joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40cad0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov dword [esp + 8], 0xce7
mov dword [esp + 4], 0x40c9bb
mov dword [esp], 0x402443
call sym._updatecontext_f
mov eax, dword [ebx + 0xc]
test eax, eax
mov dword [ebp - 0x10], eax
je 0x40cb60
mov dword [esp], eax
call sym._caps
mov ecx, dword [ebx + 0xc]
test ecx, ecx
mov dword [ebp - 0x10], ecx
je 0x40cb60
cld
mov eax, 4
mov esi, ecx
mov edi, 0x40c9c6
mov ecx, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x40cb80
mov esi, dword [ebp - 0x10]
mov eax, 8
mov edi, 0x40c9ca
mov ecx, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x40cb80
mov esi, dword [ebp - 0x10]
mov eax, 7
mov edi, 0x40c9d2
mov ecx, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x40cb80
lea esi, [esi]
lea edi, [edi]
mov dword [esp + 4], 0x40c9f0
mov dword [esp], ebx
call sym._u_respond
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
cld
mov esi, dword [ebp - 0x10]
mov edx, 4
mov edi, 0x40c9c6
mov ecx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x40cc05
cld
mov esi, dword [ebp - 0x10]
mov eax, 8
mov edi, 0x40c9ca
mov ecx, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x40cbd5
cld
mov esi, dword [ebp - 0x10]
mov eax, 7
mov edi, 0x40c9d2
mov ecx, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x40cb70
mov dword [esp + 4], 0x40ca15
mov dword [esp], ebx
call sym._u_respond
xor eax, eax
mov dword [0x438fac], eax
jmp 0x40cb70
mov eax, dword [0x438b44]
mov dword [esp + 4], 0x40ca30
mov dword [esp], ebx
mov dword [esp + 8], eax
call sym._u_respond
mov dword [esp + 4], 0x40ca90
mov dword [esp], ebx
call sym._u_respond
mov eax, 1
jmp 0x40cbce
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
jmp sym._shutdownumss
Function at 0x40fba0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov eax, dword [ebx + 0xc]
test eax, eax
mov dword [ebp - 0x10], eax
je 0x40fbe0
mov dword [esp], eax
call sym._caps
mov esi, dword [ebx + 0xc]
test esi, esi
mov dword [ebp - 0x10], esi
je 0x40fbe0
cld
mov edi, 0x401cee
mov ecx, 4
repe cmpsb byte [esi], byte es:[edi]
je 0x40fc00
lea esi, [esi]
mov dword [esp + 4], 0x402fd0
mov dword [esp], ebx
call sym._u_respond
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
cld
mov esi, dword [ebp - 0x10]
mov ecx, 4
mov edi, 0x401cee
repe cmpsb byte [esi], byte es:[edi]
jne 0x40fbf0
mov eax, dword [0x4389f4]
mov dword [esp], eax
call sym._doesfileexist
test eax, eax
je 0x40fc5e
mov eax, dword [0x4389f4]
mov dword [esp], eax
call sym._unlink
test eax, eax
js 0x40fc5e
mov eax, dword [0x438b44]
mov dword [esp + 4], 0x40fb71
mov dword [esp + 8], eax
mov dword [esp], ebx
call sym._u_respond
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
jmp sym._shutdownumss
mov eax, dword [0x438b44]
mov dword [esp + 4], 0x40fb81
jmp 0x40fc41
Function at 0x41c290
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
pop ebp
ret
Function at 0x420d20
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp + 8], 0x582
mov dword [esp + 4], 0x420bec
mov dword [esp], 0x41cb50
call sym._updatecontext_f
mov eax, dword [0x438b1c]
test eax, eax
jne 0x420d56
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0xc], 0x589
add eax, 5
mov dword [esp + 8], 0x41cb50
mov dword [esp + 4], 0x420bec
mov dword [esp], eax
call sym._mycalloc2
mov dword [ebp - 0x10], eax
mov eax, dword [0x438b1c]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0xc], 0x58a
add eax, 2
mov dword [esp + 8], 0x41cb50
mov dword [esp + 4], 0x420bec
mov dword [esp], eax
call sym._mycalloc2
mov dword [esp + 4], 0x420bf9
mov edi, eax
mov eax, dword [0x438b1c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._sprintf
mov dword [esp + 4], 0x420c00
mov eax, dword [0x438b1c]
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov dword [esp + 8], 0x1b6
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], 0x10601
mov dword [esp], eax
call sym._open
test eax, eax
mov esi, eax
js 0x420f77
mov dword [esp + 0xc], 0x59a
mov dword [esp + 8], 0x41cb50
mov dword [esp + 4], 0x420bec
mov dword [esp], 0x28
call sym._mycalloc2
mov dword [esp], eax
mov ebx, eax
mov dword [esp + 8], 0x420c04
mov dword [esp + 4], 0
call sym._u_fillwith_msg
mov dword [ebx], 0x10
mov dword [ebx + 0x20], esi
mov dword [esp], ebx
call sym._u_parseit
mov dword [esp], ebx
call sym._mydelete2
mov dword [esp], esi
call sym._close
mov dword [esp], edi
call sym._unlink
test eax, eax
js 0x420f39
mov dword [esp + 4], edi
mov eax, dword [0x438b1c]
mov dword [esp], eax
call sym._link
test eax, eax
js 0x420ef6
mov eax, dword [0x438b1c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._rename
test eax, eax
js 0x420ec4
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._mydelete2
mov dword [esp], edi
call sym._mydelete2
jmp 0x420d4e
call sym.___errno
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov dword [esp + 0xc], eax
mov eax, dword [0x438b1c]
mov dword [esp + 4], 0x420c30
mov dword [esp + 8], eax
mov dword [esp], 1
call sym._outerror
jmp 0x420eac
call sym.___errno
cmp dword [eax], 2
je 0x420e94
call sym.___errno
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov dword [esp + 0x10], eax
mov eax, dword [0x438b1c]
mov dword [esp + 0xc], edi
mov dword [esp + 4], 0x420c70
mov dword [esp + 8], eax
mov dword [esp], 1
call sym._outerror
jmp 0x420e94
call sym.___errno
cmp dword [eax], 2
je 0x420e7f
call sym.___errno
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov dword [esp + 0xc], eax
mov dword [esp + 8], edi
mov dword [esp + 4], 0x420cb0
mov dword [esp], 1
call sym._outerror
jmp 0x420e7f
call sym.___errno
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], 0x420cf0
jmp 0x420ee4
Function at 0x424180
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea esi, [ebp - 0x58]
push ebx
sub esp, 0xcc
xor ebx, ebx
mov dword [esp], 0x423eb0
call sym._puts
lea esi, [esi]
mov dword [esp], 0x424010
call sym._printf
call sym.___getreent
mov eax, dword [eax + 8]
mov dword [esp], eax
call sym._fflush
mov dword [esp + 8], 0x3b
mov dword [esp + 4], esi
mov dword [esp], 0
call sym._read
test eax, eax
js 0x4243dc
cmp byte [eax + ebp - 0x59], 0xa
je 0x424412
sub eax, 5
cmp eax, 3
ja 0x424401
mov ebx, 1
test ebx, ebx
je 0x4241a0
mov dword [esp], 0x42402d
lea ebx, [ebp - 0x98]
call sym._printf
call sym.___getreent
mov eax, dword [eax + 8]
mov dword [esp], eax
call sym._fflush
mov dword [esp + 8], 0x3b
mov dword [esp + 4], ebx
mov dword [esp], 0
call sym._read
test eax, eax
js 0x4243dc
cmp byte [eax + ebp - 0x99], 0xa
je 0x4243ce
mov dword [esp + 4], ebx
mov dword [esp], esi
call sym._strcmp
test eax, eax
jne 0x42439a
call sym._getpid
mov dword [esp], 0
mov ebx, eax
imul ebx, ebx, 0x1388
call sym._time
mov ecx, 0x68db8bad
mov edi, eax
imul ecx
mov ecx, edi
sar ecx, 0x1f
mov dword [ebp - 0xbc], edx
mov edx, dword [ebp - 0xbc]
mov dword [ebp - 0xc0], eax
sar edx, 0xb
sub edx, ecx
imul edx, edx, 0x1388
sub edi, edx
lea eax, [edi + ebx]
mov dword [esp], eax
call sym._srand
call sym._rand
push eax
fild dword [esp]
add esp, 4
fmul dword [0x424170]
fnstcw word [ebp - 0xaa]
movzx eax, word [ebp - 0xaa]
fdiv qword [0x424178]
or ax, 0xc00
mov word [ebp - 0xac], ax
fldcw word [ebp - 0xac]
fistp dword [ebp - 0xb0]
fldcw word [ebp - 0xaa]
mov ebx, dword [ebp - 0xb0]
mov eax, ebx
sar eax, 6
test eax, eax
mov edx, eax
js 0x424392
and edx, 0xffffffc0
sub eax, edx
mov dword [esp], eax
call sym._inttosaltchar
mov byte [ebp - 0xa8], al
test ebx, ebx
mov eax, ebx
js 0x42438d
and eax, 0xffffffc0
sub ebx, eax
mov dword [esp], ebx
call sym._inttosaltchar
mov byte [ebp - 0xa7], al
lea eax, [ebp - 0xa8]
mov byte [ebp - 0xa6], 0
mov dword [esp + 4], eax
mov dword [esp], esi
call sym._crypt
test eax, eax
mov ebx, eax
je 0x424360
mov dword [esp], eax
call sym._strlen
cmp eax, 0xd
je 0x424377
mov dword [esp], 0x424050
call sym._puts
add esp, 0xcc
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], 0x424090
call sym._printf
jmp 0x42436c
lea eax, [ebx + 0x3f]
jmp 0x424321
lea edx, [eax + 0x3f]
jmp 0x424308
call sym.___getreent
mov eax, dword [eax + 0xc]
mov dword [esp + 8], 0x25
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov dword [esp], 0x4240f0
call sym._fwrite
mov dword [esp], 1
call sym._exit
xor edx, edx
mov byte [eax + ebp - 0x99], dl
jmp 0x42424c
call sym.___getreent
mov eax, dword [eax + 0xc]
mov dword [esp + 8], 0x27
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov dword [esp], 0x424130
jmp 0x4243bd
mov dword [esp], 0x424158
call sym._puts
jmp 0x4241f8
mov byte [eax + ebp - 0x59], 0
dec eax
jmp 0x4241e7
Function at 0x428fa0
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
sub esp, 0x20
mov ebx, dword [ebp + 8]
mov dword [esp + 8], 0x18
mov dword [esp + 4], 0x428eda
mov dword [esp], 0x428e5d
call sym._updatecontext_f
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 2
call sym._socket
mov dword [ebx], eax
test eax, eax
js 0x4290e5
mov ecx, dword [0x438acc]
test ecx, ecx
jne 0x4290b0
cld
xor eax, eax
lea edi, [ebx + 0x6c]
mov ecx, 4
rep stosd dword es:[edi], eax
mov word [ebx + 0x6c], 2
lea eax, [ebx + 0x6c]
mov dword [ebx + 0x70], 0
mov dword [esp + 4], eax
mov eax, dword [ebx]
mov dword [esp], eax
call sym._ir_bind_listen_socket
test eax, eax
js 0x4290a0
movzx eax, word [ebx + 0x6e]
xchg ah, al
mov word [ebx + 0x5a], ax
mov dword [esp + 4], 1
mov eax, dword [ebx]
mov dword [esp], eax
call sym._listen
test eax, eax
js 0x42905c
mov edx, 1
mov dword [ebx + 0x90], edx
add esp, 0x20
pop ebx
pop edi
pop ebp
ret
mov dword [esp + 4], 0x428ee8
lea esi, [esi]
lea edi, [edi]
mov dword [esp], 1
call sym._outerror
call sym.___errno
mov eax, dword [eax]
mov dword [esp + 4], 0x428f02
mov dword [esp], ebx
mov dword [esp + 8], eax
call sym._t_closeconn
jmp 0x429055
mov dword [esp + 4], 0x428f30
jmp 0x429070
mov dword [esp + 0x10], 4
lea eax, [ebp - 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 4
mov dword [esp + 4], 0xffff
mov eax, dword [ebx]
mov dword [ebp - 0xc], 1
mov dword [esp], eax
call sym._setsockopt
jmp 0x428ffb
mov dword [esp + 4], 0x428f70
jmp 0x429070
Function at 0x42cd00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov dword [esp + 8], 0x10a
mov dword [ebp - 8], ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], esi
lea esi, [ebp - 0x208]
and ebx, 0xffffff7f
mov dword [esp + 4], 0x42cc73
mov dword [esp], 0x42c530
call sym._updatecontext_f
mov dword [esp + 4], 0x200
lea eax, [ebp + 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], esi
mov dword [esp + 8], eax
call sym._vsnprintf
cmp eax, 0x1ff
ja 0x42ce70
mov eax, dword [0x438a54]
test eax, eax
jne 0x42cd79
mov eax, dword [0x438c68]
test eax, eax
je 0x42ce60
test ebx, ebx
je 0x42cdd6
cmp ebx, 1
je 0x42cdc0
cmp ebx, 2
je 0x42cd91
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0x42cc7c
mov dword [esp + 8], 0x1f
mov dword [esp + 4], 4
mov dword [esp], 0
call sym._ioutput
jmp 0x42cd87
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0x42cc7c
mov dword [esp + 8], 0x9f
jmp 0x42cda5
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0x42cc88
mov dword [esp + 8], 0x9f
mov dword [esp + 4], 4
mov dword [esp], 0
call sym._ioutput
mov dword [esp], 1
call sym._tostdout_disable_buffering
call sym._uninitscreen
mov eax, dword [0x438a54]
test eax, eax
jne 0x42ce4b
mov dword [esp + 4], 0x42cc92
mov dword [esp], 0
call sym._mylog
mov eax, dword [0x438abc]
test eax, eax
jne 0x42ce41
mov dword [esp], 1
call sym._exit
mov dword [esp], eax
call sym._unlink
jmp 0x42ce35
mov dword [esp + 4], esi
mov dword [esp], 0x42cca3
call sym._printf
jmp 0x42ce18
call sym._gototop
jmp 0x42cd79
mov dword [esp + 8], 0x42ccd0
mov dword [esp + 4], 0x1ff
mov dword [esp], esi
call sym._snprintf
jmp 0x42cd63

Function at 0x4335f0
Capabilities:
Get socket status

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push edi
lea edx, [ebp - 0x38]
mov edi, edx
push esi
push ebx
sub esp, 0x5c
mov byte [edx], 0
inc eax
inc edx
cmp eax, 0x1f
jbe 0x433600
mov dword [esp + 0xc], 0
mov esi, dword [ebp + 8]
mov eax, 1
mov dword [esp + 8], 0
mov ebx, dword [ebp + 8]
mov dword [esp + 4], edi
and esi, 0x1f
mov ecx, esi
shl eax, cl
shr ebx, 5
or dword [ebp + ebx*4 - 0x38], eax
lea eax, [ebp - 0x40]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
inc eax
mov dword [esp], eax
call sym._select
xor edx, edx
test eax, eax
js 0x43366d
mov eax, dword [ebp + ebx*4 - 0x38]
mov ecx, esi
xor edx, edx
sar eax, cl
test al, 1
setne dl
add esp, 0x5c
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x434940
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [0x438fc0]
cmp eax, 0xff
jle 0x43495a
mov eax, 0xff
mov dword [esp], 0x43a7a4
lea ebx, [eax - 0x1e]
xor esi, esi
mov eax, ebx
shr eax, 0x1f
add ebx, eax
sar ebx, 1
call sym._irlist_size
lea edi, [eax + ebx + 0xd]
cmp esi, edi
jge 0x4349c6
lea esi, [esi]
mov eax, dword [0x438acc]
test eax, eax
jne 0x434aa7
mov ecx, dword [ebp + 0xc]
mov word [ecx + 2], 0
mov dword [esp + 8], 0x10
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], edx
call sym._bind
test eax, eax
jns 0x4349c6
mov eax, dword [0x438acc]
test eax, eax
je 0x434aa0
inc esi
cmp esi, edi
jl 0x434980
cmp esi, edi
mov eax, 0xffffffff
je 0x434a7b
mov dword [ebp - 0x10], 0x10
lea eax, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], ecx
mov dword [esp], eax
call sym._getsockname
test eax, eax
js 0x434a83
mov eax, dword [0x438d6c]
test eax, eax
jle 0x434a38
mov edx, dword [ebp + 0xc]
movzx eax, word [edx + 2]
xchg ah, al
mov dword [esp + 0xc], 0x4348c9
movzx eax, ax
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0x21
mov dword [esp + 4], 1
mov dword [esp], 0
call sym._ioutput
mov dword [esp + 0x10], 0xa37
mov dword [esp + 0xc], 0x42c530
mov dword [esp + 8], 0x4348dc
mov dword [esp + 4], 8
mov dword [esp], 0x43a7a4
call sym._irlist_add2
mov ecx, dword [ebp + 0xc]
movzx edx, word [ecx + 2]
xchg dh, dl
mov word [eax], dx
mov edx, dword [0x438d08]
mov dword [eax + 4], edx
xor eax, eax
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 0x434910
mov dword [esp], 1
call sym._outerror
mov eax, 0xffffffff
jmp 0x434a7b
mov esi, edi
jmp 0x4349c6
movzx eax, word [0x438acc]
add eax, esi
movzx ebx, ax
mov dword [esp], ebx
call sym._ir_listen_port_is_in_list
test eax, eax
jne 0x4349c1
mov edx, dword [ebp + 0xc]
mov eax, ebx
xchg ah, al
mov word [edx + 2], ax
jmp 0x434996

Function at 0x434f20
Capabilities:
Hash data with md5

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
cld
sub esp, 0x18
mov dword [ebp - 4], edi
mov ecx, 9
mov edx, dword [ebp + 0x10]
mov dword [ebp - 8], ebx
mov ebx, dword [ebp + 8]
test dl, 4
mov edi, ebx
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 4], edx
mov dword [ebx], eax
jne 0x434f55
mov ebx, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [esp + 0xc], 0xac0
mov dword [esp + 8], 0x42c530
mov dword [esp + 4], 0x434f08
mov dword [esp], 0x58
call sym._mycalloc2
mov dword [ebx + 8], eax
mov ebx, dword [ebp - 8]
mov dword [ebp + 8], eax
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
jmp sym._MD5Init
Function at 0x434fb0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
test al, 4
mov dword [ebx + 4], eax
je 0x434fcd
mov eax, dword [ebx + 8]
test eax, eax
je 0x434ff2
test byte [ebx + 4], 4
jne 0x434fda
mov eax, dword [ebx + 8]
test eax, eax
jne 0x434fe1
mov ebx, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [esp], eax
call sym._mydelete2
mov dword [ebx + 8], 0
jmp 0x434fda
mov dword [esp + 0xc], 0xacb
mov dword [esp + 8], 0x42c530
mov dword [esp + 4], 0x434f8d
mov dword [esp], 0x58
call sym._mycalloc2
mov dword [ebx + 8], eax
mov ebx, dword [ebp - 4]
mov dword [ebp + 8], eax
mov esp, ebp
pop ebp
jmp sym._MD5Init

Function at 0x4353c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
lea edx, [ebp - 0x48]
push ebx
sub esp, 0x54
xor ebx, ebx
movzx eax, word [ebp + 8]
mov dword [esp + 8], 0x3f
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.KERNEL32.dll_GetAtomNameA
sub esp, 0xc
test eax, eax
je 0x43541c
mov eax, 0x1f
mov edx, 1
lea esi, [esi]
lea edi, [edi]
cmp byte [eax + ebp - 0x48], 0x41
je 0x435418
add edx, edx
dec eax
jns 0x435400
cmp dword [ebx], 0x30
jne 0x43541c
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
ret
or ebx, edx
jmp 0x435407
call sym._abort
jmp sym.___w32_sharedptr_fixup_after_fork

Function at 0x4362f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.___do_sjlj_init
Function at 0x406864
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffbe4
mov esi, edx
mov ebx, eax
test bl, bl
je 0x4068a6
movzx eax, bl
add ax, 0x41
dec eax
mov word [esp], ax
mov word [esp + 2], 0x3a
mov word [esp + 4], 0
lea eax, [esp + 0x212]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryW
push esp
call sub.kernel32.dll_SetCurrentDirectoryW
lea eax, [esp + 8]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryW
test bl, bl
je 0x4068c6
lea eax, [esp + 0x212]
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
mov eax, esi
lea edx, [esp + 8]
mov ecx, 0x105
call fcn.0040af84
add esp, 0x41c
pop esi
pop ebx
ret

Function at 0x406b1c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00409f90
test esi, esi
jne 0x406b52
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.0040a118
jmp 0x406b70
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00406a00
mov edi, eax
test esi, esi
je 0x406b70
cmp dword [ebx], 0
je 0x406b70
dec esi
jmp 0x406b59
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x406ba4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x77f008], 0x8088405
inc edx
mov dword [ebx + 0x77f008], edx
mul edx
mov eax, edx
pop ebx
ret
Function at 0x408bb8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.00408f90
mov byte [esp], al
cmp byte [esp], 0
jne 0x408d38
test edi, edi
je 0x408d38
mov byte [esp + 1], 0
test ebp, ebp
jle 0x408c78
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
test ebp, ebp
jle 0x408c53
cmp edi, 0xffffffff
je 0x408c17
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x408c17
mov byte [esp], 0
jmp 0x408d38
mov ebx, dword [esi]
cmp ebx, 1
jg 0x408c53
test ebx, ebx
jne 0x408c49
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x408c49
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x408d38
call 0x4090b0
dec ebp
test ebp, ebp
jg 0x408bfc
cmp edi, 0xffffffff
je 0x408c78
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x408c76
mov byte [esp], 0
jmp 0x408d38
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x408bc6
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x408c78
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.00408da4
mov edx, eax
mov ebx, dword [0x79d8f8]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x408cdc
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x408cda
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x408cdc
xor edi, edi
cmp byte [esp], 0
je 0x408d02
mov ebx, dword [esi]
test bl, 1
jne 0x408d18
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x408ce2
mov byte [esp + 1], 1
jmp 0x408d18
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x408d02
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x408c8f
cmp byte [esp], 0
je 0x408d38
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x409bf0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x79d058], 0
je 0x409c57
cmp word [0x79d344], 0xd7b2
jne 0x409c19
cmp dword [0x79d34c], 0
jbe 0x409c19
mov eax, 0x79d340
call dword [0x79d35c]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x409c84
call fcn.0040aa3c
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x77f032], 0
jne 0x409c73
push 0
push 0x77f9ea
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret