joyce8/EMBER2024-capa huggingface dataset:
Function at 0x512c70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
mov ebp, ecx
mov ecx, dword [ebp + 0x14]
push esi
mov esi, ecx
test esi, esi
push edi
mov edi, dword [esp + 0x14]
je 0x512ca1
mov eax, dword [esi + 0xc]
shl eax, 0x1a
sar eax, 0x1a
cmp eax, 0xd
je 0x512d19
cmp eax, 2
je 0x512d19
mov esi, dword [esi + 0x14]
test esi, esi
jne 0x512c83
mov esi, ecx
cmp dword [edi], 0
jg 0x512cae
mov dword [edi], 1
mov ecx, dword [ebp + 0x14]
mov eax, dword [ecx + 0xc]
and eax, 0x3f
cmp al, 0xb
jne 0x512d66
mov edx, dword [ecx]
call dword [edx + 0x78]
cmp eax, 1
jne 0x512d66
push eax
push 0x10
mov ecx, 0x63b598
call fcn.004e1dd0
mov ebx, eax
test ebx, ebx
je 0x512d56
mov eax, dword [ebp + 0x14]
movsx ecx, word [eax + 0x18]
mov edx, dword [0x71f008]
shl ecx, 4
mov ecx, dword [ecx + edx]
call fcn.00417490
lea ecx, [ebx + 0xc]
mov edx, eax
mov dword [ebx], 0x5f8b94
call fcn.004ea010
push ebx
lea ecx, [edi + 0x10]
call fcn.004e6190
mov eax, dword [ebp + 0x14]
jmp 0x512dad
mov eax, dword [esi + 0xc]
and eax, 0x3f
cmp al, 0xd
jne 0x512d33
mov edi, dword [esp + 0x14]
mov dword [edi + 0x4c], 1
jmp 0x512ca8
mov eax, dword [edi + 0x4c]
test eax, eax
jne 0x512d4b
xor ecx, ecx
mov cl, byte [esi + 0xbc]
shr ecx, 5
and ecx, 1
mov dword [edi + 0x4c], ecx
movsx edx, word [esi + 0x44]
mov dword [edi], edx
jmp 0x512ca3
xor ebx, ebx
push ebx
lea ecx, [edi + 0x10]
call fcn.004e6190
mov eax, dword [ebp + 0x14]
jmp 0x512dad
cmp word [ebp + 0x58], 0
je 0x512d96
mov eax, dword [ebp + 0x44]
test eax, eax
je 0x512d96
movsx ecx, word [ebp + 0x18]
mov edx, dword [0x71f008]
mov ebx, dword [eax + 0x68]
shl ecx, 4
mov ecx, dword [ecx + edx]
push 1
call fcn.00417490
push eax
mov ecx, ebx
call fcn.004f2d60
mov ecx, dword [edi]
xor eax, eax
mov ax, word [0x6f7ce8]
lea edx, [edi + 0x10]
push eax
push ecx
mov ecx, esi
push edx
call fcn.004eaef0
mov ecx, dword [edi]
mov dword [edi + 0x1c], eax
xor eax, eax
mov ax, word [0x6f7cf8]
lea edx, [edi + 0x20]
push eax
push ecx
push edx
mov ecx, esi
call fcn.004eaef0
mov ecx, dword [edi]
mov dword [edi + 0x2c], eax
xor eax, eax
mov ax, word [0x6f7cfc]
lea edx, [edi + 0x30]
push eax
push ecx
push edx
mov ecx, esi
call fcn.004eaef0
mov dword [edi + 0x3c], eax
mov eax, dword [esp + 0x18]
push eax
mov ecx, edi
call fcn.0055c960
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x5165c0
Capabilities:
Initialize winsock library

Disassembly:
mov eax, 0x1cc
call fcn.005e6090
push ebx
push ebp
push esi
lea eax, [esp + 0x48]
push eax
push 0x101
mov ebp, ecx
call sub.WSOCK32.dll_WSAStartup
lea ebx, [ebp + 0xc]
mov edx, str._tallydata
mov ecx, ebx
call fcn.004ea010
lea ecx, [esp + 0xc]
call fcn.00501e30
mov eax, dword [ebp + 0xbc]
test eax, eax
je 0x51660c
push str.author.ini
lea ecx, [esp + 0x10]
push ecx
jmp 0x516616
push str.Tally.ini
lea edx, [esp + 0x10]
push edx
call fcn.005014b0
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx]
add esp, 8
push 1
call dword [eax + 0xc]
mov esi, eax
cmp esi, 1
je 0x516657
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x516653
mov edx, dword [ecx]
call dword [edx + 0x64]
test eax, eax
je 0x516653
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x516653
mov eax, dword [ecx]
call dword [eax + 0x68]
cmp eax, 1
je 0x516657
mov eax, esi
jmp 0x516692
mov eax, dword [ebp + 0xbc]
test eax, eax
je 0x516671
mov ecx, dword [ebp + 0x10]
push str.author.ini
push ecx
lea edx, [esp + 0x14]
push edx
jmp 0x51667f
mov eax, dword [ebp + 0x10]
push str.Tally.ini
push eax
lea ecx, [esp + 0x14]
push ecx
call fcn.00501520
add esp, 0xc
push 1
lea ecx, [esp + 0x10]
call fcn.0040a700
test eax, eax
jne 0x5166a7
push 1
push ebp
push 0x516560
lea ecx, [esp + 0x18]
call fcn.00501d70
push edi
mov edi, dword [esp + 0x1e0]
cmp edi, 1
jle 0x5166f0
mov ecx, dword [ebx]
call fcn.004dc6a0
mov esi, dword [esp + 0x1e4]
mov edx, dword [esi + 4]
mov ecx, ebx
call fcn.004ea010
cmp edi, 2
jle 0x5166f0
mov edi, 1
mov dword [ebp + 0x54], edi
mov edx, dword [esi + 8]
push edx
call fcn.005e64a5
add esp, 4
mov dword [0x72298c], eax
mov dword [0x722990], edi
cmp dword [ebx], 0
jne 0x516701
mov edx, str._tallydata
mov ecx, ebx
call fcn.004ea010
mov eax, dword [ebp + 0x14]
test eax, eax
lea esi, [ebp + 0x14]
jne 0x516724
mov edx, dword [ebp + 0x10]
mov ecx, esi
call fcn.004ea010
cmp dword [esi], 0
jne 0x516724
mov edx, dword [ebp + 0x10]
mov ecx, esi
call fcn.004ea010
mov ecx, dword [ebx]
mov eax, ecx
lea edi, [eax + 1]
jmp 0x516730
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x516730
sub eax, edi
mov dl, byte [ecx + eax - 1]
mov bl, 0x5c
cmp dl, bl
pop edi
jne 0x516749
mov byte [ecx + eax - 1], 0
mov ecx, dword [esi]
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x516750
sub eax, esi
cmp byte [ecx + eax - 1], bl
jne 0x516764
mov byte [ecx + eax - 1], 0
mov eax, dword [ebp + 0x48]
test eax, eax
jne 0x516772
mov ecx, ebp
call fcn.00515e20
call fcn.005f3ed6
lea ecx, [esp + 0xc]
call fcn.005015f0
pop esi
pop ebp
pop ebx
add esp, 0x1cc
ret 8
Function at 0x5170b0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
push ebx
mov ebx, ecx
mov ecx, dword [esp + 0x14]
movzx ax, byte [ecx + 2]
push ebp
mov ebp, dword [ebx + 0x20]
push esi
mov esi, dword [esp + 0x24]
mov word [esp + 0x14], ax
mov eax, dword [ebx + 0x18]
add ebp, eax
test esi, esi
push edi
mov edi, dword [esp + 0x24]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
je 0x517111
mov eax, dword [esi + 4]
test eax, eax
je 0x517111
movzx ebx, byte [ecx + 6]
push edi
mov ecx, esi
call fcn.00517160
mov ecx, esi
sub ebp, eax
call fcn.00517070
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
add ecx, eax
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x20]
cmp ebp, dword [esp + 0x10]
jle 0x517153
movzx edx, byte [ecx + 6]
mov eax, dword [ebx + 0x10]
movsx esi, word [esp + 0x18]
push eax
mov dword [esp + 0x24], edx
call fcn.005190f0
mov ecx, dword [esp + 0x20]
push eax
mov eax, dword [esp + 0x14]
push ecx
push 1
mov edx, esi
shr edx, 3
and edx, 1
push edx
shr esi, 1
and esi, 1
push esi
push eax
push edi
push ebp
push edi
mov ecx, ebx
call fcn.00560c90
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
Function at 0x518510
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
mov edi, dword [esp + 0x18]
mov esi, ecx
mov ecx, dword [esp + 0x20]
lea eax, [edi + ebp]
add eax, ecx
jns 0x51853c
push str.Could_not_fit_on_screen__nToo_small_to_be_used_
push 4
push 0x1c
call fcn.004edf50
add esp, 0xc
jmp 0x518546
movsx eax, word [esi + 0x1a]
cmp edi, eax
jle 0x518546
mov edi, eax
mov ebx, dword [esp + 0x14]
test ebx, ebx
jge 0x518583
mov ax, word [esi + 0xe]
movsx ecx, ax
mov edx, ebx
neg edx
cmp edx, ecx
jg 0x51856d
mov eax, dword [esi + 8]
inc ebx
imul ebx, ebx, 0x1c
pop edi
pop esi
pop ebp
sub eax, ebx
pop ebx
ret 0x10
cmp ax, word [esi + 0xc]
jne 0x51857a
mov ecx, esi
call fcn.00518470
movsx eax, word [esi + 0xe]
mov ecx, dword [esi + 8]
jmp 0x5185b1
mov ax, word [esi + 6]
movsx ecx, ax
cmp ebx, ecx
jg 0x51859e
mov edx, dword [esi]
imul ebx, ebx, 0x1c
pop edi
pop esi
pop ebp
lea eax, [ebx + edx - 0x1c]
pop ebx
ret 0x10
cmp ax, word [esi + 4]
jne 0x5185ab
mov ecx, esi
call fcn.005183e0
movsx eax, word [esi + 6]
mov ecx, dword [esi]
imul eax, eax, 0x1c
add eax, ecx
mov cx, word [esi + 6]
test cx, cx
jle 0x5185d5
mov edx, dword [esi]
movsx ecx, cx
imul ecx, ecx, 0x1c
lea ecx, [ecx + edx - 0x1c]
movsx edx, word [ecx + 6]
movsx ecx, word [ecx + 2]
jmp 0x5185dd
movsx edx, word [esi + 0x20]
movsx ecx, word [esi + 0x18]
add edx, ecx
mov cx, word [esi + 0xe]
add edx, ebp
test cx, cx
jle 0x518602
mov ebp, dword [esi + 8]
movsx ecx, cx
imul ecx, ecx, 0x1c
lea ecx, [ecx + ebp - 0x1c]
movsx ebp, word [ecx + 4]
movsx ecx, word [ecx]
sub ecx, ebp
jmp 0x51860c
movsx ecx, word [esi + 0x1a]
movsx ebp, word [esi + 0x18]
add ecx, ebp
sub ecx, dword [esp + 0x20]
cmp edx, ecx
jl 0x51861d
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x10
lea ebp, [edx + edi]
cmp ebp, ecx
jle 0x518628
mov edi, ecx
sub edi, edx
test ebx, ebx
jge 0x518654
mov dx, word [esp + 0x1c]
sub ecx, edi
mov word [eax], cx
add ecx, edi
mov word [eax + 2], cx
mov cx, word [esp + 0x20]
pop edi
mov word [eax + 4], dx
mov word [eax + 6], cx
inc word [esi + 0xe]
pop esi
pop ebp
pop ebx
ret 0x10
mov cx, word [esp + 0x20]
mov word [eax], dx
add edx, edi
mov word [eax + 2], dx
mov dx, word [esp + 0x1c]
pop edi
mov word [eax + 4], dx
mov word [eax + 6], cx
inc word [esi + 6]
pop esi
pop ebp
pop ebx
ret 0x10
Function at 0x523230
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x74
call fcn.005e6090
push ebx
xor ebx, ebx
mov eax, 0x5f7544
push esi
push edi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x58], eax
mov esi, edx
xor eax, eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], ebx
mov ecx, 0x1a
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov ecx, dword [esi + 4]
push esi
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x78], ecx
call fcn.00512c70
mov eax, dword [esp + 0x5c]
cmp eax, ebx
je 0x523406
mov eax, dword [eax + 0xc]
cmp eax, ebx
je 0x523406
mov cl, byte [eax]
cmp cl, bl
je 0x523406
cmp cl, 4
je 0x523406
mov ecx, dword [0x6f7dfc]
push eax
call fcn.004ef750
mov ecx, eax
call fcn.00561200
mov edi, eax
cmp edi, ebx
jne 0x5232fc
lea ecx, [esp + 0x18]
call fcn.00420c60
pop edi
pop esi
pop ebx
add esp, 0x74
ret
test byte [edi + 0x12], 0x10
jne 0x523309
mov ecx, edi
call fcn.00562190
mov edi, dword [edi + 8]
mov cx, word [edi + 0x38]
push ebp
call fcn.00512aa0
mov ebp, eax
cmp ebp, ebx
je 0x5233f5
mov cx, word [ebp]
call fcn.00567170
mov edi, eax
cmp edi, ebx
je 0x5233ea
test byte [edi + 0x12], 0x10
jne 0x523340
mov ecx, edi
call fcn.00562190
mov ecx, 0x58
call fcn.004dc530
cmp eax, ebx
je 0x52335e
mov ecx, dword [esi + 4]
push ecx
push ebx
mov ecx, eax
call fcn.004fc8c0
mov esi, eax
jmp 0x523360
xor esi, esi
movzx eax, word [ebp]
lea edx, [eax + eax*2]
mov edx, dword [edx*4 + 0x63c468]
lea ecx, [esp + 0x10]
call fcn.004ea010
mov ecx, dword [esp + 0x10]
xor edx, edx
call fcn.00502e50
push eax
push 0x401
mov ecx, esi
call fcn.004f3f50
mov ecx, dword [esp + 0x10]
call fcn.004dc6a0
mov eax, dword [edi + 8]
mov ecx, dword [eax + 8]
cmp ecx, ebx
jne 0x5233a7
mov ecx, 1
call fcn.004e9df0
mov edx, eax
lea ecx, [esp + 0x10]
call fcn.004ea010
mov ecx, dword [esp + 0x10]
xor edx, edx
call fcn.00502e50
push eax
push 0x1048
mov ecx, esi
call fcn.004f3f50
mov ecx, dword [esp + 0x10]
call fcn.004dc6a0
mov edx, dword [esp + 0x14]
mov ecx, esi
call dword [esp + 0x18]
test eax, eax
je 0x5233f5
mov esi, dword [esp + 0x14]
mov ebp, dword [ebp + 4]
cmp ebp, ebx
jne 0x523320
lea ecx, [esp + 0x1c]
call fcn.00420c60
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x74
ret
lea ecx, [esp + 0x58]
call fcn.004e6350
lea ecx, [esp + 0x48]
call fcn.004e6350
lea ecx, [esp + 0x38]
call fcn.004e6350
lea ecx, [esp + 0x28]
call fcn.004e6350
lea ecx, [esp + 0x1c]
call fcn.004e6350
pop edi
pop esi
pop ebx
add esp, 0x74
ret
Function at 0x52a610
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
mov dword [esi + 0x78], edi
lea ebx, [esi + 0xa8]
mov dword [esi + 0x50], edi
mov dword [ebx + 8], edi
mov dword [ebx + 0xc], edi
mov dword [ebx + 0x10], edi
lea ecx, [ebx + 0x30]
mov dword [ebx + 0x20], edi
mov dword [ebx + 0x24], edi
mov dword [ebx + 0x28], edi
call fcn.0050d5e0
mov ecx, ebx
mov dword [ebx], edi
call fcn.0050c630
lea ebx, [esi + 0x118]
mov dword [ebx + 8], edi
mov dword [ebx + 0xc], edi
mov dword [ebx + 0x10], edi
mov ecx, ebx
mov dword [ebx + 0x20], edi
mov dword [ebx + 0x24], edi
mov dword [ebx + 0x28], edi
call fcn.0050d750
mov dword [ebx], edi
lea ecx, [esi + 0x180]
mov dword [esi + 0x170], 0x5f7544
mov dword [esi + 0x174], edi
mov dword [esi + 0x178], edi
call fcn.0052abd0
lea ecx, [esi + 0x228]
call fcn.0050d5e0
mov ecx, 0xe00
call fcn.004dc5a0
mov dword [esi], eax
xor ecx, ecx
mov eax, dword [esi]
add eax, ecx
je 0x52a6df
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], edi
mov dword [eax + 0x20], edi
mov dword [eax + 0x24], edi
mov dword [eax + 0x28], edi
mov dword [eax], edi
mov eax, dword [esi]
lea eax, [ecx + eax + 0x38]
cmp eax, edi
je 0x52a6fd
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], edi
mov dword [eax + 0x20], edi
mov dword [eax + 0x24], edi
mov dword [eax + 0x28], edi
mov dword [eax], edi
mov eax, dword [esi]
lea edx, [ecx + 0xa8]
lea eax, [edx + eax - 0x38]
cmp eax, edi
je 0x52a721
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], edi
mov dword [eax + 0x20], edi
mov dword [eax + 0x24], edi
mov dword [eax + 0x28], edi
mov dword [eax], edi
mov eax, dword [esi]
add eax, edx
je 0x52a73b
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], edi
mov dword [eax + 0x20], edi
mov dword [eax + 0x24], edi
mov dword [eax + 0x28], edi
mov dword [eax], edi
add ecx, 0xe0
cmp ecx, 0xe00
jl 0x52a6c5
mov ecx, 0x80
call fcn.004dc5f0
mov ecx, 0x801
mov dword [esi + 4], eax
call fcn.004dc5f0
mov dword [esi + 0xa0], edi
mov dword [esi + 0x10], eax
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x532a90
Capabilities:
Parse url

Disassembly:
sub esp, 8
mov edx, dword [esp + 0xc]
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ebx, [esi + 4]
xor eax, eax
mov dword [esi], 0x61142c
mov ecx, 0xf
mov edi, ebx
rep stosd dword es:[edi], eax
xor edi, edi
push edi
mov ebp, 1
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x1b]
push ecx
push edx
mov dword [esp + 0x24], ebp
mov dword [ebx], 0x3c
mov dword [esi + 8], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0xc], ebp
mov dword [esi + 0x18], ebp
mov dword [esi + 0x24], ebp
mov dword [esi + 0x2c], ebp
mov dword [esi + 0x34], ebp
mov dword [esi + 0x3c], ebp
call dword [sym.imp.WININET.dll_InternetCanonicalizeUrlA]
mov ecx, dword [esp + 0x14]
inc ecx
mov dword [esi + 0x44], ebp
call fcn.004dc4c0
mov edx, dword [esp + 0x1c]
push edi
lea ecx, [esp + 0x18]
push ecx
push eax
push edx
mov dword [esi + 0x40], eax
call dword [sym.imp.WININET.dll_InternetCanonicalizeUrlA]
mov eax, dword [esi + 0x40]
mov ecx, dword [esp + 0x14]
mov byte [ecx + eax], 0
mov ebp, dword [esi + 0x40]
mov eax, ebp
lea ecx, [eax + 1]
lea ecx, [ecx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x532b30
push ebx
push edi
sub eax, ecx
push eax
push ebp
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
test eax, eax
jne 0x532b56
mov dword [esi + 0x44], edi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
mov eax, dword [esi + 0x14]
mov edx, dword [esi + 0x18]
pop edi
mov byte [edx + eax], 0
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
Function at 0x5332f0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Resolve dns
Set socket configuration

Disassembly:
mov eax, 0x68
call fcn.005e6090
push ebx
push ebp
push esi
push edi
mov esi, ecx
xor ebp, ebp
xor ebx, ebx
call fcn.00532b90
mov edi, eax
cmp edi, 1
jne 0x533343
mov ecx, esi
call fcn.00532ca0
mov ecx, esi
mov ebp, eax
call fcn.00532c00
push eax
lea ecx, [esp + 0x34]
call fcn.00532a90
mov ecx, dword [esp + 0x70]
test ecx, ecx
mov ebx, dword [esp + 0x4c]
mov dword [esp + 0x30], 0x61142c
je 0x533343
call fcn.004dc6a0
mov eax, dword [esp + 0x7c]
xor ecx, ecx
cmp edi, 1
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
mov dword [eax], 0xffffffff
mov dword [esp + 0x1c], ecx
mov word [esp + 0x10], 2
mov eax, ebx
je 0x533374
mov eax, dword [esp + 0x84]
push eax
call sub.WSOCK32.dll_htons
lea ecx, [esp + 0x20]
mov word [esp + 0x12], ax
call fcn.00512e40
cmp edi, 1
mov ebx, dword [esp + 0x80]
lea ecx, [esp + 0x20]
jne 0x53339b
push ebp
jmp 0x53339c
push ebx
call fcn.004e1bb0
lea ecx, [esp + 0x20]
call fcn.004e1b90
push eax
call sub.WSOCK32.dll_inet_addr
cmp eax, 0xffffffff
jne 0x5333e7
lea ecx, [esp + 0x20]
call fcn.004e1b90
push eax
call sub.WSOCK32.dll_gethostbyname
test eax, eax
jne 0x5333e0
lea ecx, [esp + 0x20]
call fcn.004e1cc0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x68
ret 0xc
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov eax, dword [eax]
test edi, edi
mov dword [esp + 0x14], eax
jne 0x533429
push 6
push 1
push 2
call sub.WSOCK32.dll_socket
push 0x10
lea ecx, [esp + 0x14]
mov esi, eax
push ecx
push esi
call sub.WSOCK32.dll_connect
cmp eax, 0xffffffff
lea ecx, [esp + 0x20]
je 0x5333cc
mov edx, dword [esp + 0x7c]
mov dword [edx], esi
call fcn.004e1cc0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x68
ret 0xc
mov ecx, esi
call fcn.00532d50
test eax, eax
je 0x53343f
mov ecx, esi
call fcn.00532e70
mov edi, eax
jmp 0x533441
xor edi, edi
mov ecx, esi
call fcn.00532d50
test eax, eax
je 0x533455
mov ecx, esi
call fcn.00532dc0
jmp 0x533457
xor eax, eax
mov edx, dword [esp + 0x7c]
push edi
push eax
mov eax, dword [esp + 0x8c]
push eax
push ebx
lea ecx, [esp + 0x20]
push ecx
push edx
mov ecx, esi
call fcn.00532f20
lea ecx, [esp + 0x20]
mov esi, eax
call fcn.004e1cc0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x68
ret 0xc
Function at 0x5343b0
Capabilities:
Generate random numbers via winapi

Disassembly:
sub esp, 0xc
push ebx
push esi
push edi
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call fcn.005e6053
add esp, 4
mov ebx, eax
call fcn.005e6031
push 1
cdq
push 0
push edx
push eax
call fcn.005e6560
mov esi, eax
push 0xf0000000
mov edi, edx
push 1
mov eax, ebx
cdq
add esi, eax
push 0
push 0
lea eax, [esp + 0x1c]
adc edi, edx
push eax
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], edi
mov dword [esp + 0x20], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x534443
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
push 8
push edx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x534436
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
mov eax, dword [esp + 0xc]
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
pop edi
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x534490
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x1060
call fcn.005e6090
xor eax, eax
mov dword [esp + 1], eax
mov dword [esp + 5], eax
mov dword [esp + 9], eax
mov dword [esp + 0xd], eax
mov eax, dword [esp + 0x1064]
test eax, eax
push ebx
mov byte [esp + 4], 0
je 0x534679
mov eax, dword [esp + 0x1070]
test eax, eax
je 0x534679
mov ebx, dword [esp + 0x1074]
mov ecx, ebx
and ecx, 0x80000007
jns 0x5344e6
dec ecx
or ecx, 0xfffffff8
inc ecx
jne 0x534679
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5344f0
sub eax, edx
push esi
mov esi, eax
cmp esi, ebx
jle 0x53450d
pop esi
xor eax, eax
pop ebx
add esp, 0x1060
ret 0x10
push ebp
push edi
lea edi, [ebx + 1]
mov ecx, edi
call fcn.004dc4c0
mov ecx, edi
mov edx, ecx
shr ecx, 2
mov ebp, eax
xor eax, eax
mov edi, ebp
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, esi
mov esi, dword [esp + 0x107c]
mov eax, ecx
shr ecx, 2
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x10
lea edx, [esp + 0x14]
lea ecx, [esp + 0x2c]
mov dword [esp + 0x28], ebp
mov byte [esp + 0x14], 0x54
mov byte [esp + 0x15], 0x20
mov byte [esp + 0x16], 0x87
mov byte [esp + 0x17], 0x84
mov byte [esp + 0x18], 0x22
mov byte [esp + 0x19], 0x36
mov byte [esp + 0x1a], 2
mov byte [esp + 0x1b], 0x99
mov byte [esp + 0x1c], 0x55
mov byte [esp + 0x1d], 6
mov byte [esp + 0x1e], 9
mov byte [esp + 0x1f], 0x23
mov byte [esp + 0x20], 0x53
mov byte [esp + 0x21], 0x12
mov byte [esp + 0x22], 0x51
mov byte [esp + 0x23], 0x66
mov byte [esp + 0x24], 0
call fcn.00574d90
push ebx
push ebp
xor edx, edx
lea ecx, [esp + 0x30]
call fcn.00574f40
cmp eax, 0xffffffff
jne 0x5345ea
xor ecx, ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
mov ecx, ebp
call fcn.004dc6a0
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
add esp, 0x1060
ret 0x10
mov eax, dword [esp + 0x1078]
xor edx, edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], edx
lea esi, [eax + ebx + 1]
mov dword [esp + 0x18], edx
mov ecx, esi
mov dword [esp + 0x1c], edx
call fcn.004dc4c0
mov ebp, eax
mov ecx, esi
mov edx, ecx
shr ecx, 2
mov esi, dword [esp + 0x24]
xor eax, eax
mov edi, ebp
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, ebx
mov eax, ecx
shr ecx, 2
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x1078]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x1074]
mov ecx, eax
mov edx, ecx
shr ecx, 2
lea edi, [ebx + ebp]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x24]
add eax, ebp
mov byte [eax + ebx], 0
call fcn.004dc6a0
pop edi
mov eax, ebp
pop ebp
pop esi
pop ebx
add esp, 0x1060
ret 0x10
xor eax, eax
pop ebx
add esp, 0x1060
ret 0x10
Function at 0x534690
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x105c
call fcn.005e6090
xor eax, eax
mov dword [esp + 1], eax
push ebx
push esi
mov esi, dword [esp + 0x1068]
test esi, esi
mov dword [esp + 0xd], eax
mov dword [esp + 0x11], eax
mov byte [esp + 8], 0
mov dword [esp + 0x15], eax
je 0x5347cc
mov ebx, dword [esp + 0x1070]
cmp dword [esp + 0x106c], ebx
jl 0x5347cc
mov ecx, ebx
and ecx, 0x80000007
jns 0x5346e5
dec ecx
or ecx, 0xfffffff8
inc ecx
jne 0x5347cc
push ebp
push edi
lea edi, [ebx + 1]
mov ecx, edi
call fcn.004dc4c0
mov ecx, edi
mov edx, ecx
shr ecx, 2
mov ebp, eax
xor eax, eax
mov edi, ebp
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, ebx
mov eax, ecx
shr ecx, 2
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x10
lea edx, [esp + 0x14]
lea ecx, [esp + 0x28]
mov byte [esp + 0x14], 0x54
mov byte [esp + 0x15], 0x20
mov byte [esp + 0x16], 0x87
mov byte [esp + 0x17], 0x84
mov byte [esp + 0x18], 0x22
mov byte [esp + 0x19], 0x36
mov byte [esp + 0x1a], 2
mov byte [esp + 0x1b], 0x99
mov byte [esp + 0x1c], 0x55
mov byte [esp + 0x1d], 6
mov byte [esp + 0x1e], 9
mov byte [esp + 0x1f], 0x23
mov byte [esp + 0x20], 0x53
mov byte [esp + 0x21], 0x12
mov byte [esp + 0x22], 0x51
mov byte [esp + 0x23], 0x66
mov byte [esp + 0x24], 0
call fcn.00574d90
push ebx
push ebp
xor edx, edx
lea ecx, [esp + 0x2c]
call fcn.00575410
cmp eax, 0xffffffff
jne 0x5347bd
xor ecx, ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
mov ecx, ebp
call fcn.004dc6a0
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
add esp, 0x105c
ret 0xc
pop edi
mov eax, ebp
pop ebp
pop esi
pop ebx
add esp, 0x105c
ret 0xc
pop esi
xor eax, eax
pop ebx
add esp, 0x105c
ret 0xc

Function at 0x5367f4
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
push ebx
mov esi, ecx
mov edi, edx
mov ecx, 0x80
shr ecx, 3
mov eax, 0
mov ebx, 0
xor dword [esi], eax
xor dword [esi + 4], ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
call fcn.00575ed8
mov dword [esi], eax
mov dword [esi + 4], ebx
add esi, 8
loop 0x53680d
pop ebx
pop edi
pop esi
ret

Function at 0x5370a0
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
call fcn.005011e0
mov ecx, dword [esi + 0x10]
pop esi
jmp fcn.004ed940