joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b390
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov esi, dword [0x44c0f8]
mov dword [esp + 0x2c], esi
mov esi, dword [esp + 0x54]
mov ebx, dword [esp + 0x50]
mov eax, dword [ebx]
test esi, esi
je 0x41b4d0
cmp eax, 1
je 0x41b3ee
mov eax, ebx
call fcn.0041a3c0
lea edi, [eax + 4]
mov dword [esp + 0x1c], eax
mov dword [esp], edi
call fcn.00419cb0
mov ebp, dword [ebx]
test ebp, ebp
je 0x41b410
cmp ebp, 1
jne 0x41b4a0
mov dword [esp], edi
call fcn.00419fe0
mov eax, dword [esp + 0x1c]
call fcn.0041a650
xor eax, eax
mov edx, dword [esp + 0x2c]
sub edx, dword [0x44c0f8]
jne 0x41b51a
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x20], 0x41a710
mov dword [esp + 0x24], eax
call fcn.0041a9c0
mov eax, dword [0x433124]
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esp], eax
call ebp
sub esp, 4
test eax, eax
je 0x41b508
mov eax, dword [eax + 0xc]
mov dword [esp + 0x28], eax
lock or dword [esp], 0
call fcn.0041a9c0
mov eax, dword [0x433124]
mov dword [esp], eax
call ebp
sub esp, 4
test eax, eax
je 0x41b4f0
lea ecx, [esp + 0x20]
mov dword [eax + 0xc], ecx
lock or dword [esp], 0
call esi
call fcn.0041a9c0
mov eax, dword [0x433124]
mov dword [esp], eax
call ebp
sub esp, 4
test eax, eax
je 0x41b4e0
mov edx, dword [esp + 0x28]
mov dword [eax + 0xc], edx
mov dword [ebx], 1
jmp 0x41b3dd
mov dword [esp], 2
call dword [0x43310c]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], ebx
mov dword [esp + 4], str._once__p_is__ld_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x41b3dd
mov eax, 0x16
jmp 0x41b3f0
call fcn.0041aa70
test eax, eax
jne 0x41b48a
jmp 0x43181f
call fcn.0041aa70
test eax, eax
jne 0x41b466
jmp 0x431814
call fcn.0041aa70
test eax, eax
jne 0x41b440
jmp 0x43180d
call fcn.00413810
nop
mov eax, dword [pe_dos_header]
ud2
lea eax, [esp + 0x20]
mov dword [0], eax
ud2
mov eax, dword [esp + 0x28]
mov dword [0], eax
ud2

Function at 0x41b760
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.0041a9c0
mov eax, dword [0x433124]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x41b7d8
lea ebp, [ebx + 0x38]
xor edi, edi
mov dword [esp], ebp
call fcn.0041e1f0
mov eax, dword [ebx + 0x28]
cmp dword [esp + 0x30], eax
jae 0x41b7b4
mov eax, dword [ebx + 0x30]
mov edx, dword [esp + 0x30]
cmp byte [eax + edx], 0
je 0x41b7b4
mov eax, dword [ebx + 0x2c]
mov edi, dword [eax + edx*4]
mov dword [esp], ebp
call fcn.0041e240
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.0041aa70
mov ebx, eax
jmp 0x41b78b
Function at 0x41b7f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [esp + 0x40]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
call fcn.0041a9c0
mov eax, dword [0x433124]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x41b908
lea edi, [ebx + 0x38]
mov dword [esp], edi
call fcn.0041e1f0
mov edx, dword [ebx + 0x2c]
cmp esi, dword [ebx + 0x28]
jb 0x41b8d4
lea ebp, [esi + 1]
mov dword [esp], edx
lea eax, [ebp*4]
mov dword [esp + 4], eax
call sub.msvcrt.dll_realloc
test eax, eax
je 0x41b914
mov dword [esp + 0x1c], eax
mov dword [esp + 4], ebp
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
call sub.msvcrt.dll_realloc
mov edx, dword [esp + 0x1c]
test eax, eax
mov dword [esp + 0x18], eax
je 0x41b914
mov ecx, dword [ebx + 0x28]
mov eax, ebp
mov dword [esp + 4], 0
mov dword [esp + 0x1c], edx
sub eax, ecx
lea ecx, [edx + ecx*4]
shl eax, 2
mov dword [esp], ecx
mov dword [esp + 8], eax
call sub.msvcrt.dll_memset
mov eax, dword [ebx + 0x28]
mov edx, dword [esp + 0x18]
mov ecx, ebp
mov dword [esp + 4], 0
sub ecx, eax
add eax, edx
mov dword [esp + 8], ecx
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov dword [ebx + 0x28], ebp
mov dword [ebx + 0x2c], edx
mov dword [ebx + 0x30], eax
mov eax, dword [esp + 0x44]
mov dword [edx + esi*4], eax
mov eax, dword [ebx + 0x30]
mov byte [eax + esi], 1
mov dword [esp], edi
call fcn.0041e240
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
sub esp, 4
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.0041aa70
mov ebx, eax
jmp 0x41b825
mov dword [esp], edi
call fcn.0041e240
mov eax, 0xc
jmp 0x41b8fc

Function at 0x41b9b0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.0041a9c0
mov eax, dword [0x433124]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x41b9d8
mov eax, dword [eax + 0x18]
add esp, 0x1c
ret
call fcn.0041aa70
test eax, eax
jne 0x41b9cd
add esp, 0x1c
ret

Function at 0x41ba40
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.0041a9c0
mov eax, dword [0x433124]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x41ba68
add eax, 0xc
add esp, 0x1c
ret
call fcn.0041aa70
test eax, eax
jne 0x41ba5d
jmp 0x41ba60
Function at 0x41baa0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call fcn.0041aba0
mov dword [eax + 4], esi
mov ebx, eax
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x41bac2
call fcn.0041abd0
test byte [ebx + 0x20], 0x30
jne 0x41badc
add ebx, 0x70
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_longjmp]
mov eax, dword [0x433124]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
push edx
test eax, eax
je 0x41bb1d
cmp dword [ebx + 0x14], 0
mov eax, dword [eax + 0x18]
je 0x41bb5d
mov dword [ebx + 0x68], 1
mov esi, dword [ebx + 4]
test eax, eax
je 0x41bb12
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
xor eax, eax
mov dword [ebx + 0x18], eax
test byte [ebx + 0x24], 4
jne 0x41bb26
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
push ecx
mov dword [ebx + 0x14], eax
mov eax, ebx
call fcn.0041a9a0
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [0x433124]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edx
push edx
jmp 0x41bb1d
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x41bb71
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
xor eax, eax
mov esi, dword [ebx + 4]
mov dword [ebx + 0x18], eax
jmp 0x41bb3e

Function at 0x41bb80
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x44cafc]
test eax, eax
jne 0x41bb90
xor eax, eax
ret
sub esp, 0x1c
call fcn.0041a9c0
mov eax, dword [0x433124]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x41bbd0
mov edx, dword [eax + 0x10]
test edx, edx
jle 0x41bbc0
xor eax, eax
add esp, 0x1c
ret
test byte [eax + 0x20], 3
je 0x41bbb4
mov eax, dword [eax + 0x24]
and eax, 1
jmp 0x41bbb6
call fcn.0041aa70
test eax, eax
je 0x41bbb4
jmp 0x41bbad

Function at 0x41bbe0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.0041a9c0
mov eax, dword [0x433124]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x41bc20
mov edx, dword [esp + 0x20]
test edx, edx
jle 0x41bc10
lock add dword [eax + 0x10], 1
add esp, 0x1c
ret
lock sub dword [eax + 0x10], 1
add esp, 0x1c
ret
call fcn.0041aa70
test eax, eax
jne 0x41bbfd
add esp, 0x1c
ret
Function at 0x41bd20
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
call fcn.0041a9c0
mov eax, dword [0x433124]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x41bd90
test byte [ebx + 0x20], 0xc
jne 0x41bd50
mov eax, dword [0x44cafc]
test eax, eax
jne 0x41bd60
add esp, 0x14
pop ebx
pop esi
ret
lea esi, [ebx + 0x1c]
mov dword [esp], esi
call fcn.00419cb0
movzx eax, byte [ebx + 0x20]
test al, 3
je 0x41bd82
mov edx, dword [ebx + 0x24]
test dl, 1
je 0x41bd82
mov ecx, dword [ebx + 0x10]
test ecx, ecx
jle 0x41bda1
mov dword [esp], esi
call fcn.00419fe0
add esp, 0x14
pop ebx
pop esi
ret
call fcn.0041aa70
mov ebx, eax
test eax, eax
jne 0x41bd41
add esp, 0x14
pop ebx
pop esi
ret
and eax, 0xfffffff3
and edx, 0xfffffffe
or eax, 4
mov dword [ebx + 0x24], edx
mov byte [ebx + 0x20], al
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x41bdc1
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push eax
mov dword [esp], esi
call fcn.00419fe0
call fcn.0041bc30
nop
push esi
push ebx
sub esp, 0x14
mov eax, dword [esp + 0x20]
test eax, eax
je 0x41be40
mov dword [esp], eax
call fcn.0041d150
xor ecx, ecx
mov ebx, edx
mov edx, 0xffffffff
cmp edx, eax
sbb ecx, ebx
cmovae edx, eax
mov ebx, edx
call fcn.0041a9c0
mov eax, dword [0x433124]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
test eax, eax
je 0x41be90
test ebx, ebx
je 0x41be5a
call fcn.0041bd20
mov eax, dword [esi + 0x18]
test eax, eax
je 0x41be80
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.0041d260
call fcn.0041bd20
add esp, 0x14
xor eax, eax
pop ebx
pop esi
ret
call fcn.0041a9c0
mov eax, dword [0x433124]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x41bea0
call fcn.0041bd20
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
call fcn.0041bd20
add esp, 0x14
xor eax, eax
pop ebx
pop esi
ret
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
jmp 0x41be2f
call fcn.0041aa70
mov esi, eax
jmp 0x41be13
call fcn.0041aa70
jmp 0x41be5a
Function at 0x430350
Capabilities:
Query environment variable

Disassembly:
push edi
sub esp, 0x18
mov eax, dword [esp + 0x20]
lea edi, [eax + 0x60]
mov dword [esp], edi
call sub.msvcrt.dll_malloc
test eax, eax
je 0x42f7f2
mov edx, eax
lea edi, [edx + 4]
mov ecx, edx
xor eax, eax
mov dword [edx], 0
and edi, 0xfffffffc
mov dword [edx + 0x5c], 0
sub ecx, edi
add ecx, 0x60
shr ecx, 2
rep stosd dword es:[edi], eax
add esp, 0x18
lea eax, [edx + 0x60]
pop edi
ret
mov eax, edi
call fcn.004215d0
mov edx, eax
test eax, eax
je 0x430338
jmp 0x42f7c9
call fcn.004306b4
nop
nop
nop
call fcn.004306b4
nop
nop
nop
nop
nop
nop
nop
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [0x44c0f8]
mov dword [esp + 0x2c], eax
xor eax, eax
mov dword [esp + 4], 0
mov dword [esp], 0x433188
call fcn.0041a130
mov dword [esp], str.GLIBCXX_TUNABLES
mov dword [0x43318c], 0
mov dword [0x433190], 0
mov dword [0x433194], 0
call sub.msvcrt.dll_getenv
mov dword [esp + 0x14], 8
mov dword [esp + 0x18], str.obj_size
mov ebx, eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 9
mov dword [esp + 0x24], str.obj_count
mov dword [esp + 0x28], 0x40
test eax, eax
jne 0x4303f6
jmp 0x4304c7
mov dword [esp], ebx
mov dword [esp + 4], 0x3a
call sub.msvcrt.dll_strchr
mov ebx, eax
test eax, eax
je 0x430470
xor eax, eax
cmp byte [ebx], 0x3a
sete al
add ebx, eax
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
xor eax, 0x62696c67
xor edx, 0x2e787863
or eax, edx
jne 0x4303e0
mov eax, dword [ebx + 7]
mov edx, dword [ebx + 0xb]
xor eax, 0x5f68652e
xor edx, 0x6c6f6f70
or eax, edx
jne 0x4303e0
cmp byte [ebx + 0xf], 0x2e
jne 0x4303e0
add ebx, 0x10
lea esi, [esp + 0x14]
lea ebp, [esp + 0x2c]
mov edi, dword [esi]
test edi, edi
je 0x430457
mov dword [esp + 8], edi
mov dword [esp + 4], ebx
mov eax, dword [esi + 4]
mov dword [esp], eax
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x430461
cmp byte [ebx + edi], 0x3d
je 0x4304f5
add esi, 0xc
cmp ebp, esi
jne 0x43043a
jmp 0x4303e0
mov eax, dword [esp + 0x28]
mov edx, 0x100
mov ecx, 6
cmp eax, edx
cmovle edx, eax
mov eax, dword [esp + 0x1c]
test eax, eax
cmove eax, ecx
add eax, 0x2c
imul eax, edx
lea ebx, [eax*4]
mov dword [0x433194], ebx
test ebx, ebx
jne 0x4304d6
mov dword [esp], 0x4302c0
call fcn.00401400
mov eax, dword [esp + 0x2c]
sub eax, dword [0x44c0f8]
jne 0x430540
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [0x433194], 0x3200
mov ebx, 0x3200
mov dword [esp], ebx
call sub.msvcrt.dll_malloc
mov dword [0x433190], eax
test eax, eax
je 0x430533
xor edx, edx
mov dword [0x43318c], eax
mov dword [eax], ebx
mov dword [eax + 4], edx
jmp 0x4304a3
lea eax, [esp + 0x10]
xor ebp, ebp
mov dword [esp + 4], eax
lea eax, [ebx + edi + 1]
mov dword [esp + 8], ebp
mov dword [esp], eax
call sub.msvcrt.dll_strtoul
mov ebx, dword [esp + 0x10]
movzx edx, byte [ebx]
cmp dl, 0x3a
je 0x430523
test dl, dl
jne 0x4303e0
test eax, eax
js 0x4303e0
mov dword [esi + 8], eax
jmp 0x4303e0
xor ecx, ecx
mov dword [0x433194], ecx
jmp 0x4304a3
call fcn.00413810
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
call fcn.004306b4
nop
nop
nop
call fcn.004306b4
nop
nop
nop
Function at 0x40993f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x409997
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x409997
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x409997
xor eax, eax
inc eax
leave
ret
xor eax, eax
leave
ret

Function at 0x4099c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x409a2e
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push str.DisableMMX
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x409a25
cmp dword [ebp - 0xc], 4
jne 0x409a25
cmp dword [ebp - 0x10], edi
je 0x409a25
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x5943a8], edi
xor eax, eax
jmp 0x409a56
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x5943a8], edi
jge 0x409a51
mov dword [0x5943a8], edi
call fcn.0040999b
test eax, eax
je 0x409a51
emms
mov dword [0x5943a8], 1
mov eax, dword [0x5943a8]
pop edi
leave
ret

Function at 0x409b36
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x98
push ebx
push edi
push 0x25
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
xor bl, bl
and byte [ebp + 0x73], bl
push eax
mov dword [ebp - 0x24], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x409b6d
inc bl
mov byte [ebp + 0x73], 1
cmp dword [ebp - 0x14], 1
jne 0x409b8f
cmp dword [ebp - 0x20], 4
ja 0x409b99
jne 0x409b89
cmp dword [ebp - 0x1c], 0xa
jb 0x409b89
cmp word [ebp - 0x18], 0x55d
jae 0x409b99
mov byte [ebp + 0x73], 1
jmp 0x409b99
cmp dword [ebp - 0x14], 2
jne 0x409baf
test bl, bl
je 0x409bca
mov eax, dword [ebp + 0x7c]
sub eax, 6
je 0x409bba
dec eax
je 0x409bb3
sub eax, 3
jne 0x409baf
cmp byte [ebp + 0x73], 0
je 0x409bdb
xor eax, eax
jmp 0x409be3
call fcn.00409a59
jmp 0x409be3
cmp byte [ebp + 0x73], 0
jne 0x409baf
call fcn.00409a91
and eax, 4
jmp 0x409be3
cmp dword [ebp + 0x7c], 0xa
je 0x409bdb
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
jmp 0x409be3
call fcn.00409a91
and eax, 8
pop edi
pop ebx
add ebp, 0x74
leave
ret
Function at 0x40cd85
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x98
push ebx
push esi
xor esi, esi
cmp dword [ebp + 0x78], esi
push edi
mov edi, ecx
jne 0x40cda6
mov eax, 0x8876086c
jmp 0x40ce88
cmp dword [ebp + 0x7c], esi
je 0x40ce20
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x28], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x18], 2
je 0x40ce00
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push dword [ebp + 0x78]
push esi
push esi
call ebx
mov dword [ebp + 0x6c], eax
add eax, 3
and eax, 0xfffffffc
call fcn.004de600
mov dword [ebp + 0x7c], esp
push esi
push esi
push dword [ebp + 0x6c]
push dword [ebp + 0x7c]
push 0xffffffffffffffff
push dword [ebp + 0x78]
push esi
push esi
call ebx
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x78], eax
mov dword [ebp + 0x7c], esi
cmp dword [ebp + 0x7c], esi
je 0x40ce20
push esi
push 0x10000000
push 3
push esi
push 1
push accept
push dword [ebp + 0x78]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x40ce39
push esi
push 0x10000000
push 3
push esi
push 1
push accept
push dword [ebp + 0x78]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [edi], eax
je 0x40ce79
push esi
push esi
push esi
push 2
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, 0xffffffff
mov dword [edi + 4], eax
je 0x40ce79
push esi
push esi
push esi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, esi
mov dword [edi + 8], eax
je 0x40ce79
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [edi + 0xc], eax
jne 0x40ce86
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, 0x88760b59
jmp 0x40ce88
xor eax, eax
lea esp, [ebp - 0x34]
pop edi
pop esi
pop ebx
add ebp, 0x70
leave
ret 8
Function at 0x431199
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x4311a7
xor eax, eax
pop ebp
ret
cmp dword [ebp + 0x10], 8
push esi
mov esi, dword [ebp + 8]
not esi
mov ecx, 0xff
jb 0x43127b
mov eax, dword [ebp + 0x10]
push ebx
shr eax, 3
push edi
xor ebx, ebx
mov bl, byte [edx]
mov edi, esi
shr edi, 8
sub dword [ebp + 0x10], 8
xor ebx, esi
and ebx, ecx
mov esi, dword [ebx*4 + 0x55fb60]
xor ebx, ebx
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x55fb60]
xor ebx, ebx
shr esi, 8
xor edi, esi
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x55fb60]
xor ebx, ebx
shr edi, 8
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x55fb60]
xor ebx, ebx
shr esi, 8
xor edi, esi
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x55fb60]
xor ebx, ebx
shr edi, 8
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x55fb60]
shr esi, 8
xor edi, esi
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x55fb60]
shr edi, 8
xor esi, edi
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x55fb60]
shr esi, 8
xor esi, edi
inc edx
dec eax
jne 0x4311c4
pop edi
pop ebx
cmp dword [ebp + 0x10], 0
je 0x43129b
xor eax, eax
mov al, byte [edx]
xor eax, esi
and eax, ecx
mov eax, dword [eax*4 + 0x55fb60]
shr esi, 8
xor esi, eax
inc edx
dec dword [ebp + 0x10]
jne 0x431281
mov eax, esi
not eax
pop esi
pop ebp
ret
Function at 0x445a20
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x580410]
xor ecx, ecx
mov edx, 4
mov dword [ebp - 4], 0
mul edx
push esi
push edi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004de266
mov ecx, dword [0x580410]
shl ecx, 2
push ecx
push 0
push eax
mov dword [0x59a1d0], eax
call fcn.004dff60
xor esi, esi
add esp, 0x10
cmp dword [0x580410], esi
jle 0x445aa5
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x445ec0
push 0x10000
push 0
call edi
mov ecx, dword [0x59a1d0]
mov dword [ecx + esi*4], eax
mov eax, dword [0x59a1d0]
cmp dword [eax + esi*4], 0
je 0x445aad
inc esi
cmp esi, dword [0x580410]
jl 0x445a72
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x445cf0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x28], 0
jg 0x445dfc
push ebx
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x18]
sub eax, 2
je 0x445d89
sub eax, 1
je 0x445d40
sub eax, 1
jne 0x445dfa
mov ecx, dword [esi + 0x10]
push dword [edi + 0x1c]
push dword [esi + 4]
mov eax, dword [ecx]
mov eax, dword [eax]
call eax
test al, al
jne 0x445df3
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
pop edi
pop ebx
pop esi
pop ebp
ret 0x10
mov ecx, dword [esi + 0x10]
push 0
push dword [edi + 0x1c]
mov eax, dword [ecx]
push dword [esi + 4]
mov eax, dword [eax + 4]
call eax
test al, al
jne 0x445d5f
push dword [edi + 0x1c]
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, esi
call fcn.004465b0
test al, al
jne 0x445dfa
push str.HandleGoodIoCompletions__:_setup_new_accept_failed
call fcn.00446d10
mov eax, dword [esi]
add esp, 4
mov ecx, esi
call dword [eax + 8]
pop edi
pop ebx
pop esi
pop ebp
ret 0x10
mov ebx, dword [ebp + 0x14]
nop dword [eax]
push 0
push ebx
push dword [ebp + 0x10]
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
cmp edi, 0xffffffff
je 0x445ddf
test edi, edi
je 0x445dc7
push edi
push dword [ebp + 0x10]
mov ecx, esi
call fcn.004460e0
cmp edi, ebx
je 0x445d90
mov ecx, esi
call fcn.00446270
pop edi
pop ebx
pop esi
pop ebp
ret 0x10
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x445dfa
mov eax, dword [ecx]
push 0
push dword [esi + 4]
call dword [eax + 0xc]
pop edi
pop ebx
pop esi
pop ebp
ret 0x10
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.HandleGoodIoCompletions__:_recv_failed:_error_code:__d
call fcn.00446d10
add esp, 8
mov ecx, esi
call fcn.00446270
pop edi
pop ebx
pop esi
pop ebp
ret 0x10
Function at 0x446270
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
push ebx
push 0x58042c
call esi
push 0x58042c
call esi
mov eax, dword [0x580418]
cmp eax, dword [0x58041c]
push 0x58042c
sete bl
call edi
test bl, bl
je 0x4462e1
push 0x58042c
call edi
push 0x3e8
call fcn.00445ac0
add esp, 4
jmp 0x4462a4
mov ecx, dword [0x58041c]
mov eax, dword [0x580414]
pop ebx
mov esi, dword [eax + ecx*4]
inc ecx
mov dword [0x58041c], ecx
cmp ecx, dword [0x580424]
jl 0x446309
mov eax, dword [0x580420]
mov dword [0x58041c], eax
push 0x58042c
call edi
push dword [esi + 0x20]
call fcn.004de26f
mov ecx, dword [ebp - 4]
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x18], 2
mov dword [esi + 0x14], ecx
mov dword [esi + 0x1c], 0xffffffff
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
test ecx, ecx
je 0x446355
mov eax, dword [ecx + 4]
mov dword [esi + 0x28], eax
push 0
push esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x14]
push eax
push dword [ecx + 4]
call dword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
je 0x4463da
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x4463da
push eax
push str.RegisterRecv__:_registration_failed:_error_code:__d
call fcn.00446d10
push dword [esi + 0x20]
call fcn.004de26f
add esp, 0xc
mov dword [esi + 0x20], 0
mov ecx, 0x580414
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x1c], 0
push esi
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
call fcn.004461e0
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret