joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46dbb0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0xffffffffffffffff
push 0x4d2748
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push 0
push 0x5746dc
lea ecx, [esp + 0x14]
call fcn.004a2dfe
push 0xfa
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0
call fcn.004a2d8f
test eax, eax
jne 0x46dc16
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 0xffffffff
call fcn.004a2da4
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret 0xc
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x14], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x10], eax
mov eax, dword [0x51174c]
test eax, eax
jne 0x46dc64
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 0xffffffff
call fcn.004a2da4
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 0xc
mov eax, dword [esp + 0x18]
test eax, eax
je 0x46ddf5
mov ecx, dword [eax]
mov ebp, dword [eax + 8]
mov eax, dword [ebp + 0x74]
test eax, eax
mov dword [esp + 0x18], ecx
je 0x46dde4
mov edx, dword [ebp]
mov ecx, ebp
call dword [edx + 0x24]
test eax, eax
je 0x46dde4
mov eax, dword [ebp + 0x1c]
test eax, eax
ja 0x46dde4
jb 0x46dcad
mov eax, dword [ebp + 0x18]
or esi, 0xffffffff
cmp eax, esi
jae 0x46dde4
jmp 0x46dcb0
or esi, 0xffffffff
mov eax, dword [ebp]
mov ecx, ebp
call dword [eax + 0x1c]
test eax, eax
jne 0x46dde4
cmp dword [ebp + 0x1c], esi
ja 0x46dcda
jb 0x46dccc
cmp dword [ebp + 0x18], esi
jae 0x46dcda
mov eax, dword [ebp + 0x308]
test eax, eax
je 0x46dde4
mov edi, dword [esp + 0x38]
lea ebx, [ebp + 0x78]
add edi, 0x74
mov ecx, 4
mov esi, ebx
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
je 0x46dde4
mov edi, dword [esp + 0x40]
test edi, edi
mov ecx, dword [0x534304]
je 0x46dd0b
mov eax, dword [ebp + 0x3b4]
jmp 0x46dd11
mov eax, dword [ebp + 0x3b8]
add eax, ecx
cmp dword [esp + 0x10], eax
jbe 0x46dde4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp + 0xb0]
xor esi, esi
test edx, edx
je 0x46dd4c
nop
mov ecx, dword [edx + 0x90]
cmp ecx, eax
jb 0x46dd44
sub ecx, eax
cmp ecx, 0xdbba0
ja 0x46dd45
inc esi
mov edx, dword [edx + 0x10]
test edx, edx
jne 0x46dd30
mov eax, dword [0x534470]
cdq
and edx, 3
add eax, edx
sar eax, 2
cmp esi, eax
jge 0x46dde4
mov eax, dword [0x5343ec]
mov ecx, dword [ebp + 0xf4]
xor edx, edx
cmp esi, eax
mov eax, dword [esp + 0x10]
setl dl
cmp eax, ecx
jbe 0x46dd80
sub eax, ecx
jmp 0x46dd82
xor eax, eax
mov ecx, dword [0x5343fc]
imul ecx, ecx, 0x3e8
cmp ecx, eax
sbb eax, eax
neg eax
test edx, edx
jne 0x46dda3
test eax, eax
jne 0x46dda3
cmp dword [esp + 0x14], 0xa
jge 0x46dde4
push 0x10
push ebx
mov ebx, dword [esp + 0x44]
call fcn.00405b60
mov edx, dword [ebp + 0x18]
push edx
call fcn.00416090
test edi, edi
je 0x46ddc8
mov eax, dword [esp + 0x10]
mov dword [ebp + 0x3b4], eax
jmp 0x46ddd2
mov ecx, dword [esp + 0x10]
mov dword [ebp + 0x3b8], ecx
mov eax, dword [esp + 0x14]
inc eax
cmp eax, 0x20
mov dword [esp + 0x14], eax
jge 0x46dc35
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x46dc60
jmp 0x46dc35
call fcn.004bcac3
int3
Function at 0x4780b0
Capabilities:
Set socket configuration

Disassembly:
push 0xffffffffffffffff
push 0x4cf606
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x5129cc]
push ebx
push esi
push edi
mov ebx, ecx
lea edx, [eax + 8]
mov esi, eax
call fcn.00470740
lea edx, [esi + 0x1024]
call fcn.00470740
push ebx
mov ecx, 0x512990
call fcn.00461a00
mov eax, dword [ebx + 0x4b8]
xor esi, esi
sub eax, esi
je 0x478128
dec eax
je 0x478115
dec eax
jne 0x478139
mov dword [ebx + 0x38], 0x534164
mov dword [ebx + 0x258], 0x534168
jmp 0x478139
mov dword [ebx + 0x38], 0x53415c
mov dword [ebx + 0x258], 0x534160
jmp 0x478139
mov dword [ebx + 0x38], 0x53416c
mov dword [ebx + 0x258], 0x534170
cmp dword [ebx + 0x534], esi
je 0x47816b
push 0x14
call fcn.004be8d8
add esp, 4
cmp eax, esi
je 0x478163
mov dword [eax], 0x4db048
mov dword [eax + 4], esi
mov dword [eax + 8], esi
mov dword [eax + 0x10], esi
mov dword [eax + 0xc], esi
jmp 0x478165
xor eax, eax
mov dword [ebx + 0x500], eax
cmp dword [ebx + 0x538], esi
je 0x47819d
push 0x14
call fcn.004be8d8
add esp, 4
cmp eax, esi
je 0x478195
mov dword [eax], 0x4db048
mov dword [eax + 4], esi
mov dword [eax + 8], esi
mov dword [eax + 0x10], esi
mov dword [eax + 0xc], esi
jmp 0x478197
xor eax, eax
mov dword [ebx + 0x504], eax
cmp dword [0x534138], esi
je 0x4781c0
mov eax, dword [ebx + 0x24]
push 4
push 0x534138
push 0x1001
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
mov eax, dword [ebx + 0x488]
cmp eax, 2
je 0x47820d
cmp dword [ebx + 0x52c], esi
je 0x4781e0
cmp dword [ebx + 0x530], esi
je 0x4781e0
cmp eax, 1
jne 0x47820d
push 0x56c
mov dword [ebx + 0x4b4], esi
call fcn.004be8d8
add esp, 4
mov dword [esp + 0xc], eax
cmp eax, esi
mov dword [esp + 0x18], 1
je 0x47823a
push eax
mov ecx, ebx
call fcn.00441740
jmp 0x47823c
push 0x578
mov dword [ebx + 0x4bc], 1
call fcn.004be8d8
add esp, 4
mov dword [esp + 0xc], eax
cmp eax, esi
mov dword [esp + 0x18], esi
je 0x47823a
push eax
mov ecx, ebx
call fcn.00443950
jmp 0x47823c
xor eax, eax
mov dword [esp + 0x18], 0xffffffff
mov edi, eax
mov eax, dword [ebx + 0x4b8]
cmp eax, 1
jne 0x478277
push 0x3f1a
push 0x534540
xor eax, eax
call fcn.00478c60
mov edi, dword [edi + 0x488]
add esp, 8
mov eax, 0x512990
call fcn.00461e50
jmp 0x478294
cmp eax, 2
jne 0x478294
mov ecx, dword [ebx + 0x14]
push ecx
push 0x3f1b
push 0x534540
xor eax, eax
call fcn.00478c60
add esp, 0xc
mov dword [ebx + 0x500], esi
mov dword [ebx + 0x504], esi
mov edx, dword [ebx]
push 1
mov ecx, ebx
call dword [edx]
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x483780
Capabilities:
Access peb ldr_data
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4d2748
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
push edi
push 1
mov esi, ecx
push 0x57467c
lea ecx, [esp + 0x14]
mov edi, edx
call fcn.004a2dfe
mov dword [esp + 0x20], 0
mov dword [esi], 0
mov dword [esi + 4], 0
cmp dword [edi + 0xc], 0xffffffff
jne 0x4837ef
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 0xffffffff
call fcn.004a2da4
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x14
mov eax, dword [edi + 0x98]
test eax, eax
jle 0x4837fe
call fcn.00483a60
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
push 0
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0x10], eax
mov eax, dword [edi + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
mov eax, dword [edi + 0xc]
push 0
push esi
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
lea ecx, [esp + 0xc]
mov esi, eax
mov dword [esp + 0x20], 0xffffffff
call fcn.004a2da4
mov ecx, dword [esp + 0x18]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x14
Function at 0x483860
Capabilities:
Get file size
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4d2748
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push edi
push 1
mov edi, ecx
push 0x57467c
lea ecx, [esp + 0x20]
call fcn.004a2dfe
mov ebx, dword [esp + 0x48]
xor ecx, ecx
mov dword [esp + 0x2c], ecx
mov dword [ebx], ecx
mov dword [ebx + 4], ecx
mov eax, dword [edi + 0xc]
or edx, 0xffffffff
cmp eax, edx
jne 0x4838c7
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], edx
call fcn.004a2da4
pop edi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 0x18
push esi
cmp dword [edi + 0x10], ecx
jne 0x4838f0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], edx
call fcn.004a2da4
pop esi
pop edi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 0x18
mov esi, dword [esp + 0x38]
push ebp
mov ebp, dword [esp + 0x40]
cmp ebp, ecx
ja 0x483909
cmp esi, 0x1400000
jbe 0x483a03
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [esp + 0x10]
xor ecx, ecx
or ecx, edx
cmp ebp, ecx
jb 0x483a01
ja 0x483933
cmp esi, eax
jbe 0x483a01
mov edx, esi
sub edx, eax
mov eax, ebp
sbb eax, ecx
mov dword [esp + 0x1c], eax
jne 0x48394d
cmp edx, 0x1400000
jbe 0x483a01
mov eax, 0x574678
call fcn.00483360
cmp dword [edi + 0x98], 8
jl 0x483965
call fcn.00483a60
mov eax, dword [edi + 0x98]
mov ecx, eax
shl ecx, 4
lea ebx, [ecx + edi + 0x18]
inc eax
mov dword [edi + 0x98], eax
mov dword [ebx + 4], ebp
mov ebp, dword [esp + 0x48]
push ebp
mov dword [ebx], esi
mov dword [ebx + 8], ebp
call fcn.004be903
mov esi, dword [esp + 0x48]
mov dword [ebx + 0xc], eax
mov ecx, ebp
mov edx, ecx
shr ecx, 2
mov edi, eax
mov eax, dword [esp + 0x50]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, dword [esp + 0x40]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x54]
mov dword [ecx + 4], eax
mov dword [ecx], ebp
mov ecx, dword [esp + 0x44]
push ecx
push edx
push eax
push ebp
push str.Deferred_write_of__I64i_bytes_at__I64i
push 0x534540
mov eax, 4
call fcn.00478d50
add esp, 0x1c
lea ecx, [esp + 0x20]
mov dword [esp + 0x34], 0xffffffff
call fcn.004a2da4
pop ebp
pop esi
pop edi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 0x18
xor ecx, ecx
push ecx
mov ecx, dword [edi + 0xc]
lea eax, [esp + 0x18]
push eax
push esi
push ecx
mov dword [esp + 0x24], ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [esp + 0x48]
mov eax, dword [esp + 0x44]
mov ecx, dword [edi + 0xc]
push 0
push ebx
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [esp + 0x20]
mov esi, eax
mov dword [esp + 0x34], 0xffffffff
call fcn.004a2da4
mov ecx, dword [esp + 0x2c]
pop ebp
mov eax, esi
pop esi
pop edi
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 0x18
Function at 0x483a60
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [edi + 0x98]
sub esp, 8
test eax, eax
je 0x483b41
cmp dword [edi + 0xc], 0xffffffff
je 0x483b41
mov ecx, dword [edi + 0x10]
test ecx, ecx
je 0x483b41
push ebx
xor ebx, ebx
test eax, eax
push esi
lea esi, [edi + 0x18]
jle 0x483b1e
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea esp, [esp]
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov edx, dword [esi + 8]
push eax
push ecx
push edx
push str.Committing_deferred_write_of__lu_bytes_at__I64i
push 0x534540
mov eax, 4
call fcn.00478d50
mov eax, dword [esi]
mov edx, dword [esi + 4]
add esp, 0x14
mov cl, 0x20
call fcn.004bc980
mov ecx, dword [esi]
mov edx, dword [edi + 0xc]
push 0
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push ecx
push edx
call ebp
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
push 0
lea eax, [esp + 0x14]
push eax
mov eax, dword [edi + 0xc]
push ecx
push edx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esi + 0xc]
push ecx
call fcn.004be908
mov eax, dword [edi + 0x98]
add esp, 4
inc ebx
add esi, 0x10
cmp ebx, eax
jl 0x483aa0
pop ebp
push 0x4ee23c
push 0x534540
mov eax, 4
mov dword [edi + 0x98], 0
call fcn.00478d50
add esp, 8
pop esi
pop ebx
add esp, 8
ret

Function at 0x483dc0
Capabilities:
Terminate thread

Disassembly:
push ecx
mov eax, dword [edi + 0x30]
push ebp
xor ebp, ebp
cmp eax, ebp
je 0x483e5d
mov eax, dword [edi + 0x3c]
push ebx
push esi
push eax
mov dword [edi + 0x34], ebp
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, 0x28
lea esp, [esp]
mov edx, dword [edi + 0x30]
lea ecx, [esp + 0xc]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x483e16
cmp dword [esp + 0xc], 0x103
jne 0x483e16
push 0x64
call ebx
dec esi
cmp esi, ebp
jg 0x483df0
cmp esi, ebp
jne 0x483e40
mov eax, dword [edi + 0x30]
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push str.WARNING:_Terminating_CTransfers_thread.
push 0x534540
mov eax, 3
call fcn.00478d50
add esp, 8
push 0x64
call ebx
mov dword [edi + 0x30], ebp
pop esi
mov dword [0x51172c], ebp
mov dword [0x511730], ebp
mov dword [0x574790], ebp
mov dword [0x574794], ebp
pop ebx
pop ebp
pop ecx
ret
Function at 0x484440
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push 0xffffffffffffffff
push 0x4cd711
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x228
mov eax, dword [0x504530]
push esi
push edi
xor edi, edi
mov dword [esp + 0x22c], eax
mov dword [esp + 0x10], edi
call fcn.004be803
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0xc], eax
push edi
push edi
push edi
push edi
push str.mtxx
mov dword [esp + 0x24c], edi
call dword [sym.imp.WININET.dll_InternetOpenW]
mov esi, eax
cmp esi, edi
mov dword [esp + 0x10], esi
je 0x484593
mov eax, dword [esp + 0x244]
push ebx
push edi
push edi
push edi
push edi
push eax
push esi
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov ebx, eax
cmp ebx, edi
je 0x48458b
push edi
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x30]
push edx
push 5
push ebx
mov dword [esp + 0x30], 0x208
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x484584
lea eax, [esp + 0x28]
push ebp
push eax
call fcn.004ad85f
lea esi, [eax + 1]
push esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x24], edi
mov dword [esp + 0x30], esi
call fcn.004be903
mov ebp, eax
mov ecx, esi
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, ebp
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
add esp, 8
mov dword [esp + 0x24], ebp
rep stosb byte es:[edi], al
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0x244], 1
mov ecx, dword [esp + 0x14]
push ecx
push ebp
push ebx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x48456e
lea edx, [esp + 0x10]
push edx
mov ecx, ebp
call fcn.00484bc0
mov byte [esp + 0x240], 2
mov eax, dword [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
call fcn.004039a0
lea eax, [esp + 0x10]
call fcn.00484f50
push ebp
mov byte [esp + 0x244], 0
call fcn.004be908
mov esi, dword [esp + 0x1c]
add esp, 4
pop ebp
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
pop ebx
mov esi, dword [esp + 0xc]
add esi, 0xfffffff0
push esi
call fcn.00403fa0
mov edi, dword [esp + 0x244]
add eax, 0x10
add esp, 4
mov dword [edi], eax
mov dword [esp + 0x238], 0xffffffff
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4845d1
mov ecx, dword [esi]
mov eax, dword [ecx]
push esi
call dword [eax + 4]
mov ecx, dword [esp + 0x230]
mov eax, edi
pop edi
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x228]
pop esi
call fcn.004ae38e
add esp, 0x234
ret
Function at 0x4864d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d2748
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
push 1
lea eax, [esi + 4]
push eax
lea ecx, [esp + 0xc]
call fcn.004a2dfe
mov dword [esp + 0x18], 0
mov esi, dword [esi + 0x30]
test esi, esi
je 0x486528
lea esp, [esp]
test esi, esi
mov eax, esi
je 0x48654b
mov eax, dword [eax + 8]
mov esi, dword [esi]
call fcn.00485d10
test eax, eax
ja 0x486550
test esi, esi
jne 0x486510
lea ecx, [esp + 4]
mov dword [esp + 0x18], 0xffffffff
call fcn.004a2da4
xor eax, eax
pop esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
jmp fcn.004bcac3
lea ecx, [esp + 4]
mov dword [esp + 0x18], 0xffffffff
call fcn.004a2da4
mov ecx, dword [esp + 0x10]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret

Function at 0x4869f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d2748
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
push 1
lea eax, [edi + 4]
push eax
lea ecx, [esp + 0xc]
call fcn.004a2dfe
mov dword [esp + 0x18], 0
mov esi, dword [edi + 0x30]
test esi, esi
je 0x486a40
test esi, esi
mov eax, esi
je 0x486a69
mov ecx, dword [eax + 8]
test ecx, ecx
mov esi, dword [esi]
je 0x486a3c
mov edx, dword [ecx]
push 1
call dword [edx]
test esi, esi
jne 0x486a27
lea ecx, [edi + 0x2c]
call fcn.004bce50
lea ecx, [esp + 4]
mov dword [esp + 0x18], 0xffffffff
call fcn.004a2da4
mov ecx, dword [esp + 0x10]
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret
jmp fcn.004bcac3

Function at 0x488260
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4d14b2
push eax
mov dword fs:[0], esp
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
push 6
push esi
mov edi, ecx
call fcn.00487170
xor ebp, ebp
mov dword [esp + 0x14], ebp
mov dword [esi], 0x4ee928
call fcn.00426670
mov dword [esi + 0x5fc], eax
mov dword [esi + 0x600], ebp
mov byte [esp + 0x14], 1
call fcn.00426670
mov dword [esi + 0x608], eax
mov dword [esi + 0x60c], ebp
mov eax, dword [esp + 0x20]
mov byte [esp + 0x14], 2
mov dword [esi + 0x5e0], edi
mov dword [esi + 0x5e4], eax
lea ecx, [edi + 4]
mov eax, dword [ecx]
lea edx, [esi + 4]
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
mov eax, dword [ecx + 8]
mov dword [edx + 8], eax
mov ecx, dword [ecx + 0xc]
mov dword [edx + 0xc], ecx
add edi, 0x14
push edi
lea ecx, [esi + 0x14]
call fcn.00403e70
push str.BitTorrent
call fcn.004ac8fd
add esp, 4
push eax
push str.BitTorrent
lea ecx, [esi + 0x30]
call fcn.00403ee0
mov edx, dword [esi + 0x5e4]
push edx
mov eax, esi
