joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45a344
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00456f24
xor eax, eax
push ebp
push 0x45a51a
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x45a530
mov dl, 8
mov eax, dword [ebp - 4]
call sym.Strm.exe__Psock_TPowersock_StatusMessage_qqruc17System_AnsiString
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x100b4], edx
mov eax, dword [ebp - 4]
call sym.Strm.exe__Psock_TPowersock_TimerOn_qqrv
xor eax, eax
push ebp
push 0x45a4f5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffff
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x4442e4]
call fcn.004477d8
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x45a48d
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x45a467
push 0
push 0x10000
mov eax, dword [ebp - 4]
add eax, 0x24
push eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x10288]
push eax
call sub.WSOCK32.DLL_recv
mov ebx, eax
test ebx, ebx
jle 0x45a42b
mov eax, dword [ebp - 4]
lea edx, [eax + 0x24]
mov ecx, ebx
mov eax, dword [ebp - 0xc]
call fcn.00447640
mov eax, dword [ebp - 4]
add dword [eax + 0x100b4], ebx
mov eax, dword [ebp - 4]
cmp word [eax + 0x100ba], 0
je 0x45a423
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0x100bc]
call dword [esi + 0x100b8]
mov eax, dword [ebp - 4]
call sym.Strm.exe__Psock_TPowersock_TimerOn_qqrv
cmp ebx, 0xffffffff
jne 0x45a457
call sub.WSOCK32.DLL_WSAGetLastError
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x1008c], esi
cmp esi, 0x2749
je 0x45a477
lea ecx, [ebp - 0x10]
mov dx, 0x2733
mov eax, dword [ebp - 4]
call sym.Strm.exe__Psock_TPowersock_ErrorManager_qqrus
test ebx, ebx
je 0x45a477
mov eax, dword [0x46e844]
mov eax, dword [eax]
call fcn.00424674
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10088], 0
je 0x45a3c7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a494
mov eax, dword [ebp - 0xc]
call fcn.00455e94
ret
Function at 0x45a558
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov edi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45a6fa
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x45a710
mov dl, 8
mov eax, dword [ebp - 4]
call sym.Strm.exe__Psock_TPowersock_StatusMessage_qqruc17System_AnsiString
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x100b4], edx
mov eax, dword [ebp - 4]
call sym.Strm.exe__Psock_TPowersock_TimerOn_qqrv
xor eax, eax
push ebp
push 0x45a6dd
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x45a658
push 0
push 0x10000
mov eax, dword [ebp - 4]
add eax, 0x24
push eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x10288]
push eax
call sub.WSOCK32.DLL_recv
mov ebx, eax
test ebx, ebx
je 0x45a67c
test ebx, ebx
jle 0x45a61d
mov eax, dword [ebp - 4]
lea edx, [eax + 0x24]
mov ecx, ebx
mov eax, edi
call fcn.00447640
mov eax, dword [ebp - 4]
add dword [eax + 0x100b4], ebx
mov eax, dword [ebp - 4]
cmp word [eax + 0x100ba], 0
je 0x45a613
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x100bc]
call dword [ebx + 0x100b8]
mov eax, dword [ebp - 4]
call sym.Strm.exe__Psock_TPowersock_TimerOn_qqrv
jmp 0x45a647
inc ebx
jne 0x45a647
call sub.WSOCK32.DLL_WSAGetLastError
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x1008c], ebx
cmp ebx, 0x2749
je 0x45a67c
lea ecx, [ebp - 8]
mov dx, 0x2733
mov eax, dword [ebp - 4]
call sym.Strm.exe__Psock_TPowersock_ErrorManager_qqrus
mov eax, dword [0x46e844]
mov eax, dword [eax]
call fcn.00424674
cmp esi, 0xffffffff
je 0x45a67c
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10088], 0
jne 0x45a67c
cmp esi, 0xffffffff
je 0x45a5b0
mov eax, edi
call fcn.004475d0
cmp esi, eax
jg 0x45a5b0
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10088], 0
je 0x45a6c7
mov eax, dword [ebp - 4]
mov byte [eax + 0x10088], 0
mov ecx, 0x45a728
mov dl, 1
mov eax, dword [sym.Strm.exe__Psock_EAbortError_]
call fcn.00451b68
call fcn.004565ec
mov eax, dword [ebp - 4]
cmp word [eax + 0x10282], 0
je 0x45a6c7
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x10284]
call dword [ebx + 0x10280]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a6e4
mov eax, dword [ebp - 4]
call sym.Strm.exe__Psock_TPowersock_TimerOff_qqrv
ret
Function at 0x45a740
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45a914
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x45a92c
mov dl, 8
mov eax, dword [ebp - 4]
call sym.Strm.exe__Psock_TPowersock_StatusMessage_qqruc17System_AnsiString
mov eax, esi
call fcn.00456af0
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x100b4], edx
mov eax, dword [ebp - 4]
call sym.Strm.exe__Psock_TPowersock_TimerOn_qqrv
xor eax, eax
push ebp
push 0x45a8f7
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x45a872
push 0
push 0x10000
mov eax, dword [ebp - 4]
add eax, 0x24
push eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x10288]
push eax
call sub.WSOCK32.DLL_recv
mov ebx, eax
test ebx, ebx
je 0x45a896
cmp ebx, 1
jle 0x45a83c
mov eax, dword [esi]
call fcn.00456d70
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
add edx, ebx
mov eax, esi
call fcn.0045705c
mov eax, esi
call fcn.00456f40
mov edx, dword [ebp - 8]
inc edx
dec edx
cmp edx, dword [eax - 4]
jb 0x45a7f8
call fcn.00455dd4
inc edx
lea edx, [eax + edx - 1]
mov eax, dword [ebp - 4]
add eax, 0x24
mov ecx, ebx
call fcn.004559c8
mov eax, dword [ebp - 4]
add dword [eax + 0x100b4], ebx
mov eax, dword [ebp - 4]
cmp word [eax + 0x100ba], 0
je 0x45a832
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x100bc]
call dword [ebx + 0x100b8]
mov eax, dword [ebp - 4]
call sym.Strm.exe__Psock_TPowersock_TimerOn_qqrv
jmp 0x45a866
inc ebx
jne 0x45a866
call sub.WSOCK32.DLL_WSAGetLastError
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x1008c], ebx
cmp ebx, 0x2749
je 0x45a896
lea ecx, [ebp - 0xc]
mov dx, 0x2733
mov eax, dword [ebp - 4]
call sym.Strm.exe__Psock_TPowersock_ErrorManager_qqrus
mov eax, dword [0x46e844]
mov eax, dword [eax]
call fcn.00424674
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10088], 0
jne 0x45a896
cmp edi, 0xffffffff
je 0x45a79f
mov eax, dword [esi]
call fcn.00456d70
cmp edi, eax
jg 0x45a79f
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10088], 0
je 0x45a8e1
mov eax, dword [ebp - 4]
mov byte [eax + 0x10088], 0
mov ecx, 0x45a944
mov dl, 1
mov eax, dword [sym.Strm.exe__Psock_EAbortError_]
call fcn.00451b68
call fcn.004565ec
mov eax, dword [ebp - 4]
cmp word [eax + 0x10282], 0
je 0x45a8e1
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x10284]
call dword [ebx + 0x10280]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a8fe
mov eax, dword [ebp - 4]
call sym.Strm.exe__Psock_TPowersock_TimerOff_qqrv
ret
Function at 0x45aa34
Capabilities:
Set socket configuration

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov ecx, 0x45aafc
mov dl, 8
mov eax, esi
call sym.Strm.exe__Psock_TPowersock_StatusMessage_qqruc17System_AnsiString
lea eax, [esi + 0x24]
mov edx, 0x45ab10
call fcn.00450c40
push eax
call sub.WSOCK32.DLL_inet_addr
mov dword [esi + 0x10260], eax
mov word [esi + 0x1025c], 2
mov eax, dword [esi + 0x100ac]
cmp eax, 0xffff
jbe 0x45aa7c
call fcn.00455dd4
push eax
call sub.WSOCK32.DLL_htons
mov word [esi + 0x1025e], ax
mov byte [esi + 0x100c8], 0
push 0x10
lea eax, [esi + 0x1025c]
push eax
movzx eax, word [esi + 0x10288]
push eax
call sub.WSOCK32.DLL_bind
test bl, bl
je 0x45aac7
push 8
push 0x466
mov eax, dword [esi + 0x1028c]
push eax
movzx eax, word [esi + 0x10288]
push eax
call sub.WSOCK32.DLL_WSAAsyncSelect
jmp 0x45aae2
push 8
push 0x465
mov eax, dword [esi + 0x1028c]
push eax
movzx eax, word [esi + 0x10288]
push eax
call sub.WSOCK32.DLL_WSAAsyncSelect
push 1
movzx eax, word [esi + 0x10288]
push eax
call sub.WSOCK32.DLL_listen
pop esi
pop ebx
ret
Function at 0x45b3bc
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x45b488
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x45b49c
mov dl, 4
mov eax, ebx
call sym.Strm.exe__Psock_TPowersock_StatusMessage_qqruc17System_AnsiString
mov byte [ebx + 0x10290], 0
mov si, word [ebx + 0x10288]
cmp si, 0xffff
je 0x45b472
movzx eax, si
push eax
call sub.WSOCK32.DLL_closesocket
test eax, eax
jne 0x45b464
test byte [ebx + 0x20], 8
jne 0x45b421
cmp word [ebx + 0x1004a], 0
je 0x45b421
mov edx, ebx
mov eax, dword [ebx + 0x1004c]
call dword [ebx + 0x10048]
cmp byte [ebx + 0x10089], 0
jne 0x45b472
push 0
push 1
push 2
call sub.WSOCK32.DLL_socket
mov esi, eax
cmp esi, 0xffff
jbe 0x45b444
call fcn.00455dd4
mov word [ebx + 0x10288], si
push 0x3d
push 0x465
mov eax, dword [ebx + 0x1028c]
push eax
movzx eax, si
push eax
call sub.WSOCK32.DLL_WSAAsyncSelect
jmp 0x45b472
lea ecx, [ebp - 4]
mov dx, 0x2733
mov eax, ebx
call sym.Strm.exe__Psock_TPowersock_ErrorManager_qqrus
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45b48f
lea eax, [ebp - 4]
call fcn.00456af0
ret

Function at 0x45b784
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
mov ebx, eax
mov ecx, 0x45b7c0
mov dl, 8
mov eax, ebx
call sym.Strm.exe__Psock_TPowersock_StatusMessage_qqruc17System_AnsiString
push 2
push 1
lea eax, [ebx + 0x24]
push eax
movzx eax, word [ebx + 0x10288]
push eax
call sub.WSOCK32.DLL_recv
test eax, eax
jle 0x45b7b2
mov al, 1
pop ebx
ret
xor eax, eax
pop ebx
ret

Function at 0x45b7d0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x45b7d7
mov eax, dword [esp + 0x10000]
mov ebx, eax
mov ecx, 0x45b824
mov dl, 8
mov eax, ebx
call sym.Strm.exe__Psock_TPowersock_StatusMessage_qqruc17System_AnsiString
push 0
push 0x10000
lea eax, [esp + 8]
push eax
movzx eax, word [ebx + 0x10288]
push eax
call sub.WSOCK32.DLL_recv
add esp, 0x10004
pop ebx
ret
Function at 0x45b834
Capabilities:
Set socket configuration

Disassembly:
push ebx
mov ebx, eax
mov ecx, 0x45b9c4
mov dl, 8
mov eax, ebx
call sym.Strm.exe__Psock_TPowersock_StatusMessage_qqruc17System_AnsiString
cmp dword [ebx + 0x1009c], 0
jne 0x45b86a
lea eax, [ebx + 0x24]
mov edx, dword [ebx + 0x1026c]
call fcn.00450c40
push eax
call sub.WSOCK32.DLL_inet_addr
mov dword [ebx + 0x10260], eax
jmp 0x45b884
lea eax, [ebx + 0x24]
mov edx, dword [ebx + 0x1009c]
call fcn.00450c40
push eax
call sub.WSOCK32.DLL_inet_addr
mov dword [ebx + 0x10260], eax
cmp dword [ebx + 0x10260], 0xffffffff
jne 0x45b9ba
xor eax, eax
mov dword [ebx + 0x10260], eax
mov eax, ebx
call sym.Strm.exe__Psock_TPowersock_TimerOn_qqrv
mov byte [ebx + 0x100c8], 0
push 0x400
mov eax, dword [ebx + 0x10270]
push eax
lea eax, [ebx + 0x24]
push eax
push 0x466
mov eax, dword [ebx + 0x1028c]
push eax
call sub.WSOCK32.DLL_WSAAsyncGetHostByName
push 2
call sub.KERNEL32.DLL_Sleep
mov eax, dword [0x46e844]
mov eax, dword [eax]
call fcn.00424674
cmp byte [ebx + 0x100c8], 0
jne 0x45b8f6
cmp byte [ebx + 0x100a9], 0
jne 0x45b8f6
cmp byte [ebx + 0x10088], 0
je 0x45b8c8
mov eax, ebx
call sym.Strm.exe__Psock_TPowersock_TimerOff_qqrv
cmp byte [ebx + 0x100a9], 0
je 0x45b91c
mov ecx, 0x45b9dc
mov dl, 1
mov eax, dword [sym.Strm.exe__Psock_ESockError_]
call fcn.00451b68
call fcn.004565ec
cmp byte [ebx + 0x10088], 0
je 0x45b93b
mov ecx, 0x45b9fc
mov dl, 1
mov eax, dword [sym.Strm.exe__Psock_ESockError_]
call fcn.00451b68
call fcn.004565ec
cmp byte [ebx + 0x100a8], 0
jne 0x45b95a
mov ecx, 0x45ba1c
mov dl, 1
mov eax, dword [sym.Strm.exe__Psock_ESockError_]
call fcn.00451b68
call fcn.004565ec
lea eax, [ebx + 0x10260]
mov edx, dword [ebx + 0x10270]
mov edx, dword [edx + 0xc]
mov edx, dword [edx]
mov dl, byte [edx]
mov byte [eax], dl
mov edx, dword [ebx + 0x10270]
mov edx, dword [edx + 0xc]
mov edx, dword [edx]
mov dl, byte [edx + 1]
mov byte [eax + 1], dl
mov edx, dword [ebx + 0x10270]
mov edx, dword [edx + 0xc]
mov edx, dword [edx]
mov dl, byte [edx + 2]
mov byte [eax + 2], dl
mov edx, dword [ebx + 0x10270]
mov edx, dword [edx + 0xc]
mov edx, dword [edx]
mov dl, byte [edx + 3]
mov byte [eax + 3], dl
cmp word [ebx + 0x10062], 0
je 0x45b9ba
mov edx, ebx
mov eax, dword [ebx + 0x10064]
call dword [ebx + 0x10060]
pop ebx
ret
Function at 0x45badc
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
mov dword [ebp - 4], edx
mov ecx, 0x45bb9c
mov dl, 8
call sym.Strm.exe__Psock_TPowersock_StatusMessage_qqruc17System_AnsiString
mov eax, 0xc8
call fcn.00450538
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x45bb87
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xc8
mov eax, dword [ebp - 8]
push eax
call sub.WSOCK32.DLL_gethostname
mov eax, dword [ebp - 8]
push eax
call sub.WSOCK32.DLL_gethostbyname
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebx + 0xc]
mov esi, dword [eax]
xor eax, eax
mov al, byte [esi]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0
xor eax, eax
mov al, byte [esi + 1]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
xor eax, eax
mov al, byte [esi + 2]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0
xor eax, eax
mov al, byte [esi + 3]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x28]
mov ecx, 3
mov eax, 0x45bbb8
call fcn.004512ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45bb8e
mov eax, dword [ebp - 8]
call fcn.00455854
ret

Function at 0x45bbc4
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov esi, edx
mov edi, esp
mov dword [edi], 0x10
push edi
lea edx, [esp + 8]
push edx
movzx eax, word [eax + 0x10288]
push eax
call sub.WSOCK32.DLL_getsockname
push dword [esp + 8]
call sub.WSOCK32.DLL_inet_ntoa
mov ebx, eax
xor eax, eax
mov dword [edi], eax
xor eax, eax
mov edx, dword [edi]
cmp byte [ebx + edx], 0x2e
jne 0x45bc07
mov edx, dword [edi]
mov byte [ebx + edx], 0x2c
inc eax
inc dword [edi]
cmp eax, 3
jl 0x45bbf8
mov edx, esi
mov eax, ebx
call fcn.00450d64
add esp, 0x14
pop edi
pop esi
pop ebx
ret

Function at 0x45bc20
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebx
push esi
add esp, 0xffffffdc
mov esi, edx
mov dword [esp], 0x10
push esp
lea edx, [esp + 8]
push edx
movzx eax, word [eax + 0x10288]
push eax
call sub.WSOCK32.DLL_getsockname
push esi
mov bx, word [esp + 0xa]
mov eax, ebx
and ax, 0xff
movzx eax, ax
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], 0
shr bx, 8
movzx eax, bx
mov dword [esp + 0x20], eax
mov byte [esp + 0x24], 0
lea edx, [esp + 0x18]
mov ecx, 1
mov eax, 0x45bc8c
call fcn.004512ac
add esp, 0x24
pop esi
pop ebx
ret

Function at 0x462750
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x4627b2
call fcn.00462700
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.0045d854
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.0045d854
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x462830
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x46d0b0], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x46290a
cmp dword [0x46d0ac], 0
jne 0x46290a
cmp dword [0x46d290], 0
je 0x4628c4
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.00462600
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4628aa
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.00462600
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4628aa
lea ebx, [ebp - 0x84]
jmp 0x4628ab
inc ebx
call fcn.004627ec
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x462945
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x46d0b4
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.0045d854
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x46d0b7
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x462945
cmp dword [0x46d0ac], 0
je 0x462924
cmp dword [0x46d0ac], 0xffffffff
je 0x462945
push esi
call dword [0x46d0ac]
pop ecx
mov eax, dword [0x46d0b0]
test eax, eax
je 0x462945
cmp dword [0x46d0b0], 0xffffffff
je 0x462945
cmp byte [eax], 0
je 0x462945
push esi
push eax
call fcn.00462750
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4630dc
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x46fd70], 0
jne 0x46315d
cmp dword [0x46fd90], 0
jne 0x46310c
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x46fd90], eax
test eax, eax
jne 0x46310c
push str.GetEnvironmentStrings_failed
call fcn.0046295c
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x46fd90]
jmp 0x463120
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.0045d854
pop ecx
mov edi, eax
test eax, eax
jne 0x463118
lea edi, [ebp + 1]
push edi
call fcn.0045d2b4
pop ecx
mov ebx, eax
mov dword [0x46fd74], ebx
test ebx, ebx
jne 0x46314a
xor eax, eax
jmp 0x463220
push edi
mov edx, dword [0x46fd90]
push edx
push ebx
call fcn.0045d704
add esp, 0xc
jmp 0x46317d
xor esi, esi
mov ebx, dword [0x46fd70]
jmp 0x463177
push eax
call fcn.0045d854
pop ecx
test eax, eax
jne 0x463173
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x463167
lea ebx, [esi + 4]
push 4
mov dword [0x46fd78], ebx
inc ebx
push ebx
call fcn.0045cd8c
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x4631a0
xor eax, eax
jmp 0x463220
cmp dword [0x46fd70], 0
jne 0x4631d1
xor esi, esi
mov ebx, dword [0x46fd74]
mov eax, dword [esp]
mov ebp, eax
jmp 0x4631c2
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.0045d854
pop ecx
mov edi, eax
test eax, eax
jne 0x4631b8
jmp 0x463202
xor esi, esi
mov ebx, dword [0x46fd70]
mov eax, dword [esp]
mov edi, eax
jmp 0x4631fc
push eax
call fcn.0045d854
pop ecx
test eax, eax
je 0x4631f1
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x4631f5
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x4631e0
mov eax, dword [0x46fd70]
test eax, eax
je 0x463212
push eax
call fcn.0045d2c4
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x46fd70], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x47bd70
Capabilities:
Hash data using sha1

Disassembly:
mov edx, dword [esp + 4]
push edi
mov ecx, 0x17
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [edx], 0x67452301
mov dword [edx + 4], 0xefcdab89
mov dword [edx + 8], 0x98badcfe
mov dword [edx + 0xc], 0x10325476
mov dword [edx + 0x10], 0xc3d2e1f0
pop edi
ret

Function at 0x47be50
Capabilities:
Hash data using sha1

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
push ebx
mov ebx, dword [esp + 0x28]
push ebp
mov edx, dword [eax + 0x10]
mov ecx, dword [eax]
mov ebp, dword [eax + 0xc]
push esi
mov esi, dword [eax + 8]
mov dword [esp + 0x18], edx
push edi
xor dl, dl
xor edi, edi
mov dword [esp + 0x18], ecx
mov ecx, dword [eax + 4]
mov dword [esp + 0x20], ebp
mov byte [esp + 0x13], dl
mov dword [esp + 0x24], edi
cmp edi, 0x3c
ja case.0x47be92.4
xor eax, eax
mov al, byte [edi + 0x47bfec]
jmp dword [eax*4 + 0x47bfd8]
mov dword [esp + 0x14], 0x5a827999
jmp case.0x47be92.4
mov dword [esp + 0x14], 0x6ed9eba1
jmp case.0x47be92.4
mov dword [esp + 0x14], 0x8f1bbcdc
jmp case.0x47be92.4
mov dword [esp + 0x14], 0xca62c1d6
mov al, dl
and al, 0xf
cmp dl, 0xf
mov byte [esp + 0x28], al
mov edi, dword [esp + 0x28]
jbe 0x47bf0c
mov edx, edi
and edx, 0xff
lea eax, [edx - 8]
lea ebp, [edx - 3]
and eax, 0xf
and ebp, 0xf
mov eax, dword [ebx + eax*4]
xor eax, dword [ebx + ebp*4]
lea ebp, [edx + 2]
and ebp, 0xf
xor eax, dword [ebx + ebp*4]
mov ebp, dword [ebx + edx*4]
xor eax, ebp
mov ebp, eax
add eax, eax
shr ebp, 0x1f
or ebp, eax
mov dword [ebx + edx*4], ebp
mov ebp, dword [esp + 0x20]
mov dl, byte [esp + 0x13]
cmp dl, 0x14
jae 0x47bf1f
mov eax, ecx
mov edx, esi
not eax
and eax, ebp
and edx, ecx
or eax, edx
jmp 0x47bf3d
cmp dl, 0x28
jb 0x47bf37
cmp dl, 0x3c
jae 0x47bf37
mov eax, esi
mov edx, esi
or eax, ecx
and edx, ecx
and eax, ebp
or eax, edx
jmp 0x47bf3d
mov eax, ebp
xor eax, esi
xor eax, ecx
mov edx, dword [esp + 0x18]
and edi, 0xff
mov ebx, edx
shr ebx, 0x1b
shl edx, 5
or ebx, edx
mov edx, ebx
mov ebx, dword [esp + 0x34]
add edx, dword [ebx + edi*4]
mov edi, dword [esp + 0x14]
add edx, edi
mov edi, dword [esp + 0x1c]
add edx, edi
mov edi, dword [esp + 0x24]
add eax, edx
mov edx, ecx
shl edx, 0x1e
shr ecx, 2
mov dword [esp + 0x1c], ebp
or edx, ecx
mov ecx, dword [esp + 0x18]
mov ebp, esi
mov esi, edx
mov dl, byte [esp + 0x13]
inc dl
inc edi
cmp dl, 0x50
mov dword [esp + 0x20], ebp
mov dword [esp + 0x18], eax
mov byte [esp + 0x13], dl
mov dword [esp + 0x24], edi
jb 0x47be85
mov edx, dword [esp + 0x30]
mov edi, dword [edx]
mov ebx, dword [edx + 4]
add edi, eax
mov eax, dword [esp + 0x1c]
mov dword [edx], edi
mov edi, dword [edx + 8]
add edi, esi
mov esi, dword [edx + 0xc]
add ebx, ecx
mov ecx, dword [edx + 0x10]
add esi, ebp
mov dword [edx + 8], edi
mov dword [edx + 0xc], esi
pop edi
add ecx, eax
pop esi
mov dword [edx + 4], ebx
pop ebp
mov dword [edx + 0x10], ecx
pop ebx
add esp, 0x1c
ret