joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46e080
Capabilities:
Get socket status

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov ebx, dword [esp + 0x44]
mov esi, dword [esp + 0x48]
mov edi, dword [esp + 0x4c]
mov ecx, dword [esp + 0x50]
test ebx, ebx
je 0x46e0a0
mov eax, dword [ebx]
test eax, eax
jne 0x46e0d0
test esi, esi
je 0x46e0aa
mov eax, dword [esi]
test eax, eax
jne 0x46e0d0
test edi, edi
je 0x46e0b8
mov eax, dword [edi]
test eax, eax
jne 0x46e190
xor eax, eax
test ecx, ecx
je 0x46e16a
mov eax, ecx
call sym._Curl_wait_ms.part.0
jmp 0x46e16a
xor edx, edx
test ecx, ecx
js 0x46e10b
test ecx, ecx
je 0x46e171
mov eax, ecx
mov edx, 0x10624dd3
imul edx
mov eax, ecx
sar eax, 0x1f
sar edx, 6
sub edx, eax
mov dword [esp + 0x28], edx
imul edx, edx, 0x3e8
sub ecx, edx
lea edx, [esp + 0x28]
imul ecx, ecx, 0x3e8
mov dword [esp + 0x2c], ecx
test edi, edi
je 0x46e1a0
mov eax, dword [edi]
test eax, eax
mov eax, 0
cmove edi, eax
test esi, esi
je 0x46e1b0
mov ecx, dword [esi]
mov eax, 0
test ecx, ecx
cmove esi, eax
test ebx, ebx
je 0x46e1c0
mov eax, dword [ebx]
test eax, eax
mov eax, 0
cmove ebx, eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
add eax, 1
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_select]
sub esp, 0x14
add esp, 0x30
pop ebx
pop esi
pop edi
ret
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
lea edx, [esp + 0x28]
jmp 0x46e10b
test ecx, ecx
jns 0x46e0d6
xor edx, edx
jmp 0x46e11f
xor edi, edi
test esi, esi
jne 0x46e127
lea esi, [esi]
xor esi, esi
test ebx, ebx
jne 0x46e13b
lea esi, [esi]
xor ebx, ebx
jmp 0x46e147

Function at 0x46e9f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x28]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_recv]
sub esp, 0x10
cmp eax, 0xffffffff
je 0x46ea30
mov ecx, dword [esp + 0x2c]
mov dword [ecx], eax
xor eax, eax
add esp, 0x1c
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, dword [esp + 0x2c]
cmp eax, 0x2733
mov eax, 0x51
mov dword [edx], 0
mov edx, 0x38
cmovne eax, edx
add esp, 0x1c
ret
Function at 0x46eae0
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov ebx, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
mov eax, dword [ebx + 0x5d8]
test eax, eax
je 0x46eb50
mov dword [esp + 4], 1
mov dword [esp], ebx
call sym._Curl_set_in_callback
mov eax, dword [ebx + 0x56c]
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 8], eax
call dword [ebx + 0x5d8]
mov dword [esp + 4], 0
mov dword [esp], ebx
mov edi, eax
call sym._Curl_set_in_callback
add esp, 0x20
mov eax, edi
pop ebx
pop esi
pop edi
ret
xor edi, edi
cmp esi, 2
ja 0x46eb41
mov eax, dword [ebx + 0x568]
mov dword [esp + 8], 1
mov dword [esp + 4], 2
mov dword [esp + 0xc], eax
lea eax, [esi + esi*2 + 0x5d6238]
mov dword [esp], eax
call sym._fwrite
mov eax, dword [ebx + 0x568]
mov dword [esp + 8], 1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call sym._fwrite
add esp, 0x20
mov eax, edi
pop ebx
pop esi
pop edi
ret
Function at 0x46ed70
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x13c
mov ebx, dword [esp + 0x150]
mov edx, dword [esp + 0x154]
mov edi, dword [esp + 0x160]
mov ecx, dword [ebx + 0x508]
lea eax, [ebx + edx*4]
mov ebp, dword [eax + 0x408]
test byte [ecx + 0x40], 3
je 0x46edb0
cmp dword [eax + 0x420], sym._Curl_recv_plain
je 0x46ee00
mov eax, dword [esp + 0x15c]
mov dword [esp + 0xc], 0
mov dword [esp], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x158]
mov dword [esp + 4], eax
call dword [sym.imp.WS2_32.dll_send]
sub esp, 0x10
cmp eax, 0xffffffff
mov esi, eax
mov dword [edi], 0
je 0x46eeb0
add esp, 0x13c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
shl edx, 4
lea esi, [ebx + edx]
mov eax, dword [esi + 0x434]
sub eax, dword [esi + 0x438]
mov edx, eax
mov eax, dword [esi + 0x430]
test eax, eax
je 0x46ee22
test edx, edx
je 0x46edb0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebp
mov dword [esp + 0x2c], edx
call sym._Curl_socket_check
cmp eax, 0xffffffff
je 0x46edb0
test al, 1
je 0x46edb0
mov eax, dword [esi + 0x430]
mov edx, dword [esp + 0x2c]
test eax, eax
je 0x46ef1d
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
add eax, dword [esi + 0x438]
mov dword [esp], ebp
mov dword [esp + 4], eax
call dword [sym.imp.WS2_32.dll_recv]
sub esp, 0x10
test eax, eax
jle 0x46edb0
add dword [esi + 0x438], eax
jmp 0x46edb0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
mov ebp, eax
je 0x46ef10
lea eax, [esp + 0x30]
mov dword [esp], ebp
mov dword [esp + 8], 0x100
mov dword [esp + 4], eax
call sym._Curl_strerror
mov dword [esp + 4], str.Send_failure:__s
mov dword [esp + 8], eax
mov eax, dword [ebx]
mov dword [esp], eax
call sym._Curl_failf
mov eax, dword [ebx]
mov dword [eax + 0xc6c], ebp
mov dword [edi], 0x37
add esp, 0x13c
pop ebx
mov eax, esi
pop esi
pop edi
pop ebp
ret
mov dword [edi], 0x51
xor esi, esi
jmp 0x46edeb
mov eax, dword [ebx]
mov eax, dword [eax + 0x8d0]
add eax, eax
mov dword [esi + 0x434], eax
mov dword [esp], eax
call dword [0x5bcc30]
test eax, eax
mov dword [esi + 0x430], eax
mov dword [esi + 0x438], 0
mov dword [esi + 0x43c], 0
jne 0x46ef63
mov dword [esi + 0x434], 0
jmp 0x46edb0
mov edx, dword [esi + 0x434]
jmp 0x46ee71
Function at 0x46efc0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x11c
mov esi, dword [esp + 0x130]
mov ebx, dword [esp + 0x134]
mov ebp, dword [esi + ebx*4 + 0x408]
shl ebx, 4
add ebx, esi
mov ecx, dword [ebx + 0x430]
test ecx, ecx
je 0x46f0b0
mov edx, dword [ebx + 0x438]
mov eax, dword [ebx + 0x43c]
cmp edx, eax
ja 0x46f060
mov edi, 0
jne 0x46f0b0
mov dword [esp], ecx
call dword [0x5bcc2c]
mov dword [ebx + 0x430], 0
mov dword [ebx + 0x434], 0
mov dword [ebx + 0x438], 0
mov dword [ebx + 0x43c], 0
test edi, edi
jle 0x46f0b0
mov eax, dword [esp + 0x140]
mov dword [eax], 0
add esp, 0x11c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
sub edx, eax
cmp edx, dword [esp + 0x13c]
cmova edx, dword [esp + 0x13c]
add ecx, eax
mov eax, dword [esp + 0x138]
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 8], edx
mov edi, edx
call sym._memcpy
mov eax, dword [ebx + 0x43c]
add eax, edi
cmp eax, dword [ebx + 0x438]
mov dword [ebx + 0x43c], eax
jne 0x46f03e
mov ecx, dword [ebx + 0x430]
jmp 0x46f00d
mov eax, dword [esp + 0x13c]
mov dword [esp + 0xc], 0
mov dword [esp], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x138]
mov dword [esp + 4], eax
call dword [sym.imp.WS2_32.dll_recv]
sub esp, 0x10
cmp eax, 0xffffffff
mov edi, eax
mov ecx, dword [esp + 0x140]
mov dword [ecx], 0
jne 0x46f04f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
mov ebx, eax
je 0x46f150
lea eax, [esp + 0x10]
mov dword [esp + 8], 0x100
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._Curl_strerror
mov dword [esp + 4], str.Recv_failure:__s
mov dword [esp + 8], eax
mov eax, dword [esi]
mov dword [esp], eax
call sym._Curl_failf
mov eax, dword [esi]
mov dword [eax + 0xc6c], ebx
mov eax, dword [esp + 0x140]
mov dword [eax], 0x38
jmp 0x46f04f
mov eax, dword [esp + 0x140]
mov dword [eax], 0x51
jmp 0x46f04f
Function at 0x478e60
Capabilities:
Get common file path

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [esp + 0x40]
mov dword [esp], str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
sub esp, 4
test eax, eax
je 0x478f90
mov ebx, eax
mov dword [esp + 4], str.LoadLibraryExA
mov dword [esp], eax
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call ebp
sub esp, 8
mov edi, eax
mov dword [esp + 4], 0x5d90ec
mov dword [esp], esi
call sym._strpbrk
test eax, eax
je 0x478ed5
test edi, edi
je 0x478f10
mov dword [esp + 8], 8
mov dword [esp + 4], 0
mov dword [esp], esi
call edi
sub esp, 0xc
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
test edi, edi
je 0x478f24
mov dword [esp + 4], str.AddDllDirectory
mov dword [esp], ebx
call ebp
sub esp, 8
test eax, eax
je 0x478f24
mov dword [esp + 8], 0x800
mov dword [esp + 4], 0
mov dword [esp], esi
call edi
sub esp, 0xc
jmp 0x478ecd
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
sub esp, 4
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 0x1c], eax
call eax
sub esp, 8
test eax, eax
mov ebx, eax
je 0x478f90
mov dword [esp], esi
call sym._strlen
lea eax, [ebx + eax + 1]
mov dword [esp], eax
call dword [0x5bcc30]
test eax, eax
mov ebp, eax
je 0x478f74
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [esp + 0x1c]
sub esp, 8
test eax, eax
jne 0x478fa0
xor ebx, ebx
mov dword [esp], ebp
call dword [0x5bcc2c]
mov eax, ebx
jmp 0x478ecd
xor eax, eax
jmp 0x478ecd
mov dword [esp], ebp
call sym._strlen
mov byte [ebp + eax], 0x5c
lea eax, [ebp + eax + 1]
mov dword [esp + 4], esi
mov dword [esp], eax
call sym._strcpy
test edi, edi
je 0x478fdd
mov dword [esp + 8], 8
mov dword [esp + 4], 0
mov dword [esp], ebp
call edi
sub esp, 0xc
mov ebx, eax
jmp 0x478f76
mov dword [esp], ebp
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
sub esp, 4
mov ebx, eax
jmp 0x478f76

Function at 0x478ff0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x1ac
test byte [esp + 0x1b0], 2
je 0x479040
lea eax, [esp + 0x10]
mov dword [esp], 0x202
mov dword [esp + 4], eax
call dword [sym.imp.WS2_32.dll_WSAStartup]
sub esp, 8
test eax, eax
je 0x4790c1
mov eax, 2
add esp, 0x1ac
ret
shr ax, 8
cmp ax, 2
jne 0x4790ce
nop
call sym._Curl_sspi_global_init
test eax, eax
jne 0x479025
mov dword [esp], str.iphlpapi.dll
call sym._Curl_load_library
test eax, eax
mov dword [0x743174], eax
je 0x47907b
mov dword [esp + 4], str.if_nametoindex
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
sub esp, 8
test eax, eax
je 0x47907b
mov dword [0x743170], eax
mov dword [esp + 0xc], 3
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], 6
call sym._Curl_verify_windows_version
test al, al
mov dword [esp], 0x7463f0
setne byte [0x7463e8]
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub esp, 4
xor eax, eax
add esp, 0x1ac
ret
movzx eax, word [esp + 0x10]
cmp al, 2
je 0x479030
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
jmp 0x479025
Function at 0x47add0
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x14
mov dword [esp + 8], str.Connected_for_receive
mov dword [esp + 4], 0x5d9980
mov eax, dword [eax + 0x10]
mov eax, dword [eax]
mov dword [esp], eax
call sym._Curl_infof
mov dword [ebx], 1
mov eax, ebx
call sym._tftp_set_timeouts
test eax, eax
je 0x47ae10
add esp, 0x14
pop ebx
pop esi
ret
add esp, 0x14
mov edx, esi
mov eax, ebx
pop ebx
pop esi
jmp sym._tftp_rx

Function at 0x47b220
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x14
mov dword [esp + 8], str.Connected_for_transmit
mov dword [esp + 4], 0x5d9980
mov eax, dword [eax + 0x10]
mov eax, dword [eax]
mov dword [esp], eax
call sym._Curl_infof
mov dword [ebx], 2
mov eax, ebx
call sym._tftp_set_timeouts
test eax, eax
je 0x47b260
add esp, 0x14
pop ebx
pop esi
ret
add esp, 0x14
mov edx, esi
mov eax, ebx
pop ebx
pop esi
jmp sym._tftp_tx

Function at 0x47ba40
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
sub esp, 0x18
mov ecx, dword [eax + 0x10]
mov ebx, dword [ecx]
mov ecx, dword [eax]
cmp ecx, 1
je 0x47bac0
jb 0x47bab2
cmp ecx, 2
je 0x47ba80
cmp ecx, 3
jne 0x47ba90
mov dword [esp], ebx
mov dword [esp + 8], str.TFTP_finished
mov dword [esp + 4], 0x5d9980
call sym._Curl_infof
add esp, 0x18
xor eax, eax
pop ebx
ret
add esp, 0x18
pop ebx
jmp sym._tftp_tx
mov dword [esp], ebx
mov dword [esp + 8], str.Internal_state_machine_error
mov dword [esp + 4], 0x5d98ca
call sym._Curl_failf
add esp, 0x18
mov eax, 0x47
pop ebx
ret
add esp, 0x18
pop ebx
jmp sym._tftp_send_first
add esp, 0x18
pop ebx
jmp sym._tftp_rx
Function at 0x4899e0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [esp + 0x40]
lea esi, [esp + 0x14]
mov eax, dword [ebx + 0xc]
mov edi, dword [ebx + 0x44]
mov dword [esp + 8], 0x5dbb20
mov dword [esp + 4], 0xc
mov dword [esp], esi
mov dword [esp + 0xc], eax
call sym._curl_msnprintf
lea eax, [ebx + 0x20]
mov dword [esp + 4], esi
mov dword [esp + 0xc], eax
lea eax, [ebx + 0x24]
mov dword [esp + 8], eax
mov eax, dword [ebx + 8]
mov dword [esp], eax
call sym._Curl_getaddrinfo_ex
test eax, eax
jne 0x489a93
mov eax, dword [ebx]
mov dword [esp], eax
call dbg.pthread_mutex_lock
mov eax, dword [ebx + 4]
test eax, eax
jne 0x489ab0
mov eax, dword [ebx + 0x18]
cmp eax, 0xffffffff
je 0x489a78
lea edx, [esp + 0x13]
mov byte [esp + 0x13], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.WS2_32.dll_send]
sub esp, 0x10
test eax, eax
js 0x489ad4
mov eax, dword [ebx]
mov dword [ebx + 4], 1
mov dword [esp], eax
call dbg.pthread_mutex_unlock
add esp, 0x2c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, eax
mov ebp, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call ebp
test eax, eax
jne 0x489ae0
mov dword [ebx + 0x1c], esi
jmp 0x489a32
mov eax, dword [ebx]
mov dword [esp], eax
call dbg.pthread_mutex_unlock
mov eax, ebx
call sym._destroy_thread_sync_data
mov dword [esp], edi
call dword [0x5bcc2c]
add esp, 0x2c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebx + 0x1c], eax
jmp 0x489a78
call ebp
mov edx, 8
test eax, eax
cmove eax, edx
mov dword [ebx + 0x1c], eax
jmp 0x489a32
Function at 0x48bb00
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x3c
mov eax, dword [0x743280]
mov dword [esp + 0x24], 0x4020
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 4
test eax, eax
je 0x48bba4
cmp eax, 2
je 0x48bb6b
lea eax, [esp + 0x2c]
mov dword [esp + 8], 0x1001
mov dword [esp + 4], 0xffff
mov dword [esp + 0x10], eax
lea eax, [esp + 0x28]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_getsockopt]
sub esp, 0x14
test eax, eax
jne 0x48bb70
mov eax, dword [esp + 0x24]
cmp dword [esp + 0x28], eax
jle 0x48bb70
add esp, 0x3c
ret
lea eax, [esp + 0x24]
mov dword [esp + 0x10], 4
mov dword [esp + 8], 0x1001
mov dword [esp + 4], 0xffff
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
sub esp, 0x14
add esp, 0x3c
ret
mov dword [esp + 0xc], 3
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], 6
call sym._Curl_verify_windows_version
test al, al
je 0x48bbe0
mov dword [0x743280], 2
add esp, 0x3c
ret
mov dword [0x743280], 1
jmp 0x48bb2d
Function at 0x48e5e0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
test eax, eax
je 0x48e690
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x10
call sym._isip
test al, al
je 0x48e602
xor eax, eax
add esp, 0x10
pop ebx
pop esi
pop edi
ret
mov dword [esp], ebx
call sym._strlen
mov dword [esp + 4], 0x2e
mov dword [esp + 8], eax
mov edi, eax
mov dword [esp], ebx
call sym._Curl_memrchr
test eax, eax
je 0x48e693
sub eax, ebx
mov dword [esp + 4], 0x2e
mov dword [esp], ebx
mov dword [esp + 8], eax
call sym._Curl_memrchr
test eax, eax
je 0x48e693
lea esi, [eax + 1]
mov eax, esi
sub eax, ebx
sub edi, eax
test esi, esi
cmove esi, ebx
add edi, esi
cmp edi, esi
jbe 0x48e697
mov eax, 0x1505
mov esi, esi
lea edi, [edi]
mov ebx, eax
add esi, 1
shl ebx, 5
add ebx, eax
movsx eax, byte [esi - 1]
mov dword [esp], eax
call sym._Curl_raw_toupper
movsx eax, al
xor eax, ebx
cmp edi, esi
jne 0x48e660
add esp, 0x10
movzx eax, al
pop ebx
pop esi
pop edi
ret
xor eax, eax
ret
mov esi, ebx
jmp 0x48e64c
mov eax, 5
jmp 0x48e5fb
Function at 0x4906b0
Capabilities:
Resolve dns

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [esp + 0x5c]
mov dword [eax], 0
lea eax, [esp + 0x2c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x50]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_getaddrinfo]
sub esp, 0x10
test eax, eax
mov dword [esp + 0x18], eax
jne 0x49082e
mov ebx, dword [esp + 0x2c]
test ebx, ebx
je 0x490880
mov dword [esp + 0x14], 0
xor edi, edi
jmp 0x490725
cmp eax, 0x17
mov esi, 0x1c
je 0x490732
mov ebx, dword [ebx + 0x1c]
test ebx, ebx
je 0x490810
mov eax, dword [ebx + 4]
cmp eax, 2
jne 0x490710
mov esi, 0x10
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x49071a
mov eax, dword [ebx + 0x10]
cmp esi, eax
ja 0x49071a
test eax, eax
je 0x49071a
mov dword [esp], 0x20
call dword [0x5bcc30]
test eax, eax
mov ebp, eax
je 0x490858
mov eax, dword [ebx]
mov dword [ebp], eax
mov eax, dword [ebx + 4]
mov dword [ebp + 4], eax
mov eax, dword [ebx + 8]
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [ebp + 0x10], esi
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x14], 0
mov dword [ebp + 0x1c], 0
mov dword [ebp + 0xc], eax
mov dword [esp], esi
call dword [0x5bcc30]
test eax, eax
mov dword [ebp + 0x18], eax
je 0x49084f
mov edx, dword [ebx + 0x18]
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + esi - 4]
mov dword [eax + esi - 4], ecx
lea ecx, [eax + 4]
mov dword [esp + 0x1c], ebx
and ecx, 0xfffffffc
sub eax, ecx
sub edx, eax
add eax, esi
xor esi, esi
and eax, 0xfffffffc
mov ebx, dword [edx + esi]
mov dword [ecx + esi], ebx
add esi, 4
cmp esi, eax
jb 0x4907c2
mov ebx, dword [esp + 0x1c]
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x4907ea
mov dword [esp], eax
call dword [0x5bcc24]
test eax, eax
mov dword [ebp + 0x14], eax
je 0x490843
mov eax, dword [esp + 0x14]
test edi, edi
cmove edi, ebp
test eax, eax
je 0x49083a
mov ebx, dword [ebx + 0x1c]
mov dword [eax + 0x1c], ebp
mov dword [esp + 0x14], ebp
test ebx, ebx
jne 0x490725
lea esi, [esi]
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x490824
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
sub esp, 4
test edi, edi
je 0x490880
mov eax, dword [esp + 0x5c]
mov dword [eax], edi
mov eax, dword [esp + 0x18]
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x14], ebp
jmp 0x49071a
mov eax, dword [ebp + 0x18]
mov dword [esp], eax
call dword [0x5bcc2c]
mov dword [esp], ebp
call dword [0x5bcc2c]
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x49086c
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
sub esp, 4
mov dword [esp], edi
xor edi, edi
call sym._Curl_freeaddrinfo
mov dword [esp + 0x18], 8
jmp 0x490828
mov dword [esp], 0x2af9
xor edi, edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
sub esp, 4
mov dword [esp + 0x18], 0x2af9
jmp 0x490828
Function at 0x49b7a0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push ebx
mov ecx, dword [esp + 8]
mov eax, 0x1505
mov ebx, dword [esp + 0xc]
add ebx, ecx
cmp ecx, ebx
jae 0x49b7c8
mov edx, eax
add ecx, 1
shl edx, 5
add eax, edx
movsx edx, byte [ecx - 1]
xor eax, edx
cmp ebx, ecx
jne 0x49b7b4
xor edx, edx
div dword [esp + 0x10]
pop ebx
mov eax, edx
ret

Function at 0x49cc40
Capabilities:
Move file

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebp, dword [esp + 0x30]
mov ebx, dword [esp + 0x34]
call sym._Curl_now
mov esi, eax
mov edi, edx
nop
lea esi, [esi]
mov dword [esp + 8], 1
mov dword [esp + 4], ebx
mov dword [esp], ebp
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
sub esp, 0xc
test eax, eax
jne 0x49ccd0
call sym._Curl_now
mov dword [esp + 8], esi
mov dword [esp + 0xc], edi
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._Curl_timediff
cmp edx, 0
jbe 0x49ccb0
add esp, 0x1c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 0x3e8
ja 0x49cc9a
mov dword [esp], 1
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
jmp 0x49cc60
add esp, 0x1c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x49dd90
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
push edi
mov ebp, edx
push esi
push ebx
mov esi, ecx
mov edi, eax
sub esp, 0x4c
mov ebx, dword [esp + 0x60]
mov dword [esp + 4], 0
mov dword [esp], ecx
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 8], ebx
mov dword [esp + 0x38], 4
mov dword [esp + 0x3c], ebx
call sym._memset
mov eax, dword [esp + 0x64]
mov dword [esp + 0x10], 0xf0000040
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp + 0xc], eax
lea eax, [esp + 0x2c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
sub esp, 0x14
test eax, eax
jne 0x49de15
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esp + 0x30]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
sub esp, 0x14
test eax, eax
jne 0x49de83
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x49de75
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x49de0d
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
sub esp, 8
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
sub esp, 4
jmp 0x49de51
mov eax, dword [esp + 0x30]
mov dword [esp + 0xc], 0
mov dword [esp + 8], ebp
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
sub esp, 0x10
test eax, eax
je 0x49de49
lea eax, [esp + 0x38]
mov dword [esp + 0x10], 0
mov dword [esp + 4], 4
mov edi, dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x34]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call edi
sub esp, 0x14
test eax, eax
je 0x49de49
cmp ebx, dword [esp + 0x34]
jb 0x49de49
lea eax, [esp + 0x3c]
mov dword [esp + 0x10], 0
mov dword [esp + 8], esi
mov dword [esp + 4], 2
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call edi
sub esp, 0x14
jmp 0x49de49