joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4321f0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push 0x1000
push 0
push dword [0x4a96f8]
mov dword [esp + 0x14], 0x1000
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esp + 0x10], edx
test edx, edx
je 0x432374
mov cl, byte [esp + 3]
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x28]
push esi
push edi
mov esi, edx
mov edi, edi
cmp ebp, 0xffffffff
je 0x43223e
test ebp, ebp
je 0x4322e0
dec ebp
cmp dword [ebx + 4], 0
je 0x432257
push 1
lea eax, [esp + 0x17]
push eax
push ebx
call fcn.004327b0
mov dword [esp + 0x14], eax
jmp 0x432271
push 0
lea eax, [esp + 0x18]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
mov cl, byte [esp + 0x13]
cmp eax, 1
jne 0x4322e0
test cl, cl
je 0x432285
mov byte [esi], cl
inc esi
mov cl, byte [esp + 0x13]
mov eax, dword [esp + 0x18]
mov edi, esi
mov edx, dword [esp + 0x20]
dec eax
sub edi, edx
cmp edi, eax
jle 0x4322c0
mov eax, dword [esp + 0x18]
add eax, 0x1000
push eax
push edx
push 8
push dword [0x4a96f8]
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov cl, byte [esp + 0x13]
mov edx, eax
mov dword [esp + 0x20], edx
lea esi, [edi + edx]
test cl, cl
je 0x4322e0
cmp dword [esp + 0x2c], 0
jne 0x432230
cmp cl, 0xd
je 0x4322e7
cmp cl, 0xa
jne 0x432230
dec esi
jmp 0x432357
cmp dword [esp + 0x2c], 0
jne 0x432357
cmp cl, 0xa
jne 0x4322ef
dec esi
jmp 0x432357
cmp cl, 0xd
jne 0x432357
dec esi
cmp dword [ebx + 4], 0
je 0x43230e
push 1
lea eax, [esp + 0x17]
push eax
push ebx
call fcn.004327b0
mov dword [esp + 0x14], eax
jmp 0x432324
push 0
lea eax, [esp + 0x18]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [esp + 0x13], 0xa
je 0x432357
cmp dword [ebx + 4], 0
je 0x432336
inc dword [ebx + 0xc]
jmp 0x432357
push 1
lea eax, [esp + 0x20]
mov dword [esp + 0x1c], 0xffffffff
push eax
push 0xffffffffffffffff
push dword [ebx]
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x34]
mov ecx, esi
sub ecx, dword [esp + 0x20]
pop edi
mov dword [eax], ecx
mov eax, dword [esp + 0x1c]
mov byte [esi], 0
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x10
xor eax, eax
add esp, 0x14
ret 0x10
Function at 0x432380
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
push 0x1000
push 0
push dword [0x4a96f8]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
mov dword [esp + 8], ecx
test ecx, ecx
je 0x43252d
mov ax, word [esp]
push ebx
mov ebx, dword [esp + 0x20]
push ebp
mov ebp, dword [esp + 0x2c]
push esi
push edi
mov edi, ecx
mov dword [esp + 0x20], 0x1000
mov dword [esp + 0x1c], 0x7ff
cmp ebp, 0xffffffff
je 0x4323d4
test ebp, ebp
je 0x43248d
dec ebp
cmp dword [ebx + 4], 0
je 0x4323ed
push 2
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.004327b0
mov dword [esp + 0x14], eax
jmp 0x432407
push 0
lea eax, [esp + 0x18]
push eax
push 2
lea eax, [esp + 0x1c]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
cmp eax, 2
mov ax, word [esp + 0x10]
jne 0x43248d
test ax, ax
je 0x432421
mov word [edi], ax
add edi, 2
mov ax, word [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov esi, edi
mov edx, dword [esp + 0x1c]
sub esi, ecx
sar esi, 1
cmp esi, edx
jle 0x432468
mov eax, dword [esp + 0x20]
add edx, 0x800
add eax, 0x1000
mov dword [esp + 0x1c], edx
push eax
push ecx
push 8
push dword [0x4a96f8]
mov dword [esp + 0x30], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, eax
mov ax, word [esp + 0x10]
mov dword [esp + 0x18], ecx
lea edi, [ecx + esi*2]
test ax, ax
je 0x43248d
cmp dword [esp + 0x30], 0
