joyce8/EMBER2024-capa huggingface dataset:
Function at 0x481f70
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
je 0x482025
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x482025
lea eax, [ebp + 8]
push eax
push 0x51505c
push 1
push 0
push 0x51507c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x482025
mov eax, dword [ebp + 8]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, dword [ebp + 8]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x44]
mov edx, dword [ebp + 0x18]
test dx, dx
je 0x481fd3
mov eax, dword [ebp + 8]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [ebp + 8]
lea edx, [ebp - 4]
push edx
push 0x51506c
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
js 0x482025
mov eax, dword [ebp - 4]
push 2
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov ecx, dword [ebp - 4]
mov esi, eax
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
push 0
push edi
push 0x1005
push 2
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
xor eax, eax
test esi, esi
pop edi
sete al
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4820f0
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
je 0x4821d8
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x4821d8
lea eax, [ebp + 8]
push eax
push 0x51505c
push 1
push 0
push 0x51507c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x4821d8
mov eax, dword [ebp + 8]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, dword [ebp + 8]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x44]
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x482156
mov eax, dword [ebp + 8]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov edx, dword [ebp + 0x20]
test edx, edx
je 0x482167
mov eax, dword [ebp + 8]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov al, byte [ebp + 0x1c]
test al, al
je 0x482186
mov ecx, dword [ebp + 8]
mov esi, 0x300
movzx eax, al
or ax, si
movzx eax, ax
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x34]
mov eax, dword [ebp + 8]
lea edx, [ebp - 4]
push edx
push 0x51506c
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
js 0x4821d8
mov eax, dword [ebp - 4]
push 2
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov ecx, dword [ebp - 4]
mov esi, eax
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
push 0
push edi
push 0x1005
push 2
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
xor eax, eax
test esi, esi
pop edi
sete al
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4821e0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x4821f5
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
xorps xmm0, xmm0
mov dword [ebp - 8], 0
mov eax, 0x14
movq qword [ebp - 0x10], xmm0
movdqu xmmword [ebp - 0x20], xmm0
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x20]
push eax
mov word [ebp - 4], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 3
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], 0
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
jne 0x4821ee
push eax
push esi
push 0x1005
push 4
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x482260
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 8], 0
jne 0x482272
xor al, al
mov esp, ebp
pop ebp
ret
push ebx
lea eax, [ebp - 8]
xor bl, bl
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
js 0x4822c4
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x4822bb
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push dword [ebp - 4]
test eax, eax
movzx ebx, bl
mov eax, dword [ebp - 8]
mov ecx, 1
cmovne ebx, ecx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x482b90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 8
push ebx
push esi
test eax, eax
je 0x482c25
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x482c25
mov ebx, dword [ebp + 0x14]
test ebx, ebx
je 0x482c25
mov esi, dword [ebp + 0x18]
test esi, esi
je 0x482c25
cmp esi, 0xffffffff
je 0x482c25
push edi
lea edx, [ebp + 8]
mov dword [ebp + 8], 0
push edx
push 0x20019
push 0
push ecx
push eax
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x482c17
lea eax, [esi + esi]
push eax
push edi
push ebx
mov dword [ebp - 4], eax
call fcn.0046f380
add esp, 0xc
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 8]
push eax
push edi
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 8]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test edi, edi
pop edi
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x482c30
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
je 0x482cb3
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x482cb3
cmp dword [ebp + 0x14], 0
je 0x482cb3
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
push 0xf003f
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x482c86
push 0
lea eax, [ebp + 8]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x482cb3
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x1c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
pop edi
sete al
pop esi
pop ebp
ret
pop edi
xor al, al
pop esi
pop ebp
ret

Function at 0x482cc0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x482d11
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x482d11
lea edx, [ebp + 8]
mov dword [ebp + 8], 0
push edx
push 0xf003f
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x482d11
push esi
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp + 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
pop esi
sete al
pop ebp
ret
xor al, al
pop ebp
ret

Function at 0x483040
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x483055
xor al, al
pop edi
mov esp, ebp
pop ebp
ret
push ebx
lea eax, [ebp - 4]
mov byte [ebp + 0xb], 0
push eax
push edi
mov dword [ebp - 4], 0
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
jne 0x483079
pop ebx
xor al, al
pop edi
mov esp, ebp
pop ebp
ret
push esi
push ebx
call fcn.00464009
push ebx
mov esi, eax
push 0
push esi
call fcn.0046f380
add esp, 0x10
push esi
push ebx
push dword [ebp - 4]
push edi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x483108
push 0
push edi
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov edi, eax
test edi, edi
je 0x483108
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push str.VarFileInfoTranslation
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4830ff
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 0
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 0
push eax
push 0x5379fc
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4830ff
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov byte [ebp + 0xb], 1
mov ecx, dword [edx + 8]
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [edx + 0xc]
mov dword [eax], ecx
push 1
push edi
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
test esi, esi
je 0x483115
push esi
call fcn.00463d2b
add esp, 4
mov al, byte [ebp + 0xb]
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x483120
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3830
call fcn.00476ea0
mov eax, dword [0x548280]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x3830], eax
push esi
mov esi, dword [ebp + 0x10]
push edi
test ebx, ebx
je 0x4832ce
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x4832ce
test esi, esi
je 0x4832ce
test eax, eax
je 0x4832ce
push 0
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x4832ce
mov ecx, 0x19000
cmp eax, ecx
cmova eax, ecx
lea ecx, [ebp - 0x2804]
push ecx
push eax
push 0
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4832ce
lea eax, [ebp - 0x382c]
mov dword [ebp - 0x3828], 0
push eax
lea eax, [ebp - 0x3828]
mov dword [ebp - 0x382c], 0
push eax
push str.VarFileInfoTranslation
lea eax, [ebp - 0x2804]
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4832ce
mov ecx, dword [ebp - 0x3828]
lea eax, [ebp - 0x300c]
mov dword [ebp - 0x3010], eax
xor eax, eax
mov word [ebp - 0x300c], ax
mov dword [ebp - 0x2808], 0
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
lea eax, [ebp - 0x3010]
push str._04x_04x
push eax
call fcn.00445f30
push dword [ebp - 0x3830]
lea eax, [ebp - 0x3818]
mov dword [ebp - 0x3014], 0
mov dword [ebp - 0x381c], eax
xor eax, eax
mov word [ebp - 0x3818], ax
lea eax, [ebp - 0x300c]
push eax
lea eax, [ebp - 0x381c]
push str.StringFileInfo_s_s
push eax
call fcn.00445f30
add esp, 0x20
mov dword [ebp - 0x3824], 0
lea eax, [ebp - 0x3820]
mov dword [ebp - 0x3820], 0xff
push eax
lea eax, [ebp - 0x3824]
push eax
lea eax, [ebp - 0x3818]
push eax
lea eax, [ebp - 0x2804]
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4832ce
mov esi, dword [ebp - 0x3820]
cmp esi, edi
push edi
cmova esi, edi
push 0
push ebx
mov dword [ebp - 0x3820], esi
call fcn.0046f380
push esi
push dword [ebp - 0x3824]
push ebx
call fcn.00463af4
add esp, 0x18
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004632a9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004632a9
mov esp, ebp
pop ebp
ret
Function at 0x483da0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2a44
call fcn.00476ea0
mov eax, dword [0x548280]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
test esi, esi
je 0x483fe7
push 0x800
push eax
mov word [ebp - 0x808], ax
lea eax, [ebp - 0x806]
push eax
call fcn.0046f380
lea ecx, [ebp - 0x808]
add esp, 0xc
sub ecx, esi
lea esp, [esp]
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x483df0
push edi
lea eax, [ebp - 0x808]
push 0xffffffffffffffff
push eax
call fcn.0047d830
add esp, 8
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x483fe6
push ebx
push 0x800
xor ebx, ebx
mov word [ebp - 0x100c], ax
lea eax, [ebp - 0x100a]
push ebx
push eax
call fcn.0046f380
xor eax, eax
push 0x800
push eax
mov word [ebp - 0x1810], ax
lea eax, [ebp - 0x180e]
push eax
call fcn.0046f380
xor eax, eax
push 0x800
push eax
mov word [ebp - 0x2014], ax
lea eax, [ebp - 0x2012]
push eax
call fcn.0046f380
add esp, 0x24
mov dword [ebp - 0x2a44], 0x22c
lea eax, [ebp - 0x2a44]
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x483fdc
mov esi, dword [ebp + 0xc]
nop
xor eax, eax
movzx ecx, word [ebp + eax - 0x2a20]
lea eax, [eax + 2]
mov word [ebp + eax - 0x100e], cx
test cx, cx
jne 0x483ea2
lea eax, [ebp - 0x100c]
push 0xffffffffffffffff
push eax
call fcn.0047d830
add esp, 8
lea ecx, [ebp - 0x100c]
lea eax, [ebp - 0x808]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x483efd
test dx, dx
je 0x483ef9
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x483efd
add eax, 4
add ecx, 4
test dx, dx
jne 0x483ed7
xor eax, eax
jmp 0x483f02
sbb eax, eax
or eax, 1
test eax, eax
jne 0x483fbf
test esi, esi
je 0x483fd6
push dword [ebp - 0x2a3c]
lea eax, [ebp - 0x1810]
push 0x401
push eax
call fcn.00483b90
add esp, 0xc
test al, al
je 0x483fd6
push dword [ebp + 0x10]
lea eax, [ebp - 0x2014]
push eax
lea eax, [ebp - 0x1810]
push eax
call fcn.00484b40
add esp, 0xc
test al, al
je 0x483fbf
xor eax, eax
push 0x800
push eax
mov word [ebp - 0x2818], ax
lea eax, [ebp - 0x2816]
push eax
call fcn.0046f380
lea eax, [ebp - 0x2818]
push eax
lea eax, [ebp - 0x2014]
push eax
call fcn.00484730
add esp, 0x14
test al, al
je 0x483fbf
lea ecx, [ebp - 0x2818]
mov eax, esi
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x483fb6
test dx, dx
je 0x483fb2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x483fb6
add eax, 4
add ecx, 4
test dx, dx
jne 0x483f90
xor eax, eax
jmp 0x483fbb
sbb eax, eax
or eax, 1
test eax, eax
je 0x483fd6
lea eax, [ebp - 0x2a44]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x483ea0
jmp 0x483fdc
mov ebx, dword [ebp - 0x2a3c]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004632a9
mov esp, ebp
pop ebp
ret
Function at 0x486280
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x548280]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
push edi
mov eax, 2
mov edi, ecx
movdqu xmmword [ebp - 0x14], xmm0
push esi
mov word [ebp - 0x14], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x10], eax
cmp eax, 0xffffffff
jne 0x4862cc
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x4862f8
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
mov ecx, edi
push 0x10
lea eax, [ebp - 0x14]
push eax
call fcn.00486310
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004632a9
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop esi
call fcn.004632a9
mov esp, ebp
pop ebp
ret 8

Function at 0x486470
Capabilities:
Connect socket
Get socket status
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x548280]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
cmp dword [esi + 8], 0
jbe 0x48654a
lea eax, [ebp - 0x110]
mov dword [ebp - 0x110], 1
push eax
push 0x8004667e
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
je 0x486536
push dword [ebp + 0xc]
push edi
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_connect]
