joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47dedc
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x47df03
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00403c62
jmp 0x47dfd2
mov eax, dword [edi + 0x1c]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], eax
test eax, eax
je 0x47df25
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x47df27
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test ebx, ebx
jl 0x47dfc6
jg 0x47df44
test esi, esi
je 0x47dfc6
test ecx, ecx
jl 0x47df91
jg 0x47df4e
test eax, eax
je 0x47df91
cmp ebx, ecx
jg 0x47df62
jl 0x47df58
cmp esi, eax
jae 0x47df62
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
push eax
push dword [esp + 0x18]
push dword [ebp + 8]
call fcn.004c2cb0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [edi + 0x2c]
add edx, ecx
sub esi, ecx
mov dword [esp + 0xc], edx
sbb ebx, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x47df98
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
test ebx, ebx
jl 0x47dfc6
jg 0x47dfa2
test esi, esi
je 0x47dfc6
cmp dword [edi + 0x4c], 0
je 0x47dfc6
mov ecx, edi
call fcn.0047e437
push dword [edi + 0x4c]
push esi
push 1
push dword [esp + 0x18]
call fcn.004da095
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x47e23f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0x47e25b
xor eax, eax
jmp 0x47e320
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x47e284
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
add eax, ecx
cmp ecx, eax
jae 0x47e284
dec dword [edx]
mov eax, ebx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
jmp 0x47e320
cmp dword [esi + 0x4c], 0
je 0x47e31e
mov ecx, esi
call fcn.0047e437
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x47e2b1
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.004d92a4
cmp eax, edi
pop ecx
pop ecx
cmovne edi, ebx
jmp 0x47e31e
lea eax, [ebp + 8]
mov byte [ebp - 1], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x47e31e
cmp eax, 1
jle 0x47e2ed
cmp eax, 3
jne 0x47e31e
push dword [esi + 0x4c]
movsx ecx, byte [ebp - 1]
push ecx
jmp 0x47e2a3
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
sub eax, ecx
mov dword [ebp - 8], eax
je 0x47e310
push dword [esi + 0x4c]
push eax
mov eax, ecx
push 1
push eax
call fcn.004d67f9
add esp, 0x10
cmp dword [ebp - 8], eax
jne 0x47e31e
lea eax, [ebp - 1]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0xc], eax
mov eax, ebx
jne 0x47e320
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x47e4bf
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x47e537
cmp byte [esi + 0x3d], 0
je 0x47e537
push 0xffffffffffffffff
call fcn.0047e23f
cmp eax, 0xffffffff
je 0x47e509
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x47e50d
sub eax, 1
je 0x47e511
dec eax
sub eax, 1
je 0x47e537
xor al, al
jmp 0x47e539
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 4]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x47e52e
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004d67f9
add esp, 0x10
cmp edi, eax
jne 0x47e509
cmp byte [esi + 0x3d], 0
sete al
jmp 0x47e539
mov al, 1
pop edi
pop esi
leave
ret
Function at 0x47f46a
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x5955b1
call fcn.0058e54c
push ecx
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], edi
push 8
lea esi, [edi + 0x1c]
mov dword [edi], vtable.Blizzard::Util::ThreadSafeQueue_class_bnet::log::Entry__.0
mov dword [ebp - 0x14], esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
call fcn.00405569
mov dword [esi], eax
pop ecx
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov eax, dword [esi]
mov dword [eax], esi
lea eax, [edi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [ebp - 4], ebx
lea ecx, [edi + 0x30]
mov dword [edi], vtable.Blizzard::Util::BlockingQueue_class_bnet::log::Entry__.0
call fcn.0043235b
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x4801f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x260
push esi
push edi
push dword [ebp + 8]
mov edi, ecx
mov esi, edx
lea ecx, [esp + 0xc]
call fcn.0043580a
push dword [eax + 4]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
lea eax, [esp + 0x10]
cmp dword [esp + 0xc], eax
je 0x48022f
push dword [esp + 0xc]
call fcn.004ab853
pop ecx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4836ab
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x595834
call fcn.0058e54c
sub esp, 0x38
push ebx
push esi
mov esi, edx
xor ebx, ebx
push edi
mov edi, ecx
mov dword [ebp - 0x14], ebx
push edi
lea eax, [esi + 4]
mov edx, str.bounds
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x24]
lea eax, [esi + 8]
mov dword [ebp - 0x20], eax
lea eax, [esi + 0xc]
mov dword [ebp - 0x1c], eax
lea eax, [esi + 0x10]
mov dword [ebp - 0x18], eax
call fcn.00483487
pop ecx
push 2
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0x28]
mov byte [ebp - 0x28], bl
pop ebx
push ebx
push 0x5d78e8
mov dword [ebp - 0x14], 0xf
call fcn.00403fdc
and dword [ebp - 4], 0
lea eax, [esi + 0x18]
push eax
lea edx, [ebp - 0x28]
mov ecx, edi
call fcn.0045398d
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x28]
call fcn.00403f6b
and dword [ebp - 0x18], 0
lea ecx, [ebp - 0x28]
push 6
push str.action
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.00403fdc
lea eax, [esi + 0x30]
mov dword [ebp - 4], 1
push eax
lea edx, [ebp - 0x28]
mov ecx, edi
call fcn.0045398d
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x28]
call fcn.00403f6b
and dword [ebp - 0x18], 0
lea ecx, [ebp - 0x28]
push 7
push str.visible
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.00403fdc
lea eax, [esi + 0x14]
mov dword [ebp - 4], ebx
push eax
lea edx, [ebp - 0x28]
mov ecx, edi
call fcn.00453a52
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x28]
call fcn.00403f6b
and dword [ebp - 0x18], 0
push 0xf
pop ebx
mov dword [ebp - 0x14], ebx
mov byte [ebp - 0x28], 0
push 9
push str.tab_order
lea ecx, [ebp - 0x28]
call fcn.00403fdc
lea eax, [esi + 0x60]
mov dword [ebp - 4], 3
push eax
lea edx, [ebp - 0x28]
mov ecx, edi
call fcn.0045411a
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x28]
call fcn.00403f6b
and dword [ebp - 0x30], 0
lea ecx, [ebp - 0x40]
push ebx
push str.accessible_name
mov dword [ebp - 0x2c], ebx
mov byte [ebp - 0x40], 0
call fcn.00403fdc
lea ecx, [esi + 0x48]
mov dword [ebp - 4], 4
push ecx
lea edx, [ebp - 0x40]
mov ecx, edi
call fcn.0045398d
pop ecx
lea ecx, [ebp - 0x40]
call fcn.00403f6b
mov ecx, dword [ebp - 0xc]
mov al, 1
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x486523
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
push ecx
lea ecx, [ebp - 0x260]
mov edi, edx
mov dword [esi], eax
call fcn.0043580a
push esi
push dword [ebp + 8]
mov esi, dword [ebp + 0x14]
push edi
push 0
push dword [eax + 4]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
