joyce8/EMBER2024-capa huggingface dataset:
Function at 0x453630
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
xor ecx, ecx
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ecx
test byte [esi + 0xac], 1
je 0x4536ea
cmp dword [esi + 0x8c], ecx
jbe 0x4536ea
mov eax, 0xffffff44
lea ebx, [esi + 0xbc]
sub eax, esi
mov dword [ebp - 0x10], eax
nop dword [eax]
movzx eax, byte [ebx]
mov ecx, dword [esi + 0x100e8]
xor eax, ecx
mov edx, dword [esi + 0x100f4]
movzx eax, al
mov edi, dword [esi + 0x100f0]
shr ecx, 8
and edi, 0xfffd
or edi, 2
xor ecx, dword [edx + eax*4]
movzx eax, cl
add eax, dword [esi + 0x100ec]
imul eax, eax, 0x8088405
mov dword [esi + 0x100e8], ecx
mov ecx, dword [esi + 0x100f0]
inc eax
mov dword [esi + 0x100ec], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [edx + eax*4]
mov eax, edi
xor eax, 1
mov dword [esi + 0x100f0], ecx
imul eax, edi
shr eax, 8
xor byte [ebx], al
inc ebx
mov eax, dword [ebp - 0x10]
add eax, ebx
cmp eax, dword [esi + 0x8c]
jb 0x453670
mov ebx, dword [esi + 0x8c]
mov dword [ebp - 4], ebx
cmp dword [esi + 0x1011c], 0
mov eax, ebx
mov dword [ebp - 0x10], eax
ja 0x45370e
cmp dword [esi + 0x10118], 0
jbe 0x4537a7
mov edx, dword [esi + 0x14]
mov eax, dword [esi + 0x34]
mov ecx, dword [esi + 0x20]
push 2
push 0
test edx, edx
je 0x45372a
push 0
push eax
push ecx
call edx
add esp, 0x14
jmp 0x453734
push eax
mov eax, dword [esi + 0x30]
push ecx
call eax
add esp, 0x10
cmp dword [esi + 0x14], 0
mov eax, dword [esi + 0x34]
mov ecx, dword [esi + 0x20]
push eax
push ecx
je 0x45374c
mov eax, dword [esi + 0x10]
call eax
add esp, 8
jmp 0x453762
mov eax, dword [esi + 0x2c]
call eax
add esp, 8
cmp eax, 0xffffffff
jne 0x453760
or eax, eax
or edx, 0xffffffff
jmp 0x453762
xor edx, edx
mov edi, dword [esi + 0x10118]
mov ebx, dword [esi + 0x1011c]
sub edi, eax
mov eax, edi
mov dword [ebp - 0xc], 0
sbb ebx, edx
or eax, ebx
jne 0x453793
mov ecx, esi
call fcn.00451770
mov ecx, eax
mov dword [ebp - 0xc], ecx
test ecx, ecx
jne 0x453817
test ebx, ebx
mov ebx, dword [ebp - 4]
ja 0x4537a4
jb 0x4537a0
cmp edi, ebx
jae 0x4537a4
mov eax, edi
jmp 0x4537a7
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
add eax, 0xbc
add eax, esi
push eax
push dword [esi + 0x34]
mov eax, dword [esi + 0xc]
push dword [esi + 0x20]
call eax
push dword [esi + 0x34]
mov ecx, dword [esi + 0x1c]
mov edi, eax
push dword [esi + 0x20]
call ecx
add esp, 0x18
test eax, eax
jne 0x453820
add dword [ebp - 8], edi
sub ebx, edi
mov dword [ebp - 4], ebx
jne 0x4536f3
mov ecx, dword [ebp - 0xc]
mov eax, dword [esi + 0x8c]
add dword [esi + 0x100d8], eax
mov eax, dword [esi + 0x58]
adc dword [esi + 0x100dc], 0
add dword [esi + 0x100e0], eax
mov dword [esi + 0x58], 0
adc dword [esi + 0x100e4], 0
mov dword [esi + 0x8c], 0
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
or ecx, 0xffffffff
jmp 0x4537e3
Function at 0x456520
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, edx
mov edx, dword [ebp + 8]
cmp edx, 4
jge 0x456561
test edx, edx
je 0x45664a
nop dword [eax]
movzx eax, byte [edi]
lea edi, [edi + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5a1ec0]
sub edx, 1
jne 0x456540
mov eax, ecx
pop edi
mov esp, ebp
pop ebp
ret
push ebx
push esi
mov eax, edi
mov esi, 4
and eax, 3
mov ebx, edx
sub esi, eax
sub ebx, esi
and ebx, 0xfffffff8
sub edx, ebx
sub edx, esi
mov dword [ebp + 8], edx
test esi, esi
je 0x456599
movzx eax, byte [edi]
inc edi
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5a22c0]
sub esi, 1
jne 0x456581
shr ebx, 3
mov dword [ebp - 4], ebx
test ebx, ebx
je 0x456628
xor ecx, dword [edi]
mov eax, ecx
mov ebx, ecx
shr eax, 8
movzx eax, al
shr ebx, 0x10
mov edx, ebx
shr edx, 8
mov esi, dword [eax*4 + 0x5a26c0]
movzx eax, bl
mov ebx, dword [edi + 4]
add edi, 8
xor esi, dword [edx*4 + 0x5a2ac0]
mov edx, ebx
shr edx, 0x10
xor esi, dword [eax*4 + 0x5a3ac0]
movzx eax, cl
mov dword [ebp - 8], edx
shr edx, 8
xor esi, dword [eax*4 + 0x5a36c0]
mov eax, ebx
shr eax, 8
mov ecx, esi
movzx eax, al
mov esi, dword [eax*4 + 0x5a3ec0]
xor esi, dword [edx*4 + 0x5a22c0]
movzx eax, bl
xor esi, dword [eax*4 + 0x5a32c0]
mov eax, dword [ebp - 8]
movzx eax, al
xor esi, dword [eax*4 + 0x5a2ec0]
xor ecx, esi
sub dword [ebp - 4], 1
jne 0x4565a7
mov edx, dword [ebp + 8]
pop esi
pop ebx
test edx, edx
je 0x45664a
nop
movzx eax, byte [edi]
lea edi, [edi + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5a22c0]
sub edx, 1
jne 0x456630
mov eax, ecx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x456660
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push edi
mov edi, dword [ebp + 8]
test edi, edi
js 0x45682e
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__lseek]
push 0x100000
or ebx, 0xffffffff
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 0x10
mov dword [ebp - 4], eax
test eax, eax
je 0x45682e
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
jle 0x4567de
mov ecx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
nop
cmp esi, 0x100000
jbe 0x4567f3
mov edi, 0x100000
push edi
push eax
push dword [ebp + 8]
mov dword [ebp - 8], edi
call ecx
add esp, 0xc
mov eax, dword [ebp - 4]
mov ecx, 4
mov esi, dword [ebp - 4]
and eax, 3
sub ecx, eax
mov edx, edi
sub edx, ecx
and edx, 0xfffffff8
sub edi, edx
sub edi, ecx
mov dword [ebp - 0x10], edi
test ecx, ecx
je 0x456708
movzx eax, byte [esi]
inc esi
xor eax, ebx
shr ebx, 8
movzx eax, al
xor ebx, dword [eax*4 + 0x5a22c0]
sub ecx, 1
jne 0x4566f0
shr edx, 3
mov dword [ebp - 0xc], edx
test edx, edx
je 0x4567a1
mov edi, edx
xor ebx, dword [esi]
mov eax, ebx
mov ecx, ebx
shr eax, 8
movzx eax, al
shr ecx, 0x10
mov dword [ebp - 0xc], ecx
shr ecx, 8
mov edx, dword [eax*4 + 0x5a26c0]
mov eax, dword [ebp - 0xc]
movzx eax, al
xor edx, dword [ecx*4 + 0x5a2ac0]
xor edx, dword [eax*4 + 0x5a3ac0]
movzx eax, bl
xor edx, dword [eax*4 + 0x5a36c0]
mov eax, dword [esi + 4]
mov ebx, edx
mov ecx, eax
shr eax, 8
movzx eax, al
shr ecx, 0x10
mov dword [ebp - 0xc], ecx
shr ecx, 8
mov edx, dword [eax*4 + 0x5a3ec0]
mov eax, dword [esi + 4]
add esi, 8
movzx eax, al
xor edx, dword [ecx*4 + 0x5a22c0]
xor edx, dword [eax*4 + 0x5a32c0]
mov eax, dword [ebp - 0xc]
movzx eax, al
xor edx, dword [eax*4 + 0x5a2ec0]
xor ebx, edx
sub edi, 1
jne 0x456718
mov edi, dword [ebp - 0x10]
test edi, edi
je 0x4567bf
movzx eax, byte [esi]
lea esi, [esi + 1]
xor eax, ebx
shr ebx, 8
movzx eax, al
xor ebx, dword [eax*4 + 0x5a22c0]
sub edi, 1
jne 0x4567a5
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp - 8]
mov eax, dword [ebp - 4]
sub esi, edi
mov edi, dword [ebp + 8]
mov ecx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
mov dword [ebp + 0x10], esi
test esi, esi
jg 0x4566b0
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
not ebx
mov eax, ebx
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push eax
push edi
call ecx
add esp, 0xc
mov edi, esi
mov dword [ebp - 8], edi
cmp esi, 4
jae 0x4566ce
mov edx, dword [ebp - 4]
mov ecx, esi
test esi, esi
je 0x4567c5
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ebx
shr ebx, 8
movzx eax, al
xor ebx, dword [eax*4 + 0x5a1ec0]
sub ecx, 1
jne 0x456812
jmp 0x4567c5
pop edi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45cfc0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov ecx, dword [ebp + 0x18]
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov ebx, ecx
mov esi, dword [eax]
sub ebx, edi
mov dword [esp + 0x14], ebx
je 0x45d12e
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 8]
mov dword [esp + 0x10], 0
cmp dword [esp + 0x10], edx
ja 0x45d13a
jb 0x45d007
cmp ebx, eax
ja 0x45d13a
sub eax, ebx
sbb edx, 0
cmp dword [ebp + 0x10], edx
ja 0x45d13a
mov edx, dword [ebp + 0xc]
jb 0x45d022
cmp edx, eax
ja 0x45d13a
add edx, dword [esi + 0x28]
mov eax, dword [esi + 0x2c]
adc eax, dword [ebp + 0x10]
cmp dword [esi + 0x20], edx
jne 0x45d035
cmp dword [esi + 0x24], eax
je 0x45d08d
push 0
push eax
push edx
push dword [esi + 0x18]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fseeki64]
add esp, 0x10
test eax, eax
je 0x45d08a
mov dword [esi + 0x20], 0xffffffff
mov dword [esi + 0x24], 0xffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov edi, dword [eax]
mov eax, dword [esi + 0x30]
cmp eax, edi
je 0x45d180
test edi, edi
je 0x45d180
test eax, eax
jne 0x45d079
mov dword [esi + 0x30], edi
push edi
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
add esp, 4
push eax
push edi
jmp 0x45d167
mov ecx, dword [ebp + 0x18]
mov eax, dword [esi + 0x18]
mov dword [esp + 0x10], eax
cmp edi, ecx
jae 0x45d0d5
mov edx, 0x100000
nop dword [eax]
mov ebx, ecx
sub ebx, edi
cmp ebx, 0x100000
push eax
cmova ebx, edx
push ebx
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
cmp ebx, eax
jne 0x45d0d7
mov ecx, dword [ebp + 0x18]
add edi, ebx
mov eax, dword [esp + 0x10]
mov edx, 0x100000
cmp edi, ecx
jb 0x45d0a0
mov ebx, dword [esp + 0x14]
je 0x45d115
mov dword [esi + 0x20], 0xffffffff
mov dword [esi + 0x24], 0xffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov edi, dword [eax]
mov eax, dword [esi + 0x30]
cmp eax, edi
je 0x45d180
test edi, edi
je 0x45d180
test eax, eax
jne 0x45d107
mov dword [esi + 0x30], edi
push edi
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
add esp, 4
push eax
push edi
jmp 0x45d167
add ebx, dword [esi + 0x28]
mov ecx, 0
mov eax, dword [esi + 0x2c]
adc eax, ecx
add ebx, dword [ebp + 0xc]
mov dword [esi + 0x20], ebx
adc eax, dword [ebp + 0x10]
mov dword [esi + 0x24], eax
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], 0x1b
mov eax, dword [esi + 0x30]
cmp eax, 0x1b
je 0x45d180
test eax, eax
jne 0x45d159
mov dword [esi + 0x30], 0x1b
push 0x1b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
add esp, 4
push eax
push 0x1b
push str.call_import_system_api_error__errno:__d__errmsg:__s._n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.0045c4f0
add esp, 0x10
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46ab00
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56e82d
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x5bfd00]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp + 8]
mov dword [ebp - 4], 1
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0047d210
lea eax, [ebp + 0x20]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.0047d210
add esp, 0x10
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 7
cmova eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
cmp dword [ebp - 0x2c], 7
lea ecx, [ebp - 0x40]
push 0
cmova ecx, dword [ebp - 0x40]
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 7
push 0
cmova eax, dword [ebp - 0x28]
push ecx
push eax
push 0
call sub.urlmon.dll_URLDownloadToFileW
mov ecx, dword [ebp - 0x2c]
test eax, eax
sete bl
cmp ecx, 7
jbe 0x46abc5
mov edx, dword [ebp - 0x40]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x46abbb
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x46ac8f
push ecx
push edx
call fcn.00563352
add esp, 8
mov ecx, dword [ebp - 0x14]
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
cmp ecx, 7
jbe 0x46ac13
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x46ac09
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x46ac8f
push ecx
push edx
call fcn.00563352
add esp, 8
mov ecx, dword [ebp + 0x1c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp ecx, 0xf
jbe 0x46ac57
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x46ac4d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x46ac8f
push ecx
push edx
call fcn.00563352
add esp, 8
mov ecx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp ecx, 0xf
jbe 0x46ac9f
mov edx, dword [ebp + 0x20]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x46ac95
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x46ac95
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00563352
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00563360
mov esp, ebp
pop ebp
ret 0x30
Function at 0x471e80
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56f4c5
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x5bfd00]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [ebp + 0x1c], 0xf
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
cmova eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x2c]
push str.powershell_Add_MpPreference__ExclusionPath___s_
push eax
call fcn.0045db80
xorps xmm0, xmm0
mov byte [ebp - 4], 2
lea eax, [ebp - 0x2c]
movlpd qword [ebp - 0x94], xmm0
push eax
lea eax, [ebp - 0x44]
movlpd qword [ebp - 0x8c], xmm0
push eax
movlpd qword [ebp - 0x84], xmm0
movlpd qword [ebp - 0x7c], xmm0
movlpd qword [ebp - 0x74], xmm0
movlpd qword [ebp - 0x6c], xmm0
movlpd qword [ebp - 0x64], xmm0
movlpd qword [ebp - 0x5c], xmm0
mov dword [ebp - 0x98], 0x44
call fcn.0047d210
add esp, 0x14
cmp dword [eax + 0x14], 7
jbe 0x471f2c
mov eax, dword [eax]
lea ecx, [ebp - 0x54]
push ecx
lea ecx, [ebp - 0x98]
push ecx
push 0
push 0
push 0x8000000
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [ebp - 0x30]
cmp ecx, 7
jbe 0x471f8b
mov edx, dword [ebp - 0x44]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x471f81
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x471f81
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00563352
add esp, 8
push 0xffffffffffffffff
push dword [ebp - 0x54]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x54]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x18]
cmp ecx, 0xf
jbe 0x471fd8
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x471fce
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x472010
push ecx
push edx
call fcn.00563352
add esp, 8
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
cmp ecx, 0xf
jbe 0x472026
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x47201c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x47201c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
mov eax, 0x471fa8
ret
push ecx
push edx
call fcn.00563352
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00563360
mov esp, ebp
pop ebp
ret 0x18
Function at 0x4720a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56f50d
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x5bfd00]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
push eax
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x58]
push str._LAUNCHER_:_Terminate_Process._Code:__i
push eax
call fcn.0045db80
push eax
mov dword [ebp - 4], 0
call fcn.0048f070
mov ecx, dword [ebp - 0x44]
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
cmp ecx, 0xf
jbe 0x47212d
mov edx, dword [ebp - 0x58]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x472123
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x472123
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00563352
add esp, 8
mov eax, dword [esi]
test eax, eax
je 0x47214f
push dword [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0xffffffffffffffff
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
xorps xmm0, xmm0
mov dword [ebp - 0x30], 0
push 0x59de09
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x2c], 0
movups xmmword [ebp - 0x40], xmm0
call fcn.0040d5d0
push 0x17
xorps xmm0, xmm0
mov dword [ebp - 4], 1
push str.quick_server_connection
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x14], 0
call fcn.0040d5d0
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004899c0
mov ecx, dword [ebp - 0x14]
add esp, 8
cmp ecx, 0xf
jbe 0x4721e2
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4721d8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x47221a
push ecx
push edx
call fcn.00563352
add esp, 8
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
cmp ecx, 0xf
jbe 0x47222a
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x472220
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x472220
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00563352
add esp, 8
push dword [ebp - 0x5c]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00563360
mov esp, ebp
pop ebp
ret 4
Function at 0x478710
Capabilities:
Hash data with md5
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10008
call fcn.00563f70
mov eax, dword [0x5bfd00]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov esi, ecx
mov ecx, dword [ebp + 0xc]
push 0x59eec8
push eax
mov dword [ebp - 0x10008], ecx
call fcn.0047cff0
mov edi, eax
add esp, 8
test edi, edi
je 0x4787f1
push ebx
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
lea eax, [ebp - 0x10004]
push edi
push 0x10000
push 1
push eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
call ebx
add esp, 0x10
test eax, eax
je 0x4787be
push eax
lea eax, [ebp - 0x10004]
mov ecx, esi
push eax
call fcn.0048e6a0
push edi
push 0x10000
lea eax, [ebp - 0x10004]
push 1
push eax
call ebx
add esp, 0x10
test eax, eax
jne 0x478797
mov ecx, esi
call fcn.0047c710
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [ebp - 0x10008]
add esp, 4
movups xmm0, xmmword [esi + 0x58]
pop ebx
pop edi
movups xmmword [eax], xmm0
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00563360
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop esi
call fcn.00563360
mov esp, ebp
pop ebp
ret 8

Function at 0x47a910
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0xf
jbe 0x47a91e
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x47a92e
xor al, al
pop ebp
ret
shr eax, 4
and al, 1
pop ebp
ret

Function at 0x47b990
Capabilities:
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0x14], 0
push esi
mov esi, dword [ebp + 8]
push edi
je 0x47b9b4
cmp dword [esi + 0x14], 0xf
mov eax, esi
jbe 0x47b9a8
mov eax, dword [esi]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cmp dword [esi + 0x14], 0xf
jbe 0x47b9bc
mov esi, dword [esi]
push 0x57bbcc
push esi
call fcn.0047cff0
mov esi, eax
add esp, 8
test esi, esi
jne 0x47b9d6
pop edi
xor al, al
pop esi
pop ebp
ret
mov edi, dword [ebp + 0x10]
push ebx
mov bl, 1
test edi, edi
je 0x47b9f5
push esi
push edi
push 1
push dword [ebp + 0xc]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp eax, edi
sete bl
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
mov al, bl
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x47ba10
Capabilities:
Read file on windows
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10004
call fcn.00563f70
mov eax, dword [0x5bfd00]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [ebp + 0x10], 0
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
je 0x47ba55
push esi
call fcn.00484090
add esp, 4
mov eax, esi
cmp dword [esi + 0x14], 0xf
jbe 0x47ba49
mov eax, dword [esi]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cmp dword [edi + 0x14], 0xf
jbe 0x47ba5d
mov edi, dword [edi]
push 0x59eec8
push edi
call fcn.0047cff0
mov edi, eax
add esp, 8
test edi, edi
je 0x47ba97
cmp dword [esi + 0x14], 0xf
jbe 0x47ba79
mov esi, dword [esi]
push 0x59f884
push esi
call fcn.0047cff0
add esp, 8
mov ebx, eax
push edi
test ebx, ebx
jne 0x47baaa
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00563360
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
lea eax, [ebp - 0x10004]
push 0x10000
push 1
push eax
call esi
add esp, 0x10
test eax, eax
je 0x47baf0
push ebx
push eax
lea eax, [ebp - 0x10004]
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push edi
push 0x10000
lea eax, [ebp - 0x10004]
push 1
push eax
call esi
add esp, 0x20
test eax, eax
jne 0x47bac7
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
push edi
call esi
push ebx
call esi
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
mov al, 1
pop edi
pop esi
pop ebx
call fcn.00563360
mov esp, ebp
pop ebp
ret