joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4890c0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 8]
cmp eax, 0xffffffff
je 0x489174
lea ecx, [ebp - 4]
mov dword [ebp - 4], 4
push ecx
lea ecx, [ebp - 8]
push ecx
push 0x1001
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_getsockopt]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push dword [ebp - 4]
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x8000
push eax
push 0x1001
push 0xffff
push dword [edi + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
call esi
push 0
push 0
push dword [edi + 8]
call dword [sym.imp.WS2_32.dll_accept]
mov edi, eax
cmp edi, 0xffffffff
je 0x489174
push 0x23a4
call fcn.0053d643
add esp, 4
mov dword [ebp - 0xc], eax
mov ecx, eax
call fcn.00488d80
mov esi, eax
test esi, esi
je 0x489164
mov ecx, esi
mov dword [esi + 8], edi
call fcn.00489200
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push 2
push edi
call dword [sym.imp.WS2_32.dll_shutdown]
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4891d0
Capabilities:
Resolve dns

Disassembly:
push esi
mov esi, ecx
push esi
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x4891f9
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x4891f7
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
test eax, eax
je 0x4891f7
mov eax, dword [eax]
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x4892d0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x609460], 2
push esi
mov esi, ecx
jb 0x489329
mov eax, dword [ebp + 8]
push 4
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push 0x1006
push 0xffff
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x489329
push 4
lea eax, [ebp + 8]
push eax
push 0x1005
push 0xffff
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x489329
or eax, 0xffffffff
pop esi
pop ebp
ret 4
xor eax, eax
pop esi
pop ebp
ret 4

Function at 0x489330
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x609460], 2
push esi
mov esi, ecx
jae 0x489346
xor eax, eax
pop esi
pop ebp
ret 4
mov eax, dword [ebp + 8]
push 4
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push 0x1006
push 0xffff
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x48933f
push 4
lea eax, [ebp + 8]
push eax
push 0x1005
push 0xffff
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
inc eax
neg eax
pop esi
sbb eax, eax
pop ebp
ret 4
Function at 0x489390
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x609460], 2
push esi
mov esi, ecx
jae 0x4893a6
xor eax, eax
pop esi
pop ebp
ret 4
mov eax, dword [ebp + 8]
push 4
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push 0x1006
push 0xffff
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x48939f
push 4
lea eax, [ebp + 8]
push eax
push 0x1005
push 0xffff
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
inc eax
neg eax
pop esi
sbb eax, eax
pop ebp
ret 4

Function at 0x4894f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
mov edi, eax
mov edx, dword [esi + 0x239c]
add eax, edx
cmp eax, dword [esi + 0x23a0]
jb 0x4895b0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x239c]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x23a0]
sub eax, ecx
push eax
lea eax, [esi + 0x74]
add eax, ecx
push ebx
push eax
call fcn.00540f80
mov ecx, dword [esi + 8]
lea edx, [esi + 0x74]
add esp, 8
push dword [esi + 0x23a0]
call fcn.00489b90
add esp, 8
test al, al
je 0x4895d2
mov ecx, dword [esi + 0x23a0]
xor edx, edx
mov edi, dword [esi + 0x239c]
mov eax, ecx
sub eax, edi
mov dword [esi + 0x239c], 0
sub edi, ecx
add ebx, eax
add edi, dword [ebp + 0xc]
cmp edi, ecx
jb 0x4895b0
nop
push ecx
push ecx
mov ecx, dword [esi + 8]
mov edx, ebx
call fcn.00489b90
add esp, 8
test al, al
je 0x4895d2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x23a0]
add ebx, ecx
sub edi, ecx
mov dword [esi + 0xc], eax
cmp edi, ecx
jae 0x489580
mov edx, dword [esi + 0x239c]
push edi
lea ecx, [esi + 0x74]
add ecx, edx
push ebx
push ecx
call fcn.00540f80
mov eax, dword [ebp + 0xc]
add esp, 0xc
add dword [esi + 0x239c], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x489af0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov eax, ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 1
mov dword [ebp - 4], eax
nop word [eax + eax]
mov eax, dword [eax + 8]
cmp eax, 0xffffffff
je 0x489b2f
push 0
push esi
push edi
push eax
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x489b2d
add edi, eax
sub esi, eax
jmp 0x489b38
je 0x489b41
call ebx
cmp eax, 0x2733
jne 0x489b6c
test esi, esi
je 0x489b60
mov eax, dword [ebp - 4]
jmp 0x489b10
push str.C:Users_rudiDesktopgit_ultravncwinvncwinvnc_vsocket.cpp_:_zero_bytes_read3_n
push 4
push 0x5d7d48
call fcn.0041c960
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call ebx
push eax
push str.C:Users_rudiDesktopgit_ultravncwinvncwinvnc_vsocket.cpp_:_HTTP_socket_error:__d_n
push 4
push 0x5d7d48
call fcn.0041c960
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x489b90
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
mov eax, dword [0x5d7008]
xor eax, esp
mov dword [esp + 0x120], eax
push ebx
push esi
push edi
xor edi, edi
mov dword [esp + 0x14], edx
mov ebx, ecx
mov dword [esp + 0x10], 0
cmp dword [ebp + 8], edi
jbe 0x489c85
mov dword [esp + 0x18], 1
xor esi, esi
mov dword [esp + 0x1c], 0
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], ebx
push ecx
push 0
lea ecx, [esp + 0x28]
mov dword [esp + 0x28], 1
push ecx
lea eax, [ebx + 1]
push 0
push eax
call dword [sym.imp.WS2_32.dll_select]
mov ecx, eax
inc esi
mov al, byte [0x5d9e87]
test ecx, ecx
jne 0x489c2b
test al, al
jne 0x489c2b
cmp esi, 0x258
jl 0x489bd8
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x120]
xor ecx, esp
call fcn.0053d630
mov esp, ebp
pop ebp
ret
cmp esi, 0x258
jge 0x489c14
test al, al
jne 0x489c14
test ecx, ecx
js 0x489c14
cmp ecx, 1
jg 0x489c14
lea eax, [esp + 0x20]
push eax
push ebx
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
mov esi, dword [ebp + 8]
test eax, eax
je 0x489c6e
push 0
mov eax, esi
sub eax, edi
push eax
mov eax, dword [esp + 0x1c]
add eax, edi
push eax
push ebx
call dword [sym.imp.WS2_32.dll_send]
mov dword [esp + 0x10], eax
jmp 0x489c72
mov eax, dword [esp + 0x10]
test eax, eax
je 0x489c14
cmp eax, 0xffffffff
je 0x489c14
add edi, eax
cmp edi, esi
jb 0x489bc6
mov ecx, dword [esp + 0x12c]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0053d630
mov esp, ebp
pop ebp
ret
Function at 0x4a51c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x14], edi
sub edx, 1
je 0x4a538a
sub edx, 3
je 0x4a5260
sub edx, 6
jne 0x4a539e
mov ebx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [esp + 0xc], edx
test ebx, ebx
je 0x4a539e
nop
mov ecx, dword [edi + 0x60]
mov eax, 0x40
and ecx, 0x3f
mov esi, ebx
sub eax, ecx
cmp eax, ebx
cmovbe esi, eax
lea eax, [ecx + edi]
push esi
push edx
push eax
call fcn.00540f80
mov edx, dword [esp + 0x18]
add esp, 0xc
add edx, esi
sub ebx, esi
add dword [edi + 0x60], esi
mov ecx, dword [edi + 0x60]
adc dword [edi + 0x64], 0
and ecx, 0x3f
or ecx, 0
mov eax, dword [edi + 0x64]
mov dword [esp + 0xc], edx
mov dword [esp + 0x1c], eax
jne 0x4a5255
lea ecx, [edi + 0x40]
mov edx, edi
call fcn.004a55a0
mov edx, dword [esp + 0xc]
test ebx, ebx
jne 0x4a5200
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
mov eax, dword [edi + 0x40]
mov esi, dword [edi + 0x44]
not eax
mov ebx, dword [ebp + 8]
not esi
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ebx
cmp ecx, 4
jbe 0x4a5346
test bl, 3
je 0x4a52bc
mov edi, ecx
movzx ecx, byte [ebx]
dec edi
movzx edx, al
inc ebx
shrd eax, esi, 8
xor edx, ecx
shr esi, 8
xor eax, dword [edx*8 + 0x5a9d20]
xor esi, dword [edx*8 + 0x5a9d24]
test bl, 3
jne 0x4a5288
mov dword [esp + 0xc], edi
mov edi, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x10], ebx
mov edx, ecx
and ecx, 3
and edx, 0xfffffffc
mov dword [esp + 0xc], ecx
add edx, ebx
mov dword [esp + 0x18], edx
cmp ebx, edx
jae 0x4a5346
mov edi, edx
mov ebx, dword [ebx]
xor ebx, eax
mov eax, ebx
shr eax, 0x10
movzx edx, al
mov eax, ebx
shr eax, 8
movzx ecx, al
mov eax, dword [edx*8 + 0x5aa520]
mov edx, dword [edx*8 + 0x5aa524]
xor eax, dword [ecx*8 + 0x5aad20]
xor edx, dword [ecx*8 + 0x5aad24]
mov ecx, ebx
shr ecx, 0x18
xor eax, dword [ecx*8 + 0x5a9d20]
xor edx, dword [ecx*8 + 0x5a9d24]
movzx ecx, bl
mov ebx, dword [esp + 0x10]
add ebx, 4
mov dword [esp + 0x10], ebx
xor eax, dword [ecx*8 + 0x5ab520]
xor edx, dword [ecx*8 + 0x5ab524]
xor eax, esi
xor edx, 0
mov esi, edx
cmp ebx, edi
jb 0x4a52d4
mov edi, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x4a5379
mov edi, dword [esp + 0xc]
nop
movzx ecx, byte [ebx]
lea ebx, [ebx + 1]
movzx edx, al
shrd eax, esi, 8
xor edx, ecx
shr esi, 8
xor eax, dword [edx*8 + 0x5a9d20]
xor esi, dword [edx*8 + 0x5a9d24]
sub edi, 1
jne 0x4a5350
mov edi, dword [esp + 0x14]
not eax
not esi
mov dword [edi + 0x44], esi
mov dword [edi + 0x40], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [edi + 0x40]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
call fcn.004a54b0
add esp, 4
mov dword [edi + 0x40], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a54b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, edx
mov ebx, ecx
not eax
cmp esi, 8
jbe 0x4a5578
test bl, 7
je 0x4a54e9
nop dword [eax]
movzx ecx, byte [ebx]
dec esi
movzx edx, al
inc ebx
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x5a7d20]
test bl, 7
jne 0x4a54d0
push edi
mov edi, esi
and esi, 7
and edi, 0xfffffff8
add edi, ebx
cmp ebx, edi
jae 0x4a5577
xor eax, dword [ebx]
add ebx, 4
mov dword [ebp + 8], ebx
add dword [ebp + 8], 4
mov ebx, dword [ebx]
mov ecx, ebx
shr ecx, 0x10
movzx edx, cl
mov ecx, ebx
shr ecx, 8
movzx ecx, cl
mov edx, dword [edx*4 + 0x5a8120]
xor edx, dword [ecx*4 + 0x5a8520]
mov ecx, eax
shr ecx, 0x10
movzx ecx, cl
xor edx, dword [ecx*4 + 0x5a9120]
mov ecx, eax
shr ecx, 8
movzx ecx, cl
xor edx, dword [ecx*4 + 0x5a9520]
mov ecx, ebx
shr ecx, 0x18
xor edx, dword [ecx*4 + 0x5a7d20]
mov ecx, eax
shr ecx, 0x18
movzx eax, al
xor edx, dword [ecx*4 + 0x5a8d20]
movzx ecx, bl
mov ebx, dword [ebp + 8]
xor edx, dword [ecx*4 + 0x5a8920]
xor edx, dword [eax*4 + 0x5a9920]
mov eax, edx
cmp ebx, edi
jb 0x4a54f8
pop edi
test esi, esi
je 0x4a559a
nop dword [eax]
movzx ecx, byte [ebx]
lea ebx, [ebx + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x5a7d20]
sub esi, 1
jne 0x4a5580
pop esi
not eax
pop ebx
pop ebp
ret
Function at 0x4a69a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 0x18]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ecx + eax*4]
sub esi, 2
push edi
mov edi, edx
cmp esi, 8
jae 0x4a69e1
mov dword [eax + 0x20], 0
lea edx, [edi + 4]
mov eax, dword [ecx + 0x18]
mov dword [ecx + eax*4 + 0x108], edi
mov eax, ebx
inc dword [ecx + 0x18]
shl eax, 4
add edx, eax
mov eax, 3
jmp 0x4a6a50
mov dword [eax + 0x20], 1
lea edx, [edi + 2]
mov eax, dword [ecx + 0x18]
sub esi, 8
mov dword [ecx + eax*4 + 0x108], edi
inc dword [ecx + 0x18]
mov eax, dword [ecx + 0x18]
lea eax, [ecx + eax*4]
cmp esi, 8
jae 0x4a6a2e
mov dword [eax + 0x20], 0
mov eax, dword [ecx + 0x18]
mov dword [ecx + eax*4 + 0x108], edx
mov eax, ebx
inc dword [ecx + 0x18]
lea edx, [edi + 0x104]
shl eax, 4
add edx, eax
mov eax, 3
jmp 0x4a6a50
mov dword [eax + 0x20], 1
mov eax, dword [ecx + 0x18]
mov dword [ecx + eax*4 + 0x108], edx
lea edx, [edi + 0x204]
inc dword [ecx + 0x18]
mov eax, 8
add esi, 0xfffffff8
push esi
push eax
call fcn.004a6530
add esp, 8
cmp byte [ebp + 0x10], 0
jne 0x4a6a77
add dword [edi + ebx*4 + 0x4808], 0xffffffff
jne 0x4a6a77
mov ecx, edi
mov edx, ebx
pop edi
pop esi
pop ebx
pop ebp
jmp fcn.004a6800
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4a71e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], edx
push ebx
mov ebx, ecx
push edi
mov dword [ebx], 0x4000400
test edx, edx
je 0x4a7221
lea eax, [ebx + 0x104]
mov ecx, edx
nop
movaps xmm0, xmmword [0x5cf140]
lea eax, [eax + 0x10]
movups xmmword [eax - 0x110], xmm0
movaps xmm0, xmmword [0x5cf140]
movups xmmword [eax - 0x10], xmm0
sub ecx, 1
jne 0x4a7200
cmp byte [ebp + 8], 0
lea edi, [ebx + 0x204]
mov ecx, 0x80
mov eax, 0x4000400
rep stosd dword es:[edi], eax
jne 0x4a73dc
mov dword [ebp - 8], 0
test edx, edx
je 0x4a73dc
lea eax, [ebx + 0x404]
lea ecx, [ebx + 0x4808]
mov dword [ebp + 8], eax
mov dword [ebp - 0x10], ecx
push esi
nop
mov edi, dword [ebx + 0x4804]
xor esi, esi
mov dword [ecx], edi
movzx ecx, word [ebx]
mov eax, ecx
mov dword [ebp - 0xc], edi
shr eax, 4
xor ecx, 0x7f0
shr ecx, 4
mov dword [ebp - 4], esi
movzx eax, byte [eax + 0x5add20]
movzx edx, byte [ecx + 0x5add20]
movzx ecx, word [ebx + 2]
mov dword [ebp - 0x14], eax
mov eax, ecx
shr eax, 4
xor ecx, 0x7f0
shr ecx, 4
movzx eax, byte [eax + 0x5add20]
add eax, edx
mov dword [ebp - 0x18], eax
movzx eax, byte [ecx + 0x5add20]
add eax, edx
mov dword [ebp - 0x1c], eax
test edi, edi
je 0x4a73bb
cmp esi, 8
jae 0x4a7319
lea edx, [esi + 8]
xor edi, edi
mov esi, dword [ebp - 8]
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
shr ecx, 4
lea eax, [edx + esi*8]
and ecx, 0x7f
movzx eax, word [ebx + eax*2 + 4]
shr eax, 4
xor eax, ecx
movzx eax, byte [eax + 0x5add20]
add edi, eax
cmp edx, 1
jne 0x4a72d1
mov esi, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x14]
add eax, edi
mov edi, dword [ebp - 0xc]
mov dword [ecx + esi*4], eax
inc esi
mov dword [ebp - 4], esi
cmp esi, edi
jb 0x4a72c4
jmp 0x4a73bb
cmp esi, edi
jae 0x4a73bb
cmp esi, 0x10
jae 0x4a7376
mov edx, esi
xor edi, edi
mov esi, dword [ebp - 8]
nop dword [eax]
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
shr ecx, 4
lea eax, [edx + esi*8]
and ecx, 0x7f
movzx eax, word [ebx + eax*2 + 0x104]
shr eax, 4
xor eax, ecx
movzx eax, byte [eax + 0x5add20]
add edi, eax
cmp edx, 1
jne 0x4a7330
mov esi, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x18]
add eax, edi
mov dword [ecx + esi*4], eax
inc esi
mov dword [ebp - 4], esi
cmp esi, dword [ebp - 0xc]
jb 0x4a7321
jmp 0x4a73bb
xor edi, edi
lea eax, [esi + 0xf0]
nop
mov edx, eax
shr eax, 1
and edx, 1
neg edx
shr edx, 4
movzx ecx, word [ebx + eax*2 + 0x204]
and edx, 0x7f
shr ecx, 4
xor ecx, edx
movzx ecx, byte [ecx + 0x5add20]
add edi, ecx
cmp eax, 1
jne 0x4a7380
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x1c]
add eax, edi
mov dword [ecx + esi*4], eax
inc esi
cmp esi, dword [ebp - 0xc]
jb 0x4a7376
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
inc eax
add dword [ebp + 8], 0x440
add ecx, 4
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], ecx
cmp eax, dword [ebp - 0x20]
jb 0x4a7260
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a9920
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
mov eax, 1
mov ecx, edx
mov edx, dword [ebp + 8]
push esi
push edi
shl eax, cl
xor edi, edi
add edx, eax
mov esi, edx
shr edx, 1
and esi, 1
neg esi
shr esi, 4
movzx ecx, word [ebx + edx*2]
and esi, 0x7f
shr ecx, 4
xor ecx, esi
movzx ecx, byte [ecx + 0x5add20]
add edi, ecx
cmp edx, 1
jne 0x4a9938
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4a99d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
mov ecx, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebx + 0xaa4]
sub ecx, edi
mov eax, dword [ebx + 0xaa8]
add ebx, 0xaac
shr esi, cl
and eax, edx
mov ecx, edi
shl eax, cl
add esi, eax
imul eax, esi, 0x600
add eax, ebx
xor ebx, ebx
mov dword [ebp + 8], eax
cmp byte [ebp + 0xc], bl
jne 0x4a9a25
push dword [ebp + 0x14]
lea edx, [ebx + 8]
mov ecx, eax
call fcn.004a9920
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
ret
mov ecx, dword [ebp + 0x14]
mov esi, 0x100
mov edi, dword [ebp + 0x10]
add ecx, esi
add edi, edi
mov edx, esi
and edx, edi
mov eax, ecx
add edx, esi
shr eax, 8
add eax, edx
mov edx, dword [ebp + 8]
movzx edx, word [edx + eax*2]
mov eax, ecx
shr eax, 7
add ecx, ecx
and eax, 1
shr edx, 4
neg eax
shr eax, 4
and eax, 0x7f
xor edx, eax
movzx eax, byte [edx + 0x5add20]
mov edx, edi
xor edx, ecx
add ebx, eax
not edx
and esi, edx
cmp ecx, 0x10000
jb 0x4a9a32
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret
Function at 0x4a9a80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
mov dword [ebp - 4], esi
lea eax, [edi + 0x105a4]
lea edx, [edi + 0x101a0]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov eax, dword [edi + 0x10da0]
xor ebx, ebx
mov dword [ebp - 8], ebx
test eax, eax
je 0x4a9b07
lea eax, [ebx + 0x40]
xor esi, esi
mov ebx, dword [ebp - 4]
nop dword [eax]
mov edx, eax
shr eax, 1
and edx, 1
neg edx
shr edx, 4
lea ecx, [ebx + eax]
and edx, 0x7f
movzx ecx, word [edi + ecx*2 + 0x6e0c]
shr ecx, 4
xor ecx, edx
movzx ecx, byte [ecx + 0x5add20]
add esi, ecx
cmp eax, 1
jne 0x4a9ac0
mov ebx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov dword [edx + ebx*4], esi
inc ebx
mov eax, dword [edi + 0x10da0]
mov dword [ebp - 8], ebx
cmp ebx, eax
jb 0x4a9ab1
mov esi, dword [ebp - 4]
mov ecx, 0xe
cmp eax, ecx
jbe 0x4a9b26
mov eax, ecx
shr eax, 1
shl eax, 4
sub eax, 0x50
add dword [edx + ecx*4], eax
inc ecx
cmp ecx, dword [edi + 0x10da0]
jb 0x4a9b10
mov ecx, dword [ebp - 0x10]
add esi, 0x40
mov eax, dword [edx]
mov dword [ebp - 4], esi
mov dword [ecx - 4], eax
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov eax, dword [edx + 8]
mov dword [ecx + 4], eax
mov eax, dword [edx + 0xc]
add edx, 0x100
mov dword [ecx + 8], eax
add ecx, 0x200
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
cmp esi, 0x100
jb 0x4a9aa2
mov esi, 4
lea eax, [edi + 0x107b0]
mov dword [ebp - 8], esi
mov dword [ebp - 4], eax
movzx ebx, byte [esi + 0x5abd20]
mov eax, ebx
mov edx, ebx
shr eax, 1
and edx, 1
dec eax
or edx, 2
mov ecx, eax
mov dword [ebp - 0xc], eax
shl edx, cl
mov eax, esi
mov ecx, 1
mov dword [ebp - 0x14], edx
sub eax, edx
mov dword [ebp - 0x10], ecx
xor esi, esi
mov edx, eax
sub ecx, ebx
add ecx, dword [ebp - 0x14]
and edx, 1
shr eax, 1
mov dword [ebp - 0x18], eax
mov eax, edx
neg eax
movzx ecx, word [edi + ecx*2 + 0x700a]
shr eax, 4
shr ecx, 4
and eax, 0x7f
xor ecx, eax
movzx eax, byte [ecx + 0x5add20]
mov ecx, dword [ebp - 0x10]
add esi, eax
sub dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x18]
lea ecx, [edx + ecx*2]
mov dword [ebp - 0x10], ecx
jne 0x4a9ba0
mov edx, dword [ebp - 4]
mov eax, dword [edi + ebx*4 + 0x101a0]
add eax, esi
mov dword [edx - 0x200], eax
mov eax, dword [edi + ebx*4 + 0x102a0]
add eax, esi
mov dword [edx], eax
mov eax, dword [edi + ebx*4 + 0x103a0]
add eax, esi
mov dword [edx + 0x200], eax
mov eax, dword [edi + ebx*4 + 0x104a0]
add eax, esi
mov esi, dword [ebp - 8]
inc esi
mov dword [edx + 0x400], eax
add edx, 4
mov dword [ebp - 8], esi
mov dword [ebp - 4], edx
cmp esi, 0x80
jb 0x4a9b74
mov dword [edi + 0x10da4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ae870
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
push esi
mov esi, edx
mov dword [ebp - 4], eax
cmp dword [ecx + 0x5c], eax
jne 0x4ae886
pop esi
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp + 8]
cmp ebx, 4
jb 0x4ae930
mov edx, dword [0x5d8458]
push edi
nop word [eax + eax]
movzx edi, byte [esi + 3]
movzx eax, byte [esi + 2]
shl edi, 8
or edi, eax
lea eax, [ebx - 4]
cmp edi, eax
ja 0x4ae92c
movzx ecx, byte [esi + 1]
movzx eax, byte [esi]
shl cx, 8
or cx, ax
mov eax, 0x4453
cmp cx, ax
jne 0x4ae915
cmp edx, 0xffffffff
jne 0x4ae8f5
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x4ae8eb
mov edx, 1
mov dword [0x5d8458], edx
jmp 0x4ae8f9
xor edx, edx
mov dword [0x5d8458], edx
jmp 0x4ae915
test edx, edx
je 0x4ae915
cmp edi, 5
jb 0x4ae915
cmp byte [esi + 8], 0
ja 0x4ae915
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], 1
mov dword [eax], esi
mov eax, dword [ebp + 0x10]
mov dword [eax], edi
mov ecx, 0xfffffffc
add esi, 4
sub ecx, edi
add esi, edi
add ebx, ecx
cmp ebx, 4
jae 0x4ae8a0
mov eax, dword [ebp - 4]
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4aeec0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov edi, ecx
push dword [edi + 0x109d8]
call fcn.0054d155
add esp, 4
cmp dword [edi + 0x14], 0
jne 0x4af0c4
lea eax, [ebp - 0x24]
mov ecx, edi
push eax
lea eax, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x14]
call fcn.004aed10
add esp, 8
mov dword [ebp - 0xc], eax
lea esi, [edi + 0x109f0]
push 0
push 0x80
push 3
push 0
push 2
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [edi + 0x8d8]
mov ebx, eax
mov ecx, dword [ecx + 0x14]
test cl, 0x5f
je 0x4aef68
and ecx, 0x7f
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x4aef68
push 1
lea esi, [edi + 0x8dc]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ecx
push eax
push str._nwarning___d_:_could_not_set_file_attributes_n
push esi
call fcn.0048d4b0
add esp, 0x10
push eax
mov eax, dword [edi + 0x10b54]
push esi
push edi
call eax
lea esi, [edi + 0x109f0]
mov edx, dword [edi + 0x10918]
test edx, edx
je 0x4af029
lea eax, [ebp - 4]
mov ecx, edi
push eax
lea eax, [ebp - 8]
push eax
movzx eax, word [edi + 0x10938]
push eax
call fcn.004ae870
add esp, 0xc
test eax, eax
je 0x4af029
push dword [ebp - 4]
mov eax, dword [edi + 0x8d8]
mov edx, esi
push dword [ebp - 8]
mov ecx, edi
push dword [eax + 0x14]
call fcn.004ae640
add esp, 0xc
cmp eax, 0x4f
jne 0x4af029
mov edx, dword [edi + 0x38]
lea esi, [edi + 0x8dc]
test edx, edx
je 0x4aeff6
push 1
lea edx, [edi + 0x88dc]
lea ecx, [edi + 0x109f0]
call fcn.004b9f00
push ecx
push eax
push 0x5ccfdc
push esi
call fcn.0048d4b0
add esp, 0x10
push eax
mov eax, dword [edi + 0x10b54]
push esi
push edi
call eax
mov edx, dword [edi + 0x38]
push 1
mov ecx, 0x584fd8
test edx, edx
push ecx
mov eax, 0x5ba2b4
cmove eax, ecx
push eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff5
push eax
push str._compressed_WinNT_security_data_missing___d_bytes__s
push esi
call fcn.0048d4b0
add esp, 0x14
push eax
mov eax, dword [edi + 0x10b54]
push esi
push edi
call eax
cmp ebx, 0xffffffff
jne 0x4af05e
push 1
lea esi, [edi + 0x8dc]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ecx
push eax
push str._nCreateFile___error__d_when_trying_set_file_time_n
push esi
call fcn.0048d4b0
add esp, 0x10
push eax
mov eax, dword [edi + 0x10b54]
push esi
push edi
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x4af0bd
test cl, 1
lea eax, [ebp - 0x14]
mov edx, 0
cmove eax, edx
test cl, 2
push eax
lea eax, [ebp - 0x1c]
cmove eax, edx
test cl, 4
push eax
mov ecx, edx
lea eax, [ebp - 0x24]
cmove eax, ecx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x4af0bd
push eax
lea esi, [edi + 0x8dc]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ecx
push eax
push str._nSetFileTime_failed:__d_n
push esi
call fcn.0048d4b0
add esp, 0x10
push eax
mov eax, dword [edi + 0x10b54]
push esi
push edi
call eax
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret