joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43f304
Capabilities:
Get file size

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, ecx
push 0x48b13c
push 1
mov dword [esp + 0x14], esi
call fcn.0042cab0
mov ebx, dword [esp + 0x1c]
add esp, 8
mov eax, dword [ebx + 4]
test eax, eax
jne 0x43f32a
mov eax, 0x47ca58
push 0
push 0
push 3
push 0
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [esi + 0x34], eax
jne 0x43f361
push str.open_file_failed
push 1
call fcn.0042cab0
add esp, 8
xor al, al
pop esi
pop ebx
add esp, 8
ret 4
mov eax, dword [ebx + 8]
push ebp
mov ebp, dword [0x47ca5c]
push edi
mov edi, eax
add esi, 0x50
cmp ebp, edi
jae 0x43f377
mov edi, ebp
cmp esi, ebx
jne 0x43f3d7
mov eax, dword [esi + 8]
sub eax, edi
cmp eax, ebp
jae 0x43f386
mov ebp, eax
test ebp, ebp
jbe 0x43f486
mov ecx, esi
call fcn.004228a0
mov ecx, dword [esi + 8]
mov eax, dword [esi + 4]
sub ecx, ebp
lea edx, [edi + ebp]
sub ecx, edi
push ecx
lea ecx, [eax + edx*2]
lea edx, [eax + edi*2]
push ecx
push edx
call fcn.00422850
mov edi, dword [esi + 8]
add esp, 0xc
sub edi, ebp
mov ecx, esi
push 0
push edi
call fcn.00422910
test al, al
je 0x43f486
push edi
mov ecx, esi
call fcn.004228f0
jmp 0x43f486
xor ebp, ebp
cmp edi, ebp
jbe 0x43f446
cmp edi, eax
jne 0x43f446
mov eax, dword [ebx + 4]
cmp eax, ebp
jne 0x43f3ed
mov eax, 0x47ca58
cmp byte [eax - 1], 0xfe
jae 0x43f446
mov ecx, dword [esi + 4]
cmp ecx, ebp
je 0x43f418
mov al, byte [ecx - 1]
test al, al
je 0x43f40c
cmp al, 0xff
je 0x43f40c
dec al
mov byte [ecx - 1], al
jmp 0x43f418
add ecx, 0xfffffffe
push ecx
call fcn.004472d3
add esp, 4
mov dword [esi + 4], ebp
mov dword [esi + 8], ebp
mov dword [esi + 0xc], ebp
mov eax, dword [ebx + 4]
cmp eax, ebp
jne 0x43f42d
mov eax, 0x47ca58
mov dword [esi + 4], eax
mov ecx, dword [ebx + 8]
mov dword [esi + 8], ecx
mov edx, dword [ebx + 0xc]
mov dword [esi + 0xc], edx
mov cl, byte [eax - 1]
inc cl
mov byte [eax - 1], cl
jmp 0x43f486
push 1
push edi
mov ecx, esi
call fcn.00422910
test al, al
je 0x43f486
mov ebx, dword [ebx + 4]
mov ecx, 0x47ca58
test ebx, ebx
je 0x43f462
mov ecx, ebx
mov eax, dword [esi + 4]
test edi, edi
jbe 0x43f47a
mov edx, edi
mov bx, word [ecx]
add ecx, 2
mov word [eax], bx
add eax, 2
dec edx
jne 0x43f46b
mov eax, dword [esi + 4]
mov dword [esi + 8], edi
mov word [eax + edi*2], 0
mov esi, dword [esp + 0x14]
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x14], 0
mov edx, dword [esi + 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
mov eax, dword [esp + 0x10]
push 1
push 0
push 0
push eax
call fcn.0044c970
xor ecx, ecx
add eax, edi
adc edx, ecx
mov dword [esi + 0x20], eax
push 0x7530
lea ecx, [esi + 0x40]
mov dword [esi + 0x24], edx
mov dword [esi + 0x3c], 1
call fcn.00446500
push str.init_upload_succeeded
push 0
call fcn.0042cab0
add esp, 8
mov al, 1
pop edi
pop ebp
pop esi
pop ebx
add esp, 8
ret 4
Function at 0x4406a0
Capabilities:
Copy file
Get file size

Disassembly:
sub esp, 0x64c
push ebp
push esi
mov esi, ecx
push edi
push 0x47cc54
lea edi, [esi + 0x15c]
mov ecx, edi
call fcn.00438ab0
mov dword [esi + 0x110], 1
mov eax, dword [esi + 0x118]
xor ebp, ebp
cmp eax, ebp
jne 0x4406d8
mov eax, 0x47ca58
push ebx
mov ebx, dword [esp + 0x660]
push ebx
push eax
call fcn.0044c1ff
add esp, 8
test eax, eax
je 0x440732
push ebp
mov ecx, esi
call fcn.00442b40
mov eax, dword [esi + 0x118]
cmp eax, ebp
jne 0x440705
mov eax, 0x47ca58
push ebp
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x440732
push str.copy_file_failed
push 1
call fcn.0042cab0
add esp, 8
mov dword [esi + 0x110], 2
push 0x47cc5c
jmp 0x440737
push 0x47cc58
mov ecx, edi
call fcn.00438ab0
mov ecx, 0x191
xor eax, eax
lea edi, [esp + 0x14]
mov dword [esp + 0x254], 0x648
rep stosd dword es:[edi], eax
mov eax, dword [esi + 0x118]
mov dword [esp + 0x658], ebp
cmp eax, ebp
mov dword [esp + 0x38], 0xf9c00
jne 0x440774
mov eax, 0x47ca58
push ebp
push 0x80
push 3
push ebp
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x440798
or eax, eax
or edx, edi
jmp 0x4407c5
lea eax, [esp + 0x10]
mov dword [esp + 0x10], ebp
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x10]
push 1
push ebp
push ebp
push ecx
call fcn.0044c970
xor ecx, ecx
add eax, ebx
adc edx, ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 0x110]
mov dword [esp + 0x28], edx
mov dword [esp + 0x40], eax
mov eax, dword [esi + 0x118]
mov dword [esp + 0x20], edx
mov edx, dword [esi + 0x30]
cmp eax, ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebp
mov dword [esp + 0x3c], 2
mov dword [esp + 0x658], edx
mov dword [esp + 0x48], ebp
mov dword [esp + 0x44], ebp
mov dword [esp + 0x34], ebp
pop ebx
jne 0x440815
mov eax, 0x47ca58
push 0x103
lea ecx, [esp + 0x4c]
push eax
push ecx
call fcn.0044aebd
mov eax, dword [esi + 0x128]
add esp, 0xc
cmp eax, ebp
mov word [esp + 0x24e], bp
jne 0x44083f
mov eax, 0x47ca58
push 0xff
lea edx, [esp + 0x258]
push eax
push edx
call fcn.0044aebd
mov eax, dword [esi + 0x138]
add esp, 0xc
cmp eax, ebp
mov word [esp + 0x452], bp
jne 0x44086c
mov eax, 0x47ca58
push 0xff
push eax
lea eax, [esp + 0x45c]
push eax
call fcn.0044aebd
add esp, 0xc
lea ecx, [esp + 0x10]
mov word [esp + 0x652], bp
push ecx
mov ecx, esi
call fcn.00441cd0
pop edi
pop esi
pop ebp
add esp, 0x64c
ret 4
Function at 0x442ab0
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x1c]
mov ecx, dword [esi + 0x148]
lea eax, [esp + 0xc]
push 0
push eax
push ebx
push ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x442b16
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x442b16
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0xc]
push edx
push eax
push edi
push ebx
push str.seek_file_failed:_I64d_HiWord:_d_len:_d
push 1
call fcn.0042cab0
add esp, 0x18
xor al, al
pop edi
pop esi
pop ebx
add esp, 8
ret 0x10
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x10]
push 0
push ecx
mov ecx, dword [esi + 0x148]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
mov al, 1
pop ebx
add esp, 8
ret 0x10

Function at 0x442b40
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x148]
cmp eax, 0xffffffff
je 0x442b6c
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov eax, dword [esi + 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x148], 0xffffffff
mov eax, dword [esi + 0x110]
cmp eax, 0xa
je 0x442b84
cmp eax, 2
je 0x442b84
mov al, byte [esp + 8]
test al, al
je 0x442bbc
mov al, byte [esi + 8]
test al, al
jne 0x442bbc
mov byte [esi + 8], 1
mov eax, dword [esi + 0x118]
test eax, eax
jne 0x442b9e
mov eax, 0x47ca58
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esi + 0x110]
push ecx
push eax
push str.DeleteFile:_d_res_m_Status:_d
push 1
call fcn.0042cab0
add esp, 0x10
mov al, 1
pop esi
ret 4

Function at 0x442da0
Capabilities:
Set registry value

Disassembly:
sub esp, 8
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 4]
push edi
push eax
push 0xf003f
push 0
push str.SOFTWARELiveUpdate360_
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x1c], 0
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x442e54
lea ecx, [esp + 8]
push ecx
push 0xf003f
push 0
push str.SOFTWARE
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x442df9
pop edi
xor al, al
pop esi
add esp, 8
ret
lea edx, [esp + 0xc]
lea eax, [esp + 8]
push edx
push eax
push 0
push 0
push 0
push 0
push 0
push str.SOFTWARELiveUpdate360_
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x442e29
pop edi
xor al, al
pop esi
add esp, 8
ret
mov ecx, dword [esp + 8]
push ecx
call edi
lea edx, [esp + 8]
push edx
push 0xf003f
push 0
push str.SOFTWARELiveUpdate360_
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x442e54
pop edi
xor al, al
pop esi
add esp, 8
ret
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 8]
lea eax, [esp + 0x18]
push 4
push eax
push 4
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp + 8]
push eax
call edi
pop edi
mov al, 1
pop esi
add esp, 8
ret
Function at 0x444fe0
Capabilities:
Copy file
Get file size

Disassembly:
sub esp, 0x41c
push ebx
push ebp
push esi
mov ebx, dword [esp + 0x42c]
push edi
xor edi, edi
push edi
push edi
push 3
push edi
push 1
push edi
mov ebp, ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x445021
pop edi
mov dword [ebp + 0x2c], 0xfffffc14
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x41c
ret 0xc
lea eax, [esp + 0x14]
mov dword [esp + 0x10], edi
push eax
push edi
push edi
push esi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
lea ecx, [esp + 0x10]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x434]
mov eax, dword [esp + 0x10]
cmp edx, edi
jne 0x44506a
mov ecx, dword [esp + 0x438]
cmp ecx, eax
je 0x445080
pop edi
mov dword [ebp + 0x2c], 0xfffffc16
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x41c
ret 0xc
mov esi, dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
lea edx, [esp + 0x224]
push 0x104
push edx
push ebx
call esi
test eax, eax
jne 0x4450b0
pop edi
mov dword [ebp + 0x2c], 0xfffffc13
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x41c
ret 0xc
mov eax, dword [ebp + 0x84]
test eax, eax
jne 0x4450bf
mov eax, 0x47ca58
lea ecx, [esp + 0x1c]
push 0x104
push ecx
push eax
call esi
test eax, eax
je 0x4450f8
lea edx, [esp + 0x1c]
lea eax, [esp + 0x224]
push edx
push eax
call fcn.0044c1ff
add esp, 8
test eax, eax
jne 0x4450f8
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x41c
ret 0xc
mov eax, dword [ebp + 0x84]
test eax, eax
jne 0x445107
mov eax, 0x47ca58
push 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
setne al
test al, al
jne 0x445121
mov dword [ebp + 0x2c], 0xfffffc17
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x41c
ret 0xc
Function at 0x4454f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4794e4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov dword [esp + 0x10], ebp
mov edx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov dword [ebp + 0x10], edx
mov edx, dword [esp + 0x2c]
mov dword [ebp + 0xc], ecx
mov dword [ebp], method.CRenderObjectBase.virtual_0
mov esi, dword [edx]
lea ecx, [ebp + 0x14]
lea edi, [ebp + 0x28]
xor eax, eax
mov dword [ecx], esi
mov esi, dword [edx + 4]
mov dword [esp + 0x1c], eax
mov dword [ecx + 4], esi
mov esi, dword [edx + 8]
mov dword [ecx + 8], esi
mov edx, dword [edx + 0xc]
mov esi, dword [esp + 0x24]
mov dword [ecx + 0xc], edx
mov dl, byte [esp + 0x34]
mov ecx, 0x192
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x30]
lea esi, [ebp + 0x6c8]
mov dword [ebp + 0x670], ecx
mov cl, byte [esp + 0x34]
mov dword [ebp + 0x678], eax
mov byte [ebp + 0x6c4], dl
mov byte [esi], cl
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov edx, dword [esp + 0x50]
mov dword [ebp + 0x6d8], edx
mov dword [ebp + 0x6dc], eax
mov byte [esp + 0x1c], 2
mov dword [ebp], 0x47cd08
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [esp + 0x48]
mov dword [ebp + 0x674], eax
mov eax, dword [0x47ca5c]
mov edi, ebx
cmp eax, ebx
jae 0x4455be
mov edi, eax
lea ecx, [esp + 0x40]
cmp esi, ecx
jne 0x4455dc
push eax
push edi
mov ecx, esi
call fcn.004252b0
push 0
push 0
mov ecx, esi
call fcn.004252b0
jmp 0x445654
test edi, edi
jbe 0x44561f
cmp edi, ebx
jne 0x44561f
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x4455f1
mov eax, 0x47ca58
cmp byte [eax - 1], 0xfe
jae 0x44561f
push 1
mov ecx, esi
call fcn.00422400
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x44560d
mov eax, 0x47ca58
mov edx, dword [esp + 0x4c]
mov dword [esi + 4], eax
mov dword [esi + 8], ebx
mov dword [esi + 0xc], edx
inc byte [eax - 1]
jmp 0x445654
push 1
push edi
mov ecx, esi
call fcn.00422910
test al, al
je 0x445654
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x44563a
mov eax, 0x47ca58
push edi
push eax
mov eax, dword [esi + 4]
push eax
call fcn.00421840
mov ecx, dword [esi + 4]
mov dword [esi + 8], edi
add esp, 0xc
mov word [ecx + edi*2], 0
mov esi, dword [esp + 0x28]
lea edx, [ebp + 0x67c]
mov ecx, 0x10
xor eax, eax
mov edi, edx
test esi, esi
rep stosd dword es:[edi], eax
je 0x445685
mov edi, edx
mov edx, dword [esp + 0x24]
mov ecx, 0x10
rep movsd dword es:[edi], dword [esi]
mov eax, dword [edx + 0x28]
mov dword [ebp + 0x6c0], eax
jmp 0x445692
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx + 0x28]
mov dword [ebp + 0x6c0], edx
mov ecx, dword [esp + 0x58]
mov eax, dword [esp + 0x54]
mov dword [ebp + 4], ecx
mov ecx, dword [esp + 0x44]
test ecx, ecx
mov dword [ebp + 8], eax
je 0x4456c6
mov al, byte [ecx - 1]
test al, al
je 0x4456ba
cmp al, 0xff
je 0x4456ba
dec al
mov byte [ecx - 1], al
jmp 0x4456c6
add ecx, 0xfffffffe
push ecx
call fcn.004472d3
add esp, 4
mov ecx, dword [esp + 0x14]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x38
Function at 0x446380
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x22c
push esi
push edi
xor esi, esi
mov ecx, 0x8a
xor eax, eax
lea edi, [esp + 0xc]
mov dword [esp + 8], esi
push esi
rep stosd dword es:[edi], eax
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x4463b1
push str.hProcessSnap_1_CreateToolhelp32Snapshot_Filed.
jmp 0x446427
lea eax, [esp + 8]
mov dword [esp + 8], 0x22c
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x446422
push ebx
mov ebx, dword [esp + 0x244]
push ebp
mov ebp, dword [esp + 0x244]
mov ecx, dword [esp + 0x240]
mov eax, dword [esp + 0x18]
cmp ecx, eax
jne 0x4463f6
lea edx, [esp + 0x34]
push ebx
push edx
push ebp
call fcn.0044aebd
add esp, 0xc
inc esi
cmp esi, 0x3e8
jg 0x44640e
lea eax, [esp + 0x10]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4463d8
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
pop ebx
pop edi
mov al, 1
pop esi
add esp, 0x22c
ret
push str.Process32First_Filed.
push 1
call fcn.0042cab0
add esp, 8
xor al, al
pop edi
pop esi
add esp, 0x22c
ret

Function at 0x4467d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x479550
push eax
mov dword fs:[0], esp
push esi
mov esi, ecx
mov al, byte [esi + 0x24]
test al, al
mov eax, dword [esi + 0x20]
je 0x4467ff
test eax, eax
je 0x44680c
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
jmp 0x44680c
test eax, eax
je 0x44680c
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 4], eax
mov dword [esi], 0
mov dword [esi + 0x28], 0
mov byte [esi + 0x2c], 0
mov dword [esi + 0x30], 0
xor eax, eax
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x44684c
mov edx, dword [esi + 0x10]
sub edx, ecx
sar edx, 2
cmp eax, edx
jae 0x44684c
mov dword [ecx + eax*4], 0
inc eax
jmp 0x44682f
mov al, byte [esi + 0x24]
test al, al
je 0x44686f
mov edx, dword [esi + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [esp + 4]
mov al, 1
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret

Function at 0x449170
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret 4
Function at 0x449e20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4798d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x805c
call fcn.0044c0a0
push ebx
push esi
push edi
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x10], esp
mov ebx, ecx
push eax
mov dword [ebp - 4], 0
call fcn.00449170
mov edi, dword [ebp + 8]
push 0
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x449e89
push 0x48c0d4
push 0
push 0x1ac
push str.D:_root.ddev360C360PubSrc360BaseQHMD5.cpp
call fcn.00449f30
add esp, 0x10
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
lea ecx, [ebp - 0x14]
push 0
push ecx
lea edx, [ebp - 0x806c]
push 0x8000
push edx
push edi
call esi
test eax, eax
jne 0x449ec0
push 0x48c0c8
push eax
push 0x1af
push str.D:_root.ddev360C360PubSrc360BaseQHMD5.cpp
call fcn.00449f30
add esp, 0x10
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x449edd
push eax
lea eax, [ebp - 0x806c]
lea ecx, [ebp - 0x6c]
push eax
push ecx
mov ecx, ebx
call fcn.004491a0
mov eax, dword [ebp - 0x14]
cmp eax, 0x8000
je 0x449e8f
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0x6c]
push edx
push eax
mov ecx, ebx
call fcn.00449260
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x44a690
Capabilities:
Allocate thread local storage
Check mutex on windows
Query environment variable
Set environment variable

Disassembly:
mov ecx, 0x492fb4
jmp fcn.0044a6a0

Function at 0x44aa60
Capabilities:
Get thread local storage value
Print debug messages
Set thread local storage value

Disassembly:
mov ecx, 0x492fb4
jmp fcn.0044aa70

Function at 0x44d1b8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x44d1d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0044e04b
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x44d1fb
test byte [esp + 8], 2
je 0x44d1fb
call fcn.0044e0be
mov dword [eax], 0xd
call fcn.0044e0c7
mov dword [eax], 5
jmp 0x44d1d4
xor eax, eax
ret

Function at 0x45a2ac
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
cmp eax, ecx
jne 0x45a2ba
push 1
pop eax
ret
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x60], ecx
mov dword [eax + 0x64], ecx
xor eax, eax
ret
Function at 0x45a86a
Capabilities:
Create thread
Create udp socket
Set socket configuration

Disassembly:
mov ecx, 0x4934a0
jmp fcn.0046205c

Function at 0x45aa65
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
lea eax, [ebp - 0x10]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push dword [ebp - 0xc]
lea eax, [ebp - 0x30]
push dword [ebp - 0x10]
push dword [0x48fdb4]
push str.360P_04d_012I64X
push eax
call fcn.0044d35e
lea eax, [ebp - 0x30]
push 0x14
push eax
push 0x493684
call fcn.0044dbc0
push 0xb
lea eax, [ebp - 0x28]
push 4
push eax
mov dword [ebp - 4], 0x67452301
call fcn.0045aa13
push 0x432aff97
push 5
mov ebx, 0x10325476
push eax
mov edi, 0x98badcfe
mov dword [ebp - 8], eax
push ebx
mov esi, 0xefcdab89
push edi
lea eax, [ebp - 4]
push esi
push eax
call fcn.00461e69
add esp, 0x48
lea eax, [ebp - 4]
push 0x2441453
push 0x14
push dword [ebp - 8]
push ebx
push edi
push esi
push eax
call fcn.00461ea3
push 0xf57c0faf
push 0x10
push dword [ebp - 8]
lea eax, [ebp - 4]
push ebx
push edi
push esi
push eax
call fcn.00461edd
push 0x4bdecfa9
push 0x16
push dword [ebp - 8]
lea eax, [ebp - 4]
push ebx
push edi
push esi
push eax
call fcn.00461f10
mov ecx, dword [ebp - 4]
mov dl, 9
shr ecx, 0x10
xor ecx, dword [ebp - 4]
add esp, 0x54
mov bl, 0x30
mov ax, cx
shr ax, 0xc
cmp al, dl
jbe 0x45ab40
add al, 0x37
jmp 0x45ab42
add al, bl
mov byte [0x49368c], al
xor eax, eax
mov al, ch
and al, 0xf
cmp al, dl
jbe 0x45ab55
add al, 0x37
jmp 0x45ab57
add al, bl
mov byte [0x49368d], al
mov al, cl
shr al, 4
and al, 0xf
cmp al, dl
jbe 0x45ab6b
add al, 0x37
jmp 0x45ab6d
add al, bl
and cl, 0xf
mov byte [0x49368e], al
cmp cl, dl
jbe 0x45ab7e
add cl, 0x37
jmp 0x45ab80
add cl, bl
pop edi
pop esi
mov byte [0x49368f], cl
pop ebx
leave
ret
Function at 0x45ab8b
Capabilities:
Get common file path
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d8
push ebx
push esi
mov esi, 0x94
push edi
xor ebx, ebx
push esi
lea eax, [ebp - 0xa0]
push ebx
push eax
call fcn.0044e2f0
add esp, 0xc
lea eax, [ebp - 0xa0]
mov dword [ebp - 0xa0], esi
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [ebp - 0x9c]
mov dword [0x493564], eax
mov eax, dword [ebp - 0x98]
mov dword [0x493530], eax
lea eax, [ebp - 0x80]
push eax
call fcn.00451932
mov dword [0x493498], eax
mov eax, dword [ebp - 0x94]
push 0x40
mov dword [0x49348c], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x1d7]
mov byte [ebp - 0x1d8], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x1d8]
mov dword [esp], 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x45adc7
lea eax, [ebp - 0x1d8]
push str.drivers_tcpip.sys
push eax
call fcn.004535b0
pop ecx
lea eax, [ebp - 0x1d8]
pop ecx
push ebx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, ebx
je 0x45adc7
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
lea eax, [ebp - 0x1d8]
push edi
push esi
push ebx
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x45ac9e
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0x48fdf4
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x45ac9e
push dword [ebp - 0xc]
lea eax, [ebp - 0xd4]
push dword [ebp - 8]
push eax
call fcn.0044dbc0
mov esi, dword [ebp - 0xc8]
add esp, 0xc
jmp 0x45aca1
mov esi, dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
movzx eax, si
mov ecx, 0xb0b
cmp eax, ecx
jg 0x45ad75
je 0x45ace7
sub eax, 0x830
je 0x45ad6b
sub eax, 0x35
je 0x45ad64
sub eax, 0xd
je 0x45ad5d
sub eax, 0x12
je 0x45ad56
sub eax, 0x1f9
jne 0x45adc7
mov edi, 0x4f5a2
lea eax, [ebp - 0x1d8]
push 0x48fdf0
push eax
call fcn.00474886
mov esi, eax
pop ecx
cmp esi, ebx
pop ecx
je 0x45adc7
push ebx
push edi
push esi
mov dword [ebp - 4], ebx
call fcn.0047479c
push esi
push 4
push 1
lea eax, [ebp - 4]
pop edi
push edi
push eax
call fcn.0044ce06
push esi
call fcn.0044c2de
mov eax, dword [ebp - 4]
add esp, 0x20
xor edx, edx
push 5
lea eax, [eax + eax*2]
pop ecx
div ecx
mov ecx, 0xff
cmp eax, ecx
mov dword [ebp - 4], eax
mov edx, eax
jb 0x45ad4a
mov edx, ecx
cmp edx, edi
jae 0x45adab
mov dword [0x48fdb8], edi
jmp 0x45adba
mov edi, 0x4f322
jmp 0x45acec
mov edi, 0x4f822
jmp 0x45acec
mov edi, 0x4f4a2
jmp 0x45acec
mov edi, 0x4eab7
jmp 0x45acec
cmp eax, 0xb4c
je 0x45ace7
cmp eax, 0xcac
je 0x45ada1
cmp eax, 0xd42
je 0x45ad97
cmp eax, 0x15f9
je 0x45ada1
jmp 0x45adc7
mov edi, 0x4f7a2
jmp 0x45acec
mov edi, 0x4fb46
jmp 0x45acec
cmp eax, ecx
mov dword [0x48fdb8], eax
jb 0x45adba
mov dword [0x48fdb8], ecx
push eax
push str.tcp_connecting_limit_is__d_n
call fcn.0047475b
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret