joyce8/EMBER2024-capa huggingface dataset:
Function at 0x473374
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405108
xor eax, eax
push ebp
push 0x4734eb
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebx + 0x38]
mov edx, dword [ebp - 4]
call fcn.00404cac
mov word [ebx + 0x36], di
mov byte [ebp - 5], 0
mov byte [ebx + 0x34], 0
push 0
push 1
push 2
call sub.ws2_32.dll_socket
mov esi, eax
mov dword [ebx + 0x28], esi
mov eax, esi
xor edx, edx
cmp edx, 0xffffffff
jne 0x4733df
cmp eax, 0xffffffff
jne 0x4733df
push esi
call sub.ws2_32.dll_closesocket
call sub.ws2_32.dll_WSACleanup
jmp 0x4734d5
mov dword [ebp - 0x14], 1
push 4
lea eax, [ebp - 0x14]
push eax
push 8
push 0xffff
mov eax, dword [ebx + 0x28]
push eax
call sub.ws2_32.dll_setsockopt
inc eax
jne 0x473408
mov eax, dword [ebx + 0x28]
push eax
call sub.ws2_32.dll_closesocket
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x2c], 0x1770
mov dword [ebp - 0x28], 0x5dc
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
push 0
push 0
lea eax, [ebp - 0xc]
push eax
push 0xc
lea eax, [ebp - 0x3c]
push eax
push 0xc
lea eax, [ebp - 0x30]
push eax
push 0x98000004
mov eax, dword [ebx + 0x28]
push eax
call sub.ws2_32.dll_WSAIoctl
inc eax
jne 0x47345f
mov eax, dword [ebx + 0x28]
push eax
call sub.ws2_32.dll_closesocket
jmp 0x4734d5
mov word [ebp - 0x24], 2
push edi
call sub.ws2_32.dll_htons
mov word [ebp - 0x22], ax
mov eax, dword [ebp - 4]
call fcn.00405118
push eax
call sub.ws2_32.dll_inet_addr
mov dword [ebp - 0x20], eax
mov byte [ebx + 0x34], 1
mov dword [ebp - 0x10], 1
lea eax, [ebp - 0x10]
push eax
push 0x8004667e
mov eax, dword [ebx + 0x28]
push eax
call sub.ws2_32.dll_ioctlsocket
push 0x10
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebx + 0x28]
push eax
call sub.ws2_32.dll_connect
mov ecx, ebx
mov dl, 1
mov eax, dword [0x472cc0]
call fcn.00472f04
mov esi, eax
mov dword [ebx + 0x2c], esi
mov word [esi + 0x4c], 0
mov word [esi + 0x4a], 0
mov word [esi + 0x48], 0
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4734f2
lea eax, [ebp - 4]
call fcn.00404c58
ret

Function at 0x4734fc
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe70
push ebx
push esi
test dl, dl
je 0x473513
add esp, 0xfffffff0
call fcn.00404180
mov ebx, edx
mov esi, eax
mov dl, 1
mov eax, dword [0x472784]
call fcn.004728ac
mov dword [esi + 0x30], eax
lea eax, [ebp - 0x190]
push eax
push 0x202
call sub.ws2_32.dll_WSAStartup
test eax, eax
je 0x473540
call sub.ws2_32.dll_WSACleanup
mov eax, esi
test bl, bl
je 0x473555
call fcn.004041d8
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x474344
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0047369c
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
pop ebp
ret

