joyce8/EMBER2024-capa huggingface dataset:
Function at 0x434830
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5129b2
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x55c4e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], 0
mov dword [esi], 0x542620
mov dword [esi + 0x70], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], 0
lea edi, [esi + 0x10]
mov eax, dword [esi]
mov dword [ebp - 0x10], 1
mov eax, dword [eax + 4]
mov dword [esi + eax], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
push ecx
push edi
lea eax, [ecx - 0x18]
mov dword [ecx + esi - 4], eax
mov eax, dword [esi]
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov ecx, dword [eax + 4]
add ecx, esi
call fcn.004354c0
mov dword [ebp - 4], 2
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov dword [esi + eax], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ecx + esi - 4], eax
mov ecx, edi
call fcn.00435e00
lea eax, [edi + 4]
mov dword [edi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov dword [edi + 0xc], eax
lea ecx, [edi + 8]
lea eax, [edi + 0x14]
mov byte [edi + 0x4c], 0
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov byte [edi + 0x45], 0
mov dword [edi + 0x10], ecx
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, dword [0x566110]
mov dword [edi + 0x50], 0
mov dword [edi + 0x48], eax
mov dword [edi + 0x40], 0
mov ecx, dword [ebp + 8]
mov byte [ebp - 4], 3
cmp dword [ecx + 0x14], 8
jb 0x434965
mov ecx, dword [ecx]
mov eax, dword [ebp + 0xc]
push ecx
or eax, 1
push eax
push ecx
mov ecx, edi
call fcn.004355d0
test eax, eax
jne 0x434998
mov eax, dword [esi]
mov ecx, dword [eax + 4]
mov eax, dword [ecx + esi + 0xc]
add ecx, esi
or eax, 2
cmp dword [ecx + 0x38], 0
jne 0x434990
or eax, 4
push 0
push eax
call fcn.00433a90
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4357e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x512a88
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x55c4e0]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov eax, dword [0x55c4e0]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x40], 0
je 0x435934
cmp byte [ebx + 0x45], 0
je 0x435934
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x435840
xor al, al
jmp 0x435936
mov ecx, 0xf
mov byte [esp + 0x18], 0
xorps xmm0, xmm0
mov dword [esp + 0x2c], ecx
cmp ecx, 0x10
movq qword [esp + 0x18], xmm0
lea eax, [esp + 0x18]
mov dword [esp + 0x28], 8
cmovae eax, dword [esp + 0x18]
mov byte [eax + 8], 0
mov dword [esp + 0x40], 0
jmp 0x435880
cmp dword [esp + 0x2c], 0x10
lea eax, [esp + 0x14]
mov ecx, dword [ebx + 0x40]
lea edi, [esp + 0x18]
cmovae edi, dword [esp + 0x18]
lea esi, [esp + 0x18]
cmovae esi, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x2c]
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x4358c1
dec eax
je 0x4358c5
sub eax, 2
je 0x43591b
xor bl, bl
jmp 0x43591d
mov byte [ebx + 0x45], 0
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 0x18]
mov edx, dword [esp + 0x18]
cmp ecx, 0x10
mov esi, dword [esp + 0x14]
cmovae eax, edx
sub esi, eax
je 0x4358fc
push dword [ebx + 0x50]
cmp ecx, 0x10
lea eax, [esp + 0x1c]
push esi
cmovae eax, edx
push 1
push eax
call fcn.004db507
add esp, 0x10
cmp esi, eax
jne 0x4358bd
cmp byte [ebx + 0x45], 0
je 0x43591b
test esi, esi
jne 0x435880
push esi
push 8
lea ecx, [esp + 0x20]
call fcn.0040af10
jmp 0x435880
mov bl, 1
cmp dword [esp + 0x2c], 0x10
jb 0x435930
push dword [esp + 0x18]
call fcn.004c5e80
add esp, 4
mov al, bl
jmp 0x435936
mov al, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004d2943
mov esp, ebp
pop ebp
ret
Function at 0x439a60
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ecx
xor eax, eax
mov edx, eax
mov ecx, eax
and edx, 1
shr ecx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov dword [eax*4 + 0x5688a0], ecx
inc eax
cmp eax, 0x100
jb 0x439a63
cmp eax, 0x800
jae 0x439b33
nop
mov edx, dword [eax*4 + 0x5684a0]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x5688a0]
mov dword [eax*4 + 0x5688a0], edx
inc eax
cmp eax, 0x800
jb 0x439b10
mov dword [0x56a8a0], 0x43b6a0
mov dword [0x56888c], 0x43b6a0
mov dword [0x56a8a4], 0x43b740
call fcn.0043b950
mov ecx, dword [0x56888c]
test eax, eax
mov edx, 0x43b740
cmove ecx, edx
mov dword [0x56888c], ecx
pop ecx
ret
Function at 0x43e930
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
xor edi, edi
mov dword [ebp - 4], ebx
mov esi, dword [esi]
and esi, 7
cmp edx, 5
jae 0x43e956
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
add dword [ebp + 8], 5
sub edx, 4
add edx, ebx
mov dword [ebp - 0xc], edx
lea eax, [edi + ebx]
cmp eax, edx
jae 0x43e97f
lea esp, [esp]
mov cl, byte [eax]
and cl, 0xfe
cmp cl, 0xe8
je 0x43e97f
inc eax
cmp eax, edx
jb 0x43e970
mov ecx, eax
sub ecx, edi
mov edi, eax
sub ecx, ebx
sub edi, ebx
cmp eax, edx
jae 0x43ea62
cmp ecx, 2
jbe 0x43ea22
xor esi, esi
movzx ebx, byte [eax + 4]
lea ecx, [ebx + 1]
test cl, 0xfe
jne 0x43ea54
movzx ecx, byte [eax + 3]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [eax + 2]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [eax + 1]
shl ebx, 8
or ebx, ecx
mov ecx, dword [ebp + 8]
add ecx, edi
add edi, 5
sub ebx, ecx
mov dword [ebp - 8], ecx
test esi, esi
je 0x43e9fc
and esi, 6
mov edx, ebx
shl esi, 2
mov ecx, esi
shr edx, cl
inc edx
test dl, 0xfe
jne 0x43e9f7
mov edx, 0x100
shl edx, cl
dec edx
xor ebx, edx
sub ebx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
xor esi, esi
mov ecx, ebx
mov byte [eax + 1], bl
shr ecx, 8
mov byte [eax + 2], cl
mov ecx, ebx
shr ebx, 0x18
and bl, 1
shr ecx, 0x10
neg bl
mov byte [eax + 3], cl
mov byte [eax + 4], bl
mov ebx, dword [ebp - 4]
jmp 0x43e962
shr esi, cl
test esi, esi
je 0x43e99c
cmp esi, 4
ja 0x43ea49
cmp esi, 3
je 0x43ea49
mov ecx, esi
shr ecx, 1
movzx ecx, byte [ecx + eax + 1]
inc ecx
test cl, 0xfe
jne 0x43e99c
or esi, 8
shr esi, 1
inc edi
jmp 0x43e962
mov ebx, dword [ebp - 4]
or esi, 8
shr esi, 1
inc edi
jmp 0x43e962
cmp ecx, 2
jbe 0x43ea77
mov eax, dword [ebp + 0xc]
xor esi, esi
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
shr esi, cl
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x441b70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x513232
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x55c4e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], 0
mov dword [esi], 0x542678
mov dword [esi + 0x10], 0x542670
mov dword [esi + 0x78], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
push ecx
lea edi, [esi + 0x18]
mov dword [ebp - 4], 0
push edi
mov dword [ebp - 0x10], 1
call fcn.00441a60
mov dword [ebp - 4], 1
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov dword [esi + eax], vtable.std::basic_fstream_char__struct_std::char_traits_char__.0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x78]
mov dword [ecx + esi - 4], eax
mov ecx, edi
call fcn.00435e00
lea eax, [edi + 4]
mov dword [edi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov dword [edi + 0xc], eax
lea ecx, [edi + 8]
lea eax, [edi + 0x14]
mov byte [edi + 0x4c], 0
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov byte [edi + 0x45], 0
mov dword [edi + 0x10], ecx
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, dword [0x566110]
mov dword [edi + 0x50], 0
mov dword [edi + 0x48], eax
mov dword [edi + 0x40], 0
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], 8
jb 0x441c7f
mov eax, dword [eax]
push ecx
push 0xb
push eax
mov ecx, edi
call fcn.004355d0
test eax, eax
jne 0x441cad
mov eax, dword [esi]
mov ecx, dword [eax + 4]
mov eax, dword [ecx + esi + 0xc]
add ecx, esi
or eax, 2
cmp dword [ecx + 0x38], 0
jne 0x441ca5
or eax, 4
push 0
push eax
call fcn.00433a90
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x444e70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x513ab2
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x55c4e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], 0
mov dword [esi], 0x5425c0
mov dword [esi + 0x60], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], 0
lea edi, [esi + 4]
mov eax, dword [esi]
mov dword [ebp - 0x10], 1
mov eax, dword [eax + 4]
mov dword [esi + eax], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
push ecx
push edi
lea eax, [ecx - 8]
mov dword [ecx + esi - 4], eax
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
call fcn.004354c0
mov dword [ebp - 4], 2
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov dword [esi + eax], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x60]
mov dword [ecx + esi - 4], eax
mov ecx, edi
call fcn.00435e00
lea eax, [edi + 4]
mov dword [edi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov dword [edi + 0xc], eax