jne 0x4323c6
cmp ax, 0xd
je 0x432494
cmp ax, 0xa
jne 0x4323c6
sub edi, 2
jmp 0x43250c
cmp dword [esp + 0x30], 0
jne 0x43250c
cmp ax, 0xa
jne 0x43249f
sub edi, 2
jmp 0x43250c
cmp ax, 0xd
jne 0x43250c
sub edi, 2
cmp dword [ebx + 4], 0
je 0x4324c1
push 2
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.004327b0
mov dword [esp + 0x14], eax
jmp 0x4324d7
push 0
lea eax, [esp + 0x18]
push eax
push 2
lea eax, [esp + 0x1c]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp word [esp + 0x10], 0xa
je 0x43250c
cmp dword [ebx + 4], 0
je 0x4324eb
add dword [ebx + 0xc], 2
jmp 0x43250c
push 1
lea eax, [esp + 0x28]
mov dword [esp + 0x24], 0xfffffffe
push eax
push 0xfffffffffffffffe
push dword [ebx]
mov dword [esp + 0x34], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x38]
mov ecx, edi
sub ecx, dword [esp + 0x18]
sar ecx, 1
mov dword [eax], ecx
xor eax, eax
mov word [edi], ax
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x10
xor eax, eax
add esp, 0x18
ret 0x10
Function at 0x432540
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push 0x1000
push 0
push dword [0x4a96f8]
mov dword [esp + 0x10], 0x1000
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esp + 0xc], edx
test edx, edx
je 0x432690
mov eax, dword [esp + 0x1c]
mov cl, byte [esp + 3]
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
push edi
mov edi, dword [esp + 0x30]
mov esi, edx
cmp edi, 0xffffffff
je 0x43258c
test edi, edi
je 0x4325fd
dec edi
push esi
push ebp
call fcn.004328d0
mov dword [esp + 0x20], eax
test eax, eax
jne 0x43259f
xor cl, cl
jmp 0x4325a1
mov cl, byte [esi]
mov edx, dword [esp + 0x1c]
add esi, eax
mov eax, dword [esp + 0x14]
mov ebx, esi
sub ebx, edx
mov byte [esp + 0x13], cl
add eax, 0xfffffffb
cmp ebx, eax
jle 0x4325e4
mov eax, dword [esp + 0x14]
add eax, 0x1000
push eax
push edx
push 8
push dword [0x4a96f8]
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov cl, byte [esp + 0x13]
mov edx, eax
mov dword [esp + 0x1c], edx
lea esi, [ebx + edx]
mov eax, dword [esp + 0x2c]
test cl, cl
je 0x4325fd
test eax, eax
jne 0x432582
cmp cl, 0xd
je 0x432601
cmp cl, 0xa
jne 0x432582
dec esi
jmp 0x432673
test eax, eax
jne 0x432673
cmp cl, 0xa
jne 0x432609
dec esi
jmp 0x432673
cmp cl, 0xd
jne 0x432673
dec esi
cmp dword [ebp + 4], 0
je 0x432628
push 1
lea eax, [esp + 0x17]
push eax
push ebp
call fcn.004327b0
mov dword [esp + 0x20], eax
jmp 0x43263f
push 0
lea eax, [esp + 0x24]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [ebp]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [esp + 0x13], 0xa
je 0x432673
cmp dword [ebp + 4], 0
je 0x432651
inc dword [ebp + 0xc]
jmp 0x432673
push 1
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 0xffffffff
push eax
push 0xffffffffffffffff
push dword [ebp]
mov dword [esp + 0x28], 0xffffffff
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x34]
mov ecx, esi
sub ecx, dword [esp + 0x1c]
pop edi
mov dword [eax], ecx
mov eax, dword [esp + 0x18]
mov byte [esi], 0
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x10
xor eax, eax
add esp, 0x14
ret 0x10
Function at 0x4326a0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
mov dword [esp + 4], 0
cmp dword [esi + 0x1c], 0
jne 0x4327a7
cmp dword [esi + 0x14], 1
jne 0x4326eb
mov eax, dword [esi + 0xc]
lea ecx, [esp + 0xc]
push 1
neg eax
cdq
push ecx
push eax
push dword [esi]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esi + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
push edi
mov edi, dword [esp + 0x20]
cmp eax, edi
jle 0x432768
mov ecx, dword [esi + 8]
add ecx, dword [esi + 4]
sub ecx, eax
mov eax, edi
dec eax
je 0x432753
dec eax
je 0x43273c
sub eax, 2
je 0x432727
push edi
push dword [esp + 0x20]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov ax, word [eax]
mov word [ecx], ax
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov al, byte [eax]
mov byte [ecx], al
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
push esi
call fcn.00431690
mov eax, dword [esi + 8]
cmp edi, eax
jl 0x432795
push 0
lea eax, [esp + 0xc]
push eax
push edi
push dword [esp + 0x28]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
add esp, 0xc
ret 0xc
mov ecx, dword [esi + 4]
sub ecx, dword [esi + 0xc]
push edi
push dword [esp + 0x20]
add ecx, eax
jmp 0x432711
xor eax, eax
pop esi
add esp, 0xc
ret 0xc
Function at 0x4327b0
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
cmp dword [esi + 0x14], 0
jne 0x4327d1
push esi
call fcn.00431690
mov dword [esi + 0x14], 1
mov dword [esi + 0xc], 0
mov ebx, dword [esi + 0xc]
mov edi, dword [esp + 0x18]
mov eax, dword [esi + 0x10]
cmp ebx, edi
jl 0x432845
add eax, dword [esi + 4]
mov ecx, edi
sub eax, ebx
dec ecx
je 0x432832
dec ecx
je 0x43281d
sub ecx, 2
je 0x43280a
push edi
push eax
push dword [esp + 0x1c]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
mov ecx, dword [eax]
mov eax, dword [esp + 0x14]
mov dword [eax], ecx
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
mov cx, word [eax]
mov eax, dword [esp + 0x14]
mov word [eax], cx
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
mov ecx, dword [esp + 0x14]
mov dl, byte [eax]
mov eax, edi
mov byte [ecx], dl
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
push ebp
mov ebp, dword [esp + 0x18]
sub eax, ebx
add eax, dword [esi + 4]
push ebx
push eax
push ebp
call sub.MSVCRT.dll_memcpy
mov eax, dword [esi + 8]
add esp, 0xc
sub edi, ebx
add ebp, ebx
push 0
cmp edi, eax
jl 0x43288a
lea eax, [esp + 0x18]
push eax
push edi
push ebp
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
pop ebp
pop edi
mov dword [esi + 0xc], 0
add eax, ebx
pop esi
pop ebx
ret 0xc
lea ecx, [esp + 0x18]
push ecx
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
cmp edi, eax
jle 0x4328ab
mov edi, eax
push edi
push dword [esi + 4]
push ebp
call sub.MSVCRT.dll_memcpy
sub dword [esi + 0xc], edi
lea eax, [ebx + edi]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x4328d0
Capabilities:
Read file on windows

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [edi + 4], 0
je 0x4328f7
push 1
lea eax, [esp + 0x10]
push eax
push edi
call fcn.004327b0
mov dword [esp + 4], eax
jmp 0x432911
push 0
lea eax, [esp + 8]
push eax
push 1
lea eax, [esp + 0x18]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 4]
cmp eax, 1
je 0x43291d
xor eax, eax
pop edi
pop ecx
ret 8
mov cl, byte [esp + 0xc]
test cl, cl
js 0x432939
mov eax, dword [esp + 0x10]
pop edi
mov byte [eax], cl
mov byte [eax + 1], 0
mov eax, 1
pop ecx
ret 8
mov al, cl
and al, 0xe0
push esi
cmp al, 0xc0
jne 0x432949
mov esi, 2
jmp 0x432965
mov al, cl
and al, 0xf0
cmp al, 0xe0
jne 0x432958
mov esi, 3
jmp 0x432965
mov al, cl
and al, 0xf8
cmp al, 0xf0
jne 0x4329c2
mov esi, 4
mov edx, dword [esp + 0x14]
mov byte [edx], cl
cmp dword [edi + 4], 0
je 0x432994
lea eax, [esi - 1]
push eax
lea eax, [edx + 1]
push eax
push edi
call fcn.004327b0
mov edx, eax
lea ecx, [esi - 1]
xor eax, eax
cmp edx, ecx
setne al
dec eax
and eax, esi
pop esi
pop edi
pop ecx
ret 8
push 0
lea eax, [esp + 0xc]
