joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408a90
Capabilities:
Get common file path
Get file attributes
Move file
Set file attributes

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x47f528
push eax
mov eax, dword [0x4a707c]
mov dword fs:[0], esp
sub esp, 0x34
push ebx
xor ebx, ebx
cmp eax, ebx
push esi
je 0x408c89
mov eax, dword [0x4a7080]
cmp eax, ebx
je 0x408c89
cmp byte [eax], bl
je 0x408c89
push 0x400
lea ecx, [esp + 0xc]
call fcn.004624c0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
push 0x400
mov dword [esp + 0x48], ebx
mov byte [eax + ecx - 1], bl
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x408c78
push 0x49b1f0
lea ecx, [esp + 0xc]
call fcn.00462d30
push str._system32driversetchosts
lea ecx, [esp + 0xc]
call fcn.00462710
lea ecx, [esp + 0x20]
call fcn.004633b0
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x20]
push 0xffffffffffffffff
push eax
push ecx
mov byte [esp + 0x50], 1
call fcn.00464870
add esp, 0xc
test al, al
jne 0x408b4a
mov dword [esp + 0x28], ebx
mov edx, dword [0x4a7080]
push edi
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ebx
push ecx
push edx
lea ecx, [esp + 0x34]
call fcn.004639c0
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cmp eax, 0xffffffff
pop edi
jne 0x408c50
mov edx, dword [0x4a7080]
lea ecx, [esp + 0x20]
push edx
call fcn.00463640
mov eax, dword [esp + 0xc]
push ebx
push eax
call esi
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x20]
push ecx
push edx
call fcn.00464900
add esp, 8
test al, al
jne 0x408c50
lea ecx, [esp + 0x14]
call fcn.00462470
push 0x4a6f4c
lea ecx, [esp + 0x18]
mov byte [esp + 0x48], 2
call fcn.004626b0
push str._db_hs
lea ecx, [esp + 0x18]
call fcn.00462710
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x20]
push eax
push ecx
call fcn.00464900
add esp, 8
test al, al
jne 0x408bfc
lea ecx, [esp + 0x14]
mov byte [esp + 0x44], 1
call fcn.00462600
jmp 0x408c6b
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x18]
push 3
push edx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x408c35
mov ecx, dword [esp + 0xc]
push ecx
call fcn.004645e0
add esp, 4
test al, al
je 0x408c35
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x20]
push edx
push eax
call fcn.00464900
add esp, 8
mov ecx, dword [esp + 0x18]
push ecx
call fcn.004645e0
add esp, 4
lea ecx, [esp + 0x14]
mov byte [esp + 0x44], 1
call fcn.00462600
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
and eax, 5
cmp al, 5
je 0x408c6b
mov eax, dword [esp + 0xc]
push 5
push eax
call esi
lea ecx, [esp + 0x20]
mov byte [esp + 0x44], bl
call fcn.004634a0
lea ecx, [esp + 8]
mov dword [esp + 0x44], 0xffffffff
call fcn.00462600
mov ecx, dword [esp + 0x3c]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x40
ret
Function at 0x408d10
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x34c
push esi
push edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x408d33
pop edi
xor al, al
pop esi
add esp, 0x34c
ret
mov ecx, 0x49
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
mov dword [esp + 8], 0x128
push eax
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x408d69
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor al, al
pop esi
add esp, 0x34c
ret
push ebx
xor bl, bl
mov ecx, 0x88
xor eax, eax
lea edi, [esp + 0x138]
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x35c]
mov dword [esp + 0x134], 0x224
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x134]
push ecx
push edx
call fcn.00408cd0
add esp, 8
test al, al
je 0x408e00
lea eax, [esp + 0x254]
push 0x2f
push eax
call fcn.00464030
lea ecx, [esp + 0x25c]
push edi
push ecx
call fcn.0042e1d0
add esp, 0x10
test eax, eax
jne 0x408e00
mov dword [esp + 0x134], eax
mov edx, dword [esp + 0x13c]
mov ecx, 0x4a6f40
push edx
call fcn.00469640
test al, al
jne 0x408dfe
mov eax, dword [esp + 0x134]
inc eax
cmp eax, 3
mov dword [esp + 0x134], eax
jb 0x408dd2
jmp 0x408e00
mov bl, 1
lea eax, [esp + 0xc]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x408d8e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop ebx
pop edi
pop esi
add esp, 0x34c
ret
Function at 0x408e30
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x34c
push ebx
push ebp
mov ebp, dword [esp + 0x358]
push esi
xor ebx, ebx
push edi
push ebx
push 2
mov dword [ebp + 8], ebx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x408e62
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x34c
ret
mov ecx, 0x49
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x128
push eax
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x408e9a
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x34c
ret
mov ecx, 0x88
xor eax, eax
lea edi, [esp + 0x13c]
rep stosd dword es:[edi], eax
mov dword [esp + 0x138], 0x224
mov ecx, dword [0x4a708c]
xor eax, eax
cmp ecx, ebx
mov dword [0x4a7094], eax
jbe 0x408f67
cmp eax, ecx
jae 0x408ed9
mov ecx, dword [0x4a7088]
mov eax, dword [ecx + eax*8]
jmp 0x408edb
xor eax, eax
lea edx, [esp + 0x34]
push eax
push edx
call fcn.0042e1d0
add esp, 8
test eax, eax
jne 0x408f3e
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x138]
push eax
push ecx
call fcn.00408cd0
add esp, 8
test al, al
je 0x408f59
lea edx, [esp + 0x258]
push 0x2f
push edx
call fcn.00464030
mov eax, dword [0x4a6f44]
mov ecx, dword [0x4a6f48]
lea edx, [esp + 0x260]
mov byte [eax + ecx - 1], bl
mov eax, dword [0x4a6f44]
push eax
push edx
call fcn.0042e1d0
add esp, 0x10
test eax, eax
jne 0x408f59
mov eax, dword [0x4a7094]
mov ecx, dword [0x4a708c]
inc eax
cmp eax, ecx
mov dword [0x4a7094], eax
jb 0x408ece
jmp 0x408f67
mov eax, dword [0x4a7094]
push ebx
push eax
mov ecx, ebp
call fcn.00463cc0
lea ecx, [esp + 0x10]
push ecx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x408eb5
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x34c
ret
Function at 0x409570
Capabilities:
Acquire debug privileges
Enumerate processes

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x47f60b
push eax
mov dword fs:[0], esp
sub esp, 0x3fc
lea eax, [esp]
push ebx
push ebp
push esi
push edi
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40973e
lea ecx, [esp + 0x28]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [esp + 0x10]
push 0
push 0
lea edx, [esp + 0x2c]
push 0x10
push edx
push 0
push eax
mov dword [esp + 0x3c], 1
mov dword [esp + 0x48], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x40973e
push eax
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebp, eax
cmp ebp, 0xffffffff
je 0x40973e
mov ecx, 0x49
xor eax, eax
lea edi, [esp + 0xc4]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc0]
mov dword [esp + 0xc0], 0x128
push ecx
push ebp
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x409737
push 0
lea ecx, [esp + 0x38]
mov dword [esp + 0x418], 0
call fcn.00466fc0
mov eax, dword [0x4a6f44]
lea ecx, [esp + 0x34]
push eax
call fcn.00467040
test al, al
je 0x40973e
lea ecx, [esp + 0x34]
call fcn.004670c0
mov edx, dword [eax]
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 0x14], edx
lea edi, [esp + 0x1ec]
mov ecx, dword [eax + 4]
mov dword [esp + 0x18], ecx
mov ecx, 0x88
mov edx, dword [eax + 8]
mov dword [esp + 0x1c], edx
mov eax, dword [eax + 0xc]
mov dword [esp + 0x20], eax
xor eax, eax
rep stosd dword es:[edi], eax
mov dword [esp + 0x1e8], 0x224
mov edx, dword [esp + 0xc8]
lea ecx, [esp + 0x1e8]
push ecx
push edx
mov byte [esp + 0x311], 0
call fcn.00408cd0
add esp, 8
test al, al
je 0x40971c
cmp byte [esp + 0x309], 0x3a
jne 0x40971c
call ebx
cmp dword [esp + 0x1f0], eax
je 0x40971c
push 0
lea ecx, [esp + 0x38]
call fcn.00466fc0
lea eax, [esp + 0x308]
lea ecx, [esp + 0x34]
push eax
call fcn.00467040
test al, al
je 0x40971c
lea ecx, [esp + 0x34]
call fcn.004670c0
mov edi, eax
lea esi, [esp + 0x14]
mov ecx, 4
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
je 0x409733
lea eax, [esp + 0xc0]
push eax
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x409737
jmp 0x4096a9
mov al, 1
jmp 0x409740
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov ecx, dword [esp + 0x40c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x408
ret

Function at 0x40c64c
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x47f958
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov eax, dword [esp + 0x30]
push esi
mov esi, ecx
add eax, 0x18
push 4
push eax
lea ecx, [esp + 0xc]
call fcn.00463450
mov ecx, dword [esi + 0x130]
push eax
mov eax, dword [esp + 0x34]
push 0xd
mov dword [esp + 0x30], 0
lea edx, [eax + eax*2]
shl edx, 4
add ecx, edx
call fcn.0040ebb0
lea ecx, [esp + 4]
mov dword [esp + 0x28], 0xffffffff
call fcn.004634a0
mov ecx, dword [esp + 0x20]
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret 8
Function at 0x40e8b0
Capabilities:
Terminate process

Disassembly:
mov al, byte [esp + 4]
push esi
mov esi, ecx
mov byte [esi + 0x20], al
call fcn.0047617e
test eax, eax
je 0x40e8cc
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x40e8ce
xor eax, eax
mov ecx, eax
call fcn.00474f8b
mov eax, dword [esi + 0x10]
test eax, eax
je 0x40e96d
push ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push eax
call edi
test eax, eax
je 0x40e952
mov eax, dword [esi + 0x10]
push 0x3e8
push eax
call edi
test eax, eax
je 0x40e952
mov ecx, dword [esi + 0x1c]
push 0
push 0
push 0x12
push ecx
call dword [sym.imp.USER32.dll_PostThreadMessageA]
mov edx, dword [esi + 0x10]
push 0xa
push edx
call edi
test eax, eax
je 0x40e952
mov eax, dword [esi + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
push eax
mov ebp, 0xa
call edi
test eax, eax
jne 0x40e952
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, ebp
dec ebp
test ecx, ecx
je 0x40e951
push 1
call ebx
mov edx, dword [esi + 0x10]
push 0
push edx
call edi
test eax, eax
je 0x40e93a
pop ebx
mov eax, dword [esi + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esi + 0x10]
push ecx
call edi
pop edi
mov dword [esi + 0x10], 0
pop ebp
mov dword [esi + 0xc], 0
call fcn.0047617e
test eax, eax
pop esi
je 0x40e98f
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
mov ecx, eax
call fcn.00474fa0
ret 4
xor eax, eax
mov ecx, eax
call fcn.00474fa0
ret 4
Function at 0x40e9a0
Capabilities:
Create pipe
Create process on windows
Create process suspended
Write and execute a file
Write file on windows
Write pipe

Disassembly:
sub esp, 0x5c
push esi
push edi
mov esi, ecx
push 1
call fcn.0040e8b0
lea eax, [esp + 0x14]
push 8
lea ecx, [esp + 0xc]
push eax
lea edx, [esp + 0x14]
push ecx
push edx
mov dword [esp + 0x2c], 1
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0xc
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x40e9f9
pop edi
xor al, al
pop esi
add esp, 0x5c
ret
mov ecx, dword [esp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [esp + 0x10]
push 0
push eax
push 4
push 0x4a7888
push ecx
call edi
mov eax, dword [esp + 8]
lea edx, [esp + 0x10]
push 0
push edx
push 4
push esi
push eax
call edi
mov edx, dword [esp + 8]
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0xc]
push 0xfffffffffffffff4
mov dword [esp + 0x24], 0x44
mov dword [esp + 0x50], 0x100
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x60], edx
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esp + 0x60], eax
mov eax, dword [esi + 4]
mov ecx, dword [eax*4 + 0x4a7550]
push ecx
call fcn.00408d10
mov ecx, dword [esi + 4]
add esp, 4
lea edx, [esi + 0x10]
lea eax, [esp + 0x20]
push edx
mov edx, dword [ecx*4 + 0x4a7550]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40eac2
mov eax, dword [esp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esp + 0xc]
push ecx
call edi
push 1
mov ecx, esi
call fcn.0040e8b0
pop edi
xor al, al
pop esi
add esp, 0x5c
ret
mov edx, dword [esp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call edi
mov eax, dword [esp + 0xc]
push eax
call edi
mov ecx, dword [esi + 0x24]
push 0
push 0
push 0x466
push ecx
call dword [sym.imp.USER32.dll_PostThreadMessageA]
pop edi
mov al, 1
pop esi
add esp, 0x5c
ret

Function at 0x40eb00
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0xc]
test eax, eax
je 0x40eb78
mov al, byte [esp + 0xc]
test al, al
jne 0x40eb48
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
jne 0x40eb2f
mov ecx, dword [esi + 8]
push 6
push ecx
call edi
mov ecx, dword [esi + 8]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowOwnedPopups]
mov edx, dword [esi + 8]
push 0
push edx
call edi
pop edi
pop esi
ret 4
mov edx, dword [esi + 8]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push edx
call edi
mov eax, dword [esi + 8]
push 1
push eax
call dword [sym.imp.USER32.dll_ShowOwnedPopups]
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x40eb78
mov ecx, dword [esi + 8]
push 9
push ecx
call edi
pop edi
pop esi
ret 4
Function at 0x40ede0
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, ecx
lea ecx, [eax + 0x1d]
mov eax, 0x88888889
mul ecx
mov eax, dword [esi + 0xc]
push edi
mov edi, edx
shr edi, 4
cmp edi, eax
jbe 0x40ee29
sub edi, eax
je 0x40ee29
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push esi
push 0x40ef80
push 0
push 0
call ebx
test eax, eax
je 0x40ee29
push eax
lea ecx, [esi + 4]
call fcn.00463cb0
dec edi
jne 0x40ee09
pop edi
pop esi
pop ebx
ret 4

Function at 0x40ee30
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
call fcn.0040eeb0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x44], eax
add ecx, 0x1d
mov eax, 0x88888889
mul ecx
mov edi, edx
shr edi, 4
cmp edi, 5
jae 0x40ee60
mov edi, 5
jmp 0x40ee64
test edi, edi
je 0x40ee96
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push esi
push 0x40ef80
push 0
push 0
call ebx
test eax, eax
je 0x40ee92
push eax
lea ecx, [esi + 4]
call fcn.00463cb0
dec edi
jne 0x40ee6a
pop edi
pop esi
mov al, 1
pop ebx
ret 8
test edi, edi
jne 0x40ee9e
pop edi
pop esi
mov al, 1
pop ebx
ret 8
mov ecx, esi
call fcn.0040eeb0
pop edi
pop esi
xor al, al
pop ebx
ret 8

Function at 0x40eeb0
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
mov byte [esi], 1
mov eax, dword [esi + 0xc]
mov ecx, eax
dec eax
test ecx, ecx
je 0x40eed4
lea edi, [esi + 0x1c]
lea ebx, [eax + 1]
mov edx, dword [edi]
push 0
mov ecx, edi
call dword [edx + 4]
dec ebx
jne 0x40eec8
mov dword [esi + 0x14], 0xffffffff
mov edx, dword [esi + 0x14]
mov ecx, dword [esi + 0xc]
inc edx
mov eax, edx
mov dword [esi + 0x14], edx
cmp eax, ecx
jae 0x40ef33
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0xc]
cmp eax, ecx
jae 0x40ef0a
mov ecx, dword [esi + 8]
mov edi, dword [ecx + eax*8]
jmp 0x40ef0c
xor edi, edi
push 0xffffffffffffffff
push edi
call ebp
cmp eax, 0xffffffff
jne 0x40ef1f
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push edi
call ebx
mov edx, dword [esi + 0x14]
mov ecx, dword [esi + 0xc]
inc edx
mov eax, edx
mov dword [esi + 0x14], edx
cmp eax, ecx
jb 0x40eef8
pop ebp
lea edi, [esi + 0x1c]
mov dword [esi + 0xc], 0
push 0xffffffffffffffff
mov ecx, edi
mov edx, dword [edi]
call dword [edx + 4]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
cmp eax, 0xffffffff
je 0x40ef6d
test eax, eax
je 0x40ef61
push eax
mov ecx, 0x4a6ec8
call fcn.0041d230
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 8]
cmp eax, 0xffffffff
jne 0x40ef52
mov byte [esi], 0
pop edi
pop esi
pop ebx
ret
Function at 0x40f640
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x47fc58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov eax, dword [esp + 0x24]
mov ecx, dword [0x4a7144]
push ebx
push esi
push eax
lea edx, [esp + 0xc]
push ecx
push edx
call fcn.00462520
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov esi, dword [esp + 0x30]
xor ebx, ebx
mov byte [eax + ecx - 1], bl
mov edx, dword [esp + 0x18]
push edx
push 0x2712
push esi
mov dword [esp + 0x34], ebx
call fcn.00435f50
mov ecx, dword [esp + 0x48]
add esp, 0x18
lea eax, [esp + 8]
push ebx
push eax
call fcn.00467940
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov byte [ecx + edx - 1], bl
mov eax, dword [esp + 0xc]
push eax
push 0x2726
push esi
call fcn.00435f50
mov ecx, dword [0x4a70f4]
push ecx
push 0x2722
push esi
call fcn.00435f50
push 0x2710
push 0x9c
push esi
mov dword [esp + 0x50], 0x2710
call fcn.00435f50
mov edx, dword [esp + 0x50]
push edx
push 0x9b
push esi
call fcn.00435f50
push 0x408f90
push 0x4e6f
push esi
call fcn.00435f50
lea eax, [esp + 0x44]
push eax
push 0x272d
push esi
call fcn.00435f50
add esp, 0x48
push 0x408f90
push 0x4e2b
push esi
call fcn.00435f50
push ebx
push 0x2711
push esi
call fcn.00435f50
mov ecx, dword [esp + 0x24]
push esi
mov byte [ecx], bl
call fcn.00435f80
mov edx, dword [esp + 0x44]
add esp, 0x1c
cmp eax, ebx
mov dword [edx], eax
je 0x40f769
call fcn.00425529
cdq
mov ecx, 0x3e8
idiv ecx
add edx, 0x64
push edx
jmp 0x40f7c6
lea edx, [esp + 0x2c]
push edx
push 0x200002
push esi
call fcn.00436080
add esp, 0xc
test eax, eax
je 0x40f7a5
or esi, 0xffffffff
lea ecx, [esp + 8]
mov dword [esp + 0x1c], esi
call fcn.00462600
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 0x10
mov eax, dword [esp + 0x2c]
cmp eax, 0x12e
jne 0x40f7bd
mov dword [esp + 0x1c], 0xffffffff
jmp 0x40f840
cmp eax, 0xc8
je 0x40f7f5
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 8]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00462600
pop esi
mov eax, 0xfffffff9
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 0x10
lea ecx, [esp + 8]
call fcn.00462e00
push ebx
push str.expires:
lea ecx, [esp + 0x10]
call fcn.00462e80
or esi, 0xffffffff
cmp eax, esi
je 0x40f861
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
add eax, 8
mov byte [ecx + edx - 1], bl
mov ecx, dword [esp + 0xc]
add eax, ecx
cmp byte [eax], 0x20
jne 0x40f837
mov cl, byte [eax + 1]
inc eax
cmp cl, 0x20
je 0x40f82e
cmp byte [eax], 0x30
jne 0x40f861
mov dword [esp + 0x1c], esi
lea ecx, [esp + 8]
call fcn.00462600
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 0x10
push ebx
push str.set_cookie:_skey_
lea ecx, [esp + 0x10]
call fcn.00462e80
cmp eax, esi
mov dword [esp + 0x1c], esi
lea ecx, [esp + 8]
je 0x40f899
call fcn.00462600
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 0x10
call fcn.00462600
mov ecx, dword [esp + 0x14]
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 0x10
Function at 0x416130
Capabilities:
Create thread

Disassembly:
sub esp, 0x18
push esi
mov esi, ecx
mov ecx, dword [esp + 0x20]
push edi
push 0
push 0
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
add eax, 0x12c
add ecx, 0x50
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x18]
push eax
push ecx
push 0x50000000
push 0
push 0
mov ecx, esi
call fcn.004726e0
mov eax, 0xb56f3c
lea ecx, [esp + 8]
mov dword [esi + 0xe8], eax
mov dword [esi + 0x1a0], eax
mov dword [esi + 0x258], eax
mov eax, 0xffff
mov dword [esi + 0xf0], eax
mov dword [esi + 0x1a8], eax
mov dword [esi + 0x260], eax
mov edx, dword [0x4a6f38]
mov eax, dword [0x4a77e0]
push edx
push 0x49c8e0
push eax
push esi
push 0
mov edi, 6
push ecx
lea ecx, [esi + 0x3c]
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], 0x20
call fcn.0046ca50
mov ecx, dword [esp + 8]
mov edx, dword [0x4a6f38]
mov eax, dword [0x4a77e4]
add ecx, 0x5a
push edx
push 0x49c71c
mov dword [esp + 0x10], ecx
push eax
push esi
lea ecx, [esp + 0x18]
push 0
push ecx
lea ecx, [esi + 0xf4]
call fcn.0046ca50
mov edx, dword [esp + 8]
lea eax, [esp + 8]
add edx, 0x5a
lea ecx, [esi + 0x1ac]
mov dword [esp + 8], edx
mov edx, dword [0x4a6f38]
push edx
push 0
push 0
push esi
push 0
push eax
call fcn.0046ca50
mov eax, 0x40e
mov dword [esp + 0x10], edi
mov dword [esi + 0x254], eax
mov dword [esi + 0x19c], eax
mov dword [esi + 0xe4], eax
mov dword [esp + 0x14], 0x3c
mov dword [esp + 0x18], 0x126
mov dword [esp + 0x1c], 0x4a
push 0
push 0
lea ecx, [esp + 0x18]
push esi
push ecx
push 0x40000000
push 0
push 0
push 0
lea ecx, [esi + 0x264]
call fcn.004725b3
lea edi, [esi + 0x2c4]
push 0x4a6f4c
mov ecx, edi
call fcn.004626b0
push str._dat_b.dat
mov ecx, edi
call fcn.00462710
mov ecx, esi
call fcn.004162d0
lea edx, [esi + 0x2d0]
push edx
push 0
push esi
push 0x416a60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x2d4], eax
pop edi
pop esi
add esp, 0x18
ret 8
Function at 0x4172b0
Capabilities:
Create thread

Disassembly:
sub esp, 0x18
push esi
mov esi, ecx
mov ecx, dword [esp + 0x20]
push edi
mov edi, dword [esp + 0x2c]
push 0
mov dword [esi + 0x3c], edi
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
add eax, 0x12c
add ecx, 0x50
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x20], ecx
push 0
lea ecx, [esp + 0x18]
push eax
push ecx
push 0x50000000
push 0
push 0
mov ecx, esi
call fcn.004726e0
mov eax, edi
and eax, 3
cmp eax, 1
je 0x417311
cmp eax, 2
mov eax, 0xb56f3c
jne 0x417316
mov eax, 0xa36436
mov dword [esi + 0xec], eax
mov dword [esi + 0x1a4], eax
mov dword [esi + 0x25c], eax
mov eax, 0xffff
mov dword [esi + 0xf4], eax
mov dword [esi + 0x1ac], eax
mov dword [esi + 0x264], eax
mov edx, dword [0x4a6f38]
mov eax, dword [edi*4 + 0x4a7650]
push edx
push 0x49c8e0
push eax
push esi
lea ecx, [esp + 0x18]
push 0
push ecx
lea ecx, [esi + 0x40]
mov dword [esp + 0x20], 6
mov dword [esp + 0x24], 0x20
call fcn.0046ca50
mov ecx, dword [esp + 8]
mov edx, dword [0x4a6f38]
mov eax, dword [edi*4 + 0x4a76d0]
add ecx, 0x5a
push edx
push 0x49c71c
mov dword [esp + 0x10], ecx
push eax
push esi
lea ecx, [esp + 0x18]
push 0
push ecx
lea ecx, [esi + 0xf8]
call fcn.0046ca50
mov eax, dword [esp + 8]
mov edx, dword [0x4a6f38]
add eax, 0x5a
push edx
push 0
mov dword [esp + 0x10], eax
push 0
push esi
lea eax, [esp + 0x18]
push 0
push eax
lea ecx, [esi + 0x1b0]
call fcn.0046ca50
push 0
push 0
lea ecx, [esp + 0x18]
push esi
push ecx
mov eax, 0x40e
push 0x40000000
push 0
mov dword [esi + 0x258], eax
push 0
mov dword [esi + 0x1a0], eax
push 0
lea ecx, [esi + 0x268]
mov dword [esi + 0xe8], eax
mov dword [esp + 0x30], 6
mov dword [esp + 0x34], 0x3c
mov dword [esp + 0x38], 0x126
mov dword [esp + 0x3c], 0x4a
call fcn.004725b3
mov ecx, esi
call fcn.00417490
lea edx, [esi + 0x2e8]
push edx
push 0
push esi
push 0x418030
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x2ec], eax
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax*4 + 0x4a7450]
cmp byte [ecx], 0
je 0x417480
call fcn.00425529
and eax, reloc.WS2_32.dll_accept
jns 0x41746b
dec eax
or eax, 0xfffffffe
inc eax
je 0x417480
mov eax, 1
pop edi
mov dword [esi + 0x324], eax
pop esi
add esp, 0x18
ret 0xc
xor eax, eax
pop edi
mov dword [esi + 0x324], eax
pop esi
add esp, 0x18
ret 0xc