mov dword [esi + 0x4c8], 1
mov dword [esi + 0x5e8], ebp
mov dword [esi + 0x5ec], 1
mov dword [esi + 0x5f0], ebp
call fcn.00487fe0
mov eax, dword [esi + 0x5e4]
lea edi, [eax + 0x290]
push ebp
push esi
mov ecx, edi
call fcn.004bcf1a
test eax, eax
jne 0x488360
push esi
mov ecx, edi
call fcn.004bd06e
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0xc
ret 8
Function at 0x488d60
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4d14b2
push eax
mov dword fs:[0], esp
push esi
mov esi, dword [esp + 0x14]
push edi
push 3
push esi
call fcn.00487170
xor edi, edi
mov dword [esp + 0x10], edi
mov dword [esi], 0x4eead0
call fcn.00426670
mov dword [esi + 0x5fc], eax
mov dword [esi + 0x600], edi
mov byte [esp + 0x10], 1
call fcn.00426670
mov dword [esi + 0x608], eax
mov dword [esi + 0x60c], edi
mov eax, dword [esp + 0x1c]
mov byte [esp + 0x10], 2
mov dword [esi + 0x5e0], eax
mov dword [esi + 0x4c8], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x5e0]
add ecx, 0x30
push ecx
lea ecx, [esi + 0x30]
mov dword [esi + 0x5e4], eax
call fcn.00403e70
mov edx, dword [esi + 0x5e0]
add edx, 4
mov ecx, dword [edx]
lea eax, [esi + 4]
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov edx, dword [edx + 0xc]
mov dword [eax + 0xc], edx
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
lea ecx, [esi + 0x14]
call fcn.004039a0
mov ecx, dword [esi + 0x5e0]
add ecx, 0x4f8
push ecx
lea ecx, [esi + 0x4dc]
call fcn.00403e70
mov eax, dword [esi + 0x5e0]
mov ecx, dword [esp + 8]
mov dword [esi + 0x5ec], edi
mov dword [esi + 0x5f0], edi
mov dword [esi + 0x5f4], edi
lea edx, [esi + 0x4d8]
mov dword [eax + 0x258], edx
pop edi
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 8
Function at 0x490820
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4cd679
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push edi
mov edi, ecx
mov dword [esp + 4], edi
mov dword [edi], 0x4ef968
mov dword [esp + 0x10], 2
call fcn.00490ab0
push edi
call fcn.00490ae0
lea ecx, [edi + 0x30]
mov byte [esp + 0x10], 1
call fcn.004bde9c
lea ecx, [edi + 0x14]
mov byte [esp + 0x10], 0
call fcn.004bcf5c
mov dword [edi], 0x4ef96c
mov dword [esp + 0x10], 3
mov eax, dword [edi + 0x10]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x49089b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov dword [esp + 0x10], 0xffffffff
mov edi, dword [edi + 0xc]
sub edi, 0x10
lea eax, [edi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4908c0
mov ecx, dword [edi]
mov edx, dword [ecx]
push edi
call dword [edx + 4]
mov ecx, dword [esp + 8]
pop edi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x491790
Capabilities:
Get file size
Read file on windows

Disassembly:
push ecx
push edi
mov edi, eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x400000
mov dword [esp + 4], eax
jbe 0x4917ad
xor eax, eax
pop edi
pop ecx
ret
push esi
push eax
call fcn.004be903
mov ecx, dword [esp + 0xc]
add esp, 4
push 0
mov esi, eax
lea eax, [esp + 0xc]
push eax
push ecx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
push edx
push eax
mov ecx, esi
call fcn.004915b0
push esi
mov edi, eax
call fcn.004be908
add esp, 0xc
pop esi
mov eax, edi
pop edi
pop ecx
ret
Function at 0x494500
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4cd5fe
mov eax, dword fs:[0]
push eax
