joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4251c2
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cf370
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov dword [ebp - 0x14], ecx
push str.GFIO::SizeEx
lea ecx, [ebp - 0x2c]
call fcn.00404f76
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
cmp dword [eax + 5], 0
jne 0x425216
push str.m_handle
push str.GFIO
push 0x238
push str.D:projectsUTIL_srcgfio.cpp
call fcn.004044d6
add esp, 0x10
mov eax, dword [ebp - 0x14]
cmp dword [eax + 5], 0
jne 0x425234
mov byte [ebp - 0xd], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.004050e2
mov al, byte [ebp - 0xd]
jmp 0x4252a4
push dword [ebp + 8]
mov eax, dword [ebp - 0x14]
push dword [eax + 5]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x42525c
mov byte [ebp - 0xe], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.004050e2
mov al, byte [ebp - 0xe]
jmp 0x4252a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00404f48
pop ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0x425291
push 0x4dc1ac
push dword [ebp - 0x18]
push str.GFIO
push 0x23b
push str.D:projectsUTIL_srcgfio.cpp
call fcn.004048de
add esp, 0x14
mov byte [ebp - 0xf], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.004050e2
mov al, byte [ebp - 0xf]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x425564
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d01ad
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov dword [ebp - 0x10], ecx
push str.GFIO::Write
lea ecx, [ebp - 0x38]
call fcn.00404f76
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
cmp dword [eax + 5], 0
jne 0x4255b8
push str.m_handle
push str.GFIO
push 0x203
push str.D:projectsUTIL_srcgfio.cpp
call fcn.004044d6
add esp, 0x10
mov eax, dword [ebp - 0x10]
cmp dword [eax + 5], 0
jne 0x4255d9
and dword [ebp - 0x14], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.004050e2
mov eax, dword [ebp - 0x14]
jmp 0x425659
push 0
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
mov eax, dword [ebp - 0x10]
push dword [eax + 5]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x42560a
and dword [ebp - 0x18], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.004050e2
mov eax, dword [ebp - 0x18]
jmp 0x425659
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp + 0xc]
je 0x425643
xor eax, eax
inc eax
je 0x42562e
push 0x20a
push str.D:projectsUTIL_srcgfio.cpp
push 0x4d9734
call fcn.00403b39
add esp, 0xc
and dword [ebp - 0x20], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.004050e2
mov eax, dword [ebp - 0x20]
jmp 0x425659
mov dword [ebp - 0x24], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.004050e2
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x4263e7
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cf438
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
and dword [ebp - 0x10], 0
xor eax, eax
inc eax
imul eax, eax, 0
movsx eax, byte [eax + 0x51f358]
test eax, eax
jne 0x42642d
mov dword [ebp - 0x14], 0x7f
lea eax, [ebp - 0x14]
push eax
push 0x51f358
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
movzx eax, byte [ebp + 0xc]
test eax, eax
jne 0x426457
push 0x51f358
mov ecx, dword [ebp + 8]
call fcn.004053d4
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
or eax, 1
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
jmp 0x4264da
push 0x51f358
lea ecx, [ebp - 0x2f]
call fcn.004053d4
mov dword [ebp - 4], 1
push str.ComputerName
lea ecx, [ebp - 0x26]
call fcn.004053d4
mov byte [ebp - 4], 2
push str.SoftwareMarcotteEnvironment
lea ecx, [ebp - 0x1d]
call fcn.004053d4
mov byte [ebp - 4], 3
push 0
push 0
push 0
lea eax, [ebp - 0x2f]
push eax
lea eax, [ebp - 0x26]
push eax
lea eax, [ebp - 0x1d]
push eax
push dword [ebp + 8]
call fcn.0044e0b7
add esp, 0x1c
mov eax, dword [ebp - 0x10]
or eax, 1
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1d]
call fcn.004055b0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x26]
call fcn.004055b0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2f]
call fcn.004055b0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x426af5
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cf52a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
and dword [ebp - 0x14], 0
lea ecx, [ebp - 0x24]
call fcn.004054e3
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], 0x400
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
lea ecx, [ebp - 0x24]
call fcn.004065f0
push eax
push 8
call sub.Secur32.dll_GetUserNameExA
movzx eax, al
test eax, eax
jne 0x426bcf
mov eax, dword [ebp - 0x10]
shl eax, 3
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
lea ecx, [ebp - 0x24]
call fcn.004065f0
push eax
push 8
call sub.Secur32.dll_GetUserNameExA
movzx eax, al
test eax, eax
jne 0x426bcf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00404f48
pop ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0x426ba8
push str.GetUserNameEx_failed_with_a_8KB_buffer_
push dword [ebp - 0x18]
push str.GUTIL
push 0x130
push str.D:projectsUTIL_srcgutil.cpp
call fcn.004048de
add esp, 0x14
push 0x4d96ec
mov ecx, dword [ebp + 8]
call fcn.004053d4
mov eax, dword [ebp - 0x14]
or eax, 1
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.004055b0
mov eax, dword [ebp + 8]
jmp 0x426bf3
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp + 8]
call fcn.004052c0
mov eax, dword [ebp - 0x14]
or eax, 1
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.004055b0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x427762
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
call fcn.00427291
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.00481c56
movzx eax, al
test eax, eax
je 0x427790
xor eax, eax
inc eax
jmp 0x42782a
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp + 8]
call fcn.00405b2a
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4277af
xor eax, eax
jmp 0x42782a
push dword [ebp - 8]
call fcn.0040245f
pop ecx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov dword [eax + 0x69], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x69], 0
jne 0x4277d1
xor eax, eax
jmp 0x42782a
mov eax, dword [ebp - 4]
push dword [eax + 0x69]
push dword [ebp - 8]
push 0
mov ecx, dword [ebp + 8]
call fcn.00405b2a
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x4277fa
mov ecx, dword [ebp - 4]
call fcn.00427291
xor eax, eax
jmp 0x42782a
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push str.VarFileInfoTranslation
mov eax, dword [ebp - 4]
push dword [eax + 0x69]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x427827
cmp dword [ebp - 0x10], 4
jb 0x427827
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x6d], eax
xor eax, eax
inc eax
mov esp, ebp
pop ebp
ret 4
Function at 0x428d0e
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cf799
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
cmp dword [eax + 4], 0
je 0x428e28
mov eax, dword [ebp - 0x10]
cmp dword [eax + 8], 0
je 0x428d59
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x10]
and dword [eax + 8], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0x10]
sub eax, dword [ecx + 0x10]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx + 4]
cmp eax, dword [ecx + 0x24]
jbe 0x428e21
push 0x4dda78
lea eax, [ebp - 0x31]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0x10]
sub eax, dword [ecx + 0x10]
push eax
lea eax, [ebp - 0x43]
push eax
call fcn.00407505
add esp, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
and dword [ebp - 4], 0
push dword [ebp - 0x18]
push str.Critical_section_was_detained_for
lea eax, [ebp - 0x3a]
push eax
call fcn.00405b42
add esp, 0xc
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x20]
call fcn.00405cc1
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x28]
call fcn.00405b2a
push eax
push str.GCS_LOCK
push 0x12c
push str.D:projectsUTIL_srcglock.cpp
call fcn.004046ac
add esp, 0x10
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x31]
call fcn.004055b0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3a]
call fcn.004055b0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x43]
call fcn.004055b0
mov eax, dword [ebp - 0x10]
and dword [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x43591c
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d1dc0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov dword [ebp - 0x10], ecx
push str.MD5::init
lea ecx, [ebp - 0x24]
call fcn.00404f76
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x68], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x10]
and dword [ecx + eax + 0x10], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x10]
and dword [ecx + eax + 0x10], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + eax], 0x67452301
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + eax], 0xefcdab89
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x10]
mov dword [ecx + eax], 0x98badcfe
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x10]
mov dword [ecx + eax], 0x10325476
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.004050e2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x439620
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d0696
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x148
push str.GSOCK::GetLocalIPAddresses
lea ecx, [ebp - 0x54]
call fcn.00404f76
and dword [ebp - 4], 0
push 0x80
lea eax, [ebp - 0x154]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
jne 0x4396b3
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.00404f48
pop ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0x43969b
push str.gethostname
push dword [ebp - 0x18]
push str.GSOCK
push 0x619
push str.D:projectsUTIL_srcgsock.cpp
call fcn.004048de
add esp, 0x14
and dword [ebp - 0x34], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.004050e2
mov eax, dword [ebp - 0x34]
jmp 0x439811
lea eax, [ebp - 0x154]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x439716
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.00404f48
pop ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jge 0x4396fe
push 0x4dec88
push dword [ebp - 0x1c]
push str.GSOCK
push 0x61f
push str.D:projectsUTIL_srcgsock.cpp
call fcn.004048de
add esp, 0x14
and dword [ebp - 0x38], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.004050e2
mov eax, dword [ebp - 0x38]
jmp 0x439811
and dword [ebp - 0x10], 0
jmp 0x439723
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0x10]
cmp dword [eax + ecx*4], 0
je 0x4397d7
push 4
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0x10]
push dword [eax + ecx*4]
lea eax, [ebp - 0x2c]
push eax
call fcn.004ae720
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.004054e3
mov byte [ebp - 4], 1
push dword [ebp - 0x2c]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
lea ecx, [ebp - 0x28]
call fcn.0040574c
push 4
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0x10]
push dword [eax + ecx*4]
lea eax, [ebp - 0x40]
push eax
call fcn.004ae720
add esp, 0xc
push 0
push 0
push str.169.254.
lea ecx, [ebp - 0x28]
call fcn.00405b2a
push eax
call fcn.00407a21
add esp, 0x10
test eax, eax
je 0x4397b7
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.004055b0
jmp 0x43971c
push dword [ebp - 0x40]
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp + 8]
call fcn.00425aba
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.004055b0
jmp 0x43971c
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov ecx, dword [ebp + 8]
call dword [eax + 8]
test eax, eax
jne 0x4397fb
and dword [ebp - 0x3c], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.004050e2
mov eax, dword [ebp - 0x3c]
jmp 0x439811
mov dword [ebp - 0x30], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.004050e2
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x441ff2
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_connect]
pop ebp
ret 0x10

Function at 0x4423d4
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov ecx, dword [ebp + 8]
call fcn.00405b2a
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movsx eax, byte [eax]
test eax, eax
je 0x4424d1
push 0x14
pop eax
imul eax, eax, 0
xor ecx, ecx
inc ecx
mov word [ebp + eax - 0x30], cx
push 0x14
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 4]
mov cl, byte [ecx]
mov byte [ebp + eax - 0x22], cl
push 0x14
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2c], 1
push 0x14
pop eax
imul eax, eax, 0
xor ecx, ecx
inc ecx
mov word [ebp + eax - 0x28], cx
push 0x14
pop eax
imul eax, eax, 0
xor ecx, ecx
mov word [ebp + eax - 0x26], cx
push 0x14
pop eax
imul eax, eax, 0
xor ecx, ecx
mov word [ebp + eax - 0x24], cx
push 0x14
pop eax
imul eax, eax, 0
and dword [ebp + eax - 0x20], 0
push 0x14
pop eax
shl eax, 0
xor ecx, ecx
inc ecx
mov word [ebp + eax - 0x30], cx
push 0x14
pop eax
shl eax, 0
mov ecx, dword [ebp - 4]
mov cl, byte [ecx]
mov byte [ebp + eax - 0x22], cl
push 0x14
pop eax
shl eax, 0
and dword [ebp + eax - 0x2c], 0
push 0x14
pop eax
shl eax, 0
xor ecx, ecx
inc ecx
mov word [ebp + eax - 0x28], cx
push 0x14
pop eax
shl eax, 0
xor ecx, ecx
mov word [ebp + eax - 0x26], cx
push 0x14
pop eax
shl eax, 0
xor ecx, ecx
mov word [ebp + eax - 0x24], cx
push 0x14
pop eax
shl eax, 0
and dword [ebp + eax - 0x20], 0
lea eax, [ebp - 8]
push eax
push 2
lea eax, [ebp - 0x30]
push eax
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
jmp 0x4423e5
mov esp, ebp
pop ebp
ret
Function at 0x461e16
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d4135
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5c
mov dword [ebp - 0x10], ecx
push str.GODBC::CreateStatement
lea ecx, [ebp - 0x54]
call fcn.00404f76
and dword [ebp - 4], 0
push dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
call fcn.0046535c
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x59b], 0
jne 0x461e77
mov dword [ebp - 0x1c], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.004050e2
mov eax, dword [ebp - 0x1c]
jmp 0x46200b
mov eax, dword [ebp - 0x10]
add eax, 4
push eax
lea ecx, [ebp - 0x68]
call fcn.00427e89
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 0x8f6], eax
jbe 0x461f3a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x8f6], eax
push 0
mov eax, dword [ebp - 0x10]
add eax, 0x30
push eax
push str.Machine_has_been_running_for_49.7_days._Forcing_reconnection_to__s
lea eax, [ebp - 0x3d]
push eax
call fcn.00407450
add esp, 0xc
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x24]
call fcn.00405b2a
push eax
push str.GODBC
push 0x1233
push str.D:projectsUTIL_srcgdb.cpp
call fcn.00404405
add esp, 0x14
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x3d]
call fcn.004055b0
mov eax, dword [ebp - 0x10]
push dword [eax + 0x937]
mov ecx, dword [ebp - 0x10]
call fcn.00460654
test eax, eax
jne 0x461f3a
and dword [ebp - 0x28], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x68]
call fcn.00428198
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.004050e2
mov eax, dword [ebp - 0x28]
jmp 0x46200b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x8f6], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x2c], 0
jne 0x461f6e
push str.m_connection
push str.GODBC
push 0x123a
push str.D:projectsUTIL_srcgdb.cpp
call fcn.004044d6
add esp, 0x10
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x2c], 0
jne 0x461f9e
mov eax, dword [ebp + 8]
and dword [eax], 0
and dword [ebp - 0x2c], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x68]
call fcn.00428198
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.004050e2
mov eax, dword [ebp - 0x2c]
jmp 0x46200b
push 0x10
call fcn.0040245f
pop ecx
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 3
cmp dword [ebp - 0x14], 0
je 0x461fc6
mov eax, dword [ebp - 0x10]
push dword [eax + 0x2c]
mov ecx, dword [ebp - 0x14]
call fcn.0045b487
mov dword [ebp - 0x18], eax
jmp 0x461fca
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x30], eax
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x30]
mov dword [eax], ecx
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
call fcn.0045d65c
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x68]
call fcn.00428198
mov dword [ebp - 0x34], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.004050e2
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x484636
Capabilities:
Encrypt data using xtea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + eax]
mov dword [ebp - 8], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + eax]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0xc6ef3720
mov dword [ebp - 0x18], 0x9e3779b9
mov dword [ebp - 0x10], 0x20
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x14], 0
jbe 0x4846e5
mov eax, dword [ebp - 8]
shl eax, 4
mov ecx, dword [ebp - 8]
shr ecx, 5
xor eax, ecx
add eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
shr ecx, 0xb
and ecx, 3
mov edx, dword [ebp + 0x10]
mov esi, dword [ebp - 4]
add esi, dword [edx + ecx*4]
xor eax, esi
mov ecx, dword [ebp - 0xc]
sub ecx, eax
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
shl eax, 4
mov ecx, dword [ebp - 0xc]
shr ecx, 5
xor eax, ecx
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
and ecx, 3
mov edx, dword [ebp + 0x10]
mov esi, dword [ebp - 4]
add esi, dword [edx + ecx*4]
xor eax, esi
mov ecx, dword [ebp - 8]
sub ecx, eax
mov dword [ebp - 8], ecx
jmp 0x484670
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov dword [ecx + eax], edx
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
mov dword [ecx + eax], edx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x484708
Capabilities:
Encrypt data using xtea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + eax]
mov dword [ebp - 8], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + eax]
mov dword [ebp - 0xc], eax
and dword [ebp - 4], 0
mov dword [ebp - 0x18], 0x9e3779b9
mov dword [ebp - 0x10], 0x20
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x14], 0
jbe 0x4847b0
mov eax, dword [ebp - 0xc]
shl eax, 4
mov ecx, dword [ebp - 0xc]
shr ecx, 5
xor eax, ecx
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
and ecx, 3
mov edx, dword [ebp + 0x10]
mov esi, dword [ebp - 4]
add esi, dword [edx + ecx*4]
xor eax, esi
add eax, dword [ebp - 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
shl eax, 4
mov ecx, dword [ebp - 8]
shr ecx, 5
xor eax, ecx
add eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
shr ecx, 0xb
and ecx, 3
mov edx, dword [ebp + 0x10]
mov esi, dword [ebp - 4]
add esi, dword [edx + ecx*4]
xor eax, esi
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0x48473f
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov dword [ecx + eax], edx
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
mov dword [ecx + eax], edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x485598
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d1dc0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov dword [ebp - 0x10], ecx
push str.GTHREAD::AllocTlsShouldQuit
lea ecx, [ebp - 0x24]
call fcn.00404f76
and dword [ebp - 4], 0
cmp dword [0x514d90], 0xffffffff
jne 0x485600
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x514d90], eax
cmp dword [0x514d90], 0xffffffff
jne 0x485600
xor eax, eax
inc eax
je 0x485600
push 0xd0
push str.D:projectsUTIL_srcgthread.cpp
push 0x4d9734
call fcn.00403b39
add esp, 0xc
push 0
push 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x4f
call fcn.00484a83
movzx eax, al
test eax, eax
jne 0x485632
xor eax, eax
inc eax
je 0x485632
push 0xd5
push str.D:projectsUTIL_srcgthread.cpp
push 0x4d9734
call fcn.00403b39
add esp, 0xc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.004050e2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x4857dc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d6c80
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov dword [ebp - 0x14], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x5205e0]
cmp eax, 0xea60
jbe 0x4858f1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x5205e0], eax
push str.TraceSetQuits
lea ecx, [ebp - 0x26]
call fcn.004053d4
and dword [ebp - 4], 0
push str.SOFTWAREMarcottePerfgthread_
lea ecx, [ebp - 0x1d]
call fcn.004053d4
mov byte [ebp - 4], 1
push 0
push 0
push 1
push 0
lea eax, [ebp - 0x26]
push eax
lea eax, [ebp - 0x1d]
push eax
call fcn.0044e447
add esp, 0x18
test eax, eax
je 0x485860
mov byte [ebp - 0xd], 1
jmp 0x485864
mov byte [ebp - 0xd], 0
movzx eax, byte [ebp - 0xd]
mov dword [0x5205e4], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1d]
call fcn.004055b0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x26]
call fcn.004055b0
push str.Trace
lea ecx, [ebp - 0x38]
call fcn.004053d4
mov dword [ebp - 4], 2
push str.SOFTWAREMarcottePerfgthread_
lea ecx, [ebp - 0x2f]
call fcn.004053d4
mov byte [ebp - 4], 3
push 0
push 0
push 1
push 0
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x2f]
push eax
call fcn.0044e447
add esp, 0x18
test eax, eax
je 0x4858cc
mov byte [ebp - 0xe], 1
jmp 0x4858d0
mov byte [ebp - 0xe], 0
movzx eax, byte [ebp - 0xe]
mov dword [0x5205e8], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2f]
call fcn.004055b0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.004055b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret