joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47f3c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4f84b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push str.HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunServices
lea ecx, [esp + 0x14]
call fcn.004da8ea
push 0x5279e8
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x24], 0
push eax
call fcn.004dab11
mov ecx, dword [esp + 0x24]
lea edx, [esp + 8]
push ecx
push eax
push edx
mov byte [esp + 0x28], 1
call fcn.004dab11
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 4
call fcn.004da87c
lea ecx, [esp + 0x10]
mov byte [esp + 0x1c], 3
call fcn.004da87c
mov eax, dword [esp + 8]
lea ecx, [esp + 0x24]
push eax
push ecx
call fcn.0045e980
mov esi, dword [esp + 0x30]
mov eax, dword [eax]
push esi
push eax
call fcn.004c2c45
add esp, 0x10
lea ecx, [esp + 0x24]
test eax, eax
setne bl
call fcn.004da87c
test bl, bl
je 0x47f470
mov edx, dword [esp + 8]
push esi
push edx
call fcn.0045e630
add esp, 8
lea ecx, [esp + 8]
mov dword [esp + 0x1c], 0xffffffff
call fcn.004da87c
mov ecx, dword [esp + 0x14]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret

Function at 0x47f760
Capabilities:
Start service

Disassembly:
push ebx
push edi
push 0
call dword [sym.imp.kernel32.dll_SetLastError]
xor ebx, ebx
push 0x2000000
push ebx
push ebx
call dword [sym.imp.advapi32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x47f7ee
mov eax, dword [esp + 0xc]
push ebp
push esi
push 0x10
push eax
push edi
call dword [sym.imp.advapi32.dll_OpenServiceA]
mov ebp, dword [sym.imp.advapi32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
je 0x47f7d0
push ebx
push ebx
push esi
call dword [sym.imp.advapi32.dll_StartServiceA]
test eax, eax
jne 0x47f7b7
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x420
je 0x47f7b7
mov ebx, eax
push esi
call ebp
push edi
call ebp
pop esi
pop ebp
push ebx
call dword [sym.imp.kernel32.dll_SetLastError]
xor eax, eax
pop edi
test ebx, ebx
sete al
pop ebx
ret
call dword [sym.imp.kernel32.dll_GetLastError]
push edi
mov ebx, eax
call ebp
pop esi
pop ebp
push ebx
call dword [sym.imp.kernel32.dll_SetLastError]
xor eax, eax
pop edi
test ebx, ebx
sete al
pop ebx
ret
call dword [sym.imp.kernel32.dll_GetLastError]
mov ebx, eax
push ebx
call dword [sym.imp.kernel32.dll_SetLastError]
xor eax, eax
pop edi
test ebx, ebx
sete al
pop ebx
ret
Function at 0x47f810
Capabilities:
Stop service

Disassembly:
sub esp, 0x1c
push ebx
push esi
push 0
call dword [sym.imp.kernel32.dll_SetLastError]
xor ebx, ebx
push 0x2000000
push ebx
push ebx
call dword [sym.imp.advapi32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
je 0x47f8ac
mov eax, dword [esp + 0x28]
push ebp
push edi
push 0x20
push eax
push esi
call dword [sym.imp.advapi32.dll_OpenServiceA]
mov ebp, dword [sym.imp.advapi32.dll_CloseServiceHandle]
mov edi, eax
test edi, edi
je 0x47f88b
lea ecx, [esp + 0x10]
push ecx
push 1
push edi
call dword [sym.imp.advapi32.dll_ControlService]
test eax, eax
jne 0x47f86f
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x426
je 0x47f86f
mov ebx, eax
push edi
call ebp
push esi
call ebp
pop edi
pop ebp
push ebx
call dword [sym.imp.kernel32.dll_SetLastError]
xor eax, eax
pop esi
test ebx, ebx
sete al
pop ebx
add esp, 0x1c
ret
call dword [sym.imp.kernel32.dll_GetLastError]
push esi
mov ebx, eax
call ebp
pop edi
pop ebp
push ebx
call dword [sym.imp.kernel32.dll_SetLastError]
xor eax, eax
pop esi
test ebx, ebx
sete al
pop ebx
add esp, 0x1c
ret
call dword [sym.imp.kernel32.dll_GetLastError]
mov ebx, eax
push ebx
call dword [sym.imp.kernel32.dll_SetLastError]
xor eax, eax
pop esi
test ebx, ebx
sete al
pop ebx
add esp, 0x1c
ret

Function at 0x47f8d0
Capabilities:
Modify service

Disassembly:
push ebx
push edi
push 0
call dword [sym.imp.kernel32.dll_SetLastError]
xor ebx, ebx
push 0x2000000
push ebx
push ebx
call dword [sym.imp.advapi32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x47f96c
mov eax, dword [esp + 0xc]
push ebp
push esi
push 2
push eax
push edi
call dword [sym.imp.advapi32.dll_OpenServiceA]
mov ebp, dword [sym.imp.advapi32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
je 0x47f94e
mov ecx, dword [esp + 0x18]
push ebx
push ebx
push ebx
neg ecx
push ebx
push ebx
sbb ecx, ecx
push ebx
push ebx
add ecx, 3
push 0xffffffffffffffff
push ecx
push 0xffffffffffffffff
push esi
call dword [sym.imp.advapi32.dll_ChangeServiceConfigA]
test eax, eax
jne 0x47f935
call dword [sym.imp.kernel32.dll_GetLastError]
mov ebx, eax
push esi
call ebp
push edi
call ebp
pop esi
pop ebp
push ebx
call dword [sym.imp.kernel32.dll_SetLastError]
xor eax, eax
pop edi
test ebx, ebx
sete al
pop ebx
ret
call dword [sym.imp.kernel32.dll_GetLastError]
push edi
mov ebx, eax
call ebp
pop esi
pop ebp
push ebx
call dword [sym.imp.kernel32.dll_SetLastError]
xor eax, eax
pop edi
test ebx, ebx
sete al
pop ebx
ret
call dword [sym.imp.kernel32.dll_GetLastError]
mov ebx, eax
push ebx
call dword [sym.imp.kernel32.dll_SetLastError]
xor eax, eax
pop edi
test ebx, ebx
sete al
pop ebx
ret
Function at 0x47f990
Capabilities:
Query service configuration

Disassembly:
mov eax, 0x1004
call fcn.004c2ff0
push ebx
push ebp
mov ebp, dword [esp + 0x1014]
push esi
push 0
mov dword [ebp], 0
call dword [sym.imp.kernel32.dll_SetLastError]
xor ebx, ebx
push 0x2000000
push ebx
push ebx
call dword [sym.imp.advapi32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
je 0x47fa44
mov eax, dword [esp + 0x1014]
push edi
push 1
push eax
push esi
call dword [sym.imp.advapi32.dll_OpenServiceA]
mov edi, eax
test edi, edi
je 0x47fa32
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
push 0x1000
push edx
push edi
call dword [sym.imp.advapi32.dll_QueryServiceConfigA]
test eax, eax
jne 0x47fa13
call dword [sym.imp.kernel32.dll_GetLastError]
push edi
mov ebx, eax
call dword [sym.imp.advapi32.dll_CloseServiceHandle]
push esi
call dword [sym.imp.advapi32.dll_CloseServiceHandle]
pop edi
jmp 0x47fa4c
cmp dword [esp + 0x18], 2
jne 0x47fa21
mov dword [ebp], 1
push edi
call dword [sym.imp.advapi32.dll_CloseServiceHandle]
push esi
call dword [sym.imp.advapi32.dll_CloseServiceHandle]
pop edi
jmp 0x47fa4c
call dword [sym.imp.kernel32.dll_GetLastError]
push esi
mov ebx, eax
call dword [sym.imp.advapi32.dll_CloseServiceHandle]
pop edi
jmp 0x47fa4c
call dword [sym.imp.kernel32.dll_GetLastError]
mov ebx, eax
push ebx
call dword [sym.imp.kernel32.dll_SetLastError]
xor eax, eax
pop esi
test ebx, ebx
pop ebp
pop ebx
sete al
add esp, 0x1004
ret

Function at 0x47fa70
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, dword [sym.imp.kernel32.dll_SetLastError]
push esi
push edi
push 0
call ebp
xor edi, edi
push 2
push edi
push edi
call dword [sym.imp.advapi32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
je 0x47fafb
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push ebx
push edi
mov edx, dword [esp + 0x1c]
push edi
neg ecx
push edi
push edi
sbb ecx, ecx
push edi
push eax
mov eax, dword [esp + 0x2c]
add ecx, 3
push edi
push ecx
push pe_nt_image_headers32
push 0x10030
push edx
push eax
push esi
call dword [sym.imp.advapi32.dll_CreateServiceA]
mov ebx, dword [sym.imp.advapi32.dll_CloseServiceHandle]
test eax, eax
je 0x47fae1
push eax
call ebx
push esi
call ebx
pop ebx
push edi
call ebp
xor eax, eax
test edi, edi
pop edi
pop esi
sete al
pop ebp
ret
call dword [sym.imp.kernel32.dll_GetLastError]
push esi
mov edi, eax
call ebx
pop ebx
push edi
call ebp
xor eax, eax
test edi, edi
pop edi
pop esi
sete al
pop ebp
ret
call dword [sym.imp.kernel32.dll_GetLastError]
mov edi, eax
push edi
call ebp
xor eax, eax
test edi, edi
pop edi
pop esi
sete al
pop ebp
ret
Function at 0x47fb20
Capabilities:
Delete service

Disassembly:
push ebx
push esi
push 0
call dword [sym.imp.kernel32.dll_SetLastError]
xor esi, esi
push 0x80000000
push esi
push esi
call dword [sym.imp.advapi32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
je 0x47fbb6
mov eax, dword [esp + 0xc]
push ebp
push edi
push 0x10020
push eax
push ebx
call dword [sym.imp.advapi32.dll_OpenServiceA]
mov ebp, dword [sym.imp.advapi32.dll_CloseServiceHandle]
mov edi, eax
test edi, edi
je 0x47fb91
push edi
call dword [sym.imp.advapi32.dll_DeleteService]
test eax, eax
jne 0x47fb78
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x430
je 0x47fb78
mov esi, eax
push edi
call ebp
push ebx
call ebp
pop edi
pop ebp
push esi
call dword [sym.imp.kernel32.dll_SetLastError]
xor eax, eax
test esi, esi
pop esi
pop ebx
sete al
ret
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x424
je 0x47fba0
mov esi, eax
push ebx
call ebp
pop edi
pop ebp
push esi
call dword [sym.imp.kernel32.dll_SetLastError]
xor eax, eax
test esi, esi
pop esi
pop ebx
sete al
ret
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
push esi
call dword [sym.imp.kernel32.dll_SetLastError]
xor eax, eax
test esi, esi
pop esi
pop ebx
sete al
ret
Function at 0x483160
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4f8bd1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x90
push esi
push edi
mov edi, dword [esp + 0xac]
lea eax, [esp + 0x24]
push edi
mov esi, ecx
push eax
call fcn.00459be0
push 0x3c8
mov dword [esp + 0xac], 0
call fcn.004dae15
add esp, 0xc
mov dword [esp + 0xc], eax
test eax, eax
mov byte [esp + 0xa0], 1
je 0x4831ca
mov ecx, dword [esp + 0xa8]
push ecx
mov ecx, eax
call fcn.0048fdd0
jmp 0x4831cc
xor eax, eax
mov edx, dword [esp + 0x78]
mov byte [esp + 0xa0], 0
push edx
mov dword [esp + 0xc], eax
call fcn.0046c240
mov ecx, dword [esp + 0xc]
add esp, 4
lea edx, [esi + 0xbc]
mov dword [ecx + 0x3c], eax
mov eax, dword [esp + 8]
push edx
lea ecx, [eax + 0x34]
call fcn.004da9b5
mov ecx, dword [esp + 8]
lea edx, [esp + 8]
lea eax, [esp + 0x1c]
push edx
mov dword [ecx + 0x30], edi
push eax
lea ecx, [esi + 0x98]
call fcn.00483380
mov ecx, dword [0x5370e4]
push ecx
lea ecx, [esp + 0x10]
call fcn.004da8ea
push 0x52468c
lea edx, [esp + 0x14]
push eax
push edx
mov byte [esp + 0xac], 2
call fcn.004dab11
push str.Server
push eax
lea eax, [esp + 0x1c]
mov byte [esp + 0xa8], 3
push eax
call fcn.004dab11
push str.:nMaxConcurrentConnections__0
lea ecx, [esp + 0x1c]
push eax
push ecx
mov byte [esp + 0xac], 4
call fcn.004dab11
mov eax, dword [eax]
mov byte [esp + 0xa0], 5
push eax
call fcn.0045e7e0
add esp, 4
lea ecx, [esp + 0x18]
mov dword [0x537788], eax
mov byte [esp + 0xa0], 4
call fcn.004da87c
lea ecx, [esp + 0x14]
mov byte [esp + 0xa0], 3
call fcn.004da87c
lea ecx, [esp + 0x10]
mov byte [esp + 0xa0], 2
call fcn.004da87c
lea ecx, [esp + 0xc]
mov byte [esp + 0xa0], 0
call fcn.004da87c
mov ecx, dword [esp + 8]
call fcn.00490310
lea ecx, [esp + 0x94]
mov dword [esp + 0xa0], 8
call fcn.004da87c
lea ecx, [esp + 0x7c]
mov byte [esp + 0xa0], 7
call fcn.004da87c
lea ecx, [esp + 0x78]
mov byte [esp + 0xa0], 6
call fcn.004da87c
lea edx, [esp + 0x34]
mov dword [esp + 0x1c], edx
lea ecx, [esp + 0x74]
mov dword [esp + 0xa0], 0xb
call fcn.004da87c
lea ecx, [esp + 0x50]
mov byte [esp + 0xa0], 0xa
call fcn.004644e0
lea ecx, [esp + 0x38]
mov byte [esp + 0xa0], 9
call fcn.004644e0
lea ecx, [esp + 0x34]
mov dword [esp + 0xa0], 0xffffffff
call fcn.004da87c
mov ecx, dword [esp + 0x98]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x9c
ret 8
Function at 0x489b30
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0xb0]
test eax, eax
je 0x489bc3
mov edi, dword [sym.imp.kernel32.dll_GetTickCount]
call edi
mov edx, dword [esi + 0xa4]
mov ecx, eax
sub ecx, edx
cmp ecx, 0x3e8
jl 0x489bc3
mov eax, dword [esi + 0xa8]
xor edx, edx
mov dword [esi + 0xa4], 0
mov dword [esi + 0xa8], 0
lea eax, [eax + eax*4]
mov dword [esi + 0xb0], 1
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
div ecx
mov dword [esi + 0xac], eax
call edi
mov dword [esi + 0xa4], eax
mov dword [esi + 0x9c], 0
call edi
add eax, 0x3e8
test eax, eax
mov dword [esi + 0xa0], eax
jne 0x489bc3
mov dword [esi + 0xa0], 1
mov edi, dword [esi + 0xac]
shr edi, 1
jne 0x489bd8
mov ecx, dword [esi + 0x64]
call fcn.004652f0
pop edi
pop esi
ret
cmp edi, 0x80000
jbe 0x489be5
mov edi, 0x80000
mov ecx, dword [esi + 0x64]
call fcn.00496f30
add eax, edi
pop edi
pop esi
ret
Function at 0x48b870
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4f944b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
push edi
mov esi, ecx
push 0x1c
call fcn.004dae15
mov edi, eax
add esp, 4
mov dword [esp + 0xc], edi
test edi, edi
mov dword [esp + 0x18], 0
je 0x48b8b4
lea ecx, [edi + 4]
call fcn.00464470
mov eax, edi
jmp 0x48b8b6
xor eax, eax
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [esp + 8], eax
mov dword [eax], ecx
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 8]
push edx
push eax
add ecx, 4
mov dword [esp + 0x20], 0xffffffff
call fcn.00464700
mov eax, dword [esi + 0xc]
mov edx, dword [esi + 0x10]
add esi, 4
sub edx, eax
sar edx, 2
cmp edx, 1
mov edi, eax
jae 0x48b9c5
mov edx, dword [esi + 4]
test edx, edx
je 0x48b90a
mov ecx, eax
sub ecx, edx
sar ecx, 2
cmp ecx, 1
ja 0x48b90f
mov ecx, 1
test edx, edx
jne 0x48b917
xor eax, eax
jmp 0x48b91c
sub eax, edx
sar eax, 2
add eax, ecx
test eax, eax
mov dword [esp + 0x24], eax
jge 0x48b928
xor eax, eax
push ebx
push ebp
shl eax, 2
push eax
call fcn.004dae15
mov ebx, dword [esi + 4]
add esp, 4
cmp ebx, edi
mov dword [esp + 0x28], eax
mov ebp, eax
je 0x48b957
push ebx
push ebp
call fcn.0040e680
add ebx, 4
add esp, 8
add ebp, 4
cmp ebx, edi
jne 0x48b943
lea ecx, [esp + 0x10]
push ecx
push 1
push ebp
mov ecx, esi
call fcn.004240d0
mov edx, dword [esi + 8]
add ebp, 4
push ebp
push edx
push edi
mov ecx, esi
call fcn.0040e650
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push eax
push ecx
mov ecx, esi
call fcn.0042ff70
mov edx, dword [esi + 4]
push edx
call fcn.004dae3e
mov edi, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
add esp, 4
lea ecx, [edi + eax*4]
mov dword [esi + 0xc], ecx
mov ecx, esi
call fcn.0040e450
lea edx, [edi + eax*4 + 4]
pop ebp
mov dword [esi + 4], edi
pop ebx
mov dword [esi + 8], edx
pop edi
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret 0xc
mov ecx, eax
sub ecx, edi
sar ecx, 2
cmp ecx, 1
jae 0x48ba13
lea edx, [edi + 4]
mov ecx, esi
push edx
push eax
push edi
call fcn.0040e650
mov eax, dword [esi + 8]
lea ecx, [esp + 8]
mov edx, eax
push ecx
sub edx, edi
mov ecx, 1
sar edx, 2
sub ecx, edx
push ecx
push eax
mov ecx, esi
call fcn.004240d0
mov eax, dword [esi + 8]
cmp edi, eax
je 0x48ba4f
mov edx, dword [esp + 8]
mov dword [edi], edx
add edi, 4
cmp edi, eax
jne 0x48ba04
jmp 0x48ba4f
push eax
push eax
add eax, 0xfffffffc
mov ecx, esi
push eax
call fcn.0040e650
mov ecx, dword [esi + 8]
lea eax, [ecx - 4]
cmp edi, eax
je 0x48ba39
mov edx, dword [eax - 4]
sub eax, 4
sub ecx, 4
cmp eax, edi
mov dword [ecx], edx
jne 0x48ba2a
lea ecx, [edi + 4]
mov eax, edi
cmp edi, ecx
je 0x48ba4f
mov edx, dword [esp + 8]
mov dword [eax], edx
add eax, 4
cmp eax, ecx
jne 0x48ba42
mov eax, dword [esi + 8]
mov ecx, dword [esp + 0x10]
add eax, 4
pop edi
mov dword [esi + 8], eax
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 0xc
Function at 0x48c660
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov eax, dword [0x537620]
push eax
call dword [sym.imp.user32.dll_OpenClipboard]
test eax, eax
je 0x48c6a2
push esi
push 1
call dword [sym.imp.user32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x48c69b
push esi
call dword [sym.imp.kernel32.dll_GlobalLock]
test eax, eax
je 0x48c694
mov ecx, dword [esp + 8]
push eax
call fcn.004daa05
push esi
call dword [sym.imp.kernel32.dll_GlobalUnlock]
call dword [sym.imp.user32.dll_CloseClipboard]
pop esi
ret

Function at 0x48c6b0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov eax, dword [0x537620]
push eax
call dword [sym.imp.user32.dll_OpenClipboard]
test eax, eax
je 0x48c736
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push 0x2002
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x48c72d
push ebx
call dword [sym.imp.kernel32.dll_GlobalLock]
mov edx, eax
test edx, edx
je 0x48c72d
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
mov edi, edx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.kernel32.dll_GlobalUnlock]
call dword [sym.imp.user32.dll_EmptyClipboard]
push ebx
push 1
call dword [sym.imp.user32.dll_SetClipboardData]
test eax, eax
jne 0x48c72d
push ebx
call dword [sym.imp.kernel32.dll_GlobalFree]
call dword [sym.imp.user32.dll_CloseClipboard]
pop edi
pop esi
pop ebx
ret
Function at 0x48e880
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jbe 0x48e8b3
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 8]
push ebx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x5040b4]
xor eax, edx
inc ecx
dec esi
jne 0x48e892
pop ebx
pop esi
ret
mov eax, dword [esp + 0x10]
pop esi
ret

Function at 0x48e8c0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jbe 0x48e90b
mov edx, dword [esp + 8]
mov eax, dword [esp + 0x10]
push edi
mov cl, byte [edx]
inc edx
xor cl, al
mov byte [esp + 0x14], cl
mov ecx, dword [esp + 0x14]
and ecx, 0xff
mov edi, ecx
and ecx, 0xf
shr edi, 4
mov di, word [edi*2 + 0x5044b4]
xor di, word [ecx*2 + 0x5044d4]
xor ecx, ecx
mov cl, ah
xor edi, ecx
dec esi
mov eax, edi
jne 0x48e8d2
pop edi
pop esi
ret
mov ax, word [esp + 0x10]
pop esi
ret

Function at 0x48e970
Capabilities:
Set socket configuration

Disassembly:
push ecx
push esi
push 0
push 0x3f
push 2
mov esi, ecx
push 0
call fcn.004ec8b1
test eax, eax
jne 0x48e988
pop esi
pop ecx
ret
mov ecx, dword [esi + 4]
lea eax, [esp + 4]
push 4
push eax
push 0x20
push 0xffff
push ecx
mov dword [esp + 0x18], 1
call sub.wsock32.dll_setsockopt
cmp eax, 0xffffffff
je 0x48e9b4
mov eax, 1
pop esi
pop ecx
ret
push edi
call sub.wsock32.dll_WSAGetLastError
mov edx, dword [esi]
mov ecx, esi
mov edi, eax
call dword [edx + 0x10]
push edi
call dword [sym.imp.kernel32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
pop ecx
ret
Function at 0x493980
Capabilities:
Create thread

Disassembly:
push ecx
mov eax, dword [0x537800]
test eax, eax
jne 0x4939fa
call fcn.0045d480
test eax, eax
je 0x4939fa
push esi
mov esi, dword [sym.imp.kernel32.dll_CreateEventA]
push 0
push 0
push 0
push 0
call esi
push 0
push 0
push 0
push 0
mov dword [0x5377d4], eax
call esi
mov dword [0x5377d0], eax
lea eax, [esp + 4]
push eax
push 0
push 0
push 0x493a00
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
mov esi, eax
push 2
push esi
call dword [sym.imp.kernel32.dll_SetThreadPriority]
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
push 0x493b70
call fcn.004c2c04
add esp, 4
mov dword [0x537800], 1
pop esi
pop ecx
ret
Function at 0x496810
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4f9fc4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov al, byte [esp + 3]
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0x18], esi
mov dword [esi], method.CScrollView.virtual_240
mov byte [esi + 0x1c], al
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov cl, byte [esp + 0x13]
mov dword [esp + 0x24], ebx
mov byte [esi + 0x2c], cl
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dl, byte [esp + 0x13]
mov al, byte [esp + 0x13]
lea edi, [esi + 0x3c]
push 1
push ebx
mov ecx, edi
mov byte [esp + 0x2c], 1
mov byte [edi], dl
mov byte [edi + 1], al
mov byte [edi + 8], bl
call fcn.0047a350
lea ecx, [esp + 0x14]
mov ebp, eax
call fcn.004d043e
cmp dword [0x537810], ebx
jne 0x4968a7
mov eax, ebp
xor ebp, ebp
mov dword [0x537810], eax
mov dword [eax], ebx
mov ecx, dword [0x537810]
mov dword [ecx + 8], ebx
mov ecx, dword [0x53780c]
inc ecx
mov dword [0x53780c], ecx
lea ecx, [esp + 0x14]
call fcn.004d04da
cmp ebp, ebx
je 0x4968ca
push ebp
call fcn.004dae3e
add esp, 4
mov edx, dword [0x537810]
push ebx
push edx
mov ecx, edi
call fcn.0047a350
mov dword [edi + 4], eax
mov dword [edi + 0xc], ebx
mov dword [eax], eax
mov edi, dword [edi + 4]
mov dword [edi + 8], edi
mov al, byte [esp + 0x13]
lea ecx, [esi + 0x4c]
mov dword [esp + 0x14], ecx
mov byte [ecx], al
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], ebx
push ebx
push ebx
push 0x536ec0
mov byte [esp + 0x30], 3
call fcn.0049ab30
mov ecx, esi
mov byte [esp + 0x24], 4
mov dword [esi], 0x504560
call fcn.00496b90
mov ecx, esi
call fcn.00496e20
push 0x537808
call dword [sym.imp.kernel32.dll_InterlockedIncrement]
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x49d450
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4fa5b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
mov esi, ecx
push edi
lea ecx, [esp + 8]
call fcn.00464470
mov eax, dword [esp + 0x30]
lea ecx, [esp + 8]
push eax
mov dword [esp + 0x2c], 0
call fcn.004646d0
mov edx, dword [esp + 0x34]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
lea ecx, [esp + 0x10]
call fcn.00464700
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x18]
push ecx
mov ecx, dword [esi + 0x10]
push edx
push 0x50a
push esi
call fcn.004971d0
lea ecx, [esp + 8]
mov dword [esp + 0x28], 0xffffffff
call fcn.004644e0
mov ecx, dword [esp + 0x20]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret 8
Function at 0x4a0030
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4fa7b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push esi
mov esi, ecx
lea ecx, [esp + 0x10]
mov byte [esp + 0xc], 0
mov eax, dword [esi + 0x50]
mov dword [esp + 8], eax
call fcn.00464470
mov ecx, dword [esi + 0x10]
mov dword [esp + 0x30], 0
call fcn.00496f10
push eax
lea ecx, [esp + 0x14]
call fcn.00464590
lea ecx, [esp + 8]
push 8
push ecx
lea ecx, [esp + 0x18]
call fcn.00464700
lea edx, [esp + 4]
lea eax, [esp + 0x10]
push edx
push eax
mov ecx, esi
call fcn.0049c8e0
mov ecx, dword [esp + 0x14]
mov dl, byte [esp + 4]
mov byte [ecx + 4], dl
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
mov edx, dword [esi + 0x50]
push eax
push ecx
mov ecx, dword [esi + 0x10]
push edx
push esi
call fcn.004971d0
mov eax, dword [esp + 4]
test eax, eax
je 0x4a00ce
mov ecx, esi
call fcn.0049cb50
jmp 0x4a00db
mov eax, fcn.004a0030
xor ecx, ecx
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], 0xffffffff
call fcn.004644e0
mov ecx, dword [esp + 0x28]
pop esi
mov dword fs:[0], ecx
add esp, 0x30
ret