joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438190
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
add ecx, 4
push ecx
mov ecx, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
ret 0x14

Function at 0x4381c0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x104
mov eax, dword [0x5fe940]
mov edx, dword [esp + 0x108]
add ecx, 4
push ecx
mov ecx, dword [esp + 0x110]
push 0x100
mov dword [esp + 0x108], eax
lea eax, [esp + 8]
push eax
push 0x5b5931
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x438214
mov ecx, dword [esp + 0x100]
call fcn.005900c7
add esp, 0x104
ret 0xc
lea eax, [esp]
push eax
call fcn.00590c69
mov ecx, dword [esp + 0x114]
mov dword [ecx], eax
mov ecx, dword [esp + 0x104]
add esp, 4
mov eax, 1
call fcn.005900c7
add esp, 0x104
ret 0xc

Function at 0x44dd40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10c
mov eax, dword [0x5fe940]
push ebx
push esi
mov edx, ecx
push edi
mov ecx, 0x40
mov esi, edx
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x114], eax
lea eax, [esp + 0x11]
lea ecx, [edx + 0x101]
mov esi, 0x40
lea esp, [esp]
mov dl, byte [ecx - 1]
mov bl, byte [eax - 1]
xor bl, dl
mov dl, byte [ecx]
mov byte [eax - 1], bl
mov bl, byte [eax]
xor bl, dl
mov dl, byte [ecx + 1]
mov byte [eax], bl
mov bl, byte [eax + 1]
xor bl, dl
mov dl, byte [ecx + 2]
mov byte [eax + 1], bl
xor byte [eax + 2], dl
add ecx, 4
add eax, 4
dec esi
jne 0x44dd80
mov esi, dword [ebp + 8]
lea eax, [esp + 0x10]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x44ddef
test cl, cl
je 0x44ddd8
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x44ddef
add eax, 2
add esi, 2
test cl, cl
jne 0x44ddb4
xor eax, eax
mov ecx, dword [esp + 0x114]
call fcn.005900c7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esp + 0x114]
sbb eax, eax
sbb eax, 0xffffffff
call fcn.005900c7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x455dc0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x104
mov eax, dword [0x5fe940]
push ebx
push esi
push edi
mov esi, ecx
push 0x28
mov ecx, 0x8b1138
mov dword [esp + 0x110], eax
call fcn.00413730
mov edx, dword [esi + 4]
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
add ebx, edx
call edi
cmp ebx, eax
jb 0x455eab
call edi
mov esi, dword [esi + 4]
push 0x28
mov ecx, 0x8b1138
sub esi, eax
call fcn.00413730
mov ecx, dword [0x60d19c]
add esi, eax
mov eax, 0x10624dd3
mul esi
shr edx, 6
push edx
push 0xc4
call fcn.004fef50
push eax
lea eax, [esp + 0x14]
push eax
call fcn.0059000d
add esp, 0xc
push 0xff
push 0xff
push 0xff
push 0
mov ecx, 0x81d780
call fcn.00430450
mov ecx, 0x81d780
push eax
push 0
push 0
push 0
push 0
call fcn.00430450
mov ecx, 0x7cf7d8
push eax
call fcn.00509e10
push 0xffffffffffffffff
push 0xff
push 0xff
push 0xff
push 0xff
mov ecx, 0x81d780
call fcn.00430450
movzx ecx, ax
push ecx
lea edx, [esp + 0x14]
push edx
push 5
push 0x26c
mov ecx, 0x7cf7d8
call fcn.0050c1f0
mov ecx, dword [esp + 0x10c]
pop edi
pop esi
pop ebx
call fcn.005900c7
add esp, 0x104
ret
Function at 0x464a60
Capabilities:
Get common file path

Disassembly:
sub esp, 0x204
mov eax, dword [0x5fe940]
mov dword [esp + 0x200], eax
push esi
lea eax, [esp + 4]
push eax
push 0x200
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push str.equip
call fcn.00436a80
mov ecx, dword [esp + 0x214]
mov edx, dword [0x6508a4]
imul ecx, ecx, 0x4ac
add esp, 4
push 0
push 3
lea eax, [ecx + edx + 0x32c]
push 1
push eax
mov ecx, 0x879bc8
call fcn.0055cf20
mov ecx, dword [esp + 0x20c]
lea edx, [esp + 4]
push edx
mov dword [esi + ecx*4 + 0x44d8], eax
call fcn.00436a80
mov ecx, dword [esp + 0x208]
add esp, 4
pop esi
call fcn.005900c7
add esp, 0x204
ret 8
Function at 0x4655b0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x21c
mov eax, dword [0x5fe940]
push ebx
push ebp
push esi
mov ebp, ecx
push edi
lea edi, [ebp + 0x44d8]
mov dword [esp + 0x228], eax
mov esi, edi
mov ebx, 0xf
mov eax, dword [esi]
test eax, eax
je 0x4655ec
push eax
mov ecx, 0x879bc8
call fcn.0055c7f0
mov dword [esi], 0
add esi, 4
dec ebx
jne 0x4655d5
lea eax, [esp + 0x28]
push eax
push 0x200
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push str.equip
call fcn.00436a80
add esp, 4
xor esi, esi
mov eax, dword [ebp + 0x4194]
mov cl, byte [eax + esi + 0xc]
mov dl, byte [eax + esi + 4]
xor dl, cl
add eax, esi
mov byte [esp + 0x14], dl
mov dl, byte [eax + 5]
xor dl, cl
mov byte [esp + 0x15], dl
mov dl, byte [eax + 6]
xor dl, cl
mov byte [esp + 0x16], dl
mov dl, byte [eax + 7]
xor dl, cl
mov cl, byte [eax + 0xd]
mov byte [esp + 0x17], dl
mov dl, byte [eax + 8]
xor dl, cl
mov byte [esp + 0x24], dl
mov dl, byte [eax + 9]
xor dl, cl
mov byte [esp + 0x25], dl
mov dl, byte [eax + 0xa]
xor dl, cl
mov byte [esp + 0x26], dl
mov dl, byte [eax + 0xb]
xor dl, cl
mov ecx, dword [esp + 0x14]
mov byte [esp + 0x27], dl
cmp ecx, dword [esp + 0x24]
je 0x46567d
mov dword [0], 1
mov cl, byte [eax + 0xc]
mov dl, byte [eax + 4]
xor dl, cl
mov byte [esp + 0x1c], dl
mov dl, byte [eax + 5]
xor dl, cl
mov byte [esp + 0x1d], dl
mov dl, byte [eax + 6]
mov al, byte [eax + 7]
xor al, cl
xor dl, cl
mov byte [esp + 0x1e], dl
mov byte [esp + 0x1f], al
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x46576d
mov eax, dword [ebp + 0x4194]
mov cl, byte [eax + esi + 0xc]
mov dl, byte [eax + esi + 4]
xor dl, cl
add eax, esi
mov byte [esp + 0x10], dl
mov dl, byte [eax + 5]
xor dl, cl
mov byte [esp + 0x11], dl
mov dl, byte [eax + 6]
xor dl, cl
mov byte [esp + 0x12], dl
mov dl, byte [eax + 7]
xor dl, cl
mov cl, byte [eax + 0xd]
mov byte [esp + 0x13], dl
mov dl, byte [eax + 8]
xor dl, cl
mov byte [esp + 0x18], dl
mov dl, byte [eax + 9]
xor dl, cl
mov byte [esp + 0x19], dl
mov dl, byte [eax + 0xa]
xor dl, cl
mov byte [esp + 0x1a], dl
mov dl, byte [eax + 0xb]
xor dl, cl
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x1b], dl
cmp ecx, dword [esp + 0x18]
je 0x46571c
mov dword [0], 1
mov cl, byte [eax + 0xc]
mov dl, byte [eax + 4]
xor dl, cl
mov byte [esp + 0x20], dl
mov dl, byte [eax + 5]
xor dl, cl
mov byte [esp + 0x21], dl
mov dl, byte [eax + 6]
mov al, byte [eax + 7]
xor dl, cl
xor al, cl
mov byte [esp + 0x22], dl
mov edx, dword [0x6508a4]
mov byte [esp + 0x23], al
mov ecx, dword [esp + 0x20]
imul ecx, ecx, 0x4ac
push 0
push 3
lea eax, [ecx + edx + 0x32c]
push 1
push eax
mov ecx, 0x879bc8
call fcn.0055cf20
mov dword [edi], eax
add esi, 0x110
add edi, 4
cmp esi, 0xff0
jl 0x465611
lea ecx, [esp + 0x28]
push ecx
call fcn.00436a80
mov ecx, dword [esp + 0x22c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
call fcn.005900c7
add esp, 0x21c
ret
Function at 0x4661c0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x204
mov eax, dword [0x5fe940]
push esi
mov dword [esp + 0x204], eax
push edi
mov edi, ecx
xor esi, esi
mov eax, 0x67afe8
lea ecx, [ecx]
cmp dword [eax], 0
je 0x4661f0
add eax, 0xc
inc esi
cmp eax, 0x67b018
jl 0x4661e0
cmp esi, 4
je 0x466297
push ebx
mov ebx, dword [esp + 0x214]
lea eax, [esi + esi*2]
mov dword [eax*4 + 0x67afe8], ebx
mov eax, dword [edi + esi*4 + 0x44c8]
test eax, eax
je 0x46622c
push eax
mov ecx, 0x879bc8
call fcn.0055c7f0
mov dword [edi + esi*4 + 0x44c8], 0
lea ecx, [esp + 0xc]
push ecx
push 0x200
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0x5c0ea8
call fcn.00436a80
add esp, 4
push ebx
mov ecx, 0x7099d8
call fcn.004cf230
imul eax, eax, 0x29c
push 0
push 3
push 1
add eax, 0x709af8
push eax
mov ecx, 0x879bc8
call fcn.0055cf20
lea edx, [esp + 0xc]
push edx
mov dword [edi + esi*4 + 0x44c8], eax
call fcn.00436a80
mov eax, dword [0x817200]
add esp, 4
push 0
push eax
mov ecx, 0x85ea80
call fcn.00548830
pop ebx
mov ecx, dword [esp + 0x208]
pop edi
pop esi
call fcn.005900c7
add esp, 0x204
ret 4
Function at 0x473b60
Capabilities:
Get common file path

Disassembly:
sub esp, 0x204
mov eax, dword [0x5fe940]
push esi
mov esi, ecx
mov ecx, dword [str.dialog_minishop]
mov dword [esp + 0x204], eax
push edi
lea eax, [esi + 0x1f0]
mov dword [eax], ecx
mov edx, dword [0x5b567c]
mov dword [eax + 4], edx
mov ecx, dword [0x5b5680]
push 0x5c
push str..DXDialog_MiniShop.cpp
mov dword [eax + 8], ecx
mov edx, dword [0x5b5684]
push str.CDXDialog_MiniShop::setBackImage
push str.._new_frame_minishop_back.i16
mov ecx, 0x858120
mov dword [eax + 0xc], edx
call fcn.004348b0
push 0
push str.._new_frame_minishop_back.i16
mov ecx, 0x858120
call fcn.00434680
push 1
push 4
push 0xc430
push 0x1d9
push 0x1f2
push 0xc430
push esi
mov dword [esi + 0x610], eax
mov dword [esi + 0x624], 0xe3
mov dword [esi + 0x628], 0x1ce
call fcn.00401c50
push 1
push 4
push 0xc42c
push 0x1ff
push 0x1f2
push 0xc42c
push esi
call fcn.00401c50
add esp, 0x38
lea eax, [esp + 8]
push eax
push 0x200
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0x5c0ea8
call fcn.00436a80
add esp, 4
mov edi, 0x67b018
add esi, 0x614
lea esp, [esp]
mov eax, dword [edi]
push eax
mov ecx, 0x7099d8
call fcn.004cf230
imul eax, eax, 0x29c
push 0
push 3
push 1
add eax, 0x709af8
push eax
mov ecx, 0x879bc8
mov dword [esi], 0
call fcn.0055cf20
mov dword [esi], eax
add edi, 0xc
add esi, 4
cmp edi, 0x67b048
jl 0x473c50
lea ecx, [esp + 8]
push ecx
call fcn.00436a80
mov ecx, dword [esp + 0x20c]
add esp, 4
pop edi
pop esi
call fcn.005900c7
add esp, 0x204
ret
Function at 0x490c90
Capabilities:
Resume thread

Disassembly:
mov eax, dword [ecx + 4]
test eax, eax
je 0x490c9e
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
ret
Function at 0x49d270
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5adb4b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov edi, dword [esp + 0x1c]
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00498e50
mov dword [esp + 0x14], 0
lea eax, [edi + 0x10]
push eax
lea ecx, [esi + 0x10]
call fcn.00498e50
mov byte [esp + 0x14], 1
lea ecx, [edi + 0x20]
push ecx
lea ecx, [esi + 0x20]
call fcn.00498e50
mov byte [esp + 0x14], 2
lea edx, [edi + 0x30]
push edx
lea ecx, [esi + 0x30]
call fcn.00498e50
mov byte [esp + 0x14], 3
lea eax, [edi + 0x40]
push eax
lea ecx, [esi + 0x40]
call fcn.00498e50
mov byte [esp + 0x14], 4
lea ecx, [edi + 0x50]
push ecx
lea ecx, [esi + 0x50]
call fcn.00498e50
mov byte [esp + 0x14], 5
lea edx, [edi + 0x60]
push edx
lea ecx, [esi + 0x60]
call fcn.00498e50
mov byte [esp + 0x14], 6
lea eax, [edi + 0x70]
push eax
lea ecx, [esi + 0x70]
call fcn.00498e50
mov byte [esp + 0x14], 7
lea ecx, [edi + 0x80]
push ecx
lea ecx, [esi + 0x80]
call fcn.00498e50
mov byte [esp + 0x14], 8
lea edx, [edi + 0x90]
push edx
lea ecx, [esi + 0x90]
call fcn.00498e50
mov byte [esp + 0x14], 9
lea eax, [edi + 0xa0]
push eax
lea ecx, [esi + 0xa0]
call fcn.00498e50
mov byte [esp + 0x14], 0xa
lea ecx, [edi + 0xb0]
push ecx
lea ecx, [esi + 0xb0]
call fcn.00498e50
mov byte [esp + 0x14], 0xb
add edi, 0xc0
push edi
lea ecx, [esi + 0xc0]
call fcn.00498e50
mov dword [esp + 0x14], 0xffffffff
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x4ad3e0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c8d90
push 0x590d20
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x28], edi
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov ebx, dword [edi + 0x1c]
mov byte [ebp - 0x19], al
mov byte [ebp - 0x1a], al
mov dword [ebp - 4], eax
mov esi, dword [edi + 0x40]
mov dword [ebp - 0x20], esi
cmp esi, eax
jne 0x4ad430
mov byte [ebp - 0x19], 1
jmp 0x4ad51b
mov ecx, esi
call fcn.004ad0d0
push 0
push esi
push 0
lea eax, [ebp - 0x24]
push eax
push 1
lea ecx, [esi + 0x1028]
push ecx
push ebx
call dword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
jne 0x4ad469
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x2c], eax
cmp eax, 0x3e5
jne 0x4ad517
mov edx, dword [esi + 4]
add dword [esi + 0x18], edx
mov dword [esi + 4], 0
mov ecx, esi
call fcn.004ad100
test al, al
je 0x4ad430
mov eax, dword [0x60d160]
test eax, eax
je 0x4ad4c9
mov al, byte [0x6a3088]
test al, al
je 0x4ad4c9
mov dword [ebp - 0x30], 0x6213dc
mov eax, dword [0x6213e8]
push eax
mov ecx, dword [0x6213e4]
push ecx
mov edx, dword [0x6213e0]
push edx
mov eax, dword [0x6213dc]
push eax
push 0
mov ecx, 0x6feaf8
call fcn.004aa640
mov byte [0x6a3088], 0
jmp 0x4ad50c
mov al, byte [edi + 0xe4]
test al, al
je 0x4ad504
mov ecx, dword [edi + 0xe0]
push ecx
mov edx, dword [edi + 0xdc]
push edx
mov eax, dword [edi + 0xd8]
push eax
mov ecx, dword [edi + 0xd4]
push ecx
push 0
mov ecx, 0x6febf0
call fcn.004aa640
mov byte [edi + 0xe4], 0
jmp 0x4ad50c
lea ecx, [edi + 4]
call fcn.004ad9e0
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 0xc]
mov byte [ebp - 0x19], 1
mov byte [ebp - 0x1a], 1
mov dword [ebp - 4], 0xffffffff
call fcn.004ad541
mov al, byte [ebp - 0x19]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ad570
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c8da0
push 0x590d20
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x2c], edi
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1a], al
mov byte [ebp - 0x19], al
mov dword [ebp - 4], eax
mov ebx, dword [edi + 0x1c]
mov dword [ebp - 0x30], ebx
mov esi, dword [edi + 0x44]
mov dword [ebp - 0x20], esi
cmp esi, eax
jne 0x4ad5ea
mov ecx, 0x8e95d8
call fcn.004a9b50
mov esi, eax
mov dword [ebp - 0x20], esi
test esi, esi
je 0x4ad69d
mov ecx, esi
call fcn.004a9870
mov dword [esi + 0x14], 0x10
push esi
lea ecx, [edi + 4]
call fcn.004ad1d0
mov ecx, esi
call fcn.004ad0d0
push 0
push esi
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x28]
push ecx
push 1
lea edx, [esi + 0x1028]
push edx
push ebx
call dword [sym.imp.WS2_32.dll_WSARecv]
cmp eax, 0xffffffff
jne 0x4ad621
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x34], eax
cmp eax, 0x3e5
jne 0x4ad670
mov eax, dword [esi + 4]
add dword [esi + 0x18], eax
mov dword [esi + 4], 0
mov al, byte [esi + 0x1020]
mov byte [ebp - 0x1b], al
test al, al
jne 0x4ad656
push esi
lea ecx, [edi + 4]
call fcn.004addb0
test al, al
je 0x4ad670
mov eax, dword [edi + 0x28]
mov dword [ebp - 0x38], eax
push eax
mov ecx, esi
call fcn.004ad150
mov ecx, esi
call fcn.004ad100
test al, al
je 0x4ad699
lea ebx, [edi + 4]
push esi
mov ecx, ebx
call fcn.004ade90
test al, al
jne 0x4ad676
mov byte [ebp - 0x19], 1
jmp 0x4ad69d
mov ecx, ebx
call fcn.004ad9b0
push 0
lea eax, [edi + 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push esi
lea ecx, [edi + 0x50]
call fcn.004abe10
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 8]
mov byte [ebp - 0x1a], 1
mov dword [ebp - 4], 0xffffffff
call fcn.004ad6c3
mov al, byte [ebp - 0x1a]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4ada40
Capabilities:
Connect socket

Disassembly:
mov edx, dword [esp + 8]
xor eax, eax
push esi
mov esi, ecx
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
push edx
mov word [esi], 2
call dword [sym.imp.WS2_32.dll_htons]
mov word [esi + 2], ax
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, dword [esi + 0x18]
push 0
push 0
push 0
push 0
push 0x10
push esi
push ecx
mov dword [esi + 4], eax
call dword [sym.imp.WS2_32.dll_WSAConnect]
cmp eax, 0xffffffff
pop esi
jne 0x4ada9f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x4ada9f
xor al, al
ret 8
mov al, 1
ret 8
Function at 0x4ae070
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5ae037
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi + 0x18], edi
xor eax, eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
xor ecx, ecx
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], ecx
lea ecx, [esi + 0x48]
mov dword [esp + 8], esi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
call fcn.004ac400
mov dword [esp + 0x18], edi
lea eax, [esi + 0x4c]
mov dword [esp + 0xc], eax
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], edi
mov dword [eax + 0x24], edi
mov dword [eax + 0x28], edi
mov byte [esp + 0x18], 2
lea eax, [esi + 0x78]
mov dword [esp + 0xc], eax
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], edi
mov dword [eax + 0x24], edi
mov dword [eax + 0x28], edi
mov byte [esp + 0x18], 4
xor edx, edx
lea eax, [esi + 0x10]
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [esp + 0x18], 0xffffffff
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x4ae1d0
Capabilities:
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c8e58
push 0x590d20
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18c
mov eax, dword [0x5fe940]
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x19c], esi
xor bl, bl
mov byte [ebp - 0x191], bl
mov dword [ebp - 4], 0
lea edi, [esi + 0x48]
push 0
push str.Microsoft_Base_Cryptographic_Provider_v1.0
push str._KEY_LOCAL_F700_
push 1
mov ecx, edi
call fcn.004ac410
mov dword [ebp - 0x198], eax
test eax, eax
jge 0x4ae25a
push 8
push str.Microsoft_Base_Cryptographic_Provider_v1.0
push str._KEY_LOCAL_F700_
push 1
mov ecx, edi
call fcn.004ac430
mov dword [ebp - 0x198], eax
test eax, eax
jl 0x4ae2dc
lea ecx, [esi + 0x4c]
call fcn.004ace80
lea ecx, [esi + 0x78]
call fcn.004ace80
lea eax, [ebp - 0x190]
push eax
mov ecx, 0x60d1c8
call fcn.004144d0
push 1
push 0
test al, al
je 0x4ae28c
lea ecx, [ebp - 0x190]
push ecx
jmp 0x4ae28e
push 0
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_WSASocketA]
mov dword [esi + 0x18], eax
cmp eax, 0xffffffff
je 0x4ae2dc
push 0
push 0
push 0
push 0
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventA]
call edi
mov dword [esi + 0x10], eax
push 0
push 0
push 0
push 0
call edi
mov dword [esi + 0x14], eax
push 0x33
push eax
mov edx, dword [esi + 0x18]
push edx
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
je 0x4ae2dc
mov bl, 1
mov byte [ebp - 0x191], bl
mov dword [ebp - 4], 0xffffffff
call fcn.004ae30f
mov al, bl
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x1c]
call fcn.005900c7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4afd40
Capabilities:
Create thread
Terminate thread

Disassembly:
push esi
mov esi, ecx
push 0x5c9054
mov byte [esi + 0xc], 0
call fcn.00412660
mov eax, dword [esi + 4]
add esp, 4
test eax, eax
je 0x4afd6e
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x5c9038
mov dword [esi + 4], 0
call fcn.00412660
add esp, 4
push str.WriteEvent
push 1
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0x5c9018
mov dword [0xaeb70c], eax
call fcn.00412660
add esp, 4
push 0xaeb708
push 0
push esi
push 0x4afc70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esi + 8]
push ecx
push 0x5c8f60
mov dword [esi + 4], eax
call fcn.00412660
mov edx, dword [0xaeb70c]
add esp, 8
push 0x1388
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x5c9000
call fcn.00412660
add esp, 4
pop esi
ret
Function at 0x4b7730
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
push esi
mov esi, ecx
mov ecx, dword [esi + 0x240]
test ecx, ecx
je 0x4b78cc
mov eax, dword [esi + 0x218]
shl eax, 6
mov edx, dword [eax + esi + 8]
add eax, esi
push ebx
mov ebx, dword [eax + 0xc]
mov eax, ebx
neg eax
sbb eax, eax
and eax, 2
lea edx, [eax + edx*4 + 0x9d07]
mov eax, ecx
dec eax
push ebp
push edi
mov dword [esp + 0x10], edx
je 0x4b7829
dec eax
je 0x4b77e1
dec eax
jne 0x4b788d
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
mov edx, dword [esi + 0x244]
mov edi, eax
sub edi, edx
push 0x11
imul edi, edi, 0x82
mov ecx, 0x8b1138
call fcn.00413730
mov ecx, eax
mov eax, edi
xor edx, edx
div ecx
mov edi, eax
cmp edi, 0x82
jl 0x4b77cb
mov edi, 0x82
mov dword [esi + 0x240], 0
call ebp
mov dword [esi + 0x244], eax
test ebx, ebx
jne 0x4b77d6
neg edi
jmp 0x4b7891
add edi, 0x29e
jmp 0x4b7891
mov edi, ebx
neg edi
sbb edi, edi
push 0x12
mov ecx, 0x8b1138
and edi, 0x29e
call fcn.00413730
mov edx, dword [esi + 0x244]
mov ebp, eax
add ebp, edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, ebp
jb 0x4b7891
mov dword [esi + 0x240], 3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x244], eax
jmp 0x4b7891
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
mov edx, dword [esi + 0x244]
mov edi, eax
sub edi, edx
push 0x11
imul edi, edi, 0x82
mov ecx, 0x8b1138
call fcn.00413730
mov ecx, eax
mov eax, edi
xor edx, edx
div ecx
mov edi, eax
cmp edi, 0x82
jl 0x4b7876
mov edi, 0x82
mov dword [esi + 0x240], 2
call ebp
mov dword [esi + 0x244], eax
test ebx, ebx
jne 0x4b7882
sub edi, 0x82
jmp 0x4b7891
mov edx, 0x320
sub edx, edi
mov edi, edx
jmp 0x4b7891
mov edi, dword [esp + 0x10]
mov ebp, dword [esi + 0x248]
mov edx, dword [esp + 0x10]
inc ebp
neg ebx
sbb ebx, ebx
xor eax, eax
mov dword [esi + 0x248], ebp
mov al, byte [esi + 0x248]
and ebx, 0xfffffff9
add ebx, 0x18c
push ebx
push edi
mov ecx, 0x858130
and eax, 1
add eax, edx
push eax
call fcn.00420530
pop edi
pop ebp
pop ebx
pop esi
pop ecx
ret
Function at 0x4b78d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x254]
test eax, eax
je 0x4b79dd
push ebx
push edi
xor edi, edi
dec eax
je 0x4b797c
dec eax
je 0x4b7944
dec eax
jne 0x4b79c9
push 0x13
mov ecx, 0x8b1138
call fcn.00413730
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
call ebx
sub eax, dword [esi + 0x258]
imul eax, eax, 0x8e
xor edx, edx
div edi
mov edi, eax
cmp edi, 0x8e
jl 0x4b793d
mov edi, 0x8e
mov dword [esi + 0x254], 0
call ebx
mov dword [esi + 0x258], eax
neg edi
jmp 0x4b79c9
push ebp
push 0x14
mov ecx, 0x8b1138
call fcn.00413730
mov edx, dword [esi + 0x258]
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebp, eax
add ebp, edx
call ebx
cmp eax, ebp
pop ebp
jb 0x4b79c9
mov dword [esi + 0x254], 3
call ebx
mov dword [esi + 0x258], eax
jmp 0x4b79c9
push 0x13
mov ecx, 0x8b1138
call fcn.00413730
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
call ebx
sub eax, dword [esi + 0x258]
imul eax, eax, 0x8e
xor edx, edx
div edi
mov edi, eax
cmp edi, 0x8e
jl 0x4b79c3
mov edi, 0x8e
mov dword [esi + 0x254], 2
call ebx
mov dword [esi + 0x258], eax
sub edi, 0x8e
push 3
push edi
push 0x9d06
mov ecx, 0x858130
call fcn.00420530
pop edi
pop ebx
pop esi
ret