lea eax, [ebp - 0x258]
cmp dword [ebp - 0x25c], eax
je 0x486575
push dword [ebp - 0x25c]
call fcn.004ab853
pop ecx
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x486600
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x370
lea eax, [esp + 8]
push ebx
push esi
push ecx
push eax
mov ecx, str.Blizzard_Error
xor ebx, ebx
call fcn.004864f7
pop ecx
pop ecx
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
lea eax, [esp + 0x2c]
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, eax
test esi, esi
jne 0x4866b3
push str.UserUUID
lea ecx, [esp + 0x11c]
call fcn.0043580a
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 1
push ebx
push dword [eax + 4]
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
lea eax, [esp + 0x120]
cmp dword [esp + 0x11c], eax
je 0x486691
push dword [esp + 0x11c]
call fcn.004ab853
pop ecx
test esi, esi
jne 0x4866a9
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
test esi, esi
jne 0x4866a9
mov bl, 1
jmp 0x4866ba
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4867af
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, ecx
push ebx
mov dword [ebp - 0x14], eax
mov ebx, edx
push esi
mov eax, dword [eax]
inc eax
push edi
mov edi, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edi
mov al, byte [edi]
mov byte [ebp - 1], al
movzx esi, al
test al, al
jne 0x4867e1
mov dword [ebx], 1
jmp 0x486927
lea eax, [esi - 0x30]
cmp eax, 0x4a
ja 0x486927
lea ecx, [esi - 0x30]
movsx edx, word [ecx*2 + 0x5cd138]
mov dword [ebp - 8], ecx
test edx, edx
je 0x486806
mov esi, edx
jmp 0x486927
cmp esi, 0x55
ja 0x4868aa
je 0x486831
push 0x30
pop eax
cmp esi, eax
je 0x486888
jbe 0x4868c6
cmp esi, 0x39
jbe 0x48683c
cmp esi, 0x4c
je 0x486831
cmp esi, 0x4e
jne 0x4868c6
mov dword [ebx], 0x25
jmp 0x486927
cmp dword [ebp + 0x10], 0
jne 0x486877
jmp 0x486851
mov edi, esi
imul ecx, ecx, 0xa
movzx eax, byte [edi]
add eax, 0xffffffd0
add ecx, eax
lea esi, [edi + 1]
movzx eax, byte [esi]
test byte [eax + 0x5cd1d0], 4
jne 0x486844
cmp ecx, 0xa
jl 0x48686a
cmp ecx, dword [ebp + 8]
jg 0x486874
push 0xffffffffffffffec
pop esi
sub esi, ecx
jmp 0x486927
mov ecx, dword [ebp - 8]
cmp byte [ebp - 1], 0x38
jb 0x486888
mov edi, dword [ebp - 0xc]
dec edi
xor esi, esi
jmp 0x486927
mov edi, dword [ebp - 0x10]
mov bl, byte [edi + 1]
inc edx
lea eax, [ebx - 0x30]
cmp al, 7
ja 0x4868a5
add ecx, 0xfffffffa
movzx eax, bl
inc edi
lea ecx, [eax + ecx*8]
cmp edx, 2
jl 0x48688b
movzx esi, cl
jmp 0x486927
cmp esi, 0x63
je 0x486908
cmp esi, 0x6c
je 0x486831
cmp esi, 0x75
je 0x486831
cmp esi, 0x78
je 0x4868d4
test byte [ebp + 0xc], 0x40
je 0x486927
mov dword [ebx], 3
jmp 0x486927
push 0x30
xor esi, esi
pop ebx
movzx eax, byte [edi + 1]
inc edx
test byte [eax + 0x5cd1d0], 8
je 0x486927
inc edi
lea ecx, [eax - 0x20]
cmp eax, 0x61
push 0x37
cmovb ecx, eax
cmp ecx, 0x41
pop eax
cmovl eax, ebx
shl esi, 4
sub esi, eax
add esi, ecx
cmp edx, 2
jl 0x4868d9
jmp 0x486927
inc edi
movzx eax, byte [edi]
test eax, eax
jne 0x486918
mov dword [ebx], 2
jmp 0x48692e
lea ecx, [eax - 0x61]
cmp ecx, 0x19
lea esi, [eax - 0x20]
cmova esi, eax
xor esi, 0x40
mov eax, dword [ebp - 0x14]
mov dword [eax], edi
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x48b97e
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, edx
mov dword [ebp - 0x18], edx
shl eax, 2
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], ecx
push edi
mov edi, ecx
test eax, eax
jle 0x48ba36
mov ecx, edx
mov dword [ebp - 8], 0xff
push ebx
shl ecx, 2
push esi
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], edi
test edx, edx
jle 0x48ba23
mov dword [ebp - 0xc], edx
mov al, byte [edi]
xor edx, edx
mov ch, byte [edi + 3]
lea edi, [edi + 4]
movzx eax, al
movzx esi, ch
imul eax, esi
mov bl, byte [edi - 2]
mov cl, byte [edi - 3]
div dword [ebp - 8]
mov edx, dword [ebp - 4]
mov byte [edx], al
inc edx
mov dword [ebp - 4], edx
xor edx, edx
movzx eax, cl
imul eax, esi
div dword [ebp - 8]
mov edx, dword [ebp - 4]
mov byte [edx], al
inc edx
movzx eax, bl
mov ebx, 0xff
mov dword [ebp - 4], edx
xor edx, edx
imul eax, esi
div ebx
mov edx, dword [ebp - 4]
mov byte [edx], al
mov byte [edx + 1], ch
add edx, 2
sub dword [ebp - 0xc], 1
mov dword [ebp - 4], edx
jne 0x48b9bb
mov edi, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
add edi, ecx
sub eax, 1
mov dword [ebp - 0x10], edi
mov dword [ebp + 8], eax
jne 0x48b9ae
pop esi
pop ebx
pop edi
leave
ret
Function at 0x48cf1b
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, edx
mov edx, ecx
mov al, byte [edx + 8]
mov byte [ebp - 1], al
cmp al, 3
je 0x48d0a9
movzx ecx, byte [edx + 9]
push esi
xor esi, esi
mov dword [ebp - 8], ecx
push edi
mov edi, dword [edx]
test al, 2
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
je 0x48cf79
movzx eax, byte [eax]
sub ecx, eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 8]
push 3
movzx eax, byte [eax + 1]
sub ecx, eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 8]
movzx eax, byte [eax + 2]
sub ecx, eax
mov dword [ebp - 0x1c], ecx
pop ecx
jmp 0x48cf8b
movzx eax, byte [eax + 3]
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], ecx
xor ecx, ecx
inc ecx
mov dword [ebp - 8], eax
test byte [ebp - 1], 4
mov dword [ebp - 0xc], ecx
je 0x48cfa9
mov eax, dword [ebp + 8]
movzx eax, byte [eax + 4]
sub dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x24], eax
inc ecx
mov dword [ebp - 0xc], ecx
mov eax, esi
test ecx, ecx
je 0x48d0a7
cmp dword [ebp + eax*4 - 0x24], esi
jg 0x48cfbf
mov dword [ebp + eax*4 - 0x24], esi
jmp 0x48cfc6
mov dword [ebp - 0x10], 1
inc eax
cmp eax, ecx
jl 0x48cfb3
cmp word [ebp - 0x10], si
je 0x48d0a7
movzx eax, byte [edx + 9]
dec eax
sub eax, 1
je 0x48d092
dec eax
sub eax, 1
je 0x48d064
sub eax, 4
je 0x48d046
sub eax, 8
jne 0x48d0a7
imul edi, ecx
mov dword [ebp - 0x10], edi
test edi, edi
je 0x48d0a7
mov eax, esi
xor edx, edx
div ecx
movzx esi, byte [ebx]
mov eax, 0x100
imul esi, eax
movzx eax, byte [ebx + 1]
mov cx, word [ebp + edx*4 - 0x24]
add si, ax
shr si, cl
movzx ecx, si
mov esi, dword [ebp - 0x14]
mov eax, ecx
shr eax, 8
inc esi
mov byte [ebx], al
lea ebx, [ebx + 2]
mov byte [ebx - 1], cl
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x14], esi
cmp esi, dword [ebp - 0x10]
jb 0x48d005
jmp 0x48d0a7
imul edi, ecx
test edi, edi
je 0x48d0a7
xor edx, edx
mov eax, esi
div ecx
mov cl, byte [ebp + edx*4 - 0x24]
shr byte [ebx], cl
inc ebx
mov ecx, dword [ebp - 0xc]
inc esi
cmp esi, edi
jb 0x48d04d
jmp 0x48d0a7
mov esi, dword [edx + 4]
mov edx, 0xf0
mov ecx, dword [ebp - 0x24]
sar edx, cl
push 0xf
pop eax
and dl, 0xf0
sar eax, cl
or dl, al
test esi, esi
je 0x48d0a7
mov al, byte [ebx]
mov cl, byte [ebp - 0x24]
shr al, cl
and al, dl
mov byte [ebx], al
inc ebx
sub esi, 1
jne 0x48d07f
jmp 0x48d0a7
mov ecx, dword [edx + 4]
test ecx, ecx
je 0x48d0a7
mov al, byte [ebx]
shr al, 1
and al, 0x55
mov byte [ebx], al
inc ebx
sub ecx, 1
jne 0x48d099
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4ae758
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x4dff38
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004dfebb

Function at 0x4e6fa5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004e6e22

Function at 0x4eb339
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004eafdb

Function at 0x4f13b0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x600088]
xor eax, esp
mov dword [esp + 0x190], eax
mov eax, dword [0x60d04c]
mov ecx, eax
inc eax
mov dword [0x60d04c], eax
test ecx, ecx
je 0x4f13ec
xor eax, eax
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.004ac0cf
add esp, 0x194
ret
cmp byte [esp + 0x19c], 0
je 0x4f1428
mov dword [fcn.004d89a5], 0x4d89a5
mov dword [fcn.004cc3ce], 0x4cc3ce
mov dword [fcn.004d5df3], 0x4d5df3
mov dword [fcn.004df0a6], 0x4df0a6
mov dword [fcn.004cce02], 0x4cce02
push ebx
call fcn.004fde50
test eax, eax
je 0x4f146a
mov ebx, dword [esp + 0x19c]
test bl, 2
je 0x4f148d
lea eax, [esp + 4]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x4f146a
mov eax, dword [esp + 4]
cmp al, 2
jne 0x4f1485
shr eax, 8
cmp al, 2
jne 0x4f1485
call fcn.004fca60
test eax, eax
je 0x4f148d
mov eax, 2
pop ebx
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.004ac0cf
add esp, 0x194
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x4f146a
call fcn.00403b40
test eax, eax
jne 0x4f146a
call fcn.004fab80
mov eax, dword [0x60d164]
test bl, 4
mov ecx, 1
mov dword [0x60d050], ebx
cmovne eax, ecx
mov dword [0x60d164], eax
call fcn.00506f80
mov ecx, dword [esp + 0x194]
xor eax, eax
pop ebx
xor ecx, esp
call fcn.004ac0cf
add esp, 0x194
ret
Function at 0x4f9280
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
sub esp, 0x18
mov eax, dword [0x600088]
xor eax, esp
mov dword [esp + 0x14], eax
push edi
mov edi, dword [esp + 0x20]
test edi, edi
je 0x4f935a
lea eax, [esp + 4]
push eax
push edi
push 2
call fcn.00513bf0
add esp, 0xc
test eax, eax
jne 0x4f935a
lea eax, [esp + 8]
push eax
push edi
push 0x17
call fcn.00513bf0
add esp, 0xc
test eax, eax
jne 0x4f935a
push ebx
push ebp
push esi
mov esi, edi
xor ebx, ebx
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x4f92d5
sub esi, ecx
push esi
push 0x2e
push edi
call fcn.00513bc0
add esp, 0xc
test eax, eax
je 0x4f9309
sub eax, edi
push eax
push 0x2e
push edi
call fcn.00513bc0
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x4f930b
inc ebx
mov ecx, edi
sub ecx, ebx
add esi, ecx
test ebx, ebx
cmovne edi, ebx
xor ecx, ecx
xor ebp, ebp
mov ebx, 0x1505
lea eax, [esi + edi]
cmp edi, eax
cmova esi, ecx
test esi, esi
je 0x4f9344
mov al, byte [edi]
push eax
call fcn.00507040
movsx ecx, al
lea edi, [edi + 1]
mov eax, ebx
inc ebp
shl eax, 5
add esp, 4
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp ebp, esi
jb 0x4f9323
pop esi
pop ebp
movzx eax, bl
pop ebx
pop edi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.004ac0cf
add esp, 0x18
ret
mov ecx, dword [esp + 0x18]
xor eax, eax
pop edi
xor ecx, esp
call fcn.004ac0cf
add esp, 0x18
ret

Function at 0x4fab80
Capabilities:
Create udp socket

Disassembly:
mov eax, dword [0x600ac4]
cmp eax, 0xffffffff
jne 0x4fabc2
push 0
push 2
push 0x17
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
jne 0x4faba8
xor eax, eax
test eax, eax
mov dword [0x600ac4], eax
setg al
ret
push eax
push 0
mov dword [0x600ac4], 1
call fcn.005052d0
mov eax, dword [0x600ac4]
add esp, 8
test eax, eax
setg al
ret

Function at 0x4fabd0
Capabilities:
Create udp socket

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x2d0], 2
jne 0x4fac25
mov eax, dword [0x600ac4]
cmp eax, 0xffffffff
jne 0x4fac1f
push 0
push 2
push 0x17
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
jne 0x4fac05
xor eax, eax
test eax, eax
mov dword [0x600ac4], eax
setg al
ret
push eax
push 0
mov dword [0x600ac4], 1
call fcn.005052d0
mov eax, dword [0x600ac4]
add esp, 8
test eax, eax
setg al
ret
mov al, 1
ret
Function at 0x5047b0
Capabilities:
Write file on windows

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp dword [edi + 0x1d0], 0
je 0x5047f4
push esi
push 1
push edi
call fcn.004f4fa0
push dword [edi + 0x15c]
mov eax, dword [edi + 0x1d0]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push edi
call eax
push 0
push edi
mov esi, eax
call fcn.004f4fa0
add esp, 0x24
mov eax, esi
pop esi
pop edi
ret
mov eax, dword [esp + 0xc]
cmp eax, 2
ja 0x50482d
push dword [edi + 0x158]
lea eax, [eax + eax*2]
push 1
add eax, 0x5b12b4
push 2
push eax
call fcn.004d67f9
push dword [edi + 0x158]
push 1
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call fcn.004d67f9
add esp, 0x20
xor eax, eax
pop edi
ret

Function at 0x504f00
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
mov edx, dword [esp + 8]
xor eax, eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov esi, 0x1cc
mov ecx, dword [edi + 0x1ac]
cmp edx, ecx
sete al
lea eax, [eax*4 + 0x1a8]
mov ebp, dword [eax + edi]
mov eax, 0x1dc
cmove esi, eax
mov eax, dword [edi + 0x2c8]
add esi, edi
mov ebx, dword [esi + 4]
sub ebx, dword [esi + 8]
test byte [eax + 0x40], 3
je 0x504fd8
xor eax, eax
cmp edx, ecx
sete al
lea eax, [eax*4 + 0x1bc]
cmp dword [eax + edi], 0x504b50
jne 0x504fd8
cmp dword [esi], 0
je 0x504f68
test ebx, ebx
je 0x504fd8
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebp
call fcn.00504370
add esp, 0x14
cmp eax, 0xffffffff
je 0x504fd8
test al, 1
je 0x504fd8
mov ecx, dword [esi]
test ecx, ecx
jne 0x504fb8
mov eax, dword [edi]
mov eax, dword [eax + 0x4c8]
add eax, eax
push eax
mov dword [esi + 4], eax
call dword [0x600ab0]
mov ebx, dword [esi + 4]
mov ecx, eax
add esp, 4
mov dword [esi], ecx
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
test ecx, ecx
je 0x504fd1
mov eax, dword [esi + 8]
push 0
push ebx
add eax, ecx
push eax
push ebp
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x504fd8
add dword [esi + 8], eax
jmp 0x504fd8
mov dword [esi + 4], 0
push 0
push dword [esp + 0x24]
push dword [esp + 0x24]
push ebp
call dword [sym.imp.WS2_32.dll_send]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x505041
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
jne 0x505012
mov ecx, dword [esp + 0x24]
lea eax, [ebx + 0x52]
pop edi
pop esi
pop ebp
mov dword [ecx], 0
pop ebx
ret
push esi
push edi
call fcn.00529070
push eax
push str.Send_failure:__s
push dword [edi]
call fcn.00504840
mov eax, dword [edi]
add esp, 0x14
mov ecx, dword [esp + 0x24]
pop edi
mov dword [eax + 0x8e4], esi
mov eax, 0x37
pop esi
pop ebp
mov dword [ecx], ebx
pop ebx
ret
mov ecx, dword [esp + 0x24]
xor eax, eax
pop edi
pop esi
pop ebp
mov dword [ecx], ebx
pop ebx
ret