joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5004f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xcc
push ebx
push esi
mov esi, dword [esp + 0xd8]
push 0x1c
lea eax, [esp + 0xa0]
push esi
push eax
mov ebx, ecx
call fcn.00505840
mov ecx, dword [esp + 0xe8]
push 0x1c
add esi, ecx
lea edx, [esp + 0xc8]
push esi
push edx
call fcn.00505840
push 7
lea eax, [esp + 0xb8]
push 0x4625e8
push eax
call fcn.00505630
add esp, 0x24
cmp eax, 1
jne 0x500553
pop esi
xor al, al
pop ebx
add esp, 0xcc
ret 8
push 7
lea ecx, [esp + 0xbc]
push 0x4625e8
push ecx
call fcn.00505630
add esp, 0xc
cmp eax, 1
je 0x500546
push ebp
push edi
push 7
push 7
lea edx, [esp + 0xac]
push edx
push ebx
call fcn.00505bf0
push 7
push 7
lea eax, [esp + 0xd8]
push eax
lea ebp, [ebx + 0x20]
push ebp
call fcn.00505bf0
mov ecx, 7
mov esi, ebx
lea edi, [esp + 0x70]
push 7
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ebx
push ecx
call fcn.00505ae0
push 0x4625e8
push 7
push ebx
mov eax, 0xe
lea esi, [esp + 0xa4]
call fcn.004ff5f0
push 7
lea edx, [esp + 0x8c]
push edx
lea eax, [esp + 0xac]
push ebx
push eax
call fcn.005059c0
add esp, 0x48
push 0x4625e8
push 7
push ebx
mov eax, 0xe
lea esi, [esp + 0x78]
call fcn.004ff5f0
push 7
lea ecx, [esp + 0x60]
push 0x4625e8
push ecx
call fcn.005056f0
mov edi, 1
push edi
push 7
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x58]
push eax
mov dword [esp + 0x38], 3
call fcn.00505bf0
push 7
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x64]
push edx
lea eax, [esp + 0xa0]
push eax
call fcn.005059c0
push 0x4625e8
lea ecx, [esp + 0x70]
push 7
push ecx
lea eax, [edi + 0xd]
lea esi, [esp + 0xb0]
call fcn.004ff5f0
add esp, 0x44
push 7
lea edx, [esp + 0x38]
push edx
push ebx
mov dword [esp + 0x3c], 0
call fcn.00505740
add esp, 0xc
test al, al
je 0x500686
add dword [esp + 0x30], edi
push 7
push 0x4625cc
push ebx
call fcn.00505740
add esp, 0xc
test al, al
je 0x50069e
add dword [esp + 0x30], edi
cmp dword [esp + 0x30], 0
je 0x500700
mov ecx, 7
mov esi, ebx
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x30]
jmp 0x5006c0
push 7
lea eax, [esp + 0x18]
push 0x4625e8
push eax
call fcn.005056a0
add esp, 0xc
test al, al
jne 0x5006d9
dec esi
test esi, esi
jne 0x5006c0
push 7
lea ecx, [esp + 0x18]
push 0x4625e8
push ecx
call fcn.00505790
push 0x1c
lea edx, [esp + 0x24]
push edx
push ebx
call fcn.00526df0
add esp, 0x18
jmp 0x500710
push 7
push 0x4625e8
push ebx
call fcn.00505790
add esp, 0xc
push 7
lea eax, [esp + 0x70]
push ebp
push eax
call fcn.00505ae0
push 0x4625e8
push 7
push ebp
mov eax, 0xe
lea esi, [esp + 0x84]
call fcn.004ff5f0
push 7
push ebp
push ebx
call fcn.00505630
add esp, 0x24
pop edi
pop ebp
cmp eax, 3
pop esi
sete al
pop ebx
add esp, 0xcc
ret 8

Function at 0x501da0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi]
test ecx, ecx
je 0x501dcf
push ebx
push edi
movzx edi, byte [edx]
movzx ebx, al
xor edi, ebx
shr eax, 8
xor eax, dword [edi*4 + 0x462768]
dec ecx
inc edx
test ecx, ecx
jne 0x501db5
pop edi
pop ebx
mov dword [esi], eax
pop esi
ret 0xc
Function at 0x503b60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x54a0b0
mov eax, dword fs:[0]
push eax
sub esp, 0x50
push ebx
push ebp
push esi
push edi
mov eax, dword [0x463df0]
xor eax, esp
push eax
lea eax, [esp + 0x64]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [edi + 0x18]
mov eax, dword [ecx + 4]
xor ebx, ebx
mov dword [esp + 0x14], ecx
cmp byte [eax + 0x31], bl
jne 0x503bb7
mov edx, dword [esp + 0x74]
mov edx, dword [edx]
cmp edx, dword [eax + 0xc]
jge 0x503baa
mov eax, dword [eax + 8]
jmp 0x503bae
mov ecx, eax
mov eax, dword [eax]
cmp byte [eax + 0x31], bl
je 0x503ba0
mov dword [esp + 0x14], ecx
mov esi, dword [edi]
mov eax, dword [edi + 0x18]
mov ebp, ecx
mov dword [esp + 0x1c], eax
cmp esi, ebx
je 0x503bca
cmp esi, esi
je 0x503bd3
call fcn.00526bf6
mov ecx, dword [esp + 0x14]
cmp ecx, dword [esp + 0x1c]
je 0x503be8
mov ecx, dword [ecx + 0xc]
mov edx, dword [esp + 0x74]
cmp ecx, dword [edx]
jge 0x503cb4
mov eax, 0xf
mov dword [esp + 0x3c], eax
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
mov dword [esp + 0x20], 0x469080
mov ecx, dword [esp + 0x74]
mov edx, dword [ecx]
push 0xffffffffffffffff
mov dword [esp + 0x64], eax
push ebx
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x54]
mov dword [esp + 0x78], ebx
mov dword [esp + 0x4c], edx
mov dword [esp + 0x68], ebx
mov byte [esp + 0x58], bl
call fcn.004787f0
mov dword [esp + 0x44], 0x469080
lea ecx, [esp + 0x40]
push ecx
push ebp
push esi
lea edx, [esp + 0x24]
push edx
mov ecx, edi
mov byte [esp + 0x7c], 1
call fcn.00503990
mov esi, dword [eax]
mov ebp, dword [eax + 4]
mov edi, 0x10
mov dword [esp + 0x44], 0x469080
cmp dword [esp + 0x60], edi
jb 0x503c71
mov eax, dword [esp + 0x4c]
push eax
call fcn.005265f5
add esp, 4
mov dword [esp + 0x60], 0xf
mov dword [esp + 0x5c], ebx
mov byte [esp + 0x4c], bl
mov dword [esp + 0x6c], 0xffffffff
mov dword [esp + 0x20], 0x469080
cmp dword [esp + 0x3c], edi
jb 0x503ca4
mov ecx, dword [esp + 0x28]
push ecx
call fcn.005265f5
add esp, 4
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
cmp esi, ebx
jne 0x503ce2
call fcn.00526bf6
xor esi, esi
cmp ebp, dword [esi + 0x18]
jne 0x503cc9
call fcn.00526bf6
lea eax, [ebp + 0x10]
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5c
ret 4
mov esi, dword [esi]
jmp 0x503cbf
Function at 0x5074c0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push ebp
push esi
mov ebp, ecx
push edi
mov edi, dword [ebp + 0x10]
cmp edi, dword [ebp + 0x14]
jbe 0x5074d3
call fcn.00526bf6
mov esi, dword [ebp + 4]
mov ebx, dword [ebp + 0x14]
cmp dword [ebp + 0x10], ebx
jbe 0x5074e3
call fcn.00526bf6
mov eax, dword [ebp + 4]
test esi, esi
je 0x5074ee
cmp esi, eax
je 0x5074f3
call fcn.00526bf6
cmp edi, ebx
je 0x507547
test esi, esi
jne 0x50752d
call fcn.00526bf6
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x50750c
call fcn.00526bf6
mov eax, dword [edi]
cmp byte [eax], 0xcc
je 0x507535
test esi, esi
jne 0x507531
call fcn.00526bf6
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x507528
call fcn.00526bf6
add edi, 4
jmp 0x5074d6
mov eax, dword [esi]
jmp 0x507502
mov eax, dword [esi]
jmp 0x50751e
call fcn.004784f0
pop edi
pop esi
pop ebp
mov dword [eax], 0xb
mov al, 1
pop ebx
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret

Function at 0x508690
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x54a408
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x463df0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x2c]
mov edi, dword [esp + 0x30]
mov ebx, dword [esp + 0x34]
lea esi, [edi + edi + 2]
cmp esi, ebx
mov dword [esp + 0x24], 0
mov dword [esp + 0x14], edi
jge 0x50877e
lea eax, [esi - 1]
shl eax, 5
add eax, ebp
je 0x5086f0
mov ecx, esi
shl ecx, 5
lea eax, [ecx + ebp - 0x1c]
jmp 0x5086f2
xor eax, eax
mov edx, esi
shl edx, 5
lea ecx, [edx + ebp]
test ecx, ecx
je 0x508703
add ecx, 4
jmp 0x508705
xor ecx, ecx
cmp dword [eax + 0x18], 0x10
mov ebx, dword [eax + 0x14]
jb 0x508713
mov eax, dword [eax + 4]
jmp 0x508716
add eax, 4
mov edi, dword [ecx + 0x14]
mov edx, edi
cmp edi, ebx
jb 0x508721
mov edx, ebx
cmp dword [ecx + 0x18], 0x10
jb 0x50872c
mov ecx, dword [ecx + 4]
jmp 0x50872f
add ecx, 4
push edx
push eax
push ecx
call fcn.00481b70
add esp, 0xc
test eax, eax
jne 0x508749
cmp edi, ebx
jb 0x50874b
cmp edi, ebx
setne al
test eax, eax
jge 0x50874c
dec esi
mov ecx, dword [esp + 0x30]
mov eax, esi
shl eax, 5
add eax, ebp
shl ecx, 5
push eax
add ecx, ebp
call fcn.004b5e20
mov dword [esp + 0x30], esi
lea esi, [esi + esi + 2]
cmp esi, dword [esp + 0x34]
jl 0x5086db
mov ebx, dword [esp + 0x34]
mov edi, dword [esp + 0x30]
cmp esi, ebx
jne 0x50879d
mov ecx, ebx
shl ecx, 5
lea edx, [ecx + ebp - 0x20]
mov ecx, edi
shl ecx, 5
push edx
add ecx, ebp
call fcn.004b5e20
dec ebx
mov dword [esp + 0x30], ebx
mov edi, ebx
sub esp, 0x20
mov esi, esp
mov dword [esp + 0x38], esp
push 0xffffffffffffffff
lea ecx, [esi + 4]
push 0
lea eax, [esp + 0x64]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], 0
push eax
mov byte [ecx + 4], 0
call fcn.004787f0
mov ecx, dword [esp + 0x34]
push ecx
push edi
push ebp
mov dword [esi], 0x469080
call fcn.00507d20
add esp, 0x2c
cmp dword [esp + 0x54], 0x10
mov dword [esp + 0x38], 0x469080
jb 0x5087fa
mov edx, dword [esp + 0x40]
push edx
call fcn.005265f5
add esp, 4
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x5101d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x54ab38
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push esi
push edi
mov eax, dword [0x463df0]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov edx, ecx
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
sub esp, 0x3c
mov edi, esp
mov dword [esp + 0x8c], eax
mov eax, dword [esp + 0x94]
mov ecx, 0xf
lea esi, [esp + 0x48]
rep movsd dword es:[edi], dword [esi]
push eax
mov ecx, edx
call fcn.005100d0
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x48
ret 4
Function at 0x51aaf0
Capabilities:
Check os version

Disassembly:
sub esp, 0x24
push edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor edi, edi
mov dword [0x59f4c8], edi
mov dword [0x59f4c4], edi
mov dword [0x59f4c0], edi
mov dword [0x59f4bc], edi
test eax, eax
jns 0x51aa6a
cmp al, 4
jae 0x51aa5b
mov dword [0x59f4c4], 1
pop edi
add esp, 0x24
ret
mov dword [0x59f4c8], 1
pop edi
add esp, 0x24
ret
xor eax, eax
push esi
mov dword [esp + 8], eax
push 0x46d668
mov dword [0x59f4c0], 1
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov word [esp + 0xc], ax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
cmp esi, edi
je 0x51aacf
push 0x46d654
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x51aac8
lea ecx, [esp + 8]
push ecx
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ax, word [esp + 8]
pop esi
cmp ax, 6
je 0x51aae1
cmp ax, 9
jne 0x51aaeb
mov dword [0x59f4bc], 1
pop edi
add esp, 0x24
ret
jmp 0x51aa20

Function at 0x51d610
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
xor eax, eax
test edx, edx
je 0x51d658
push esi
mov esi, dword [esp + 8]
push edi
movzx ecx, byte [esi]
mov edi, ecx
xor edi, eax
shr eax, 4
and eax, 0xfff
and edi, 0xf
xor eax, dword [edi*4 + 0x463988]
shr ecx, 4
xor ecx, eax
shr eax, 4
and ecx, 0xf
and eax, 0xfff
xor eax, dword [ecx*4 + 0x463988]
dec edx
inc esi
test edx, edx
jne 0x51d620
pop edi
pop esi
ret 8

Function at 0x51f3f0
Capabilities:
Identify system language via api

Disassembly:
sub esp, 0x18
mov eax, dword [0x463df0]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersion]
call esi
test eax, eax
jns 0x51f4a3
call esi
cmp al, 4
jae 0x51f4a3
push edi
push 0x14
lea eax, [esp + 0xc]
push eax
push 0x4651d5
push 0x46f764
push 0x46f75c
call dword [sym.imp.KERNEL32.dll_GetProfileStringA]
xor edi, edi
mov esi, 0x463a30
lea ecx, [ecx]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x51f445
sub eax, edx
push eax
lea ecx, [esp + 0xc]
push ecx
push esi
call fcn.0052b2e5
add esp, 0xc
test eax, eax
je 0x51f485
inc edi
add esi, 8
cmp edi, 0x10
jb 0x51f440
pop edi
mov dword [0x59e67c], 0x809
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.00526a8a
add esp, 0x18
ret
mov edx, dword [edi*8 + 0x463a34]
pop edi
mov dword [0x59e67c], edx
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.00526a8a
add esp, 0x18
ret
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
cmp ecx, 4
jne 0x51f4f7
shr eax, 0xa
mov ecx, eax
sub ecx, 3
je 0x51f4cd
sub ecx, 1
je 0x51f4f0
sub ecx, 1
jne 0x51f4d2
mov eax, 1
movzx eax, ax
shl eax, 0xa
or eax, 4
mov dword [0x59e67c], eax
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.00526a8a
add esp, 0x18
ret
mov eax, 2
jmp 0x51f4d2
movzx ecx, cx
or ecx, 0x800
mov dword [0x59e67c], ecx
mov ecx, dword [esp + 0x18]
pop esi
xor ecx, esp
call fcn.00526a8a
add esp, 0x18
ret
Function at 0x520d70
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
add eax, esi
movzx eax, ax
test edx, edx
jbe 0x520da6
mov edi, edi
xor byte [ecx], al
mov si, ax
shr si, 0xf
add eax, eax
add si, ax
movzx eax, si
mov si, ax
add eax, eax
shr si, 0xf
add si, ax
inc ecx
sub edx, 1
movzx eax, si
jne 0x520d80
pop esi
ret 4

Function at 0x520f60
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x48
mov eax, dword [0x463df0]
xor eax, esp
mov dword [esp + 0x44], eax
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_LockFile]
push esi
push edi
xor edi, edi
mov esi, ecx
mov dword [esp + 0x10], 0x19
xor ebx, ebx
cmp ebx, 6
jge 0x5210aa
mov eax, dword [esi + 0x20]
push 0
push 0x24
push 0
push 0x3c
push eax
call ebp
mov edi, eax
test edi, edi
jne 0x520fb9
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [esp + 0x10]
lea eax, [edx + edx]
mov dword [esp + 0x10], eax
inc ebx
test edi, edi
je 0x520f86
push 0x40
lea ecx, [esp + 0x18]
push 0
push ecx
mov dword [esi + 0x24], 1
call fcn.00526600
add esp, 0xc
lea edx, [esp + 0x30]
mov edi, 0x24
push edx
lea eax, [edi + 0x18]
call fcn.00520e10
test eax, eax
je 0x521076
lea eax, [esp + 0x36]
lea ecx, [esi + 0x76]
mov edi, 8
lea esp, [esp]
movzx edx, byte [ecx - 2]
add byte [eax - 2], dl
movzx edx, byte [ecx - 1]
add byte [eax - 1], dl
movzx edx, byte [ecx]
add byte [eax], dl
movzx edx, byte [ecx + 1]
add byte [eax + 1], dl
add eax, 4
add ecx, 4
sub edi, 1
jne 0x521000
mov edx, dword [esp + 0x32]
mov eax, dword [esp + 0x30]
add eax, edx
lea ecx, [esp + 0x34]
movzx eax, ax
lea edx, [edi + 0x20]
lea esp, [esp]
xor byte [ecx], al
mov di, ax
shr di, 0xf
add eax, eax
add di, ax
movzx eax, di
mov di, ax
add eax, eax
shr di, 0xf
add di, ax
inc ecx
sub edx, 1
movzx eax, di
jne 0x521040
cmp dword [esp + 0x50], edx
je 0x5210d1
mov dword [0x463b34], 0x65
cmp dword [esi + 0x24], 0
je 0x521095
mov ecx, dword [esi + 0x20]
push 0
push 0x24
push 0
push 0x3c
push ecx
call dword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [esi + 0x24], 0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.00526a8a
add esp, 0x48
ret
test edi, edi
jne 0x520fbe
pop edi
pop esi
pop ebp
mov dword [0x463b34], 0x64
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.00526a8a
add esp, 0x48
ret
movzx edx, word [esp + 0x36]
movzx eax, word [esp + 0x38]
mov cl, byte [esp + 0x3a]
mov dword [esi + 0x40], edx
movzx edx, word [esp + 0x34]
pop edi
mov byte [esi + 0x50], cl
mov ecx, dword [esp + 0x50]
mov dword [esi + 0x44], eax
mov dword [esi + 4], edx
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00526a8a
add esp, 0x48
ret
Function at 0x5211d0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x40
mov eax, dword [0x463df0]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebx
push esi
push edi
lea eax, [esp + 0xf]
mov esi, ecx
push eax
mov eax, dword [esi + 0x5c]
mov edi, 1
mov ebx, edx
call fcn.00520e10
test eax, eax
je 0x52120c
cmp byte [esp + 0xf], 0xfa
jbe 0x521222
mov dword [0x463b34], 0x67
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.00526a8a
add esp, 0x40
ret 4
push ebp
push 0x38
xor ebp, ebp
lea ecx, [esp + 0x18]
push ebp
push ecx
call fcn.00526600
mov eax, dword [esi + 0x60]
add esp, 0xc
lea edx, [esp + 0x28]
push edx
add eax, 0x14
lea edi, [ebp + 0x1d]
call fcn.00520e10
test eax, eax
je 0x5213ac
mov edx, dword [esp + 0x2a]
mov eax, dword [esp + 0x28]
add eax, edx
lea ecx, [esp + 0x2c]
movzx eax, ax
lea edx, [ebp + 0x18]
xor byte [ecx], al
mov di, ax
shr di, 0xf
add eax, eax
add di, ax
movzx eax, di
mov di, ax
add eax, eax
shr di, 0xf
add di, ax
inc ecx
sub edx, 1
movzx eax, di
jne 0x521264
cmp dword [esp + 0x40], ebp
je 0x5212b1
pop ebp
pop edi
pop esi
mov dword [0x463b34], 0x65
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.00526a8a
add esp, 0x40
ret 4
mov cx, word [esp + 0x2c]
cmp cx, word [esi + 0x54]
je 0x5212dd
pop ebp
pop edi
pop esi
mov dword [0x463b34], 0x67
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.00526a8a
add esp, 0x40
ret 4
mov eax, dword [esi + 0x6c]
test eax, eax
je 0x5212ec
push eax
call fcn.0051fe00
mov ebp, eax
test ebx, ebx
je 0x52134a
test ebp, ebp
je 0x52134a
cmp dword [ebp + 0x10], 1
jne 0x52134a
cmp byte [esp + 0x13], 0xfa
jae 0x52134a
cmp byte [esp + 0x44], 0
jne 0x521328
test byte [ebp + 0x28], 0x80
jne 0x521328
mov eax, dword [esi + 0x64]
mov edx, dword [ebp + 0x2c]
add eax, dword [esi + 0x60]
mov edi, dword [ebp + 0x34]
push edx
call fcn.00520e10
test eax, eax
je 0x5213ac
movzx eax, byte [esp + 0x44]
xor ecx, ecx
test eax, eax
sete cl
mov dword [ebp + 0x14], eax
mov dword [ebp + 0x10], 2
mov dword [ebp + 0x18], ecx
mov dword [esi + 0x6c], 0
mov dword [ebx], ebp
mov edi, dword [esp + 0x54]
test edi, edi
je 0x5213ca
mov ecx, dword [esi + 0x3c]
mov eax, dword [esi + 0x44]
xor edx, edx
cmp ecx, eax
jbe 0x52136f
mov ebx, dword [esi + 0x40]
cmp ebx, dword [esi + 0x38]
jbe 0x521373
sub eax, ecx
add eax, 0xa8c0
jmp 0x521371
sub eax, ecx
mov edx, eax
lea eax, [edx + edx]
test eax, eax
jge 0x52137e
xor eax, eax
jmp 0x52138a
cmp eax, 0xffff
mov ecx, 0xffff
jg 0x52138d
movzx ecx, ax
cmp ecx, edi
jae 0x5213c3
mov eax, edi
sub eax, ecx
xor edx, edx
div dword [esi + 0x34]
mov dword [esi + 0x14], eax
cmp eax, 1
jbe 0x5213ca
mov dword [0x463b34], 0x63
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.00526a8a
add esp, 0x40
ret 4
mov dword [esi + 0x14], 0
mov ecx, dword [esp + 0x4c]
pop ebp
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00526a8a
add esp, 0x40
ret 4
Function at 0x5213f0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ecx
push esi
mov esi, ecx
mov cx, word [esi + 0x40]
push edi
lea edi, [eax + 0x14]
mov word [edi], cx
movzx edx, word [esi + 0x44]
mov word [eax + 0x16], dx
lea ecx, [eax + 0x18]
mov ax, word [esi + 0x54]
mov word [ecx], ax
movzx edx, word [esi + 0x44]
add dx, word [esi + 0x40]
push ebx
movzx eax, dx
mov edx, 0x18
xor byte [ecx], al
mov bx, ax
shr bx, 0xf
add eax, eax
add bx, ax
movzx eax, bx
mov bx, ax
add eax, eax
shr bx, 0xf
add bx, ax
inc ecx
sub edx, 1
movzx eax, bx
jne 0x521422
mov eax, dword [esi + 0x60]
push edi
add eax, 0x14
lea edi, [edx + 0x1c]
call fcn.00520ee0
pop ebx
test eax, eax
jne 0x521460
pop edi
pop esi
pop ecx
ret
cmp dword [esi + 0x6c], 0
je 0x52146d
mov byte [esp + 0xb], 0xfa
jmp 0x521474
mov cl, byte [esi + 0x50]
mov byte [esp + 0xb], cl
mov eax, dword [esi + 0x5c]
lea edx, [esp + 0xb]
push edx
mov edi, 1
call fcn.00520ee0
neg eax
sbb eax, eax
pop edi
neg eax
pop esi
pop ecx
ret
Function at 0x522850
Capabilities:
Get hostname
Resolve dns

Disassembly:
sub esp, 0x220
mov eax, dword [0x463df0]
xor eax, esp
mov dword [esp + 0x21c], eax
push esi
mov esi, dword [esp + 0x228]
push 0x100
lea eax, [esp + 0x124]
push eax
call sub.WSOCK32.dll_gethostname
cmp eax, 0xffffffff
jne 0x52289d
xor al, al
pop esi
mov ecx, dword [esp + 0x21c]
xor ecx, esp
call fcn.00526a8a
add esp, 0x220
ret 4
lea ecx, [esp + 0x120]
push ecx
call sub.WSOCK32.dll_gethostbyname
test eax, eax
je 0x522883
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
push ebx
mov ebx, dword [eax]
push 1
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x14], 0x10c
call fcn.0051f170
test eax, eax
jne 0x5228ec
mov edx, dword [esp + 0x18]
test edx, edx
jle 0x5228ec
lea ecx, [esp + 0x1c]
nop
cmp dword [ecx], ebx
je 0x5228f3
inc eax
add ecx, 0x18
cmp eax, edx
jl 0x5228e0
xor al, al
jmp 0x5229b7
lea eax, [eax + eax*2]
mov ecx, dword [esp + eax*8 + 0x24]
test ecx, ecx
je 0x5228ec
mov edx, ebx
shr edx, 0x18
mov byte [esp + 8], dl
mov eax, ebx
shr eax, 0x10
mov byte [esp + 9], al
movzx eax, byte [esi + 7]
mov byte [esp + 0xc], al
movzx eax, byte [esi + 5]
mov edx, ebx
shr edx, 8
mov byte [esp + 0xa], dl
movzx edx, byte [esi + 6]
mov byte [esp + 0xd], dl
movzx edx, byte [esi + 4]
mov byte [esp + 0xe], al
mov eax, dword [esi + 4]
and eax, ecx
mov byte [esp + 0xf], dl
mov edx, eax
shr edx, 0x18
mov byte [esp + 0x10], dl
mov edx, eax
shr edx, 0x10
mov byte [esp + 0x11], dl
not ecx
mov edx, eax
mov byte [esp + 0x13], al
mov eax, ecx
shr edx, 8
shr ecx, 0x18
mov byte [esp + 0x12], dl
mov byte [esp + 0x14], cl
mov edx, eax
mov ecx, eax
shr edx, 0x10
shr ecx, 8
mov byte [esp + 0x15], dl
mov edx, dword [esp + 0xc]
mov byte [esp + 0x16], cl
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x17], al
mov eax, dword [esp + 0x14]
or eax, ecx
push edi
mov byte [esp + 0xf], bl
cmp edx, ecx
jbe 0x5229a7
cmp edx, eax
jae 0x5229a5
mov edi, dword [esp + 0xc]
cmp edi, ecx
jbe 0x5229a5
cmp edi, eax
jb 0x5229ad
cmp edx, ecx
je 0x5229d0
cmp edx, eax
je 0x5229d0
mov dword [esi + 8], 1
mov al, 1
pop edi
mov ecx, dword [esp + 0x224]
pop ebx
pop esi
xor ecx, esp
call fcn.00526a8a
add esp, 0x220
ret 4
mov dword [esi + 8], 0
xor al, al
jmp 0x5229b6

Function at 0x5229e0
Capabilities:
Resolve dns

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [0x59f4b0]
xor ebx, ebx
xor al, al
mov byte [esp + 0xb], al
cmp esi, ebx
je 0x522a2b
cmp byte [esi + 0xc], bl
lea eax, [esi + 0xc]
je 0x522a21
push eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call sub.WSOCK32.dll_gethostbyname
cmp eax, ebx
je 0x522a21
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
push esi
mov dword [esi + 4], edx
call fcn.00522850
or byte [esp + 0xb], al
mov esi, dword [esi]
cmp esi, ebx
jne 0x5229f5
mov al, byte [esp + 0xb]
pop esi
pop ebx
pop ecx
ret