joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e26dc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x4e2776.0
jmp dword [ecx*4 + 0x4e270f]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x4e2741
sub dl, 8
je 0x4e2750
jmp case.0x4e2776.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4e2384
jmp case.0x4e2776.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4e23dc
jmp case.0x4e2776.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x4e2776.0
movzx ecx, byte [ecx + 0x4e277d]
jmp dword [ecx*4 + 0x4e278e]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4e2488
jmp case.0x4e2776.0
cmp dl, 3
jne 0x4e27bb
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4e24e0
jmp case.0x4e2776.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4e249c
jmp case.0x4e2776.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4e2524
jmp case.0x4e2776.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x4e27e6
sub dl, 8
je 0x4e27f2
jmp case.0x4e2776.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4e2550
jmp case.0x4e2776.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4e25bc
jmp case.0x4e2776.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x4e2811
sub dl, 8
je 0x4e281d
jmp case.0x4e2776.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4e2678
jmp case.0x4e2776.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4e26a0
mov edx, dword [eax + 0x468]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x450]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 8], esi
add edx, dword [eax + 0x44c]
mov dword [ebp - 0x10], edx
mov esi, ecx
test esi, esi
jb 0x4e28bf
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004e1888
test eax, eax
je 0x4e28bf
mov eax, ebx
call fcn.004e28c8
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x4e2858
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4e28c8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x4e28f9
dec al
je 0x4e2934
dec al
je 0x4e2979
dec al
je 0x4e29e2
jmp 0x4e2a6c
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x4e2a6c
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4e2909
jmp 0x4e2a6c
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4e2a6c
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4e2944
jmp 0x4e2a6c
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4e2a6c
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x4e29a8
xor ebp, ebp
jmp 0x4e29b8
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4e29c1
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4e2989
jmp 0x4e2a6c
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4e2a6c
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x4e2a3b
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.004df958
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4e29f6
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4047d0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
push 0
push 0
push 4
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esp, ebp
pop ebp
ret 4

Function at 0x404850
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x5a7634]
xor eax, ebp
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x12c], ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x10], eax
push 0x104
lea eax, [ebp - 0x120]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 3
lea edx, [ebp - 0x120]
push edx
mov ecx, dword [ebp - 0x12c]
call fcn.00404770
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0xffffffff
jne 0x4048b4
xor al, al
jmp 0x4049a0
push 0
mov eax, dword [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x124]
push ecx
mov ecx, dword [ebp - 0x12c]
call fcn.004047a0
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0xffffffff
jne 0x404902
push 0
push 0x5567f4
push str.CreateMapFile_fail
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor al, al
jmp 0x4049a0
mov edx, dword [ebp - 0x128]
push edx
mov ecx, dword [ebp - 0x12c]
call fcn.004047d0
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x404921
xor al, al
jmp 0x4049a0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x12c]
call fcn.004047f0
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
sub edx, ecx
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 0
jg 0x40495f
push 0
push 0x556814
push 0x556820
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor al, al
jmp 0x4049a0
push 3
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0042ced0
add esp, 0xc
mov edx, dword [ebp - 0x12c]
mov dword [edx + 0x30], eax
mov eax, dword [ebp - 0x12c]
cmp dword [eax + 0x30], 0xffffffff
jne 0x40499e
push 0
push 0x556840
push str.OpenZip
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor al, al
jmp 0x4049a0
mov al, 1
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0052c40e
mov esp, ebp
pop ebp
ret

Function at 0x410700
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x16c
mov eax, dword [0x5a7634]
xor eax, ebp
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x16c], ecx
push 0x104
lea eax, [ebp - 0x168]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x44
push 0
lea ecx, [ebp - 0x58]
push ecx
call fcn.0052c7f0
add esp, 0xc
mov dword [ebp - 0x58], 0x44
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x58]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x168]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ecx, dword [ebp - 0x5c]
xor ecx, ebp
call fcn.0052c40e
mov esp, ebp
pop ebp
ret
Function at 0x410a60
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x546a23
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x5a7634]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
push 0
push 0
call dword [sym.imp.WININET.dll_FindFirstUrlCacheEntryA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x410bb6
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.0042d5c4
add esp, 4
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x20]
push edx
push 0
call dword [sym.imp.WININET.dll_FindFirstUrlCacheEntryA]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
mov byte [ebp - 0x21], 0
movzx edx, byte [ebp - 0x21]
test edx, edx
jne 0x410b72
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.WININET.dll_FindNextUrlCacheEntryA]
test eax, eax
je 0x410b26
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
jmp 0x410b70
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0x7a
je 0x410b37
jmp 0x410b6c
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
push eax
call fcn.0042d5b9
add esp, 4
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.0042d5c4
add esp, 4
mov dword [ebp - 0x44], eax
mov edx, dword [ebp - 0x44]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x20], ecx
jmp 0x410b70
mov byte [ebp - 0x21], 1
jmp 0x410af9
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.WININET.dll_FindCloseUrlCache]
jmp 0x410b9d
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
push eax
call fcn.0042d5b9
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x416e20
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x5a7634]
xor eax, ebp
mov dword [ebp - 0x24], eax
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jl 0x416f5b
lea eax, [ebp - 8]
push eax
push 0x582718
push 1
push 0
push 0x582868
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jl 0x416f55
call fcn.00403a90
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], 0
jne 0x416e87
mov dword [ebp - 0x28], 0
jmp 0x416ed4
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x3fffffff
jle 0x416ea9
mov dword [ebp - 0x2c], 0
jmp 0x416ece
mov eax, dword [ebp - 0xc]
shl eax, 1
call fcn.0052d260
mov dword [ebp - 0x30], esp
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x30]
push eax
call fcn.00417540
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [edx + 0x50]
call ecx
cmp dword [ebp + 0x10], 0
je 0x416f06
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ecx + 0x44]
call eax
lea ecx, [ebp - 0x20]
push ecx
push 0x5827f8
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [eax]
call edx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jl 0x416f47
push 0
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [edx + 0x18]
call ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [eax + 8]
call edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ecx + 8]
call eax
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
lea esp, [ebp - 0x30]
mov ecx, dword [ebp - 0x24]
xor ecx, ebp
call fcn.0052c40e
mov esp, ebp
pop ebp
ret
Function at 0x416f70
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38c
mov eax, dword [0x5a7634]
xor eax, ebp
mov dword [ebp - 8], eax
push edi
cmp dword [ebp + 8], 0
je 0x416f90
cmp dword [ebp + 0xc], 0
jne 0x416f97
xor al, al
jmp 0x417174
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x364], eax
lea ecx, [ebp - 0x360]
mov dword [ebp - 0x368], ecx
mov edx, dword [ebp - 0x368]
mov dword [ebp - 0x36c], edx
mov eax, dword [ebp - 0x364]
mov cl, byte [eax]
mov byte [ebp - 0x36d], cl
mov edx, dword [ebp - 0x368]
mov al, byte [ebp - 0x36d]
mov byte [edx], al
mov ecx, dword [ebp - 0x364]
add ecx, 1
mov dword [ebp - 0x364], ecx
mov edx, dword [ebp - 0x368]
add edx, 1
mov dword [ebp - 0x368], edx
cmp byte [ebp - 0x36d], 0
jne 0x416fb8
lea eax, [ebp - 0x360]
add eax, 0xffffffff
mov dword [ebp - 0x374], eax
mov ecx, dword [ebp - 0x374]
mov dl, byte [ecx + 1]
mov byte [ebp - 0x375], dl
add dword [ebp - 0x374], 1
cmp byte [ebp - 0x375], 0
jne 0x41700a
mov edi, dword [ebp - 0x374]
mov eax, dword [0x557ca4]
mov dword [edi], eax
mov cx, word [0x557ca8]
mov word [edi + 4], cx
mov dl, byte [0x557caa]
mov byte [edi + 6], dl
lea eax, [ebp - 0x148]
push eax
lea ecx, [ebp - 0x360]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x41706e
xor al, al
jmp 0x417174
mov dword [ebp - 0x254], 0
lea edx, [ebp - 0x148]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x417172
push 0x104
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x11c]
push edx
call fcn.00417190
add esp, 0xc
movzx eax, al
test eax, eax
je 0x41714e
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x37c], ecx
lea edx, [ebp - 0x250]
mov dword [ebp - 0x380], edx
mov eax, dword [ebp - 0x380]
mov cl, byte [eax]
mov byte [ebp - 0x381], cl
mov edx, dword [ebp - 0x37c]
cmp cl, byte [edx]
jne 0x41712a
cmp byte [ebp - 0x381], 0
je 0x41711e
mov eax, dword [ebp - 0x380]
mov cl, byte [eax + 1]
mov byte [ebp - 0x382], cl
mov edx, dword [ebp - 0x37c]
cmp cl, byte [edx + 1]
jne 0x41712a
add dword [ebp - 0x380], 2
add dword [ebp - 0x37c], 2
cmp byte [ebp - 0x382], 0
jne 0x4170cc
mov dword [ebp - 0x388], 0
jmp 0x417135
sbb eax, eax
sbb eax, 0xffffffff
mov dword [ebp - 0x388], eax
mov ecx, dword [ebp - 0x388]
mov dword [ebp - 0x38c], ecx
cmp dword [ebp - 0x38c], 0
jne 0x41714e
mov al, 1
jmp 0x417174
mov edx, dword [ebp - 0x254]
add edx, 1
mov dword [ebp - 0x254], edx
cmp dword [ebp - 0x254], 0x3e8
jle 0x41716d
xor al, al
jmp 0x417174
jmp 0x417078
xor al, al
pop edi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0052c40e
mov esp, ebp
pop ebp
ret

Function at 0x423c30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
add eax, 0x78
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esp, ebp
pop ebp
ret
Function at 0x425180
Capabilities:
Check for time delay via gettickcount
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x5a7634]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x120], 0
mov eax, dword [ebp - 0x134]
cmp dword [eax + 0x28], 0xffffffff
jne 0x4251b9
mov eax, 0xfffffffe
jmp 0x425394
mov dword [ebp - 0x124], 0
jmp 0x4251d4
mov ecx, dword [ebp - 0x124]
add ecx, 1
mov dword [ebp - 0x124], ecx
mov edx, dword [ebp - 0x124]
cmp edx, dword [ebp - 0x120]
jae 0x4251fe
mov eax, dword [ebp - 0x124]
mov ecx, dword [ebp - 0x134]
mov edx, dword [ebp + eax*4 - 0x11c]
cmp edx, dword [ecx + 0x28]
jne 0x4251fc
jmp 0x4251fe
jmp 0x4251c5
mov eax, dword [ebp - 0x124]
cmp eax, dword [ebp - 0x120]
jne 0x42523a
cmp dword [ebp - 0x120], 0x40
jae 0x42523a
mov ecx, dword [ebp - 0x124]
mov edx, dword [ebp - 0x134]
mov eax, dword [edx + 0x28]
mov dword [ebp + ecx*4 - 0x11c], eax
mov ecx, dword [ebp - 0x120]
add ecx, 1
mov dword [ebp - 0x120], ecx
xor edx, edx
jne 0x4251b9
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
push edx
push 0
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0x120]
push ecx
mov edx, dword [ebp - 0x134]
mov eax, dword [edx + 0x28]
add eax, 1
push eax
call dword [sym.imp.WSOCK32.dll_select]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jle 0x4252df
lea ecx, [ebp - 0x120]
push ecx
mov edx, dword [ebp - 0x134]
mov eax, dword [edx + 0x28]
push eax
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x4252bf
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x12c], eax
mov ecx, dword [ebp - 0x12c]
sub ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x134]
mov dword [edx + 0x20], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x128]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x134]
mov dword [ecx + 0x20], eax
jmp 0x4252ec
mov edx, dword [ebp - 0x134]
mov dword [edx + 0x20], 0x2710
mov dword [ebp - 0x130], 0
jmp 0x425307
mov eax, dword [ebp - 0x130]
add eax, 1
mov dword [ebp - 0x130], eax
mov ecx, dword [ebp - 0x130]
cmp ecx, dword [ebp - 0x120]
jae 0x42537f
mov edx, dword [ebp - 0x130]
mov eax, dword [ebp - 0x134]
mov ecx, dword [ebp + edx*4 - 0x11c]
cmp ecx, dword [eax + 0x28]
jne 0x42537a
mov edx, dword [ebp - 0x120]
sub edx, 1
cmp dword [ebp - 0x130], edx
jae 0x425369
mov eax, dword [ebp - 0x130]
mov ecx, dword [ebp - 0x130]
mov edx, dword [ebp + ecx*4 - 0x118]
mov dword [ebp + eax*4 - 0x11c], edx
mov eax, dword [ebp - 0x130]
add eax, 1
mov dword [ebp - 0x130], eax
jmp 0x42532d
mov ecx, dword [ebp - 0x120]
sub ecx, 1
mov dword [ebp - 0x120], ecx
jmp 0x42537f
jmp 0x4252f8
xor edx, edx
jne 0x4252ec
mov dword [ebp - 0x120], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0052c40e
mov esp, ebp
pop ebp
ret 8
Function at 0x428ae0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x428af0
xor eax, eax
jmp 0x428c8d
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 8
jb 0x428c4e
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x55ad78]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x55ad78]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x55ad78]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x55ad78]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x55ad78]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x55ad78]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x55ad78]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x55ad78]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0x10]
sub eax, 8
mov dword [ebp + 0x10], eax
jmp 0x428af9
cmp dword [ebp + 0x10], 0
je 0x428c87
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x55ad78]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
jne 0x428c54
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
pop ebp
ret