joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44c920
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x58777c
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
push esi
mov eax, dword [0x5f4760]
xor eax, esp
push eax
lea eax, [esp + 0x64]
mov dword fs:[0], eax
mov dword [esp + 0x6c], 0
mov edx, dword [esp + 0x74]
mov ecx, dword [edx - 8]
mov eax, 1
sub eax, dword [edx - 4]
or ecx, eax
jge 0x44c96e
xor ecx, ecx
lea eax, [esp + 0x74]
call fcn.00403340
mov edx, dword [esp + 0x74]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x44c99f
mov dword [esp + 0x6c], 0xffffffff
lea eax, [esp + 0x74]
push eax
call fcn.00403090
or eax, 0xffffffff
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x68
ret
lea ecx, [esp + 0xc]
push ecx
call fcn.004534d0
mov byte [esp + 0x6c], 1
mov eax, dword [esp + 0x74]
lea esi, [esp + 0xc]
mov dword [esp + 8], 0xffffffff
call fcn.00453530
test eax, eax
je 0x44c9db
call fcn.00453540
test eax, eax
je 0x44c9db
lea ecx, [esp + 8]
mov eax, esi
call fcn.00453660
mov esi, dword [esp + 8]
mov byte [esp + 0x6c], 0
lea ecx, [esp + 0xc]
call fcn.0043ec60
mov dword [esp + 0x6c], 0xffffffff
lea edx, [esp + 0x74]
push edx
call fcn.00403090
mov eax, esi
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x68
ret

Function at 0x44d190
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x581fe5
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x5f4760]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov esi, dword [esp + 0x18]
push edi
push esi
call fcn.00406380
mov dword [esp + 0x10], 0
lea eax, [edi + 4]
push eax
lea ecx, [esi + 4]
push ecx
call fcn.00406380
mov byte [esp + 0x10], 1
lea edx, [edi + 8]
push edx
lea eax, [esi + 8]
push eax
call fcn.00406380
mov byte [esp + 0x10], 2
lea ecx, [edi + 0xc]
push ecx
lea edx, [esi + 0xc]
push edx
call fcn.00406380
mov byte [esp + 0x10], 3
lea eax, [edi + 0x10]
push eax
lea ecx, [esi + 0x10]
push ecx
call fcn.00406380
mov byte [esp + 0x10], 4
lea edx, [edi + 0x14]
push edx
lea eax, [esi + 0x14]
push eax
call fcn.00406380
mov byte [esp + 0x10], 5
lea ecx, [edi + 0x18]
push ecx
lea edx, [esi + 0x18]
push edx
call fcn.00406380
mov byte [esp + 0x10], 6
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov ecx, dword [edi + 0x20]
mov dword [esi + 0x20], ecx
mov edx, dword [edi + 0x24]
mov dword [esi + 0x24], edx
mov eax, dword [edi + 0x28]
lea ecx, [edi + 0x2c]
push ecx
lea edx, [esi + 0x2c]
push edx
mov dword [esi + 0x28], eax
call fcn.00406380
mov byte [esp + 0x10], 7
mov eax, dword [edi + 0x30]
mov dword [esi + 0x30], eax
mov dword [esp + 0x10], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret 4
Function at 0x44df60
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x58e8d7
mov eax, dword fs:[0]
push eax
sub esp, 0x118
mov eax, dword [0x5f4760]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
mov eax, dword [0x5f4760]
xor eax, esp
push eax
lea eax, [esp + 0x120]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
push eax
push 0x1000
lea eax, [esp + 0x1c]
push eax
push str.null
push str.libdate
push str.360Safe
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [esp + 0x14]
push str.null
push ecx
call fcn.004a47ba
add esp, 8
test eax, eax
je 0x44e036
mov eax, dword [esi]
mov ecx, dword [eax - 0xc]
test ecx, ecx
jge 0x44dfe0
or esi, 0xffffffff
jmp 0x44dffb
push 0x5d8858
push eax
call fcn.004a4912
add esp, 8
test eax, eax
jne 0x44dff7
or esi, 0xffffffff
jmp 0x44dffb
sub eax, dword [esi]
mov esi, eax
lea edx, [esp + 0xc]
push edx
lea ecx, [esp + 0x18]
call fcn.00402fe0
mov dword [esp + 0x128], 0
lea ecx, [esp + 0xc]
call fcn.0044dc80
test eax, eax
jne 0x44e05d
mov dword [esp + 0x128], 0xffffffff
lea eax, [esp + 0xc]
push eax
call fcn.00403090
xor eax, eax
mov ecx, dword [esp + 0x120]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.004a314d
add esp, 0x124
ret
cmp esi, 0xffffffff
je 0x44e0db
lea ecx, [esp + 0x10]
push ecx
call fcn.0044df00
add esp, 4
mov esi, eax
mov byte [esp + 0x128], 1
mov eax, dword [esi]
sub eax, 0x10
mov ecx, 1
sub ecx, dword [eax + 0xc]
mov eax, dword [eax + 8]
or eax, ecx
jge 0x44e096
xor ecx, ecx
mov eax, esi
call fcn.00403340
mov edx, dword [esp + 0xc]
mov ecx, dword [edx - 8]
mov esi, dword [esi]
mov eax, 1
sub eax, dword [edx - 4]
or ecx, eax
jge 0x44e0ba
xor ecx, ecx
lea eax, [esp + 0xc]
call fcn.00403340
mov edx, dword [esp + 0xc]
push esi
push edx
push str.wslib64
push str.cachelibver
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov byte [esp + 0x128], 0
lea edx, [esp + 0x10]
push edx
jmp 0x44e152
lea eax, [esp + 0x10]
push eax
call fcn.0044df00
add esp, 4
mov esi, eax
mov byte [esp + 0x128], 2
mov eax, dword [esi]
sub eax, 0x10
mov ecx, 1
sub ecx, dword [eax + 0xc]
mov eax, dword [eax + 8]
or eax, ecx
jge 0x44e10f
xor ecx, ecx
mov eax, esi
call fcn.00403340
mov edx, dword [esp + 0xc]
mov ecx, dword [edx - 8]
mov esi, dword [esi]
mov eax, 1
sub eax, dword [edx - 4]
or ecx, eax
jge 0x44e133
xor ecx, ecx
lea eax, [esp + 0xc]
call fcn.00403340
mov edx, dword [esp + 0xc]
push esi
push edx
push 0x5d8870
push str.cachelibver
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov byte [esp + 0x128], 0
lea ecx, [esp + 0x10]
push ecx
call fcn.00403090
mov dword [esp + 0x128], 0xffffffff
lea edx, [esp + 0xc]
push edx
call fcn.00403090
mov eax, 1
jmp 0x44e038
Function at 0x44fc60
Capabilities:
Create thread

Disassembly:
push esi
push 0
push str.CNetStatusChecker::Start:_dwWaitTime_u
mov esi, 0x602250
call fcn.00409e30
add esp, 8
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [edi + 4], eax
test eax, eax
je 0x44fcc4
push 0
push 0
push edi
push 0x44fd30
push 0
push 0
call fcn.004a4c67
add esp, 0x18
mov dword [edi + 8], eax
cmp eax, 0xffffffff
je 0x44fcb3
test eax, eax
je 0x44fcb3
mov eax, 1
pop esi
ret
mov eax, dword [edi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 4], 0
xor eax, eax
pop esi
ret

Function at 0x44fef0
Capabilities:
Get file size

Disassembly:
sub esp, 0xc
push ebp
mov ebp, dword [esp + 0x20]
push edi
mov edi, eax
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [esp + 0xc]
xor ecx, ecx
mov dword [esp + 8], eax
cmp edx, ecx
ja 0x44ff27
jb 0x44ff1b
cmp eax, ebx
jae 0x44ff27
mov eax, ebx
mov edx, ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov ecx, dword [esp + 0x20]
push 0
push eax
push edx
push ecx
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [esi + 8], eax
test eax, eax
jne 0x44ff4d
call fcn.00450a30
pop edi
pop ebp
add esp, 0xc
ret 0x10
mov ecx, dword [esp + 0x18]
test ebx, ebx
jne 0x44ff60
mov edx, dword [esp + 8]
sub edx, ecx
mov dword [esi + 4], edx
jmp 0x44ff63
mov dword [esi + 4], ebx
mov edx, dword [esi + 4]
push 0
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0x20]
push edx
mov dword [esi + 0x14], ecx
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0x14]
push ecx
push edx
push ebp
push eax
mov dword [esi + 0x18], ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
mov dword [esi], eax
test eax, eax
jne 0x44ffae
call fcn.00450a30
mov edi, eax
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0
mov eax, edi
pop edi
pop ebp
add esp, 0xc
ret 0x10
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 0x10
Function at 0x4500b0
Capabilities:
Access peb ldr_data
Get system information on windows

Disassembly:
push 0xffffffffffffffff
push 0x5849a6
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
push edi
mov eax, dword [0x5f4760]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov esi, dword [esp + 0x44]
lea eax, [esi + 8]
xor edi, edi
mov dword [esi], vtable.FastFileIO.0
mov dword [esp + 0xc], eax
mov dword [eax], edi
mov dword [esp + 0x3c], 1
lea eax, [esi + 0x10]
mov dword [esp + 0xc], eax
mov dword [eax], edi
mov dword [eax + 8], edi
mov byte [esp + 0x3c], 3
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov byte [esp + 0x3c], 4
mov dword [esi + 0x50], vtable.RWLock.0
lea eax, [esi + 0x5c]
mov dword [esi + 0x54], edi
push eax
mov dword [esi + 0x58], edi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push edi
push 1
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push eax
mov dword [esi + 0x74], eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov byte [esp + 0x3c], 5
lea eax, [esi + 0x80]
mov dword [esp + 0xc], eax
mov dword [eax], edi
mov dword [eax + 8], edi
mov byte [esp + 0x3c], 7
lea ecx, [esi + 0xa0]
push ecx
call fcn.004030f0
mov byte [esp + 0x3c], 8
lea edx, [esp + 0x10]
push edx
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x2c]
cmp eax, edi
ja 0x45018f
mov eax, 0x10000
mov dword [esi + 0x78], eax
mov dword [esi + 0x7c], edi
mov dword [esp + 0x3c], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x34
ret 4
Function at 0x4542a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x582fa9
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5f4760]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1c]
push edi
mov esi, 5
call fcn.00454650
mov dword [esp + 0x14], 0
mov eax, 0x601e80
mov dword [edi], vtable.TiXmlDeclaration.0
mov dword [edi + 0x2c], eax
mov byte [esp + 0x14], 1
mov dword [edi + 0x30], eax
mov byte [esp + 0x14], 2
mov dword [edi + 0x34], eax
mov dword [esp + 0x14], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4

Function at 0x454ef0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
mov edi, eax
test ebp, ebp
jne 0x454f0f
push ebp
push ebp
push ebp
push edi
lea eax, [ebp + 2]
call fcn.00456700
pop edi
xor al, al
pop ebp
ret 4
push ebx
call fcn.004547d0
push 2
or eax, 0xffffffff
push 0
push ebp
mov dword [edi + 8], eax
mov dword [edi + 4], eax
call fcn.004a3eca
push ebp
call fcn.004a73d2
push 0
push 0
push ebp
mov ebx, eax
call fcn.004a3eca
add esp, 0x1c
test ebx, ebx
jg 0x454f5a
push 0
push 0
push 0
push edi
mov eax, 0xc
call fcn.00456700
pop ebx
pop edi
xor al, al
pop ebp
ret 4
lea eax, [ebx + 1]
push esi
push eax
call fcn.004a3245
push ebp
push 1
mov esi, eax
push ebx
push esi
mov byte [esi], 0
call fcn.004a3d30
add esp, 0x14
cmp eax, 1
je 0x454f9e
push esi
call fcn.004a3142
add esp, 4
push 0
push 0
push 0
push edi
mov eax, 2
call fcn.00456700
pop esi
pop ebx
pop edi
xor al, al
pop ebp
ret 4
mov byte [esi + ebx], 0
cmp byte [esi], 0
mov eax, esi
mov ecx, esi
je 0x454fcc
jmp 0x454fb0
mov dl, byte [eax]
cmp dl, 0xd
jne 0x454fc3
mov byte [ecx], 0xa
inc eax
inc ecx
cmp byte [eax], 0xa
jne 0x454fc7
jmp 0x454fc6
mov byte [ecx], dl
inc ecx
inc eax
cmp byte [eax], 0
jne 0x454fb0
push 0
mov byte [ecx], 0
mov edx, dword [edi]
mov eax, dword [edx + 8]
push 0
push esi
mov ecx, edi
call eax
push esi
call fcn.004a3142
add esp, 4
pop esi
xor eax, eax
cmp byte [edi + 0x2c], al
pop ebx
pop edi
sete al
pop ebp
ret 4

Function at 0x457770
Capabilities:
Create thread

Disassembly:
lea eax, [esi + 8]
push eax
push 4
push esi
push 0x4577a0
push 0
push 0
call fcn.004a4c67
add esp, 0x18
test eax, eax
mov dword [esi + 4], eax
setne al
ret

Function at 0x4577d0
Capabilities:
Resume thread

Disassembly:
mov eax, dword [eax + 4]
test eax, eax
je 0x4577c6
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x4577c6
mov al, 1
ret
xor al, al
ret
push esi
mov esi, eax
call fcn.00457770
test al, al
jne 0x4577de
pop esi
ret
mov eax, esi
pop esi
jmp 0x4577b0
Function at 0x457850
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5884ea
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x5f4760]
xor eax, esp
mov dword [esp + 0x10], eax
push ebp
push esi
mov eax, dword [0x5f4760]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
xor esi, esi
mov dword [esp + 0x28], esi
push edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], esi
call fcn.004030f0
mov dword [esp + 0x28], esi
mov dword [esp + 0xc], 1
test ebp, ebp
jle 0x4578eb
jmp 0x4578b0
movzx eax, byte [ebx + esi]
push eax
lea ecx, [esp + 0x18]
push str._02X
push ecx
call fcn.004a4097
lea eax, [esp + 0x20]
add esp, 0xc
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4578d0
sub eax, edx
lea edx, [esp + 0x14]
push edx
push edi
mov edx, eax
call fcn.00403150
inc esi
cmp esi, ebp
jl 0x4578b0
mov eax, edi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.004a314d
add esp, 0x20
ret

Function at 0x4591f0
Capabilities:
Hash data using sha1

Disassembly:
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x18], ecx
mov dword [eax + 0x14], ecx
ret

Function at 0x459480
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x581eca
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x5f4760]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov dword [esp + 0x38], 0
mov ecx, dword [esp + 0x40]
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
lea eax, [esp + 0xc]
push eax
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
test eax, eax
jne 0x459511
mov dword [esp + 0x38], 0xffffffff
lea edx, [esp + 0x40]
push edx
call fcn.00403090
xor eax, eax
xor edx, edx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x38], 0xffffffff
lea eax, [esp + 0x40]
push eax
call fcn.00403090
mov eax, edi
mov edx, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret
Function at 0x45bc30
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
mov ebx, eax
mov dword [esi], 0
mov edi, edi
mov eax, dword [esi]
mov edx, dword [ebp + 0x14]
mov ecx, edi
sub ecx, eax
push ecx
add eax, ebx
push eax
push edx
call fcn.004b0fdc
add esp, 0xc
test eax, eax
jle 0x45bc62
add dword [esi], eax
cmp dword [esi], edi
jb 0x45bc40
test eax, eax
jge 0x45bc86
call fcn.004a836a
mov eax, dword [eax]
push eax
call fcn.004a82bc
mov ebx, eax
add esp, 4
or eax, 0xffffffff
mov ecx, ebp
call fcn.0045bb40
pop ebp
or eax, 0xffffffff
pop ebx
ret
test eax, eax
jne 0x45bc91
mov dword [ebp + 0x40], 1
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x460990
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x58d05b
mov eax, dword fs:[0]
push eax
sub esp, 0x11c
mov eax, dword [0x5f4760]
xor eax, esp
mov dword [esp + 0x118], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5f4760]
xor eax, esp
push eax
lea eax, [esp + 0x130]
mov dword fs:[0], eax
push 0x603ce8
xor ebx, ebx
mov dword [esp + 0x1c], 0x603ce8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0x138], ebx
cmp dword [0x603d18], ebx
je 0x460add
mov eax, dword [0x603d14]
mov edi, dword [eax]
mov eax, dword [0x603d00]
test eax, eax
jne 0x460b24
call fcn.004a35f3
xor eax, eax
cmp edi, dword [eax + 0x14]
jne 0x460a18
call fcn.004a35f3
push 0
call fcn.004a4642
mov esi, dword [0x603ce4]
mov ecx, dword [edi + 0x14]
xor ebp, ebp
add esp, 4
add esi, dword [edi + 0x10]
adc ecx, ebp
cmp ecx, edx
jg 0x460add
jl 0x460a44
cmp esi, eax
jae 0x460add
mov ecx, dword [0x603dfc]
push 0x103
push ecx
lea edx, [esp + 0x2c]
push edx
call fcn.004a5b40
mov edi, dword [edi + 8]
add esp, 0xc
push edi
lea eax, [esp + 0x28]
push eax
mov byte [esp + 0x12f], 0
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x460aad
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 1
je 0x460aa2
push 0x80
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [0x603d14]
mov eax, dword [edx]
mov ecx, dword [0x603d00]
push eax
push ecx
lea ebx, [esp + 0x24]
mov edi, 0x603d00
call fcn.00460db0
cmp dword [0x603d18], 0
mov ebx, 1
jne 0x4609f3
mov dword [esp + 0x138], 0xffffffff
push 0x603ce8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
je 0x460afc
call fcn.00460b30
mov ecx, dword [esp + 0x130]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x118]
xor ecx, esp
call fcn.004a314d
add esp, 0x128
ret
mov eax, dword [eax]
jmp 0x460a0e
Function at 0x460b30
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x58d028
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5f4760]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
push 0x603ce8
mov dword [esp + 0x1c], 0x603ce8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0x24], 0
mov eax, dword [0x603d1c]
push 0
push 0x80
push 2
push 0
push 1
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x460bb5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Could_not_open_file__error__d__n
mov esi, 0x602250
call fcn.00409e30
add esp, 8
jmp 0x460c9d
cmp dword [0x603d18], 0
je 0x460c96
mov ecx, dword [0x603d14]
mov esi, dword [ecx]
mov edi, dword [0x603d00]
mov ebx, dword [0x603d14]
test edi, edi
je 0x460be2
cmp edi, dword [0x603d00]
je 0x460be7
call fcn.004a35f3
cmp esi, ebx
je 0x460c96
mov dword [esp + 0x14], 0
test edi, edi
jne 0x460c71
call fcn.004a35f3
xor eax, eax
cmp esi, dword [eax + 0x14]
jne 0x460c0c
call fcn.004a35f3
mov edx, dword [esi + 8]
mov ebx, dword [edx - 0xc]
test edi, edi
jne 0x460c75
call fcn.004a35f3
xor eax, eax
cmp esi, dword [eax + 0x14]
jne 0x460c27
call fcn.004a35f3
mov eax, dword [esi + 8]
push 0
lea ecx, [esp + 0x18]
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
push ebp
call ebx
test eax, eax
je 0x460c7d
push 0
lea edx, [esp + 0x18]
push edx
push 2
push 0x5d2c30
push ebp
call ebx
test eax, eax
je 0x460c7d
test edi, edi
jne 0x460c79
call fcn.004a35f3
xor eax, eax
cmp esi, dword [eax + 0x14]
jne 0x460c6a
call fcn.004a35f3
mov esi, dword [esi]
jmp 0x460bd0
mov eax, dword [edi]
jmp 0x460c02
mov eax, dword [edi]
jmp 0x460c1d
mov eax, dword [edi]
jmp 0x460c60
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Could_not_write_to_file__error__d__n
mov esi, 0x602250
call fcn.00409e30
add esp, 8
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x24], 0xffffffff
push 0x603ce8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x4622a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
cmp dword [eax + 0x18], 0x10
push esi
jb 0x4622ac
mov ecx, dword [eax + 4]
jmp 0x4622af
lea ecx, [eax + 4]
mov edx, dword [eax + 0x14]
add edx, ecx
mov eax, 0x811c9dc5
cmp ecx, edx
je 0x4622d0
lea ecx, [ecx]
movsx esi, byte [ecx]
imul eax, eax, 0x1000193
inc ecx
xor eax, esi
cmp ecx, edx
jne 0x4622c0
and eax, 0x7fffffff
push 0x1f31d
push eax
call fcn.004a867a
imul eax, eax, 0xb14
imul edx, edx, 0x41a7
add esp, 8
sub edx, eax
mov eax, edx
jns 0x4622fa
add eax, 0x7fffffff
pop esi
ret
Function at 0x462e90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x58bb1e
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
mov eax, dword [0x5f4760]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
lea eax, [esp + 0x10]
push eax
call fcn.0043df10
xor ebx, ebx
mov dword [esp + 0x38], ebx
lea ecx, [esp + 0xc]
push ecx
call fcn.004030f0
mov byte [esp + 0x38], 1
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x48]
lea ecx, [esp + 0x10]
call fcn.00462a20
test eax, eax
jne 0x462f1e
mov byte [esp + 0x38], bl
lea eax, [esp + 0xc]
push eax
call fcn.00403090
mov dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 0x10]
push ecx
call fcn.0043deb0
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop ebx
add esp, 0x34
ret 8
mov ebx, dword [esp + 0x40]
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x10]
call fcn.00462e20
test eax, eax
jne 0x462f69
mov byte [esp + 0x38], al
lea eax, [esp + 0xc]
push eax
call fcn.00403090
mov dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 0x10]
push ecx
call fcn.0043d660
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop ebx
add esp, 0x34
ret 8
mov byte [esp + 0x38], 0
lea edx, [esp + 0xc]
push edx
call fcn.00403090
mov dword [esp + 0x38], 0xffffffff
lea eax, [esp + 0x10]
push eax
call fcn.0043d660
mov eax, 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop ebx
add esp, 0x34
ret 8
Function at 0x465650
Capabilities:
Set socket configuration

Disassembly:
sub esp, 8
push esi
mov esi, eax
xor eax, eax
cmp dword [esi + 0x41c], eax
push 4
lea ecx, [esp + 0xc]
push ecx
setne al
push 8
push 0xffff
push edi
mov dword [esp + 0x1c], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jge 0x46568c
push edi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
call fcn.00475a40
add esp, 8
pop esi
add esp, 8
ret