd5
mov al, 0x46
jmp case.default.0x427cd5
mov al, 0x47
jmp case.default.0x427cd5
mov al, 0x48
jmp case.default.0x427cd5
mov al, 0x49
jmp case.default.0x427cd5
mov al, 0x4a
jmp case.default.0x427cd5
mov al, 0x4b
jmp case.default.0x427cd5
mov al, 0x4c
jmp case.default.0x427cd5
mov al, 0x4d
jmp case.default.0x427cd5
mov al, 0x4e
jmp case.default.0x427cd5
mov al, 0x4f
jmp case.default.0x427cd5
mov al, 0x50
jmp case.default.0x427cd5
mov al, 0x51
jmp case.default.0x427cd5
mov al, 0x52
jmp case.default.0x427cd5
mov al, 0x53
jmp case.default.0x427cd5
mov al, 0x54
jmp case.default.0x427cd5
mov al, 0x55
jmp case.default.0x427cd5
mov al, 0x56
jmp case.default.0x427cd5
mov al, 0x57
jmp case.default.0x427cd5
mov al, 0x58
jmp case.default.0x427cd5
mov al, 0x59
jmp case.default.0x427cd5
mov al, 0x5a
cmp cl, al
jne 0x427d54
mov cl, byte [ebx + 1]
inc ebx
dec edi
inc esi
test cl, cl
jne 0x427c40
test edi, edi
jne 0x427d61
pop edi
pop esi
mov eax, 1
pop ebx
ret
movzx eax, byte [ebx]
push eax
call fcn.00427930
mov dl, al
movzx eax, byte [esi]
push eax
call fcn.00427930
add esp, 8
xor ecx, ecx
cmp dl, al
sete cl
pop edi
pop esi
pop ebx
mov eax, ecx
ret
Function at 0x427e60
Capabilities:
Parse pe header

Disassembly:
push edi
mov edi, dword [esp + 0x10]
cmp edi, 1
jb 0x427f0c
mov edx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
sub esi, edx
lea esp, [esp]
mov al, byte [edx]
movsx ecx, al
add ecx, 0xffffff9f
cmp ecx, 0x19
ja case.default.0x427e8d
jmp dword [ecx*4 + 0x427f10]
mov al, 0x41
jmp case.default.0x427e8d
mov al, 0x42
jmp case.default.0x427e8d
mov al, 0x43
jmp case.default.0x427e8d
mov al, 0x44
jmp case.default.0x427e8d
mov al, 0x45
jmp case.default.0x427e8d
mov al, 0x46
jmp case.default.0x427e8d
mov al, 0x47
jmp case.default.0x427e8d
mov al, 0x48
jmp case.default.0x427e8d
mov al, 0x49
jmp case.default.0x427e8d
mov al, 0x4a
jmp case.default.0x427e8d
mov al, 0x4b
jmp case.default.0x427e8d
mov al, 0x4c
jmp case.default.0x427e8d
mov al, 0x4d
jmp case.default.0x427e8d
mov al, 0x4e
jmp case.default.0x427e8d
mov al, 0x4f
jmp case.default.0x427e8d
mov al, 0x50
jmp case.default.0x427e8d
mov al, 0x51
jmp case.default.0x427e8d
mov al, 0x52
jmp case.default.0x427e8d
mov al, 0x53
jmp case.default.0x427e8d
mov al, 0x54
jmp case.default.0x427e8d
mov al, 0x55
jmp case.default.0x427e8d
mov al, 0x56
jmp case.default.0x427e8d
mov al, 0x57
jmp case.default.0x427e8d
mov al, 0x58
jmp case.default.0x427e8d
mov al, 0x59
jmp case.default.0x427e8d
mov al, 0x5a
mov byte [esi + edx], al
mov al, byte [edx]
inc edx
test al, al
je 0x427f0b
dec edi
jne 0x427e80
pop esi
pop edi
ret

Function at 0x427f80
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x456130]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call fcn.0043589f
add esp, 4
mov byte [esp], 0
test eax, eax
je 0x427fe5
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [esp], 0
je 0x427fe5
lea edx, [esp]
push edx
call dword [0x456064]
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.00431acd
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor ecx, esp
xor eax, eax
call fcn.00431acd
add esp, 0x108
ret

Function at 0x42a7b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [eax + 0x2c]
push esi
push edi
mov edi, dword [ebx]
mov esi, dword [edi + 0x1e0]
test esi, esi
jne 0x42a7c9
mov esi, dword [eax + 0x28]
mov ecx, dword [eax + 0x24]
mov edx, dword [eax + 0x20]
push ecx
push edx
call fcn.004130d0
push edx
push eax
call fcn.00413100
add esp, 0x10
sub esi, eax
cmp dword [edi + 0x1d4], 0
je 0x42a816
mov eax, dword [ebx + 0x124]
mov ecx, dword [ebx + 0x120]
push eax
push ecx
call fcn.004130d0
push edx
push eax
call fcn.00413100
mov ecx, dword [edi + 0x1d4]
sub ecx, eax
add esp, 0x10
mov eax, ecx
cmp esi, ecx
jge 0x42a818
mov eax, esi
pop edi
pop esi
pop ebx
ret
Function at 0x42b170
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea eax, [ecx + eax*2 + 0xc]
push edi
push eax
call dword [0x456058]
mov edi, eax
add esp, 4
test edi, edi
jne 0x42b195
pop edi
pop esi
pop ecx
ret
lea eax, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], eax
mov edx, dword [esi + 0xc]
push ebx
add edx, eax
push ebp
mov ebp, dword [esp + 0x20]
mov dword [edi + 8], edx
cmp ebp, dword [esi + 0x10]
jbe 0x42b1dc
push eax
mov eax, dword [esi]
call eax
mov ecx, dword [esp + 0x20]
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push ebp
push ecx
push edx
call eax
mov ebx, dword [edi + 8]
mov ecx, dword [edi + 4]
add ebx, dword [esi + 0xc]
mov edx, dword [esi + 8]
push ecx
push ebx
call edx
mov ebp, dword [esi + 0x14]
add esp, 0x18
jmp 0x42b1e0
mov ebx, dword [esp + 0x1c]
mov eax, dword [edi + 4]
mov ecx, dword [esi]
push eax
call ecx
mov edx, dword [edi + 8]
mov eax, dword [esi]
push edx
call eax
add esp, 8
mov dword [esp + 0x10], 0
test ebp, ebp
je 0x42b23c
mov dword [esp + 0x10], ebp
mov cl, byte [ebx]
xor cl, 0x36
mov byte [esp + 0x18], cl
mov eax, dword [edi + 4]
mov ecx, dword [esi + 4]
push 1
lea edx, [esp + 0x1c]
push edx
push eax
call ecx
mov dl, byte [ebx]
xor dl, 0x5c
mov byte [esp + 0x24], dl
mov ecx, dword [edi + 8]
mov edx, dword [esi + 4]
push 1
lea eax, [esp + 0x28]
push eax
push ecx
inc ebx
call edx
add esp, 0x18
dec ebp
jne 0x42b203
mov eax, dword [esp + 0x10]
pop ebp
pop ebx
cmp eax, dword [esi + 0x10]
jae 0x42b278
mov ecx, dword [edi + 4]
mov edx, dword [esi + 4]
push 1
push 0x44eebc
push ecx
call edx
mov eax, dword [edi + 8]
mov ecx, dword [esi + 4]
push 1
push 0x44eebd
push eax
call ecx
mov eax, dword [esp + 0x20]
inc eax
add esp, 0x18
mov dword [esp + 8], eax
cmp eax, dword [esi + 0x10]
jb 0x42b247
mov eax, edi
pop edi
pop esi
pop ecx
ret

Function at 0x42bc10
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x5c
mov eax, dword [0x456130]
xor eax, esp
mov dword [esp + 0x58], eax
push esi
mov esi, dword [esp + 0x68]
mov eax, esi
push edi
mov edi, dword [esp + 0x68]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 8], 0x67452301
mov dword [esp + 0xc], 0xefcdab89
mov dword [esp + 0x10], 0x98badcfe
mov dword [esp + 0x14], 0x10325476
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42bc60
sub eax, edx
push eax
call fcn.00413180
push eax
lea eax, [esp + 0x10]
push esi
push eax
call fcn.0042ba90
lea ecx, [esp + 0x18]
push ecx
push edi
call fcn.0042bb30
mov ecx, dword [esp + 0x78]
add esp, 0x18
pop edi
pop esi
xor ecx, esp
call fcn.00431acd
add esp, 0x5c
ret

Function at 0x42bca0
Capabilities:
Get hostname

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push esi
mov byte [esi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [esi + edi - 1], 0
test eax, eax
jne 0x42bcd2
push 0x2e
push esi
call fcn.00433200
add esp, 8
test eax, eax
je 0x42bcd0
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
ret
Function at 0x42cde0
Capabilities:
Read file on windows

Disassembly:
push edi
mov edi, eax
mov eax, dword [esi]
cmp dword [eax + 4], 2
jne 0x42ce02
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x42cdf6
xor eax, eax
pop edi
ret
mov eax, dword [eax + 8]
push eax
push edi
push 1
push ebx
call ecx
jmp 0x42ce32
cmp dword [esi + 8], 0
jne 0x42ce25
mov ecx, dword [eax + 8]
push 0x44f00c
push ecx
call fcn.00434726
add esp, 8
mov dword [esi + 8], eax
test eax, eax
jne 0x42ce25
or eax, 0xffffffff
pop edi
ret
mov edx, dword [esi + 8]
push edx
push edi
push 1
push ebx
call fcn.00433508
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x42ce54
mov eax, dword [esi + 8]
test eax, eax
je 0x42ce4e
push eax
call fcn.00431d38
add esp, 4
mov dword [esi + 8], edi
mov eax, dword [esi]
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, edi
pop edi
ret
Function at 0x431acd
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x456130]
jne 0x431ad7
repz ret
jmp fcn.0043786c

Function at 0x442b8d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x456130]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00437260
and dword [ebp - 0x14], 0
cmp dword [0x458364], 0
mov dword [ebp - 0x18], eax
jne 0x442c40
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x442ce8
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x442ce8
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x458364], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x458368], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x45836c], eax
call edi
push eax
call esi
mov dword [0x458374], eax
test eax, eax
je 0x442c40
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x458370], eax
mov eax, dword [0x458370]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x442c99
cmp dword [0x458374], ecx
je 0x442c99
push eax
call esi
push dword [0x458374]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x442c99
test ebx, ebx
je 0x442c99
call edi
test eax, eax
je 0x442c90
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x442c90
test byte [ebp - 8], 1
jne 0x442c99
or dword [ebp + 0x10], 0x200000
jmp 0x442ccc
mov eax, dword [0x458368]
cmp eax, dword [ebp - 0x18]
je 0x442ccc
push eax
call esi
test eax, eax
je 0x442ccc
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x442ccc
mov eax, dword [0x45836c]
cmp eax, dword [ebp - 0x18]
je 0x442ccc
push eax
call esi
test eax, eax
je 0x442ccc
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x458364]
call esi
test eax, eax
je 0x442ce8
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x442cea
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00431acd
leave
ret