mov eax, 0x1010
mov dword fs:[0], esp
call fcn.004aec00
mov eax, dword [0x504530]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
push 2
push 0
mov ebx, ecx
mov dword [esp + 0x1020], eax
mov eax, dword [ebx + 4]
push 0xfffff000
push eax
mov dword [esp + 0x1c], 0
call ebp
mov eax, dword [ebx + 4]
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea ecx, [esp + 0x10]
push ecx
push 0x1000
lea edx, [esp + 0x24]
push edx
push eax
call edi
test eax, eax
je 0x494577
mov ecx, dword [esp + 0xc]
cmp ecx, 0x16
jae 0x49457e
xor eax, eax
jmp 0x4946a5
mov eax, 4
cmp ecx, eax
push esi
jbe 0x49459e
lea esi, [esp + ecx + 0x18]
lea esp, [esp]
cmp dword [esi], 0x6054b50
je 0x4945a5
inc eax
dec esi
cmp eax, ecx
jb 0x494590
xor eax, eax
jmp 0x4946a4
mov ecx, dword [ebx + 4]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, dword [esi + 0xc]
jb 0x49459e
mov edx, dword [esi + 0x10]
mov eax, dword [ebx + 4]
push 0
push 0
push edx
push eax
call ebp
cmp eax, dword [esi + 0x10]
jne 0x49459e
mov ecx, dword [esi + 0xc]
push ecx
call fcn.004be903
mov ecx, dword [ebx + 4]
add esp, 4
push 0
mov ebp, eax
mov eax, dword [esi + 0xc]
lea edx, [esp + 0x14]
push edx
push eax
push ebp
push ecx
mov dword [esp + 0x28], ebp
call edi
mov edx, dword [esp + 0x10]
cmp edx, dword [esi + 0xc]
jne 0x494691
movzx edi, word [esi + 0xa]
lea eax, [edi + edi*4]
lea ecx, [eax*8 + 4]
push ecx
mov dword [ebx + 0xc], edi
call fcn.004be903
add esp, 4
mov dword [esp + 0x18], eax
test eax, eax
mov dword [esp + 0x1028], 0
je 0x494647
push 0x494490
push 0x4943b0
push edi
lea ebp, [eax + 4]
push 0x28
push ebp
mov dword [eax], edi
call fcn.004ad372
mov eax, ebp
mov ebp, dword [esp + 0x14]
jmp 0x494649
xor eax, eax
mov dword [esp + 0x1028], 0xffffffff
mov edx, dword [esi + 0xc]
push edx
push ebp
mov dword [ebx + 8], eax
call fcn.004946d0
test eax, eax
jne 0x494691
mov eax, dword [ebx + 8]
xor edi, edi
cmp eax, edi
je 0x49468b
mov ecx, dword [eax - 4]
lea esi, [eax - 4]
push 0x494490
push ecx
push 0x28
push eax
call fcn.004ad186
push esi
call fcn.004be908
add esp, 4
mov dword [ebx + 8], edi
mov dword [ebx + 0xc], edi
push ebp
call fcn.004be908
mov ecx, dword [ebx + 0xc]
xor eax, eax
add esp, 4
test ecx, ecx
setg al
pop esi
mov ecx, dword [esp + 0x101c]
pop edi
pop ebp
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x1010]
pop ebx
call fcn.004ae38e
add esp, 0x101c
ret
Function at 0x494860
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [ebx + 4]
sub esp, 0x24
cmp eax, 0xffffffff
jne 0x494871
xor eax, eax
add esp, 0x24
ret
mov ecx, dword [esi + 0x10]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push ecx
push eax
call edi
mov edx, dword [esi + 0x10]
xor ecx, ecx
cmp eax, edx
jne 0x494891
cmp ecx, dword [esi + 0x14]
je 0x494898
xor eax, eax
pop edi
add esp, 0x24
ret
mov ecx, dword [ebx + 4]
push 0
lea edx, [esp + 8]
push edx
push 0x1e
lea eax, [esp + 0x14]
push eax
push ecx
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 4], 0x1e
jne 0x494891
cmp dword [esp + 8], 0x4034b50
jne 0x494891
mov ax, word [esp + 0x10]
cmp ax, 8
je 0x4948d9
test ax, ax
jne 0x494891
movzx edx, word [esp + 0x24]
movzx eax, word [esp + 0x22]
mov ecx, dword [ebx + 4]
push 1
push 0
add edx, eax
push edx
push ecx
call edi
mov eax, 1
pop edi
add esp, 0x24
ret