joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439c70
Capabilities:
Create process on windows

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x539708
push 0x524140
push eax
mov dword fs:[0], esp
sub esp, 0x74
mov dword [ebp - 0x24], 0xffffffff
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ebx
push 0x800
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
mov esi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
call esi
mov dword [ebp - 0x1c], eax
push 0x400
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call esi
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], ebx
je 0x439dd8
cmp eax, ebx
je 0x439dd8
lea edi, [ebp - 0x84]
xor eax, eax
mov ecx, 0x11
rep stosd dword es:[edi], eax
mov dword [ebp - 0x84], 0x44
mov eax, dword [ebp - 0x1c]
mov byte [eax], bl
push 0x400
mov eax, dword [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.MSVCR80.dll_strrchr]
add esp, 8
test eax, eax
je 0x439d25
mov byte [eax], bl
mov eax, dword [ebp - 0x20]
push eax
push str._sCNIDSK16.EXE
mov edi, dword [ebp - 0x1c]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
mov eax, dword [ebp - 0x1c]
lea eax, [ecx + eax - 1]
push eax
call dword [sym.imp.MSVCR80.dll_sprintf]
add esp, 0xc
mov esi, 1
cmp esi, dword [ebp + 8]
jge 0x439d8d
mov eax, dword [ebp + 0xc]
lea ebx, [eax + esi*4]
mov eax, dword [ebx]
push eax
push 0x54aaac
mov edi, dword [ebp - 0x1c]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
mov eax, dword [ebp - 0x1c]
lea eax, [ecx + eax - 1]
push eax
call dword [sym.imp.MSVCR80.dll_sprintf]
add esp, 0xc
add ebx, 4
inc esi
cmp esi, dword [ebp + 8]
jl 0x439d5d
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x84]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x1c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x439dd8
push 0xffffffffffffffff
mov eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x439dd8
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0xffffffff
call fcn.00439df8
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
pop edi
mov dword fs:[0], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43c230
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x48
mov dword [esp], 0
push ebx
push esi
push edi
push ebp
mov edi, dword [esp + 0x5c]
test edi, edi
je 0x43c263
cmp edi, 2
je 0x43c263
cmp edi, 3
je 0x43c263
cmp edi, 4
je 0x43c263
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x48
ret
mov esi, dword [esp + 0x60]
cmp dword [esi + 0x14], 0
jne 0x43c27f
cmp edi, 4
je 0x43c27f
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x48
ret
test edi, edi
jne 0x43c28d
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x48
ret
cmp dword [0x54b100], 1
jne 0x43c328
mov eax, dword [esi]
lea edx, [esp + 0x18]
add al, 0x41
movsx ecx, al
push ecx
push str.._c:
push edx
call dword [sym.imp.MSVCR80.dll_sprintf]
add esp, 0xc
lea ecx, [esp + 0x18]
push 0
push 0x10000000
push 3
push 0
push 3
push 0xc0000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x54b104], eax
cmp eax, 0xffffffff
jne 0x43c2e9
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x48
ret
lea eax, [esp + 0x10]
push 0
push eax
mov ecx, dword [0x54b104]
push 0x18
push 0x563e60
push 0
push 0
push 0x70000
push ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x43c31e
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x48
ret
mov dword [0x54b100], 0
cmp edi, 2
je 0x43c332
cmp edi, 3
jne 0x43c370
mov eax, dword [esi + 8]
mov ebx, dword [esi + 0x10]
imul eax, dword [0x563e6c]
add eax, dword [esi + 4]
push 0
imul eax, dword [0x563e70]
add eax, dword [esi + 0xc]
push 0
dec eax
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
imul ebx, dword [0x563e74]
imul eax, dword [0x563e74]
push eax
mov eax, dword [0x54b104]
push eax
call ebp
jmp 0x43c374
mov ebx, dword [esp + 0x18]
cmp edi, 4
jne 0x43c3dc
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, eax
test ebp, ebp
jne 0x43c39c
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x48
ret
lea eax, [esp + 0x10]
push 0
push eax
mov ecx, dword [0x54b104]
push ebx
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [esp + 0x14], eax
push ebp
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
mov ebp, dword [sym.imp.KERNEL32.dll_HeapFree]
call ebp
cmp dword [esp + 0x14], 0
jne 0x43c3dc
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x48
ret
cmp edi, 2
jne 0x43c40b
lea eax, [esp + 0x10]
push 0
push eax
mov ecx, dword [esi + 0x14]
push ebx
mov edx, dword [0x54b104]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x43c40b
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x48
ret
cmp edi, 3
jne 0x43c43a
lea eax, [esp + 0x10]
push 0
push eax
mov ecx, dword [esi + 0x14]
push ebx
mov edx, dword [0x54b104]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x43c43a
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x48
ret
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x48
ret
Function at 0x464cf0
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
mov esi, eax
test esi, esi
push edi
mov edi, ecx
jbe 0x464d18
lea ebx, [ebx]
push 0
push esi
push edi
push ebx
call sub.WSOCK32.dll_send
test eax, eax
jl 0x464d1d
jle 0x464d14
sub esi, eax
add edi, eax
test esi, esi
ja 0x464d00
pop edi
xor eax, eax
pop esi
ret
pop edi
mov eax, 0x1e14
pop esi
ret

Function at 0x464d30
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 8
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test eax, eax
mov dword [esp + 0xc], eax
fild dword [esp + 0xc]
jge 0x464d52
fadd qword [0x52f6c8]
fmul qword [0x528338]
mov esi, dword [sym.imp.MSVCR80.dll__errno]
or edi, 0xffffffff
fstp qword [esp + 0xc]
call esi
mov dword [eax], 0xb
call esi
cmp dword [eax], 0xb
jne 0x464dec
test edi, edi
jge 0x464e6b
call fcn.00464cd0
fsub qword [esp + 0xc]
fld qword [0x53bc00]
fcom st(1)
fnstsw ax
test ah, 5
jnp 0x464e25
fcompp
fnstsw ax
test ah, 5
jp 0x464dae
cmp dword [0x571234], 0
je 0x464e64
call esi
mov ecx, dword [esp + 0x18]
push ebp
mov dword [eax], 0
mov eax, dword [esp + 0x20]
push eax
push ecx
push ebx
call sub.WSOCK32.dll_recv
mov edi, eax
test edi, edi
jge 0x464de1
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x464de1
call esi
mov dword [eax], 0xb
call esi
cmp dword [eax], 0xb
je 0x464d74
test edi, edi
jge 0x464e6b
call esi
mov ecx, dword [eax]
push ecx
push str.problema_grosso_grosso:_errno_d_n
call dword [sym.imp.MSVCR80.dll___iob_func]
add eax, 0x40
push eax
call dword [sym.imp.MSVCR80.dll_fprintf]
add esp, 0xc
push 2
push ebx
call sub.WSOCK32.dll_shutdown
pop edi
pop esi
or eax, 0xffffffff
mov dword [0x571234], 0
pop ebp
add esp, 8
ret
fstp st(1)
fstp st(0)
call esi
mov edx, dword [eax]
push edx
push 0x78
push str.scaduto_timeout_di__d_sec._:_errno_d_n
call dword [sym.imp.MSVCR80.dll___iob_func]
add eax, 0x40
push eax
call dword [sym.imp.MSVCR80.dll_fprintf]
add esp, 0x10
push 2
push ebx
call sub.WSOCK32.dll_shutdown
pop edi
pop esi
or eax, 0xffffffff
mov dword [0x571234], 0
pop ebp
add esp, 8
ret
call esi
mov eax, dword [eax]
push eax
jmp 0x464e2e
mov eax, edi
pop edi
pop esi
mov dword [0x571234], 0
pop ebp
add esp, 8
ret

Function at 0x464fb0
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push edi
mov edi, 1
push 2
mov ebx, eax
lea eax, [esp + 0x13]
push edi
push eax
mov dword [0x571234], edi
call fcn.00464d30
add esp, 0xc
test eax, eax
jle 0x46502a
mov ebp, dword [sym.imp.MSVCR80.dll_fwrite]
jmp 0x464fe0
push 0
push 0x400
push esi
mov dword [0x571234], edi
call fcn.00464d30
add esp, 0xc
test eax, eax
jle 0x465031
mov ecx, dword [esp + 0x14]
push ecx
push eax
push edi
push esi
call ebp
add esp, 0x10
cmp eax, 0xffffffff
je 0x46503b
test eax, eax
je 0x46503b
push 2
lea edx, [esp + 0x13]
push edi
push edx
mov dword [0x571234], edi
call fcn.00464d30
add esp, 0xc
test eax, eax
jg 0x464fe0
pop edi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
pop edi
pop ebp
mov eax, 0x1d4c
pop ebx
pop ecx
ret
pop edi
pop ebp
mov eax, 0x1c84
pop ebx
pop ecx
ret
Function at 0x465050
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x40c
mov eax, dword [0x5627bc]
xor eax, esp
mov dword [esp + 0x408], eax
mov eax, dword [esp + 0x410]
push ebx
push ebp
push esi
mov ebp, 1
push 2
mov ebx, ecx
lea ecx, [esp + 0x13]
push ebp
push ecx
mov dword [esp + 0x1c], eax
mov dword [0x571234], ebp
call fcn.00464d30
add esp, 0xc
test eax, eax
jle 0x465101
push 0
push 0x400
push edi
mov dword [0x571234], ebp
call fcn.00464d30
add esp, 0xc
test eax, eax
jle 0x46511b
xor esi, esi
xor edx, edx
test eax, eax
jle 0x4650c9
mov cl, byte [edi + edx]
cmp cl, 0xd
je 0x4650c3
mov byte [esp + esi + 0x14], cl
add esi, ebp
add edx, ebp
cmp edx, eax
jl 0x4650b5
mov edx, dword [esp + 0x10]
push edx
push esi
lea eax, [esp + 0x1c]
push ebp
push eax
call dword [sym.imp.MSVCR80.dll_fwrite]
add esp, 0x10
cmp eax, 0xffffffff
je 0x465138
test eax, eax
je 0x465138
push 2
lea ecx, [esp + 0x13]
push ebp
push ecx
mov dword [0x571234], ebp
call fcn.00464d30
add esp, 0xc
test eax, eax
jg 0x465093
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x408]
xor ecx, esp
call fcn.00523ce0
add esp, 0x40c
ret
pop esi
pop ebp
mov eax, 0x1bbc
pop ebx
mov ecx, dword [esp + 0x408]
xor ecx, esp
call fcn.00523ce0
add esp, 0x40c
ret
mov ecx, dword [esp + 0x414]
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 0x1c20
call fcn.00523ce0
add esp, 0x40c
ret

Function at 0x465160
Capabilities:
Read and send data from client to server
Read file on windows
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
push edi
jmp 0x465170
mov eax, dword [esp + 0x14]
push eax
push 0x400
push 1
push ebx
call dword [sym.imp.MSVCR80.dll_fread]
add esp, 0x10
cmp eax, 0xffffffff
je 0x4651af
test eax, eax
je 0x4651af
mov edi, ebx
mov esi, eax
jbe 0x465170
push 0
push esi
push edi
push ebp
call sub.WSOCK32.dll_send
test eax, eax
jl 0x465170
jle 0x4651a9
sub esi, eax
add edi, eax
test esi, esi
ja 0x465195
jmp 0x465170
push ebp
call sub.WSOCK32.dll_closesocket
pop edi
pop esi
xor eax, eax
pop ebp
ret
Function at 0x466310
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x538
mov eax, dword [0x5627bc]
xor eax, esp
mov dword [esp + 0x534], eax
push ebx
push esi
push edi
push 0x131
lea eax, [esp + 0x11]
push 0
push eax
mov byte [esp + 0x18], 0
call sub.MSVCR80.dll_memset
mov esi, dword [sym.imp.MSVCR80.dll__errno]
add esp, 0xc
call esi
mov ebx, dword [esp + 0x548]
cmp ebx, 0xffffffff
mov dword [eax], 0
jne 0x466365
mov eax, dword [0x54c0e8]
cmp eax, ebx
je 0x466365
mov ebx, eax
push 0
push 0x64
lea ecx, [esp + 0x148]
push ecx
push ebx
mov dword [0x5711e8], 7
call sub.WSOCK32.dll_recv
mov al, byte [0x53bc5c]
mov edx, dword [str.QUIT]
mov byte [esp + 0x10], al
lea eax, [esp + 0xc]
mov dword [esp + 0xc], edx
add eax, 0xffffffff
jmp 0x4663a0
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x4663a0
mov cx, word [0x53bc0c]
mov dl, byte [0x53bc0e]
mov word [eax], cx
mov byte [eax + 2], dl
lea eax, [esp + 0xc]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4663c4
sub eax, edx
lea ecx, [esp + 0xc]
call fcn.00464cf0
mov edi, eax
call esi
test edi, edi
jle 0x466416
mov eax, dword [eax]
push ebx
mov dword [0x5711ec], eax
call sub.WSOCK32.dll_closesocket
mov eax, 0xffffffdb
sub eax, edi
pop edi
pop esi
mov dword [0x54c0e8], 0xffffffff
pop ebx
mov ecx, dword [esp + 0x534]
xor ecx, esp
call fcn.00523ce0
add esp, 0x538
ret
mov ecx, dword [eax]
mov dword [0x5711ec], ecx
call esi
push ebx
mov dword [eax], 0
call sub.WSOCK32.dll_closesocket
mov edi, eax
mov dword [0x54c0e8], 0xffffffff
call esi
mov edx, dword [eax]
mov ecx, dword [esp + 0x540]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
mov dword [0x5711ec], edx
call fcn.00523ce0
add esp, 0x538
ret
Function at 0x46f9a0
Capabilities:
Enumerate pe sections

Disassembly:
mov al, byte [esp + 0x1c]
mov edx, dword [esp + 0x18]
test al, al
mov eax, dword [esp + 0x24]
sete cl
and eax, 0xff
sub eax, 0
je 0x46f9d7
dec eax
je 0x46f9c7
dec eax
jne 0x46f9e8
test cl, cl
je 0x46f9e8
jmp 0x46f9db
mov cx, word [esp + 0x14]
mov eax, edx
shr cx, 1
sar eax, 1
sub ecx, eax
jmp 0x46f9e1
test cl, cl
jne 0x46f9e8
mov ecx, dword [esp + 0x14]
sub ecx, edx
mov eax, dword [esp + 0xc]
add word [eax], cx
mov eax, dword [esp + 0x20]
push esi
test eax, eax
je 0x46fa42
mov ecx, dword [esp + 0x30]
cmp dword [ecx], 0
jne 0x46fa42
xor esi, esi
mov si, word [eax + 4]
cmp edx, esi
jg 0x46fa21
movsx esi, word [eax + 2]
xor edx, edx
push edi
mov dx, word [eax + 6]
mov edi, dword [esp + 0x30]
add edx, esi
movsx esi, word [esp + 0x18]
add esi, edi
pop edi
cmp esi, edx
jle 0x46fa42
push 3
push 1
push eax
mov eax, dword [esp + 0x18]
mov dword [ecx], 1
mov ecx, dword [esp + 0x14]
push 0
push 0
push eax
push ecx
call sub.XLIB.dll_Ordinal_203
add esp, 0x1c
pop esi
ret
Function at 0x4c6320
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
xor eax, eax
xor ecx, ecx
mov cx, word [esi + 0x2c]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov ax, word [esi + 0x2e]
add eax, ecx
mov ecx, dword [esi + 0x7c]
xor edx, edx
xor ebp, ebp
mov dx, word [ecx + 6]
push edi
mov dword [esp + 0x2c], edx
mov bp, word [ecx + 8]
xor edi, edi
add ebp, edx
mov di, word [ecx + 4]
xor edx, edx
mov dword [esp + 0x18], edi
mov dx, word [ecx + 0xc]
add edx, edi
xor edi, edi
mov di, word [ecx + 0xa]
add ebp, eax
mov ebx, edi
xor edi, edi
mov di, word [esi + 0x20]
add edx, eax
sub edi, ebx
mov ebx, dword [esp + 0x2c]
sub edi, ebx
mov ebx, 0
sub edi, ebp
sub edi, eax
sets bl
dec ebx
and edi, ebx
xor ebx, ebx
mov bx, word [ecx + 0xe]
xor ecx, ecx
mov cx, word [esi + 0x22]
sub ecx, ebx
mov ebx, dword [esp + 0x18]
sub ecx, ebx
sub ecx, edx
sub ecx, eax
mov eax, 0
sets al
dec eax
and ecx, eax
movsx eax, word [esi + 0x1c]
add ebp, eax
movsx eax, word [esi + 0x1e]
add edx, eax
mov eax, dword [esi + 4]
mov al, byte [eax + 0x14]
and al, 4
je 0x4c63cf
mov ebx, dword [esi + 0x60]
jmp 0x4c63d5
mov ebx, dword [esi + 8]
mov ebx, dword [ebx + 0x60]
test al, al
je 0x4c63de
mov eax, dword [esi + 0x58]
jmp 0x4c63e4
mov eax, dword [esi + 8]
mov eax, dword [eax + 0x58]
mov eax, dword [eax + 4]
push 0
push ecx
push edi
push edx
push ebp
push ebx
push eax
call sub.XLIB.dll_Ordinal_90
mov edx, dword [esi + 4]
mov ecx, dword [esi + 0x5c]
add esp, 0x1c
mov al, byte [edx + 0x14]
test al, 2
je 0x4c6412
mov dl, byte [esi + 0x27]
test dl, dl
je 0x4c6412
mov dl, byte [esi + 0x28]
test dl, dl
jne 0x4c641b
mov edx, dword [esi + 0x60]
test edx, edx
je 0x4c641b
mov ecx, edx
cmp ecx, 2
je 0x4c645f
test al, 4
je 0x4c6429
mov eax, dword [esi + 0x58]
jmp 0x4c642f
mov edx, dword [esi + 8]
mov eax, dword [edx + 0x58]
lea edx, [esp + 0x2c]
mov eax, dword [eax + 4]
push edx
lea edx, [esp + 0x1c]
push edx
lea edx, [esp + 0x18]
push edx
lea edx, [esp + 0x20]
push edx
lea edx, [esp + 0x2c]
push edx
lea edx, [esp + 0x34]
push edx
lea edx, [esp + 0x3c]
push edx
push ecx
push eax
call sub.XLIB.dll_Ordinal_462
add esp, 0x24
mov ecx, dword [esp + 0x10]
xor eax, eax
mov ax, word [esi + 0x22]
mov bp, word [esi + 0x72]
sub eax, ecx
mov di, word [esi + 0x6e]
shr eax, 1
mov edx, 0
mov bx, word [esi + 0x70]
sets dl
dec edx
mov word [esi + 0x72], cx
mov ecx, dword [esp + 0x34]
and edx, eax
mov ax, word [esp + 0x14]
mov word [esi + 0x6e], dx
mov edx, dword [esp + 0x30]
push ecx
push edx
push esi
mov word [esi + 0x70], ax
call dword [0x553cfc]
add esp, 0xc
mov word [esi + 0x6e], di
mov word [esi + 0x70], bx
mov word [esi + 0x72], bp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x4e07a0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push 0x55df44
push eax
xor esi, esi
call dword [sym.imp.MSVCR80.dll_fopen]
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x4e0812
push ebp
mov ebp, dword [sym.imp.MSVCR80.dll_fread]
push edi
mov edi, dword [esp + 0x18]
mov dword [edi], esi
mov edx, dword [edi]
lea ecx, [esi + 0x800]
push ecx
push edx
call sub.HCLXT.dll_Ordinal_130
mov dword [edi], eax
push ebx
push 0x800
add eax, esi
push 1
push eax
call ebp
add esp, 0x18
add esi, eax
cmp eax, 0x800
je 0x4e07cb
mov eax, dword [edi]
inc esi
push esi
mov byte [eax + esi - 1], 0
mov ecx, dword [edi]
push ecx
call sub.HCLXT.dll_Ordinal_130
add esp, 8
mov dword [edi], eax
mov al, 1
pop edi
pop ebp
pop esi
pop ebx
ret
pop esi
xor al, al
pop ebx
ret
Function at 0x523120
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
test eax, eax
push ebp
je 0x523143
push 0
push 0
push eax
mov ebp, eax
mov dword [esp + 0x18], 0
call dword [sym.imp.MSVCR80.dll_fseek]
add esp, 0xc
jmp 0x523172
mov eax, dword [esp + 8]
push 0x525ca8
push eax
call fcn.00522f10
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x52316a
call fcn.005225b0
mov dword [eax], 0x28e
xor eax, eax
pop ebp
ret
mov dword [esp + 0xc], 1
push ebx
push esi
push edi
push ebp
call dword [sym.imp.MSVCR80.dll__fileno]
push eax
call dword [sym.imp.MSVCR80.dll__filelength]
mov ecx, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
mov esi, eax
mov eax, dword [ecx]
lea edx, [esi + 1]
add esp, 8
cmp edx, eax
jbe 0x5231c0
push eax
mov eax, dword [edi]
lea ebx, [esi + 0x81]
push ebx
push eax
call fcn.00522910
add esp, 0xc
test eax, eax
mov dword [edi], eax
jne 0x5231ba
mov ecx, dword [esp + 0x20]
mov dword [ecx], eax
jmp 0x52320a
mov edx, dword [esp + 0x20]
mov dword [edx], ebx
test esi, esi
jbe 0x5231e2
mov eax, dword [edi]
push ebp
push esi
push 1
push eax
call dword [sym.imp.MSVCR80.dll_fread]
add esp, 0x10
test eax, eax
je 0x5231ff
cmp eax, esi
jg 0x5231ff
mov ecx, dword [edi]
mov byte [eax + ecx], 0
cmp dword [esp + 0x18], 0
mov edx, dword [edi]
mov byte [esi + edx], 0
je 0x5231f8
push ebp
call fcn.00522fc0
add esp, 4
mov eax, dword [edi]
pop edi
pop esi
pop ebx
pop ebp
ret
call fcn.005225b0
mov dword [eax], 0x292
cmp dword [esp + 0x18], 0
je 0x52321a
push ebp
call fcn.00522fc0
add esp, 4
pop edi
pop esi
pop ebx
xor eax, eax
pop ebp
ret

Function at 0x523590
Capabilities:
Write file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
xor ebx, ebx
test ebp, ebp
jne 0x5235ac
call fcn.005225b0
pop ebp
mov dword [eax], 0x65
xor eax, eax
pop ebx
ret
mov eax, dword [esp + 0xc]
push edi
push 0x525c24
push eax
call fcn.00522f10
mov edi, eax
add esp, 8
test edi, edi
jne 0x5235d6
call fcn.005225b0
pop edi
pop ebp
mov dword [eax], 0x28e
xor eax, eax
pop ebx
ret
push esi
mov esi, dword [esp + 0x1c]
test esi, esi
jle 0x5235ef
push edi
push esi
push 1
push ebp
call dword [sym.imp.MSVCR80.dll_fwrite]
add esp, 0x10
mov ebx, eax
push edi
call fcn.00522fc0
add esp, 4
cmp ebx, esi
pop esi
je 0x52360e
call fcn.005225b0
pop edi
pop ebp
mov dword [eax], 0x290
xor eax, eax
pop ebx
ret
pop edi
pop ebp
mov eax, 1
pop ebx
ret

Function at 0x523620
Capabilities:
Create thread

Disassembly:
push ecx
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push esi
lea eax, [esp + 4]
push eax
push 0
push ecx
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
jne 0x523653
push str.CreateThread_error_r_n
call dword [sym.imp.XLIB.dll_Ordinal_719]
add esp, 4
mov eax, esi
pop esi
pop ecx
ret
Function at 0x523b90
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x523bec
mov edx, dword [esp + 0xc]
test edx, edx
je 0x523bec
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x523bec
mov eax, dword [esi]
cmp eax, 0xffffffff
jne 0x523bbf
call fcn.005225b0
mov dword [eax], 0x388
xor eax, eax
pop esi
ret
push 0
push ecx
push edx
push eax
call sub.WSOCK32.dll_send
test eax, eax
jge 0x523be5
push esi
call fcn.005239b0
add esp, 4
call fcn.005225b0
mov dword [eax], 0x387
xor eax, eax
pop esi
ret
mov eax, 1
pop esi
ret
call fcn.005225b0
mov dword [eax], 0x65
xor eax, eax
pop esi
ret

Function at 0x524840
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x14
push esi
mov esi, dword [esp + 0x1c]
test esi, esi
mov dword [0x565c0c], 0
je 0x524960
cmp byte [esi], 0
je 0x524960
mov eax, dword [esp + 0x20]
push ebx
mov ebx, dword [esp + 0x28]
push ebp
push edi
call fcn.00524780
cmp dword [esp + 0x38], 0
mov dword [esp + 0x10], eax
je 0x5248a4
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
mov dword [esp + 0x18], eax
call dword [sym.imp.USER32.dll_SetCursor]
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x1c], eax
mov ebx, dword [sym.imp.MSVCR80.dll__fsopen]
mov ebp, dword [sym.imp.MSVCR80.dll__errno]
jmp 0x5248b6
mov esi, dword [esp + 0x28]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x2c]
push eax
push ecx
push esi
call ebx
add esp, 0xc
mov edi, eax
call ebp
cmp dword [esp + 0x38], 0
mov esi, dword [eax]
je 0x524911
test edi, edi
jne 0x524944
cmp esi, 0x24
je 0x5248e1
cmp esi, 0xd
jne 0x5248f6
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.USER32.dll_SetCursor]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x18], eax
cmp esi, 0x24
je 0x524900
cmp esi, 0xd
jne 0x524915
mov eax, dword [esp + 0x18]
sub eax, dword [esp + 0x1c]
cmp eax, 0x2710
jb 0x5248b2
jmp 0x524915
test edi, edi
jne 0x524956
cmp esi, 0x24
je 0x52491f
cmp esi, 0xd
jne 0x524944
cmp dword [esp + 0x34], 0
mov dword [0x565c0c], 1
je 0x524944
mov ecx, dword [esp + 0x28]
push 0
push str.FILE_LOCKED_
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp dword [esp + 0x38], 0
je 0x524956
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, edi
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x14
ret
xor eax, eax
pop esi
add esp, 0x14
ret