joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4093ba
Capabilities:
Terminate process

Disassembly:
sub esp, 0xc
mov eax, dword [0x6b0d44]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [0x76a4a4]
push ebx
mov ebx, ecx
push ebp
mov ebp, edx
push esi
push edi
test eax, eax
je 0x40940e
xor esi, esi
cmp dword [0x76a4bc], esi
jle 0x4093fd
push 1
push dword [eax + esi*4]
call fcn.005cdee0
mov eax, dword [0x76a4a4]
inc esi
pop ecx
pop ecx
cmp esi, dword [0x76a4bc]
jl 0x4093e3
push 1
push eax
call fcn.005cdee0
and dword [0x76a4a4], 0
pop ecx
pop ecx
mov ecx, dword [0x6b4e3c]
mov edi, 0x3ff
mov eax, dword [0x76a4b4]
imul eax, ecx
mov dword [0x6b4e40], ecx
cdq
and edx, edi
lea esi, [edx + eax]
mov eax, dword [0x76a494]
imul eax, ecx
sar esi, 0xa
mov dword [0x76a488], esi
cdq
and edx, edi
lea ecx, [edx + eax]
mov eax, esi
cdq
idiv dword [0x76a4b8]
sar ecx, 0xa
mov edi, eax
mov dword [0x76a4c8], ecx
mov esi, edx
mov dword [0x76a4c4], edi
mov eax, ecx
cdq
idiv dword [0x76a498]
mov dword [0x76a4bc], eax
test esi, esi
je 0x409479
inc edi
mov dword [0x76a4c4], edi
test edx, edx
je 0x409483
inc eax
mov dword [0x76a4bc], eax
mov esi, dword [sym.imp.WS2_32.dll_htons]
push 7
call esi
push 8
mov word [esp + 0x14], ax
call esi
mov word [esp + 0x12], ax
movzx eax, word [0x76a488]
push eax
call esi
mov word [esp + 0x14], ax
movzx eax, word [0x76a4c8]
push eax
call esi
push ebp
mov word [esp + 0x1a], ax
lea eax, [esp + 0x14]
push 8
push eax
call ebx
mov eax, dword [0x76a4bc]
mov edi, 0x2df
push edi
push 0x6b4c84
shl eax, 2
push 1
push eax
call fcn.005ce020
mov ecx, eax
add esp, 0x1c
mov dword [0x76a4a4], ecx
test ecx, ecx
je 0x409598
mov edx, dword [0x76a4bc]
xor esi, esi
test edx, edx
jle 0x40955e
add edi, 2
mov eax, dword [0x76a4c4]
push edi
push 0x6b4d08
shl eax, 3
push 1
push eax
call fcn.005ce020
mov ecx, dword [0x76a4a4]
add esp, 0x10
mov dword [ecx + esi*4], eax
test eax, eax
je 0x409571
mov edx, dword [0x76a4bc]
inc esi
cmp esi, edx
jl 0x409500
test edx, edx
jle 0x40955e
mov edi, dword [0x76a4c4]
xor esi, esi
test edi, edi
jle 0x409556
mov eax, dword [ecx]
mov dword [eax + esi*8], 0xff
mov eax, dword [ecx]
mov byte [eax + esi*8 + 4], 0
inc esi
cmp esi, edi
jl 0x409541
add ecx, 4
sub edx, 1
jne 0x40953b
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0059b3f0
add esp, 0xc
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x6b4d28
push esi
push edi
xor ecx, ecx
call fcn.0047145c
push edi
push str...meshcoreKVMWindowskvm.c
push 0x6b4d68
jmp 0x4095bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x6b4ca4
push esi
push edi
xor ecx, ecx
call fcn.0047145c
push edi
push 0x6b4cc4
push 0x6b4ce4
call fcn.004010b4
add esp, 0x18
push esi
call fcn.005aae60
int3
Function at 0x4095cc
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x753c
call fcn.0059bb50
mov eax, dword [0x6b0d44]
xor eax, esp
mov dword [esp + 0x7538], eax
push ebx
mov ebx, dword [ecx]
push ebp
mov ebp, dword [ecx + 4]
push esi
