joyce8/EMBER2024-capa huggingface dataset:
Function at 0x480080
Capabilities:
Resolve dns

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x4800c5
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x4800c5
push esi
push edi
mov edi, dword [esp + 0x10]
xor dl, dl
jmp 0x4800a0
mov esi, dword [eax + 0xc]
movzx ecx, dl
shl ecx, 2
mov esi, dword [ecx + esi]
test esi, esi
je 0x4800bc
mov esi, dword [esi]
inc dl
cmp dl, 0xa
mov dword [ecx + edi], esi
jb 0x4800a0
pop edi
movzx ax, dl
pop esi
ret 8
xor ax, ax
ret 8

Function at 0x4807f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x408
mov eax, dword [0x4d757c]
push esi
push edi
mov dword [esp + 0x40c], eax
mov edx, ecx
xor eax, eax
mov word [esp + 8], 0
mov ecx, 0xff
lea edi, [esp + 0xa]
rep stosd dword es:[edi], eax
add edx, 0x184c
push edx
stosw word es:[edi], ax
lea eax, [esp + 0xc]
push str._sdataLoginError000.dat
push eax
call dword [sym.imp.MSVCR71.dll_swprintf]
lea ecx, [esp + 0x14]
push 0x4c1ce0
push ecx
call dword [sym.imp.MSVCR71.dll__wfopen]
mov esi, eax
add esp, 0x14
test esi, esi
je 0x480892
push 2
push 0
push esi
call dword [sym.imp.MSVCR71.dll_fseek]
mov edx, dword [ebp + 8]
push esi
push 1
push 0x318
push edx
call dword [sym.imp.MSVCR71.dll_fwrite]
push esi
call dword [sym.imp.MSVCR71.dll_fclose]
add esp, 0x20
mov eax, 1
mov ecx, dword [esp + 0x40c]
call fcn.0045a4fd
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esp + 0x40c]
xor eax, eax
call fcn.0045a4fd
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4818b0
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x49f21b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push ebp
xor eax, eax
push esi
mov dword [esp + 0x1c], eax
push edi
mov edi, ecx
xor ebp, ebp
mov dword [esp + 0x24], eax
push 6
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x2c], eax
call fcn.00450490
add esp, 4
test al, al
je 0x48191a
push str.CLoginSessionImpl::ConnectFourBackupDomain___Begin_Connect_4_Backup_Domain__n
push 0x408
push str..LoginSessionImpl.cpp
push 6
call fcn.004504b0
add esp, 0xc
push eax
call fcn.004506e0
add esp, 8
lea esi, [edi + 0x530]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
mov dword [edi + 0x1838], 0xffffffff
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor esi, esi
lea ebx, [ebx]
push 0x120
call sub.MFC71U.DLL_CWordArray::CWordArray
mov ebx, eax
add esp, 4
mov dword [esp + 0x18], ebx
cmp ebx, ebp
mov dword [esp + 0x34], ebp
je 0x481984
mov edi, ebx
mov ebp, 0xa
mov ecx, edi
call fcn.00458010
add edi, 0x1c
dec ebp
jne 0x481962
xor eax, eax
mov ecx, 0x48
mov edi, ebx
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x10]
mov eax, ebx
xor ebp, ebp
jmp 0x481986
xor eax, eax
lea ecx, [esp + 0x14]
push ecx
push ebp
push eax
push 0x4817a0
push ebp
push ebp
mov dword [esp + 0x4c], 0xffffffff
mov word [eax + 0x11a], si
mov dword [eax + 0x11c], edi
call dword [sym.imp.MSVCR71.dll__beginthreadex]
add esp, 0x18
mov dword [esp + esi*4 + 0x1c], eax
inc esi
cmp esi, 4
jl 0x481940
push 0x1d4c0
push 1
lea edx, [esp + 0x24]
push edx
push 4
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
xor ebx, ebx
lea esi, [edi + 0x1828]
cmp ebx, dword [edi + 0x1838]
je 0x4819f6
mov ecx, dword [esi]
cmp ecx, ebp
je 0x4819f6
mov eax, dword [ecx]
call dword [eax + 0x10]
push esi
call fcn.0048ed00
add esp, 4
mov dword [esi], ebp
inc ebx
add esi, 4
cmp ebx, 4
jl 0x4819d8
mov ecx, dword [edi + 0x28]
pop edi
xor eax, eax
pop esi
cmp ecx, 2
mov ecx, dword [esp + 0x24]
pop ebp
sete al
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x482720
