joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44f2f0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x4c07e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x44f51b
cmp byte [ebx], 0
je 0x44f51b
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp dword [0x4c3100], 0
je 0x44f36e
push 2
call fcn.00471428
add esp, 4
cmp dword [0x4c3100], eax
je 0x44f364
push 1
call fcn.00471428
mov ecx, dword [0x4c3100]
add esp, 4
cmp ecx, eax
je 0x44f364
push ecx
call fcn.0046c799
push dword [0x4c3100]
call fcn.0046c560
add esp, 8
mov dword [0x4c3100], 0
mov edx, ebx
mov byte [ebp - 0x804], 0
lea ecx, [edx + 1]
nop word [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x44f380
sub edx, ecx
cmp edx, 0x7ff
jle 0x44f3a0
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464e2f
mov esp, ebp
pop ebp
ret
push esi
mov esi, ebx
mov al, byte [ebx]
inc ebx
test al, al
jne 0x44f3a3
push edi
lea edi, [ebp - 0x804]
sub ebx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x44f3b4
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, 0x7ff
and ecx, 3
sub ebx, edx
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x804]
add ecx, edx
cmp byte [ebp + 0xc], al
jne 0x44f4d8
cmp ebx, 1
jl 0x44f4f0
mov byte [ecx], 0x5c
dec ebx
inc ecx
mov dword [ebp - 0x808], ecx
mov byte [ecx], al
cmp ebx, 9
jl 0x44f4f0
mov edx, str.Wastelog_
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x44f408
sub edx, esi
lea edi, [ecx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x44f414
mov ecx, edx
sub ebx, 9
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov dword [ebp - 0x80c], ebx
and ecx, 3
mov ebx, 0x4c3d20
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x808]
lea edx, [ebx + 1]
add ecx, 9
mov dword [ebp - 0x808], ecx
nop word [eax + eax]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x44f450
sub ebx, edx
cmp ebx, dword [ebp - 0x80c]
jg 0x44f4f0
mov edx, 0x4c3d20
mov esi, edx
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x44f470
sub edx, esi
lea edi, [ecx - 1]
nop dword [eax]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x44f480
mov eax, dword [ebp - 0x80c]
mov ecx, edx
shr ecx, 2
sub eax, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp eax, 4
jl 0x44f4f0
mov edx, str..log
mov esi, edx
nop word [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x44f4b0
mov edi, dword [ebp - 0x808]
sub edx, esi
dec edi
add edi, ebx
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x44f4c2
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x804]
push 0x4afc40
push eax
call fcn.0046ca05
add esp, 8
test eax, eax
jne 0x44f503
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464e2f
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov dword [0x4c3100], eax
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464e2f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop ebx
call fcn.00464e2f
mov esp, ebp
pop ebp
ret
Function at 0x44f530
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x4c07e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x4c6c88]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x4c6444]
cmp eax, dword [ecx + 4]
jle 0x44f592
push 0x4c6444
call fcn.00464d2b
add esp, 4
cmp dword [0x4c6444], 0xffffffff
jne 0x44f592
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0xea60
push 0x4c6444
mov dword [0x4c6440], eax
call fcn.00464cec
add esp, 4
push 0x7530
push 0x4c6440
call fcn.004510e0
add esp, 8
test eax, eax
jne 0x44f651
call fcn.0044d940
test al, al
jne 0x44f72d
mov eax, dword [0x4c3de0]
cmp eax, 1
jne 0x44f65f
push esi
mov esi, dword [0x4c3de4]
push 0x4c3de8
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x44f5fb
push 0x4c3de8
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x44f5f6
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x44f603
or eax, 0xffffffff
jmp 0x44f603
or ecx, 0xffffffff
test eax, eax
cmove eax, ecx
mov dword [0x4c3de4], eax
cmp esi, eax
je 0x44f650
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov esi, eax
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44f618
sub eax, edx