Function at 0x4766d0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x476841
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47681c
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x111], 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x105
lea eax, [ebp - 0x111]
push eax
lea eax, [ebp - 0x118]
mov edx, ebx
call fcn.00404e40
lea eax, [ebp - 0x118]
mov edx, 0x476858
call fcn.00404f20
mov eax, dword [ebp - 0x118]
call fcn.00405118
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x47678e
lea eax, [ebp - 0x111]
call fcn.0040a13c
mov ecx, eax
lea edx, [ebp - 0x111]
mov eax, esi
call fcn.00404d48
jmp 0x476795
mov eax, esi
call fcn.00404c58
cmp bl, 0x61
jae 0x4767b6
lea edx, [ebp - 0x11c]
mov eax, dword [esi]
call fcn.0040e200
mov edx, dword [ebp - 0x11c]
mov eax, esi
call fcn.00404cac
jmp 0x4767d0
lea edx, [ebp - 0x120]
mov eax, dword [esi]
call fcn.0040e174
mov edx, dword [ebp - 0x120]
mov eax, esi
call fcn.00404cac
lea eax, [ebp - 0x124]
push eax
mov eax, dword [esi]
mov dword [ebp - 0x12c], eax
mov byte [ebp - 0x128], 0xb
lea edx, [ebp - 0x12c]
xor ecx, ecx
mov eax, 0x476864
call fcn.0040a87c
mov edx, dword [ebp - 0x124]
mov eax, esi
call fcn.00404cac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x476823
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x47bc78
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405108
xor eax, eax
push ebp
push 0x47bcd6
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 4]
call fcn.0047bd54
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
je 0x47bcbe
lea eax, [ebp - 4]
call fcn.0047bd54
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 5
jne 0x47bcc0
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47bcdd
lea eax, [ebp - 4]
call fcn.00404c58
ret
Function at 0x47bce4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405108
xor eax, eax
push ebp
push 0x47bd48
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xe
lea eax, [ebp - 0x1a]
push eax
lea eax, [ebp - 4]
call fcn.0047bd54
push eax
call sub.kernel32.dll_GetVolumeInformationA
mov edx, ebx
lea eax, [ebp - 0x1a]
call fcn.0040a364
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47bd4f
lea eax, [ebp - 4]
call fcn.00404c58
ret

Function at 0x47c358
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405108
xor eax, eax
push ebp
push 0x47c451
push dword fs:[eax]
mov dword fs:[eax], esp
mov ax, word [esi + 4]
mov word [ebx + 4], ax
mov ax, word [esi + 6]
mov word [ebx + 6], ax
mov ax, word [esi + 8]
mov word [ebx + 8], ax
mov ax, word [esi + 0xa]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xc]
call fcn.0047ba08
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x18], eax
mov ax, word [esi + 0x1c]
mov word [ebx + 0x1c], ax
mov ax, word [esi + 0x1e]
mov word [ebx + 0x1e], ax
mov ax, word [esi + 0x20]
mov word [ebx + 0x22], ax
mov ax, word [esi + 0x22]
mov word [ebx + 0x24], ax
mov ax, word [esi + 0x24]
mov word [ebx + 0x26], ax
mov eax, dword [esi + 0x26]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2a]
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00409f78
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0047cd5c
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00409e5c
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.0047cdd0
xor eax, eax
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c458
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404c7c
ret
Function at 0x47c460
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405108
xor eax, eax
push ebp
push 0x47c569
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebx + 4], 0
mov ax, word [esi + 4]
mov word [ebx + 6], ax
mov ax, word [esi + 6]
mov word [ebx + 8], ax
mov ax, word [esi + 8]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xa]
call fcn.0047ba08
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0xe]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x12]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x16]
mov dword [ebx + 0x18], eax
mov ax, word [esi + 0x1a]
mov word [ebx + 0x1c], ax
mov ax, word [esi + 0x1c]
mov word [ebx + 0x20], ax
mov word [ebx + 0x22], 0
mov word [ebx + 0x24], 0
mov word [ebx + 0x26], 0
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
cmp dword [ebp - 4], 0
je 0x47c52f
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00409f78
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0047cd5c
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00409e5c
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.0047cdd0
jmp 0x47c541
xor edx, edx
mov eax, ebx
call fcn.0047cd5c
xor edx, edx
mov eax, ebx
call fcn.0047cdd0
xor eax, eax
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c570
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404c7c
ret

Function at 0x482f18
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov ecx, dword [edi + 0x170]
mov edx, ebx
mov eax, edi
call fcn.00483154
mov esi, eax
mov dword [edi + 0x170], esi
and esi, 0xff
add dword [edi + 0x174], esi
imul esi, dword [edi + 0x174], 0x8088405
inc esi
mov dword [edi + 0x174], esi
mov edx, esi
shr edx, 0x18
mov ecx, dword [edi + 0x178]
mov eax, edi
call fcn.00483154
mov dword [edi + 0x178], eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x482f90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x482fb8
inc esi
mov eax, edi
call fcn.00482f74
xor byte [ebx], al
mov dl, byte [ebx]
mov eax, edi
call fcn.00482f18
inc ebx
dec esi
jne 0x482fa2
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x483048
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00405108
xor eax, eax
push ebp
push 0x4830bd
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.00482fc0
mov dword [ebp - 8], 0xc
lea esi, [ebp - 0x14]
mov eax, edi
call fcn.00482f74
mov ebx, eax
xor bl, byte [esi]
mov edx, ebx
mov eax, edi
call fcn.00482f18
mov byte [esi], bl
inc esi
dec dword [ebp - 8]
jne 0x483088
mov bl, byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4830c4
lea eax, [ebp - 4]
call fcn.00404c58
ret
Function at 0x483ca4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x483e88
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
jle 0x483e44
mov eax, dword [ebp - 4]
call fcn.00485624
cmp ebx, eax
jge 0x483e44
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x118]
mov edx, ebx
call fcn.0047a270
mov edx, dword [0x47bdec]
call fcn.00404004
mov esi, eax
mov eax, esi
call fcn.0047ccec
test al, al
je 0x483e3a
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov edi, dword [esi + 0x44]
test edi, edi
jne 0x483e2e
xor eax, eax
push ebp
push 0x483e27
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0048425c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
call fcn.0041b19c
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push dword [esi + 0x34]
push dword [esi + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
lea edx, [ebp - 0x46]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, 0x2e
mov esi, dword [eax]
call dword [esi + 0xc]
movzx eax, word [ebp - 0x2a]
movzx edx, word [ebp - 0x28]
add eax, edx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x18]
movzx esi, word [ebp - 0x26]
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.004052a4
mov eax, dword [ebp - 8]
call fcn.00405170
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, esi
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
mov al, byte [eax + 0x28]
mov byte [ebp - 9], al
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00484020
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
mov dl, byte [ebp - 9]
mov byte [eax + 0x28], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x483e72
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
jne 0x483e26
mov eax, dword [ebp - 4]
call fcn.004842e4
ret
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.0040a364
jmp 0x483e72
mov eax, dword [ebp - 8]
call fcn.00404c58
jmp 0x483e72
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x4c], 0
lea eax, [ebp - 0x50]
push eax
push 0
lea edx, [ebp - 0x54]
mov eax, 0xb3
call fcn.00409894
mov ecx, dword [ebp - 0x54]
mov dl, 1
mov eax, dword [0x416f70]
call fcn.0040d390
call fcn.004045e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x483e8f
lea eax, [ebp - 0x54]
call fcn.00404c58
ret
Function at 0x488a70
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x488b4b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x4c70d8
mov ecx, 0xff
mov edx, pe_nt_image_headers32
call fcn.004036cc
lea eax, [ebp - 8]
mov edx, 0x488b64
call fcn.00404cf0
mov word [ebp - 2], 0
mov eax, dword [ebp - 8]
call fcn.00404f18
mov edi, eax
xor ecx, ecx
mov ebx, 0x4c70d8
lea esi, [ebp - 0x108]
mov byte [ebx], cl
xor eax, eax
mov al, cl
movzx edx, di
push ecx
mov ecx, edx
xor edx, edx
div ecx
pop ecx
mov eax, dword [ebp - 8]
mov al, byte [eax + edx]
mov byte [esi], al
inc ecx
inc esi
inc ebx
test cl, cl
jne 0x488acd
mov cl, 0
mov eax, 0x4c70d8
lea esi, [ebp - 0x108]
movzx ebx, word [ebp - 2]
mov dl, byte [eax]
mov edi, edx
and edi, 0xff
add ebx, edi
movzx edi, byte [esi]
add ebx, edi
and ebx, 0xff
mov word [ebp - 2], bx
movzx ebx, word [ebp - 2]
mov bl, byte [ebx + 0x4c70d8]
mov byte [eax], bl
movzx ebx, word [ebp - 2]
mov byte [ebx + 0x4c70d8], dl
inc esi
inc eax
dec cl
jne 0x488afa
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x488b52
lea eax, [ebp - 8]
call fcn.00404c58
ret

Function at 0x488b7c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov dword [esp + 4], edx
mov dword [esp], eax
mov byte [esp + 8], 0
xor esi, esi
xor eax, eax
cmp dword [esp + 4], 0
jbe 0x488c07
mov edx, dword [esp + 4]
dec edx
test edx, edx
jb 0x488c02
inc edx
mov dword [esp + 0xc], edx
xor edx, edx
inc esi
and esi, 0xff
cmp esi, 0xff
ja 0x488c07
xor ecx, ecx
mov cl, byte [esi + 0x4c70d8]
lea eax, [ecx + eax]
and eax, 0xff
cmp eax, 0xff
ja 0x488c07
xor ebx, ebx
mov bl, byte [eax + 0x4c70d8]
add ecx, ebx
and ecx, 0xff
cmp edx, dword [esp + 4]
ja 0x488c07
cmp ecx, 0xff
ja 0x488c07
mov ebx, dword [esp]
lea edi, [ebx + edx]
mov cl, byte [ecx + 0x4c70d8]
xor byte [edi], cl
inc edx
dec dword [esp + 0xc]
jne 0x488ba9
mov byte [esp + 8], 1
mov al, byte [esp + 8]
add esp, 0x10
pop edi
pop esi
pop ebx
ret

Function at 0x489bd0
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, dword [0x4c51f8]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x489be4
Capabilities:
Hide graphical window

Disassembly:
push 9
mov eax, dword [0x4c51f8]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x4c51f8]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_SetForegroundWindow
mov eax, dword [0x4c51f8]
mov eax, dword [eax]
cmp byte [eax + 0x5b], 0
jne 0x489c39
mov eax, dword [0x4c51f8]
mov eax, dword [eax]
mov byte [eax + 0x5b], 1
mov eax, dword [0x4c51f8]
mov eax, dword [eax]
mov eax, dword [eax + 0x44]
test eax, eax
je 0x489c39
mov edx, dword [0x4c51f8]
mov dl, 1
call fcn.0045a6d0
ret
Function at 0x48e2d4
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x48e3af
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x4c829c
mov ecx, 0xff
mov edx, pe_nt_image_headers32
call fcn.004036cc
lea eax, [ebp - 8]
mov edx, 0x48e3c8
call fcn.00404cf0
mov word [ebp - 2], 0
mov eax, dword [ebp - 8]
call fcn.00404f18
mov edi, eax
xor ecx, ecx
mov ebx, 0x4c829c
lea esi, [ebp - 0x108]
mov byte [ebx], cl
xor eax, eax
mov al, cl
movzx edx, di
push ecx
mov ecx, edx
xor edx, edx
div ecx
pop ecx
mov eax, dword [ebp - 8]
mov al, byte [eax + edx]
mov byte [esi], al
inc ecx
inc esi
inc ebx
test cl, cl
jne 0x48e331
mov cl, 0
mov eax, 0x4c829c
lea esi, [ebp - 0x108]
movzx ebx, word [ebp - 2]
mov dl, byte [eax]
mov edi, edx
and edi, 0xff
add ebx, edi
movzx edi, byte [esi]
add ebx, edi
and ebx, 0xff
mov word [ebp - 2], bx
movzx ebx, word [ebp - 2]
mov bl, byte [ebx + 0x4c829c]
mov byte [eax], bl
movzx ebx, word [ebp - 2]
mov byte [ebx + 0x4c829c], dl
inc esi
inc eax
dec cl
jne 0x48e35e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48e3b6
lea eax, [ebp - 8]
call fcn.00404c58
ret

Function at 0x48e3e4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov dword [esp + 4], edx
mov dword [esp], eax
mov byte [esp + 8], 0
xor esi, esi
xor eax, eax
cmp dword [esp + 4], 0
jbe 0x48e46f
mov edx, dword [esp + 4]
dec edx
test edx, edx
jb 0x48e46a
inc edx
mov dword [esp + 0xc], edx
xor edx, edx
inc esi
and esi, 0xff
cmp esi, 0xff
ja 0x48e46f
xor ecx, ecx
mov cl, byte [esi + 0x4c829c]
lea eax, [ecx + eax]
and eax, 0xff
cmp eax, 0xff
ja 0x48e46f
xor ebx, ebx
mov bl, byte [eax + 0x4c829c]
add ecx, ebx
and ecx, 0xff
cmp edx, dword [esp + 4]
ja 0x48e46f
cmp ecx, 0xff
ja 0x48e46f
mov ebx, dword [esp]
lea edi, [ebx + edx]
mov cl, byte [ecx + 0x4c829c]
xor byte [edi], cl
inc edx
dec dword [esp + 0xc]
jne 0x48e411
mov byte [esp + 8], 1
mov al, byte [esp + 8]
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x48eae0
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd3c
push ebx
xor ecx, ecx
mov dword [ebp - 0x2a4], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405108
xor eax, eax
push ebp
push 0x48ec46
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1a0]
push eax
push 0x101
call sub.ws2_32.dll_WSAStartup
xor edx, edx
push ebp
push 0x48ec1e
push dword fs:[edx]
mov dword fs:[edx], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x2a0]
push eax
call sub.ws2_32.dll_gethostname
lea eax, [ebp - 0x2a0]
mov edx, dword [ebp - 4]
call fcn.0040a1d4
lea eax, [ebp - 0x2a0]
push eax
call sub.ws2_32.dll_gethostbyname
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x48ec07
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x48ec01
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x48ebfb
lea eax, [ebp - 0x2a4]
push eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
mov dword [ebp - 0x2c4], eax
mov byte [ebp - 0x2c0], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + 1]
mov dword [ebp - 0x2bc], eax
mov byte [ebp - 0x2b8], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + 2]
mov dword [ebp - 0x2b4], eax
mov byte [ebp - 0x2b0], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + 3]
mov dword [ebp - 0x2ac], eax
mov byte [ebp - 0x2a8], 0
lea edx, [ebp - 0x2c4]
mov ecx, 3
mov eax, 0x48ec60
call fcn.0040a87c
mov edx, dword [ebp - 0x2a4]
mov eax, ebx
call fcn.00404cac
mov byte [ebp - 5], 1
jmp 0x48ec0b
mov byte [ebp - 5], 0
jmp 0x48ec0b
mov byte [ebp - 5], 0
jmp 0x48ec0b
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48ec25
call sub.ws2_32.dll_WSACleanup
ret
Function at 0x48eec0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov word [ebp - 6], cx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00405108
xor eax, eax
push ebp
push 0x48ef9d
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
cmp dword [edi + 0x34], 0
jne 0x48ef87
mov byte [edi + 0x3c], 0
push 0
push 1
push 2
call sub.ws2_32.dll_socket
mov esi, eax
mov dword [edi + 0x30], esi
mov eax, esi
xor edx, edx
cmp edx, 0xffffffff
jne 0x48ef23
cmp eax, 0xffffffff
jne 0x48ef23
push esi
call sub.ws2_32.dll_closesocket
call sub.ws2_32.dll_WSACleanup
jmp 0x48ef87
mov word [ebp - 0x1c], 2
mov ax, word [ebp - 6]
push eax
call sub.ws2_32.dll_htons
mov word [ebp - 0x1a], ax
mov eax, dword [ebp - 4]
call fcn.00405118
push eax
call sub.ws2_32.dll_inet_addr
mov dword [ebp - 0x18], eax
mov byte [edi + 0x3c], 1
mov dword [ebp - 0xc], 1
lea eax, [ebp - 0xc]
push eax
push 0x8004667e
mov eax, dword [edi + 0x30]
push eax
call sub.ws2_32.dll_ioctlsocket
push 0x10
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [edi + 0x30]
push eax
call sub.ws2_32.dll_connect
mov ecx, edi
mov dl, 1
mov eax, dword [0x48e910]
call fcn.0048ec6c
mov dword [edi + 0x34], eax
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48efa4
lea eax, [ebp - 4]
call fcn.00404c58
ret

Function at 0x48efb0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe70
push ebx
push esi
push edi
test dl, dl
je 0x48efc8
add esp, 0xfffffff0
call fcn.00404180
mov ebx, edx
mov edi, eax
mov si, 0xfa0
mov word [edi + 0x44], si
movzx eax, si
push eax
lea eax, [edi + 0x40]
mov ecx, 1
mov edx, dword [0x48e878]
call fcn.0040604c
add esp, 4
mov dl, 1
mov eax, dword [0x472784]
call fcn.004728ac
mov dword [edi + 0x38], eax
lea eax, [ebp - 0x190]
push eax
push 0x202
call sub.ws2_32.dll_WSAStartup
test eax, eax
je 0x48f017
call sub.ws2_32.dll_WSACleanup
mov eax, edi
test bl, bl
je 0x48f02c
call fcn.004041d8
pop dword fs:[0]
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret