joyce8/EMBER2024-capa huggingface dataset:
Function at 0x449130
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
push esi
push edi
mov edi, eax
mov esi, edx
jne 0x44913f
pop edi
xor eax, eax
pop esi
ret
cmp edi, 8
not esi
jb 0x449227
push ebp
mov ebp, edi
shr ebp, 3
movzx edx, byte [ecx]
xor edx, esi
and edx, 0xff
add ecx, 1
mov eax, esi
shr eax, 8
xor eax, dword [edx*4 + 0x5c2e28]
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x5c2e28]
movzx edx, byte [ecx + 1]
xor edx, eax
and edx, 0xff
add ecx, 1
shr eax, 8
xor eax, dword [edx*4 + 0x5c2e28]
movzx edx, byte [ecx + 1]
xor edx, eax
add ecx, 1
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x5c2e28]
movzx edx, byte [ecx + 1]
xor edx, eax
add ecx, 1
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x5c2e28]
movzx edx, byte [ecx + 1]
xor edx, eax
add ecx, 1
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x5c2e28]
movzx edx, byte [ecx + 1]
add ecx, 1
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x5c2e28]
movzx edx, byte [ecx + 1]
add ecx, 1
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x5c2e28]
add ecx, 1
sub edi, 8
sub ebp, 1
mov esi, eax
jne 0x449150
pop ebp
test edi, edi
je 0x44924c
jmp 0x449230
movzx eax, byte [ecx]
xor eax, esi
and eax, 0xff
shr esi, 8
xor esi, dword [eax*4 + 0x5c2e28]
add ecx, 1
sub edi, 1
jne 0x449230
mov eax, esi
pop edi
not eax
pop esi
ret

Function at 0x449260
Capabilities:
Hash data with crc32

Disassembly:
mov eax, dword [edx]
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5c2e28]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
add eax, 1
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x5c2e28]
mov dword [edx + 8], ecx
ret
Function at 0x449480
Capabilities:
Encode data using xor
Hash data with crc32
Write file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ecx
cmp byte [esi + 0x2d], 0
push edi
mov edi, dword [esp + 0x14]
mov eax, ebx
je 0x449560
mov eax, dword [esi + 0x3c]
push ebp
xor ebp, ebp
cmp eax, ebp
je 0x4494b4
cmp dword [esi + 0x40], edi
jae 0x4494b4
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esi + 0x3c], ebp
cmp dword [esi + 0x3c], ebp
jne 0x4494cb
lea eax, [edi + edi]
push eax
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
mov ecx, dword [esi + 0x3c]
push edi
push ebx
push ecx
call sub.MSVCR80.dll_memcpy
add esp, 0xc
cmp edi, ebp
jbe 0x44955c
mov edx, dword [esi + 0x3c]
mov bl, byte [edx + ebp]
mov edi, dword [esi + 0x30]
mov eax, dword [esi + 0x38]
movzx ecx, bl
xor ecx, edi
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5c2e28]
shr edi, 8
xor ecx, edi
mov dword [esi + 0x30], ecx
movzx ecx, cl
add ecx, dword [esi + 0x34]
mov edx, eax
imul ecx, ecx, 0x8088405
add ecx, 1
mov dword [esi + 0x34], ecx
shr ecx, 0x18
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x5c2e28]
and edx, 0xfffd
mov dword [esi + 0x38], eax
mov ecx, dword [esi + 0x3c]
or edx, 2
mov eax, edx
xor eax, 1
imul eax, edx
shr eax, 8
xor al, bl
mov byte [ecx + ebp], al
add ebp, 1
cmp ebp, dword [esp + 0x18]
jb 0x4494e1
mov edi, dword [esp + 0x18]
mov eax, dword [esi + 0x3c]
pop ebp
mov edx, dword [esi + 0x20]
test edx, edx
je 0x449599
mov ecx, dword [esi + 0x24]
lea ebx, [ecx + edi]
cmp ebx, dword [esi + 0x28]
jb 0x449581
pop edi
mov dword [esi + 0x14], 0x30000
pop esi
xor eax, eax
pop ebx
ret 8
push edi
push eax
add ecx, edx
push ecx
call sub.MSVCR80.dll_memcpy
add esp, 0xc
add dword [esi + 0x24], edi
mov eax, edi
pop edi
pop esi
pop ebx
ret 8
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4495ba
push 0
lea edx, [esp + 0x18]
push edx
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
ret 8
pop edi
mov dword [esi + 0x14], 0x1000000
pop esi
xor eax, eax
pop ebx
ret 8