inc eax
push esi
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.0046b5c5
add esp, 0xc
lea eax, [ebp - 0x44]
lea ecx, [ebp - 0x145]
push eax
push esi
push str.Ip_Mode_force_:_Resolved_new_ip._Old_Ip:__s____New_Ip:__s
push 5
call fcn.00407110
push eax
call fcn.0044f120
add esp, 0x14
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464e2f
mov esp, ebp
pop ebp
ret
cmp eax, 2
jne 0x44f651
push 0x100
lea eax, [ebp - 0x144]
push 0
push eax
call fcn.00466b60
add esp, 0xc
call fcn.004225c0
test eax, eax
je 0x44f6cc
call fcn.004225c0
mov ecx, eax
call fcn.00422580
push eax
lea eax, [ebp - 0x144]
push 0x10
push eax
call fcn.0046b5c5
lea ecx, [ebp - 0x144]
add esp, 0xc
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x44f6b0
sub ecx, edx
jne 0x44f6e2
call fcn.004225c0
mov ecx, eax
call fcn.004225a0
push eax
push 0x10
jmp 0x44f6d3
push str.localhost
push 0xa
lea eax, [ebp - 0x144]
push eax
call fcn.0046b5c5
add esp, 0xc
lea eax, [ebp - 0x144]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x44f70d
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [0x4c3de4], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464e2f
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x144]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [0x4c3de4], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464e2f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov dword [0x4c3de4], 0xffffffff
call fcn.00464e2f
mov esp, ebp
pop ebp
ret
Function at 0x44f750
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1110
call fcn.00465040
mov eax, dword [0x4c07e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [0x4c25e8]
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x1110], eax
lea esi, [ecx + 7]
mov byte [ebp - 0x1104], 0
shr esi, 3
test esi, esi
je 0x44f916
cmp byte [0x4c4e88], 0
mov edx, str.unknown
mov eax, 0x4c4e88
cmove eax, edx
push eax
push ecx
lea eax, [ebp - 0x1104]
push str.WASTE_PUBLIC_KEY_20__d__s_r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [ebp - 0x1104]
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x44f7c0
push ebx
push 1
push 0x1e
lea eax, [ebp - 0x110c]
mov dword [ebp - 0x110c], 0
push eax
mov eax, 0x4c27ec
sub ecx, edx
sub eax, esi
push esi
push eax
lea eax, [ebp - 0x1104]
add eax, ecx
push eax
call fcn.0044d5e0
mov ebx, 0x200
add esp, 0x18
mov ecx, ebx
mov edx, eax
sub ecx, esi
cmp ecx, ebx
jge 0x44f81e
nop dword [eax + eax]
cmp byte [ecx + 0x4c27ec], 0
jne 0x44f81e
inc ecx
cmp ecx, ebx
jl 0x44f810
sub ebx, ecx
push 1
mov eax, ebx
sar eax, 8
mov byte [ebp - 0x1105], al
lea eax, [ebp - 0x110c]
push 0x1e
push eax
push 1
lea eax, [ebp - 0x1105]
push eax
push edx
call fcn.0044d5e0
push 1
push 0x1e
lea ecx, [ebp - 0x110c]
mov byte [ebp - 0x1105], bl
push ecx
push 1
lea ecx, [ebp - 0x1105]
push ecx
push eax
call fcn.0044d5e0
push 1
push 0x1e
lea ecx, [ebp - 0x110c]
push ecx
mov ecx, 0x4c29ec
push ebx
sub ecx, ebx
push ecx
push eax
call fcn.0044d5e0
add esp, 0x48
push str._r_nWASTE_PUBLIC_KEY_END_r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
lea ecx, [ebp - 0x1104]
lea edx, [ecx + 1]
pop ebx
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x44f8a0
sub ecx, edx
push edi
lea eax, [ecx + 1]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
lea ecx, [ebp - 0x1104]
mov edx, eax
lea edi, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x44f8d0
sub ecx, edi
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x1104]
push eax
push edx
call fcn.00466cc0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp - 0x1110]
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00464e2f
mov esp, ebp
pop ebp
ret
Function at 0x450cf0
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4c07e0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x214]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x450d3a
push 0x80
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
jne 0x450d4b
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464e2f
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x450d34
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
movzx eax, byte [ecx + 3]
push eax
movzx eax, byte [ecx + 2]
push eax
movzx eax, byte [ecx + 1]
push eax
movzx eax, byte [ecx]
push eax
push str._d._d._d._d
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [ebp - 4]
add esp, 0x18
xor ecx, ebp
mov al, 1
pop esi
call fcn.00464e2f
mov esp, ebp
pop ebp
ret

Function at 0x450ea0
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x4c07e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x404]
push esi
push 0x400
push 0
push eax
call fcn.00466b60
push 0x4c3520
lea eax, [ebp - 0x404]
push str._s.pr0
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
lea eax, [ebp - 0x404]
push 0
push 7
push 3
push 0
push 1
push accept
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x450f1d
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464e2f
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x450fc1
push edi
lea eax, [ebp - 0x408]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push eax
mov dword [ebp - 0x408], eax
call fcn.0046b4f9
add esp, 4
mov edi, eax
lea eax, [ebp - 0x408]
push 0
push eax
push dword [ebp - 0x408]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x450fb7
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push dword [ebp - 0x408]
push edi
call fcn.00450fe0
add esp, 0xc
mov ebx, eax
lea eax, [ebp - 0x404]
push 0
push 0x80
push 2
push 0
push 1
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
test esi, esi
je 0x450fb7
push 0
lea eax, [ebp - 0x408]
push eax
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.0046b4f4
add esp, 4
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.00464e2f
mov esp, ebp
pop ebp
ret

Function at 0x4510c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4510dc
test al, 0x10
jne 0x4510dc
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4511c0
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
je 0x4511ea
mov ecx, dword [0x4c3114]
call fcn.00407330
test eax, eax
jle 0x4511ea
mov eax, 1
jmp 0x4511ec
xor eax, eax
cmp dword [0x4c0330], 0
jne 0x451209
test eax, eax
je 0x45120d
mov dword [0x4c0330], 1
mov al, 1
mov esp, ebp
pop ebp
ret
test eax, eax
jne 0x451217
mov dword [0x4c0330], 0
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x451ca0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov ebx, ecx
mov ecx, 0xe3
push esi
push edi
lea edi, [ebx + 0x9c4]
mov edx, dword [edi + 4]
lea edi, [edi + 4]
xor edx, dword [edi - 4]
and edx, 0x7fffffff
xor edx, dword [edi - 4]
mov eax, edx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr edx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x630]
xor eax, edx
mov dword [edi - 0x9c4], eax
sub ecx, 1
jne 0x451cb0
lea esi, [ebx + 0xd50]
mov edi, 0x18c
mov ecx, dword [esi]
lea esi, [esi + 4]
xor ecx, dword [esi]
and ecx, 0x7fffffff
xor ecx, dword [esi - 4]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi - 0xd50]
xor eax, ecx
mov dword [esi - 0x9c4], eax
sub edi, 1
jne 0x451cf2
mov ecx, dword [ebx + 0x1380]
xor ecx, dword [ebx + 4]
and ecx, 0x7fffffff
xor ecx, dword [ebx + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx + 0x9c0], eax
mov dword [ebx], edi
pop edi
pop esi
pop ebx
ret

Function at 0x451d70
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
lea eax, [ecx + 8]
mov esi, 0x270
nop dword [eax]
mov edx, dword [eax - 4]
lea eax, [eax + 4]
xor edx, dword [eax - 4]
and edx, 0x7fffffff
xor edx, dword [eax - 8]
mov ecx, edx
and cl, 1
movzx ecx, cl
neg ecx
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [eax + 0x62c]
xor ecx, edx
mov dword [eax + 0x9b8], ecx
sub esi, 1
jne 0x451d80
pop esi
ret

Function at 0x452570
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, 1
push ebx
mov ebx, ecx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebx + 4], edx
lea esi, [ebx + 8]
nop dword [eax]
mov ecx, edx
lea esi, [esi + 4]
shr ecx, 0x1e
xor edx, ecx
imul edx, edi
add edx, eax
inc eax
mov dword [esi - 4], edx
cmp eax, 0x270
jl 0x452590
pop edi
pop esi
mov dword [ebx], 0x270
pop ebx
pop ebp
ret 8
Function at 0x454aa0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48deef
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x4c07e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
call fcn.00457410
push eax
mov ecx, 0x4c6454
call fcn.00407260
mov ecx, edi
call fcn.004573c0
push eax
mov ecx, 0x4c6498
call fcn.004576a0
cmp byte [edi + 0x52b], 0
je 0x454af9
mov ecx, edi
call fcn.00455270
cmp dword [edi + 0xb30], 0
jne 0x454b71
cmp dword [edi + 0xb34], 0
jne 0x454b71
lea ebx, [edi + 0x72c]
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x454b16
sub ecx, edx
cmp dword [edi + 0xbec], ecx
jge 0x454b71
mov ecx, ebx
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x454b30
sub ecx, edx
lea esi, [ecx + ebx]
nop dword [eax]
mov eax, dword [edi + 0xbec]
lea ecx, [eax + ebx]
cmp esi, ecx
jbe 0x454b71
nop dword [eax]
mov al, byte [esi]
cmp al, 0x2f
je 0x454b5f
cmp al, 0x5c
je 0x454b5f
dec esi
cmp esi, ecx
ja 0x454b50
cmp esi, ecx
jbe 0x454b71
push ebx
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x454b40
mov ecx, dword [edi + 0x1448]
test ecx, ecx
je 0x454b82
push 1
call fcn.0041d670
lea ecx, [edi + 0xc54]
call fcn.004604d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4554e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push edi
mov edi, ecx
mov eax, dword [edi + 0xc40]
test eax, eax
jne 0x45577d
cmp dword [edi + 0xb8c], eax
ja 0x455504
call fcn.00455870
push 0
call fcn.00457a70
add esp, 4
sub eax, dword [edi + 0xb40]
sbb edx, dword [edi + 0xb44]
mov dword [ebp - 0x10], edx
js 0x4555f0
jg 0x45552e
cmp eax, 5
jbe 0x4555f0
cmp dword [edi + 0xc38], 3
jb 0x4555a0
push 0x490cb9
push 1
push 0
mov ecx, edi
call fcn.00456f10
push 1
push str.Timed_Out
mov ecx, edi
mov byte [edi + 0x50a], 1
call fcn.004562f0
push str.Timed_Out
lea eax, [edi + 0x72c]
push eax
push str.File_Recv:__s:__s
push 5
lea ecx, [ebp - 1]
call fcn.00407110
push eax
call fcn.0044f120
add esp, 0x14
mov dword [edi + 0xc38], 0
mov dword [edi + 0xc40], 1
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret 4
push esi
push 0
call fcn.00457a70
add esp, 4
mov dword [edi + 0xb40], eax
mov dword [edi + 0xb44], edx
mov ecx, edi
push dword [0x4c3114]
call fcn.00457000
inc dword [edi + 0xc38]
lea esi, [edi + 0xb4c]
push dword [edi + 0xc38]
push str.Retrying__d_3
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov ecx, edi
push 1
push esi
call fcn.004562f0
pop esi
cmp dword [edi + 0xb98], 0xffffffff
je 0x455734
push 0
call fcn.00457a70
add esp, 4
cmp edx, dword [edi + 0xc4c]
jl 0x455734
jg 0x455621
cmp eax, dword [edi + 0xc48]
jbe 0x455734
push 0
call fcn.00457a70
add esp, 4
add eax, 0x78
mov dword [edi + 0xc48], eax
adc edx, 0
mov dword [edi + 0xc4c], edx
push 0
push 0
push 0
push dword [edi + 0xb98]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 0xfffffefe
push eax
push 4
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], 0x101
push eax
push dword [edi + 0xb98]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
push dword [edi + 0xb98]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 8]
push eax
push 4
lea eax, [edi + 0xc2c]
push eax
push dword [edi + 0xb98]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 8]
push eax
push 4
lea eax, [edi + 0xc30]
push eax
push dword [edi + 0xb98]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 8]
push eax
push 0x14
lea eax, [edi + 0xbfc]
push eax
push dword [edi + 0xb98]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [edi + 0xbf8]
test ecx, ecx
je 0x455708
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [edi + 0xc10]
add eax, 7
shr eax, 3
push eax
push ecx
push dword [edi + 0xb98]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [edi + 0x1448]
lea eax, [ebp - 8]
push 0
push eax
push 3
call fcn.00430260
push eax
push dword [edi + 0xb98]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [edi + 0xb98]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov ecx, edi
call fcn.004559b0
test al, al
je 0x455771
mov dword [edi + 0xc40], 2
mov ecx, edi
push dword [0x4c3114]
call fcn.004570d0
push 1
push str.Completed
mov ecx, edi
call fcn.004562f0
mov eax, dword [edi + 0xc40]
pop edi
mov esp, ebp
pop ebp
ret 4
mov dword [edi + 0xc40], 0
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x455790
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x1450]
test ecx, ecx
je 0x4557ab
cmp eax, ecx
jb 0x45586a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0x7d0
mov dword [esi + 0x1450], eax
mov eax, dword [esi + 0xbbc]
movd xmm2, eax
cvtdq2pd xmm2, xmm2
shr eax, 0x1f
addsd xmm2, qword [eax*8 + 0x4b01c0]
mov eax, dword [esi + 0xc50]
shl eax, 0xe
movd xmm1, eax
cvtdq2pd xmm1, xmm1
movaps xmm0, xmm1
mulsd xmm0, qword [0x4b01b0]
comisd xmm2, xmm0
jbe 0x45582b
push 0x64
push 0x64
push 0xa
call dword [sym.imp.KERNEL32.dll_MulDiv]
add dword [esi + 0xc50], eax
cmp dword [esi + 0xc50], 0x64
jl 0x45585e
mov eax, dword [esi + 0xbbc]
mov dword [esi + 0xc50], 0x64
mov dword [esi + 0x144c], eax
pop esi
ret
mulsd xmm1, qword [0x4b01a8]
comisd xmm1, xmm2
jbe 0x45586a
push 0x64
push 0x64
push 1
call dword [sym.imp.KERNEL32.dll_MulDiv]
sub dword [esi + 0xc50], eax
cmp dword [esi + 0xc50], 1
jg 0x45585e
mov dword [esi + 0xc50], 1
mov eax, dword [esi + 0xbbc]
mov dword [esi + 0x144c], eax
pop esi
ret
Function at 0x4559b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4190
call fcn.00465040
mov eax, dword [0x4c07e0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov eax, dword [esi + 0xc10]
cmp eax, 1
jne 0x4559dd
cmp dword [esi + 0xc18], eax
je 0x4559f6
cmp dword [esi + 0xc18], eax
jae 0x4559f6
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464e2f
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x4c3118]
xorps xmm0, xmm0
push 0
push str.shafiles
mov byte [ebp - 0x2c], 0
movups xmmword [ebp - 0x2b], xmm0
mov word [ebp - 0x1b], 0
mov byte [ebp - 0x19], 0
mov byte [ebp - 0x18], 0
movups xmmword [ebp - 0x17], xmm0
mov word [ebp - 7], 0
mov byte [ebp - 5], 0
call fcn.004038d0
test eax, eax
je 0x455a5c
push 1
push str.Completed
mov ecx, esi
mov dword [esi + 0xc40], 2
call fcn.004562f0
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464e2f
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x4c3118]
push ebx
push edi
push 0x20
push str.maxsizesha
call fcn.004038d0
shl eax, 0x14
cmp dword [esi + 0xb30], eax
jae 0x455aa1
lea edi, [esi + 0xbfc]
mov ebx, 0x10
lea ecx, [ebp - 0x2c]
mov edx, edi
nop dword [eax + eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x455ab4
add ecx, 4
add edx, 4
sub ebx, 4
jae 0x455a90
pop edi
pop ebx
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464e2f
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0xb30], 0
je 0x455aa1
push 1
push str.Checking__SHA1_
mov ecx, esi
call fcn.004562f0
push 0
push 0
push 0
push dword [esi + 0xb94]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea ecx, [ebp - 0x418c]
call fcn.00441bb0
lea ecx, [ebp - 0x418c]
call fcn.00441ee0
push 0
lea eax, [ebp - 0x4190]
push eax
push 0x4000
lea eax, [ebp - 0x402c]
push eax
push dword [esi + 0xb94]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x455b62
nop dword [eax + eax]
mov eax, dword [ebp - 0x4190]
test eax, eax
je 0x455b62
push eax
lea eax, [ebp - 0x402c]
push eax
lea ecx, [ebp - 0x418c]
call fcn.00441bc0
push 0
lea eax, [ebp - 0x4190]
push eax
push 0x4000
lea eax, [ebp - 0x402c]
push eax
push dword [esi + 0xb94]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x455b20
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x418c]
call fcn.00441df0
lea ecx, [ebp - 0x18]
mov edx, 0x10
nop dword [eax]
mov eax, dword [edi]
cmp eax, dword [ecx]
jne 0x455bbc
add edi, 4
add ecx, 4
sub edx, 4
jae 0x455b80
push 1
push str.Completed
mov ecx, esi
mov dword [esi + 0xc40], 2
call fcn.004562f0
pop edi
pop ebx
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464e2f
mov esp, ebp
pop ebp
ret
push 0x490cb9
push 1
mov dword [esi + 0xc40], 1
mov ecx, esi
push dword [0x4c3114]
call fcn.00456f10
push 1
push str.SHA_mismatch
mov ecx, esi
call fcn.004562f0
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop ebx
xor ecx, ebp
pop esi
call fcn.00464e2f
mov esp, ebp
pop ebp
ret