joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f1680
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x54
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x50], edx
mov dword [eax - 4], esp
or dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x504a90
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov ecx, dword [ebp + 0x10]
mov dword fs:[0], eax
mov eax, 0x7fffffff
mov esi, dword [edx + 8]
mov edi, dword [edx + 0xc]
cmp ecx, eax
cmovb eax, ecx
mov ecx, dword [edx + 0x10]
mov dword [ebp - 0x58], esi
lea esi, [ebp - 0x2c]
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x48], ecx
mov edx, dword [ebp - 0x58]
mov ecx, esi
push dword [ebp + 8]
call fcn.004f1364
pop eax
mov edx, dword [ebp - 0x2c]
cmp edx, 2
je 0x4f1814
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
test edx, edx
jne 0x4f181c
cmp edi, 0xffffffff
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x5c], eax
je 0x4f1847
push 0
push dword [ebp - 0x54]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ws2_32.dll_send]
cmp eax, 0xffffffff
je 0x4f172b
mov byte [ebp - 0x34], 4
mov dword [ebp - 0x30], eax
jmp 0x4f17c9
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
and word [ebp - 0x33], 0
mov esi, eax
xor eax, eax
lea ecx, [ebp - 0x34]
mov byte [ebp - 0x31], al
mov byte [ebp - 0x34], al
mov dword [ebp - 0x30], esi
call fcn.0043cb60
mov edi, dword [ebp - 0x48]
cmp al, 0xd
jne 0x4f17c9
test edi, edi
je 0x4f17be
mov eax, dword [edi + 4]
mov dword [ebp - 0x38], esi
mov edx, dword [edi]
lea ecx, [ebp - 0x2c]
lock inc dword [eax]
jle 0x4f1851
mov esi, dword [edi + 8]
mov edi, dword [edi + 0xc]
add edx, 8
mov dword [ebp - 0x10], 1
push edi
push esi
push eax
call fcn.004682f0
add esp, 0xc
mov eax, dword [ebp - 0x38]
and dword [ebp - 0x10], 0
mov dword [ebp - 0x3c], eax
push 4
pop ecx
call fcn.004cb5e1
cmp byte [ebp - 0x2c], 4
je 0x4f17c9
mov ebx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x38]
cmp bl, 4
je 0x4f17c9
mov esi, dword [ebp - 0x28]
or dword [ebp - 0x10], 0xffffffff
xor ecx, ecx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], esi
call fcn.004cb5e1
jmp 0x4f17da
and dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], 4
mov ebx, dword [ebp - 0x34]
mov esi, dword [ebp - 0x30]
cmp bl, 4
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x44], ebx
je 0x4f1826
lea ecx, [ebp - 0x44]
call fcn.004e9574
cmp al, 0xd
jne 0x4f182e
mov ecx, dword [ebp - 0x50]
lea edx, [ebp - 0x60]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x10], 2
call fcn.004f1080
or dword [ebp - 0x10], 0xffffffff
lea esi, [ebp - 0x2c]
push esi
call fcn.004e8690
pop eax
mov edi, dword [ebp - 0x4c]
jmp 0x4f16d4
mov eax, dword [ebp - 0x20]
mov byte [eax], 5
jmp 0x4f1836
mov edx, dword [ebp - 0x20]
mov dword [edx], ecx
mov dword [edx + 4], eax
jmp 0x4f1836
mov eax, dword [ebp - 0x20]
mov byte [eax], 4
jmp 0x4f1833
mov eax, dword [ebp - 0x20]
mov dword [eax], ebx
mov dword [eax + 4], esi
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x5805ec
call fcn.00526c90
ud2
Function at 0x4f40e2
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, esp
mov dword [esi + 0x28], ebp
lea eax, [esi + 0x30]
mov dword [esi + 0xc], ecx
mov dword [eax - 4], esp
or dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x504b80
mov edx, dword fs:[0]
mov dword [eax], edx
mov dword fs:[0], eax
and dword [eax + 8], 0
call fcn.004ea971
xor ebx, ebx
mov ecx, dword [esi + 0xc]
lea edx, [esi + 0x10]
mov eax, dword [ecx]
mov edi, dword [ecx + 4]
mov dword [edx + 8], ebx
mov ebx, dword [esi + 8]
or dword [esi + 0x38], 0xffffffff
mov dword [edx + 0xc], ebx
mov dword [edx + 0x10], eax
mov dword [edx + 0x14], edi
and dword [edx + 4], 0
mov dword [edx], 1
call fcn.004eaca2
mov eax, dword [esi + 0x30]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4f613c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x44
lea edi, [ebp - 0x18]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], edx
mov dword [edi - 4], esp
or dword [edi + 8], 0xffffffff
mov dword [edi + 4], 0x504bf0
mov eax, dword fs:[0]
mov ecx, esi
mov dword [edi], eax
mov dword fs:[0], edi
call fcn.004efccf
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], edx
lea ecx, [edx + 0xa0]
mov dword [ebp - 0x20], edx
add edx, 0x70
test eax, eax
mov dword [ebp - 0x24], eax
cmove ecx, edx
and dword [edi + 8], 0
mov edx, esi
call fcn.004ec402
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
call fcn.004ea80f
mov ecx, dword [ebp - 0x2c]
xorps xmm0, xmm0
or dword [ebp - 0x10], 0xffffffff
movsd qword [ebp - 0x3c], xmm0
movsd qword [ebp - 0x44], xmm0
movsd qword [ebp - 0x4c], xmm0
movsd xmm0, qword [ebp - 0x50]
movsd xmm1, qword [ebp - 0x40]
mov dword [ecx], eax
mov eax, dword [ebp - 0x28]
mov dword [ecx + 4], edx
mov dword [ecx + 0xc], edi
mov dword [ecx + 8], eax
mov dword [ecx + 0x10], esi
movsd qword [ecx + 0x14], xmm0
movsd xmm0, qword [ebp - 0x48]
mov eax, dword [ebp - 0x38]
movsd qword [ecx + 0x24], xmm1
mov dword [ecx + 0x2c], eax
movsd qword [ecx + 0x1c], xmm0
or dword [ecx + 0x34], 0xffffffff
or dword [ecx + 0x30], 0xffffffff
and dword [ecx + 0x38], 0
and dword [ecx + 0x40], 0
xor eax, eax
mov byte [ecx + 0x44], al
mov byte [ecx + 0x48], al
lea ecx, [ebp - 0x34]
call fcn.004e7db6
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x44
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4fda69
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
lea eax, [ebp - 0x18]
mov dword [ebp - 0x2c], ecx
mov edi, dword [ebp + 8]
mov esi, edx
mov edx, dword [ebp + 0x10]
mov dword [eax - 4], esp
or dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x504c90
mov dword [ebp - 0x20], esi
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
mov ecx, dword [ebp + 0xc]
cmp dword [edi + 8], 0
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], edx
je 0x4fdad3
mov eax, dword [edi + 0xc]
mov edx, dword [edi + 0x18]
mov ecx, dword [edi + 0x14]
and dword [ebp - 0x10], 0
push eax
call fcn.004fdc48
pop ecx
mov dword [ebp - 0x24], eax
mov eax, edx
mov esi, dword [ebp - 0x20]
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
jmp 0x4fdadc
mov eax, dword [edi + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [edi + 0x18]
and dword [ebp - 0x10], 0
sub edx, ecx
mov ecx, esi
mov dword [ebp - 0x28], eax
add edx, eax
call fcn.004f67ef
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
push dword [ebp - 0x28]
call fcn.004f6808
pop eax
push 0x23
pop edx
mov ecx, dword [ebp - 0x20]
call fcn.004f6df0
lea esi, [ebp - 0x34]
mov ecx, esi
call fcn.004f74a7
mov edx, dword [esi]
mov ecx, dword [ebp - 0x20]
push dword [esi + 4]
call fcn.004fdc5e
pop eax
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edx + 8]
movsd xmm0, qword [edx]
mov edx, dword [ebp + 8]
movsd qword [ecx + 0x10], xmm0
movsd xmm0, qword [edx + 0x3c]
mov dword [ecx + 0x18], eax
mov bl, byte [edx + 0x44]
mov edi, dword [edx]
mov esi, dword [edx + 4]
movsd qword [ecx + 0x3c], xmm0
movsd xmm0, qword [edx + 0x34]
mov byte [ecx + 0x44], bl
movsd qword [ecx + 0x34], xmm0
mov dword [ecx], edi
mov dword [ecx + 4], esi
mov edi, dword [ebp - 0x28]
mov esi, dword [edx + 0x1c]
mov dword [ecx + 8], 1
mov dword [ecx + 0xc], edi
mov dword [ecx + 0x1c], esi
mov edi, dword [edx + 0x20]
mov esi, dword [edx + 0x24]
mov dword [ecx + 0x20], edi
mov dword [ecx + 0x24], esi
mov edi, dword [edx + 0x28]
mov esi, dword [edx + 0x2c]
mov edx, dword [edx + 0x30]
mov dword [ecx + 0x28], edi
mov dword [ecx + 0x2c], esi
mov dword [ecx + 0x30], edx
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x504f68
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x1c]
and esi, 0x1f
push edi
mov edi, dword [esp + 0x1c]
cmp esi, 8
jb 0x504ffc
mov eax, esi
shr eax, 3
mov dword [esp + 0x20], eax
cmp dword [esp + 0x24], 1
jne 0x504fae
push 8
lea eax, [esp + 0x18]
push edi
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x20]
add esp, 0xc
mov ecx, dword [esp + 0x18]
jmp 0x504fb3
mov eax, dword [edi]
mov ecx, dword [edi + 4]
push ecx
push eax
push 0
push 0
call fcn.00505134
push 0x1b
xor edx, ebx
xor eax, ebp
push edx
push eax
add edi, 8
call sub.api_ms_win_crt_utility_l1_1_0.dll__rotl64
add esp, 0x1c
push 0x9e3779b1
push 0x85ebca87
push edx
push eax
call fcn.005256e0
mov ebp, eax
mov ebx, edx
add ebp, 0xc2b2ae63
adc ebx, 0x85ebca77
sub esi, 8
sub dword [esp + 0x20], 1
jne 0x504f8d
cmp esi, 4
jb 0x50506f
cmp dword [esp + 0x24], 1
jne 0x50501e
push 4
lea eax, [esp + 0x24]
push edi
push eax
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x2c]
add esp, 0xc
jmp 0x505020
mov ecx, dword [edi]
mov eax, 0x9e3779b1
mov dword [esp + 0x20], ecx
mul ecx
push 0x17
mov ecx, eax
add edi, 4
mov eax, 0x85ebca87
mul dword [esp + 0x24]
add ecx, edx
xor eax, ebp
xor ecx, ebx
push ecx
push eax
call sub.api_ms_win_crt_utility_l1_1_0.dll__rotl64
add esp, 0xc
push 0xc2b2ae3d
push 0x27d4eb4f
push edx
push eax
call fcn.005256e0
mov ebp, eax
mov ebx, edx
add ebp, 0x9e3779f9
adc ebx, 0x165667b1
sub esi, 4
test esi, esi
je 0x5050b3
movzx eax, byte [edi]
push 0x27d4eb2f
cdq
push 0x165667c5
push edx
push eax
call fcn.005256e0
xor ebx, edx
xor ebp, eax
push 0xb
push ebx
push ebp
inc edi
call sub.api_ms_win_crt_utility_l1_1_0.dll__rotl64
add esp, 0xc
push 0x9e3779b1
push 0x85ebca87
push edx
push eax
call fcn.005256e0
mov ebp, eax
mov ebx, edx
sub esi, 1
jne 0x505073
push 0xc2b2ae3d
xor ecx, ecx
mov esi, ebx
push 0x27d4eb4f
xor ecx, ebx
shr esi, 1
push ecx
xor esi, ebp
push esi
call fcn.005256e0
mov esi, eax
mov ecx, edx
shrd esi, ecx, 0x1d
push 0x165667b1
shr ecx, 0x1d
xor esi, eax
push 0x9e3779f9
xor ecx, edx
push ecx
push esi
call fcn.005256e0
xor esi, esi
mov ecx, edx
pop edi
xor edx, esi
xor eax, ecx
pop esi
pop ebp
pop ebx
ret
Function at 0x512ef0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x70
mov eax, dword [0x5c2e80]
xor eax, esp
mov dword [esp + 0x6c], eax
mov edx, dword [esp + 0x84]
mov eax, dword [esp + 0x74]
mov ecx, dword [esp + 0x7c]
push ebx
mov ebx, dword [esp + 0x84]
push ebp
mov ebp, dword [esp + 0x80]
add ecx, ebp
push esi
push edi
mov edi, dword [esp + 0x98]
lea esi, [edx + ebx]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x9c]
mov dword [esp + 0x14], ebx
mov ebx, ebp
mov dword [esp + 0x38], ebp
push edx
lea ebp, [eax + edi]
mov dword [esp + 0x2c], esi
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], edi
lea esi, [eax + 0x1004]
mov dword [esp + 0x30], esi
lea edx, [eax + 0x1004]
mov esi, dword [eax + 0x2810]
lea ecx, [eax + 0x1808]
mov dword [esp + 0x38], esi
mov esi, dword [esp + 0x18]
push esi
push edx
push ecx
push eax
lea eax, [esp + 0x38]
mov dword [esp + 0x44], ecx
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x30]
push eax
call fcn.005133be
add esp, 0x20
cmp eax, 0xffffff88
ja 0x5130d6
push 0xc
add esi, eax
lea eax, [esp + 0x74]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
add eax, ecx
mov dword [esp + 0x74], ecx
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x34]
sub eax, esi
mov dword [esp + 0x70], 1
push eax
lea eax, [esp + 0x4c]
push esi
push eax
call fcn.00512292
add esp, 0x18
cmp eax, 0xfffffff8
ja 0x5130d3
mov eax, dword [esp + 0x10]
push eax
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x54]
push eax
call fcn.00512264
push dword [esp + 0x38]
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x68]
push eax
call fcn.00512264
push dword [esp + 0x48]
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x7c]
push eax
call fcn.00512264
lea eax, [esp + 0x60]
push eax
call fcn.00512631
mov edx, dword [esp + 0x3c]
add esp, 0x28
cmp eax, 2
ja 0x513094
test edx, edx
jle 0x513090
lea eax, [esp + 0x3c]
dec edx
push eax
lea eax, [esp + 0x74]
mov dword [esp + 0x14], edx
push eax
call fcn.00512d0a
pop ecx
pop ecx
push dword [esp + 0x1c]
lea eax, [esp + 0x1c]
push dword [esp + 0x38]
lea esi, [esp + 0x78]
push ebp
push eax
sub esp, 0xc
mov edi, esp
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.005130e9
add esp, 0x20
cmp eax, 0xffffff88
ja 0x5130d6
add ebx, eax
lea eax, [esp + 0x3c]
push eax
call fcn.00512631
mov edx, dword [esp + 0x14]
pop ecx
cmp eax, 2
jbe 0x513038
mov edi, dword [esp + 0x18]
lea eax, [esp + 0x3c]
push eax
call fcn.005085c0
pop ecx
test eax, eax
je 0x5130d3
test edx, edx
js 0x5130d3
sub ebp, edi
lea esi, [ebx + ebp]
cmp esi, dword [esp + 0x1c]
jbe 0x5130b6
push 0xffffffffffffffba
jmp 0x5130d5
test ebp, ebp
je 0x5130cb
cmp ebx, edi
je 0x5130c9
push ebp
push edi
push ebx
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov ebx, esi
sub ebx, dword [esp + 0x38]
mov eax, ebx
jmp 0x5130d6
push 0xffffffffffffffec
pop eax
mov ecx, dword [esp + 0x7c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005256c9
add esp, 0x70
ret
Function at 0x51767a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x68
mov eax, dword [0x5c2e80]
xor eax, esp
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0x74]
mov ecx, dword [esp + 0x7c]
push ebx
push ebp
mov ebp, dword [esp + 0x74]
push esi
mov esi, dword [esp + 0x84]
push edi
mov edi, dword [esp + 0x80]
mov ebx, edi
add eax, edi
mov dword [esp + 0x30], edi
mov edi, dword [ebp + 0x2820]
lea edx, [ecx + esi]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x2824]
add eax, edi
mov dword [esp + 0x28], edx
push ecx
mov dword [esp + 0x1c], eax
lea edx, [ebp + 0x1004]
mov eax, dword [ebp + 0x2810]
push esi
mov dword [esp + 0x34], eax
lea eax, [ebp + 0x1808]
push edx
push eax
push ebp
lea eax, [esp + 0x38]
mov dword [esp + 0x24], edi
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x30]
push eax
call fcn.0051613f
add esp, 0x20
cmp eax, 0xffffff88
ja 0x51784a
push 0xc
add esi, eax
lea eax, [esp + 0x6c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
add eax, ecx
mov dword [esp + 0x6c], ecx
mov dword [esp + 0x70], eax
push 4
pop eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x34]
sub eax, esi
push eax
lea eax, [esp + 0x44]
push esi
push eax
call fcn.00513a18
add esp, 0x18
cmp eax, 0xffffff88
ja 0x517847
push ebp
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x4c]
push eax
call fcn.005140eb
lea eax, [ebp + 0x1004]
push eax
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x60]
push eax
call fcn.005140eb
lea eax, [ebp + 0x1808]
push eax
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x74]
push eax
call fcn.005140eb
lea eax, [esp + 0x58]
push eax
call fcn.00512631
mov ebp, dword [esp + 0x3c]
add esp, 0x28
cmp eax, 2
jg 0x5177fe
test ebp, ebp
jle 0x5177fa
lea eax, [esp + 0x34]
dec ebp
push eax
lea eax, [esp + 0x6c]
push eax
call fcn.0051730f
pop ecx
pop ecx
push dword [esp + 0x1c]
lea eax, [esp + 0x14]
push dword [esp + 0x30]
lea esi, [esp + 0x70]
push dword [esp + 0x20]
push eax
sub esp, 0xc
mov edi, esp
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0051785d
add esp, 0x20
cmp eax, 0xffffff88
ja 0x51784a
add ebx, eax
lea eax, [esp + 0x34]
push eax
call fcn.00512631
pop ecx
cmp eax, 2
jle 0x5177a7
mov edi, dword [esp + 0x10]
lea eax, [esp + 0x34]
push eax
call fcn.005085c0
pop ecx
test eax, eax
je 0x517847
test ebp, ebp
js 0x517847
mov eax, dword [esp + 0x18]
sub eax, edi
cmp edi, dword [esp + 0x18]
ja 0x517847
lea esi, [eax + ebx]
cmp esi, dword [esp + 0x1c]
jbe 0x51782a
push 0xffffffffffffffba
jmp 0x517849
test eax, eax
je 0x51783f
cmp ebx, edi
je 0x51783d
push eax
push edi
push ebx
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov ebx, esi
sub ebx, dword [esp + 0x30]
mov eax, ebx
jmp 0x51784a
push 0xffffffffffffffec
pop eax
mov ecx, dword [esp + 0x74]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005256c9
add esp, 0x68
ret
Function at 0x525cd5
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
test eax, eax
je 0x525d14
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x525d14
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x525d14
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x525d14
cmp dword [ecx + 0x74], 0xe
jbe 0x525d14
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x528cf0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov edi, dword [ebp + 8]
inc edi
sete al