Function at 0x449800
Capabilities:
Read file on windows

Disassembly:
push ecx
mov ecx, dword [esi + 0x78]
test ecx, ecx
push edi
je 0x449848
mov eax, dword [esi + 0x80]
mov edi, dword [esi + 0x7c]
cmp eax, edi
jae 0x449885
sub edi, eax
cmp edi, edx
jbe 0x44981e
mov edi, edx
push edi
add eax, ecx
push eax
push ebx
call sub.MSVCR80.dll_memcpy
mov edx, dword [esi + 0x6c]
add dword [esi + 0x80], edi
add dword [esi + 0x68], edi
add esp, 0xc
mov eax, edi
mov ecx, ebx
call fcn.00449130
mov dword [esi + 0x6c], eax
mov eax, edi
pop edi
pop ecx
ret
mov eax, dword [esi + 0x70]
test eax, eax
je 0x44987e
push 0
lea ecx, [esp + 8]
push ecx
push edx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x449885
mov edi, dword [esp + 4]
mov edx, dword [esi + 0x6c]
add dword [esi + 0x68], edi
mov eax, edi
mov ecx, ebx
call fcn.00449130
mov dword [esi + 0x6c], eax
mov eax, edi
pop edi
pop ecx
ret
mov dword [esi + 0x14], 0x1000000
xor eax, eax
pop edi
pop ecx
ret
Function at 0x44a3c0
Capabilities:
Delete file
Move file

Disassembly:
push 0xffffffffffffffff
push 0x57583b
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x5d2020]
xor eax, esp
mov dword [esp + 0x22c], eax
push ebx
push esi
push edi
mov eax, dword [0x5d2020]
xor eax, esp
push eax
lea eax, [esp + 0x240]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebx]
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
sub esi, 0x10
call edx
cmp dword [esi + 0xc], 0
lea ecx, [esi + 0xc]
jl 0x44a425
cmp eax, dword [esi]
jne 0x44a425
mov edi, esi
mov eax, 1
lock xadd dword [ecx], eax
jmp 0x44a462
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
jne 0x44a43e
jmp fcn.00401f10
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
lea ecx, [eax + eax + 2]
push ecx
add esi, 0x10
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [edi + 0x10]
push eax
call dword [sym.imp.MSVCR80.dll_memcpy_s]
add esp, 0x10
add edi, 0x10
mov dword [esp + 0x10], edi
lea eax, [esp + 0x10]
mov dword [esp + 0x248], 0
call fcn.0044a7c0
push 0x208
lea ecx, [esp + 0x38]
push 0
push ecx
call fcn.0044ea7c
mov ebx, dword [ebx]
push ebx
lea edx, [esp + 0x44]
push 0x104
push edx
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
mov dword [esp + 0x260], 0xffffffff
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
add esp, 0x18
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x44a4cf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
lea edx, [esp + 0x14]
lea ecx, [esp + 0x34]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
push edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov word [esp + 0x34], ax
mov word [esp + 0x28], 0x414
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
neg eax
sbb eax, eax
add eax, 1
mov ecx, dword [esp + 0x240]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.0044e502
add esp, 0x23c
ret
Function at 0x44b600
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5781eb
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5d2020]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, dword [esp + 0x20]
mov eax, dword [0x5dcd6c]
mov edx, dword [eax + 0xc]
mov ecx, 0x5dcd6c
call edx
add eax, 0x10
mov dword [esi], eax
xor edi, edi
mov dword [esp + 0x18], edi
mov eax, dword [0x5dcd6c]
mov edx, dword [eax + 0xc]
mov ecx, 0x5dcd6c
call edx
add eax, 0x10
mov dword [esi + 4], eax
mov byte [esp + 0x18], 1
mov eax, dword [0x5dcd6c]
mov edx, dword [eax + 0xc]
mov ecx, 0x5dcd6c
call edx
add eax, 0x10
mov dword [esi + 8], eax
mov byte [esp + 0x18], 2
mov eax, dword [0x5dcd6c]
mov edx, dword [eax + 0xc]
mov ecx, 0x5dcd6c
call edx
add eax, 0x10
mov dword [esi + 0xc], eax
mov ecx, dword [esp + 0x24]
lea eax, [esi + 0x10]
push eax
mov byte [esp + 0x1c], 3
call fcn.00401bd0
mov byte [esp + 0x18], 4
mov edx, dword [0x5dcd6c]
mov eax, dword [edx + 0xc]
mov ecx, 0x5dcd6c
call eax
add eax, 0x10
mov dword [esi + 0x14], eax
mov byte [esp + 0x18], 5
mov edx, dword [0x5dcd6c]
mov eax, dword [edx + 0xc]
mov ecx, 0x5dcd6c
call eax
add eax, 0x10
mov dword [esi + 0x18], eax
mov byte [esp + 0x18], 6
mov edx, dword [0x5dcd6c]
mov eax, dword [edx + 0xc]
mov ecx, 0x5dcd6c
call eax
add eax, 0x10
mov dword [esi + 0x1c], eax
mov byte [esp + 0x18], 7
mov edx, dword [0x5dcd6c]
mov eax, dword [edx + 0xc]
mov ecx, 0x5dcd6c
call eax
add eax, 0x10
mov dword [esi + 0x20], eax
mov dword [esi + 0x28], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
push esi
mov byte [esp + 0x1c], 9
call fcn.0044b930
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 8

Function at 0x44bcd0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x30]
add edi, 0x2c
cmp esi, dword [edi + 8]
jbe 0x44bcf0
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov edi, edi
mov ebx, dword [edi + 8]
cmp dword [edi + 4], ebx
jbe 0x44bcfe
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
cmp edi, edi
je 0x44bd08
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
cmp esi, ebx
je 0x44bd7b
cmp esi, dword [edi + 8]
jb 0x44bd17
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov ebx, dword [ebp + 8]
lea eax, [esp + 0xc]
push esi
add ebx, 0x14
push eax
call fcn.00407c00
mov eax, dword [eax]
add esp, 8
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov eax, dword [esp + 0xc]
sete bl
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x44bd59
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
jne 0x44bd6d
cmp esi, dword [edi + 8]
jb 0x44bd68
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
add esi, 4
jmp 0x44bcf0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x44bd90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x576f68
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5d2020]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
mov eax, dword [0x5dcd6c]
mov edx, dword [eax + 0xc]
mov ecx, 0x5dcd6c
xor esi, esi
call edx
add eax, 0x10
mov dword [esp + 0x14], eax
mov dword [esp + 0x28], esi
mov eax, dword [ebp]
mov ecx, dword [eax - 0xc]
cmp ecx, esi
jle 0x44bef6
push 0x2c
push eax
call dword [sym.imp.MSVCR80.dll_wcschr]
add esp, 8
cmp eax, esi
je 0x44bef6
sub eax, dword [ebp]
sar eax, 1
mov edi, eax
cmp edi, 0xffffffff
je 0x44bef6
mov eax, edi
sub eax, esi
push ebp
mov ecx, esi
lea edx, [esp + 0x20]
call fcn.004044a0
mov byte [esp + 0x28], 1
mov ecx, dword [eax]
mov esi, dword [esp + 0x14]
lea eax, [ecx - 0x10]
add esi, 0xfffffff0
cmp eax, esi
je 0x44be76
cmp dword [esi + 0xc], 0
lea ebx, [esi + 0xc]
jl 0x44be69
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x44be69
call fcn.004045e0
mov dword [esp + 0x18], eax
or eax, 0xffffffff
lock xadd dword [ebx], eax
dec eax
test eax, eax
jg 0x44be5c
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov ecx, dword [esp + 0x18]
add ecx, 0x10
mov dword [esp + 0x14], ecx
jmp 0x44be76
mov ebx, dword [ecx - 0xc]
push ecx
lea eax, [esp + 0x18]
call fcn.00402030
mov byte [esp + 0x28], 0
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x44be9b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ebx, [esp + 0x14]
call fcn.004093f0
mov ebx, eax
call fcn.00409480
mov ecx, dword [esp + 0x14]
cmp dword [ecx - 0xc], 0
je 0x44bec2
mov esi, dword [esp + 0x34]
lea ebx, [esp + 0x14]
call fcn.00404270
mov eax, dword [ebp]
mov ecx, dword [eax - 0xc]
lea esi, [edi + 1]
test esi, esi
jl 0x44bef6
cmp esi, ecx
jge 0x44bef6
lea edx, [eax + esi*2]
push 0x2c
push edx
call dword [sym.imp.MSVCR80.dll_wcschr]
add esp, 8
test eax, eax
je 0x44bef6
sub eax, dword [ebp]
sar eax, 1
mov edi, eax
cmp edi, 0xffffffff
jne 0x44be09
mov ecx, esi
lea esi, [esp + 0x1c]
mov edx, ebp
call fcn.00404130
lea edi, [esp + 0x14]
mov byte [esp + 0x28], 2
call fcn.004042f0
mov byte [esp + 0x28], 0
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x44bf36
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ebx, [esp + 0x14]
call fcn.004093f0
mov ebx, eax
call fcn.00409480
mov ecx, dword [esp + 0x14]
cmp dword [ecx - 0xc], 0
je 0x44bf5d
mov esi, dword [esp + 0x34]
lea ebx, [esp + 0x14]
call fcn.00404270
mov dword [esp + 0x28], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x44bf85
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x44c000
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x576110
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push edi
mov eax, dword [0x5d2020]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, 0x400000
lea ebx, [esp + 0x18]
call fcn.00407850
mov ecx, dword [esp + 0x2c]
push eax
lea edx, [esp + 0x18]
mov dword [esp + 0x28], 0
mov ebx, dword [ecx + 0x28]
push edx
call fcn.00404150
push eax
lea eax, [esp + 0x18]
push eax
mov ebx, str..kid
mov byte [esp + 0x34], 1
call fcn.00404150
xor ebx, ebx
mov byte [esp + 0x34], bl
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
add esp, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x44c08b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x24], 0xffffffff
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x44c0b3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44c0d8
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x44c11a
mov ecx, dword [esp + 0xc]
push 0x5c69c8
push ecx
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x1c], ebx
call dword [sym.imp.MSVCR80.dll__wfopen_s]
add esp, 0xc
test eax, eax
jne 0x44c106
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.MSVCR80.dll_fclose]
add esp, 4
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x44c126
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x1c
ret 4

Function at 0x44c480
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x575108
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5d2020]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor edi, edi
mov dword [esp + 0x14], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov eax, dword [0x5dcd6c]
mov edx, dword [eax + 0xc]
mov ecx, 0x5dcd6c
call edx
add eax, 0x10
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x44d130
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x44d1c5
push edi
lea ecx, [esp + 0x10]
push ecx
push ebp
mov dword [esp + 0x18], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp dword [esp + 0x10], ebx
mov edi, eax
jne 0x44d1bd
cmp edi, 0x200000
ja 0x44d1bd
lea edx, [edi + 2]
push esi
push edx
call fcn.0044e4eb
add esp, 4
push ebx
mov esi, eax
lea eax, [esp + 0x14]
push eax
push edi
push esi
push ebp
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x44d1bc
mov eax, dword [esp + 0x10]
cmp eax, edi
jne 0x44d1bc
mov edx, dword [esp + 0x1c]
mov byte [eax + esi], bl
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
mov byte [ecx + esi + 1], bl
mov dword [edx], esi
mov dword [eax], edi
mov ebx, 1
pop esi
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebp
mov eax, ebx
pop ebx
add esp, 8
ret 8

Function at 0x44e36c
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x5d2020]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0044e2ab
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.0044ea7c
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x44e3bb
cmp dword [ebp - 0x1c], 5
jb 0x44e3d3
jmp 0x44e3cf
cmp dword [ebp - 0x10], 1
jne 0x44e3d3
cmp dword [ebp - 0x1c], 4
ja 0x44e3cf
jne 0x44e3d3
cmp dword [ebp - 0x18], 0
jbe 0x44e3d3
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x57a808
call fcn.0044e15e
test eax, eax
jge 0x44e3f4
mov byte [0x5dfe00], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0044e502
add ebp, 0x78
leave
ret
Function at 0x453160
Capabilities:
Get common file path

Disassembly:
push ecx
push ebp
push esi
push str.kernel32
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
jne 0x45317a
pop esi
pop ebp
pop ecx
ret
push ebx
push edi
push str.LoadLibraryExA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, dword [esp + 0x18]
mov edi, eax
push 0x57a8e0
push ebx
mov dword [esp + 0x18], edi
call dword [sym.imp.MSVCR80.dll__mbspbrk]
add esp, 8
test eax, eax
je 0x4531c7
test edi, edi
je 0x4531b8
push 8
push 0
push ebx
call edi
pop edi
pop ebx
pop esi
mov ebp, eax
pop ebp
pop ecx
ret
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
pop ebx
pop esi
mov ebp, eax
pop ebp
pop ecx
ret
test edi, edi
je 0x4531ed
push str.AddDllDirectory
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4531ed
push 0x800
push 0
push ebx
call edi
pop edi
pop ebx
pop esi
mov ebp, eax
pop ebp
pop ecx
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, eax
test edi, edi
je 0x4532a4
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x453206
sub eax, edx
lea eax, [eax + edi + 1]
push eax
call dword [0x5d2038]
mov esi, eax
add esp, 4
test esi, esi
je 0x45329a
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x45329a
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x453236
sub eax, edx
mov word [eax + esi], 0x5c
mov eax, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x453250
sub eax, edx
lea edx, [eax + esi]
mov ecx, ebx
sub edx, ebx
mov al, byte [ecx]
mov byte [edx + ecx], al
add ecx, 1
test al, al
jne 0x453262
mov eax, dword [esp + 0x10]
test eax, eax
je 0x453291
push 8
push 0
push esi
call eax
push esi
mov ebp, eax
call dword [0x5d203c]
add esp, 4
pop edi
pop ebx
pop esi
mov eax, ebp
pop ebp
pop ecx
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, eax
push esi
call dword [0x5d203c]
add esp, 4
pop edi
pop ebx
pop esi
mov eax, ebp
pop ebp
pop ecx
ret

Function at 0x4532b0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x5d2020]
xor eax, esp
mov dword [esp + 0x190], eax
test byte [esp + 0x198], 2
je 0x45330d
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x4532f3
mov ax, word [esp]
cmp al, 2
jne 0x4532ed
cmp ah, al
je 0x45330d
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.0044e502
add esp, 0x194
ret
push str.iphlpapi.dll
call fcn.00453160
add esp, 4
test eax, eax
mov dword [0x5dd150], eax
je 0x453338
push str.if_nametoindex
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x453338
mov dword [0x5dd154], eax
push 3
push 2
push 0
push 6
call fcn.00453000
add esp, 0x10
neg eax
sbb eax, eax
neg eax
push 0x5dff40
mov dword [0x5dff48], eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov ecx, dword [esp + 0x190]
xor ecx, esp
xor eax, eax
call fcn.0044e502
add esp, 0x194
ret
Function at 0x45c020
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x45c063
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, dword [esp + 0x10]
xor ecx, ecx
cmp eax, 0x2733
sete cl
mov dword [edx], 0
mov eax, ecx
neg eax
sbb eax, eax
and eax, 0x19
add eax, 0x38
ret
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
xor eax, eax
ret

Function at 0x45c0e0
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
xor ebx, ebx
cmp dword [esi + 0x620], ebx
push edi
je 0x45c12a
push 1
push esi
call fcn.0045a080
mov eax, dword [esi + 0x5b4]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push eax
mov eax, dword [esp + 0x20]
push ecx
mov ecx, dword [esi + 0x620]
push edx
push eax
push esi
call ecx
push ebx
push esi
mov edi, eax
call fcn.0045a080
add esp, 0x24
mov eax, edi
pop edi
pop esi
pop ebx
ret
mov eax, dword [esp + 0x14]
test eax, eax
jl 0x45c16a
cmp eax, 2
jg 0x45c16a
mov edx, dword [esi + 0x5b0]
mov edi, dword [sym.imp.MSVCR80.dll_fwrite]
push edx
push 1
lea eax, [eax + eax*2 + 0x57b42c]
push 2
push eax
call edi
mov ecx, dword [esi + 0x5b0]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
push ecx
push 1
push edx
push eax
call edi
add esp, 0x20
pop edi
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x45c700
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov ecx, dword [ebx + 0x5c0]
push ebp
mov ebp, dword [ebx + eax*4 + 0x420]
push esi
lea esi, [eax + 0x44]
shl esi, 4
add esi, ebx
push edi
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [ecx + 0x40], 3
je 0x45c79f
cmp dword [ebx + eax*4 + 0x430], 0x45c410
jne 0x45c79f
cmp dword [esi], 0
je 0x45c73a
test edi, edi
je 0x45c79f
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebp
call fcn.004826f0
add esp, 0x14
cmp eax, 0xffffffff
je 0x45c79f
test al, 1
je 0x45c79f
cmp dword [esi], 0
jne 0x45c781
mov edx, dword [ebx]
mov eax, dword [edx + 0x954]
add eax, eax
push eax
mov dword [esi + 4], eax
call dword [0x5d2038]
mov edi, dword [esi + 4]
xor ecx, ecx
add esp, 4
cmp eax, ecx
mov dword [esi], eax
mov dword [esi + 8], ecx
mov dword [esi + 0xc], ecx
je 0x45c79c
mov eax, dword [esi]
add eax, dword [esi + 8]
push 0
push edi
push eax
push ebp
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x45c79f
add dword [esi + 8], eax
pop edi
pop esi
pop ebp
ret
mov dword [esi + 4], ecx
pop edi
pop esi
pop ebp
ret