mov eax, dword [esi + 4]
mov dword [ebp - 0x104], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x118], eax
lea eax, [ebp - 0x118]
push eax
push 0
lea eax, [ebp - 0x108]
mov dword [ebp - 0x108], 1
push eax
push 0
push 0
mov dword [ebp - 0x114], 0
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jle 0x48652d
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x10c], 0
push eax
push 0x8004667e
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x48655c
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004632a9
mov esp, ebp
pop ebp
ret 8
push dword [ebp + 0xc]
push edi
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x486536
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.004632a9
mov esp, ebp
pop ebp
ret 8
Function at 0x487290
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 0x414]
test eax, eax
je 0x4872b0
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call fcn.00489ae0
add esp, 0xc
pop ebp
ret 0xc
pop ebp
jmp method.XSocket.virtual_8

Function at 0x487300
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 0x414]
test eax, eax
je 0x487320
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call fcn.00489c60
add esp, 0xc
pop ebp
ret 0xc
pop ebp
jmp method.XSocket.virtual_12

Function at 0x487f90
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [ecx + 4]
test eax, eax
jne 0x487f9a
xor al, al
ret
add ecx, 0x10
cmp dword [ecx], 0
jbe 0x487fbd
push 4
push ecx
push 0x1006
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
setne al
ret
mov al, 1
ret

Function at 0x487fc0
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [ecx + 4]
test eax, eax
jne 0x487fca
xor al, al
ret
add ecx, 0xc
cmp dword [ecx], 0
jbe 0x487fed
push 4
push ecx
push 0x1005
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
setne al
ret
mov al, 1
ret
Function at 0x49f460
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa8
call fcn.00476ea0
mov eax, dword [0x548280]
xor eax, esp
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0xac]
push ebx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0xb4]
push ebp
push esi
mov esi, dword [esp + 0xc4]
xor ebp, ebp
mov eax, dword [eax + 4]
push edi
mov edi, dword [esp + 0xc4]
mov dword [esp + 0x14], eax
sub eax, edi
mov dword [esp + 0x10], eax
cmp esi, edi
jae 0x49f4c6
push str.orig_len___md_size
push 0xf2
push str.._ssl_s3_cbc.c
call fcn.004ae090
add esp, 0xc
cmp edi, 0x40
jbe 0x49f4e2
push str.md_size___EVP_MAX_MD_SIZE
push 0xf3
push str.._ssl_s3_cbc.c
call fcn.004ae090
add esp, 0xc
lea eax, [esp + 0x34]
neg eax
lea ebx, [esp + 0x34]
and eax, 0x3f
add ebx, eax
lea eax, [edi + 0x100]
mov dword [esp + 0x1c], ebx
cmp esi, eax
jbe 0x49f509
mov ebp, esi
sub ebp, edi
sub ebp, 0x100
mov eax, edi
xor edx, edx
and eax, 0xfffffffe
shl eax, 0x17
sub eax, ebp
add eax, dword [esp + 0x10]
div edi
push edi
mov esi, edx
push 0
push ebx
mov dword [esp + 0x30], esi
call fcn.0046f380
add esp, 0xc
mov dword [esp + 0x18], 0
cmp ebp, dword [esp + 0xc8]
jae 0x49f5ff
mov ecx, dword [esp + 0x10]
mov edx, ecx
mov ebx, dword [esp + 0x14]
mov esi, ebx
mov eax, dword [esp + 0xc0]
sub esi, ecx
shr edx, 0x1f
mov dword [esp + 0x28], edx
mov edx, ebx
shr edx, 0x1f
mov eax, dword [eax + 0xc]
mov dword [esp + 0x14], edx
mov edx, ebp
sub edx, ebx
mov dword [esp + 0x20], esi
mov esi, dword [esp + 0x1c]
add eax, ebx
mov dword [esp + 0x10], edx
mov dword [esp + 0x30], eax
mov ebx, dword [esp + 0x20]
mov ecx, ebp
mov eax, dword [esp + 0x28]
inc ebp
shr ecx, 0x1f
lea ebx, [ebx + edx]
shr edx, 0x1f
xor dl, byte [esp + 0x14]
shr ebx, 0x1f
xor bl, al
xor al, cl
or bl, al
mov al, cl
xor al, byte [esp + 0x14]
xor bl, cl
or dl, al
dec bl
mov eax, dword [esp + 0x10]
xor dl, cl
mov ecx, dword [esp + 0x30]
dec dl
not dl
mov al, byte [ecx + eax]
mov ecx, dword [esp + 0x18]
and dl, al
and dl, bl
or byte [ecx + esi], dl
mov edx, ecx
inc edx
mov ecx, edx
mov eax, edx
sub ecx, edi
xor eax, edi
xor ecx, edi
or ecx, eax
xor ecx, edx
shr ecx, 0x1f
neg ecx
and edx, ecx
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x10]
inc edx
mov dword [esp + 0x10], edx
cmp ebp, dword [esp + 0xc8]
jb 0x49f580
mov esi, dword [esp + 0x24]
mov ebx, dword [esp + 0x1c]
xor edx, edx
test edi, edi
je 0x49f63a
mov ebp, dword [esp + 0x2c]
lea esp, [esp]
mov eax, esi
xor eax, 0x20
mov al, byte [eax + ebx]
movzx eax, byte [esi + ebx]
inc esi
mov byte [edx + ebp], al
mov ecx, esi
sub ecx, edi
mov eax, esi
xor ecx, edi
xor eax, edi
or ecx, eax
inc edx
xor ecx, esi
shr ecx, 0x1f
neg ecx
and esi, ecx
cmp edx, edi
jb 0x49f610
mov ecx, dword [esp + 0xb4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004632a9
add esp, 0xa8
ret
Function at 0x4a0020
Capabilities:
Encode data using xor

Disassembly:
mov eax, 8
call fcn.00476ea0
push ebx
mov ebx, dword [esp + 0x1c]
push esi
push edi
mov edi, dword [esp + 0x18]
inc ebx
mov eax, dword [edi]
cmp eax, 0xfeff
je 0x4a0058
cmp eax, 0x100
je 0x4a0058
mov esi, dword [esp + 0x1c]
cmp ebx, dword [esi + 4]
jbe 0x4a0075
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
mov ecx, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
lea eax, [ebx + ecx]
mov edx, dword [esi + 4]
cmp eax, edx
ja 0x4a004f
add dword [esi + 0xc], ecx
add dword [esi + 0x10], ecx
sub edx, ecx
mov dword [esi + 4], edx
test dword [edi + 0xf4], 0x200
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 4]
movzx edx, byte [ecx + eax - 1]
mov dword [esp + 0x18], edx
je 0x4a00c1
cmp dword [edi + 0x84], 0
jne 0x4a00c1
mov eax, dword [edi + 0x58]
cmp dword [eax + 8], 0
jne 0x4a00b0
cmp dword [eax + 0xc], 0
jne 0x4a00b0
test dl, 1
jne 0x4a00b0
or dword [eax], 8
mov eax, dword [edi + 0x58]
test byte [eax], 8
je 0x4a00c1
test edx, edx
je 0x4a00c1
dec edx
mov dword [esp + 0x18], edx
lea ecx, [edx + ebx]
push ebp
mov ebp, dword [esi + 4]
mov edi, ebp
sub edi, ecx
mov dword [esp + 0x14], ebp
xor edi, ecx
mov eax, ebp
xor eax, ecx
mov ecx, 0xff
or edi, eax
lea eax, [ebp - 1]
xor edi, ebp
shr edi, 0x1f
dec edi
cmp eax, ecx
cmovb ecx, eax
xor ebx, ebx
mov dword [esp + 0x10], ecx
test ecx, ecx
je 0x4a0143
mov ecx, edx
dec ebp
shr ecx, 0x1f
add ebp, dword [esi + 0xc]
mov esi, dword [esp + 0x10]
mov dword [esp + 0x28], ecx
mov al, byte [esp + 0x28]
lea ebp, [ebp - 1]
sub edx, ebx
mov ecx, ebx
shr ecx, 0x1f
inc ebx
shr edx, 0x1f
xor al, cl
xor dl, cl
or dl, al
movzx eax, byte [ebp + 1]
xor dl, byte [esp + 0x28]
dec dl
movzx ecx, dl
mov edx, dword [esp + 0x1c]
xor eax, edx
and ecx, eax
not ecx
and edi, ecx
cmp ebx, esi
jb 0x4a0106
mov esi, dword [esp + 0x20]
mov ebp, dword [esp + 0x14]
not edi
lea eax, [edx + 1]
and edi, 0xff
lea ecx, [edi - 1]
not edi
shr ecx, 0x1f
shr edi, 0x1f
and ecx, edi
neg ecx
and eax, ecx
sub ebp, eax
shl eax, 8
or dword [esi], eax
mov eax, ecx
mov dword [esi + 4], ebp
and eax, 1
pop ebp
pop edi
not ecx
pop esi
or eax, ecx
pop ebx
add esp, 8
ret
Function at 0x4a27d0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 0x18]
mov eax, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
and ecx, 1
push edi
push dword [esp + 0x34]
mov edi, dword [esp + 0x24]
push dword [esp + 0x30]
cdq
sub eax, edx
mov edx, dword [esp + 0x2c]
mov ebp, eax
sar ebp, 1
push edi
push esi
lea ebx, [edx + ebp]
add ebp, ecx
push ebp
push edx
push dword [esp + 0x2c]
call fcn.004a28d0
push dword [esp + 0x50]
push dword [esp + 0x50]
push edi
push esi
push ebp
push ebx
push dword [esp + 0x4c]
call fcn.004a28d0
mov edx, dword [esp + 0x6c]
add esp, 0x38
xor esi, esi
test edx, edx
jle 0x4a28c0
mov ebx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
cmp edx, 0x20
jb 0x4a28a1
lea eax, [ecx - 1]
lea edi, [ebx - 1]
add eax, edx
add edi, edx
cmp ebx, eax
ja 0x4a284f
cmp edi, ecx
jae 0x4a28a1
mov eax, edx
and eax, 0x8000001f
jns 0x4a285d
dec eax
or eax, 0xffffffe0
inc eax
mov edi, edx
mov ebp, ecx
sub edi, eax
mov eax, ebx
sub ebp, ebx
jmp 0x4a2870
movdqu xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movdqu xmm1, xmmword [eax + ebp - 0x20]
pxor xmm1, xmm0
movdqu xmmword [eax - 0x20], xmm1
movdqu xmm1, xmmword [ecx + esi + 0x10]
add esi, 0x20
movdqu xmm0, xmmword [eax - 0x10]
pxor xmm1, xmm0
movdqu xmmword [eax - 0x10], xmm1
cmp esi, edi
jl 0x4a2870
cmp esi, edx
jge 0x4a28c0
sub ecx, ebx
lea eax, [esi + ebx]
mov dword [esp + 0x30], ecx
sub edx, esi
mov cl, byte [eax + ecx]
lea eax, [eax + 1]
xor byte [eax - 1], cl
mov ecx, dword [esp + 0x30]
dec edx
jne 0x4a28b0
pop edi
pop esi
pop ebp
pop ebx
ret