joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bc360
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x88
mov eax, dword [0x5ca3a0]
xor eax, esp
mov dword [esp + 0x84], eax
push ebx
push ebp
mov ebp, dword [esp + 0x94]
mov ebx, dword [ebp]
push esi
mov esi, dword [ebp + 0x3f0]
push edi
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 0x80
mov edx, dword [esi + 0x154]
mov eax, dword [esi + 0x15c]
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esi + 0x14]
push 0
add edx, 4
lea edi, [esi + 0x15c]
push edx
push eax
push ecx
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [esi + 0x148], 0
mov dword [esi + 0x14c], eax
jne 0x4bc3ef
mov edx, dword [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esi + 0xc8]
push ecx
call fcn.00482b90
mov edx, dword [esp + 0x1c]
add esp, 0xc
mov dword [esi + 0x148], edx
mov edx, dword [esi + 0x14c]
cmp edx, 4
jge 0x4bc42a
push str.Received_too_short_packet
push ebx
call fcn.004ac540
add esp, 8
mov dword [esi + 0xc], 7
xor eax, eax
mov ecx, dword [esp + 0x94]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0047da50
add esp, 0x88
ret
mov eax, edi
call fcn.004bb2a0
movzx eax, ax
mov dword [esi + 0xc], eax
add eax, 0xfffffffd
cmp eax, 3
ja case.default.0x4bc443
jmp dword [eax*4 + 0x4bc52c]
cmp edx, 4
jle case.0x4bc443.4
mov eax, edi
call fcn.004bb2b0
movzx ecx, word [esi + 0x40]
inc ecx
cmp cx, ax
jne case.0x4bc443.4
add edx, 0xfffffffc
push edx
mov edx, dword [edi]
add edx, 4
push edx
push 1
push ebp
call fcn.004ac820
mov edi, eax
add esp, 0x10
test edi, edi
je 0x4bc496
mov ecx, 5
mov eax, esi
call fcn.004bc2e0
mov eax, edi
jmp 0x4bc411
mov eax, dword [esi + 0x14c]
sub eax, 4
cdq
add dword [ebx + 0x38], eax
mov ecx, dword [ebx + 0x38]
adc dword [ebx + 0x3c], edx
mov eax, dword [ebx + 0x3c]
push eax
push ecx
push ebx
call fcn.004b6830
jmp 0x4bc502
mov eax, edi
call fcn.004bb2b0
movzx edx, ax
mov eax, dword [edi]
add eax, 4
push eax
push 0x57c1d0
push ebx
mov dword [esi + 8], edx
call fcn.004ac4b0
jmp 0x4bc502
mov ecx, dword [edi]
add edx, 0xfffffffe
push edx
add ecx, 2
push ecx
push esi
call fcn.004bb340
add esp, 0xc
test eax, eax
je case.0x4bc443.4
jmp 0x4bc411
push str.Internal_error:_Unexpected_packet
push 0x57434c
push ebx
call fcn.004ac540
add esp, 0xc
push ebp
call fcn.004b68f0
add esp, 4
test eax, eax
je 0x4bc40f
mov ecx, 5
mov eax, esi
call fcn.004bc2e0
mov eax, 0x2a
jmp 0x4bc411

Function at 0x4bd820
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
mov edx, dword [edi + 0x130]
mov al, byte [esp + 8]
push esi
mov esi, dword [edi]
push 0
push 3
lea ecx, [esp + 0xc]
push ecx
push edx
mov byte [esp + 0x14], 0xff
mov byte [esp + 0x15], al
mov byte [esp + 0x16], bl
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jge 0x4bd864
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push esi
call fcn.004ac540
add esp, 0xc
mov esi, dword [esp + 0xc]
mov ecx, dword [edi]
push str.SENT
mov eax, ebx
call fcn.004bd720
add esp, 4
pop esi
pop ecx
ret
Function at 0x4bee60
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x18
mov eax, dword [0x5ca3a0]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
mov ebx, dword [esi + 0x134]
push ebp
push edi
mov edi, dword [esi]
push 1
push 0
push edi
or ebp, 0xffffffff
mov dword [esp + 0x18], 0x10
call fcn.004ac980
add esp, 0xc
test eax, eax
jl 0x4beec9
mov ecx, 0x3e8
cmp eax, ecx
jge 0x4beea0
mov ecx, eax
push ecx
push 0xffffffffffffffff
push ebx
call fcn.004c6dd0
add esp, 0xc
cmp eax, 0xffffffff
je 0x4bef64
test eax, eax
jne 0x4beeee
push 1
push eax
push edi
call fcn.004ac980
add esp, 0xc
test eax, eax
jge 0x4bee95
push str.Timeout_while_waiting_for_server_connect
push edi
call fcn.004ac540
add esp, 8
pop edi
pop ebp
mov eax, 0x1c
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0047da50
add esp, 0x18
ret
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
push ebx
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x4bef1e
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x14]
push eax
push ebx
mov dword [esp + 0x18], 0x10
call dword [sym.imp.WS2_32.dll_accept]
mov ebp, eax
push ebx
push esi
call fcn.004ad1b0
add esp, 8
cmp ebp, 0xffffffff
jne 0x4bef34
push str.Error_accept__ing_server_connect
jmp 0x4bef69
push str.Connection_accepted_from_server_n
push edi
call fcn.004ac4b0
push 1
push ebp
mov dword [esi + 0x134], ebp
call fcn.004c9eb0
add esp, 0x10
pop edi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0047da50
add esp, 0x18
ret
push str.Error_while_waiting_for_server_connect
push edi
call fcn.004ac540
mov ecx, dword [esp + 0x28]
add esp, 8
pop edi
pop ebp
pop ebx
xor ecx, esp
mov eax, 0x1e
call fcn.0047da50
add esp, 0x18
ret
Function at 0x4c6dd0
Capabilities:
Check for time delay via gettickcount
Get socket status

Disassembly:
sub esp, 0x31c
push ebx
mov ebx, dword [esp + 0x324]
push ebp
mov ebp, dword [esp + 0x32c]
push esi
xor esi, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
cmp ebx, 0xffffffff
jne 0x4c6e14
cmp ebp, ebx
jne 0x4c6e14
mov eax, dword [esp + 0x334]
push eax
call fcn.004c6da0
add esp, 4
pop esi
pop ebp
pop ebx
add esp, 0x31c
ret
push edi
mov edi, dword [esp + 0x338]
cmp edi, esi
jle 0x4c6e2f
mov esi, edi
call fcn.004b3150
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
xor eax, eax
xor ecx, ecx
or edx, 0xffffffff
mov dword [esp + 0x20], ecx
mov dword [esp + 0x124], eax
cmp ebx, 0xffffffff
je 0x4c6e63
mov ecx, 1
mov dword [esp + 0x128], ebx
mov dword [esp + 0x124], ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ecx
mov edx, ebx
mov dword [esp + 0x228], eax
cmp ebp, 0xffffffff
je 0x4c6ea7
mov dword [esp + 0x22c], ebp
mov dword [esp + 0x228], 1
test ecx, ecx
jbe 0x4c6e90
cmp dword [esp + eax*4 + 0x24], ebp
je 0x4c6e90
inc eax
cmp eax, ecx
jb 0x4c6e85
cmp eax, ecx
jne 0x4c6ea1
cmp ecx, 0x40
jae 0x4c6ea1
mov dword [esp + eax*4 + 0x24], ebp
inc dword [esp + 0x20]
cmp ebp, edx
jbe 0x4c6ea7
mov edx, ebp
xor ebx, ebx
test edi, edi
setl bl
lea ecx, [esp + 0x18]
lea ebp, [edx + 1]
dec ebx
and ebx, ecx
xor eax, eax
cmp edi, eax
jle 0x4c6ee9
mov eax, 0x10624dd3
imul esi
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x18], eax
imul eax, eax, 0x3e8
mov edx, esi
sub edx, eax
imul edx, edx, 0x3e8
mov dword [esp + 0x1c], edx
jmp 0x4c6ef3
jne 0x4c6ef3
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
push ebx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x230]
push ecx
lea edx, [esp + 0x130]
push edx
push ebp
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
jne 0x4c6f5d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
je 0x4c6f26
cmp eax, 0x2714
jne 0x4c6f61
test edi, edi
jle 0x4c6eb8
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push eax
push ecx
call fcn.004b3150
push edx
push eax
call fcn.004b3180
mov esi, edi
sub esi, eax
add esp, 0x10
test esi, esi
jg 0x4c6eb8
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x31c
ret
test eax, eax
jge 0x4c6f6f
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x31c
ret
jne 0x4c6f7e
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x31c
ret
mov edi, dword [esp + 0x330]
xor esi, esi
cmp edi, 0xffffffff
je 0x4c6fb5
lea edx, [esp + 0x124]
push edx
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x4c6fa3
mov esi, 1
lea eax, [esp + 0x20]
push eax
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x4c6fb5
or esi, 4
mov edi, dword [esp + 0x334]
cmp edi, 0xffffffff
je 0x4c6fe8
lea ecx, [esp + 0x228]
push ecx
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x4c6fd6
or esi, 2
lea edx, [esp + 0x20]
push edx
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x4c6fe8
or esi, 4
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x31c
ret
Function at 0x4c7e70
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x5ca3a0]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call fcn.004993c1
add esp, 4
mov byte [esp], 0
test eax, eax
je 0x4c7ed5
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp byte [esp], 0
je 0x4c7ed5
lea edx, [esp]
push edx
call dword [0x5cb888]
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0047da50
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor ecx, esp
xor eax, eax
call fcn.0047da50
add esp, 0x108
ret
jmp 0x4c7e70

Function at 0x4c7ef0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x5ca3a0]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call fcn.004993c1
add esp, 4
mov byte [esp], 0
test eax, eax
je 0x4c7ed5
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp byte [esp], 0
je 0x4c7ed5
lea edx, [esp]
push edx
call dword [0x5cb888]
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0047da50
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor ecx, esp
xor eax, eax
call fcn.0047da50
add esp, 0x108
ret
jmp 0x4c7e70

Function at 0x4cb570
Capabilities:
Get hostname

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push esi
mov byte [esi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [esi + edi - 1], 0
test eax, eax
jne 0x4cb5a2
push 0x2e
push esi
call fcn.00485080
add esp, 8
test eax, eax
je 0x4cb5a0
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
ret
Function at 0x4e5a90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, 0x474
call fcn.0047f910
mov eax, dword [0x5ca3a0]
xor eax, esp
mov dword [esp + 0x470], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [esp + 0x3c], 0
test esi, esi
jne 0x4e5ad7
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x470]
xor ecx, esp
call fcn.0047da50
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x48]
push eax
push esi
call fcn.0054fa3f
add esp, 8
test eax, eax
jl 0x4e5ac0
mov eax, 8
call fcn.0047f910
fldz
fstp qword [esp]
lea ecx, [esp + 0x50]
push 0x30
push ecx
call fcn.004e5900
mov ebx, dword [ebp + 0xc]
add esp, 0x10
test ebx, ebx
je 0x4e5ac0
push 0x574480
push esi
call fcn.00483c88
add esp, 8
mov dword [esp + 0x40], eax
test eax, eax
je 0x4e5bb1
jmp 0x4e5b34
mov eax, dword [esp + 0x40]
test ebx, ebx
jle 0x4e5b42
cmp ebx, 0x400
mov esi, ebx
jl 0x4e5b47
mov esi, 0x400
push eax
push esi
lea edx, [esp + 0x80]
push 1
push edx
call fcn.00485565
mov edi, eax
add esp, 0x10
mov dword [esp + 0x44], edi
test edi, edi
jle 0x4e5b95
fild dword [esp + 0x44]
mov eax, 8
call fcn.0047f910
lea eax, [esp + 0x80]
fstp qword [esp]
push esi
push eax
call fcn.004e5900
add dword [esp + 0x4c], edi
add esp, 0x10
test ebx, ebx
jle 0x4e5b30
sub ebx, esi
test ebx, ebx
jg 0x4e5b30
mov ecx, dword [esp + 0x40]
push ecx
call fcn.004833e1
lea edx, [esp + 0x7c]
push 0x400
push edx
call fcn.005502d0
add esp, 0xc
mov ecx, dword [esp + 0x47c]
mov eax, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0047da50
mov esp, ebp
pop ebp
ret

Function at 0x4f1eb0
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x5c
push 0
push esi
call fcn.0047d440
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov eax, 1
pop esi
ret
Function at 0x4f2bd0
Capabilities:
Access the windows event log

Disassembly:
mov eax, 0x108
call fcn.0047f910
mov eax, dword [0x5ca3a0]
xor eax, esp
mov dword [esp + 0x104], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x4f2c35
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x4f2c35
mov ecx, dword [esp + 0x10c]
lea eax, [esp + 0x110]
push eax
push ecx
call fcn.0049307f
add eax, 0x40
push eax
call fcn.00496bf5
add esp, 0xc
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0047da50
add esp, 0x108
ret
mov eax, dword [esp + 0x10c]
lea edx, [esp + 0x110]
push edx
push eax
lea ecx, [esp + 0xc]
push 0xff
push ecx
call fcn.0054fe22
add esp, 0x10
mov byte [esp + 0x103], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x4f2cc4
call fcn.004f2a90
test eax, eax
jle 0x4f2cc4
push esi
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push 0
mov esi, eax
lea eax, [esp + 8]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
lea edx, [esp + 0x28]
push esi
mov dword [esp + 0x28], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0047da50
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0047da50
add esp, 0x108
ret

Function at 0x4f2d20
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0x10]
xor cl, cl
test edi, edi
jbe 0x4f2d44
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
sub esi, eax
mov dl, byte [esi + eax]
xor dl, byte [eax]
inc eax
or cl, dl
sub edi, 1
jne 0x4f2d36
pop esi
movzx eax, cl
pop edi
ret

Function at 0x4f3130
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
xor esi, esi
test edx, edx
je 0x4f3177
mov al, byte [edx]
test al, al
je 0x4f3177
push edi
mov edi, 0x100
movsx eax, al
or eax, edi
mov ecx, eax
shr ecx, 2
xor ecx, eax
and ecx, 0xf
add edi, 0x100
rol esi, cl
mov ecx, eax
imul ecx, eax
mov al, byte [edx + 1]
inc edx
xor esi, ecx
test al, al
jne 0x4f3147
mov eax, esi
shr eax, 0x10
pop edi
xor eax, esi
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x4f7fb0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x24
call fcn.0047f910
mov eax, dword [0x5ca3a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, esi
push edi
mov dword [ebp - 0x18], esi
lea ecx, [eax + 1]
jmp 0x4f7fe0
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4f7fe0
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0
sub eax, ecx
lea edi, [eax + 1]
push edi
push esi
push 8
push 0xfde9
mov dword [ebp - 0x20], 8
call ebx
mov esi, eax
test esi, esi
jg 0x4f8058
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3ec
jne 0x4f803a
mov ecx, dword [ebp - 0x18]
push 0
push 0
push edi
push ecx
push 0
push 0xfde9
mov dword [ebp - 0x20], 0
call ebx
mov esi, eax
test esi, esi
jg 0x4f8058
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x459
jne 0x4f80ea
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
push edx
push eax
jmp 0x4f80d8
lea eax, [esi + esi]
call fcn.00487660
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
mov eax, esp
push esi
push eax
push edi
push ecx
push edx
push 0xfde9
mov dword [ebp - 0x24], eax
call ebx
test eax, eax
je 0x4f80ea
mov esi, dword [ebp - 0x1c]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4f8083
push 8
sub eax, edx
lea ecx, [ebp - 0x14]
push ecx
inc eax
push eax
push esi
push 0
push 0xfde9
call ebx
test eax, eax
je 0x4f80ea
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x14]
push edx
push eax
call fcn.00483704
mov esi, eax
add esp, 8
test esi, esi
jne 0x4f818e
call fcn.00485227
cmp dword [eax], 2
je 0x4f80d0
call fcn.00485227
cmp dword [eax], 9
jne 0x4f80e2
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
push ecx
push edx
call fcn.00483c88
mov esi, eax
add esp, 8
test esi, esi
jne 0x4f818e
push 0xa9
push str..crypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call fcn.004eac70
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
push 0x583f50
push eax
push 0x59a444
push ecx
push str.fopen_
push 5
call fcn.004eaf70
add esp, 0x2c
call fcn.00485227
cmp dword [eax], 2
jne 0x4f8160
push 0xac
push str..crypto_bio_bss_file.c
push 0x80
push 0x6d
push 0x20
call fcn.004eac70
add esp, 0x14
xor eax, eax
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047da50
mov esp, ebp
pop ebp
ret
push 0xae
push str..crypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call fcn.004eac70
add esp, 0x14
xor eax, eax
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047da50
mov esp, ebp
pop ebp
ret
push 0x5ceafc
call fcn.004e6ac0
mov edi, eax
add esp, 4
test edi, edi
jne 0x4f81c0
push esi
call fcn.004833e1
add esp, 4
xor eax, eax
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047da50
mov esp, ebp
pop ebp
ret
push 0
push edi
call fcn.004e6500
push esi
push 1
push 0x6a
push edi
call fcn.004e6860
add esp, 0x18
mov eax, edi
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047da50
mov esp, ebp
pop ebp
ret
Function at 0x5221b0
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [esp + 4]
push ebp
push edi
mov edi, dword [esp + 0x14]
xor ebp, ebp
test edi, edi
jle 0x522293
push esi
mov esi, dword [esp + 0x14]
lea esp, [esp]
cmp edi, 3
movzx edx, byte [esi]
jl 0x52222e
movzx eax, byte [esi + 1]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 2]
shl edx, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
inc ecx
mov eax, edx
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc ecx
and edx, 0x3f
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
jmp 0x522280
shl edx, 0x10
cmp edi, 2
jne 0x52223f
movzx eax, byte [esi + 1]
shl eax, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc ecx
cmp edi, 1
jne 0x52226d
lea edx, [edi + 0x3c]
jmp 0x52227a
shr edx, 6
and edx, 0x3f
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
inc ecx
mov byte [ecx], 0x3d
sub edi, 3
inc ecx
add ebp, 4
add esi, 3
test edi, edi
jg 0x5221d0
pop esi
pop edi
mov eax, ebp
mov byte [ecx], 0
pop ebp
ret
Function at 0x536cd0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp ecx, dword [edi + 4]
jge 0x536ce9
mov esi, edi
mov edi, eax
jmp 0x536ceb
mov esi, eax
mov eax, dword [esi + 4]
mov ebx, dword [esp + 0x10]
cmp eax, dword [ebx + 8]
jg 0x536cfb
mov eax, ebx
jmp 0x536d05
push eax
push ebx
call fcn.004ef830
add esp, 8
test eax, eax
jne 0x536d0d
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [edi + 4], eax
jle 0x536d29
mov edx, dword [esi]
mov ecx, dword [edi]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [edi + 4]
jl 0x536d14
cmp eax, dword [esi + 4]
jge 0x536d40
mov edi, edi
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [esi + 4]
jl 0x536d30
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
test eax, eax
jle 0x536d61
mov ecx, dword [ebx]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x536d5e
dec eax
test eax, eax
jg 0x536d50
mov dword [ebx + 4], eax
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x540907
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 0xa0
call fcn.0047f910
mov eax, dword [0x5ca3a0]
xor eax, esp
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0xa8]
push ebp
mov ebp, dword [esp + 0xa8]
push esi
mov esi, ecx
test eax, eax
jbe 0x540a74
push ebx
dec eax
push edi
lea edi, [ebp + 0xc]
shr eax, 3
add ebp, 0x14
inc eax
mov dword [esp + 0x18], eax
movzx ebx, byte [esi]
movzx eax, byte [esi + 1]
inc esi
movzx ecx, byte [esi + 1]
inc esi
movzx edx, byte [esi + 1]
shl eax, 8
or ebx, eax
inc esi
movzx eax, byte [esi + 1]
inc esi
shl ecx, 0x10
or ebx, ecx
movzx ecx, byte [esi + 1]
shl edx, 0x18
inc esi
or ebx, edx
movzx edx, byte [esi + 1]
inc esi
shl ecx, 8
or eax, ecx
movzx ecx, byte [esi + 1]
inc esi
shl edx, 0x10
or eax, edx
mov dl, byte [edi]
shl ecx, 0x18
or eax, ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], eax
mov al, byte [ebp]
and dl, 0xdf
and al, 0xbf
or dl, 0x40
or al, 0x20
push edi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], ebx
inc esi
mov byte [edi], dl
mov byte [ebp], al
call fcn.004f16d0
lea ecx, [esp + 0x30]
push ecx
push edi
call fcn.004f17d0
push 1
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x38]
push eax
call fcn.00551840
push ebp
call fcn.004f16d0
lea ecx, [esp + 0x48]
push ecx
push ebp
call fcn.004f17d0
push 1
lea edx, [esp + 0x54]
push edx
lea eax, [esp + 0x48]
push eax
call fcn.00551840
mov eax, dword [esp + 0x50]
xor eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x58]
xor dword [esp + 0x40], edx
xor ecx, ebx
xor ebx, dword [esp + 0x54]
mov dword [esp + 0x44], eax
mov eax, edi
mov byte [eax], bl
mov edx, ebx
inc eax
shr edx, 8
add esp, 0x30
mov byte [eax], dl
inc eax
inc eax
mov edx, ebx
shr edx, 0x10
mov byte [eax - 1], dl
mov edx, dword [esp + 0x14]
inc eax
shr ebx, 0x18
mov byte [eax - 1], bl
mov byte [eax], dl
mov ebx, edx
inc eax
inc eax
shr ebx, 8
mov byte [eax - 1], bl
mov ebx, edx
shr edx, 0x18
shr ebx, 0x10
mov byte [eax], bl
mov byte [eax + 1], dl
mov edx, ecx
shr edx, 8
mov eax, ebp
mov byte [eax], cl
mov byte [eax + 1], dl
inc eax
inc eax
mov edx, ecx
shr edx, 0x10
mov byte [eax], dl
inc eax
shr ecx, 0x18
mov byte [eax], cl
mov ecx, dword [esp + 0x10]
inc eax
mov byte [eax], cl
mov edx, ecx
shr edx, 8
inc eax
mov byte [eax], dl
mov edx, ecx
inc eax
shr edx, 0x10
shr ecx, 0x18
sub dword [esp + 0x18], 1
mov byte [eax], dl
mov byte [eax + 1], cl
jne 0x540923
pop edi
pop ebx
mov ecx, dword [esp + 0xa4]
pop esi
pop ebp
xor ecx, esp
call fcn.0047da50
add esp, 0xa0
ret
Function at 0x54e770
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x5ca3a0]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0054e705
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.0047d440
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x54e7bf
cmp dword [ebp - 0x1c], 5
jb 0x54e7d7
jmp 0x54e7d3
cmp dword [ebp - 0x10], 1
jne 0x54e7d7
cmp dword [ebp - 0x1c], 4
ja 0x54e7d3
jne 0x54e7d7
cmp dword [ebp - 0x18], 0
jbe 0x54e7d7
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x5b74f0
call fcn.0054e5f6
test eax, eax
jge 0x54e7f8
mov byte [0x5dba78], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0047da50
add ebp, 0x78
leave
ret
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x73f35742
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..rsrc
mov ebx, 0x4304d8
nop
mov ecx, 0x5621190f
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219