joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4147dc
Capabilities:
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
mov eax, 0x4dd9ee
push ebx
push esi
push edi
call fcn.004cfcb8
xor edx, edx
mov dword [ebp - 0x28], edx
mov word [ebp - 0x14], 8
call fcn.00411564
test al, al
jne 0x414817
mov eax, 1
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x4148c4
push 6
push 1
push 2
call sub.WSOCK32.dll_socket
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x41483d
mov eax, 1
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x4148c4
push 0x10
push 0
lea ecx, [ebp - 0x38]
push ecx
call fcn.004cd264
add esp, 0xc
mov word [ebp - 0x38], 2
mov ax, word [ebp + 8]
push eax
call sub.WSOCK32.dll_htons
mov word [ebp - 0x36], ax
lea edx, [ebp - 0x38]
push 0x10
push edx
push ebx
call sub.WSOCK32.dll_bind
inc eax
jne 0x414887
push ebx
call sub.WSOCK32.dll_closesocket
mov eax, 1
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x4148c4
push ebx
call sub.WSOCK32.dll_closesocket
mov word [ebp - 0x14], 0
jmp 0x4148b8
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
mov esp, ebp
mov edi, dword [ebp - 0x44]
mov esi, dword [ebp - 0x40]
mov ebx, dword [ebp - 0x3c]
pop ebp
ret

Function at 0x415058
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 1
lea eax, [ebp - 8]
mov ebx, 0xa
push eax
push 0x8004667e
push esi
call sub.WSOCK32.dll_ioctlsocket
lea edx, [ebp - 4]
push edx
push 0x4004667f
push esi
call sub.WSOCK32.dll_ioctlsocket
inc eax
jne 0x4150a5
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x4150a5
xor eax, eax
jmp 0x4150d6
mov edx, dword [ebp - 4]
test edx, edx
jne 0x4150d3
dec ebx
test ebx, ebx
je 0x4150d3
push 0
push 0
call fcn.004013d8
add esp, 8
push 1
call fcn.004d934c
pop ecx
push 0
push 0
call fcn.004013d8
add esp, 8
jmp 0x415083
mov eax, dword [ebp - 4]
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4152d0
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec8
mov eax, 0x4ddb53
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
call fcn.004cfcb8
xor edx, edx
mov dword [ebp - 0x28], edx
mov word [ebp - 0x14], 8
mov word [ebp - 0x14], 8
mov esi, 0x7918
call fcn.00401270
mov dword [ebp - 0x34], eax
call fcn.00401270
mov edx, dword [ebp - 0x34]
sub eax, edx
cmp esi, eax
jae 0x415326
xor eax, eax
mov ecx, dword [ebp - 0x24]
mov dword fs:[0], ecx
jmp 0x41545a
xor eax, eax
mov dword [ebp - 0x138], eax
xor eax, eax
lea edx, [ebp - 0x134]
jmp 0x415342
mov ecx, dword [edx]
cmp ebx, ecx
je 0x41534c
inc eax
add edx, 4
mov ecx, dword [ebp - 0x138]
cmp eax, ecx
jb 0x415338
mov edx, dword [ebp - 0x138]
cmp eax, edx
jne 0x415368
cmp edx, 0x40
jae 0x415368
mov dword [ebp + eax*4 - 0x134], ebx
inc dword [ebp - 0x138]
xor eax, eax
lea edx, [ebp - 0x138]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x2c], 1
push eax
push 0
push edx
push 0
push 0
call sub.WSOCK32.dll_select
cmp eax, 0xffffffff
jne 0x4153bf
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x4153ac
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x41545a
push 0
call sub.KERNEL32.dll_Sleep
push 0xa
call sub.KERNEL32.dll_Sleep
jmp 0x415307
dec eax
je 0x4153d5
push 0
call sub.KERNEL32.dll_Sleep
push 0xa
call sub.KERNEL32.dll_Sleep
jmp 0x415307
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov eax, dword [ebp + 0xc]
push eax
push ebx
call sub.WSOCK32.dll_send
cmp eax, 0xffffffff
jne 0x415417
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x415404
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x41545a
push 0
call sub.KERNEL32.dll_Sleep
push 0xa
call sub.KERNEL32.dll_Sleep
jmp 0x415307
test eax, eax
je 0x415307
mov ecx, dword [ebp - 0x24]
mov dword fs:[0], ecx
jmp 0x41545a
mov esp, ebp
mov edi, dword [ebp - 0x144]
mov esi, dword [ebp - 0x140]
mov ebx, dword [ebp - 0x13c]
pop ebp
ret
Function at 0x415470
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec8
mov eax, 0x4ddb67
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
call fcn.004cfcb8
xor edx, edx
mov dword [ebp - 0x28], edx
mov word [ebp - 0x14], 8
mov word [ebp - 0x14], 8
mov esi, 0x3e80
call fcn.00401270
mov dword [ebp - 0x34], eax
call fcn.00401270
mov edx, dword [ebp - 0x34]
sub eax, edx
cmp esi, eax
jae 0x4154c6
xor eax, eax
mov ecx, dword [ebp - 0x24]
mov dword fs:[0], ecx
jmp 0x4155f4
xor eax, eax
mov dword [ebp - 0x138], eax
xor eax, eax
lea edx, [ebp - 0x134]
jmp 0x4154e2
mov ecx, dword [edx]
cmp ebx, ecx
je 0x4154ec
inc eax
add edx, 4
mov ecx, dword [ebp - 0x138]
cmp eax, ecx
jb 0x4154d8
mov edx, dword [ebp - 0x138]
cmp eax, edx
jne 0x415508
cmp edx, 0x40
jae 0x415508
mov dword [ebp + eax*4 - 0x134], ebx
inc dword [ebp - 0x138]
xor eax, eax
lea edx, [ebp - 0x138]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x2c], 1
push eax
push 0
push 0
push edx
push 0
call sub.WSOCK32.dll_select
cmp eax, 0xffffffff
jne 0x41555d
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x41554c
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x4155f4
push 0
push 0
call fcn.004013d8
add esp, 8
jmp 0x4154a7
dec eax
je 0x415571
push 0
push 0
call fcn.004013d8
add esp, 8
jmp 0x4154a7
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov eax, dword [ebp + 0xc]
push eax
push ebx
call sub.WSOCK32.dll_recv
cmp eax, 0xffffffff
jne 0x4155b1
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x4155a0
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x4155f4
push 0
push 0
call fcn.004013d8
add esp, 8
jmp 0x4154a7
test eax, eax
je 0x4154a7
mov ecx, dword [ebp - 0x24]
mov dword fs:[0], ecx
jmp 0x4155f4
mov esp, ebp
mov edi, dword [ebp - 0x144]
mov esi, dword [ebp - 0x140]
mov ebx, dword [ebp - 0x13c]
pop ebp
ret
Function at 0x415774
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, 0x4ddba3
call fcn.004cfcb8
xor edx, edx
mov dword [ebp - 0x28], edx
mov word [ebp - 0x14], 8
call fcn.00411564
push esi
call sub.WSOCK32.dll_inet_addr
cmp eax, 0xffffffff
jne 0x4157d2
push esi
call sub.WSOCK32.dll_gethostbyname
test eax, eax
jne 0x4157c6
mov eax, 0x1ce9
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x415879
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
mov edx, dword [eax]
mov dword [ebp - 0x34], edx
jmp 0x4157d5
mov dword [ebp - 0x34], eax
mov word [ebp - 0x38], 2
mov cx, word [ebp + 0x10]
push ecx
call sub.WSOCK32.dll_htons
mov word [ebp - 0x36], ax
push 6
push 1
push 2
call sub.WSOCK32.dll_socket
mov esi, eax
mov dword [ebx], esi
cmp esi, 0xffffffff
jne 0x41580e
mov eax, 0x1cea
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x415879
push 0x10
lea ecx, [ebp - 0x38]
push ecx
mov eax, dword [ebx]
push eax
call sub.WSOCK32.dll_connect
test eax, eax
je 0x415839
mov edx, dword [ebx]
push edx
call sub.WSOCK32.dll_closesocket
mov eax, 0x1ceb
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x415879
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x415879
mov esp, ebp
mov edi, dword [ebp - 0x44]
mov esi, dword [ebp - 0x40]
mov ebx, dword [ebp - 0x3c]
pop ebp
ret
Function at 0x4158a8
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc8
mov eax, 0x4ddbb7
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
call fcn.004cfcb8
xor edx, edx
mov dword [ebp - 0x28], edx
mov word [ebp - 0x14], 8
xor ecx, ecx
mov dword [ebp - 0x134], ecx
xor eax, eax
lea edx, [ebp - 0x130]
jmp 0x4158ee
mov ecx, dword [edx]
cmp ebx, ecx
je 0x4158f8
inc eax
add edx, 4
mov ecx, dword [ebp - 0x134]
cmp eax, ecx
jb 0x4158e4
mov edx, dword [ebp - 0x134]
cmp eax, edx
jne 0x415914
cmp edx, 0x40
jae 0x415914
mov dword [ebp + eax*4 - 0x130], ebx
inc dword [ebp - 0x134]
xor eax, eax
mov dword [ebp - 0x238], eax
xor eax, eax
lea edx, [ebp - 0x234]
jmp 0x415930
mov ecx, dword [edx]
cmp ebx, ecx
je 0x41593a
inc eax
add edx, 4
mov ecx, dword [ebp - 0x238]
cmp eax, ecx
jb 0x415926
mov edx, dword [ebp - 0x238]
cmp eax, edx
jne 0x415956
cmp edx, 0x40
jae 0x415956
mov dword [ebp + eax*4 - 0x234], ebx
inc dword [ebp - 0x238]
xor eax, eax
test esi, esi
mov dword [ebp - 0x30], eax
jne 0x415964
mov esi, 1
mov eax, esi
shl eax, 3
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
mov dword [ebp - 0x2c], eax
xor eax, eax
cmp edi, 1
jne 0x415999
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x238]
push edx
push ecx
lea eax, [ebp - 0x134]
push 0
push eax
lea edx, [ebx + 1]
push edx
call sub.WSOCK32.dll_select
cmp edi, 2
jne 0x4159bb
lea ecx, [ebp - 0x30]
lea eax, [ebp - 0x238]
push ecx
push eax
lea edx, [ebp - 0x134]
lea ecx, [ebx + 1]
push edx
push 0
push ecx
call sub.WSOCK32.dll_select
test eax, eax
jne 0x4159d0
mov eax, 0x1c85
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x415a46
inc eax
jne 0x4159e4
mov eax, 0x1c86
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x415a46
lea ecx, [ebp - 0x238]
push ecx
push ebx
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x415a06
mov eax, 0x1c86
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x415a46
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x415a46
mov esp, ebp
mov edi, dword [ebp - 0x244]
mov esi, dword [ebp - 0x240]
mov ebx, dword [ebp - 0x23c]
pop ebp
ret
Function at 0x415a5c
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
mov eax, 0x4ddbe0
push ebx
push esi
push edi
call fcn.004cfcb8
xor edx, edx
mov dword [ebp - 0x28], edx
mov word [ebp - 0x14], 8
mov esi, 0x4ddbcc
lea edi, [ebp - 0x3c]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
mov word [ebp - 0x14], 8
call fcn.00401270
mov eax, dword [ebp + 0x10]
mov edi, dword [eax]
xor esi, esi
mov eax, dword [ebp + 0x10]
xor edx, edx
mov dword [eax], edx
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x415aaf
mov eax, dword [ebp + 0xc]
mov byte [eax], 0
mov edx, dword [ebp + 0x14]
test edx, edx
jne 0x415abd
mov dword [ebp + 0x14], 0x2ee0
mov ecx, dword [ebp + 0x14]
push ecx
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.004158a8
add esp, 0xc
cmp eax, 0x1c85
jne 0x415aea
mov eax, 0x1c21
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x415bc9
cmp eax, 0x1c86
jne 0x415b05
mov eax, 0x1c22
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x415bc9
push 0
mov ecx, edi
sub ecx, esi
push ecx
mov eax, dword [ebp + 0xc]
add eax, esi
push eax
mov edx, dword [ebp + 8]
push edx
call sub.WSOCK32.dll_recv
mov ebx, eax
test ebx, ebx
jg 0x415b51
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x415b42
push 0
call sub.USER32.dll_MessageBeep
push 0
push 0
call fcn.004013d8
add esp, 8
jmp 0x415b05
test ebx, ebx
jne 0x415b4d
mov ebx, 0x1c24
jmp 0x415b79
mov ebx, eax
jmp 0x415b79
add esi, ebx
xor ebx, ebx
cmp edi, esi
jbe 0x415b79
mov eax, dword [ebp + 0x14]
push eax
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.004158a8
add esp, 0xc
cmp eax, 0x1c85
je 0x415b79
cmp eax, 0x1c86
jne 0x415b05
test esi, esi
jne 0x415b84
mov ecx, dword [ebp + 0xc]
mov byte [ecx + esi], 0
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
mov eax, ebx
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x415bc9
mov esp, ebp
mov edi, dword [ebp - 0x48]
mov esi, dword [ebp - 0x44]
mov ebx, dword [ebp - 0x40]
pop ebp
ret
Function at 0x415bd8
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
mov eax, 0x4ddc08
push ebx
push esi
push edi
call fcn.004cfcb8
xor edx, edx
mov dword [ebp - 0x28], edx
mov word [ebp - 0x14], 8
mov esi, 0x4ddbf4
lea edi, [ebp - 0x3c]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
mov word [ebp - 0x14], 8
call fcn.00401270
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
test edx, edx
mov eax, dword [eax]
mov edi, eax
jne 0x415c25
mov dword [ebp + 0x14], 0x2ee0
test eax, eax
jne 0x415c3a
xor eax, eax
mov ecx, dword [ebp - 0x24]
mov dword fs:[0], ecx
jmp 0x415d39
mov eax, dword [ebp + 0x14]
push eax
push 2
mov edx, dword [ebp + 8]
push edx
call fcn.004158a8
add esp, 0xc
cmp eax, 0x1c85
jne 0x415c67
mov eax, 0x1bbd
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x415d39
cmp eax, 0x1c86
jne 0x415c82
mov eax, 0x1bbe
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x415d39
xor esi, esi
push 0
mov eax, edi
sub eax, esi
push eax
mov edx, dword [ebp + 0xc]
add edx, esi
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.WSOCK32.dll_send
mov ebx, eax
test ebx, ebx
jg 0x415cd0
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x415cc1
push 0
call sub.USER32.dll_MessageBeep
push 0
push 0
call fcn.004013d8
add esp, 8
jmp 0x415c84
test ebx, ebx
jne 0x415ccc
mov ebx, 0x1bc0
jmp 0x415cf4
mov ebx, eax
jmp 0x415cf4
add esi, ebx
xor ebx, ebx
cmp edi, esi
jbe 0x415cf4
mov eax, dword [ebp + 0x14]
push eax
push 2
mov edx, dword [ebp + 8]
push edx
call fcn.004158a8
add esp, 0xc
mov ebx, eax
cmp ebx, 0x1c86
jmp 0x415c84
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
mov eax, ebx
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x415d39
mov esp, ebp
mov edi, dword [ebp - 0x48]
mov esi, dword [ebp - 0x44]
mov ebx, dword [ebp - 0x40]
pop ebp
ret
Function at 0x416644
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 3
add esp, 0xfffff004
push eax
dec eax
jne 0x41664d
add esp, 0xfffff7d0
mov eax, dword [ebp - 4]
mov eax, 0x4ddc60
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
call fcn.004cfcb8
xor edx, edx
mov dword [ebp - 0x28], edx
mov word [ebp - 0x14], 8
test ebx, ebx
jne 0x41668e
mov ecx, dword [ebp - 0x24]
mov dword fs:[0], ecx
jmp 0x4167d0
mov eax, dword [ebx]
cmp eax, 0x114
je 0x4166a6
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x4167d0
test byte [ebx + 0xc], 4
je 0x4166bb
mov ecx, dword [ebp - 0x24]
mov dword fs:[0], ecx
jmp 0x4167d0
test byte [ebx + 0xc], 0x10
je 0x4166cf
mov eax, dword [ebp - 0x24]
mov dword fs:[0], eax
jmp 0x4167d0
mov esi, dword [ebx + 4]
xor eax, eax
mov dword [ebx + 4], eax
lea edx, [ebp - 0x2c]
or dword [ebx + 0xc], 0x20
push 0
push edx
lea ecx, [ebp - 0x1c30]
push 0x1c00
push ecx
push esi
call sub.KERNEL32.dll_ReadFile
test eax, eax
je 0x416789
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x416789
mov edx, dword [ebp - 0x2c]
push edx
lea ecx, [ebp - 0x1c30]
push ecx
call fcn.00416520
add esp, 8
test eax, eax
je 0x416789
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x416789
lea edx, [ebp - 0x3834]
push edx
lea ecx, [ebp - 0x1c30]
push ecx
push ebx
call dword [ebx + 0x10]
add esp, 0xc
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
cmp eax, 0xfffe
jne 0x41674c
or dword [ebx + 0xc], 0x10
jmp 0x416789
mov edx, dword [ebp - 0x2c]
cmp edx, 0x1c00
jbe 0x41675e
mov dword [ebp - 0x2c], 0x1c00
mov ecx, dword [ebp - 0x2c]
push ecx
lea eax, [ebp - 0x3834]
push eax
call fcn.004163dc
add esp, 8
test eax, eax
je 0x416789
push 0
lea edx, [ebp - 0x2c]
push edx
push eax
lea ecx, [ebp - 0x3834]
push ecx
push esi
call sub.KERNEL32.dll_WriteFile
push esi
call sub.KERNEL32.dll_FlushFileBuffers
push esi
call sub.KERNEL32.dll_DisconnectNamedPipe
push esi
call sub.KERNEL32.dll_CloseHandle
mov word [ebp - 0x14], 0
jmp 0x4167c6
mov ecx, dword [ebp - 0x24]
mov dword fs:[0], ecx
mov esp, ebp
mov edi, dword [ebp - 0x3840]
mov esi, dword [ebp - 0x383c]
mov ebx, dword [ebp - 0x3838]
pop ebp
ret
Function at 0x41e70c
Capabilities:
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ecx, ecx
mov eax, dword [ebp + 8]
mov edx, 0x7f7f7f
test eax, eax
je 0x41e745
mov edx, 0x811c9dc5
jmp 0x41e73f
and ebx, 0xff
xor edx, ebx
inc eax
imul ebx, edx, 0x1000193
mov edx, ebx
inc ecx
cmp ecx, 0x104
jg 0x41e745
mov bl, byte [eax]
test bl, bl
jne 0x41e725
mov eax, edx
pop ebx
pop ebp
ret

Function at 0x422d18
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 4
add esp, 0xfffff004
push eax
dec eax
jne 0x422d21
mov eax, dword [ebp - 4]
push ebx
push esi
push edi
mov esi, dword [ebp + 0x18]
mov edi, dword [ebp + 8]
xor ebx, ebx
test edi, edi
je 0x422eb4
mov eax, dword [ebp + 0x14]
add eax, ebx
cmp eax, dword [ebp + 0xc]
jg 0x422ea8
mov edx, dword [ebp + 0x14]
push edx
mov ecx, dword [ebp + 0x10]
push ecx
lea eax, [ebx + edi]
push eax
call fcn.004cd600
add esp, 0xc
test eax, eax
jne 0x422ea8
test ebx, ebx
je 0x422d7b
jmp 0x422d72
dec ebx
movsx edx, byte [edi + ebx]
cmp edx, 0x2d
je 0x422d71
test ebx, ebx
je 0x422d8e
movsx eax, byte [edi + ebx]
cmp eax, 0xd
je 0x422d8d
cmp eax, 0xa
jne 0x422d8e
dec ebx
test esi, esi
je 0x422ea3
lea edx, [ebp - 0x2004]
push edx
push 0x2000
call sub.KERNEL32.dll_GetTempPathA
test eax, eax
je 0x422ea3
push esi
call sub.KERNEL32.dll_GetTickCount
and eax, 0xfff
push eax
call fcn.0041e7f4
and eax, 0xfff
lea ecx, [ebp - 0x4004]
push eax
push 0x5cd12f
push ecx
call fcn.004d1ac0
add esp, 0x14
lea eax, [ebp - 0x4004]
push eax
push 0x5cd13d
lea edx, [ebp - 0x2004]
push edx
call fcn.004cd3e4
pop ecx
lea ecx, [ebp - 0x2004]
add eax, ecx
push eax
call fcn.004d1ac0
add esp, 0xc
push pe_nt_image_headers32
lea eax, [ebp - 0x2004]
push eax
call fcn.00405b9c
add esp, 8
test eax, eax
je 0x422e25
push 0x64
call sub.KERNEL32.dll_Sleep
jmp 0x422daf
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x4004]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [ebp - 0x2004]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push 6
push eax
call fcn.00403da4
add esp, 8
mov dword [ebp - 4], eax
lea edx, [ebp - 4]
push edx
call fcn.00403e40
pop ecx
test eax, eax
jne 0x422e82
push 2
lea ecx, [ebp - 0x2004]
push ecx
call fcn.00403da4
add esp, 8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x422ea3
push ebx
push edi
mov edx, dword [ebp - 4]
push edx
call fcn.004042b4
add esp, 0xc
test eax, eax
lea ecx, [ebp - 4]
push ecx
call fcn.00403e78
pop ecx
lea eax, [ebx + 2]
jmp 0x422eb6
inc ebx
mov edx, dword [ebp + 0xc]
cmp ebx, edx
jl 0x422d41
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4293d4
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [ebp + 8]
mov esi, 0x811c9dc5
jmp 0x4293f4
and edx, 0xff
xor esi, edx
inc eax
imul ecx, esi, 0x1000193
mov esi, ecx
mov dl, byte [eax]
test dl, dl
jne 0x4293e3
mov edx, esi
movzx ecx, si
sar ecx, 8
mov eax, esi
shr eax, 0x10
and esi, 0xff000000
shr esi, 0x18
mov ebx, esi
xor al, bl
mov bl, byte [ebp + 0x10]
test bl, bl
je 0x429436
or dl, 0x88
or cl, 0x88
or al, 0x88
cmp dl, 0xff
jne 0x429429
dec edx
cmp cl, 0xff
jne 0x42942f
dec ecx
cmp al, 0xff
jne 0x42944d
dec eax
jmp 0x42944d
and dl, 0x77
and cl, 0x77
and al, 0x77
test dl, dl
jne 0x429443
inc edx
test cl, cl
jne 0x429448
inc ecx
test al, al
jne 0x42944d
inc eax
mov esi, edx
xor edx, edx
mov dl, cl
and eax, 0xff
movzx ecx, dx
shl ecx, 8
and esi, 0xff
shl eax, 0x10
or esi, ecx
or esi, eax
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x42948c
mov edx, esi
and edx, 0xffffff
push edx
push 0x5ce4f3
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004d1ac0
add esp, 0xc
mov eax, esi
pop esi
pop ebx
pop ebp
ret

Function at 0x42b53c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
add edx, eax
test eax, eax
je 0x42b554
dec eax
dec edx
xor byte [edx], 0x33
test eax, eax
jne 0x42b54b
pop ebp
ret

Function at 0x42b558
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
add edx, eax
test eax, eax
je 0x42b570
dec eax
dec edx
xor byte [edx], 0x33
test eax, eax
jne 0x42b567
pop ebp
ret
Function at 0x42d984
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push 0x5cef58
cmp esi, 1
jl 0x42d9a2
cmp esi, 8
jle 0x42d9a6
xor eax, eax
jmp 0x42d9ab
mov eax, 1
push eax
push ebx
call fcn.0042c0b8
add esp, 0xc
xor edx, edx
mov dword [ebx + 0x6af70], edx
mov ecx, dword [ebx + 0x6af68]
test ecx, ecx
jne 0x42d9db
mov dword [ebx + 0x6af70], 1
mov dword [ebx + 0x6af68], 0x10000
xor eax, eax
mov dword [ebx + 0x6af64], eax
push 0x1fffc
push 0
lea edx, [ebx + 0x4af68]
push edx
call fcn.004cd264
movzx ecx, word [esi*8 + 0x507e09]
mov dword [ebx + 0x6af90], ecx
add esp, 0xc
movzx eax, word [esi*8 + 0x507e07]
mov dword [ebx + 0x6af94], eax
cmp esi, 2
movzx edx, word [esi*8 + 0x507e0b]
mov dword [ebx + 0x6af98], edx
movzx ecx, word [esi*8 + 0x507e0d]
mov dword [ebx + 0x6af8c], ecx
jg 0x42da3c
or word [edi], 4
jmp 0x42da45
cmp esi, 8
jl 0x42da45
or word [edi], 2
xor eax, eax
xor edx, edx
mov dword [ebx + 0x6af7c], eax
mov esi, 0x8000
add esi, esi
mov dword [ebx + 0x6af6c], edx
push esi
lea eax, [ebx + 0x1af68]
push eax
push ebx
call dword [ebx + 9]
add esp, 0xc
mov dword [ebx + 0x6af88], eax
mov eax, dword [ebx + 0x6af88]
test eax, eax
je 0x42da80
cmp eax, 0xffffffff
jne 0x42da94
mov dword [ebx + 0x6af84], 1
xor edx, edx
mov dword [ebx + 0x6af88], edx
jmp 0x42dae2
xor ecx, ecx
mov dword [ebx + 0x6af84], ecx
mov eax, dword [ebx + 0x6af88]
cmp eax, 0x106
jae 0x42dab0
push ebx
call fcn.0042dcdc
pop ecx
xor edx, edx
xor esi, esi
mov dword [ebx + 0x6af74], edx
lea eax, [ebx + 0x1af68]
mov edx, dword [ebx + 0x6af74]
xor ecx, ecx
shl edx, 5
mov cl, byte [eax]
xor edx, ecx
inc eax
and edx, 0x7fff
inc esi
cmp esi, 2
mov dword [ebx + 0x6af74], edx
jb 0x42dac0
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x42eef4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
test edx, edx
jne 0x42ef0a
xor eax, eax
pop ebx
pop ebp
ret
xor eax, 0xffffffff
cmp ecx, 8
jb 0x42effa
xor ebx, ebx
sub ecx, 8
mov bl, byte [edx]
inc edx
xor ebx, eax
and ebx, 0xff
shr eax, 8
mov ebx, dword [ebx*4 + 0x507eb4]
xor ebx, eax
mov eax, ebx
xor ebx, ebx
mov bl, byte [edx]
inc edx
xor ebx, eax
and ebx, 0xff
shr eax, 8
mov ebx, dword [ebx*4 + 0x507eb4]
xor ebx, eax
mov eax, ebx
xor ebx, ebx
mov bl, byte [edx]
inc edx
xor ebx, eax
and ebx, 0xff
shr eax, 8
mov ebx, dword [ebx*4 + 0x507eb4]
xor ebx, eax
mov eax, ebx
xor ebx, ebx
mov bl, byte [edx]
inc edx
xor ebx, eax
and ebx, 0xff
shr eax, 8
mov ebx, dword [ebx*4 + 0x507eb4]
xor ebx, eax
mov eax, ebx
xor ebx, ebx
mov bl, byte [edx]
inc edx
xor ebx, eax
and ebx, 0xff
shr eax, 8
mov ebx, dword [ebx*4 + 0x507eb4]
xor ebx, eax
mov eax, ebx
xor ebx, ebx
mov bl, byte [edx]
inc edx
xor ebx, eax
and ebx, 0xff
shr eax, 8
mov ebx, dword [ebx*4 + 0x507eb4]
xor ebx, eax
mov eax, ebx
xor ebx, ebx
mov bl, byte [edx]
inc edx
xor ebx, eax
and ebx, 0xff
shr eax, 8
mov ebx, dword [ebx*4 + 0x507eb4]
xor ebx, eax
mov eax, ebx
xor ebx, ebx
mov bl, byte [edx]
inc edx
xor ebx, eax
and ebx, 0xff
shr eax, 8
mov ebx, dword [ebx*4 + 0x507eb4]
xor ebx, eax
cmp ecx, 8
mov eax, ebx
jae 0x42ef16
test ecx, ecx
je 0x42f01c
xor ebx, ebx
mov bl, byte [edx]
inc edx
xor ebx, eax
and ebx, 0xff
shr eax, 8
mov ebx, dword [ebx*4 + 0x507eb4]
xor ebx, eax
dec ecx
mov eax, ebx
jne 0x42effe
xor eax, 0xffffffff
pop ebx
pop ebp
ret