joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e1fec
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
cmp byte [ebp - 5], 0
je 0x4e2007
mov dword [ebp - 0x10], 1
jmp 0x4e200c
xor eax, eax
mov dword [ebp - 0x10], eax
push 4
lea eax, [ebp - 0x10]
push eax
push 8
push 0xffff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x20]
push eax
call sub.wsock32.dll_setsockopt
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x4e2030
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4e20d1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
call fcn.00404880
push eax
call sub.wsock32.dll_gethostbyname
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4e20ae
lea eax, [ebp - 0x14]
push eax
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x24]
mov ecx, 1
mov eax, 0x4e20e8
call fcn.0040a55c
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
add eax, 4
call fcn.00404414
mov dword [ebp - 8], 0xffffffff
jmp 0x4e20bb
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e20d8
lea eax, [ebp - 0x14]
call fcn.004043c0
ret

Function at 0x4e2494
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4e253d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
add eax, 4
call fcn.004043c0
push 0
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
add eax, edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x20]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x4e2527
lea eax, [ebp - 0x14]
push eax
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x24]
mov ecx, 1
mov eax, 0x4e2558
call fcn.0040a55c
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
add eax, 4
call fcn.00404414
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e2544
lea eax, [ebp - 0x14]
call fcn.004043c0
ret
Function at 0x4e2590
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4e2639
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
add eax, 4
call fcn.004043c0
push 0
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
add eax, edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x20]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x4e2623
lea eax, [ebp - 0x14]
push eax
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x24]
mov ecx, 1
mov eax, 0x4e2654
call fcn.0040a55c
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
add eax, 4
call fcn.00404414
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e2640
lea eax, [ebp - 0x14]
call fcn.004043c0
ret
Function at 0x4e9e24
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
call fcn.00405b5c
mov eax, dword [ebp + 0xc]
call fcn.00405b5c
xor eax, eax
push ebp
push 0x4e9eab
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
dec eax
test eax, eax
jl 0x4e9e8a
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
mov al, byte [edx + eax]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
xor al, byte [edx + ecx]
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x10]
mov byte [edx + ecx], al
inc dword [ebp - 0x10]
dec dword [ebp - 0x14]
jne 0x4e9e64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e9eb2
lea eax, [ebp + 0xc]
mov edx, dword [0x4b8420]
mov ecx, 2
call fcn.00404fb8
ret

Function at 0x4e9eb8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00405b5c
mov eax, dword [ebp - 0xc]
call fcn.00405b5c
xor eax, eax
push ebp
push 0x4e9f33
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
dec eax
test eax, eax
jl 0x4e9f12
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov al, byte [eax + edx]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor byte [edx + ecx], al
inc dword [ebp - 0x10]
dec dword [ebp - 0x14]
jne 0x4e9ef8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e9f3a
lea eax, [ebp - 0xc]
mov edx, dword [0x4b8420]
mov ecx, 2
call fcn.00404fb8
ret
Function at 0x4ea60c
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
jl 0x4ea62d
cmp dword [ebp - 8], 0x13
jg 0x4ea62d
mov dword [ebp - 0xc], 0x5a827999
jmp 0x4ea671
cmp dword [ebp - 8], 0x14
jl 0x4ea642
cmp dword [ebp - 8], 0x27
jg 0x4ea642
mov dword [ebp - 0xc], 0x6ed9eba1
jmp 0x4ea671
cmp dword [ebp - 8], 0x28
jl 0x4ea657
cmp dword [ebp - 8], 0x3b
jg 0x4ea657
mov dword [ebp - 0xc], 0x8f1bbcdc
jmp 0x4ea671
cmp dword [ebp - 8], 0x3c
jl 0x4ea66c
cmp dword [ebp - 8], 0x4f
jg 0x4ea66c
mov dword [ebp - 0xc], 0xca62c1d6
jmp 0x4ea671
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x4ea714
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x10
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov ecx, dword [edx + eax*4 + 0xc]
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
xor ecx, dword [edx + eax*4 - 8]
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
xor ecx, dword [edx + eax*4 - 0x20]
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
xor ecx, dword [edx + eax*4 - 0x28]
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004ea5dc
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [ecx + edx*4 + 0x18], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x50
jne 0x4ea725
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
mov edx, 5
mov eax, dword [ebp - 4]
call fcn.004ea5dc
mov ebx, eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004ea678
add ebx, eax
add ebx, dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
add ebx, dword [edx + eax*4 + 0x18]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004ea60c
add ebx, eax
mov dword [ebp - 0x20], ebx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x10]
mov edx, 0x1e
mov eax, dword [ebp - 4]
call fcn.004ea5dc
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x50
jne 0x4ea79f
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
add dword [edx + 4], eax
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
add dword [edx + 8], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
add dword [edx + 0xc], eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 4]
add dword [edx + 0x10], eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 4]
add dword [edx + 0x14], eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x502ac8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push eax
push 1
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
push eax
call sub.IMAGEHLP.DLL_ImageDirectoryEntryToData
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x502b94
jmp 0x502b18
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x14]
add eax, dword [edx + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_lstrcmpiA
test eax, eax
je 0x502b21
add dword [ebp - 0x14], 0x14
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0xc], 0
jne 0x502af7
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0xc], 0
je 0x502b94
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x14]
add eax, dword [edx + 0x10]
mov dword [ebp - 0x1c], eax
jmp 0x502b8c
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
cmp eax, dword [ebp - 8]
sete al
neg al
sbb eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x502b88
lea eax, [ebp - 0x28]
push eax
push 0x40
push 4
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_VirtualProtectEx
lea eax, [ebp - 0x28]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_WriteProcessMemory
jmp 0x502b94
add dword [ebp - 0x1c], 4
mov eax, dword [ebp - 0x1c]
cmp dword [eax], 0
jne 0x502b38
mov esp, ebp
pop ebp
ret 4
Function at 0x505da0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x74]
sub edi, dword [ebx + 0x6c]
jmp 0x505dcd
mov eax, dword [ebx + 0x2c]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x6c]
ja 0x505e4c
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.00504554
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], ebp
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x505e1a
mov cx, word [esp]
sub cx, si
jmp 0x505e1c
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x505e03
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x505e42
mov cx, word [esp]
sub cx, si
jmp 0x505e44
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x505e2b
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x505ea9
mov edx, dword [ebx + 0x38]
mov ecx, edi
add edx, dword [ebx + 0x6c]
mov eax, ebp
add edx, dword [ebx + 0x74]
call fcn.00505a74
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x505e94
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x6c]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x505ea9
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x505daa
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x50c0ac
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
jmp 0x50c17c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
add eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
add eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
jne 0x50c16b
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, dword [ebp + 8]
mov dword [ebp - 8], eax
jmp 0x50c16b
lea eax, [ebp - 0x18]
push eax
push 0x40
push 4
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x50c163
mov eax, dword [ebp - 8]
test byte [eax + 3], 0x80
je 0x50c136
mov eax, dword [ebp - 8]
mov eax, dword [eax]
and eax, 0xffff
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
jmp 0x50c150
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
add eax, dword [edx]
add eax, 2
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 4
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_VirtualProtect
add dword [ebp - 8], 4
add dword [ebp - 0xc], 4
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x50c0fd
mov eax, dword [ebp - 4]
add eax, 0x14
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x50c192
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
jne 0x50c0bd
mov esp, ebp
pop ebp
ret 8
Function at 0x50c248
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
push 0x40
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
jne 0x50c405
mov eax, dword [ebp - 0x14]
cmp word [eax], 0x5a4d
jne 0x50c405
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x3c]
add eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
push 0xf8
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
jne 0x50c405
mov eax, dword [ebp - 0x18]
cmp dword [eax], 0x4550
jne 0x50c405
xor eax, eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
add eax, 0xf8
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x50c405
push 0x40
push 0x3000
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x24]
push eax
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x50c405
mov eax, dword [ebp - 0x18]
movzx eax, word [eax + 6]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
shl eax, 3
lea eax, [eax + eax*4]
add ecx, eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x30]
call fcn.0040792c
mov ecx, dword [ebp - 0x24]
dec ecx
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x28]
xor edx, edx
call fcn.0040792c
mov eax, dword [ebp - 0x20]
dec eax
test eax, eax
jl 0x50c371
inc eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0x10]
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax + 0x14]
add edx, dword [ebp - 4]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0xc]
add eax, dword [ebp - 0x30]
call fcn.0040792c
mov eax, dword [ebp - 0x1c]
add eax, 0x28
mov dword [ebp - 0x1c], eax
inc dword [ebp - 0x2c]
dec dword [ebp - 0x34]
jne 0x50c343
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0xa0], 0
je 0x50c3a1
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xa4]
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0xa0]
add ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x34]
mov edx, dword [ebp - 0x30]
call fcn.0050c198
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x80]
add eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x30]
push eax
call fcn.0050c0ac
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x28]
add eax, dword [ebp - 0x30]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x28], 0
je 0x50c3ff
xor eax, eax
push ebp
push 0x50c3f5
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x50c3eb
push 0
push 1
mov eax, dword [ebp - 0x30]
push eax
call dword [ebp - 0x10]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x50c3ff
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x50d628
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00404870
xor eax, eax
push ebp
push 0x50d76b
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
call fcn.00409964
test al, al
je 0x50d74d
mov edx, 0x40
mov eax, dword [ebp - 8]
call fcn.004097d4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x50d74d
mov ecx, 2
xor edx, edx
mov eax, dword [ebp - 0x14]
call fcn.004098b0
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jns 0x50d69a
add eax, 3
sar eax, 2
shl eax, 2
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
call fcn.0040283c
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov edx, dword [ebp - 0x1c]
call fcn.00402f00
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x14]
call fcn.004098b0
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
call fcn.00409858
mov eax, dword [ebp - 0x14]
call fcn.004098f4
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x28], eax
lea edx, [ebp - 0x30]
mov eax, 4
call fcn.004093ec
mov ecx, dword [ebp - 0x30]
mov dl, 1
mov eax, dword [0x407f88]
call fcn.0040d108
mov eax, dword [ebp - 0x1c]
test eax, eax
jns 0x50d70e
add eax, 3
sar eax, 2
dec eax
test eax, eax
jl 0x50d73a
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
xor dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
add eax, 4
mov dword [ebp - 0x24], eax
inc dword [ebp - 0x10]
dec dword [ebp - 0x2c]
jne 0x50d721
mov eax, dword [ebp - 0x20]
call fcn.0040285c
mov eax, dword [ebp - 0x28]
cdq
xor eax, edx
sub eax, edx
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50d772
lea eax, [ebp - 0x30]
call fcn.004043c0
lea eax, [ebp - 8]
call fcn.004043c0
ret
Function at 0x50d7ec
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
xor ebx, ebx
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 0x128], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x50d997
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov edx, 0x50d9ac
call fcn.00404414
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
call fcn.00404880
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x50d971
mov eax, dword [ebp - 0x10]
call fcn.00408cb0
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x50d96a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
call fcn.00404880
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x50d94e
xor eax, eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x50d9b0
mov eax, dword [ebp - 0x18]
push eax
call sub.version.dll_VerQueryValueA
cmp dword [ebp - 0x1c], 0
je 0x50d8cd
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
call fcn.00407920
mov edx, dword [ebp - 0x1c]
mov dx, word [edx]
call fcn.00407914
lea ecx, [ebp - 0x24]
mov edx, 8
call fcn.00409500
push 0x50d9d4
push dword [ebp - 0x24]
push 0x50d9f0
lea eax, [ebp - 0x128]
mov edx, 3
call fcn.00404740
mov edx, dword [ebp - 0x128]
lea eax, [ebp - 0x124]
call fcn.00409f18
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x124]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x50d94e
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
call fcn.0040a06c
mov al, byte [0x50da00]
push eax
lea eax, [ebp - 0x12c]
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
xor ecx, ecx
mov edx, 0x50da0c
call fcn.0040e664
mov edx, dword [ebp - 0x12c]
mov eax, dword [ebp - 0xc]
call fcn.00404414
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50d971
cmp dword [ebp - 0x18], 0
je 0x50d969
mov eax, dword [ebp - 0x18]
call fcn.0040285c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50d99e
lea eax, [ebp - 0x12c]
mov edx, 2
call fcn.004043e4
lea eax, [ebp - 0x24]
call fcn.004043c0
ret

Function at 0x50df50
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c]
mov edx, dword [eax]
call dword [edx + 0x44]
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
mov dword [edx + 0x38], eax
mov eax, dword [ebp - 4]
add eax, 0x10
call fcn.004043c0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x80]
push eax
call sub.kernel32.dll_ResumeThread
mov dl, 3
mov eax, dword [ebp - 4]
call fcn.0050ea18
pop ecx
pop ebp
ret