push eax
lea eax, [esi - 1]
push eax
lea eax, [edx + 1]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [esp + 8]
lea ecx, [esi - 1]
xor eax, eax
cmp edx, ecx
setne al
dec eax
and eax, esi
pop esi
pop edi
pop ecx
ret 8
mov eax, dword [esp + 0x14]
pop esi
pop edi
mov word [eax], 0x3f
mov eax, 1
pop ecx
ret 8

Function at 0x43470b
Capabilities:
Set thread local storage value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
xor ebx, ebx
push edi
mov edi, ebx
test esi, esi
je 0x434768
push esi
call dword [esi + 0x58]
mov ecx, dword [esi + 0x80]
mov edi, eax
mov dword [esi + 0x94], ecx
mov ecx, dword [esi + 0x84]
mov dword [esi + 0x98], ecx
test edi, edi
jne 0x434768
mov eax, dword [esi + 0x70]
test eax, eax
je 0x434747
push ebx
push esi
call eax
push esi
push ebx
push dword [0x4a96f8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
push dword [0x4ab42c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [0x4ab430], ebx
mov eax, edi
pop edi
pop esi
pop ebx
ret 4
Function at 0x43587d
Capabilities:
Set thread local storage value

Disassembly:
push esi
push 0x10c
push 8
push dword [0x4a96f8]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
push esi
push dword [0x4ab42c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [0x4ab430], esi
mov eax, esi
and dword [esi + 0xa8], 0
or dword [esi + 0xac], 0xffffffff
or dword [esi + 0xb0], 0xffffffff
mov dword [esi + 0xa4], 0xffffff
mov dword [esi + 0x74], 1
mov dword [esi + 0x78], 7
mov dword [esi], 0x434929
mov dword [esi + 4], 0x434949
mov dword [esi + 8], 0x435679
mov dword [esi + 0xc], 0x4349e1
mov dword [esi + 0x10], 0x434ef7
mov dword [esi + 0x14], 0x434e89
mov dword [esi + 0x18], 0x434ec7
mov dword [esi + 0x1c], 0x434edf
mov dword [esi + 0x20], fcn.00434f53
mov dword [esi + 0x24], 0x434d58
mov dword [esi + 0x28], fcn.00434bad
mov dword [esi + 0x2c], 0x434ac4
mov dword [esi + 0x30], 0x434e1f
mov dword [esi + 0x34], 0x434d74
mov dword [esi + 0x38], 0x434fd0
mov dword [esi + 0x3c], 0x4350e1
mov dword [esi + 0x40], 0x435185
mov dword [esi + 0x44], 0x43521c
mov dword [esi + 0x48], 0x43531a
mov dword [esi + 0x4c], 0x4354fb
mov dword [esi + 0x50], 0x43536b
mov dword [esi + 0x54], 0x4355bd
mov dword [esi + 0x58], 0x4356b8
mov dword [esi + 0x5c], 0x435773
mov dword [esi + 0x60], 0x4357eb
mov dword [esi + 0x64], 0x435831
pop esi
ret

Function at 0x435d0b
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
push esi
push edi
xor edi, edi
push edi
push pe_nt_image_headers32
push 3
push edi
push 1
push bind
push dword [esp + 0x2c]
mov ebp, edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x435d8f
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
push ebx
push edi
push dword [0x4a96f8]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x435d87
push ebp
lea eax, [esp + 0x1c]
push eax
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x435d78
cmp dword [esp + 0x18], ebx
jne 0x435d78
push ebx
push edi
push dword [esp + 0x1c]
call fcn.00435e20
mov ebp, eax
push edi
push 0
push dword [0x4a96f8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
pop esi
mov eax, ebp
pop ebp
ret 0xc
Function at 0x4375c8
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push 0x487a28
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x4aabec], eax
test eax, eax
je 0x4375f6
push str.AlphaBlend
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4aabe8], eax
lea eax, [ebp - 0x114]
mov dword [0x4aabf0], 1
push eax
mov dword [ebp - 0x114], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x437658
cmp dword [ebp - 0x104], 1
jne 0x43762d
and dword [0x4aabf0], 0
jmp 0x437670
cmp dword [ebp - 0x104], 2
jne 0x437658
cmp dword [ebp - 0x110], 5
jb 0x437624
jne 0x437658
mov eax, dword [ebp - 0x10c]
neg eax
sbb eax, eax
and eax, dword [0x4aabf0]
mov dword [0x4aabf0], eax
jmp 0x43765d
mov eax, dword [0x4aabf0]
test eax, eax
je 0x437670
call fcn.00436e3b
neg eax
sbb eax, eax
and dword [0x4aabf0], eax
mov esp, ebp
pop ebp
ret

Function at 0x4386e0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x438712
push 0
lea ecx, [esp + 0x10]
push ecx
push esi
push dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x43870d
cmp dword [esp + 0xc], esi
je 0x438729
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [edi + 4]
add eax, dword [edi + 8]
push esi
push dword [esp + 0x14]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add dword [edi + 8], esi
pop edi
mov eax, 1
pop esi
ret
Function at 0x44fb70
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
cmp edi, 8
jl 0x44fc29
push ebx
mov ebx, edi
shr ebx, 3
mov eax, ebx
neg eax
lea edi, [edi + eax*8]
mov eax, dword [esp + 0x10]
movzx edx, byte [esi]
movzx ecx, byte [esi + 1]
shl edx, 8
or edx, ecx
movzx ecx, byte [esi + 2]
shl edx, 8
or edx, ecx
movzx ecx, byte [esi + 3]
shl edx, 8
or edx, ecx
xor eax, edx
mov edx, eax
mov ecx, eax
shr edx, 0x10
and edx, 0xff
shr ecx, 8
and ecx, 0xff
mov edx, dword [edx*4 + 0x4975e0]
xor edx, dword [ecx*4 + 0x4971e0]
mov ecx, eax
shr ecx, 0x18
movzx eax, al
xor edx, dword [ecx*4 + 0x4979e0]
movzx ecx, byte [esi + 6]
xor edx, dword [ecx*4 + 0x4961e0]
movzx ecx, byte [esi + 5]
xor edx, dword [ecx*4 + 0x4965e0]
movzx ecx, byte [esi + 7]
xor edx, dword [ecx*4 + 0x495de0]
movzx ecx, byte [esi + 4]
add esi, 8
xor edx, dword [ecx*4 + 0x4969e0]
xor edx, dword [eax*4 + 0x496de0]
mov eax, edx
dec ebx
jne 0x44fb94
pop ebx
jmp 0x44fc2d
mov eax, dword [esp + 0xc]
test edi, edi
je 0x44fc4b
movzx ecx, byte [esi]
lea esi, [esi + 1]
mov edx, eax
shl eax, 8
shr edx, 0x18
xor edx, ecx
xor eax, dword [edx*4 + 0x495de0]
dec edi
jne 0x44fc31
pop edi
pop esi
ret
Function at 0x459d90
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
mov ecx, dword [esp + 8]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
mov ebx, 0x1505
add ecx, esi
mov eax, ecx
push edi
xor edi, edi
sub eax, esi
cmp ecx, esi
sbb ebp, ebp
not ebp
and ebp, eax
jbe 0x459dd4
mov al, byte [esi]
push eax
call fcn.00465ee0
movsx ecx, al
lea esi, [esi + 1]
mov eax, ebx
inc edi
shl eax, 5
add esp, 4
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp edi, ebp
jb 0x459db3
pop edi
pop esi
pop ebp
movzx eax, bl
pop ebx
ret
Function at 0x45cc90
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
push edi
push str.kernel32
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
jne 0x45ccaa
pop edi
pop ebx
pop ecx
ret
push ebp
push esi
push str.LoadLibraryExA
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [esp + 0x18]
mov ebp, eax
push 0x498a3c
push esi
call dword [sym.imp.MSVCRT.dll_strpbrk]
add esp, 8
test eax, eax
je 0x45ccf3
test ebp, ebp
je 0x45cce4
push 8
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
test ebp, ebp
je 0x45cd19
push str.AddDllDirectory
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x45cd19
push 0x800
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, eax
mov dword [esp + 0x10], edx
test edx, edx
je 0x45cdcf
mov ecx, esi
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x45cd36
sub ecx, ebx
lea eax, [edx + 1]
add eax, ecx
push eax
call dword [0x4a6f10]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x45cdc5
push dword [esp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x45cdc5
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x45cd68
sub ecx, edx
mov eax, 0x5c
mov word [ecx + ebx], ax
mov ecx, ebx
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x45cd80
sub ecx, edx
add ecx, ebx
sub ecx, esi
lea ecx, [ecx]
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x45cd90
test ebp, ebp
je 0x45cdbc
push 8
push 0
push ebx
call ebp
push ebx
mov edi, eax
call dword [0x4a6f14]
add esp, 4
mov eax, edi
pop esi
pop ebp
pop edi
pop ebx
pop ecx
ret
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push ebx
call dword [0x4a6f14]
add esp, 4
pop esi
pop ebp
mov eax, edi
pop edi
pop ebx
pop ecx
ret
Function at 0x45cf60
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x22c
test byte [esp + 0x230], 2
je 0x45cfab
lea eax, [esp + 0x9c]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x45cf9f
mov eax, dword [esp + 0x9c]
cmp al, 2
jne 0x45cf99
shr eax, 8
cmp al, 2
je 0x45cfab
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
add esp, 0x22c
ret
call fcn.00476920
test eax, eax
jne 0x45d080
push 0x498a00
call fcn.0045cc90
add esp, 4
mov dword [0x4aada8], eax
test eax, eax
je 0x45cfe3
push str.if_nametoindex
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x45cfe3
mov dword [0x4aada4], eax
push esi
push 0x9c
lea eax, [esp + 8]
push 0
push eax
call sub.MSVCRT.dll_memset
mov esi, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
add esp, 0xc
mov dword [esp + 4], 0x9c
mov dword [esp + 8], 6
mov dword [esp + 0xc], 0
push 3
push 2
push 0
push 0
mov dword [esp + 0x24], 2
call esi
push 3
push 1
push edx
push eax
call esi
push 3
push 0x20
push edx
push eax
call esi
push 3
push 0x10
push edx
push eax
call esi
push 1
push 8
push edx
push eax
call esi
push edx
push eax
push 0x33
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
pop esi
test eax, eax
je 0x45d077
push 0x4ab54c
mov byte [0x4ab554], 1
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor eax, eax
add esp, 0x22c
ret
mov byte [0x4ab554], 0
xor eax, eax
add esp, 0x22c
ret

Function at 0x45d200
Capabilities:
Create udp socket

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x2c8], 2
je fcn.0045d1b0
mov al, 1
ret

Function at 0x45d340
Capabilities:
Write file on windows

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
cmp dword [edi + 0x5e0], 0
je 0x45d384
push 1
push edi
call fcn.0045e540
push dword [edi + 0x574]
mov eax, dword [edi + 0x5e0]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push edi
call eax
push 0
push edi
mov esi, eax
call fcn.0045e540
add esp, 0x24
mov eax, esi
pop edi
pop esi
ret
mov eax, dword [esp + 0x10]
cmp eax, 2
ja 0x45d3bd
push dword [edi + 0x570]
mov esi, dword [sym.imp.MSVCRT.dll_fwrite]
lea eax, [eax + eax*2]
push 1
add eax, 0x498ac0
push 2
push eax
call esi
push dword [edi + 0x570]
push 1
push dword [esp + 0x30]
push dword [esp + 0x30]
call esi
add esp, 0x20
pop edi
xor eax, eax
pop esi
ret

Function at 0x45d5c0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push 0
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.WS2_32.dll_recv]
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x45d5f1
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2733
neg eax
sbb eax, eax
and eax, 0xffffffe7
add eax, 0x51
ret
mov eax, dword [esp + 0x10]
mov dword [eax], ecx
xor eax, eax
ret