lea ecx, [edi + 8]
lea eax, [edi + 0x14]
mov byte [edi + 0x4c], 0
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov byte [edi + 0x45], 0
mov dword [edi + 0x10], ecx
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, dword [0x566110]
mov dword [edi + 0x50], 0
mov dword [edi + 0x48], eax
mov dword [edi + 0x40], 0
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 3
cmp dword [eax + 0x14], 8
jb 0x444f97
mov eax, dword [eax]
push ecx
push 2
push eax
mov ecx, edi
call fcn.004355d0
test eax, eax
jne 0x444fc5
mov eax, dword [esi]
mov ecx, dword [eax + 4]
mov eax, dword [ecx + esi + 0xc]
add ecx, esi
or eax, 2
cmp dword [ecx + 0x38], 0
jne 0x444fbd
or eax, 4
push 0
push eax
call fcn.00433a90
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x447e00
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x513e06
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x55c4e0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x238], 0
push 0x206
push eax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push eax
call fcn.004dbb40
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xor eax, eax
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], 0
mov word [ebp - 0x234], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x21c]
cmp word [ebp - 0x21c], 0
je 0x447ea9
jmp 0x447ea0
add eax, 2
cmp word [eax], 0
jne 0x447ea0
push eax
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x234]
call fcn.0040b520
push str.XuanZhi_
lea edx, [ebp - 0x234]
mov dword [ebp - 4], 1
mov ecx, 0x567734
call fcn.00447cb0
add esp, 4
cmp dword [ebp - 0x220], 8
jb 0x447ef2
push dword [ebp - 0x234]
call fcn.004c5e80
add esp, 4
mov eax, 0x567734
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004d2943
mov esp, ebp
pop ebp
ret 4

Function at 0x447fc0
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x513e6b
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x55c4e0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x224], 0
push 0x206
push eax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push eax
mov dword [ebp - 0x220], 0x567750
call fcn.004dbb40
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push 5
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xor eax, eax
mov dword [0x567764], 7
mov dword [0x567760], 0
mov word [0x567750], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x21c]
cmp word [ebp - 0x21c], 0
je 0x44806a
add eax, 2
cmp word [eax], 0
jne 0x448061
push eax
lea eax, [ebp - 0x21c]
mov ecx, 0x567750
push eax
call fcn.0040b520
mov eax, 0x567750
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004d2943
mov esp, ebp
pop ebp
ret 4
Function at 0x448720
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x513fe7
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x55c4e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x24c], 0
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.004dbb40
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xor eax, eax
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x218]
cmp word [ebp - 0x218], 0
je 0x4487c9
jmp 0x4487c0
add eax, 2
cmp word [eax], 0
jne 0x4487c0
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.0040b520
push str.lddownloader_
lea edx, [ebp - 0x230]
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x248]
call fcn.00447cb0
add esp, 4
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.00448250
cmp dword [ebp - 0x234], 8
jb 0x44881e
push dword [ebp - 0x248]
call fcn.004c5e80
add esp, 4
xor eax, eax
mov dword [ebp - 0x234], 7
cmp dword [ebp - 0x21c], 8
mov dword [ebp - 0x238], 0
mov word [ebp - 0x248], ax
jb 0x448852
push dword [ebp - 0x230]
call fcn.004c5e80
add esp, 4
xor eax, eax
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
mov dword [ebp - 4], 3
lea eax, [ebp - 0x218]
cmp word [ebp - 0x218], 0
je 0x44888f
add eax, 2
cmp word [eax], 0
jne 0x448886
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.0040b520
sub esp, 0x18
mov dword [ebp - 4], 4
mov ecx, esp
lea edx, [ebp - 0x230]
push str.lddownloaderlddownloader.log
call fcn.00447cb0
add esp, 4
mov ecx, esi
call fcn.004482f0
add esp, 0x18
cmp dword [ebp - 0x21c], 8
jb 0x4488e2
push dword [ebp - 0x230]
call fcn.004c5e80
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d2943
mov esp, ebp
pop ebp
ret
Function at 0x44adc0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51449b
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x55c4e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
sub esp, 8
mov dword [ebp - 4], 0
call fcn.00421700
mov byte [ebp - 4], 1
lea ecx, [edi + 0x34]
mov eax, dword [edi + 0x10]
mov dword [edi + 0x30], eax
xor eax, eax
push 0xffffffffffffffff
mov dword [edi + 0x48], 7
mov dword [edi + 0x44], 0
push eax
mov word [edi + 0x34], ax
lea eax, [ebp + 8]
push eax
call fcn.004069f0
mov byte [ebp - 4], 2
lea edx, [edi + 0x34]
mov ecx, edi
mov byte [edi + 0x4c], 0
call fcn.0044a320
cmp dword [edi + 0xc], 0
jne 0x44ae5c
mov ecx, edi
call fcn.004277b0
mov dword [edi + 0xc], 3
xorps xmm0, xmm0
movq qword [edi], xmm0
mov dword [edi + 8], 0
cmp dword [ebp + 0x1c], 8
mov byte [edi + 0x4c], 0
jb 0x44ae71
push dword [ebp + 8]
call fcn.004c5e80
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18

Function at 0x44cd00
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x55c4e0]
xor eax, esp
mov dword [esp + 0x190], eax
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x44cd55
mov eax, dword [esp]
cmp al, 2
jne 0x44cd4f
shr eax, 8
cmp al, 2
jne 0x44cd4f
call fcn.00452350
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.004d2943
add esp, 0x194
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x190]
mov eax, 2
xor ecx, esp
call fcn.004d2943
add esp, 0x194
ret

Function at 0x452d70
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x452d8c
cmp dword [esi + 0x6c], 0
je 0x452d8c
push 2
push 3
push esi
call fcn.00468a90
add esp, 0xc
push dword [esp + 0xc]
call fcn.00461d10
add esp, 4
test esi, esi
je 0x452dad
cmp dword [esi + 0x6c], 0
je 0x452dad
push 3
push esi
call fcn.00468ad0
add esp, 8
pop esi
ret

Function at 0x4534f0
Capabilities:
Create udp socket

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x3c0], 2
je fcn.004534a0
mov al, 1
ret
Function at 0x45c790
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x108
mov eax, dword [0x55c4e0]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
push edi
mov edi, dword [esp + 0x114]
lea eax, [esp + 0x11c]
push eax
push dword [esp + 0x11c]
lea eax, [esp + 0x10]
push 0x100
push eax
call fcn.0045ed10
lea esi, [esp + 0x18]
add esp, 0x10
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x45c7d5
sub esi, ecx
mov ecx, dword [edi + 0x140]
test ecx, ecx
je 0x45c809
cmp byte [edi + 0x46b0], al
jne 0x45c809
lea edx, [esp + 8]
mov al, byte [edx]
lea edx, [edx + 1]
mov byte [ecx], al
lea ecx, [ecx + 1]
test al, al
jne 0x45c7f4
mov byte [edi + 0x46b0], 1
cmp byte [edi + 0x370], 0
je 0x45c843
mov byte [esp + esi + 8], 0xa
inc esi
cmp esi, 0x102
jae 0x45c89b
mov eax, dword [edi + 0x1b0]
mov byte [esp + esi + 8], 0
test eax, eax
je 0x45c85a
push dword [edi + 0x13c]
lea ecx, [esp + 0xc]
push esi
push ecx
push 0
push edi
call eax
add esp, 0x14
pop edi
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004d2943
add esp, 0x108
ret
push dword [edi + 0x138]
push 1
push 2
push 0x51c3d0
call fcn.004db507
push dword [edi + 0x138]
lea eax, [esp + 0x1c]
push 1
push esi
push eax
call fcn.004db507
mov ecx, dword [esp + 0x12c]
add esp, 0x20
pop edi
pop esi
xor ecx, esp
call fcn.004d2943
add esp, 0x108
ret
call fcn.004d4653
int3

Function at 0x45c8b0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x808
mov eax, dword [0x55c4e0]
xor eax, esp
mov dword [esp + 0x804], eax
push edi
mov edi, dword [esp + 0x810]
test edi, edi
je 0x45c979
cmp byte [edi + 0x370], 0
je 0x45c979
push esi
lea eax, [esp + 0x81c]
push eax
push dword [esp + 0x81c]
lea eax, [esp + 0x10]
push 0x801
push eax
call fcn.0045ed10
lea esi, [esp + 0x18]
add esp, 0x10
lea ecx, [esi + 1]
lea ebx, [ebx]
mov al, byte [esi]
inc esi
test al, al
jne 0x45c910
mov eax, dword [edi + 0x1b0]
sub esi, ecx
test eax, eax
je 0x45c94e
push dword [edi + 0x13c]
lea ecx, [esp + 0xc]
push esi
push ecx
push 0
push edi
call eax
add esp, 0x14
pop esi
pop edi
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.004d2943
add esp, 0x808
ret
push dword [edi + 0x138]
push 1
push 2
push 0x51c3d0
call fcn.004db507
push dword [edi + 0x138]
lea eax, [esp + 0x1c]
push 1
push esi
push eax
call fcn.004db507
add esp, 0x20
pop esi
mov ecx, dword [esp + 0x808]
pop edi
xor ecx, esp
call fcn.004d2943
add esp, 0x808
ret