joyce8/EMBER2024-capa huggingface dataset:
Function at 0x450790
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.0043f620
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x45085b
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x45085b
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x45080e
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x450819
or bh, 8
and edi, 0x8000000
je 0x450834
mov eax, dword [0x4b657c]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x45085b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x450c30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x450c5b
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x450c7f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x450c9a
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
Function at 0x45426d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, ebx
push edi
mov edi, ecx
shr eax, 0x10
test ax, ax
mov dword [edi + 0x40], ebx
jne 0x45428f
cmp dword [edi + 0x3c], 0
jne 0x45428f
movzx eax, bx
mov dword [edi + 0x3c], eax
call fcn.00468777
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov ecx, edi
push dword [esp + 0x18]
push eax
call fcn.004542bc
pop edi
pop esi
pop ebx
ret 8

Function at 0x45588c
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4558c4
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00458920
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004588f7
jmp 0x4558d0
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x457153
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x457195
call fcn.00468777
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
cmp eax, edi
je 0x457195
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x45718c
xor eax, eax
jmp 0x45719d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004571a3
pop edi
pop esi
pop ebx
ret 4

Function at 0x468f05
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov dword [ebp - 8], ecx
call fcn.00468777
mov esi, dword [eax + 0xc]
push 0xf1
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x468f42
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x468f42
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x468f46
xor eax, eax
jmp 0x468fc4
movzx eax, word [esi + 6]
push ebx
push edi
shl eax, 2
push eax
call fcn.00458a48
and dword [ebp - 4], 0
cmp word [esi + 6], 0
pop ecx
mov ebx, eax
jbe 0x468f7e
mov ecx, ebx
lea eax, [esi + 8]
movzx edx, word [eax]
inc dword [ebp - 4]
mov dword [ecx], edx
movzx edx, word [esi + 6]
inc eax
add ecx, 4
inc eax
cmp dword [ebp - 4], edx
jl 0x468f68
movzx eax, word [esi + 6]
mov ecx, dword [ebp - 8]
push eax
push ebx
call fcn.004690b5
push ebx
mov edi, eax
call fcn.00458a71
test edi, edi
pop ecx
je 0x468fc0
movzx ecx, word [esi + 4]
movzx eax, word [esi + 2]
lea esi, [ecx + 7]
push ecx
mov ecx, dword [ebp - 8]
lea edx, [eax + 7]
push eax
push esi
push edx
call fcn.00468e7e
push dword [ebp + 8]
mov ecx, dword [ebp - 8]
call fcn.00468fc9
mov edi, eax
mov eax, edi
pop edi
pop ebx
pop esi
leave
ret 4
Function at 0x46ab32
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x46ab60
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x46ab7e
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0046aa98
jmp 0x46ab7e
mov eax, dword [esi + 0x14]
test eax, eax
je 0x46ab7e
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0046aa98
test edi, edi
mov eax, edi
jne 0x46ab68
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x576291
Capabilities:
Resolve function by parsing pe exports

Disassembly:
enter 8, 0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
add edi, dword [edi + 0x3c]
mov eax, dword [edi + 0x78]
test eax, eax
je 0x5762fc
add eax, dword [ebp + 8]
mov ebx, dword [eax + 0x10]
mov dword [ebp - 4], ebx
mov ecx, dword [eax + 0x18]
mov dword [ebp - 8], ecx
mov edi, dword [eax + 0x1c]
add edi, dword [ebp + 8]
mov esi, dword [eax + 0x20]
add esi, dword [ebp + 8]
mov ebx, dword [eax + 0x24]
add ebx, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [esi]
add eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov dl, byte [edx]
cmp dl, byte [eax]
jb 0x5762fc
push ecx
push dword [ebp + 0xc]
push eax
call fcn.0057625f
pop ecx
test eax, eax
jne 0x5762f0
add esi, 4
inc ecx
cmp ecx, dword [ebp - 8]
jb 0x5762c8
jmp 0x5762fc
movzx eax, word [ebx + ecx*2]
mov eax, dword [edi + eax*4]
add eax, dword [ebp + 8]
jmp 0x5762fe
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x401330
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42060f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push 0
mov dword [ebp - 0x10], esi
call fcn.004074ed
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 6
test eax, eax
je 0x4013bb
push eax
push esi
call fcn.004078c7
mov ecx, dword [ebp - 0xc]
add esp, 8
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push str.bad_locale_name
call fcn.0040763b
int3
Function at 0x414c4f
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4251a8
push 0x4251a0
push str.FlsAlloc
push 0x1e
call fcn.00414b19
mov esi, eax
add esp, 0x10
test esi, esi
je 0x414c83
push dword [ebp + 8]
mov ecx, esi
call dword [0x422130]
call esi
jmp 0x414c89
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x414ccd
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4251b8
push 0x4251b0
push str.FlsGetValue
push 0x20
call fcn.00414b19
mov esi, eax
add esp, 0x10
test esi, esi
je 0x414d04
push dword [ebp + 8]
mov ecx, esi
call dword [0x422130]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x41b66f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x41b70c
push ebx
push esi
call fcn.0041b638
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00418072
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x41b6b9
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41b70b
push edi
push eax
call fcn.004153b6
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x41b6d9
call fcn.0041483e
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41b70a
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00418072
add esp, 0x20
test eax, eax
jne 0x41b6f8
push edi
call fcn.0041483e
jmp 0x41b700
push ebx
call fcn.0041483e
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x41e110
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
pshufd xmm1, xmm0, 0x55
push ebp
pshufd xmm0, xmm0, 0xff
mov ebp, esp
push ebx
movd eax, xmm1
movd edx, xmm1
and esp, 0xfffffff0
shr eax, 0x18
sub esp, 0x10
movzx ecx, dl
movzx eax, byte [eax + str.cw]
movzx ecx, byte [ecx + str.cw]
movzx edx, dh
movzx edx, byte [edx + str.cw]
shl eax, 0x18
or eax, ecx
movd ecx, xmm1
shl edx, 8
shr ecx, 0x10
movzx ecx, cl
movzx ecx, byte [ecx + str.cw]
shl ecx, 0x10
or eax, ecx
movd ecx, xmm0
or eax, edx
movd edx, xmm0
movzx ebx, cl
movzx ecx, ch
shr edx, 0x18
movzx ebx, byte [ebx + str.cw]
movzx ecx, byte [ecx + str.cw]
movzx edx, byte [edx + str.cw]
shl ecx, 8
shl edx, 0x18
or edx, ebx
movd ebx, xmm0
shr ebx, 0x10
movzx ebx, bl
movzx ebx, byte [ebx + str.cw]
shl ebx, 0x10
or edx, ebx
mov ebx, eax
or edx, ecx
ror ebx, 8
mov dword [esp + 0xc], ebx
mov ebx, edx
mov dword [esp + 4], edx
ror ebx, 8
movd xmm1, dword [esp + 4]
mov dword [esp + 8], ebx
movd xmm3, dword [esp + 0xc]
movd xmm2, dword [esp + 8]
mov dword [esp + 8], eax
movd xmm0, dword [esp + 8]
mov ebx, dword [ebp - 4]
punpckldq xmm1, xmm2
leave
punpckldq xmm0, xmm3
punpcklqdq xmm0, xmm1
ret
Function at 0x41e780
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
movdqa xmm3, xmmword [eax]
mov ebp, esp
and esp, 0xfffffff0
movdqa xmm0, xmm3
movdqa xmm2, xmmword [eax + 0x10]
mov eax, dword [ebp + 8]
pslldq xmm0, 4
movdqa xmm6, xmm0
aeskeygenassist xmm5, xmm2, 1
movaps xmmword [edx], xmm3
pslldq xmm6, 4
movdqa xmm1, xmm6
pxor xmm6, xmm0
pslldq xmm1, 4
pshufd xmm5, xmm5, 0xff
movaps xmmword [ecx], xmm2
pxor xmm3, xmm6
pxor xmm3, xmm1
pxor xmm5, xmm3
movdqa xmm3, xmm2
pslldq xmm3, 4
movdqa xmm1, xmm3
aeskeygenassist xmm4, xmm5, 0
pslldq xmm1, 4
movdqa xmm0, xmm1
pxor xmm1, xmm3
movaps xmmword [eax], xmm5
pslldq xmm0, 4
pshufd xmm4, xmm4, 0xaa
mov eax, dword [ebp + 0xc]
pxor xmm2, xmm1
pxor xmm2, xmm0
pxor xmm4, xmm2
aeskeygenassist xmm1, xmm4, 2
movaps xmmword [eax], xmm4
mov eax, dword [ebp + 0x10]
pshufd xmm3, xmm1, 0xff
movdqa xmm1, xmm5
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm0, 4
pxor xmm1, xmm0
movdqa xmm2, xmm0
pslldq xmm2, 4
pxor xmm1, xmm2
pxor xmm1, xmm3
movdqa xmm3, xmm1
pxor xmm3, xmm5
aeskeygenassist xmm0, xmm3, 0
movaps xmmword [eax], xmm3
mov eax, dword [ebp + 0x14]
pshufd xmm2, xmm0, 0xaa
movdqa xmm0, xmm4
pslldq xmm0, 4
movdqa xmm1, xmm0
pslldq xmm1, 4
pxor xmm0, xmm1
movdqa xmm5, xmm1
pslldq xmm5, 4
pxor xmm0, xmm5
pxor xmm0, xmm2
movdqa xmm2, xmm0
pxor xmm2, xmm4
aeskeygenassist xmm1, xmm2, 4
movaps xmmword [eax], xmm2
mov eax, dword [ebp + 0x18]
pshufd xmm4, xmm1, 0xff
movdqa xmm1, xmm3
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm0, 4
pxor xmm1, xmm0
movdqa xmm5, xmm0
pslldq xmm5, 4
pxor xmm1, xmm5
pxor xmm1, xmm4
pxor xmm1, xmm3
aeskeygenassist xmm0, xmm1, 0
movaps xmmword [eax], xmm1
mov eax, dword [ebp + 0x1c]
pshufd xmm4, xmm0, 0xaa
movdqa xmm0, xmm2
pslldq xmm0, 4
movdqa xmm3, xmm0
pslldq xmm3, 4
pxor xmm0, xmm3
movdqa xmm5, xmm3
pslldq xmm5, 4
pxor xmm0, xmm5
pxor xmm0, xmm4
movdqa xmm4, xmm1
pxor xmm0, xmm2
pslldq xmm4, 4
aeskeygenassist xmm2, xmm0, 8
movaps xmmword [eax], xmm0
mov eax, dword [ebp + 0x20]
pshufd xmm3, xmm2, 0xff
movdqa xmm2, xmm4
pslldq xmm2, 4
movdqa xmm5, xmm2
pxor xmm2, xmm4
movdqa xmm4, xmm0
pslldq xmm5, 4
pslldq xmm4, 4
pxor xmm2, xmm5
pxor xmm2, xmm3
pxor xmm1, xmm2
aeskeygenassist xmm2, xmm1, 0
movaps xmmword [eax], xmm1
mov eax, dword [ebp + 0x24]
pshufd xmm3, xmm2, 0xaa
movdqa xmm2, xmm4
pslldq xmm2, 4
movdqa xmm5, xmm2
pxor xmm2, xmm4
pslldq xmm5, 4
pxor xmm2, xmm5
pxor xmm2, xmm3
pxor xmm0, xmm2
movaps xmmword [eax], xmm0
leave
ret
Function at 0x435520
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x1c
mov ecx, dword [ecx + 0x1a4]
call fcn.0041b3e0
cmp byte [eax + 0xf], 0
jne 0x435540
add esp, 0x1c
ret
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
test eax, eax
je 0x435562
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.USER32.dll_ShowWindow]
sub esp, 8
add esp, 0x1c
ret
mov dword [esp], 0xfffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
add esp, 0x1c
jmp dword [sym.imp.KERNEL32.dll_FreeConsole]
Function at 0x44e5e0
Capabilities:
Get hostname

Disassembly:
push ebp
push edi
push esi
mov esi, ecx
push ebx
lea ebp, [esi + 0x15]
lea edi, [esi + 0x19]
add ecx, 0x98
sub esp, 0x1c
mov dword [ecx - 0x98], 0x54f320
and edi, 0xfffffffc
mov ebx, ebp
sub ebx, edi
call fcn.00401600
sub ebx, 0xffffff80
mov eax, dword [esp + 0x30]
mov dword [esi + 0x15], 0
and ebx, 0xfffffffc
mov ecx, ebx
shr ebx, 2
mov dword [esi + 0x228], eax
shr ecx, 2
xor eax, eax
mov dword [ebp + 0x7c], 0
rep stosd dword es:[edi], eax
lea edi, [esi + 0x19]
mov ecx, dword [esp + 0x30]
and edi, 0xfffffffc
call fcn.0041b3e0
mov edx, dword [eax + 0x48]
mov ecx, ebx
xor eax, eax
mov dword [esi + 0x15], 0
mov dword [ebp + 0x7c], 0
rep stosd dword es:[edi], eax
test edx, edx
je 0x44e664
cmp byte [edx], 0
jne 0x44e690
mov dword [esp + 4], 0x7f
mov dword [esp], ebp
call dword [sym.imp.WS2_32.dll_gethostname]
sub esp, 8
mov ecx, esi
call fcn.0044e4c0
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret 4
mov dword [esp + 8], 0x7f
mov dword [esp + 4], edx
mov dword [esp], ebp
call sub.msvcrt.dll_strncpy
jmp 0x44e678
Function at 0x457a10
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [esp + 0x40]
mov dword [esp + 4], 0x4576e0
mov dword [esp], 0x5767a4
call fcn.0046f5c0
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
sub esp, 0x10
test eax, eax
mov dword [ebx + 0x1c], eax
je 0x457bf0
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x24], 0
lea ebp, [ebx + 0x70]
mov dword [esp], ebx
call fcn.004702c0
lea eax, [ebx + 0x68]
mov dword [ebx + 4], 0
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x68], eax
mov dword [ebx + 0x6c], eax
lea eax, [ebx + 8]
mov dword [ebx + 0x38], 0
mov dword [ebx + 0x34], 0
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
lea eax, [ebx + 0x10]
mov dword [ebx + 0x3c], 0
mov dword [ebx + 0x40], 0
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x44], 0
mov dword [ebx + 0x48], 0
mov dword [ebx + 0x4c], 0
mov dword [ebx + 0x50], 0
mov dword [ebx + 0x54], 0
mov dword [ebx + 0x58], 0
mov dword [ebx + 0x5c], 0
mov dword [ebx + 0x60], 0
mov dword [ebx + 0x64], 0
mov dword [ebx + 0x18], 0
mov dword [esp], ebp
call fcn.0046f7a0
test eax, eax
mov esi, eax
je 0x457b42
mov eax, dword [ebx + 0x1c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebx + 0x1c], 0xffffffff
mov eax, esi
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebx + 0x88]
mov dword [esp + 8], 0x47c160
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.004574c0
test eax, eax
mov esi, eax
jne 0x457c20
mov eax, dword [ebx + 0xb4]
test al, 0x20
je 0x457ba0
mov edx, eax
and edx, 0xffffffdf
test al, 1
mov dword [ebx + 0xb4], edx
jne 0x457c90
and eax, 0x40
mov ecx, eax
mov eax, edx
test ecx, ecx
je 0x457ba0
mov edx, dword [ebx + 0x8c]
sub dword [edx + 4], 1
nop
lea esi, [esi]
or al, 0x80
mov dword [ebx + 0xb4], eax
mov dword [esp], 0x576780
call fcn.0046f800
mov edi, dword [0x57679c]
cmp edi, dword [0x576798]
mov eax, dword [0x5767a0]
je 0x457c30
mov dword [eax + edi*4], ebx
add edi, 1
mov dword [esp], 0x576780
mov dword [0x57679c], edi
call fcn.0046f850
add esp, 0x2c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x40], eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004588d0
mov dword [esp], 0x576780
mov esi, 0xe
call fcn.0046f850
mov esi, esi
lea edi, [edi]
mov dword [esp], ebp
call fcn.0046f7e0
jmp 0x457b22
add edi, 8
mov eax, dword [0x5767a0]
lea ecx, [edi*4]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 0x1c], ecx
call fcn.00455a10
test eax, eax
je 0x457c06
mov edx, dword [0x576798]
mov dword [0x5767a0], eax
cmp edi, edx
jle 0x457c7d
mov ecx, dword [esp + 0x1c]
lea edx, [eax + edx*4]
add ecx, eax
nop
lea esi, [esi]
mov dword [edx], 0
add edx, 4
cmp ecx, edx
jne 0x457c70
mov dword [0x576798], edi
mov edi, dword [0x57679c]
jmp 0x457bc7
mov eax, edx
jmp 0x457ba0
Function at 0x458f00
Capabilities:
Get common file path

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov esi, edx
mov ebx, eax
sub esp, 0x2c
mov dword [esp], eax
call sub.msvcrt.dll_wcslen
test eax, eax
je 0x458f47
lea ebp, [eax - 1]
mov ecx, eax
movzx eax, word [ebx + ebp*2]
cmp ax, 0x5c
je 0x458f91
cmp ax, 0x2f
jne 0x458f43
jmp 0x458f91
sub ebp, 1
movzx eax, word [ebx + ebp*2]
cmp ax, 0x2f
je 0x458f91
cmp ax, 0x5c
je 0x458f91
test ebp, ebp
jne 0x458f30
test esi, esi
je 0x458f7d
mov dword [esp], 0x20a
call fcn.004559c0
test eax, eax
mov dword [esi], eax
je 0x459039
mov dword [esp + 4], eax
mov dword [esp], 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
sub esp, 8
test eax, eax
je 0x459022
mov dword [esp], ebx
call sub.msvcrt.dll__wcsdup
mov dword [edi], eax
add esp, 0x2c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
test ebp, ebp
je 0x458f47
test esi, esi
je 0x458fdb
lea eax, [ebp + ebp + 4]
mov dword [esp + 0x1c], ecx
mov dword [esp], eax
mov dword [esp + 0x18], eax
call fcn.004559c0
test eax, eax
mov dword [esi], eax
je 0x459039
lea edx, [ebp + 1]
mov dword [esp + 4], ebx
mov dword [esp], eax
mov dword [esp + 8], edx
call sub.msvcrt.dll_wcsncpy
mov eax, dword [esi]
mov edx, dword [esp + 0x18]
xor ecx, ecx
mov word [eax + edx - 2], cx
mov ecx, dword [esp + 0x1c]
mov edx, ecx
sub edx, ebp
lea esi, [edx + edx]
mov dword [esp + 0x18], edx
mov dword [esp], esi
call fcn.004559c0
test eax, eax
mov dword [edi], eax
je 0x459039
mov edx, dword [esp + 0x18]
mov dword [esp], eax
lea ecx, [edx - 1]
lea edx, [ebx + ebp*2 + 2]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
call sub.msvcrt.dll_wcsncpy
mov eax, dword [edi]
xor edx, edx
mov word [eax + esi - 2], dx
xor eax, eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esi]
mov dword [esp], eax
call fcn.004559d0
mov dword [esi], 0
mov eax, 0xffffffff
jmp 0x45901a
mov dword [esp + 4], 0x545de8
mov dword [esp], 0xe
call fcn.00458810
lea esi, [esi]