xor esi, esi
and dword [esp + 0xc], esi
push edi
xor edi, edi
cmp dword [0x6b4e2c], esi
jne 0x40967b
push 0
lea eax, [esp + 0x14]
push eax
mov eax, 0x7530
sub eax, esi
push eax
lea eax, [esp + 0x24]
add eax, esi
push eax
push dword [0x6b4e34]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x409671
cmp dword [esp + 0x10], 0
je 0x409671
cmp dword [0x6b4e2c], 0
jne 0x409671
add esi, dword [esp + 0x10]
mov dword [esp + 0x14], esi
jmp 0x40963f
add edi, eax
push ebp
mov edx, esi
lea ecx, [esp + 0x1c]
push ebx
sub edx, edi
add ecx, edi
call fcn.00408c9f
pop ecx
pop ecx
test eax, eax
jne 0x40963d
xor eax, eax
cmp edi, esi
cmove esi, eax
cmp edi, dword [esp + 0x14]
cmovne eax, edi
cmp dword [0x6b4e2c], 0
mov edi, eax
je 0x4095fd
jmp 0x40967b
mov dword [0x6b4e2c], 1
mov ecx, dword [esp + 0x7548]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0059b3f0
add esp, 0x753c
ret
Function at 0x40a081
Capabilities:
Create thread

Disassembly:
test edx, edx
je 0x40a0c7
cmp dword [0x76a484], 1
jne 0x40a09a
cmp dword [0x6b4e2c], 0
jne 0x40a09a
xor eax, eax
ret
push dword [esp + 8]
mov eax, dword [esp + 0x10]
and dword [0x76a480], 0
push 0x4016f7
push ecx
mov dword [0x6b4e44], 5
mov dword [0x6b4e30], eax
call fcn.00409f03
add esp, 0xc
ret
push esi
push edi
xor esi, esi
xor edx, edx
push esi
push esi
push 0xc
pop ecx
call fcn.0046c097
pop ecx
xor edi, edi
inc edi
pop ecx
mov ecx, dword [esp + 0x10]
mov dword [eax], 0x4016f7
mov dword [eax + 4], ecx
mov dword [eax + 8], edi
mov dword [0x76a4ac], edi
cmp dword [0x76a484], edi
jne 0x40a10f
cmp dword [0x6b4e2c], esi
jne 0x40a10f
push edi
push eax
call fcn.005cdee0
pop ecx
pop ecx
xor eax, eax
jmp 0x40a121
push esi
push esi
push eax
push fcn.00409d5c
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, edi
pop edi
pop esi
ret
Function at 0x40b827
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
push esi
push edi
mov ebp, 0x1aa
mov ebx, 0x10000
push ebp
push 0x6b4f7c
push 1
push ebx
mov edi, ecx
call fcn.005ce020
add esp, 0x10
mov dword [edi], eax
test eax, eax
je 0x40b8d6
push str._netif_:_
push ebx
push eax
call fcn.0040b32c
mov ecx, dword [edi]
mov esi, eax
mov edx, ebx
add ecx, esi
sub edx, esi
call fcn.0040b345
add esi, eax
mov eax, dword [edi]
push 0x6b4ff4
sub ebx, esi
add eax, esi
push ebx
push eax
call fcn.0040b32c
add esi, eax
lea ebx, [ebp + 5]
mov eax, dword [edi]
push ebx
push 0x6b4ff8
push 1
mov byte [esi + eax], 0
lea eax, [esi + 1]
push eax
push dword [edi]
call fcn.005ce1d0
add esp, 0x2c
mov dword [edi], eax
test eax, eax
jne 0x40b8cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x6b5010
push esi
push ebx
xor ecx, ecx
call fcn.0047145c
push ebx
push str...meshcoremeshinfo.c
push 0x6b5040
jmp 0x40b8fb
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x6b4f94
push esi
push ebp
xor ecx, ecx
call fcn.0047145c
push ebp
push 0x6b4fac
push 0x6b4fc4
call fcn.004010b4
add esp, 0x18
push esi
call fcn.005aae60
int3
Function at 0x40b90a
Capabilities:
Create thread
Shutdown system

Disassembly:
sub esp, 0x1c
mov eax, dword [0x6b0d44]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov ebp, edx
test edi, edi
jne 0x40b92b
xor eax, eax
jmp 0x40ba77
cmp edi, 6
jne 0x40b946
mov esi, dword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
push 2
call esi
push 4
call esi
xor eax, eax
inc eax
jmp 0x40ba77
cmp edi, 7
jne 0x40b95c
xor ebx, ebx
inc ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
mov eax, ebx
jmp 0x40ba77
cmp edi, 8
jne 0x40b96b
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBeep]
jmp 0x40b93e
cmp edi, 9
jne 0x40b993
xor esi, esi
push esi
push esi
push esi
push 0x408716
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esp + 0x10], eax
test eax, eax
je 0x40b93e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40b93e
cmp edi, 5
jg 0x40b924
lea eax, [esp + 0x10]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40b924
lea eax, [esp + 0x18]
xor esi, esi
push eax
push str.SeShutdownPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push esi
push esi
push esi
lea eax, [esp + 0x20]
mov dword [esp + 0x2c], 2
push eax
push esi
push dword [esp + 0x24]
xor ebx, ebx
inc ebx
mov dword [esp + 0x2c], ebx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40ba02
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40b924
sub edi, 1
je 0x40ba3a
sub edi, 1
je 0x40ba2c
sub edi, 1
je 0x40ba29
sub edi, 1
je 0x40ba25
sub edi, 1
jne 0x40ba6b
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_SetSystemPowerState]
jmp 0x40ba4e
push ebp
push ebx
jmp 0x40ba1d
push ebx
jmp 0x40ba2d
push esi
push ebx
push 0x1e
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownA]
jmp 0x40ba4e
push accept
test ebp, ebp
je 0x40ba47
push 4
jmp 0x40ba48
push esi
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
je 0x40ba6b
push esi
push esi
push esi
lea eax, [esp + 0x20]
mov dword [esp + 0x2c], esi
push eax
push esi
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov esi, ebx
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0059b3f0
add esp, 0x1c
ret
Function at 0x40bca9
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
lea eax, [ebp - 4]
mov esi, edx
push eax
push 0x69a270
push reloc.WS2_32.dll_bind
mov edi, ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x40bcfe
mov ecx, esi
push ebx
xor ebx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x40bcd3
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push esi
push 1
push ebx
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x43b695
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
and dword [esp + 4], 0
push ebx
mov ebx, ecx
push ebp
push esi
push edi
mov eax, dword [ebx + 0x2c]
mov ebp, dword [eax + 0x88]
mov edx, dword [eax + 0x8c]
add ebp, 0x7f4a7c15
mov ecx, ebp
adc edx, 0x9e3779b9
mov eax, edx
mov dword [esp + 0x18], edx
shrd ecx, eax, 0x1e
push 0xbf58476d
shr eax, 0x1e
xor ecx, ebp
push 0x1ce4e5b9
xor eax, edx
push eax
push ecx
call fcn.0059c790
mov esi, eax
mov ecx, edx
shrd esi, ecx, 0x1b
push 0x94d049bb
shr ecx, 0x1b
xor esi, eax
push 0x133111eb
xor ecx, edx
push ecx
push esi
call fcn.0059c790
mov edi, edx
mov esi, eax
shrd esi, edi, 0x1f
shr edi, 0x1f
xor esi, eax
mov eax, dword [ebx + 0x2c]
xor edi, edx
mov edx, dword [esp + 0x14]
mov ecx, edx
and ecx, 1
inc edx
mov dword [esp + 0x14], edx
cmp edx, 0x40
mov edx, dword [esp + 0x18]
mov dword [eax + ecx*8 + 0x88], esi
mov dword [eax + ecx*8 + 0x8c], edi
jb 0x43b6b2
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x4432ec
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x6b0d44]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x41c]
mov esi, ecx
push eax
push 0x400
lea eax, [ebp - 0x408]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameA]
test eax, eax
je 0x443468
cmp byte [ebp - 0x408], 0
je 0x443468
mov ecx, esi
call fcn.00411b9c
lea edx, [ebp - 0x408]
mov ecx, esi
call fcn.004117ba
push 0x6babec
push 0xfffffffffffffffe
pop ebx
mov edx, ebx
mov ecx, esi
call fcn.0040ece7
pop ecx
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov edi, eax
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x4433e2
mov edx, dword [ebp - 0x40c]
mov ecx, dword [ebp - 0x410]
call fcn.0059c670
movaps xmm1, xmm0
mov ecx, esi
call fcn.00411647
push 0x6babf4
mov edx, ebx
mov ecx, esi
call fcn.0040ece7
mov edx, dword [ebp - 0x414]
pop ecx
mov ecx, dword [ebp - 0x418]
call fcn.0059c670
movaps xmm1, xmm0
mov ecx, esi
call fcn.00411647
push str.free
mov edx, ebx
mov ecx, esi
call fcn.0040ece7
pop ecx
dec edi
sub edi, 1
je 0x443421
sub edi, 1
je 0x44341a
sub edi, 1
je 0x443413
sub edi, 1
je 0x44340c
mov ecx, esi
sub edi, 1
je 0x443405
mov edx, 0x6bac30
jmp 0x443428
mov edx, str.RAMDISK
jmp 0x443428
mov edx, str.CDROM
jmp 0x443426
mov edx, str.REMOTE
jmp 0x443426
mov edx, str.FIXED
jmp 0x443426
mov edx, str.REMOVABLE
mov ecx, esi
call fcn.004117ba
push 0x6bac38
mov edx, ebx
mov ecx, esi
call fcn.0040ece7
pop ecx
push 6
push 0x18075380
push 0
mov edx, 0x4432cb
mov ecx, esi
call fcn.00411e30
add esp, 0xc
mov edx, ebx
mov ecx, esi
push 0x6bac40
call fcn.0040ece7
xor eax, eax
pop ecx
inc eax
jmp 0x44346a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0059b3f0
mov esp, ebp
pop ebp
ret
Function at 0x4482d1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor edi, edi
mov ebp, edi
cmp dword [esi + 4], edi
jne 0x4482f4
mov eax, dword [esi + 0x40]
cmp dword [eax + 4], edi
jle 0x44837d
mov eax, dword [esi + 0x40]
mov ebx, edi
mov eax, dword [eax + 0xc]
test eax, eax
je 0x448302
mov ebx, dword [eax]
mov ecx, dword [ebx]
mov ebp, dword [ebx + 4]
lea eax, [ecx + 0x20]
push eax
lea eax, [esp + 0x18]
push eax
push dword [ebx + 8]
lea eax, [ebx + 0xc]
push eax
push dword [ecx + 0x38]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [esp + 0x10], eax
cmp eax, 1
jne 0x448348
cmp dword [esi + 4], edi
jne 0x448393
mov ecx, dword [ebx]
mov ecx, dword [ecx + 0x40]
call fcn.0046d4b2
push ebx
call fcn.005d0f40
pop ecx
cmp dword [esi + 4], edi
je 0x4482e8
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x44837d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x448370
mov edx, dword [esi + 0x30]
mov ecx, dword [esi + 0x34]
push 0x44825f
push esi
push edi
call fcn.00471754
add esp, 0xc
jmp 0x448393
push 0xfffffffffffffffc
pop edi
push esi
push dword [esi]
call fcn.00448107
jmp 0x448391
cmp dword [esi + 4], edi
jne 0x448393
xor edi, edi
inc edi
test ebp, ebp
je 0x448393
push esi
push dword [esi]
call fcn.004481d9
pop ecx
pop ecx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4483c2
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 0xc]
mov edx, esi
mov ecx, dword [esi]
mov ecx, dword [ecx + 0x40]
call fcn.00470071
mov ecx, dword [esi]
mov eax, dword [ecx + 0x40]
cmp dword [eax + 4], 1
jne 0x4483e4
pop esi
jmp fcn.004482d1
xor eax, eax
pop esi
ret
Function at 0x45559f
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
cmp dword [esi + 0x48], edi
jne 0x4556e2
cmp dword [esi + 0x14], edi
je 0x4556e2
xor ebx, ebx
inc ebx
mov dword [esi + 0x48], ebx
cmp dword [esi + 0x4c], edi
jne 0x4555eb
push edi
push edi
xor edx, edx
mov ecx, 0x1000
call fcn.0046c097
pop ecx
pop ecx
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], 0x1000
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
cmp dword [esi + 0x58], edi
jg 0x455603
mov edx, dword [esi + 0x4c]
push ecx
push esi
push dword [esi + 0x50]
mov dword [esi + 0x58], edi
mov dword [esi + 0x54], edi
jmp 0x4556c1
mov ecx, dword [esi + 0x30]
mov eax, dword [ecx]
cmp dword [eax + 0x34], edi
jne 0x4556df
mov dword [esi + 0x5c], edi
call fcn.0046bff2
test eax, eax
je 0x45563d
mov eax, dword [esi + 0x30]
test eax, eax
je 0x455628
mov ecx, dword [eax]
jmp 0x45562a
mov ecx, edi
mov eax, dword [esi + 0x54]
xor edx, edx
push dword [esi + 0x58]
add eax, dword [esi + 0x4c]
push eax
call fcn.0045e4d6
pop ecx
pop ecx
mov eax, dword [esi + 0x5c]
test eax, eax
jle 0x45565a
mov ecx, dword [esi + 0x58]
cmp eax, ecx
jne 0x455650
mov dword [esi + 0x5c], edi
jmp 0x455660
sub ecx, eax
mov dword [esi + 0x58], eax
add dword [esi + 0x54], ecx
jmp 0x455660
mov dword [esi + 0x58], edi
mov dword [esi + 0x54], edi
mov ecx, dword [esi + 0x30]
mov eax, dword [ecx]
mov edx, dword [eax + 0x34]
test edx, edx
jne 0x4556df
mov eax, dword [esi + 0x58]
test eax, eax
je 0x455680
jle 0x45567a
cmp dword [esi + 0x5c], edi
je 0x455680
test edx, edx
je 0x455611
jmp 0x4556df
mov ecx, dword [esi + 0x50]
mov eax, ecx
sub eax, dword [esi + 0x58]
sub eax, dword [esi + 0x54]
jne 0x4556ac
lea eax, [ecx + 0x1000]
push eax
push dword [esi + 0x4c]
call fcn.005e2b50
mov dword [esi + 0x4c], eax
pop ecx
pop ecx
test eax, eax
je 0x4556e9
add dword [esi + 0x50], 0x1000
mov ecx, dword [esi + 0x54]
mov eax, dword [esi + 0x50]
mov edx, dword [esi + 0x58]
sub eax, ecx
push ecx
sub eax, edx
add edx, ecx
add edx, dword [esi + 0x4c]
push esi
push eax
mov ecx, dword [esi + 0x18]
call fcn.004731e5
add esp, 0xc
test eax, eax
je 0x4556df
push edi
push edi
push ebx
push esi
push dword [esi + 0x18]
call fcn.00455532
add esp, 0x14
mov dword [esi + 0x48], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edi, 0xfe
mov esi, 0x3cd
push edi
push esi
mov edx, 0x6c1c04
xor ecx, ecx
call fcn.0047145c
push esi
push 0x6c1c28
push 0x6c1c4c
call fcn.004010b4
add esp, 0x18
push edi
call fcn.005aae60
int3
Function at 0x45f8bf
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov ebx, ecx
or edx, 0xffffffff
push edi
mov dword [esp + 0x1c], ebx
call fcn.0040e400
mov dword [esp + 0x18], eax
or edx, 0xffffffff
lea eax, [esp + 0x14]
mov ecx, ebx
push eax
call fcn.0040fdf0
pop ecx
mov ecx, ebx
call fcn.004119c6
push 0x759254
or edx, 0xffffffff
mov ecx, ebx
call fcn.00449a29
pop ecx
mov ecx, ebx
mov edi, eax
call fcn.0041259d
mov esi, dword [esp + 0x14]
xor edx, edx
test edi, edi
je 0x45f96c
xor ebx, ebx
lea ecx, [esi + 5]
push ebx
push ebx
call fcn.0046c097
mov ebp, eax
mov edx, esi
push esi
push dword [esp + 0x24]
lea ecx, [ebp + 4]
mov dword [ebp], edi
call section..text
add esp, 0x10
mov byte [esi + ebp + 4], bl
mov ecx, dword [edi]
call fcn.0046bff2
test eax, eax
je 0x45f953
mov ecx, dword [edi]
cmp dword [ecx - 0xc], ebx
jbe 0x45f951
lea ebx, [ecx + 0x10]
add ebx, dword [ecx - 0x10]
mov ebx, dword [ebx]
mov edx, dword [ebx]
mov ecx, dword [edi + 0xc]
push ebp
push 1
push 0x46343b
push dword [edi]
call fcn.004497a2
add esp, 0x10
jmp 0x45f9ba
xor ebp, ebp
lea edi, [esi + 4]
push ebp
push ebp
mov ecx, edi
call fcn.0046c097
mov ebx, eax
mov edx, esi
push esi
push dword [esp + 0x24]
lea ecx, [ebx + 4]
mov dword [ebx], edi
call section..text
add esp, 0x10
lea eax, [esp + 0x20]
push ebp
push eax
push edi
push ebx
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x1c]
call fcn.0041259d
push 1
push ebx
call fcn.005cdee0
pop ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x461883
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
xor edi, edi
push edi
push edi
push 0x945
push 0x75dcf0
push 1
push 0x28
call fcn.005ce020
add esp, 0x10
mov ecx, eax
push 0x18
pop edx
call fcn.0046bf0b
pop ecx
pop ecx
mov esi, eax
push 4
push esi
call fcn.004a39d0
pop ecx
pop ecx
cmp dword [esi], edi
je 0x4618ae
xor ecx, ecx
call fcn.0046febf
push 0x461311
push esi
push 0x4612e6
mov edx, 0x461269
mov dword [esi + 0xc], eax
mov ecx, 0x46121d
call fcn.0040e77b
add esp, 0xc
test eax, eax
je 0x4618eb
pop edi
pop esi
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edi, 0xfe
mov esi, 0x94a
push edi
push esi
mov edx, 0x75dd20
xor ecx, ecx
call fcn.0047145c
add esp, 0xc
push esi
push 0x75dd50
push 0x75dd80
call fcn.004010b4
add esp, 0xc
push edi
call fcn.005aae60
int3
Function at 0x467bd3
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, edx
mov ebx, ecx
mov edx, dword [esp + 0x24]
mov ecx, 0x1250
call fcn.0046c159
mov esi, eax
mov dword [esi + 0x14], str.ILibAsyncSocket
mov dword [esi + 0x2c], 0x40
mov dword [esi + 0x1c], 0x467bb6
mov dword [esi + 0x20], fcn.004682f1
mov dword [esi + 0x24], fcn.00469c40
mov dword [esi + 0xc], ebx
test edi, edi
je 0x467c3a
mov ebp, 0x1cb
push ebp
push 0x75fc00
push 1
push edi
call fcn.005ce020
add esp, 0x10
mov dword [esi + 0x1f4], eax
test eax, eax
jne 0x467c49
jmp 0x467cc6
mov edi, 0xffff
mov dword [esi + 0x1f4], 0x77d080
mov eax, dword [esp + 0x14]
mov ecx, ebx
or dword [esi + 0x30], 0xffffffff
mov dword [esi + 0x1b8], eax
mov eax, dword [esp + 0x18]
mov dword [esi + 0x1bc], eax
mov eax, dword [esp + 0x1c]
mov dword [esi + 0x1c0], eax
mov eax, dword [esp + 0x20]
mov dword [esi], 0x4690cd
mov dword [esi + 4], 0x469382
mov dword [esi + 8], 0x467ad5
mov dword [esi + 0x1c4], eax
mov dword [esi + 0x1fc], edi
mov dword [esi + 0x1f8], edi
call fcn.0046c53e
push 0
push 0x40
push 1
push 0
mov dword [esi + 0x1d4], eax
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov edx, esi
mov dword [esi + 0x208], eax
mov ecx, ebx
call fcn.0046c508
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x75fc20
push esi
push ebp
xor ecx, ecx
call fcn.0047145c
push ebp
push 0x75fc40
push 0x75fc60
call fcn.004010b4
add esp, 0x18
push esi
call fcn.005aae60
int3
Function at 0x468888
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
push edi
push 0xfffffffffffffffc
mov ebx, ecx
pop esi
push 0xffffffffffffffff
push dword [ebx + 0x208]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebx + 0x234]
xor edi, edi
cmp dword [eax], edi
jbe 0x4689a8
cmp dword [ebx + 0x204], edi
jne 0x4689a8
cmp dword [ebx + 0x1e8], edi
jne 0x4688ea
push edi
push edi
push 0x30
xor edx, edx
pop ecx
call fcn.0046c097
pop ecx
pop ecx
mov esi, edi
mov dword [eax + 0x28], 3
mov dword [ebx + 0x204], eax
mov dword [ebx + 0x200], eax
jmp 0x4689a8
push ebp
push 0xf
push dword [ebx + 0x22c]
call fcn.0049eab0
mov eax, dword [ebx + 0x234]
pop ecx
pop ecx
push edi
push dword [eax]
push dword [eax + 4]
push dword [ebx + 0x30]
call dword [sym.imp.WS2_32.dll_send]
mov ebp, eax
test ebp, ebp
jle 0x4689a7
mov eax, dword [ebx + 0x234]
mov eax, dword [eax]
cmp ebp, eax
jge 0x468990
push edi
push edi
sub eax, ebp
push 0x30
mov edx, eax
pop ecx
call fcn.0046c097
mov edi, eax
mov esi, edi
neg esi
sbb esi, esi
lea ecx, [edi + 0x34]
and esi, ecx
mov dword [edi], esi
mov ecx, esi
mov eax, dword [ebx + 0x234]
mov eax, dword [eax]
sub eax, ebp
mov dword [edi + 0x28], 3
mov edx, eax
mov dword [edi + 4], eax
mov eax, dword [ebx + 0x234]
push edx
mov eax, dword [eax + 4]
add eax, ebp
push eax
call section..text
mov dword [ebx + 0x204], edi
mov dword [ebx + 0x200], edi
xor edi, edi
push edi
push edi
push 1
push dword [ebx + 0x22c]
mov esi, edi
call fcn.0049eae0
add esp, 0x20
jmp 0x4689a7
jne 0x4689a7
push edi
push edi
push 1
push dword [ebx + 0x22c]
call fcn.0049eae0
xor esi, esi
add esp, 0x10
inc esi
pop ebp
push edi
push 1
push dword [ebx + 0x208]
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
pop edi
mov eax, esi
pop esi
pop ebx
ret