joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40167e
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x30ef534]
sub esp, 0x400
push esi
mov esi, eax
shr esi, 3
push edi
mov edi, dword [0x30ef48c]
test esi, esi
je 0x4016c9
cmp eax, 0x959
jne 0x4016b5
push 0
lea eax, [ebp - 0x400]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ecx, edi
call fcn.00401481
add edi, 8
dec esi
je 0x4016c9
mov eax, dword [0x30ef534]
jmp 0x40169d
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x40d786
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419458]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00404d45
mov dword [ebp - 0x14], eax
cmp dword [0x816ba8], esi
jne 0x40d879
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d806
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d959
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d959
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d959
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x816ba8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x816bac], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x816bb0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x816bb8], eax
test eax, eax
je 0x40d876
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x816bb4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d89e
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d891
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d8b3
push 4
pop eax
jmp 0x40d95b
cmp dword [ebp - 0x14], esi
je 0x40d8b3
push dword [0x816ba8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d898
mov eax, dword [0x816bb4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d911
cmp dword [0x816bb8], edi
je 0x40d911
push eax
call ebx
push dword [0x816bb8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d911
test eax, eax
je 0x40d911
call ecx
test eax, eax
je 0x40d906
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d906
test byte [ebp - 8], 1
jne 0x40d911
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d941
mov eax, dword [0x816bac]
cmp eax, edi
je 0x40d93e
push eax
call ebx
test eax, eax
je 0x40d93e
call eax
mov esi, eax
test esi, esi
je 0x40d93e
mov eax, dword [0x816bb0]
cmp eax, edi
je 0x40d93e
push eax
call ebx
test eax, eax
je 0x40d93e
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x816ba8]
call ebx
test eax, eax
je 0x40d959
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d95b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403fb7
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x402c00
pop dword [ebp - 0x18]
mov eax, 0x8cb47e45
add eax, 0x738badbb
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xf19debb4
add dword [ebp - 0x28], 0x5cb45997
mov dword [ebp - 0x24], 0x12a70dc1
sub dword [ebp - 0x24], 0xe073c17c
mov dword [ebp - 0x20], 0x3e1146e1
add dword [ebp - 0x20], 0xe3afd4d
mov dword [ebp - 0x1c], 0xd8df3787
sub dword [ebp - 0x1c], 0xd8df3787
lea eax, [ebp - 0x28]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xec99fb37
add dword [ebp - 0x28], 0x87d86e1f
mov dword [ebp - 0x24], 0x8588796b
add dword [ebp - 0x24], 0xbbe3e80a
mov dword [ebp - 0x20], 0x47003a3b
add dword [ebp - 0x20], 0x1c6f3231
mov dword [ebp - 0x1c], 0x2c6660c5
add dword [ebp - 0x1c], 0xd3999f3b
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x4f792942
add eax, 0xb0c74766
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x34c8a
push 0
call eax
mov ecx, 0x1a5fa35c
sub ecx, 0x1a5f62fb
mov esi, eax
mov edx, 0x410000
add edx, dword [ebp - 0x18]
mov edi, 0x1deef60f
add edi, 0xff649c64
mov dword [ebp - 8], 0x7d535e9e
mov ebx, dword [edx]
xor dword [ebp - 0x14], 0xe8e280c3
add ebx, edi
xor dword [ebp - 0xc], 0xca2d6bfd
mov dword [esi], ebx
xor dword [ebp - 0x14], 0x6038025b
add esi, 4
add edx, 4
loop 0x402d17
add eax, 0x9c0c2e81
add eax, 0x63f4c5d6
xor ebx, ebx
add ebx, eax
add eax, 0xabe6f39d
add eax, 0x54190c68
mov ecx, 0xa08ba9b4
add ecx, 0x5fb4564c
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x42e6b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53bf4b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esi], vtable.Sexy::BubbleMgr.0
push edi
xor edi, edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
lea ebx, [esi + 0x40]
mov ecx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
call fcn.0042d8b0
mov dword [ebx + 4], eax
mov dword [ebx + 8], edi
lea ebx, [esi + 0x4c]
mov ecx, ebx
mov dword [ebp - 4], edi
call fcn.0042d7f0
mov dword [ebx + 4], eax
mov dword [ebx + 8], edi
xor eax, eax
mov dword [esi + 0x14], eax
mov dword [esi + 4], eax
xor ecx, ecx
mov dword [esi + 0x18], ecx
mov edx, 0x280
mov ebx, 0x1e0
mov dword [esi + 0x1c], edx
mov dword [esi + 8], edi
mov eax, 0xa
mov ecx, edx
mov dword [esi + 0xc], ecx
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], edi
mov edx, ebx
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x20], ebx
pop edi
mov dword [esi + 0x10], edx
mov byte [esi + 0x3c], 1
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x442c30
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d3a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x70
mov eax, dword [ebp + 8]
cmp eax, 1
push esi
mov esi, ecx
jne 0x442c77
mov ecx, dword [esi + 4]
call fcn.0046d7f0
mov ecx, dword [esi + 4]
call fcn.004746c0
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
test eax, eax
jne 0x442d00
mov ecx, dword [esi + 4]
call fcn.0046d7f0
mov ecx, dword [esi + 4]
mov eax, dword [ecx + 0x764]
cmp eax, 1
je 0x442c61
mov edx, dword [ecx + 0x628]
test edx, edx
jne 0x442c61
cmp eax, 4
jne 0x442cbe
mov eax, dword [esi + 0x30]
push eax
call fcn.00475300
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ecx + 0x7a0]
cmp dword [eax + 0x1c], 5
jne 0x442ce6
cmp dword [eax + 0x20], 2
jne 0x442ce6
call fcn.0046e620
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
push 1
push 1
call fcn.004747e0
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
cmp eax, 2
jne 0x442def
mov ecx, dword [esi + 4]
mov eax, dword [ecx + 0x7a0]
mov ecx, dword [esi + 0x48]
mov edx, dword [eax + 0x48]
cmp edx, ecx
mov ecx, dword [eax + 0xa8]
push edi
jge 0x442d9c
cmp ecx, 4
mov edi, str.this_Bonus_Pet
jl 0x442d32
mov edi, str.this_Bonus_Upgrade
push 0x551628
lea ecx, [ebp - 0x44]
call fcn.0041c120
push str.Not_Enough_Shells
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.0041c120
push edi
lea eax, [ebp - 0x7c]
push str.Sorry__but_you_need_more_Shells_to_purchase__s.__Keep_playing_to_earn_more_
push eax
mov byte [ebp - 4], 1
call fcn.00481330
add esp, 0xc
mov ecx, dword [esi + 4]
mov edx, dword [ecx]
push 3
lea esi, [ebp - 0x44]
push esi
push eax
lea eax, [ebp - 0x28]
push eax
push 1
push 0xe
mov byte [ebp - 4], 2
call dword [edx + 0xf0]
lea ecx, [ebp - 0x7c]
call fcn.0042d770
lea ecx, [ebp - 0x28]
call fcn.0042d770
lea ecx, [ebp - 0x44]
jmp 0x442de9
mov edi, 4
cmp ecx, edi
jge 0x442dca
push str.Would_you_like_to_nbuy_this_Bonus_Pet_
lea ecx, [ebp - 0x44]
call fcn.0041c120
lea ecx, [ebp - 0x44]
push ecx
mov ecx, dword [esi + 4]
mov dword [ebp - 4], 3
call fcn.004724b0
lea ecx, [ebp - 0x44]
jmp 0x442de9
push str.Would_you_like_to_nbuy_this_Bonus_Upgrade_
lea ecx, [ebp - 0x60]
call fcn.0041c120
mov ecx, dword [esi + 4]
lea edx, [ebp - 0x60]
push edx
mov dword [ebp - 4], edi
call fcn.004724b0
lea ecx, [ebp - 0x60]
call fcn.0042d770
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x46d410
Capabilities:
Persist via screensaver registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
mov eax, dword [0x58becc]
xor eax, dword [ebp + 4]
push edi
mov dword [ebp - 4], eax
xor eax, eax
mov ecx, 0x25
lea edi, [ebp - 0x9c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x9c]
push eax
mov dword [ebp - 0x9c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x8c], 1
pop edi
jne 0x46d497
mov eax, esi
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x46d460
sub eax, edx
mov dword [ebp - 8], eax
push str.SYSTEM.INI
je 0x46d493
push esi
push str.SCRNSAVE.EXE
push str.boot
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
call fcn.00528d83
mov esp, ebp
pop ebp
ret
push 0
jmp 0x46d474
lea ecx, [ebp - 8]
push ecx
push 0x20006
push 0
push str.Control_PanelDesktop
push closesocket
mov dword [ebp - 8], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x46d4eb
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x46d4c2
sub eax, edx
mov edx, dword [ebp - 8]
inc eax
push eax
push esi
push 1
push 0
push str.SCRNSAVE.EXE
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
call fcn.00528d83
mov esp, ebp
pop ebp
ret

Function at 0x46f300
Capabilities:
Hide graphical window
Print debug messages

Disassembly:
push esi
mov esi, ecx
mov al, byte [esi + 0x530]
test al, al
je 0x46f327
call fcn.0046d5a0
test al, al
je 0x46f32d
mov al, byte [0x58dd3c]
test al, al
jne 0x46f32d
mov ecx, esi
pop esi
jmp fcn.0046f290
pop esi
jmp fcn.004cf780
pop esi
ret
Function at 0x46f8e0
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1ac
mov eax, dword [0x58becc]
xor eax, dword [ebp + 4]
push ebx
push edi
mov dword [ebp - 4], eax
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov ecx, 0x25
lea edi, [ebp - 0xa4]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xa4]
push eax
mov dword [ebp - 0xa4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [ebp - 0x94]
mov edi, 1
cmp eax, edi
mov byte [ebp - 0x1ac], bl
mov dword [ebp - 0xc], 0x105
jne 0x46f9ab
push str.SYSTEM.INI
push 0x105
lea ecx, [ebp - 0x1ac]
push ecx
push 0x548309
push str.SCRNSAVE.EXE
push str.boot
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x1ac]
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
mov byte [esi + 4], bl
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x46f980
sub eax, edx
push eax
lea edx, [ebp - 0x1ac]
push edx
mov ecx, esi
call fcn.0041af60
pop edi
mov eax, esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
call fcn.00528d83
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 8]
push edx
push 0x20019
push ebx
push str.Control_PanelDesktop
push closesocket
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x46f963
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0x1ac]
push ecx
lea edx, [ebp - 0x10]
push edx
push ebx
push str.SCRNSAVE.EXE
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x10], edi
je 0x46f963
push 0x548309
mov ecx, esi
call fcn.0041c120
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop edi
mov eax, esi
pop ebx
call fcn.00528d83
mov esp, ebp
pop ebp
ret
Function at 0x4733e0
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53f800
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
mov eax, dword [0x58becc]
xor eax, dword [ebp + 4]
push esi
mov dword [ebp - 0x10], eax
mov esi, ecx
call fcn.0046d5a0
test al, al
je 0x4734bf
xor eax, eax
push ebx
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
mov dword [ebp - 4], eax
push str.Directory
lea eax, [esi + 0x654]
push eax
lea ecx, [ebp - 0x48]
push ecx
call fcn.004412b0
add esp, 0xc
lea edx, [ebp - 0x2c]
push edx
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.004d34e0
mov bl, al
mov eax, dword [ebp - 0x30]
neg bl
sbb bl, bl
mov esi, 0x10
inc bl
cmp eax, esi
jb 0x473471
mov eax, dword [ebp - 0x44]
push eax
call fcn.00527b8e
add esp, 4
mov eax, dword [ebp - 0x14]
test bl, bl
pop ebx
je 0x473483
cmp eax, esi
jb 0x4734bf
mov ecx, dword [ebp - 0x28]
push ecx
jmp 0x4734b7
cmp eax, esi
mov eax, dword [ebp - 0x28]
jae 0x47348d
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
mov eax, dword [ebp - 0x14]
je 0x4734af
cmp eax, esi
jb 0x4734ab
mov edx, dword [ebp - 0x28]
push edx
call fcn.00527b8e
add esp, 4
mov al, 1
jmp 0x4734c1
cmp eax, esi
jb 0x4734bf
mov eax, dword [ebp - 0x28]
push eax
call fcn.00527b8e
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
xor ecx, dword [ebp + 4]
pop esi
call fcn.00528d83
mov esp, ebp
pop ebp
ret 4
Function at 0x475b20
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x58becc]
xor eax, dword [ebp + 4]
push str.IMAGEHLP.DLL
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [0x58e17c], eax
jne 0x475b59
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
call fcn.00528d83
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SymInitialize
push eax
call esi
test eax, eax
mov dword [0x58e180], eax
jne 0x475b83
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
call fcn.00528d83
mov esp, ebp
pop ebp
ret
mov eax, dword [0x58e17c]
push str.SymSetOptions
push eax
call esi
test eax, eax
mov dword [0x58e184], eax
je 0x475b71
mov ecx, dword [0x58e17c]
push str.SymCleanup
push ecx
call esi
test eax, eax
mov dword [0x58e18c], eax
je 0x475b71
mov edx, dword [0x58e17c]
push str.UnDecorateSymbolName
push edx
call esi
test eax, eax
mov dword [0x58e188], eax
je 0x475b71
mov eax, dword [0x58e17c]
push str.StackWalk
push eax
call esi
test eax, eax
mov dword [0x58e190], eax
je 0x475b71
mov ecx, dword [0x58e17c]
push str.SymFunctionTableAccess
push ecx
call esi
test eax, eax
mov dword [0x58e194], eax
je 0x475b71
mov edx, dword [0x58e17c]
push str.SymGetModuleBase
push edx
call esi
test eax, eax
mov dword [0x58e198], eax
je 0x475b71
mov eax, dword [0x58e17c]
push str.SymGetSymFromAddr
push eax
call esi
test eax, eax
mov dword [0x58e19c], eax
je 0x475b71
push 4
call dword [0x58e184]
push 0x104
lea ecx, [ebp - 0x10c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [ebp - 0x10c]
push 0x2f
push edx
call fcn.0052a1a0
add esp, 8
test eax, eax
jne 0x475c73
lea eax, [ebp - 0x10c]
push 0x5c
push eax
call fcn.0052a1a0
add esp, 8
test eax, eax
je 0x475c76
mov byte [eax], 0
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x10c]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x475c85
sub eax, esi
mov dword [ebp - 8], eax
jne 0x475c95
xor edx, edx
push 1
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x58e180]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, dword [ebp + 4]
pop esi
call fcn.00528d83
mov esp, ebp
pop ebp
ret
Function at 0x475ce0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push edi
mov edi, dword [ebp + 8]
push 0x1c
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x475d02
xor al, al
pop edi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp - 0x1c]
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x475d63
mov eax, dword [esi + 0x3c]
movzx ecx, word [eax + esi + 0x14]
add eax, esi
lea ecx, [ecx + eax + 0x18]
movzx eax, word [eax + 6]
sub edi, esi
xor ebx, ebx
test eax, eax
mov dword [ebp - 4], eax
jbe 0x475d63
lea eax, [ecx + 0x10]
lea ebx, [ebx]
mov ecx, dword [eax]
mov edx, dword [eax - 8]
cmp ecx, edx
mov esi, dword [eax - 4]
ja 0x475d4e
mov ecx, edx
cmp edi, esi
jb 0x475d58
add ecx, esi
cmp edi, ecx
jbe 0x475d6c
mov ecx, dword [ebp - 4]
inc ebx
add eax, 0x28
cmp ebx, ecx
jb 0x475d40
pop esi
pop ebx
xor al, al
pop edi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x18]
inc ebx
sub edi, esi
pop esi
mov dword [edx], ebx
mov dword [eax], edi
pop ebx
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x475d90
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 2
mov dword [ebp - 8], eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
jne 0x475dc9
xor edx, edx
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea ecx, [ebp - 0x10]
push ecx
call edi
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
push 0
push 0x64
push edx
push eax
call fcn.0052a210
mov ecx, dword [ebp - 0x10]
add ecx, eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], ecx
adc eax, edx
lea ecx, [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], ecx
mov ebx, dword [ebp - 4]
rdtsc
mov dword [ebx], eax
mov dword [ebx + 4], edx
lea edx, [ebp - 0x20]
push edx
call edi
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0xc]
jl 0x475e08
jg 0x475e20
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp - 0x10]
jb 0x475e08
lea edx, [ebp - 0x18]
mov dword [ebp - 4], edx
mov ebx, dword [ebp - 4]
rdtsc
sub eax, dword [ebx]
sbb edx, dword [ebx + 4]
mov dword [ebx], eax
mov dword [ebx + 4], edx
mov eax, dword [ebp - 8]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
push 0
push 0x64
push ecx
push edx
call fcn.0052a1d0
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x476120
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
push ebx
push esi
mov esi, ecx
mov al, byte [esi + 0xf2]
xor ebx, ebx
cmp al, bl
jne 0x476206
lea ecx, [ecx]
cmp byte [ebp + 8], bl
mov dword [ebp - 0x10c], ebx
mov dword [ebp - 0x210], ebx
je 0x476167
mov eax, dword [esi + 8]
mov dword [ebp - 0x108], eax
mov eax, 1
mov dword [ebp - 0x10c], eax
jmp 0x47616c
mov eax, 1
cmp byte [ebp + 0xc], bl
je 0x476180
mov ecx, dword [esi + 8]
mov dword [ebp - 0x20c], ecx
mov dword [ebp - 0x210], eax
mov edx, dword [esi + 8]
mov dword [ebp - 0x314], eax
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x314]
push ecx
mov dword [ebp - 0x310], edx
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x10c]
push eax
push 0x40
mov dword [ebp - 8], ebx
mov dword [ebp - 4], 0x186a0
call sub.WSOCK32.dll_select
cmp eax, 0xffffffff
je 0x476210
mov edx, dword [esi + 8]
lea ecx, [ebp - 0x314]
push ecx
push edx
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
jne 0x476210
mov ecx, dword [esi + 8]
lea eax, [ebp - 0x10c]
push eax
push ecx
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
jne 0x476206
mov eax, dword [esi + 8]
lea edx, [ebp - 0x210]
push edx
push eax
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
jne 0x476206
cmp byte [esi + 0xf2], bl
je 0x476140
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
push 6
mov ecx, esi
call fcn.00476100
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x477110
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
cmp dword [ecx + 0x9c0], 0x270
jl 0x4760c3
xor eax, eax
push esi
mov esi, dword [ecx + eax*4]
mov edx, dword [ecx + eax*4 + 4]
xor edx, esi
and edx, 0x7fffffff
xor edx, esi
mov esi, edx
and esi, 1
mov esi, dword [esi*4 + 0x588b98]
shr edx, 1
xor esi, edx
xor esi, dword [ecx + eax*4 + 0x634]
mov dword [ecx + eax*4], esi
inc eax
cmp eax, 0xe3
jl 0x476013
cmp eax, 0x26f
jge 0x476083
lea ecx, [ecx]
mov esi, dword [ecx + eax*4]
mov edx, dword [ecx + eax*4 + 4]
xor edx, esi
and edx, 0x7fffffff
xor edx, esi
mov esi, edx
and esi, 1
mov esi, dword [esi*4 + 0x588b98]
shr edx, 1
xor esi, edx
xor esi, dword [ecx + eax*4 - 0x38c]
mov dword [ecx + eax*4], esi
inc eax
cmp eax, 0x26f
jl 0x476050
mov eax, dword [ecx + 0x9bc]
mov edx, dword [ecx]
mov esi, dword [ecx + 0x630]
xor eax, edx
mov edx, dword [ecx + 0x9bc]
and eax, 0x7fffffff
xor eax, edx
mov edx, eax
and edx, 1
mov edx, dword [edx*4 + 0x588b98]
xor edx, esi
shr eax, 1
xor edx, eax
mov dword [ecx + 0x9bc], edx
mov dword [ecx + 0x9c0], 0
pop esi
mov eax, dword [ecx + 0x9c0]
mov edx, dword [ecx + eax*4]
inc eax
mov dword [ecx + 0x9c0], eax
mov eax, edx
shr eax, 0xb
xor edx, eax
mov ecx, edx
and ecx, 0xff3a58ad
shl ecx, 7
xor edx, ecx
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
and eax, 0x7fffffff
ret
jmp 0x476000

Function at 0x477120
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov ecx, 0x58e320
jmp fcn.00477110