je 0x528e30
mov byte [ebp - 0xd], al
mov dword [ebp - 0x14], ecx
js 0x528e3a
movzx eax, byte [0x5c3018]
mov esi, edx
xor ecx, ecx
mov edx, edi
call fcn.004e33d0
test eax, eax
je 0x528e3f
mov ebx, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x18], eax
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
cmp ebx, 7
ja 0x528d5b
test ebx, ebx
je 0x528d9a
mov eax, ebx
nop dword [eax + eax]
cmp byte [esi], 0
je 0x528d6e
inc esi
dec eax
jne 0x528d50
jmp 0x528d9a
xor ecx, ecx
mov edx, esi
push dword [ebp + 8]
call fcn.0042fd80
add esp, 4
test eax, eax
je 0x528d9a
cmp byte [ebp - 0xd], 0
mov eax, dword [0x57e2f0]
mov edx, dword [ebp - 0x14]
mov ecx, dword [0x57e2f4]
mov dword [edx + 8], ecx
mov dword [edx + 4], eax
mov dword [edx], 1
jne 0x528e28
mov ecx, dword [ebp - 0x18]
jmp 0x528e1e
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], ebx
lea ebx, [ebp - 0x3c]
mov ecx, ebx
call fcn.004201f0
xorps xmm0, xmm0
mov esi, eax
mov edi, edx
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
movups xmmword [ebp - 0x3c], xmm0
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x34], 1
push eax
push ebx
push 0
push esi
call dword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x528df9
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov edx, dword [ebp - 0x14]
mov dword [edx + 8], eax
mov eax, 1
mov dword [edx + 4], 0
jmp 0x528e13
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
mov eax, dword [eax]
movzx eax, word [eax]
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov word [edx + 0xc], ax
xor eax, eax
test edi, edi
mov dword [edx], eax
mov byte [esi], 0
je 0x528e28
mov ecx, esi
mov edx, 1
call fcn.004332a0
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x52be34
call fcn.00526c90
call fcn.00420080
mov ecx, 1
mov edx, edi
call fcn.00526660
int3
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x432030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x407281
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x461124], 0
jne 0x4072bf
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x407295
mov dword [ecx*4 + 0x461120], eax
inc ecx
cmp ecx, 0x100
jl 0x407290
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x4072ec
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x461120]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4072cd
not eax
pop ebp
ret 0xc

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x431030
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x45c008], 0x8088405
inc edx
mov dword [ebx + 0x45c008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cf00
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cf31
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cf19
add dl, dl
jne 0x41cf3c
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cf8d
xor eax, eax
add dl, dl
jne 0x41cf49
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d02a
add dl, dl
jne 0x41cf58
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf63
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf6e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf79
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cf83
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cf28
mov eax, 1
add dl, dl
jne 0x41cf9b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfa6
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cf92
sub eax, ebx
mov ebx, 1
jne 0x41cfd9
mov ecx, 1
add dl, dl
jne 0x41cfbf
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cfca
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cfb6
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf28
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41cff0
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cffb
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cfe7
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf28
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41d04b
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cf28
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret