joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47da10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x414]
sub esp, 0x414
push 0xffffffffffffffff
push 0x4c8260
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x51c080]
xor eax, ebp
mov dword [ebp + 0x410], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x41c]
mov dword [ebp - 0x30], edx
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x24], ebx
mov edx, 4
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], edx
mov byte [ebp - 0x11], bl
cmp eax, ebx
je 0x47dbd7
cmp ecx, ebx
je 0x47dbd7
mov dword [ebp - 4], ebx
push 0x20019
push ebx
push ecx
push eax
call dword [sym.imp.SETUPAPI.dll_SetupDiOpenDeviceInterfaceRegKey]
mov esi, eax
mov dword [ebp - 0x18], esi
cmp esi, 0xffffffff
jne 0x47daad
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x28], eax
push 0x5042a0
lea eax, [ebp - 0x28]
push eax
call fcn.004abd6e
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 0x20]
push eax
push ebx
push str.Port_Number
push esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call edi
cmp eax, ebx
je 0x47dadd
mov dword [ebp - 0x2c], eax
push 0x5042a0
lea ecx, [ebp - 0x2c]
push ecx
call fcn.004abd6e
push 0x208
push ebx
lea edx, [ebp + 0x208]
push edx
call fcn.004ab450
add esp, 0xc
mov dword [ebp - 0x1c], 0x208
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp + 0x208]
push ecx
lea edx, [ebp - 0x20]
push edx
push ebx
push str.Base_Name
push esi
call edi
test eax, eax
je 0x47db33
push 0x103
push 0x4dbce4
push 0x104
lea eax, [ebp + 0x208]
push eax
call fcn.004a9be0
add esp, 0x10
push 0x208
push ebx
lea ecx, [ebp]
push ecx
call fcn.004ab450
mov edx, dword [ebp - 0x24]
push edx
lea eax, [ebp + 0x208]
push eax
push str._s_03d
lea edx, [ebp]
call fcn.00450a40
push 0xff
lea ecx, [ebp]
push ecx
push 0x100
mov edx, dword [ebp - 0x30]
add edx, 0x206
push edx
call fcn.004a9be0
add esp, 0x28
mov byte [ebp - 0x11], 1
mov dword [ebp - 4], 0xffffffff
jmp 0x47dbc2
cmp esi, ebx
je 0x47dbd2
cmp esi, 0xffffffff
je 0x47dbd2
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 0x11]
jmp 0x47dbd9
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x410]
xor ecx, ebp
call fcn.004a998e
add ebp, 0x414
mov esp, ebp
pop ebp
ret 4
Function at 0x47edf0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0xa04]
sub esp, 0xa04
push 0xffffffffffffffff
push 0x4c8180
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x51c080]
xor eax, ebp
mov dword [ebp + 0xa00], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov ebx, edx
mov eax, dword [ebp + 0xa0c]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x11], 0
xor esi, esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
cmp edi, esi
je 0x47efa1
cmp ebx, esi
je 0x47efa1
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x18]
push ecx
push esi
push esi
push ebx
push edi
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstanceIdW]
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x47ef66
add eax, eax
mov dword [ebp - 0x18], eax
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
mov dword [ebp - 0x24], esi
test esi, esi
je 0x47ef66
mov edx, dword [ebp - 0x18]
push edx
push 0
push esi
call fcn.004ab450
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
push esi
push ebx
push edi
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstanceIdW]
test eax, eax
je 0x47ef66
push 0x800
push 0
lea edx, [ebp]
push edx
call fcn.004ab450
push 0x200
push 0
lea eax, [ebp + 0x800]
push eax
call fcn.004ab450
mov dword [ebp - 0x20], 0x100
push esi
push str.SystemCurrentControlSetEnum_sDevice_Parameters
lea edx, [ebp]
call fcn.00411a00
add esp, 0x20
lea ecx, [ebp - 0x1c]
push ecx
push 0x20019
push 0
lea edx, [ebp]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x47ef66
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp + 0x800]
push ecx
push 0
push 0
push str.PortName
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x47ef5c
push 0xff
lea eax, [ebp + 0x800]
push eax
push 0x100
mov ecx, dword [ebp - 0x28]
add ecx, 0x206
push ecx
call fcn.004a9be0
add esp, 0x10
mov byte [ebp - 0x11], 1
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
jmp 0x47ef91
test esi, esi
je 0x47ef9c
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov al, byte [ebp - 0x11]
jmp 0x47efa3
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xa00]
xor ecx, ebp
call fcn.004a998e
add ebp, 0xa04
mov esp, ebp
pop ebp
ret 4
Function at 0x47fc30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c80d0
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1004
call fcn.004ab4d0
mov eax, dword [0x51c080]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
push 0x800
xor ebx, ebx
push ebx
lea eax, [ebp - 0x814]
push eax
call fcn.004ab450
push 0x800
push ebx
lea ecx, [ebp - 0x1014]
push ecx
call fcn.004ab450
add esp, 0x18
mov dword [ebp - 4], ebx
push 0x400
lea edx, [ebp - 0x1014]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x47fccb
push str.ssdevm.dll
lea eax, [ebp - 0x1014]
push eax
push 0x4dd780
lea edx, [ebp - 0x814]
call fcn.00411a00
add esp, 0xc
jmp 0x47fce9
push 0x3ff
push str.ssdevm.dll
push 0x400
lea ecx, [ebp - 0x814]
push ecx
call fcn.004a9be0
add esp, 0x10
lea edx, [ebp - 0x814]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 4], eax
cmp eax, ebx
je 0x47fd35
push str.PortAcquire
push eax
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call edi
mov dword [esi + 8], eax
push str.PortRelease
mov eax, dword [esi + 4]
push eax
call edi
mov dword [esi + 0xc], eax
call fcn.00462590
cmp dword [esi + 8], ebx
je 0x47fd2a
cmp eax, ebx
jne 0x47fd30
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
call fcn.00462590
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004a998e
mov esp, ebp
pop ebp
ret
Function at 0x481150
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c7fb0
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1004
call fcn.004ab4d0
mov eax, dword [0x51c080]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
push 0x800
xor ebx, ebx
push ebx
lea eax, [ebp - 0x814]
push eax
call fcn.004ab450
push 0x800
push ebx
lea ecx, [ebp - 0x1014]
push ecx
call fcn.004ab450
add esp, 0x18
mov dword [ebp - 4], ebx
mov eax, dword [esi + 0x10]
cmp eax, ebx
je 0x4811d7
cmp dword [esi + 0x14], ebx
je 0x4811c9
cmp dword [esi + 0x18], ebx
jne 0x4812a1
cmp eax, ebx
je 0x4811d7
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esi + 0x10], ebx
push 0x400
lea edx, [ebp - 0x1014]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x48120e
push str.ssdevm.dll
lea eax, [ebp - 0x1014]
push eax
push 0x4dd780
lea edx, [ebp - 0x814]
call fcn.00411a00
add esp, 0xc
jmp 0x48122c
push 0x3ff
push str.ssdevm.dll
push 0x400
lea ecx, [ebp - 0x814]
push ecx
call fcn.004a9be0
add esp, 0x10
lea edx, [ebp - 0x814]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 0x10], eax
cmp eax, ebx
je 0x48129a
push str.PortAcquire
push eax
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call edi
mov dword [esi + 0x14], eax
push str.PortRelease
mov eax, dword [esi + 0x10]
push eax
call edi
mov dword [esi + 0x18], eax
push str.Load_Device_Monitor_Success__
mov ecx, 0x527b30
call fcn.00449000
add esp, 4
cmp dword [esi + 0x14], ebx
je 0x481282
cmp dword [esi + 0x18], ebx
je 0x481282
push str.Get_Port_Acquire_function_and_release_function_Success__
jmp 0x48128d
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
push str.Get_Port_Acquire_function_and_release_function_fail__
mov ecx, 0x527b30
call fcn.00449000
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004a998e
mov esp, ebp
pop ebp
ret
Function at 0x481600
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cbc10
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x51c080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov ebx, edx
mov edi, dword [ebp + 8]
mov byte [ebp + 0xb], 1
mov dword [ebp - 4], 0
test ebx, ebx
je 0x481714
mov eax, ebx
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x481650
sub eax, edx
sar eax, 1
je 0x481714
test esi, esi
je 0x481714
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x481672
sub eax, edx
sar eax, 1
je 0x481714
mov eax, ebx
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x481690
sub eax, edx
sar eax, 1
cmp eax, 0x400
jae 0x481714
mov eax, esi
lea edx, [eax + 2]
jmp 0x4816b0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4816b0
sub eax, edx
sar eax, 1
cmp eax, 0x400
jae 0x481714
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x481714
call fcn.00481f90
test al, al
je 0x481714
push ebx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x48172a
push ebx
push 0x400
push edi
call fcn.004a9ecb
add esp, 0xc
push 0x5c
push edi
call fcn.004a9ce4
add esp, 8
test eax, eax
je 0x481708
mov word [eax], 0
push ebx
mov ecx, edi
call fcn.00481c20
test al, al
jne 0x48176d
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x5c
push ebx
call fcn.004a9ce4
add esp, 8
test eax, eax
je 0x481714
sub eax, ebx
sar eax, 1
push eax
push ebx
push 0x400
push edi
call fcn.004a9be0
add esp, 0x10
push edi
mov ecx, ebx
call fcn.00481970
test al, al
jne 0x48176d
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp + 0xb]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x481f90
Capabilities:
Delete file

Disassembly:
sub esp, 0x414
mov eax, dword [0x51c080]
xor eax, esp
mov dword [esp + 0x40c], eax
test esi, esi
je 0x482034
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x481fb1
sub eax, edx
sar eax, 1
je 0x482034
mov eax, dword [edi + 0x800]
test eax, eax
je 0x481fd1
call fcn.00485fd0
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x400
lea eax, [esp + 0xc]
push 0
push eax
call fcn.004ab450
add esp, 0xc
push 0
push 0
push 0x400
lea ecx, [esp + 0x14]
push ecx
push 0xffffffffffffffff
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea edx, [esp + 8]
push edx
call fcn.00484480
add esp, 4
test eax, eax
mov dword [edi + 0x800], eax
setne al
mov ecx, dword [esp + 0x40c]
xor ecx, esp
call fcn.004a998e
add esp, 0x414
ret
mov ecx, dword [esp + 0x40c]
xor ecx, esp
xor al, al
call fcn.004a998e
add esp, 0x414
ret

Function at 0x482050
Capabilities:
Create directory

Disassembly:
mov eax, 0x1018
call fcn.004ab4d0
mov eax, dword [0x51c080]
xor eax, esp
mov dword [esp + 0x1014], eax
push ebx
push ebp
push esi
xor ebx, ebx
mov esi, ecx
cmp esi, ebx
push edi
mov dword [esp + 0x18], 0x5c
mov dword [esp + 0x14], ebx
je 0x4821dd
mov eax, esi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x482090
sub eax, edx
sar eax, 1
je 0x4821dd
cmp byte [esp + 0x102c], bl
jne 0x4820de
push 0x5c
push esi
call fcn.004a9ce4
add esp, 8
cmp eax, ebx
je 0x4821dd
sub eax, esi
sar eax, 1
push eax
push esi
lea eax, [esp + 0x828]
push 0x400
push eax
call fcn.004a9be0
add esp, 0x10
jmp 0x4820f4
push esi
lea ecx, [esp + 0x824]
push 0x400
push ecx
call fcn.004a9ecb
add esp, 0xc
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x828]
push ecx
call fcn.004a9696
add esp, 0xc
cmp eax, ebx
je 0x4821d9
push eax
lea edx, [esp + 0x24]
push 0x400
push edx
call fcn.004a9ecb
add esp, 0xc
push 0x4e4f30
lea eax, [esp + 0x24]
push 0x400
push eax
call fcn.004aa6ad
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
push ebx
call fcn.004a9696
add esp, 0xc
cmp eax, ebx
je 0x4821d7
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
lea esi, [ecx + 2]
lea esp, [esp]
mov dx, word [ecx]
add ecx, 2
cmp dx, bx
jne 0x482170
sub ecx, esi
sar ecx, 1
je 0x4821d7
push eax
lea eax, [esp + 0x24]
push 0x400
push eax
call fcn.004aa6ad
add esp, 0xc
push 0x4e4f30
lea ecx, [esp + 0x24]
push 0x400
push ecx
call fcn.004aa6ad
add esp, 0xc
push ebx
lea edx, [esp + 0x24]
push edx
call edi
test eax, eax
jne 0x4821c0
call ebp
cmp eax, 0xb7
jne 0x4821dd
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
push ebx
call fcn.004a9696
add esp, 0xc
cmp eax, ebx
jne 0x482167
mov bl, 1
mov al, bl
jmp 0x4821df
xor al, al
mov ecx, dword [esp + 0x1024]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004a998e
add esp, 0x1018
ret 4
Function at 0x484ed0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
xor ebx, ebx
cmp dword [esi + 0x100ac], ebx
push edi
mov dword [esp + 8], ebx
je 0x484f89
cmp dword [esi + 0x7c], ebx
jbe 0x484f89
mov ebx, 0xffffff5c
lea edi, [esi + 0xa4]
sub ebx, esi
push ebp
lea esp, [esp]
movzx ecx, byte [edi]
mov eax, dword [esi + 0x100d0]
mov ebp, dword [esi + 0x100dc]
xor ecx, eax
mov edx, dword [esi + 0x100d8]
shr eax, 8
and ecx, 0xff
mov ecx, dword [ebp + ecx*4]
xor ecx, eax
movzx eax, cl
add eax, dword [esi + 0x100d4]
mov dword [esi + 0x100d0], ecx
mov ecx, dword [esi + 0x100d8]
imul eax, eax, 0x8088405
add eax, 1
mov dword [esi + 0x100d4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
and edx, 0xfffd
shr ecx, 8
xor ecx, dword [ebp + eax*4]
or edx, 2
mov eax, edx
xor eax, 1
imul eax, edx
mov dword [esi + 0x100d8], ecx
shr eax, 8
xor byte [edi], al
add edi, 1
lea ecx, [ebx + edi]
cmp ecx, dword [esi + 0x7c]
jb 0x484f00
xor ebx, ebx
pop ebp
mov edi, dword [esi + 0x7c]
mov ecx, dword [esi + 0x2c]
mov edx, edi
push edx
mov edx, dword [esi + 0x1c]
lea eax, [esi + 0xa4]
push eax
mov eax, dword [esi + 8]
push ecx
push edx
call eax
add esp, 0x10
cmp eax, edi
je 0x484fb2
mov dword [esp + 8], 0xffffffff
add dword [esi + 0x100c0], edi
mov ecx, dword [esi + 0x48]
mov eax, dword [esp + 8]
adc dword [esi + 0x100c4], ebx
add dword [esi + 0x100c8], ecx
pop edi
mov dword [esi + 0x48], ebx
adc dword [esi + 0x100cc], ebx
mov dword [esi + 0x7c], ebx
pop ebx
pop ecx
ret

Function at 0x486340
Capabilities:
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x486347
xor eax, eax
ret
mov eax, dword [esp + 4]
jmp fcn.00486350
Function at 0x486350
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, edx
test esi, esi
not eax
je 0x486382
lea esp, [esp]
test cl, 3
je 0x486382
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x4fb988]
add ecx, 1
sub esi, 1
jne 0x486360
cmp esi, 0x20
push ebx
push edi
jb 0x48656c
mov edi, esi
shr edi, 5
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x4fbd88]
xor edx, dword [ebx*4 + 0x4fc188]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x4fb988]
add ecx, 4
xor edx, dword [eax*4 + 0x4fc588]
add ecx, 4
xor edx, dword [ecx - 8]
add ecx, 4
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x4fbd88]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x4fc188]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x4fb988]
add ecx, 4
xor eax, dword [edx*4 + 0x4fc588]
add ecx, 4
xor eax, dword [ecx - 0x10]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x4fbd88]
xor edx, dword [ebx*4 + 0x4fc188]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x4fb988]
xor edx, dword [eax*4 + 0x4fc588]
xor edx, dword [ecx - 0xc]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x4fbd88]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x4fc188]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x4fb988]
xor eax, dword [edx*4 + 0x4fc588]
xor eax, dword [ecx - 8]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x4fbd88]
xor edx, dword [ebx*4 + 0x4fc188]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x4fb988]
xor edx, dword [eax*4 + 0x4fc588]
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x4fbd88]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x4fc188]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x4fb988]
and edx, 0xff
xor eax, dword [edx*4 + 0x4fc588]
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x4fbd88]
xor edx, dword [ebx*4 + 0x4fc188]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x4fb988]
add ecx, 4
xor edx, dword [eax*4 + 0x4fc588]
sub esi, 0x20
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x4fbd88]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x4fc188]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x4fb988]
and edx, 0xff
xor eax, dword [edx*4 + 0x4fc588]
sub edi, 1
jne 0x486392
cmp esi, 4
jb 0x4865b9
mov edx, esi
shr edx, 2
xor eax, dword [ecx]
add ecx, 4
mov edi, eax
shr edi, 0x10
and edi, 0xff
mov edi, dword [edi*4 + 0x4fbd88]
movzx ebx, ah
xor edi, dword [ebx*4 + 0x4fc188]
mov ebx, eax
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x4fb988]
and eax, 0xff
xor edi, dword [eax*4 + 0x4fc588]
sub esi, 4
sub edx, 1
mov eax, edi
jne 0x486576
test esi, esi
pop edi
pop ebx
je 0x4865dd
nop
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x4fb988]
add ecx, 1
sub esi, 1
jne 0x4865c0
not eax
pop esi
ret
Function at 0x488c20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esi + 0x2c]
push edi
lea esp, [esp]
mov edi, dword [esi + 0x3c]
sub edi, dword [esi + 0x74]
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x2c]
sub edi, eax
lea edx, [ecx + ebp - 0x106]
cmp eax, edx
mov dword [esp + 0xc], edi
jb 0x488cb0
mov eax, dword [esi + 0x38]
push ebp
lea ecx, [eax + ebp]
push ecx
push eax
call fcn.004ab500
mov edx, dword [esi + 0x4c]
mov eax, dword [esi + 0x44]
sub dword [esi + 0x70], ebp
sub dword [esi + 0x6c], ebp
add esp, 0xc
sub dword [esi + 0x5c], ebp
lea ecx, [eax + edx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebp
jb 0x488c7f
sub eax, ebp
jmp 0x488c81
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x488c70
mov ecx, dword [esi + 0x40]
mov edx, ebp
lea ecx, [ecx + ebp*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebp
jb 0x488ca0
sub eax, ebp
jmp 0x488ca2
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x488c91
add edi, ebp
mov dword [esp + 0xc], edi
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x488de2
mov edx, dword [esi + 0x74]
add edx, dword [esi + 0x6c]
mov eax, dword [edi + 4]
add edx, dword [esi + 0x38]
mov ecx, dword [esp + 0xc]
mov ebx, eax
cmp ebx, ecx
mov dword [esp + 0x10], edx
jbe 0x488cd8
mov ebx, ecx
test ebx, ebx
je 0x488d2c
sub eax, ebx
mov dword [edi + 4], eax
mov eax, dword [edi + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x488cfa
mov edx, dword [edi]
mov ecx, dword [edi + 0x30]
mov eax, ebx
call fcn.0048a070
jmp 0x488d13
cmp eax, 2
jne 0x488d1a
mov ecx, dword [edi]
test ecx, ecx
mov eax, dword [edi + 0x30]
jne 0x488d0c
xor eax, eax
jmp 0x488d17
mov edx, ebx
call fcn.00486350
mov edx, dword [esp + 0x10]
mov dword [edi + 0x30], eax
mov ecx, dword [edi]
push ebx
push ecx
push edx
call fcn.004ab500
add dword [edi], ebx
add esp, 0xc
add dword [edi + 8], ebx
add dword [esi + 0x74], ebx
mov ebx, dword [esi + 0x74]
cmp ebx, 3
jb 0x488d56
mov eax, dword [esi + 0x38]
mov edx, dword [esi + 0x6c]
mov ecx, dword [esi + 0x58]
add edx, eax
movzx eax, byte [edx]
mov dword [esi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp ebx, 0x106
jae 0x488d6a
mov edx, dword [esi]
cmp dword [edx + 4], 0
jne 0x488c30
mov eax, dword [esi + 0x16c0]
mov ecx, dword [esi + 0x3c]
cmp eax, ecx
jae 0x488de2
mov edi, dword [esi + 0x6c]
add edi, ebx
cmp eax, edi
jae 0x488db1
sub ecx, edi
mov ebx, ecx
cmp ebx, 0x102
jbe 0x488d91
mov ebx, 0x102
mov eax, dword [esi + 0x38]
push ebx
add eax, edi
push 0
push eax
call fcn.004ab450
add esp, 0xc
add ebx, edi
pop edi
pop ebp
mov dword [esi + 0x16c0], ebx
pop ebx
add esp, 8
ret
lea edx, [edi + 0x102]
cmp eax, edx
jae 0x488de2
sub edi, eax
add edi, 0x102
sub ecx, eax
cmp edi, ecx
jbe 0x488dcb
mov edi, ecx
mov ecx, dword [esi + 0x38]
push edi
add ecx, eax
push 0
push ecx
call fcn.004ab450
add esp, 0xc
add dword [esi + 0x16c0], edi
pop edi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x48e420
Capabilities:
Set socket configuration

Disassembly:
push esi
mov esi, dword [esp + 8]
mov al, byte [esi]
xor edx, edx
test al, al
mov ecx, esi
je 0x48e446
nop
cmp al, 0x2e
jne 0x48e437
add edx, 1
mov al, byte [ecx + 1]
add ecx, 1
test al, al
jne 0x48e430
cmp edx, 3
je 0x48e44c
xor eax, eax
pop esi
ret 8
push esi
call dword [sym.imp.WSOCK32.dll_inet_addr]
cmp eax, 0xffffffff
je 0x48e446
mov ecx, dword [esp + 0xc]
mov dword [ecx], eax
mov eax, 1
pop esi
ret 8

Function at 0x48e4e0
Capabilities:
Resolve dns

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x1c]
mov dword [esi], 0
push ecx
mov byte [eax], 0
call dword [sym.imp.WSOCK32.dll_gethostbyname]
mov ecx, eax
test ecx, ecx
mov dword [esp + 0x1c], ecx
je 0x48e584
cmp word [ecx + 8], 2
push ebx
push ebp
push edi
jne 0x48e555
cmp word [ecx + 0xa], 4
jne 0x48e555
mov edi, dword [ecx + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x48e555
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
lea esp, [esp]
mov edx, dword [eax]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebx
push ebp
call fcn.0048e470
test eax, eax
mov dword [esi], eax
je 0x48e578
add edi, 4
lea esi, [eax + 0x1c]
mov eax, dword [edi]
test eax, eax
jne 0x48e530
mov ecx, dword [esp + 0x28]
mov ecx, dword [ecx]
mov edx, dword [esp + 0x24]
push 0x400
push ecx
push 0x401
push edx
call fcn.004aba3d
add esp, 0x10
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
ret 0x18
pop edi
pop ebp
pop ebx
mov eax, 8
pop esi
ret 0x18
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
add eax, 0xffffd507
cmp eax, 3
ja case.0x48e594.11001
jmp dword [eax*4 + 0x48e5b8]
mov eax, 0x2af9
pop esi
ret 0x18
mov eax, 0x2afa
pop esi
ret 0x18
mov eax, 0x2afb
pop esi
ret 0x18