joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49e454
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
cmp byte [ebx + 0x30], 0
jne 0x49e47e
mov ecx, 0x49e4e0
mov dl, 1
mov eax, dword [0x49da64]
call fcn.0040e864
call fcn.00404894
mov dword [ebp - 8], edx
mov esi, dword [ebp - 4]
mov eax, dword [ebp + 8]
test eax, eax
jle 0x49e4cd
mov dword [ebp - 0xc], eax
mov ecx, dword [ebx + 0x40]
mov edx, dword [ebx + 0x3c]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x60]
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
mov edx, dword [ebx + 0x40]
xor al, byte [edx]
mov byte [esi], al
mov ecx, dword [ebx + 0x44]
dec ecx
mov edx, dword [ebx + 0x3c]
mov eax, dword [ebx + 0x3c]
inc eax
call fcn.00403314
mov eax, dword [ebx + 0x3c]
add eax, dword [ebx + 0x44]
dec eax
movzx edx, byte [esi]
mov byte [eax], dl
inc dword [ebp - 8]
inc esi
dec dword [ebp - 0xc]
jne 0x49e48e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x49e4f8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
cmp byte [ebx + 0x30], 0
jne 0x49e522
mov ecx, 0x49e58c
mov dl, 1
mov eax, dword [0x49da64]
call fcn.0040e864
call fcn.00404894
mov esi, edx
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
test eax, eax
jle 0x49e57a
mov dword [ebp - 0x10], eax
movzx eax, byte [esi]
mov byte [ebp - 9], al
mov ecx, dword [ebx + 0x40]
mov edx, dword [ebx + 0x3c]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x60]
mov eax, dword [ebx + 0x40]
movzx eax, byte [eax]
xor al, byte [esi]
mov edx, dword [ebp - 8]
mov byte [edx], al
mov ecx, dword [ebx + 0x44]
dec ecx
mov edx, dword [ebx + 0x3c]
mov eax, dword [ebx + 0x3c]
inc eax
call fcn.00403314
mov eax, dword [ebx + 0x3c]
add eax, dword [ebx + 0x44]
dec eax
movzx edx, byte [ebp - 9]
mov byte [eax], dl
inc esi
inc dword [ebp - 8]
dec dword [ebp - 0x10]
jne 0x49e534
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x49eb48
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x49ebca
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x49dd88]
mov eax, 0x14
call fcn.00405f5c
mov edi, eax
mov dword [edi + 0xc], esi
lea edx, [ebp - 8]
mov eax, esi
call dword [eax + 0x34]
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00409890
mov edx, dword [ebp - 4]
lea eax, [edi + 4]
call fcn.00404f98
mov eax, esi
call dword [eax + 0x30]
mov dword [edi + 8], eax
mov eax, dword [0x54cdc4]
mov dword [edi], eax
mov byte [edi + 0x10], bl
mov dword [0x54cdc4], edi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49ebd1
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404f68
ret
Function at 0x49ebd8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x49ec54
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x49ddb0]
mov eax, 0x10
call fcn.00405f5c
mov ebx, eax
mov dword [ebx + 0xc], esi
lea edx, [ebp - 8]
mov eax, esi
call dword [eax + 0x34]
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00409890
mov edx, dword [ebp - 4]
lea eax, [ebx + 4]
call fcn.00404f98
mov eax, esi
call dword [eax + 0x30]
mov dword [ebx + 8], eax
mov eax, dword [0x54cdc8]
mov dword [ebx], eax
mov dword [0x54cdc8], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49ec5b
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404f68
ret

Function at 0x49ecb0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jle 0x49ecd1
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
movzx ebx, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x49ecbe
pop edi
pop esi
pop ebx
ret

Function at 0x4b1fb0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4b202a
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
je 0x4b200f
mov ebx, 0x41
lea eax, [ebp - 8]
mov edx, ebx
call fcn.0040512c
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, 0x4b2040
call fcn.0040525c
mov eax, dword [ebp - 4]
call fcn.004053d4
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x4b2009
mov edx, dword [ebp - 4]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc ebx
cmp ebx, 0x5b
jne 0x4b1fd2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b2031
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404f68
ret
Function at 0x4b2298
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004053c4
xor eax, eax
push ebp
push 0x4b23f4
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 4]
call fcn.00409890
mov edx, dword [ebp - 0x30]
mov eax, 0x4b2410
call fcn.00405520
test eax, eax
jne 0x4b22f2
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, 0x4b2410
call fcn.0040525c
push 0
push 0
push 0
push 0
push 0x4b2418
call sub.wininet.dll_InternetOpenA
mov esi, eax
test esi, esi
je 0x4b23d1
mov dword [ebp - 0x14], 0x7d0
push 4
lea eax, [ebp - 0x14]
push eax
push 2
push esi
call sub.wininet.dll_InternetSetOptionA
mov dword [ebp - 0x18], 1
push 0
push 0x80000000
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004053d4
push eax
push esi
call sub.wininet.dll_InternetOpenUrlA
mov ebx, eax
test ebx, ebx
jne 0x4b2373
inc dword [ebp - 0x18]
call sub.kernel32.dll_GetLastError_1
mov edi, eax
cmp dword [ebp - 0x18], 5
jg 0x4b2373
cmp edi, 0x2ee2
jne 0x4b2373
cmp edi, 0x2f78
jne 0x4b2373
push 2
call sub.kernel32.dll_Sleep_2
jmp 0x4b232a
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0xa
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x2c]
push eax
push 0x13
push ebx
call sub.wininet.dll_HttpQueryInfoA
lea edi, [ebp - 0x2c]
lea eax, [ebp - 0x34]
mov edx, edi
call fcn.0040513c
mov eax, dword [ebp - 0x34]
mov edx, 0x194
call fcn.0040a0a4
add eax, 0xfffffe70
sub eax, 0x33
jae 0x4b23bd
mov byte [ebp - 5], 0
jmp 0x4b23c1
mov byte [ebp - 5], 1
test ebx, ebx
je 0x4b23cb
push ebx
call sub.wininet.dll_InternetCloseHandle
push esi
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b23fb
lea eax, [ebp - 0x34]
mov edx, 2
call fcn.00404f68
lea eax, [ebp - 4]
call fcn.00404f44
ret
Function at 0x4b38f8
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x4b3981
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x54dc9c
push 0x101
call sub.ws2_32.dll_WSAStartup
mov ebx, eax
test ebx, ebx
je 0x4b396b
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.0040e020
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xb
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 0
mov eax, 0x4b3998
mov dword [ebp - 8], eax
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x18]
push eax
push 2
mov ecx, dword [0x54751c]
mov dl, 1
mov eax, dword [0x4b30ec]
call fcn.0040e95c
call fcn.00404894
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b3988
lea eax, [ebp - 0x1c]
call fcn.00404f44
ret

Function at 0x4b3f60
Capabilities:
Set socket configuration

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, eax
xor esi, esi
xor edi, edi
movzx eax, byte [0x4b3fbc]
cmp al, byte [ebx + 0x28]
je 0x4b3f84
mov esi, 0x401
mov eax, ebx
call fcn.004b40ac
mov edi, eax
movzx eax, byte [ebx + 0x28]
push eax
push esi
push edi
mov eax, dword [ebx + 4]
push eax
call sub.ws2_32.dll_WSAAsyncSelect
movzx eax, byte [0x4b3fbc]
cmp al, byte [ebx + 0x28]
jne 0x4b3fb4
xor eax, eax
mov dword [esp], eax
push esp
push 0x8004667e
mov eax, dword [ebx + 4]
push eax
call sub.ws2_32.dll_ioctlsocket
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4b4040
Capabilities:
Connect socket

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, ebx
call fcn.004b3f60
mov cl, 1
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call fcn.004041dc
push 0x10
lea eax, [ebx + 0x18]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.ws2_32.dll_connect
mov edx, 0x4b40a4
call fcn.004b3840
mov byte [ebx + 0x29], 0
test byte [ebx + 0x28], 0x10
jne 0x4b4096
cmp dword [ebx + 4], 0xffffffff
setne al
mov byte [ebx + 8], al
mov cl, 2
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call fcn.004041dc
pop esi
pop ebx
ret

Function at 0x4b40c8
Capabilities:
Resolve dns

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, edx
mov eax, ebx
call fcn.004053d4
push eax
call sub.ws2_32.dll_gethostbyname
mov ebx, eax
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 4
call fcn.004038dc
test ebx, ebx
je 0x4b4117
mov eax, ebx
mov edx, dword [eax + 0xc]
mov edx, dword [edx]
movzx ecx, byte [edx]
mov byte [esp + 4], cl
movzx ecx, byte [edx + 1]
mov byte [esp + 5], cl
movzx ecx, byte [edx + 2]
mov byte [esp + 6], cl
movzx eax, byte [edx + 3]
mov byte [esp + 7], al
mov eax, dword [esp + 4]
mov dword [esp], eax
mov eax, dword [esp]
pop ecx
pop edx
pop ebx
ret
Function at 0x4b41f4
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x4b4225
mov ecx, dword [0x54734c]
mov dl, 1
mov eax, dword [0x4b30ec]
call fcn.0040e920
call fcn.00404894
push 0
push 1
push 2
call sub.ws2_32.dll_socket
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], ebx
inc ebx
jne 0x4b4252
mov ecx, dword [0x547278]
mov dl, 1
mov eax, dword [0x4b30ec]
call fcn.0040e920
call fcn.00404894
xor eax, eax
push ebp
push 0x4b42ce
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xffff
call fcn.004041dc
cmp byte [ebp + 8], 0
je 0x4b42aa
mov eax, dword [ebp + 0x10]
push eax
movzx eax, word [ebp + 0xc]
push eax
push 1
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.004b415c
mov eax, dword [ebp - 4]
lea esi, [ebp - 0x18]
lea edi, [eax + 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 4]
call fcn.004b4040
jmp 0x4b42c4
mov eax, dword [ebp + 0x10]
push eax
movzx eax, word [ebp + 0xc]
push eax
push 0
push 1
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.004b3b34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b42eb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4b44c4
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004b3dfc
xor eax, eax
push ebp
push 0x4b4637
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x4b4621
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
je 0x4b4510
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x4b451a
call fcn.00404940
jmp 0x4b463e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00421710
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x1010]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov ecx, 0x1000
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
test ebx, ebx
jle 0x4b4616
push 0
push ebx
lea eax, [ebp - 0x1010]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.ws2_32.dll_send
mov edi, eax
cmp edi, 0xffffffff
jne 0x4b45c9
call sub.ws2_32.dll_WSAGetLastError
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2733
je 0x4b45b6
lea eax, [ebp - 0x10]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.004041dc
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
push ebp
call fcn.004b447c
pop ecx
mov eax, dword [ebp - 4]
movzx edx, byte [0x4b464c]
cmp dl, byte [eax + 0x28]
je 0x4b461d
call fcn.0040e838
jmp 0x4b461d
mov eax, dword [ebp - 0xc]
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00421730
jmp 0x4b461d
cmp edi, ebx
jge 0x4b45e5
mov eax, dword [ebp - 0xc]
add eax, edi
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00421730
jmp 0x4b451a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00421710
cmp edx, dword [esp + 4]
jne 0x4b4605
cmp eax, dword [esp]
pop edx
pop eax
jne 0x4b451a
push ebp
call fcn.004b447c
pop ecx
jmp 0x4b461d
push ebp
call fcn.004b447c
pop ecx
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b463e
mov eax, dword [ebp - 4]
call fcn.004b3e08
ret
movzx eax, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b4650
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b4772
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004b3dfc
xor eax, eax
push ebp
push 0x4b4755
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x4b46a0
call fcn.00404940
jmp 0x4b475c
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.ws2_32.dll_send
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x4b473f
call sub.ws2_32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x4b473f
lea eax, [ebp - 0xc]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.004041dc
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x4b473f
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040e020
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x4b478c
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x54751c]
mov dl, 1
mov eax, dword [0x4b30ec]
call fcn.0040e95c
call fcn.00404894
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b475c
mov eax, dword [ebp - 4]
call fcn.004b3e08
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b4779
lea eax, [ebp - 0x28]
call fcn.00404f44
ret
Function at 0x4b47d8
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b4949
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004b3dfc
xor eax, eax
push ebp
push 0x4b492c
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp ebx, 0xffffffff
jne 0x4b483d
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x4b483d
lea eax, [ebp - 8]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.ws2_32.dll_ioctlsocket
jmp 0x4b4916
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x4b4850
call fcn.00404940
jmp 0x4b4933
lea eax, [ebp - 0x10]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.ws2_32.dll_ioctlsocket
test eax, eax
jne 0x4b4877
cmp dword [ebp - 0x10], 0
jle 0x4b4877
cmp ebx, dword [ebp - 0x10]
jle 0x4b4877
mov ebx, dword [ebp - 0x10]
push 0
push ebx
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.ws2_32.dll_recv
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x4b4916
call sub.ws2_32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x4b4916
lea eax, [ebp - 0xc]
push eax
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.004041dc
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x4b4916
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 0xc]
call fcn.0040e020
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
mov eax, 0x4b4964
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xb
lea eax, [ebp - 0x28]
push eax
push 2
mov ecx, dword [0x54751c]
mov dl, 1
mov eax, dword [0x4b30ec]
call fcn.0040e95c
call fcn.00404894
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b4933
mov eax, dword [ebp - 4]
call fcn.004b3e08
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b4950
lea eax, [ebp - 0x2c]
call fcn.00404f44
ret
Function at 0x4b58f8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp], edx
mov ebp, eax
cmp dword [esp], 0
je 0x4b590e
test ebp, ebp
jne 0x4b5915
xor eax, eax
jmp 0x4b59e9
mov esi, 2
mov byte [esp + 5], 0
mov dword [esp + 8], ecx
mov byte [esp + 6], 0xac
mov byte [esp + 7], 0x3c
mov edi, dword [esp]
dec edi
test edi, edi
jl 0x4b59cc
inc edi
movzx eax, byte [ebp]
xor al, byte [esp + 6]
inc ebp
cmp esi, 6
jne 0x4b597c
mov edx, eax
and dl, 0x3f
movzx edx, dl
movzx ebx, byte [esp + 7]
add edx, ebx
mov byte [ecx], dl
inc ecx
movzx eax, al
shr eax, 2
and al, 0x30
or byte [esp + 5], al
movzx eax, byte [esp + 5]
movzx edx, byte [esp + 7]
add eax, edx
mov byte [ecx], al
inc ecx
mov byte [esp + 5], 0
jmp 0x4b59b6
movzx edx, al
shr edx, 2
mov byte [esp + 4], dl
movzx edx, byte [esp + 4]
and dl, 0x3c
and al, 3
or dl, al
movzx eax, dl
movzx edx, byte [esp + 7]
add eax, edx
mov byte [ecx], al
inc ecx
movzx eax, byte [esp + 5]
add eax, eax
add eax, eax
movzx edx, byte [esp + 4]
and dl, 3
or al, dl
mov byte [esp + 5], al
mov eax, esi
mov ebx, 6
cdq
idiv ebx
add edx, 2
mov esi, edx
dec edi
jne 0x4b593a
cmp esi, 2
je 0x4b59e0
movzx eax, byte [esp + 5]
movzx edx, byte [esp + 7]
add eax, edx
mov byte [ecx], al
inc ecx
mov eax, ecx
sub eax, dword [esp + 8]
mov byte [ecx], 0
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4b59f4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe8
mov ebp, ecx
mov dword [esp], edx
mov edi, eax
cmp dword [esp], 0
je 0x4b5a0c
test edi, edi
jne 0x4b5a13
xor eax, eax
jmp 0x4b5bb2
mov dword [esp + 0x10], ebp
mov eax, dword [esp]
test eax, eax
jns 0x4b5a21
add eax, 3
sar eax, 2
mov edx, dword [esp]
and edx, 0x80000003
jns 0x4b5a34
dec edx
or edx, 0xfffffffc
inc edx
mov dword [esp + 4], edx
mov byte [esp + 0xd], 0xac
mov dl, 0x3c
dec eax
test eax, eax
jl 0x4b5af1
inc eax
mov dword [esp + 0x14], eax
mov dword [esp + 8], 0
mov esi, dword [esp + 8]
add esi, esi
add esi, esi
lea eax, [esi + edi]
add eax, 3
movzx eax, byte [eax]
sub al, dl
mov byte [esp + 0xc], al
lea eax, [esi + edi]
movzx eax, byte [eax]
sub al, dl
mov ecx, eax
add ecx, ecx
add ecx, ecx
and cl, 0xf0
movzx ebx, byte [esp + 0xc]
and bl, 0xc
or cl, bl
and al, 3
or cl, al
mov eax, ecx
xor al, byte [esp + 0xd]
mov byte [ebp], al
inc ebp
lea eax, [esi + edi]
inc eax
movzx eax, byte [eax]
sub al, dl
mov ecx, eax
add ecx, ecx
add ecx, ecx
and cl, 0xf0
movzx ebx, byte [esp + 0xc]
add ebx, ebx
add ebx, ebx
and bl, 0xc
or cl, bl
and al, 3
or cl, al
mov eax, ecx
xor al, byte [esp + 0xd]
mov byte [ebp], al
inc ebp
add esi, edi
add esi, 2
movzx eax, byte [esi]
sub al, dl
movzx ecx, byte [esp + 0xc]
add ecx, ecx
add ecx, ecx
and cl, 0xc0
or al, cl
xor al, byte [esp + 0xd]
mov byte [ebp], al
inc ebp
inc dword [esp + 8]
dec dword [esp + 0x14]
jne 0x4b5a55
cmp dword [esp + 4], 2
jne 0x4b5b38
mov eax, dword [esp]
add eax, edi
mov ecx, eax
dec ecx
movzx ecx, byte [ecx]
sub cl, dl
mov byte [esp + 0xc], cl
sub eax, 2
movzx eax, byte [eax]
sub al, dl
mov edx, eax
add edx, edx
add edx, edx
and dl, 0xf0
movzx ecx, byte [esp + 0xc]
add ecx, ecx
add ecx, ecx
and cl, 0xc
or dl, cl
and al, 3
or dl, al
mov eax, edx
xor al, byte [esp + 0xd]
mov byte [ebp], al
inc ebp
jmp 0x4b5ba8
cmp dword [esp + 4], 3
jne 0x4b5ba8
mov esi, dword [esp]
add esi, edi
mov eax, esi
dec eax
movzx eax, byte [eax]
sub al, dl
mov byte [esp + 0xc], al
mov eax, esi
sub eax, 3
movzx eax, byte [eax]
sub al, dl
mov ecx, eax
add ecx, ecx
add ecx, ecx
and cl, 0xf0
movzx ebx, byte [esp + 0xc]
and bl, 0xc
or cl, bl
and al, 3
or cl, al
mov eax, ecx
xor al, byte [esp + 0xd]
mov byte [ebp], al
inc ebp
sub esi, 2
movzx eax, byte [esi]
sub al, dl
mov edx, eax
add edx, edx
add edx, edx
and dl, 0xf0
movzx ecx, byte [esp + 0xc]
add ecx, ecx
add ecx, ecx
and cl, 0xc
or dl, cl
and al, 3
or dl, al
mov eax, edx
xor al, byte [esp + 0xd]
mov byte [ebp], al
inc ebp
mov eax, ebp
sub eax, dword [esp + 0x10]
mov byte [ebp], 0
add esp, 0x18
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4bf6dc
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
mov byte [ebp - 1], 0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4bf793
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.004053d4
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jne 0x4bf71e
call fcn.00404940
jmp 0x4bf79a
mov eax, ebx
call fcn.00402fd8
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push ebx
push 0
mov eax, esi
call fcn.004053d4
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
jne 0x4bf747
call fcn.00404940
jmp 0x4bf79a
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4bf7a8
mov eax, dword [ebp - 8]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
jne 0x4bf768
call fcn.00404940
jmp 0x4bf79a
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
mov dword [edi], eax
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bf79a
mov eax, dword [ebp - 8]
call fcn.00402ff4
ret
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4bf9f4
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4bfa5c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x164]
xor ecx, ecx
mov edx, 0x160
call fcn.004038dc
test ebx, ebx
jne 0x4bfa31
mov word [ebp - 2], 0
lea ebx, [ebp - 2]
or esi, 0x4008
push esi
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
push ebx
call sub.shell32.dll_SHGetFileInfoA
mov ebx, dword [ebp - 0x160]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4bfa68
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret