joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4508e7
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
lea ecx, [ebp - 4]
push ecx
push ebx
lea eax, [esi + 8]
mov byte [esi + 0x18], bl
push eax
push 0x451364
push ebx
push ebx
mov dword [eax], esi
mov dword [esi + 0xc], ebx
call fcn.004a6774
xor ecx, ecx
add esp, 0x18
cmp eax, 0xffffffff
cmove eax, ecx
mov dword [esi + 4], eax
cmp eax, ebx
jne 0x450928
mov byte [esi + 0x18], 1
xor al, al
jmp 0x45092a
mov al, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x451e68
Capabilities:
Create thread
Initialize winsock library

Disassembly:
push 0x1a8
mov eax, 0x53592a
call fcn.0049bb92
mov ebx, ecx
mov dword [ebp - 0x1a4], ebx
mov edi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [ebx + 8]
mov dword [ebx], 0x57f9d4
push eax
mov dword [ebp - 0x1a8], ebx
mov dword [ebx + 4], 0x57f638
call edi
xor eax, eax
lea esi, [ebx + 0x20]
mov dword [ebp - 4], eax
mov dword [ebp - 0x1a4], esi
mov dword [esi], eax
mov dword [esi + 4], eax
call fcn.004499d5
mov dword [esi], eax
mov byte [ebp - 4], 1
lea esi, [ebx + 0x28]
mov dword [ebp - 0x1a4], esi
and dword [esi], 0
and dword [esi + 4], 0
call fcn.004499d5
mov dword [esi], eax
mov byte [ebp - 4], 2
lea esi, [ebx + 0x30]
mov dword [ebp - 0x1a4], esi
and dword [esi], 0
and dword [esi + 4], 0
call fcn.004499d5
mov dword [esi], eax
xor eax, eax
mov dword [ebx + 0x344], eax
mov dword [ebx + 0x348], eax
mov dword [ebx + 0x34c], eax
mov dword [ebx + 0x350], eax
mov byte [ebx + 0x354], al
lea eax, [ebx + 0x35c]
push eax
mov dword [ebx + 0x358], 0x57f638
call edi
mov byte [ebp - 4], 5
lea esi, [ebx + 0x374]
mov dword [ebp - 0x1a4], esi
and dword [esi], 0
and dword [esi + 4], 0
call fcn.00451d31
mov dword [esi], eax
mov eax, dword [ebp + 8]
lea ecx, [ebx + 0x380]
mov dword [ebx + 0x37c], eax
mov edi, dword [eax + 0xc]
mov dword [ebp - 0x1a4], ecx
add edi, 2
mov byte [ebp - 4], 7
mov dword [ecx], 0x57f9a4
mov eax, edi
mov dword [ecx + 4], edi
xor ecx, ecx
push 0x34
pop edx
mul edx
mov dword [ebp - 0x1ac], edi
seto cl
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call fcn.0049aa41
pop ecx
mov dword [ebp - 0x1b0], eax
mov byte [ebp - 4], 8
test eax, eax
je 0x451fba
push 0x4510b1
push 0x4527a0
push edi
lea esi, [eax + 4]
mov dword [eax], edi
push 0x34
push esi
call fcn.0049b297
xor eax, eax
jmp 0x451fbe
xor eax, eax
mov esi, eax
mov dword [ebx + 0x388], esi
lea esi, [ebx + 0x394]
mov dword [ebx + 0x38c], eax
mov byte [ebx + 0x390], al
mov dword [esi + 4], eax
mov dword [esi], 0x57f990
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 0x452b3c
mov byte [esi + 0x18], 1
mov byte [ebx + 0x3b0], al
mov dword [ebx + 0x38], eax
mov dword [ebx + 0x13c], eax
mov dword [ebx + 0x240], eax
lea eax, [ebp - 0x1a0]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
xor edx, edx
lea ecx, [ebp - 0x1b4]
push ecx
push edx
lea eax, [esi + 8]
mov byte [esi + 0x18], dl
push eax
push 0x451364
push edx
push edx
mov dword [eax], esi
mov dword [esi + 0xc], edx
call fcn.004a6774
xor ecx, ecx
add esp, 0x18
cmp eax, 0xffffffff
cmove eax, ecx
mov dword [esi + 4], eax
test eax, eax
jne 0x45204c
mov byte [esi + 0x18], 1
mov eax, ebx
call fcn.0049bb4d
ret 4
Function at 0x452eb0
Capabilities:
Set socket configuration

Disassembly:
push 4
mov eax, 0x535a65
call fcn.0049bb5e
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [ebp + 8]
mov dword [edi + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 8], eax
xor eax, eax
inc eax
mov word [edi + 0xc], ax
mov ebx, dword [ebp + 0x10]
xor eax, eax
mov dword [ebp - 4], eax
mov dword [edi], 0x57f890
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], eax
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], eax
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], eax
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], eax
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], eax
mov dword [edi + 0x38], eax
mov byte [ebp - 4], 3
cmp ebx, 0xffffffff
je 0x452f5a
mov ecx, ebx
call fcn.0044d03f
push 4
lea eax, [ebp + 8]
mov dword [edi + 0x14], 2
push eax
push 0x1002
push 0xffff
push ebx
mov dword [ebp + 8], 0x10000
call dword [sym.imp.WS2_32.dll_setsockopt]
push 4
lea eax, [ebp + 8]
push eax
push 0x1001
push 0xffff
push ebx
call dword [sym.imp.WS2_32.dll_setsockopt]
push edi
push dword [edi + 0x10]
mov ecx, edi
call fcn.004548b8
mov eax, edi
call fcn.0049bb38
ret 0xc

Function at 0x452fc3
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x59a0a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
xor cl, cl
push edi
mov edi, dword [ebp + 8]
call fcn.0044d064
mov ecx, eax
mov dword [esi + 0x10], eax
call fcn.0044d03f
test al, al
je 0x45303c
lea eax, [ebp - 0x14]
mov ecx, edi
push eax
call fcn.0044cecd
push 0x10
lea eax, [ebp - 0x14]
mov dword [esi + 0x14], 1
push eax
push dword [esi + 0x10]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x453022
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x45303c
push esi
push dword [esi + 0x10]
mov ecx, esi
call fcn.00454912
push esi
push dword [esi + 0x10]
mov ecx, esi
call fcn.0045496c
mov al, 1
jmp 0x453051
cmp dword [esi + 0x10], 0xffffffff
je 0x45304b
push dword [esi + 0x10]
call dword [sym.imp.WS2_32.dll_closesocket]
or dword [esi + 0x10], 0xffffffff
xor al, al
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0049aa22
mov esp, ebp
pop ebp
ret 4
Function at 0x45308f
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x14], 2
jne 0x4530f2
lea edi, [esi + 0x24]
mov eax, dword [edi + 4]
sub eax, dword [edi]
jne 0x453130
cmp dword [esi + 0x10], 0xffffffff
mov ebx, dword [ebp + 0x10]
je 0x4530c7
push eax
push ebx
push dword [ebp + 0xc]
push dword [esi + 0x10]
call dword [sym.imp.WS2_32.dll_send]
mov ecx, eax
jmp 0x4530ca
or ecx, 0xffffffff
cmp ecx, 0xffffffff
jne 0x4530fd
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x4530e0
xor ecx, ecx
jmp 0x453101
push 0
push 2
mov ecx, esi
call fcn.00454827
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
test ecx, ecx
js 0x4530f2
cmp ecx, ebx
jge 0x45312c
mov edx, dword [ebp + 0xc]
mov byte [ebp + 0x10], 0
push dword [ebp + 0x10]
lea eax, [edx + ebx]
push eax
lea eax, [ecx + edx]
push eax
push dword [esi + 0x28]
mov ecx, edi
call fcn.004555d4
push esi
push dword [esi + 0x10]
mov ecx, esi
call fcn.00454912
mov al, 1
jmp 0x4530f4
cmp eax, 0x100000
ja 0x4530f2
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov byte [ebp - 4], 0
add eax, ecx
push dword [ebp - 4]
push eax
push ecx
jmp 0x453117

Function at 0x4532c0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov esi, ecx
push 2
pop eax
cmp dword [esi + 0x14], eax
jne 0x453342
lea edi, [esi + 0x24]
mov eax, dword [edi + 4]
sub eax, dword [edi]
je 0x453337
mov eax, dword [edi + 4]
or edx, 0xffffffff
sub eax, dword [edi]
cmp dword [esi + 0x10], edx
je 0x4532f7
push 0
push eax
push dword [edi]
push dword [esi + 0x10]
call dword [sym.imp.WS2_32.dll_send]
mov edx, eax
mov eax, dword [edi + 4]
sub eax, dword [edi]
cmp edx, eax
jne 0x453316
push ecx
push dword [esi + 0x10]
mov ecx, esi
call fcn.004549c6
push 0
mov ecx, edi
call fcn.004115a0
jmp 0x45336a
test edx, edx
jle 0x45336a
mov eax, dword [edi + 4]
sub eax, dword [edi]
cmp edx, eax
jae 0x45336a
mov ecx, dword [edi]
lea eax, [ecx + edx]
push eax
push ecx
lea eax, [ebp - 4]
mov ecx, edi
push eax
call fcn.00454355
jmp 0x45336a
push ecx
push dword [esi + 0x10]
call fcn.004549c6
jmp 0x45336a
cmp dword [esi + 0x14], 1
jne 0x45336a
push ecx
push dword [esi + 0x10]
mov dword [esi + 0x14], eax
call fcn.004549c6
push esi
push dword [esi + 0x10]
mov ecx, esi
call fcn.004548b8
push 0
push 1
mov ecx, esi
call fcn.00454827
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x454a2b
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov edi, dword [esi + 4]
mov ecx, esi
sub edi, dword [esi]
lea eax, [edi + 0x5d0]
push eax
call fcn.004115a0
mov eax, dword [esi]
add eax, edi
cmp dword [ebx + 0x10], 0xffffffff
je 0x454a68
push 0
push 0x5d0
push eax
push dword [ebx + 0x10]
call dword [sym.imp.WS2_32.dll_recv]
mov ecx, eax
jmp 0x454a6b
or ecx, 0xffffffff
test ecx, ecx
jle 0x454a79
cmp ecx, 0x5d0
jne 0x454aa5
test ecx, ecx
je 0x454ac1
cmp ecx, 0xffffffff
jne 0x454a36
mov eax, dword [esi]
mov ecx, esi
push dword [esi + 4]
add eax, edi
push eax
lea eax, [ebp + 8]
push eax
call fcn.00454355
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x454aba
push 0xfffffffffffffffe
pop eax
jmp 0x454ac4
mov eax, dword [esi]
push dword [esi + 4]
add eax, ecx
mov ecx, esi
add eax, edi
push eax
lea eax, [ebp + 8]
push eax
call fcn.00454355
mov eax, dword [esi + 4]
sub eax, dword [esi]
jmp 0x454ac4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x454d55
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, ecx
lea ecx, [esp + 4]
push esi
push edi
push ecx
lea edi, [ebx + 0xc0]
jmp 0x454ddc
cmp eax, 0xa
jbe 0x454dd7
cmp byte [edi], 0
jne 0x454dd7
cmp byte [edi + 1], 0
jne 0x454dd7
cmp byte [edi + 2], 0
jne 0x454dd7
cmp byte [edi + 3], 1
jne 0x454dd7
lea ecx, [edi + 0xa]
push 0
lea edx, [eax - 0xa]
call fcn.00456e99
pop ecx
test eax, eax
jle 0x454dd7
mov ecx, dword [ebx + 4]
push 0
push eax
lea eax, [edi + 0xa]
imul esi, dword [ecx + 0x38c], 0x34
push eax
add esi, dword [ecx + 0x388]
lea ecx, [esi + 0x28]
call fcn.00457005
mov eax, dword [edi + 4]
mov ecx, ebx
mov dword [esi + 0x22], eax
mov ax, word [edi + 8]
push esi
mov word [esi + 0x26], ax
mov dword [esi], 3
call fcn.0045487f
lea eax, [esp + 0xc]
push eax
lea eax, [ebx + 0x80]
mov dword [esp + 0x10], 0x10
push eax
push 0
push 0x5d0
push edi
push dword [ebx + 0x3c]
call dword [sym.imp.WS2_32.dll_recvfrom]
test eax, eax
jg 0x454d6e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4561d2
Capabilities:
Resolve dns

Disassembly:
push 0x40
mov eax, 0x535d14
call fcn.0049bb92
mov ebx, ecx
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x44]
push eax
mov dword [ebp - 0x48], eax
call fcn.00409230
lea eax, [ebp - 0x44]
mov ecx, ebx
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.00456354
mov esi, dword [ebp - 0x4c]
cmp esi, dword [ebx]
je 0x456216
lea eax, [esi + 0x10]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.00434fb0
test al, al
je 0x456218
mov esi, dword [ebx]
lea ecx, [ebp - 0x44]
call fcn.004062b0
cmp esi, dword [ebx]
je 0x456251
mov eax, dword [esi + 0x28]
mov ecx, 0x6ddd00
mov edi, dword [esi + 0x2c]
test eax, eax
mov esi, 0x1d4c0
mov dword [ebp - 0x4c], eax
cmovne esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [esi + edi]
cmp ecx, eax
jbe 0x456251
mov eax, dword [ebp - 0x4c]
jmp 0x4562ee
mov esi, dword [ebp - 0x48]
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x456268
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov edi, dword [eax]
jmp 0x45626a
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x4c], eax
call fcn.00409230
and dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x48]
mov ecx, ebx
push eax
call fcn.00456354
mov esi, dword [ebp - 0x48]
cmp esi, dword [ebx]
je 0x4562a7
lea eax, [esi + 0x10]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00434fb0
test al, al
je 0x4562ce
lea eax, [ebp - 0x2c]
push ecx
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x48]
push eax
push ecx
mov ecx, ebx
call fcn.0045638a
push eax
add eax, 0x10
mov ecx, ebx
push eax
push esi
lea eax, [ebp - 0x48]
push eax
call fcn.004563bf
mov esi, dword [ebp - 0x48]
mov eax, dword [ebp - 0x4c]
lea ecx, [ebp - 0x2c]
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], eax
call fcn.004062b0
cmp dword [ebx + 4], 0x64
jbe 0x4562ec
mov ecx, ebx
call fcn.004562f6
mov eax, edi
call fcn.0049bb4d
ret 4
Function at 0x457d84
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x59a0a0]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
push edi
xor eax, eax
mov dword [esp + 0x10], ecx
xor ebx, ebx
lea edi, [esp + 0x1c]
and dword [esp + 0x18], ebx
lea ecx, [esp + 0x2c]
stosd dword es:[edi], eax
xor esi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00457ce5
cmp dword [eax + 0x14], 8
jb 0x457dc1
mov eax, dword [eax]
push 0
push 0x80
push 3
push 0
push 7
push connect
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
lea ecx, [esp + 0x2c]
mov edi, eax
call fcn.00403110
cmp edi, 0xffffffff
je 0x457e0a
and dword [esp + 0x14], ebx
lea eax, [esp + 0x14]
push 0
push eax
push 0x10
lea eax, [esp + 0x24]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x18]
call fcn.00457c8e
cmp dword [esp + 0x20], eax
jne 0x457e27
cmp dword [esp + 0x24], edx
jne 0x457e27
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov ecx, ebx
call fcn.00457c53
xor ecx, ecx
test eax, eax
cmovne ebx, ecx
mov ecx, esi
call fcn.00457c53
xor ecx, ecx
test eax, eax
cmovne esi, ecx
test ebx, ebx
jne 0x457e79
test esi, esi
jne 0x457e79
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x59ffe0]
cmp eax, dword [ecx + 4]
jg 0x457ead
mov eax, dword [esp + 0x10]
mov ebx, dword [0x59ffd8]
mov esi, dword [0x59ffdc]
mov dword [eax + 0x44], 3
jmp 0x457e91
mov eax, dword [esp + 0x10]
mov dword [eax + 0x44], 2
test ebx, ebx
jne 0x457e8c
mov ebx, esi
jmp 0x457e91
test esi, esi
cmove esi, ebx
mov ecx, dword [esp + 0x44]
and dword [eax + 0x40], 0
pop edi
mov dword [eax + 0x4c], esi
pop esi
mov dword [eax + 0x48], ebx
pop ebx
xor ecx, esp
call fcn.0049aa22
mov esp, ebp
pop ebp
ret
mov edi, 0x59ffe0
push edi
call fcn.0049af28
cmp dword [0x59ffe0], 0xffffffff
pop ecx
jne 0x457e60
mov esi, dword [sym.imp.WS2_32.dll_inet_addr]
push str.183.62.104.184
call esi
push str.125.39.202.18
mov dword [0x59ffd8], eax
call esi
push edi
mov dword [0x59ffdc], eax
call fcn.0049aee9
pop ecx
jmp 0x457e60
Function at 0x457eec
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x59a0a0]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push esi
push edi
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ecx + 0x48]
mov dword [ebp - 0x18], eax
mov eax, dword [ecx + 0x4c]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], eax
call fcn.00457c8e
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
call fcn.00457ce5
cmp dword [eax + 0x14], 8
jb 0x457f30
mov eax, dword [eax]
xor edi, edi
push edi
push 0x80
push 2
push edi
push 7
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
lea ecx, [ebp - 0x30]
mov esi, eax
call fcn.00403110
cmp esi, 0xffffffff
je 0x457f74
push edi
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], edi
push eax
push 0x10
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0049aa22
mov esp, ebp
pop ebp
ret

Function at 0x4583ba
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
mov eax, dword [ebx + 0x2c]
test eax, eax
je 0x4583cc
mov eax, dword [eax + 4]
cmp eax, dword [ebp + 8]
jne 0x4583d9
lea ecx, [ebx + 0x24]
call fcn.00450abf
mov eax, dword [ebx + 0x1c]
test eax, eax
je 0x4583e3
mov eax, dword [eax + 4]
cmp eax, dword [ebp + 8]
je 0x4583ec
xor al, al
jmp 0x458441
cmp dword [ebx + 4], 0
push 0
sete al
movzx eax, al
push eax
movzx eax, byte [ebx]
push eax
call fcn.0044d3aa
mov ecx, eax
call fcn.00457ffe
mov esi, dword [ebx + 0x10]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 0x4c]
add dword [esi + 0x24], eax
mov esi, dword [ebx + 0x10]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 0x4c]
mov ecx, ebx
add dword [esi + 0x28], eax
call fcn.00458212
mov eax, dword [ebx + 0x34]
cmp eax, dword [ebx + 8]
jae 0x45843f
mov ecx, ebx
call fcn.0045812a
jmp 0x4583e8
mov al, 1
pop esi
pop ebx
pop ecx
pop ebp
ret 4
Function at 0x458692
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x59a0a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x18], edx
push edi
mov dword [ebp - 0x20], eax
push dword [esi]
call sub.WS2_32.dll_ntohl
push dword [esi + 4]
mov dword [ebp - 0x1c], eax
call sub.WS2_32.dll_ntohl
mov edi, dword [ebp - 0x18]
mov ebx, eax
lea eax, [ebp - 0x14]
xor esi, esi
sub edi, eax
lea eax, [edi + esi*4]
push dword [ebp + eax - 0x14]
call sub.WS2_32.dll_ntohl
mov dword [ebp + esi*4 - 0x14], eax
inc esi
cmp esi, 4
jl 0x4586ce
mov edi, dword [ebp - 0x1c]
xor edx, edx
push 0x10
pop esi
mov ecx, ebx
lea edx, [edx - 0x61c88647]
shr ecx, 5
mov eax, ebx
add ecx, dword [ebp - 0x10]
shl eax, 4
add eax, dword [ebp - 0x14]
xor ecx, eax
lea eax, [edx + ebx]
xor ecx, eax
add edi, ecx
mov ecx, edi
mov eax, edi
shr ecx, 5
add ecx, dword [ebp - 8]
shl eax, 4
add eax, dword [ebp - 0xc]
xor ecx, eax
lea eax, [edx + edi]
xor ecx, eax
add ebx, ecx
sub esi, 1
jne 0x4586ec
push edi
call sub.WS2_32.dll_htonl
mov esi, dword [ebp - 0x20]
push ebx
mov dword [esi], eax
call sub.WS2_32.dll_htonl
mov ecx, dword [ebp - 4]
pop edi
mov dword [esi + 4], eax
xor ecx, ebp
pop esi
pop ebx
call fcn.0049aa22
mov esp, ebp
pop ebp
ret

Function at 0x45874e
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x59a0a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x18], edx
push edi
mov dword [ebp - 0x20], eax
push dword [esi]
call sub.WS2_32.dll_ntohl
push dword [esi + 4]
mov edi, eax
call sub.WS2_32.dll_ntohl
mov ebx, dword [ebp - 0x18]
xor esi, esi
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x14]
sub ebx, eax
lea ecx, [ebx + esi*4]
push dword [ebp + ecx - 0x14]
call sub.WS2_32.dll_ntohl
mov dword [ebp + esi*4 - 0x14], eax
inc esi
cmp esi, 4
jl 0x45878a
mov ebx, dword [ebp - 0x1c]
mov edx, 0xe3779b90
push 0x10
pop esi
mov ecx, edi
mov eax, edi
shr ecx, 5
add ecx, dword [ebp - 8]
shl eax, 4
add eax, dword [ebp - 0xc]
xor ecx, eax
lea eax, [edx + edi]
xor ecx, eax
sub ebx, ecx
mov ecx, ebx
mov eax, ebx
shr ecx, 5
add ecx, dword [ebp - 0x10]
shl eax, 4
add eax, dword [ebp - 0x14]
xor ecx, eax
lea eax, [edx + ebx]
xor ecx, eax
lea edx, [edx + 0x61c88647]
sub edi, ecx
sub esi, 1
jne 0x4587ab
push edi
call sub.WS2_32.dll_htonl
mov esi, dword [ebp - 0x20]
push ebx
mov dword [esi], eax
call sub.WS2_32.dll_htonl
mov ecx, dword [ebp - 4]
pop edi
mov dword [esi + 4], eax
xor ecx, ebp
pop esi
pop ebx
call fcn.0049aa22
mov esp, ebp
pop ebp
ret
Function at 0x458c77
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x59a0a0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x59fe40], 0
jne 0x458d0a
push esi
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.0049e130
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0xffffffffffffffff
push 0x57fbb0
lea eax, [ebp - 0x210]
push 0x105
push eax
call fcn.004a0fe8
add esp, 0x10
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x458d09
push str.GetLocaleInfoEx
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
neg eax
push esi
sbb eax, eax
add eax, 2
mov dword [0x59fe40], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [0x59fe40], 1
sete al
xor ecx, ebp
call fcn.0049aa22
mov esp, ebp
pop ebp
ret
Function at 0x458d24
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x59a0a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x98
lea eax, [ebp - 0x9c]
mov esi, ecx
push 0
push eax
call fcn.0049e130
and dword [esi], 0
lea eax, [ebp - 0xa0]
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
add esp, 0xc
mov dword [ebp - 0xa0], 0x9c
push eax
call edi
test eax, eax
jne 0x458d8f
lea eax, [ebp - 0xa0]
mov dword [ebp - 0xa0], 0x94
push eax
call edi
test eax, eax
jne 0x458d8f
xor eax, eax
jmp 0x458ef9
push 0x80
lea eax, [ebp - 0x8c]
push str.Service_Pack_1
push eax
call fcn.004b0c10
xor edi, edi
add esp, 0xc
inc edi
test eax, eax
jne 0x458db3
or dword [esi], edi
jmp 0x458e17
push 0x80
lea eax, [ebp - 0x8c]
push str.Service_Pack_2
push eax
call fcn.004b0c10
add esp, 0xc
test eax, eax
jne 0x458dd5
or dword [esi], 2
jmp 0x458e17
push 0x80
lea eax, [ebp - 0x8c]
push str.Service_Pack_3
push eax
call fcn.004b0c10
add esp, 0xc
test eax, eax
jne 0x458df7
or dword [esi], 3
jmp 0x458e17
push 0x80
lea eax, [ebp - 0x8c]
push str.Service_Pack_4
push eax
call fcn.004b0c10
add esp, 0xc
test eax, eax
jne 0x458e17
or dword [esi], 4
shl dword [esi], 0x10
call fcn.00458c77
test eax, eax
je 0x458e54
cmp dword [ebp - 0x90], 2
jne 0x458d88
cmp dword [ebp - 0x9c], 6
jne 0x458d88
cmp dword [ebp - 0x98], edi
je 0x458e82
cmp dword [ebp - 0x98], 0
jne 0x458d88
jmp 0x458e90
mov eax, dword [ebp - 0x90]
sub eax, 0
je 0x458ef7
sub eax, 1
je 0x458ece
sub eax, 1
jne 0x458ef7
cmp dword [ebp - 0x9c], 6
jne 0x458e95
cmp dword [ebp - 0x98], edi
jne 0x458e87
or dword [esi], 9
jmp 0x458ef7
cmp dword [ebp - 0x98], 0
jne 0x458ef7
or dword [esi], 8
jmp 0x458ef7
cmp dword [ebp - 0x9c], 5
jne 0x458ec0
mov eax, dword [ebp - 0x98]
cmp eax, 2
jne 0x458eae
or dword [esi], 7
jmp 0x458ef7
cmp eax, edi
jne 0x458eb7
or dword [esi], 6
jmp 0x458ef7
test eax, eax
jne 0x458ef7
or dword [esi], 5
jmp 0x458ef7
cmp dword [ebp - 0x9c], 4
ja 0x458ef7
or dword [esi], 4
jmp 0x458ef7
cmp dword [ebp - 0x9c], 4
jne 0x458ef7
mov eax, dword [ebp - 0x98]
test eax, eax
jne 0x458ee5
or dword [esi], edi
jmp 0x458ef7
cmp eax, 0xa
jne 0x458eef
or dword [esi], 2
jmp 0x458ef7
cmp eax, 0x5a
jne 0x458ef7
or dword [esi], 3
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0049aa22
mov esp, ebp
pop ebp
ret
Function at 0x458f09
Capabilities:
Get routing table

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
mov eax, dword [0x59b02c]
test eax, eax
je 0x458f33
mov ecx, ebx
sub ecx, dword [0x59fe44]
cmp ecx, 0x3e8
jb 0x458fc3
push esi
push edi
xor esi, esi
push 0x3c
mov dword [ebp - 4], esi
call fcn.004a51f0
pop ecx
mov edi, eax
lea eax, [ebp - 4]
push esi
push eax
push edi
call dword [sym.imp.IPHLPAPI.DLL_GetIpForwardTable]
cmp eax, 0x7a
jne 0x458f7f
push edi
call fcn.004a51fb
cmp dword [ebp - 4], 0xb2c
pop ecx
jbe 0x458f68
inc esi
jmp 0x458fb3
push dword [ebp - 4]
call fcn.004a51f0
pop ecx
mov edi, eax
lea eax, [ebp - 4]
push esi
push eax
push edi
call dword [sym.imp.IPHLPAPI.DLL_GetIpForwardTable]
test eax, eax
je 0x458f8e
push edi
call fcn.004a51fb
xor esi, esi
inc esi
jmp 0x458fb2
test edi, edi
je 0x458fb3
mov ecx, esi
cmp dword [edi], ecx
jbe 0x458fac
lea eax, [edi + 4]
cmp dword [eax], esi
jne 0x458fa4
cmp dword [eax + 4], esi
je 0x458f83
inc ecx
add eax, 0x38
cmp ecx, dword [edi]
jb 0x458f9b
push edi
call fcn.004a51fb
pop ecx
pop edi
mov dword [0x59b02c], esi
mov eax, esi
mov dword [0x59fe44], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret