joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46a394
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x5b52c8]
cmp byte [eax + 0xc], 0
je 0x46a501
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46a4fa
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x5bac94], 0
jne 0x46a3e8
push 0x46a508
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x46a510
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5bac94], eax
cmp dword [0x5b19ac], 0
jne 0x46a4e3
push 0x46a520
call sub.kernel32.dll_LoadLibraryA
mov dword [0x5b19ac], eax
cmp dword [0x5b19ac], 0
je 0x46a4e3
push 0x46a52c
mov eax, dword [0x5b19ac]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5bac98], eax
push 0x46a53c
mov eax, dword [0x5b19ac]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5bac9c], eax
push 0x46a550
mov eax, dword [0x5b19ac]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5baca0], eax
push 0x46a568
mov eax, dword [0x5b19ac]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5baca4], eax
push 0x46a580
mov eax, dword [0x5b19ac]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5baca8], eax
push 0x46a594
mov eax, dword [0x5b19ac]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5bacac], eax
push 0x46a5ac
mov eax, dword [0x5b19ac]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5bacb0], eax
push 0x46a5c4
mov eax, dword [0x5b19ac]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5bacb4], eax
push 0x46a5e0
mov eax, dword [0x5b19ac]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5bacb8], eax
push 0x46a5ec
mov eax, dword [0x5b19ac]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5bacbc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46a501
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret
Function at 0x47ac08
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea esi, [ebp - 4]
xor eax, eax
push ebp
push 0x47addc
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 8]
mov eax, dword [esi]
call fcn.00463e70
mov eax, dword [esi]
cmp byte [eax + 0x258], 0
je 0x47adc1
call sub.kernel32.dll_GetTickCount
mov edx, dword [esi]
sub eax, dword [edx + 0x268]
mov edx, dword [esi]
cmp eax, dword [edx + 0x2c0]
jb 0x47ac6e
mov eax, dword [esi]
add eax, 0x264
call fcn.00404ee8
call sub.kernel32.dll_GetTickCount
mov edx, dword [esi]
mov dword [edx + 0x268], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
cmp al, 8
je 0x47ad48
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
mov edx, dword [0x5b5298]
movzx eax, al
bt dword [edx], eax
jae 0x47ad05
push 1
push 0x102
push 0x102
mov eax, dword [esi]
call fcn.00464ef4
push eax
lea eax, [ebp - 0x24]
push eax
call sub.user32.dll_PeekMessageA
test eax, eax
je 0x47ad8c
mov eax, dword [esi]
push dword [eax + 0x264]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 8]
movzx edx, byte [edx]
call fcn.004050d0
push dword [ebp - 0x28]
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 0x1c]
call fcn.004050d0
push dword [ebp - 0x2c]
mov eax, dword [esi]
add eax, 0x264
mov edx, 3
call fcn.0040527c
mov eax, dword [ebp - 8]
mov byte [eax], 0
jmp 0x47ad8c
lea eax, [ebp - 0x30]
mov edx, dword [ebp - 8]
movzx edx, byte [edx]
call fcn.004050d0
mov edx, dword [ebp - 0x30]
mov eax, dword [esi]
add eax, 0x264
call fcn.004051b4
jmp 0x47ad8c
mov eax, dword [esi]
mov ebx, dword [eax + 0x264]
test ebx, ebx
je 0x47ad35
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [esi]
add eax, 0x264
mov ecx, 1
mov edx, ebx
call fcn.00405420
mov eax, dword [esi]
mov eax, dword [eax + 0x264]
call fcn.004051a8
mov edx, eax
mov eax, dword [esi]
mov eax, dword [eax + 0x264]
call fcn.0040f438
cmp al, 2
je 0x47ad24
mov eax, dword [esi]
mov eax, dword [eax + 0x264]
test eax, eax
je 0x47ad79
sub eax, 4
mov eax, dword [eax]
mov edx, dword [esi]
add edx, 0x264
mov ecx, 1
xchg edx, eax
call fcn.00405420
mov eax, dword [esi]
mov eax, dword [eax + 0x264]
test eax, eax
je 0x47ad9d
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x47adaa
push ebp
call fcn.0047ab20
pop ecx
jmp 0x47adc1
xor edx, edx
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0xe0]
mov eax, dword [esi]
mov si, 0xffeb
call fcn.00404180
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47ade3
lea eax, [ebp - 0x30]
mov edx, 3
call fcn.00404f0c
ret
Function at 0x47b6bc
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00405368
xor eax, eax
push ebp
push 0x47b7f1
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x47b7c4
xor edx, edx
push ebp
push 0x47b7bd
push dword fs:[edx]
mov dword fs:[edx], esp
mov ebx, dword [ebp - 4]
mov eax, ebx
test eax, eax
je 0x47b709
sub eax, 4
mov eax, dword [eax]
inc eax
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x47b792
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov esi, eax
xor eax, eax
push ebp
push 0x47b781
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x47b748
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [ebp - 4]
call fcn.00405378
lea ecx, [ebx + 1]
mov edx, esi
call fcn.0040324c
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b788
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x5b498c]
mov dl, 1
mov eax, dword [0x408afc]
call fcn.0040ead0
call fcn.00404838
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b7f8
lea eax, [ebp - 4]
call fcn.00404ee8
ret
Function at 0x47b800
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47b9bb
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.0040566c
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
mov ecx, 0x47b9d4
call fcn.00405200
mov eax, ebx
call fcn.00429ce8
mov edi, eax
dec edi
test edi, edi
jl 0x47b8b8
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.00429cbc
mov edx, dword [0x472470]
call fcn.00404110
test al, al
je 0x47b8b4
push dword [ebp - 8]
mov edx, esi
mov eax, ebx
call fcn.00429cbc
lea edx, [ebp - 0x14]
call fcn.0045ce00
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.0040566c
push dword [ebp - 0x18]
lea eax, [ebp - 8]
mov edx, 3
call fcn.0040527c
inc esi
dec edi
jne 0x47b866
movzx eax, byte [0x47b9d8]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x47b9e4
mov eax, dword [ebp - 8]
call fcn.0040fe28
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 8]
call fcn.00404f80
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.0045ce00
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x47b9d4
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x360]
call fcn.0045ce00
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x47b9d4
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x47b9d4
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x47b9f0
call fcn.0040b4d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b9c2
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.00404f0c
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00404f0c
lea eax, [ebp - 0x14]
call fcn.00404ee8
lea eax, [ebp - 0x10]
call fcn.00404ee8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404f0c
ret
Function at 0x47d550
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405368
xor eax, eax
push ebp
push 0x47d5ce
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00405378
mov dword [ebp - 8], eax
cmp dword [ebx + 8], 0
jne 0x47d599
mov eax, dword [ebx + 4]
call fcn.00405378
push eax
push 0
call sub.advapi32.dll_RegisterEventSourceA
mov dword [ebx + 8], eax
push 0
lea eax, [ebp - 8]
push eax
push 0
push 1
push 0
mov eax, dword [ebp + 8]
push eax
movzx eax, word [ebp + 0xc]
push eax
push esi
mov eax, dword [ebx + 8]
push eax
call sub.advapi32.dll_ReportEventA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47d5d5
lea eax, [ebp - 4]
call fcn.00404ee8
ret

Function at 0x47e670
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47e815
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
xor eax, eax
call fcn.004034a8
cmp word [ebx + 0xa2], 0
je 0x47e6b9
mov edx, ebx
mov eax, dword [ebx + 0xa4]
call dword [ebx + 0xa0]
mov eax, dword [ebx + 0x90]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x47e6cd
lea esi, [ebp - 0xc]
jmp 0x47e6cf
xor esi, esi
cmp dword [ebx + 0x80], 0
jne 0x47e6dc
xor edi, edi
jmp 0x47e6e9
mov eax, dword [ebx + 0x80]
call fcn.00405378
mov edi, eax
mov eax, dword [ebx + 0x7c]
call fcn.00405378
push eax
push edi
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.0047dd20
mov eax, dword [ebp - 0x14]
call fcn.00405378
push eax
push esi
mov eax, dword [ebx + 0x74]
call fcn.00405378
push eax
mov eax, dword [ebp - 4]
call fcn.00405378
push eax
mov eax, ebx
call fcn.0047de60
push eax
mov eax, ebx
call fcn.0047de34
push eax
mov eax, ebx
call fcn.0047ddec
push eax
push 0xf01ff
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.0047dbec
mov eax, dword [ebp - 0x18]
call fcn.00405378
push eax
mov eax, dword [ebx + 8]
call fcn.00405378
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CreateServiceA
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x90], eax
cmp dword [ebp - 0x10], 0
jne 0x47e772
call fcn.004102f0
xor edx, edx
push ebp
push 0x47e7eb
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x47e7b0
push dword fs:[edx]
mov dword fs:[edx], esp
cmp word [ebx + 0xaa], 0
je 0x47e7a6
mov edx, ebx
mov eax, dword [ebx + 0xac]
call dword [ebx + 0xa8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47e7d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47e7f2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
Function at 0x47e824
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp word [eax + 0xb2], 0
je 0x47e850
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0xb4]
call dword [esi + 0xb0]
push 0xf01ff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00405378
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x47e875
call fcn.004102f0
xor eax, eax
push ebp
push 0x47e8ac
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_DeleteService
test eax, eax
jne 0x47e895
call fcn.004102f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47e8b3
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret

Function at 0x480b1c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x480b6d
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x480b54
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x480b44
jmp 0x480b6d
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x480b55
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a8460
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov eax, esp
xor ecx, ecx
mov edx, 0x94
call fcn.00403814
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 4], 5
jb 0x4a8496
cmp dword [esp + 8], 1
jb 0x4a8496
cmp dword [esp + 0x10], 2
je 0x4a849a
xor eax, eax
jmp 0x4a849c
mov al, 1
add esp, 0x94
ret

Function at 0x4a84a4
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov eax, esp
xor ecx, ecx
mov edx, 0x94
call fcn.00403814
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 4], 6
jne 0x4a84da
cmp dword [esp + 8], 0
jne 0x4a84da
cmp dword [esp + 0x10], 2
je 0x4a84de
xor eax, eax
jmp 0x4a84e0
mov al, 1
add esp, 0x94
ret
Function at 0x5010d8
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov eax, esi
mov edx, dword [0x4f30d8]
call fcn.00404110
test al, al
je 0x5011a6
movzx edx, byte [ebx + 5]
mov edi, esi
mov eax, edi
call fcn.005011b4
movzx eax, byte [ebx + 6]
mov byte [edi + 6], al
movzx edx, byte [ebx + 7]
mov eax, edi
call fcn.005011ec
movzx eax, byte [ebx + 8]
mov byte [edi + 8], al
movzx edx, byte [ebx + 9]
mov eax, edi
call fcn.005012a8
movzx eax, byte [ebx + 0xa]
mov byte [edi + 0xa], al
movzx edx, byte [ebx + 0xb]
mov eax, edi
call fcn.005011fc
movzx edx, byte [ebx + 0xc]
mov eax, edi
call fcn.00501210
movzx edx, byte [ebx + 0xd]
mov eax, edi
call fcn.00501224
movzx edx, byte [ebx + 0xf]
mov eax, edi
call fcn.005012c4
mov edx, dword [ebx + 0x14]
mov eax, edi
call fcn.00501338
movzx eax, byte [ebx + 4]
mov byte [edi + 4], al
movzx eax, byte [ebx + 0x10]
mov byte [edi + 0x10], al
movzx edx, byte [ebx + 0x18]
mov eax, edi
call fcn.005013e4
movzx edx, byte [ebx + 0x1a]
mov eax, edi
call fcn.0050135c
mov eax, ebx
call fcn.005013b0
mov edx, eax
mov eax, edi
call fcn.005013bc
movzx eax, byte [ebx + 0x19]
mov byte [edi + 0x19], al
movzx eax, byte [ebx + 0x20]
mov byte [edi + 0x20], al
jmp 0x5011af
mov edx, esi
mov eax, ebx
call fcn.00420934
pop edi
pop esi
pop ebx
ret

Function at 0x50bd14
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x50bda9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebx + 4]
call fcn.00404ee8
push 0
mov eax, dword [ebp + 8]
push eax
lea eax, [esi + edi]
push eax
mov eax, dword [ebx + 0x20]
push eax
call sub.wsock32.dll_recv
mov esi, eax
cmp esi, 0xffffffff
jne 0x50bd93
lea eax, [ebp - 4]
push eax
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x50bdc4
call fcn.0040b4d8
mov edx, dword [ebp - 4]
lea eax, [ebx + 4]
call fcn.00404f3c
xor esi, esi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50bdb0
lea eax, [ebp - 4]
call fcn.00404ee8
ret
Function at 0x50bdfc
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x50be91
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebx + 4]
call fcn.00404ee8
push 0
mov eax, dword [ebp + 8]
push eax
lea eax, [esi + edi]
push eax
mov eax, dword [ebx + 0x20]
push eax
call sub.wsock32.dll_send
mov esi, eax
cmp esi, 0xffffffff
jne 0x50be7b
lea eax, [ebp - 4]
push eax
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x50beac
call fcn.0040b4d8
mov edx, dword [ebp - 4]
lea eax, [ebx + 4]
call fcn.00404f3c
xor esi, esi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50be98
lea eax, [ebp - 4]
call fcn.00404ee8
ret

Function at 0x50ebb4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov eax, dword [ebp + 0x10]
call fcn.004069c4
mov eax, dword [ebp + 0xc]
call fcn.004069c4
xor eax, eax
push ebp
push 0x50ec1f
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp + 8]
dec edx
test edx, edx
jl 0x50ebfe
inc edx
xor eax, eax
lea ecx, [eax + esi]
movzx ecx, byte [ebx + ecx]
mov edi, dword [ebp + 0xc]
xor cl, byte [edi + eax]
mov edi, dword [ebp + 0x10]
mov byte [edi + eax], cl
inc eax
dec edx
jne 0x50ebe7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50ec26
lea eax, [ebp + 0xc]
mov edx, dword [0x408aa4]
mov ecx, 2
call fcn.00405c6c
ret

Function at 0x50ec30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.004069c4
mov eax, dword [ebp - 8]
call fcn.004069c4
xor eax, eax
push ebp
push 0x50ec98
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp + 8]
dec edx
test edx, edx
jl 0x50ec77
inc edx
xor eax, eax
mov ecx, dword [ebp - 8]
movzx ecx, byte [ecx + eax]
mov ebx, dword [ebp - 4]
xor byte [ebx + eax], cl
inc eax
dec edx
jne 0x50ec66
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50ec9f
lea eax, [ebp - 8]
mov edx, dword [0x408aa4]
mov ecx, 2
call fcn.00405c6c
ret
Function at 0x50eca8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405368
xor eax, eax
push ebp
push 0x50ee9e
push dword fs:[eax]
mov dword fs:[eax], esp
push 8
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, dword [0x408aa4]
call fcn.00406840
add esp, 4
push 2
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x4076ec]
call fcn.00406840
add esp, 4
push 2
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, dword [0x4076ec]
call fcn.00406840
add esp, 4
push 0
lea eax, [ebp - 0x14]
mov ecx, 1
mov edx, dword [0x408aa4]
call fcn.00406840
add esp, 4
xor edi, edi
mov eax, dword [ebp - 0x10]
push eax
push 0
push 8
xor ecx, ecx
mov edx, dword [ebx + 0x60]
mov eax, dword [0x4cb064]
call fcn.004cbad4
cmp dword [ebp - 4], 0
je 0x50ee58
mov eax, dword [ebx + 0x18]
call fcn.0050a09c
mov esi, eax
mov eax, dword [0x4caf80]
call fcn.004cb43c
lea ecx, [ebp - 0x14]
mov edx, dword [ebp - 4]
call dword [eax]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
mov eax, dword [ebx]
call fcn.0050ef68
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebx]
call fcn.0050ef68
mov eax, dword [ebp - 8]
mov edx, dword [eax + 4]
mov eax, dword [eax]
push edx
push eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 4]
mov eax, dword [eax]
xor eax, dword [esp]
xor edx, dword [esp + 4]
add esp, 8
push edx
push eax
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0xc]
mov eax, dword [eax + 8]
push edx
push eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0xc]
mov eax, dword [eax + 8]
xor eax, dword [esp]
xor edx, dword [esp + 4]
add esp, 8
push edx
push eax
lea edx, [ebp - 0x38]
mov eax, dword [ebx]
call fcn.0050ef18
jmp 0x50ee0b
inc edi
lea edx, [ebp - 0x38]
mov eax, dword [ebx]
call fcn.0050eeb0
fmul dword [0x50eeac]
add esp, 0xfffffff4
fstp xword [esp]
wait
call fcn.0042b9c4
add al, 0x40
mov byte [ebp - 0x16], al
movzx edx, byte [ebp - 0x16]
mov eax, dword [ebx + 0x18]
call fcn.0050a31c
mov eax, dword [ebp - 0x10]
call fcn.00406684
cmp edi, eax
jl 0x50eddd
lea edx, [ebp - 0x38]
mov eax, dword [ebx]
call fcn.0050eeb0
fmul dword [0x50eeac]
add esp, 0xfffffff4
fstp xword [esp]
wait
call fcn.0042b9c4
mov byte [ebp - 0x15], al
mov eax, dword [ebx + 0x18]
call fcn.0050a09c
mov edi, eax
mov eax, dword [ebx + 0x18]
call fcn.0050a07c
cmp edi, esi
je 0x50ee58
movzx edx, byte [ebp - 0x15]
xor byte [eax + esi], dl
inc esi
cmp edi, esi
jne 0x50ee4c
xor edx, edx
mov eax, dword [ebx + 0x18]
call fcn.0050a31c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50eea5
lea eax, [ebp - 0x14]
mov edx, dword [0x408aa4]
mov ecx, 2
call fcn.00405c6c
lea eax, [ebp - 0xc]
mov edx, dword [0x4076ec]
mov ecx, 2
call fcn.00405c6c
lea eax, [ebp - 4]
call fcn.00404ee8
ret
Function at 0x50f368
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov ebx, eax
mov esi, 0x10
mov ecx, dword [ebx + esi*4 + 0xc]
xor ecx, dword [ebx + esi*4 - 8]
xor ecx, dword [ebx + esi*4 - 0x20]
xor ecx, dword [ebx + esi*4 - 0x28]
mov edx, 1
mov eax, ebx
call fcn.0050f2a4
mov dword [ebx + esi*4 + 0x18], eax
inc esi
cmp esi, 0x50
jne 0x50f376
mov edi, dword [ebx + 4]
mov eax, dword [ebx + 8]
mov dword [esp], eax
mov eax, dword [ebx + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x14]
mov dword [esp + 0xc], eax
xor esi, esi
mov ecx, edi
mov edx, 5
mov eax, ebx
call fcn.0050f2a4
mov ebp, eax
mov eax, dword [esp + 4]
push eax
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [esp + 8]
mov edx, esi
mov eax, ebx
call fcn.0050f304
add ebp, eax
add ebp, dword [esp + 0xc]
add ebp, dword [ebx + esi*4 + 0x18]
mov edx, esi
mov eax, ebx
call fcn.0050f2bc
add ebp, eax
mov eax, dword [esp + 8]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 4]
mov dword [esp + 8], eax
mov ecx, dword [esp]
mov edx, 0x1e
mov eax, ebx
call fcn.0050f2a4
mov dword [esp + 4], eax
mov dword [esp], edi
mov edi, ebp
inc esi
cmp esi, 0x50
jne 0x50f3bc
add dword [ebx + 4], edi
mov eax, dword [esp]
add dword [ebx + 8], eax
mov eax, dword [esp + 4]
add dword [ebx + 0xc], eax
mov eax, dword [esp + 8]
add dword [ebx + 0x10], eax
mov eax, dword [esp + 0xc]
add dword [ebx + 0x14], eax
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret