joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49ec22
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x10]
cmp dword [eax + 0x14], 0x10
mov edx, eax
jb 0x49ec3c
mov edx, dword [eax]
mov ebx, 0x811c9dc5
test ecx, ecx
je 0x49ec58
xor ebp, ebp
movzx edi, byte [edx + ebp]
xor edi, ebx
imul ebx, edi, 0x1000193
inc ebp
cmp ecx, ebp
jne 0x49ec47
mov edi, esp
mov ecx, esi
push ebx
push eax
push edi
call fcn.0049f030
mov ecx, dword [edi + 4]
test ecx, ecx
jne 0x49ec6e
mov ecx, dword [esi + 4]
mov eax, dword [esp + 0x1c]
mov dword [eax], ecx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x49ecc4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov ebx, ecx
mov edx, dword [ebp + 0x10]
lea eax, [ebp - 0x18]
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x49f2c0
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
mov eax, dword [edx + 0x10]
cmp dword [edx + 0x14], 0x10
mov ecx, edx
jb 0x49ed02
mov ecx, dword [edx]
mov esi, 0x811c9dc5
test eax, eax
je 0x49ed1e
xor edx, edx
movzx edi, byte [ecx + edx]
xor edi, esi
imul esi, edi, 0x1000193
inc edx
cmp eax, edx
jne 0x49ed0d
mov dword [ebp - 0x10], 0xffffffff
lea edi, [ebp - 0x34]
mov ecx, ebx
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.0049ee38
mov eax, dword [edi + 4]
test eax, eax
je 0x49ed48
mov edi, dword [ebp + 8]
mov dword [edi], eax
jmp 0x49ee04
mov dword [ebp - 0x20], esi
cmp dword [ebx + 8], 0x7ffffff
je 0x49ee19
lea eax, [ebx + 4]
lea ecx, [ebp - 0x2c]
push dword [ebp + 0x10]
push eax
call fcn.0049ee7c
mov eax, dword [ebx + 8]
inc eax
movq xmm0, qword [0x72d330]
movd xmm1, eax
por xmm1, xmm0
subsd xmm1, xmm0
cvtsd2ss xmm1, xmm1
movss xmm2, dword [ebx + 0x1c]
orpd xmm2, xmm0
subsd xmm2, xmm0
xorps xmm0, xmm0
cvtsd2ss xmm0, xmm2
divss xmm1, xmm0
ucomiss xmm1, dword [ebx]
jbe 0x49eddb
mov dword [ebp - 0x10], 0
mov ecx, ebx
mov dword [ebp - 0x24], ebx
call fcn.0049ef26
mov eax, dword [ebp - 0x28]
add eax, 8
lea edx, [ebp - 0x3c]
mov ecx, dword [ebp - 0x24]
push dword [ebp - 0x20]
push eax
push dword [ebp + 0xc]
push edx
call fcn.0049ee38
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], eax
mov ebx, dword [ebp - 0x24]
jmp 0x49edde
mov eax, dword [ebp - 0x34]
mov edi, dword [ebp - 0x20]
lea esi, [ebp - 0x2c]
mov edx, dword [esi + 4]
mov dword [esi + 4], 0
mov ecx, ebx
push edx
push eax
push edi
call fcn.0049ef98
mov edi, dword [ebp + 8]
mov dword [edi], eax
mov ecx, esi
call fcn.0049efe8
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, edi
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
push str.unordered_map_set_too_long
call fcn.0053f40d
nop
push ebp
sub esp, 0x10
add ebp, 0xc
lea ecx, [ebp - 0x2c]
call fcn.0049efe8
add esp, 0x10
pop ebp
ret
Function at 0x49f086
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 0x18]
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x49f2e0
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
mov eax, dword [edx + 0x10]
cmp dword [edx + 0x14], 0x10
mov ecx, edx
jb 0x49f0c5
mov ecx, dword [edx]
mov esi, 0x811c9dc5
test eax, eax
je 0x49f0e1
xor edx, edx
movzx edi, byte [ecx + edx]
xor edi, esi
imul esi, edi, 0x1000193
inc edx
cmp eax, edx
jne 0x49f0d0
mov ebx, dword [ebp + 8]
lea edi, [ebp - 0x34]
mov ecx, dword [ebp - 0x20]
push esi
push dword [ebp + 0xc]
push edi
call fcn.0049f030
mov eax, dword [edi + 4]
test eax, eax
je 0x49f106
mov dword [ebx], eax
mov byte [ebx + 4], 0
jmp 0x49f1cc
mov dword [ebp - 0x24], esi
mov eax, dword [ebp - 0x20]
cmp dword [eax + 8], 0x7ffffff
mov dword [ebp - 0x10], 0xffffffff
je 0x49f1e1
mov esi, dword [ebp - 0x20]
lea eax, [esi + 4]
lea ecx, [ebp - 0x2c]
push dword [ebp + 0xc]
push eax
call fcn.0049f200
mov eax, dword [esi + 8]
inc eax
movq xmm0, qword [0x72d330]
movd xmm1, eax
por xmm1, xmm0
subsd xmm1, xmm0
cvtsd2ss xmm1, xmm1
movss xmm2, dword [esi + 0x1c]
orpd xmm2, xmm0
subsd xmm2, xmm0
xorps xmm0, xmm0
cvtsd2ss xmm0, xmm2
divss xmm1, xmm0
ucomiss xmm1, dword [esi]
jbe 0x49f19e
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0x20]
call fcn.0049ef26
mov eax, dword [ebp - 0x28]
add eax, 8
lea esi, [ebp - 0x3c]
mov ecx, dword [ebp - 0x20]
mov edi, dword [ebp - 0x24]
push edi
push eax
push esi
call fcn.0049f030
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], eax
jmp 0x49f1a4
mov eax, dword [ebp - 0x34]
mov edi, dword [ebp - 0x24]
lea esi, [ebp - 0x2c]
mov edx, dword [esi + 4]
mov dword [esi + 4], 0
mov ecx, dword [ebp - 0x20]
push edx
push eax
push edi
call fcn.0049ef98
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov byte [ebx + 4], 1
mov ecx, esi
call fcn.0049efe8
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ebx
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.0053f40d
nop
push ebp
sub esp, 0xc
add ebp, 0xc
lea ecx, [ebp - 0x2c]
call fcn.0049efe8
add esp, 0xc
pop ebp
ret
Function at 0x4a3952
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
lea eax, [ebp - 0x18]
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x4a3f00
mov edx, dword fs:[0]
mov dword [eax], edx
mov dword fs:[0], eax
mov eax, dword [ecx + 0x1c]
mov edx, dword [ecx + 0xc]
cmp eax, edx
jae 0x4a39fe
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], ecx
push 8
call fcn.0053e4fc
add esp, 4
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x10], 0
push 4
call fcn.0053e4fc
add esp, 4
mov ecx, eax
mov eax, dword [ebp - 0x24]
mov dword [ecx], eax
mov edx, dword [ebp - 0x20]
add edx, 4
mov dword [ebp - 0x10], 1
xor eax, eax
mov dword [ebp - 0x28], edx
push edx
push eax
mov dword [ebp - 0x2c], ecx
push ecx
push 0x4a3c4e
push eax
push eax
call fcn.0070868c
add esp, 0x18
mov ecx, dword [ebp - 0x20]
mov dword [ecx], eax
test eax, eax
je 0x4a3a15
mov eax, ecx
mov dword [ebp - 0x10], 0xffffffff
mov ecx, dword [ebp - 0x24]
push eax
call fcn.004a3a9c
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x30]
cmp eax, edx
setb al
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x28]
mov dword [eax], 0
push 6
call fcn.0053f37d
add esp, 4
push ebp
sub esp, 0x18
add ebp, 0xc
push dword [ebp - 0x2c]
call fcn.0053e52c
add esp, 0x1c
pop ebp
ret

Function at 0x4a3a9c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov esi, esp
mov dword [esi + 0x30], ebp
mov ebx, ecx
lea edi, [esi + 0x38]
mov dword [edi - 4], esp
mov dword [edi + 8], 0xffffffff
mov dword [edi + 4], 0x4a3f10
mov eax, dword fs:[0]
mov dword [edi], eax
mov dword fs:[0], edi
add ecx, 0x2c
mov dword [esi], ecx
call fcn.0040828a
mov dword [esi + 4], ebx
lock inc dword [ebx + 0x1c]
xor eax, eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [edi + 8], eax
lea ecx, [esi + 0x28]
push dword [ebp + 8]
call fcn.004a3f8c
movsd xmm0, qword [esi + 0x28]
movsd qword [esi + 8], xmm0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 1
push 0
call fcn.0070fd1a
add esp, 4
lea edi, [esi + 8]
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], edx
xor eax, eax
mov dword [edi + 0x1c], eax
mov dword [edi + 0x18], eax
mov eax, dword [esi + 4]
lea ecx, [eax + 0x24]
push edi
push dword [eax + 0x24]
call fcn.004a40d0
push dword [esi]
call fcn.005405bb
add esp, 4
mov edi, dword [esi + 0xc]
test edi, edi
je 0x4a3b6a
lock dec dword [edi + 4]
jne 0x4a3b6a
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
lock dec dword [edi + 8]
jne 0x4a3b6a
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov eax, dword [esi + 0x38]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x4a99b0
Capabilities:
Read file on windows

Disassembly:
push esi
push eax
mov esi, dword [esp + 0xc]
mov dword [esp], 0
mov ecx, dword [esi + 8]
lea edx, [ecx - 1]
mov eax, 0xffffff91
cmp edx, 0xfffffffd
ja 0x4a99f9
mov eax, esp
push 0
push eax
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4a99f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0x26
cmovne ecx, eax
mov dword [esi + 0xc], ecx
mov eax, dword [esp]
add esp, 4
pop esi
ret

Function at 0x4ab21a
Capabilities:
Delete directory
Delete file

Disassembly:
push ebx
push edi
push esi
mov ebx, dword [esp + 0x10]
mov edi, 0xffffff9a
test ebx, ebx
je 0x4ab272
push 0xfde9
push ebx
call fcn.004ab000
add esp, 8
test eax, eax
je 0x4ab272
mov esi, eax
push ebx
call fcn.004ab278
add esp, 4
test eax, eax
je 0x4ab254
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x4ab25b
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edi, eax
push esi
call fcn.00712486
add esp, 4
xor eax, eax
test edi, edi
mov edi, 0xffffff95
cmovne edi, eax
mov eax, edi
pop esi
pop edi
pop ebx
ret

Function at 0x4ab278
Capabilities:
Check if file exists

Disassembly:
push ebx
push edi
push esi
mov eax, dword [esp + 0x10]
mov esi, 0xffffff9a
test eax, eax
je 0x4ab2c1
push 0xfde9
push eax
call fcn.004ab000
add esp, 8
test eax, eax
je 0x4ab2c1
mov edi, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
push edi
call fcn.00712486
add esp, 4
xor esi, esi
test bl, 0x10
mov eax, 0xffffff95
cmove esi, eax
cmp ebx, 0xffffffff
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x4ab2c7
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push edi
push esi
mov eax, dword [esp + 0xc]
mov esi, 0xffffff9a
test eax, eax
je 0x4ab309
push 0xfde9
push eax
call fcn.004ab000
add esp, 8
test eax, eax
je 0x4ab309
mov edi, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
push edi
call fcn.00712486
add esp, 4
xor eax, eax
cmp esi, 0xffffffff
mov esi, 0xffffff95
cmovne esi, eax
mov eax, esi
pop esi
pop edi
ret

Function at 0x4ab30e
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x10
mov eax, dword [ebp + 8]
xor esi, esi
dec esi
mov edi, 0xffffff9a
test eax, eax
je 0x4ab388
push 0xfde9
push eax
call fcn.004ab000
add esp, 8
test eax, eax
je 0x4ab388
mov ebx, eax
sub esp, 0x14
movaps xmm0, xmmword [0x732020]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
call dword [0x72f674]
mov edi, eax
push ebx
call fcn.00712486
add esp, 4
xor esi, esi
mov dword [esp + 4], esi
mov dword [esp], esi
cmp edi, 0xffffffff
je 0x4ab386
mov esi, esp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esi]
mov esi, dword [esi + 4]
jmp 0x4ab388
xor edi, edi
mov eax, edi
mov edx, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4ab49c
Capabilities:
Timestomp file

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [esp + 0x2c]
mov edi, 0xffffff9a
test eax, eax
je 0x4ab5d7
push 0xfde9
push eax
call fcn.004ab000
add esp, 8
test eax, eax
je 0x4ab5d7
mov ebx, eax
sub esp, 0x14
movaps xmm0, xmmword [0x732030]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
call dword [0x72f674]
mov esi, eax
push ebx
call fcn.00712486
add esp, 4
cmp esi, 0xffffffff
je 0x4ab5d5
mov edi, dword [esp + 0x38]
mov ebp, dword [esp + 0x34]
mov ebx, dword [esp + 0x30]
mov edx, esp
lea ecx, [esp + 8]
lea eax, [esp + 0x10]
push edx
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
mov eax, ebx
or eax, ebp
je 0x4ab544
mov ecx, 0x989680
mov eax, ebx
mul ecx
imul ecx, ebp, 0x989680
add ecx, edx
mov edx, 0xd53e8000
add eax, edx
mov edx, 0x19db1de
adc ecx, edx
mov dword [esp], eax
mov dword [esp + 4], ecx
mov ebx, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
mov eax, edi
mov edx, dword [esp + 0x3c]
or eax, edx
mov ebp, 0x19db1de
je 0x4ab584
mov ebp, edx
mov edx, 0x989680
mov eax, edi
mul edx
imul edi, ebp, 0x989680
mov ebp, 0x19db1de
add edi, edx
mov edx, 0xd53e8000
add eax, edx
adc edi, ebp
mov dword [esp + 8], eax
mov dword [esp + 0xc], edi
mov eax, ecx
or eax, ebx
je 0x4ab5ac
mov edx, 0x989680
mov eax, ecx
mul edx
imul ecx, ebx, 0x989680
add ecx, edx
mov edx, 0xd53e8000
add eax, edx
adc ecx, ebp
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
mov eax, esp
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
xor ecx, ecx
test eax, eax
mov edi, 0xffffff98
cmovne edi, ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4ab5d7
xor edi, edi
mov eax, edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4ab5e1
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push edi
push esi
mov eax, dword [esp + 0x10]
mov esi, 0xffffff9a
test eax, eax
je 0x4ab62c
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0x4ab62c
push 0xfde9
push eax
call fcn.004ab000
add esp, 8
test eax, eax
je 0x4ab62c
mov edi, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebx], eax
push edi
call fcn.00712486
add esp, 4
xor eax, eax
cmp dword [ebx], 0xffffffff
mov esi, 0xffffff98
cmovne esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x4ab632
Capabilities:
Set file attributes

Disassembly:
push edi
push esi
mov eax, dword [esp + 0xc]
mov esi, 0xffffff9a
test eax, eax
je 0x4ab675
push 0xfde9
push eax
call fcn.004ab000
add esp, 8
test eax, eax
je 0x4ab675
mov edi, eax
push dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor ecx, ecx
test eax, eax
mov esi, 0xffffff98
cmovne esi, ecx
push edi
call fcn.00712486
add esp, 4
mov eax, esi
pop esi
pop edi
ret
Function at 0x4ab67a
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push edi
push esi
mov edi, dword [esp + 0xc]
mov esi, 0xffffff9a
test edi, edi
je 0x4ab6ea
cmp byte [edi], 0
je 0x4ab6a9
push edi
call fcn.007149b0
add esp, 4
cmp eax, 3
ja 0x4ab6a9
cmp byte [edi + 1], 0x3a
jne 0x4ab6a9
pop esi
pop edi
jmp fcn.004ab278
push 0xfde9
push edi
call fcn.004ab000
add esp, 8
test eax, eax
je 0x4ab6ea
mov edi, eax
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor esi, esi
test eax, eax
jne 0x4ab6e1
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0xb7
mov esi, 0xffffff98
cmove esi, ecx
push edi
call fcn.00712486
add esp, 4
mov eax, esi
pop esi
pop edi
ret

Function at 0x4ab84a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push edi
push esi
mov eax, dword [esp + 0x10]
mov esi, 0xffffff9a
test eax, eax
je 0x4ab894
push 0xfde9
push eax
call fcn.004ab000
add esp, 8
test eax, eax
je 0x4ab894
mov edi, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
push edi
call fcn.00712486
add esp, 4
xor esi, esi
bt ebx, 0xa
mov eax, 0xffffff95
cmovae esi, eax
cmp ebx, 0xffffffff
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x4adfe4
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
test byte [esp + 0x194], 2
jne 0x4ae051
push str.iphlpapi.dll
call fcn.004ae080
add esp, 4
mov dword [0x7f3d3c], eax
test eax, eax
je 0x4ae01f
push str.if_nametoindex
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4ae01f
mov dword [0x7f3d38], eax
sub esp, 0x14
movaps xmm0, xmmword [0x732180]
movups xmmword [esp], xmm0
mov dword [esp + 0x10], 3
call fcn.004cbac4
add esp, 0x14
mov byte [0x7f3d40], al
push 0x7f3d48
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor eax, eax
jmp 0x4ae079
mov eax, esp
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x4ae074
movzx eax, word [esp]
cmp eax, 0x202
je 0x4adff4
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
add esp, 0x190
ret

Function at 0x4ae080
Capabilities:
Get common file path

Disassembly:
push ebp
push ebx
push edi
push esi
push 0x798435
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x4ae0c1
mov edi, eax
mov ebx, dword [esp + 0x14]
push str.LoadLibraryExA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push 0x79863d
push ebx
call fcn.00714df0
add esp, 8
test eax, eax
je 0x4ae0c7
test esi, esi
je 0x4ae0e7
push 8
jmp 0x4ae0e0
xor ebx, ebx
mov eax, ebx
jmp 0x4ae0ee
test esi, esi
je 0x4ae0f3
push 0x7913b1
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4ae0f3
push 0x800
push 0
push ebx
call esi
jmp 0x4ae0ee
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop esi
pop edi
pop ebx
pop ebp
ret
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x4ae0c3
mov ebp, eax
push dword [esp + 0x14]
call fcn.007149b0
add esp, 4
add eax, ebp
inc eax
push eax
call dword [0x7ec0dc]
add esp, 4
mov edi, eax
xor ebx, ebx
test eax, eax
je 0x4ae16f
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x4ae16f
push edi
call fcn.007149b0
add esp, 4
mov word [edi + eax], 0x5c
push edi
call fcn.007149b0
add esp, 4
mov ecx, edi
add ecx, eax
push dword [esp + 0x14]
push ecx
call fcn.00714740
add esp, 8
test esi, esi
je 0x4ae166
push 8
push 0
push edi
call esi
jmp 0x4ae16d
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
push edi
call dword [0x7ec0e0]
add esp, 4
jmp 0x4ae0c3
Function at 0x4b62ff
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
sub esp, 8
mov esi, ecx
lea eax, [esp + 4]
mov dword [eax], 4
mov ecx, esp
push eax
push ecx
push 0x1008
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x4b633a
cmp dword [esp], 1
jne 0x4b633a
xor eax, eax
push eax
push eax
push eax
push esi
call dword [sym.imp.WS2_32.dll_send]
add esp, 8
pop esi
ret
Function at 0x4b9b3c
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push ebx
push edi
push esi
xor edi, edi
test ecx, ecx
je 0x4b9be3
mov esi, ecx
push ecx
call fcn.004cc2be
add esp, 4
test al, al
jne 0x4b9be3
push esi
call fcn.007149b0
add esp, 4
mov edi, eax
push eax
push 0x2e
push esi
call fcn.004dad20
add esp, 0xc
xor ebx, ebx
test eax, eax
je 0x4b9b92
sub eax, esi
push eax
push 0x2e
push esi
call fcn.004dad20
add esp, 0xc
test eax, eax
je 0x4b9b92
inc eax
add edi, esi
sub edi, eax
mov ebx, eax
test ebx, ebx
cmovne esi, ebx
test edi, edi
jle 0x4b9bde
add edi, esi
mov ecx, 0x1505
mov ebx, ecx
shl ebx, 5
add ebx, ecx
movsx eax, byte [esi]
inc esi
push eax
call fcn.004bddd0
add esp, 4
movsx ecx, al
xor ecx, ebx
cmp esi, edi
jb 0x4b9ba2
mov edx, 0x4104105
mov eax, ecx
mul edx
mov edi, ecx
sub edi, edx
shr edi, 1
add edi, edx
shr edi, 5
mov eax, edi
shl eax, 6
sub edi, eax
add edi, ecx
jmp 0x4b9be3
mov edi, 0x1a
mov eax, edi
pop esi
pop edi
pop ebx
ret

Function at 0x4c0ca1
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebx, edx
mov esi, ecx
lea edi, [esp + 3]
mov byte [edi], bl
mov eax, dword [ecx + 0x10028]
not eax
xor ebp, ebp
inc ebp
push ebp
push edi
push eax
call fcn.004c1424
add esp, 0xc
not eax
mov dword [esi + 0x10028], eax
movzx eax, al
add eax, dword [esi + 0x1002c]
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 0x1002c], eax
shr eax, 0x18
mov byte [edi], al
mov eax, dword [esi + 0x10030]
not eax
push ebp
push edi
push eax
call fcn.004c1424
add esp, 0xc
not eax
mov dword [esi + 0x10030], eax
mov eax, ebx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4c1429
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
mov ebx, 0xffffff9a
cmp dword [esp + 0x50], 0
je 0x4c165f
cmp dword [esp + 0x58], 0
je 0x4c165f
mov eax, dword [esp + 0x64]
test eax, eax
je 0x4c165f
movzx ecx, word [esp + 0x68]
movzx ecx, cx
mov dword [esp], ecx
push ecx
push 0
push eax
call fcn.006fba50
add esp, 0xc
call fcn.00475220
mov edi, eax
mov dword [esp + 0xc], eax
call fcn.00475220
mov ebp, eax
mov dword [esp + 8], eax
call fcn.00475220
mov dword [esp + 4], eax
mov ebx, 0xfffffffc
test edi, edi
je 0x4c1638
test ebp, ebp
je 0x4c1638
mov esi, eax
test eax, eax
je 0x4c1638
mov ebx, 0x14
push ebx
push edi
call fcn.004751ce
add esp, 8
push ebx
push ebp
call fcn.004751ce
add esp, 8
push ebx
push esi
call fcn.004751ce
add esp, 8
push dword [esp + 0x54]
mov eax, dword [esp + 0x54]
push eax
push edi
call fcn.0047504e
add esp, 0xc
mov ebx, eax
test eax, eax
jne 0x4c1511
push dword [esp + 0x54]
push dword [esp + 0x54]
push ebp
call fcn.0047504e
add esp, 0xc
mov ebx, eax
test eax, eax
jne 0x4c1511
push dword [esp + 0x5c]
push dword [esp + 0x5c]
push ebp
call fcn.00475110
add esp, 0xc
mov ebx, eax
mov eax, dword [esp]
dec eax
mov ecx, 0x66666667
imul ecx
test ebx, ebx
jne 0x4c1638
mov eax, edx
shr eax, 0x1f
sar edx, 3
add edx, eax
xor ebp, ebp
xorps xmm0, xmm0
xor edi, edi
mov dword [esp + 0x10], edx
movups xmmword [esp + 0x28], xmm0
mov dword [esp + 0x38], 0
push esi
push dword [esp + 0xc]
call fcn.004751dc
add esp, 8
test eax, eax
jne 0x4c1636
mov eax, ebp
inc eax
mov word [esp + 0x14], 0
mov byte [esp + 0x16], ah
mov dword [esp], eax
mov byte [esp + 0x17], al
cmp dword [esp + 0x60], 0
je 0x4c15de
xor ebp, ebp
mov eax, 4
lea ebx, [esp + 0x14]
push eax
push ebx
push esi
call fcn.00475110
add esp, 0xc
test eax, eax
jne 0x4c1636
mov esi, dword [esp + 4]
push 0x14
push ebx
push esi
call fcn.0047514c
add esp, 0xc
test eax, eax
jne 0x4c1636
xor eax, eax
mov cl, byte [esp + eax + 0x14]
xor byte [esp + eax + 0x28], cl
inc eax
cmp eax, 0x14
jne 0x4c15af
push esi
push dword [esp + 0x10]
call fcn.004751dc
add esp, 8
test eax, eax
jne 0x4c1636
inc ebp
mov eax, 0x14
cmp ebp, dword [esp + 0x60]
lea ebx, [esp + 0x14]
jne 0x4c1582
shl edi, 2
lea eax, [edi + edi*4]
movzx ecx, word [esp + 0x68]
cmp ax, cx
jae 0x4c161d
movzx ecx, ax
add ecx, dword [esp + 0x64]
not eax
movzx edx, word [esp + 0x68]
add eax, edx
cmp ax, 0x13
mov edx, 0x13
cmovae eax, edx
inc eax
movzx eax, ax
push eax
lea eax, [esp + 0x2c]
push eax
push ecx
call fcn.006fb4d0
add esp, 0xc
mov edi, dword [esp]
movzx ebp, di
xor ebx, ebx
mov edx, dword [esp + 0x10]
cmp ebp, edx
xorps xmm0, xmm0
jbe 0x4c1539
jmp 0x4c1638
mov ebx, eax
lea eax, [esp + 4]
push eax
call fcn.00475237
add esp, 4
lea eax, [esp + 0xc]
push eax
call fcn.00475237
add esp, 4
lea eax, [esp + 8]
push eax
call fcn.00475237
add esp, 4
mov eax, ebx
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret