joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4373f0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x68
push esi
push edi
sub esp, 0x18
mov ecx, esp
push 4
push str.kill
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
call fcn.00408530
call fcn.0042a500
add esp, 0x18
mov dword [esp + 0x28], 0x44
xor eax, eax
mov dword [esp + 0x34], str.taskkill
mov word [esp + 0x6a], ax
xorps xmm0, xmm0
mov word [esp + 0x58], ax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x2c]
movlpd qword [esp + 0x54], xmm0
or dword [esp + 0x58], 1
push eax
push 0
push 0
push 0x200
push 1
push 0
push 0
push str.taskkill__F__IM_xspa.exe__IM_work.exe
push 0
movlpd qword [esp + 0x54], xmm0
movlpd qword [esp + 0x60], xmm0
movlpd qword [esp + 0x68], xmm0
movlpd qword [esp + 0x70], xmm0
movlpd qword [esp + 0x82], xmm0
movlpd qword [esp + 0x8a], xmm0
movaps xmmword [esp + 0x38], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4374b0
call edi
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push dword [esp + 0x14]
call esi
mov eax, str.taskkill
cmp eax, 0x518960
jne 0x4374db
mov eax, dword [0x533960]
movups xmm0, xmmword [esp + 0x10]
movups xmmword [eax + 0x284], xmm0
xor eax, eax
mov dword [esp + 0x28], 0x44
mov word [esp + 0x6a], ax
xorps xmm0, xmm0
mov word [esp + 0x58], ax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x2c]
movlpd qword [esp + 0x54], xmm0
or dword [esp + 0x58], 1
push eax
push 0
push 0
push 0x200
push 1
push 0
push 0
push str.schtasks__delete__tn__SPA_AUTO___f
push 0
movlpd qword [esp + 0x54], xmm0
movlpd qword [esp + 0x60], xmm0
movlpd qword [esp + 0x68], xmm0
movlpd qword [esp + 0x70], xmm0
movlpd qword [esp + 0x82], xmm0
movlpd qword [esp + 0x8a], xmm0
mov dword [esp + 0x5c], str.schtasks
movaps xmmword [esp + 0x38], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x437560
call edi
push 0xffffffffffffffff
push dword [esp + 0x14]
call esi
mov eax, str.schtasks
cmp eax, 0x518960
jne 0x437585
mov eax, dword [0x533960]
movups xmm0, xmmword [esp + 0x10]
movups xmmword [eax + 0x284], xmm0
xor eax, eax
mov dword [esp + 0x28], 0x44
mov word [esp + 0x6a], ax
xorps xmm0, xmm0
mov word [esp + 0x58], ax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x2c]
movlpd qword [esp + 0x54], xmm0
or dword [esp + 0x58], 1
push eax
push 0
push 0
push 0x200
push 1
push 0
push 0
push str.schtasks__delete__tn__SPA_AUTO__USERNAME____f
push 0
movlpd qword [esp + 0x54], xmm0
movlpd qword [esp + 0x60], xmm0
movlpd qword [esp + 0x68], xmm0
movlpd qword [esp + 0x70], xmm0
movlpd qword [esp + 0x82], xmm0
movlpd qword [esp + 0x8a], xmm0
mov dword [esp + 0x5c], str.schtasks
movaps xmmword [esp + 0x38], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x43760a
call edi
push 0xffffffffffffffff
push dword [esp + 0x14]
call esi
mov eax, str.schtasks
cmp eax, 0x518960
jne 0x43762f
mov eax, dword [0x533960]
movups xmm0, xmmword [esp + 0x10]
movups xmmword [eax + 0x284], xmm0
call fcn.0042e0b0
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x43a8e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x43a9c6
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x43a9b5
jg 0x43a920
test edx, edx
je 0x43a9b5
nop dword [eax]
call fcn.0043dca0
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x43a974
jg 0x43a937
test esi, esi
je 0x43a974
cmp ebx, eax
jg 0x43a947
jl 0x43a941
cmp edi, esi
jae 0x43a947
mov esi, edi
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push esi
push eax
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.004c87d0
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x43a999
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov edx, dword [ecx]
movzx eax, byte [eax]
push eax
call dword [edx + 0xc]
cmp eax, 0xffffffff
je 0x43a9af
mov ecx, dword [esp + 0xc]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x10], esi
test ebx, ebx
jg 0x43a920
jl 0x43a9af
test edi, edi
jne 0x43a920
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x43a9e8
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x43a9ea
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x43aa68
jg 0x43a9fd
test esi, esi
je 0x43aa68
test eax, eax
jl 0x43aa42
jg 0x43aa07
test ebx, ebx
je 0x43aa42
cmp edi, eax
jg 0x43aa17
jl 0x43aa11
cmp esi, ebx
jae 0x43aa17
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [ebp + 8]
push dword [esp + 0x18]
call fcn.004c87d0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
add edx, ebx
sub esi, ebx
mov eax, dword [ecx + 0x30]
sbb edi, dword [esp + 0x14]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
jmp 0x43aa45
mov edx, dword [ebp + 8]
test edi, edi
jl 0x43aa68
jg 0x43aa4f
test esi, esi
je 0x43aa68
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x43aa68
push eax
push esi
push 1
push edx
call fcn.004da16d
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x43afb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x52c018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x43afe0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00474416
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x43b01c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x43b01c
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00474416
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x43b103
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x43b044
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x43b077
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.004d58fc
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00474416
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x43b103
cmp eax, 1
jle 0x43b0d6
cmp eax, 3
jne 0x43b103
push dword [esi + 0x4c]
movsx eax, byte [ebp - 0x25]
push eax
call fcn.004d58fc
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00474416
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x43b0f3
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004da16d
add esp, 0x10
cmp edi, eax
jne 0x43b103
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x43b007
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00474416
mov esp, ebp
pop ebp
ret 4
Function at 0x43d680
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, 0x1505
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movsx esi, byte [eax]
mov dword [edi], 0x1505
test esi, esi
je 0x43d6b7
mov ecx, eax
mov edx, dword [edi]
lea ecx, [ecx + 1]
shl edx, 5
add edx, dword [edi]
xor edx, esi
movsx esi, byte [ecx]
mov dword [edi], edx
test esi, esi
jne 0x43d6a2
mov ecx, dword [ebx]
mov eax, dword [ebx + 4]
dec ecx
and ecx, edx
mov dword [edi], ecx
mov esi, dword [eax + ecx*4]
test esi, esi
je 0x43d704
mov edi, dword [ebp + 8]
nop dword [eax + eax]
mov eax, dword [esi + 4]
mov ecx, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x43d6f5
test dl, dl
je 0x43d6f1
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x43d6f5
add ecx, 2
add eax, 2
test dl, dl
jne 0x43d6d5
xor eax, eax
jmp 0x43d6fa
sbb eax, eax
or eax, 1
test eax, eax
je 0x43d70d
mov esi, dword [esi]
test esi, esi
jne 0x43d6d0
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x43d720
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x52c018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x43d7da
cmp byte [esi + 0x3d], 0
je 0x43d7da
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x43d7c8
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x43d790
sub eax, 1
je 0x43d794
sub eax, 2
jne 0x43d7c8
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00474416
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x43d7b1
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004da16d
add esp, 0x10
cmp edi, eax
jne 0x43d7c8
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00474416
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00474416
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.00474416
mov esp, ebp
pop ebp
ret
Function at 0x43e490
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f4e80
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x52c018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00474630
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.00460fca
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x441250
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x441281
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x441270
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x441f40
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f5328
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x52c018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 0x1c]
mov eax, dword [eax + 0x30]
mov esi, dword [eax + 4]
mov ecx, esi
mov dword [ebp - 0x10], esi
mov eax, dword [esi]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0
push eax
call fcn.0043eeb0
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ebx, eax
test esi, esi
je 0x441fb0
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 8]
test eax, eax
je 0x441fb0
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
push ebx
lea eax, [ebp + 0x1c]
mov dword [ebp + 0x1c], 0
push eax
push 0x270f
push 0
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp + 0xc]
push eax
push edi
call fcn.00444720
mov ecx, dword [ebp + 0x20]
add esp, 0x1c
or dword [ecx], eax
test al, 2
jne 0x441ffa
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x24]
cmp eax, 0x45
jge 0x441fed
add eax, 0x64
jmp 0x441ff7
cmp eax, 0x64
jl 0x441ff7
add eax, 0xfffff894
mov dword [ecx + 0x14], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [eax], ecx
mov ecx, dword [ebp + 0x10]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20

Function at 0x443d60
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f56e7
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x52c018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edi
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [edi], eax
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
lea esi, [edi + 0x38]
mov dword [edi + 0x30], 0
mov byte [edi + 0x34], 0
mov dword [ebp - 0x14], esi
mov dword [esi + 0x24], 0
mov byte [ebp - 4], 4
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x443e14
mov eax, dword [ecx]
push esi
call dword [eax]
mov dword [esi + 0x24], eax
mov al, byte [ebp + 0xc]
lea ecx, [edi + 0x70]
mov byte [ebp - 4], 5
mov byte [edi + 0x60], al
push 9
mov byte [edi + 0x68], 9
call fcn.004088b0
lea eax, [ebp - 0xd]
mov byte [ebp - 4], 6
push eax
lea ecx, [edi + 0x10]
mov byte [ebp - 0xd], 1
call fcn.0043bb20
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x443e58
mov esi, dword [ecx]
lea eax, [ebp + 0x10]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x30
Function at 0x455e40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
xor ecx, ecx
test esi, esi
je 0x455e6b
mov edx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x455e54
pop edi
mov eax, edx
pop esi
pop ebp
ret
mov eax, dword [ebp + 8]
pop esi
pop ebp
ret
Function at 0x456c90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
test esi, esi
je 0x456e22
mov eax, dword [esi + 0x20]
mov dword [esi + 0x18], 0
test eax, eax
jne 0x456cbc
mov dword [esi + 0x28], eax
mov eax, 0x45d6f0
mov dword [esi + 0x20], 0x45d6f0
cmp dword [esi + 0x24], 0
jne 0x456cc9
mov dword [esi + 0x24], 0x45d710
cmp edx, 0xffffffff
mov ebx, 6
cmovne ebx, edx
cmp ebx, 9
ja 0x456e22
cmp dword [ebp + 0x14], 4
ja 0x456e22
push edi
push 0x16c4
push 1
push dword [esi + 0x28]
call eax
mov edi, eax
add esp, 0xc
test edi, edi
je 0x456e18
mov dword [esi + 0x1c], edi
push 2
mov dword [edi], esi
mov dword [edi + 0x18], 2
mov dword [edi + 0x1c], 0
mov dword [edi + 0x30], 0xf
mov dword [edi + 0x2c], 0x8000
mov dword [edi + 0x34], 0x7fff
mov dword [edi + 0x50], 0xf
mov dword [edi + 0x4c], 0x8000
mov dword [edi + 0x54], 0x7fff
mov dword [edi + 0x58], 5
mov eax, dword [esi + 0x20]
push 0x8000
push dword [esi + 0x28]
call eax
push 2
push dword [edi + 0x2c]
mov dword [edi + 0x38], eax
push dword [esi + 0x28]
mov eax, dword [esi + 0x20]
call eax
push 2
push dword [edi + 0x4c]
mov dword [edi + 0x40], eax
push dword [esi + 0x28]
mov eax, dword [esi + 0x20]
call eax
push 4
mov dword [edi + 0x44], eax
mov dword [edi + 0x16c0], 0
mov dword [edi + 0x169c], 0x4000
mov eax, dword [esi + 0x20]
push 0x4000
push dword [esi + 0x28]
call eax
mov edx, eax
add esp, 0x30
cmp dword [edi + 0x38], 0
mov eax, dword [edi + 0x169c]
mov dword [edi + 8], edx
lea ecx, [eax*4]
mov dword [edi + 0xc], ecx
je 0x456e02
cmp dword [edi + 0x40], 0
je 0x456e02
cmp dword [edi + 0x44], 0
je 0x456e02
test edx, edx
je 0x456e02
mov ecx, dword [edi + 0x169c]
shr eax, 1
mov dword [edi + 0x84], ebx
mov byte [edi + 0x24], 8
lea eax, [edx + eax*2]
mov dword [edi + 0x16a4], eax
lea eax, [edx + ecx*2]
add eax, ecx
mov ecx, esi
mov dword [edi + 0x1698], eax
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x88], eax
pop edi
pop esi
pop ebx
pop ebp
jmp fcn.00456e30
mov eax, dword [str.insufficient_memory]
mov ecx, esi
mov dword [edi + 4], 0x29a
mov dword [esi + 0x18], eax
call fcn.00457aa0
pop edi
pop esi
mov eax, 0xfffffffc
pop ebx
pop ebp
ret
pop esi
mov eax, 0xfffffffe
pop ebx
pop ebp
ret
Function at 0x456e30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
test esi, esi
je 0x456fb7
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x456fb7
cmp dword [esi + 0x20], 0
je 0x456fb7
cmp dword [esi + 0x24], 0
je 0x456fb7
mov dword [esi + 0x14], 0
mov dword [esi + 8], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x2c], 2
mov edx, dword [ecx + 0x18]
mov eax, dword [ecx + 8]
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x10], eax
test edx, edx
jns 0x456e8f
neg edx
mov dword [ecx + 0x18], edx
test edx, edx
mov eax, 0x71
push edi
mov edi, 0x2a
cmovne eax, edi
mov dword [ecx + 4], eax
xor eax, eax
cmp edx, 2
setne al
mov dword [esi + 0x30], eax
lea eax, [ecx + 0x94]
mov dword [ecx + 0xb18], eax
lea eax, [ecx + 0x988]
mov dword [ecx + 0xb24], eax
lea eax, [ecx + 0xa7c]
mov dword [ecx + 0xb30], eax
xor eax, eax
mov dword [ecx + 0x28], 0
mov dword [ecx + 0xb20], 0x52cecc
mov dword [ecx + 0xb2c], 0x52ce34
mov dword [ecx + 0xb38], 0x52ceb8
mov word [ecx + 0x16b8], ax
mov dword [ecx + 0x16bc], eax
call fcn.0045bf60
mov esi, dword [esi + 0x1c]
xor edx, edx
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x4c]
add eax, eax
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x44]
mov word [eax + ecx*2 - 2], dx
mov eax, dword [esi + 0x4c]
lea eax, [eax*2 - 2]
push eax
push edx
push dword [esi + 0x44]
call fcn.004c92d0
mov eax, dword [esi + 0x84]
add esp, 0xc
lea ecx, [eax + eax*2]
movzx eax, word [ecx*4 + 0x514d8a]
mov dword [esi + 0x80], eax
movzx eax, word [ecx*4 + 0x514d88]
mov dword [esi + 0x8c], eax
movzx eax, word [ecx*4 + 0x514d8c]
mov dword [esi + 0x90], eax
xor eax, eax
movzx ecx, word [ecx*4 + 0x514d8e]
pop edi
mov dword [esi + 0x7c], ecx
mov dword [esi + 0x6c], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x16b4], 0
mov dword [esi + 0x78], 2
mov dword [esi + 0x60], 2
mov dword [esi + 0x68], 0
mov dword [esi + 0x48], 0
pop esi
ret
mov eax, 0xfffffffe
pop esi
ret
Function at 0x459180
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
mov dword [edi], 0
nop dword [eax]
mov eax, ebx
sub eax, esi
push eax
lea eax, [esi + edx]
push eax
push dword [ecx + 0x14]
call fcn.004df0e1
add esp, 0xc
test eax, eax
jle 0x4591c8
mov esi, dword [edi]
mov ecx, dword [ebp - 4]
add esi, eax
mov edx, dword [ebp - 8]
mov dword [edi], esi
cmp esi, ebx
jb 0x4591a0
pop edi
pop esi
pop ebx
test eax, eax
jns 0x4591f1
call fcn.004d5610
push dword [eax]
call fcn.004db2b5
mov ecx, dword [ebp - 4]
or edx, 0xffffffff
push eax
call fcn.00459080
add esp, 8
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret
jne 0x4591fd
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x40], 1
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x47b800
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
sub esp, 0x18
mov eax, dword [0x52c018]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
mov esi, dword [esp + 0x20]
test esi, esi
je 0x47b8cb
lea eax, [esp + 4]
push eax
push esi
push 2
call fcn.0048d9e0
add esp, 0xc
test eax, eax
jne 0x47b8cb
lea eax, [esp + 8]
push eax
push esi
push 0x17
call fcn.0048d9e0
add esp, 0xc
test eax, eax
jne 0x47b8cb
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x47b854
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.0048d9b0
add esp, 0xc
test eax, eax
je 0x47b888
sub eax, esi
push eax
push 0x2e
push esi
call fcn.0048d9b0
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x47b88a
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
mov ebx, 0x1505
add edi, esi
cmp esi, edi
jae 0x47b8b6
mov al, byte [esi]
push eax
call fcn.00484200
movsx ecx, al
inc esi
mov eax, ebx
add esp, 4
shl eax, 5
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp esi, edi
jb 0x47b898
pop edi
movzx eax, bl
pop ebx
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.00474416
add esp, 0x18
ret
mov ecx, dword [esp + 0x18]
xor eax, eax
pop esi
xor ecx, esp
call fcn.00474416
add esp, 0x18
ret

Function at 0x47c530
Capabilities:
Create udp socket

Disassembly:
mov eax, dword [0x52c054]
cmp eax, 0xffffffff
jne 0x47c572
push 0
push 2
push 0x17
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
jne 0x47c558
xor eax, eax
test eax, eax
mov dword [0x52c054], eax
setg al
ret
push eax
push 0
mov dword [0x52c054], 1
call fcn.00481b10
mov eax, dword [0x52c054]
add esp, 8
test eax, eax
setg al
ret

Function at 0x47c580
Capabilities:
Create udp socket

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x2f0], 2
jne 0x47c5d5
mov eax, dword [0x52c054]
cmp eax, 0xffffffff
jne 0x47c5cf
push 0
push 2
push 0x17
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
jne 0x47c5b5
xor eax, eax
test eax, eax
mov dword [0x52c054], eax
setg al
ret
push eax
push 0
mov dword [0x52c054], 1
call fcn.00481b10
mov eax, dword [0x52c054]
add esp, 8
test eax, eax
setg al
ret
mov al, 1
ret

Function at 0x480ec0
Capabilities:
Write file on windows

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp dword [edi + 0x608], 0
je 0x480f04
push esi
push 1
push edi
call fcn.00478ee0
push dword [edi + 0x59c]
mov eax, dword [edi + 0x608]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push edi
call eax
push 0
push edi
mov esi, eax
call fcn.00478ee0
add esp, 0x24
mov eax, esi
pop esi
pop edi
ret
mov eax, dword [esp + 0xc]
cmp eax, 2
ja 0x480f3d
push dword [edi + 0x598]
lea eax, [eax + eax*2]
push 1
add eax, 0x4fe488
push 2
push eax
call fcn.004da16d
push dword [edi + 0x598]
push 1
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call fcn.004da16d
add esp, 0x20
xor eax, eax
pop edi
ret