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x724
mov eax, dword [0x4d757c]
push ebx
push esi
push edi
mov dword [esp + 0x72c], eax
mov edx, ecx
xor eax, eax
mov word [esp + 0x328], 0
mov ecx, 0xff
lea edi, [esp + 0x32a]
rep stosd dword es:[edi], eax
add edx, 0x184c
push edx
stosw word es:[edi], ax
lea eax, [esp + 0x32c]
push str._sdataLoginError000.dat
push eax
call dword [sym.imp.MSVCR71.dll_swprintf]
lea ecx, [esp + 0x334]
push 0x4ae6f8
push ecx
call dword [sym.imp.MSVCR71.dll__wfopen]
mov ebx, eax
add esp, 0x14
test ebx, ebx
je 0x482830
push 0
push 0
push ebx
call dword [sym.imp.MSVCR71.dll_fseek]
push ebx
push 1
lea edx, [esp + 0x24]
xor eax, eax
push 0x318
mov ecx, 0xc6
lea edi, [esp + 0x28]
push edx
rep stosd dword es:[edi], eax
call dword [sym.imp.MSVCR71.dll_fread]
add esp, 0x1c
cmp eax, 1
jne 0x482826
mov eax, dword [esp + 0x10]
test eax, eax
jle 0x4827fe
cmp eax, 0x3e8
jge 0x4827fe
mov ecx, dword [ebp + 8]
mov esi, dword [ecx + 4]
mov edx, dword [esi + 4]
lea eax, [esp + 0x10]
push eax
push edx
push esi
call fcn.00481500
mov ecx, dword [ebp + 8]
push 1
mov edi, eax
call fcn.00481540
mov dword [esi + 4], edi
mov eax, dword [edi + 4]
mov dword [eax], edi
push ebx
xor eax, eax
mov ecx, 0xc6
lea edi, [esp + 0x14]
push 1
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x18]
push 0x318
push ecx
call dword [sym.imp.MSVCR71.dll_fread]
add esp, 0x10
cmp eax, 1
je 0x4827c6
push ebx
call dword [sym.imp.MSVCR71.dll_fclose]
add esp, 4
mov ecx, dword [esp + 0x72c]
mov eax, 1
call fcn.0045a4fd
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x484340
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x49f416
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x238
mov eax, dword [0x4d757c]
push ebx
push esi
push edi
mov esi, ecx
mov dword [esp + 0x23c], eax
xor eax, eax
xor ebx, ebx
mov word [esp + 0x30], bx
mov ecx, 0x81
lea edi, [esp + 0x32]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esi + 0x184c]
push eax
lea ecx, [esp + 0x34]
push str._sdataSpread.dat
push ecx
call dword [sym.imp.MSVCR71.dll_swprintf]
mov edx, dword [0x4e39a0]
add esp, 0xc
mov ecx, 0x4e39a0
mov byte [esp + 0x13], bl
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x18], eax
mov eax, dword [0x4e39a0]
mov ecx, 0x4e39a0
mov dword [esp + 0x24c], ebx
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x23]
push edx
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x48]
push ecx
mov byte [esp + 0x268], 1
call fcn.00483db0
add esp, 0x1c
test eax, eax
je 0x484489
mov dl, byte [esp + 0x13]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov edi, dword [sym.imp.MSVCR71.dll_wcsncpy]
mov byte [esi + 0x88], dl
mov edx, dword [esp + 0x1c]
mov dword [esi + 0x90], eax
mov eax, dword [esp + 0x20]
mov dword [esi + 0x98], edx
mov edx, dword [esp + 0x18]
push 0x200
mov dword [esi + 0x520], eax
mov dword [esi + 0x94], ecx
mov ecx, dword [esp + 0x28]
push edx
lea eax, [esi + 0x9c]
push eax
mov dword [esi + 0x524], ecx
call edi
mov ecx, dword [esp + 0x20]
push 0x40
push ecx
add esi, 0x49e
push esi
call edi
add esp, 0x18
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x24c], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4844ae
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov dword [esp + 0x24c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4844d7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x244]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x23c]
call fcn.0045a4fd
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4845f0
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [esp + 4]
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
push edi
lea edi, [ebp - 2]
xor ecx, ecx
test edi, edi
jle 0x484683
push ebx
lea esp, [esp]
movzx edx, byte [esi + ecx]
mov ebx, dword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
shr edx, 2
mov dl, byte [edx + ebx]
mov byte [eax], dl
movzx ebx, byte [esi + ecx + 1]
xor edx, edx
mov dl, byte [esi + ecx]
shr ebx, 4
inc eax
add ecx, 3
and edx, 3
shl edx, 4
or edx, ebx
mov ebx, dword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov dl, byte [edx + ebx]
mov byte [eax], dl
movzx ebx, byte [esi + ecx - 1]
xor edx, edx
mov dl, byte [esi + ecx - 2]
shr ebx, 6
inc eax
and edx, 0xf
shl edx, 2
or edx, ebx
mov ebx, dword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov dl, byte [edx + ebx]
mov byte [eax], dl
mov ebx, dword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
xor edx, edx
mov dl, byte [esi + ecx - 1]
inc eax
and edx, 0x3f
mov dl, byte [edx + ebx]
mov byte [eax], dl
inc eax
cmp ecx, edi
jl 0x484610
pop ebx
cmp ecx, ebp
jge 0x484703
movzx edx, byte [ecx + esi]
mov edi, dword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
shr edx, 2
mov dl, byte [edx + edi]
mov byte [eax], dl
inc eax
dec ebp
cmp ecx, ebp
jne 0x4846cb
movzx ecx, byte [ecx + esi]
mov edx, dword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
and ecx, 3
shl ecx, 4
mov cl, byte [ecx + edx]
mov edx, dword [esp + 0x10]
mov byte [eax], cl
inc eax
mov byte [eax], 0x3d
inc eax
mov byte [eax], 0x3d
inc eax
pop edi
mov byte [eax], 0
sub eax, edx
pop esi
inc eax
pop ebp
ret
lea edx, [ecx + esi + 1]
movzx ecx, byte [ecx + esi]
movzx esi, byte [edx]
and ecx, 3
shl ecx, 4
shr esi, 4
or ecx, esi
mov esi, dword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov cl, byte [ecx + esi]
mov byte [eax], cl
movzx edx, byte [edx]
mov ecx, dword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
and edx, 0xf
mov dl, byte [ecx + edx*4]
inc eax
mov byte [eax], dl
inc eax
mov byte [eax], 0x3d
inc eax
mov edx, dword [esp + 0x10]
pop edi
mov byte [eax], 0
sub eax, edx
pop esi
inc eax
pop ebp
ret

Function at 0x484b20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x400
push esi
push edi
mov edx, ecx
xor eax, eax
mov dword [esp + 8], 0
mov ecx, 0xff
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
push eax
mov ecx, edx
call fcn.00484a70
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov esi, dword [ebp + 8]
or eax, 0xffffffff
test edx, edx
je 0x484b7e
dec dword [ecx]
xor edx, edx
mov dl, byte [esi]
xor edx, eax
and edx, 0xff
mov edi, dword [esp + edx*4 + 8]
mov edx, dword [ecx]
shr eax, 8
xor eax, edi
inc esi
test edx, edx
jne 0x484b60
mov edx, dword [ecx]
dec edx
pop edi
mov dword [ecx], edx
not eax
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x484c00
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
mov eax, dword [0x4d757c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x18]
mov ecx, eax
mov edx, dword [ecx]
mov dword [esp], edx
mov edx, dword [ecx + 4]
mov dword [esp + 4], edx
mov edx, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
push ebx
push esi
mov dword [esp + 0x14], ecx
lea ecx, [eax + 1]
push edi
mov dword [esp + 0x14], edx
mov eax, 0x4c26ed
mov esi, 4
lea esp, [esp]
movzx edi, byte [eax - 4]
mov bl, byte [esp + edi + 0xc]
movzx edx, byte [eax - 5]
mov dl, byte [esp + edx + 0xc]
xor dl, bl
movzx edi, byte [eax - 3]
xor dl, byte [esp + edi + 0xc]
movzx edi, byte [eax - 2]
xor dl, byte [esp + edi + 0xc]
movzx edi, byte [eax - 1]
xor dl, byte [esp + edi + 0xc]
movzx edi, byte [eax + 1]
xor dl, byte [esp + edi + 0xc]
movzx edi, byte [eax]
xor dl, byte [esp + edi + 0xc]
mov byte [ecx - 1], dl
movzx edi, byte [eax + 7]
mov bl, byte [esp + edi + 0xc]
movzx edx, byte [eax + 8]
mov dl, byte [esp + edx + 0xc]
movzx edi, byte [eax + 6]
xor dl, bl
mov bl, byte [esp + edi + 0xc]
movzx edi, byte [eax + 5]
xor dl, bl
mov bl, byte [esp + edi + 0xc]
movzx edi, byte [eax + 4]
xor dl, bl
mov bl, byte [esp + edi + 0xc]
movzx edi, byte [eax + 3]
xor dl, bl
mov bl, byte [esp + edi + 0xc]
movzx edi, byte [eax + 2]
xor dl, bl
xor dl, byte [esp + edi + 0xc]
mov byte [ecx], dl
movzx edi, byte [eax + 0xe]
mov bl, byte [esp + edi + 0xc]
movzx edx, byte [eax + 0xf]
mov dl, byte [esp + edx + 0xc]
movzx edi, byte [eax + 0xd]
xor dl, bl
mov bl, byte [esp + edi + 0xc]
movzx edi, byte [eax + 0xc]
xor dl, bl
mov bl, byte [esp + edi + 0xc]
movzx edi, byte [eax + 0xb]
xor dl, bl
mov bl, byte [esp + edi + 0xc]
movzx edi, byte [eax + 0xa]
xor dl, bl
mov bl, byte [esp + edi + 0xc]
movzx edi, byte [eax + 9]
xor dl, bl
xor dl, byte [esp + edi + 0xc]
mov byte [ecx + 1], dl
movzx edi, byte [eax + 0x15]
mov bl, byte [esp + edi + 0xc]
movzx edx, byte [eax + 0x16]
mov dl, byte [esp + edx + 0xc]
movzx edi, byte [eax + 0x14]
xor dl, bl
mov bl, byte [esp + edi + 0xc]
movzx edi, byte [eax + 0x13]
xor dl, bl
mov bl, byte [esp + edi + 0xc]
movzx edi, byte [eax + 0x12]
xor dl, bl
mov bl, byte [esp + edi + 0xc]
movzx edi, byte [eax + 0x11]
xor dl, bl
mov bl, byte [esp + edi + 0xc]
movzx edi, byte [eax + 0x10]
xor dl, bl
xor dl, byte [esp + edi + 0xc]
mov byte [ecx + 2], dl
add ecx, 4
add eax, 0x1c
dec esi
jne 0x484c40
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
call fcn.0045a4fd
add esp, 0x14
ret 4
Function at 0x484d70
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov edx, dword [esp + 8]
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
push edi
mov edi, edx
mov ebp, ebx
lea esi, [edx + 3]
sub edi, eax
sub ebp, eax
lea ecx, [ebx + 1]
sub edx, ebx
mov dword [esp + 0x10], 4
lea esp, [esp]
mov bl, byte [edi + eax]
xor bl, byte [eax]
add eax, 4
mov byte [eax + ebp - 4], bl
mov bl, byte [edx + ecx]
xor bl, byte [eax - 3]
add ecx, 4
mov byte [ecx - 4], bl
mov bl, byte [eax - 2]
xor bl, byte [esi - 1]
add esi, 4
mov byte [ecx - 3], bl
mov bl, byte [eax - 1]
xor bl, byte [esi - 4]
mov byte [ecx - 2], bl
dec dword [esp + 0x10]
jne 0x484da0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x4860e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49f4bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc2c
mov eax, dword [0x4d757c]
push ebx
push esi
push edi
mov dword [ebp - 0x14], eax
xor eax, eax
xor esi, esi
mov word [ebp - 0x414], si
mov ecx, 0xff
lea edi, [ebp - 0x412]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x10], esp
stosw word es:[edi], ax
mov eax, dword [ebp + 0xc]
push str.dataLgsInfocfg.dat
push eax
lea ecx, [ebp - 0x414]
push str._s_s
push ecx
call dword [sym.imp.MSVCR71.dll_swprintf]
lea edx, [ebp - 0x414]
push 0x4b7c4c
push edx
call dword [sym.imp.MSVCR71.dll__wfopen]
add esp, 0x18
cmp eax, esi
mov dword [ebp - 0xc1c], eax
je 0x4862ca
call fcn.0047bb90
cmp eax, esi
mov dword [ebp - 0xc18], eax
je 0x4862ca
mov edx, dword [eax]
push 0x10
push str.876B9304_359C_42E2
mov ecx, eax
call dword [edx + 4]
push 1
push 0x400
lea eax, [ebp - 0xc14]
push eax
lea ecx, [ebp - 0xc30]
mov dword [ebp + 0xc], 0x400
mov dword [ebp - 4], esi
call fcn.00455250
mov byte [ebp - 4], 1
mov dword [ebp - 0xc20], 1
call fcn.004503c0
lea ecx, [ebp - 0xc20]
push ecx
lea ecx, [ebp - 0xc30]
mov dword [ebp - 0xc38], eax
mov dword [ebp - 0xc34], edx
call fcn.004552e0
lea edx, [ebp - 0xc38]
push edx
lea ecx, [ebp - 0xc30]
call fcn.00455390
mov ebx, dword [ebp + 8]
add ebx, 0x224
push ebx
lea ecx, [ebp - 0xc30]
call fcn.00455340
xor edi, edi
cmp edi, dword [ebx]
jge 0x486224
mov edx, dword [ebp + 8]
mov ecx, edi
imul ecx, ecx, 0x1c
lea eax, [ebp - 0xc30]
push eax
lea ecx, [ecx + edx + 0x228]
call fcn.00458040
inc edi
jmp 0x486202
lea ecx, [ebp - 0xc30]
call fcn.00455270
mov ecx, dword [ebp - 0xc18]
mov edx, dword [ecx]
lea edi, [ebp + 0xc]
push edi
lea edi, [ebp - 0x814]
push edi
push eax
lea eax, [ebp - 0xc14]
push eax
push 1
call dword [edx + 8]
test eax, eax
je 0x486275
mov ecx, dword [ebp - 0xc1c]
movzx edx, word [ebp + 0xc]
push ecx
push 1
push edx
mov eax, edi
push eax
call dword [sym.imp.MSVCR71.dll_fwrite]
add esp, 0x10
mov esi, eax
dec esi
neg esi
sbb esi, esi
inc esi
lea ecx, [ebp - 0xc30]
mov byte [ebp - 4], 0
call fcn.00426080
jmp 0x486296
mov ecx, dword [ebp - 0xc1c]
push ecx
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.MSVCR71.dll_fclose]
mov eax, dword [ebp - 0xc18]
add esp, 4
test eax, eax
je 0x4862c6
lea edx, [ebp - 0xc18]
push edx
call fcn.0047b500
add esp, 4
mov eax, esi
jmp 0x4862cc
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.0045a4fd
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x488160
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
mov eax, dword [0x4d757c]
push ebx
mov ebx, ecx
mov dword [esp + 0x4c], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov dword [ebx], ecx
mov edx, dword [eax + 4]
mov dword [ebx + 4], edx
mov ecx, dword [eax]
mov dword [ebx + 8], ecx
mov ecx, dword [ebp + 0xc]
cmp ecx, 1
mov edx, dword [eax + 4]
push esi
push edi
mov dword [ebx + 0xc], edx
jb 0x4882c1
cmp ecx, 0x38
jbe 0x4881aa
mov dword [ebp + 0xc], 0x38
mov ecx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov eax, ecx
shr ecx, 2
lea edi, [esp + 0x1c]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edx, [ebx + 0x10]
mov ecx, 0x12
mov esi, 0x4c2948
mov edi, edx
rep movsd dword es:[edi], dword [esi]
lea edi, [ebx + 0x58]
mov ecx, 0x400
mov esi, 0x4c2990
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x1c]
xor eax, eax
mov esi, edx
mov dword [esp + 0x10], 0x12
nop
xor edx, edx
mov dword [esp + 0xc], 4
lea ebx, [ebx]
movzx edi, byte [ecx]
shl edx, 8
or edx, edi
mov edi, dword [ebp + 0xc]
inc ecx
inc eax
cmp eax, edi
jne 0x488217
xor eax, eax
lea ecx, [esp + 0x1c]
dec dword [esp + 0xc]
jne 0x488200
mov edi, dword [esi]
xor edi, edx
mov edx, dword [esp + 0x10]
mov dword [esi], edi
add esi, 4
dec edx
mov dword [esp + 0x10], edx
jne 0x4881f0
xor edi, edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
lea esi, [ebx + 0x10]
mov edi, edi
lea ecx, [esp + 0x14]
push ecx
mov ecx, ebx
call fcn.00487b20
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov dword [esi], edx
add esi, 4
inc edi
mov dword [esi], eax
inc edi
add esi, 4
cmp edi, 0x12
jb 0x488240
lea eax, [ebx + 0x58]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 4
mov esi, dword [esp + 0xc]
xor edi, edi
lea ebx, [ebx]
lea ecx, [esp + 0x14]
push ecx
mov ecx, ebx
call fcn.00487b20
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov dword [esi], edx
add esi, 4
inc edi
mov dword [esi], eax
inc edi
add esi, 4
cmp edi, 0x100
jl 0x488280
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
add ecx, 0x400
dec eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
jne 0x488274
mov ecx, dword [esp + 0x54]
mov eax, ebx
call fcn.0045a4fd
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x48ae70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xdc
push ebx
push ebp
mov ebp, ecx
mov ecx, dword [ebp + 4]
mov eax, dword [ecx + 4]
mov edx, ecx
mov cl, byte [eax + 0x81]
xor ebx, ebx
cmp cl, bl
push esi
mov esi, dword [esp + 0xec]
jne 0x48aeae
mov cl, byte [esi]
cmp byte [eax + 0x10], cl
jge 0x48aea2
mov eax, dword [eax + 8]
jmp 0x48aea6
mov edx, eax
mov eax, dword [eax]
cmp byte [eax + 0x81], bl
je 0x48ae98
cmp edx, dword [ebp + 4]
je 0x48aebe
mov al, byte [esi]
cmp al, byte [edx + 0x10]
jge 0x48af3f
xor ecx, ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], ecx
push edi
mov byte [esp + 0x44], cl
xor eax, eax
mov byte [esp + 0x14], bl
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov ecx, 0xc
lea edi, [esp + 0x45]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov al, byte [esi]
mov byte [esp + 0x7c], al
mov ecx, 0x1a
lea esi, [esp + 0x14]
lea edi, [esp + 0x84]
mov dword [esp + 0x78], ebx
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x7c]
push ecx
push edx
lea edx, [esp + 0x18]
push edx
mov ecx, ebp
call fcn.0048ac40
mov eax, dword [eax]
pop edi
pop esi
pop ebp
add eax, 0x18
pop ebx
add esp, 0xdc
ret 4
pop esi
pop ebp
lea eax, [edx + 0x18]
pop ebx
add esp, 0xdc
ret 4
Function at 0x48e3a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x49f6ee
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea eax, [esi + 0xc]
xor ebx, ebx
push eax
mov dword [esp + 0x20], ebx
mov dword [esi], 0x4c3f84
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esi + 8], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], 5
lea edi, [esi + 0x4c]
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov eax, dword [esp + 0x28]
cmp eax, ebx
mov byte [esp + 0x1c], 2
jle 0x48e426
mov ebp, dword [esp + 0x24]
mov dword [esp + 0x28], eax
lea ecx, [ecx]
push ebp
mov ecx, edi
call fcn.00486830
mov eax, dword [esp + 0x28]
add ebp, 0x1c
dec eax
mov dword [esp + 0x28], eax
jne 0x48e410
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esi + 0xec], eax
mov dword [esi + 0x60], ecx
lea ebp, [esi + 0x68]
xor eax, eax
mov ecx, 0x20
mov edi, ebp
mov dword [esi + 0x38], ebx
mov dword [esi + 0x64], edx
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x34]
mov eax, edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x48e458
sub eax, ecx
push eax
push edi
push ebp
call dword [sym.imp.MSVCR71.dll_strncpy]
mov eax, dword [esp + 0x44]
mov dword [esi + 0xe8], eax
mov eax, 0x48daf0
lea edi, [esi + 0xf0]
mov ecx, 0x100
rep stosd dword es:[edi], eax
add esp, 0xc
mov dword [esi + 0x288], 0x48dbe0
mov dword [esi + 0x298], 0x48dca0
mov dword [esi + 0x5c], ebx
call fcn.0048ec60
push 0x20
mov dword [esi + 0x48], eax
mov edx, dword [eax]
push str.58DA8D8F_818D_AFC0_949D_4210102A8DA7
mov ecx, eax
call dword [edx + 4]
mov ecx, dword [esp + 0x14]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x1c

Function at 0x48e580
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49f700
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esp
push esi
mov ecx, edi
mov dword [ebp - 4], 0
call fcn.00455390
lea eax, [esi + 8]
push eax
mov ecx, edi
call fcn.00455340
push 0x21
lea ecx, [esi + 0xc]
push ecx
mov ecx, edi
call fcn.00455400
add esi, 0x30
push esi
mov ecx, edi
call fcn.00455340
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4