joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4722cc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff38
push ebx
push esi
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
lea eax, [ebp - 0xc8]
xor ecx, ecx
mov edx, 0xc0
call fcn.00403418
xor ecx, ecx
push ebp
push 0x4723fd
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov dword [ebp - 8], 0x40
mov eax, dword [ebp - 8]
lea edx, [ebp + eax - 0xc8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x24]
cmp ebx, dword [ebp - 8]
jg 0x47232d
lea edx, [ebp - 0xc8]
mov eax, esi
mov ecx, ebx
call fcn.00402f08
jmp 0x472352
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x30]
mov eax, ebx
cdq
push edx
push eax
mov edx, esi
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea edx, [ebp - 0xc8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov edx, dword [ebp - 8]
dec edx
test edx, edx
jl 0x472368
inc edx
lea eax, [ebp - 0xc8]
xor byte [eax], 0x5c
inc eax
dec edx
jne 0x472361
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call dword [eax + 0x20]
add eax, dword [ebp - 8]
cdq
push edx
push eax
lea edx, [ebp - 0xc8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea edx, [ebp - 0xc8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call dword [eax + 0x20]
cmp eax, dword [ebp + 8]
jle 0x4723ba
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 0xc8]
mov ecx, dword [ebp + 8]
call fcn.00402f08
jmp 0x4723df
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov edx, dword [ebp + 8]
call fcn.00403418
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call dword [eax + 0x20]
mov ecx, eax
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 0xc8]
call fcn.00402f08
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x472404
lea eax, [ebp - 0xc8]
mov edx, 0xc0
call fcn.0047240c
ret

Function at 0x472450
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
mov edi, ecx
shr edi, 2
je 0x47246a
lea edx, [edx + edi*4]
lea eax, [eax + edi*4]
neg edi
mov ebx, dword [edx + edi*4]
xor dword [eax + edi*4], ebx
inc edi
jne 0x472461
and ecx, 3
je 0x472478
mov bl, byte [edx]
xor byte [eax], bl
inc eax
inc edx
dec ecx
jne 0x47246f
pop edi
pop ebx
ret

Function at 0x47247c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push ebp
mov edi, ecx
mov ecx, dword [ebp + 8]
mov esi, ecx
shr esi, 2
je 0x4724a9
lea edi, [edi + esi*4]
lea edx, [edx + esi*4]
lea eax, [eax + esi*4]
neg esi
mov ebx, dword [eax + esi*4]
mov ebp, dword [edx + esi*4]
mov dword [edi + esi*4], ebx
xor dword [eax + esi*4], ebp
inc esi
jne 0x47249a
and ecx, 3
je 0x4724c1
mov bl, byte [ecx + eax - 1]
mov bh, byte [ecx + edx - 1]
mov byte [ecx + edi - 1], bl
xor byte [ecx + eax - 1], bh
dec ecx
jne 0x4724ae
pop ebp
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x4724cc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push ebp
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push esi
shr esi, 2
je 0x472505
lea ecx, [ecx + esi*4]
lea edi, [edi + esi*4]
lea edx, [edx + esi*4]
lea eax, [eax + esi*4]
neg esi
mov ebp, dword [eax + esi*4]
mov ebx, dword [edi + esi*4]
xor ebx, dword [edx + esi*4]
mov dword [edx + esi*4], ebx
xor ebx, dword [ecx + esi*4]
mov dword [edi + esi*4], ebp
mov dword [eax + esi*4], ebx
inc esi
jne 0x4724ed
pop esi
and esi, 3
je 0x47252a
mov bl, byte [esi + eax - 1]
mov bh, byte [esi + edx - 1]
xor bh, byte [esi + edi - 1]
mov byte [esi + edx - 1], bh
xor bh, byte [esi + ecx - 1]
mov byte [esi + edi - 1], bl
mov byte [esi + eax - 1], bh
dec esi
jne 0x47250b
pop ebp
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x472534
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov esi, ecx
shr esi, 2
je 0x472560
lea edi, [edi + esi*4]
lea edx, [edx + esi*4]
lea eax, [eax + esi*4]
neg esi
mov ebx, dword [edx + esi*4]
xor ebx, dword [eax + esi*4]
mov dword [edi + esi*4], ebx
mov dword [eax + esi*4], ebx
inc esi
jne 0x472551
and ecx, 3
je 0x472578
mov bl, byte [ecx + edx - 1]
xor bl, byte [ecx + eax - 1]
mov byte [ecx + edi - 1], bl
mov byte [ecx + eax - 1], bl
dec ecx
jne 0x472565
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x472580
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
shr ecx, 1
lea edi, [eax + ecx*8]
lea edx, [edx + ecx*8]
neg ecx
mov ebx, dword [edx + ecx*8]
mov eax, dword [edx + ecx*8 + 4]
xor dword [edi + ecx*8], ebx
xor dword [edi + ecx*8 + 4], eax
inc ecx
jne 0x47258c
pop edi
pop ebx
ret

Function at 0x472dd0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebx]
call dword [eax + 0x20]
mov edi, eax
mov eax, edi
shr eax, 2
mov dword [esp + 4], eax
mov eax, dword [ebx + 8]
add eax, edi
mov dword [esp + 8], eax
mov eax, edi
add eax, eax
mov edx, dword [ebx + 8]
lea eax, [edx + eax]
mov dword [esp + 0xc], eax
mov eax, dword [esp]
cdq
idiv edi
mov ebp, eax
dec ebp
test ebp, ebp
jl 0x472e48
inc ebp
push edi
mov ecx, dword [esp + 0x10]
mov edx, esi
mov eax, dword [ebx + 8]
call fcn.0047247c
mov edx, dword [ebx + 8]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov eax, dword [esp + 8]
push eax
push edi
mov ecx, dword [esp + 0x14]
mov edx, dword [ebx + 8]
mov eax, esi
call fcn.004724cc
lea eax, [esi + edi]
mov esi, eax
dec ebp
jne 0x472e13
mov eax, dword [esp]
cdq
idiv edi
mov ebp, edx
test ebp, ebp
jle 0x472e84
mov edx, dword [esp + 8]
mov eax, dword [ebx + 8]
mov ecx, dword [esp + 4]
call fcn.00472580
mov edx, dword [ebx + 8]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x5c]
dec ebp
test ebp, ebp
jl 0x472e84
inc ebp
xor eax, eax
mov edx, dword [ebx + 8]
movzx edx, byte [edx + eax]
xor byte [esi + eax], dl
inc eax
dec ebp
jne 0x472e76
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x472e8c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call dword [eax + 0x20]
mov esi, eax
mov eax, esi
shr eax, 2
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
call fcn.00472ae8
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x472fcc
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, esi
add eax, eax
push eax
mov eax, dword [ebp - 8]
pop edx
mov ecx, edx
cdq
idiv ecx
mov edi, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [ebp - 0x14], eax
dec edi
test edi, edi
jl 0x472f3a
inc edi
mov edx, dword [ebp - 0x10]
mov eax, ebx
mov ecx, esi
call fcn.00402f08
mov edx, ebx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
call fcn.00472580
lea eax, [ebx + esi]
mov ebx, eax
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, esi
call fcn.00402f08
mov edx, ebx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov edx, dword [ebp - 0x10]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
call fcn.00472580
lea eax, [ebx + esi]
mov ebx, eax
dec edi
jne 0x472ee7
mov eax, esi
add eax, eax
push eax
mov eax, dword [ebp - 8]
pop edx
mov ecx, edx
cdq
idiv ecx
mov edi, edx
cmp esi, edi
jg 0x472f88
mov edx, dword [ebp - 0x10]
mov eax, ebx
mov ecx, esi
call fcn.00402f08
mov edx, ebx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
call fcn.00472580
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x10]
mov ecx, esi
call fcn.00402f08
lea eax, [ebx + esi]
mov ebx, eax
sub edi, esi
test edi, edi
jle 0x472fb3
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
dec edi
test edi, edi
jl 0x472fb3
inc edi
xor eax, eax
mov edx, dword [ebp - 4]
mov edx, dword [edx + 8]
movzx edx, byte [edx + eax]
xor byte [ebx + eax], dl
inc eax
dec edi
jne 0x472fa2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x472fd3
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00472c78
ret
Function at 0x473444
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov edi, edx
mov esi, eax
mov eax, dword [esi]
call dword [eax + 0x20]
mov ebx, eax
mov eax, ebx
shr eax, 2
mov dword [esp + 4], eax
mov eax, dword [esi + 8]
add eax, ebx
mov dword [esp + 8], eax
mov eax, ebx
add eax, eax
mov edx, dword [esi + 8]
lea eax, [edx + eax]
mov dword [esp + 0xc], eax
mov eax, dword [esp]
cdq
idiv ebx
mov ebp, eax
dec ebp
test ebp, ebp
jl 0x4734c7
inc ebp
push ebx
mov ecx, dword [esp + 0x10]
mov edx, edi
mov eax, dword [esi + 8]
call fcn.0047247c
mov edx, dword [esi + 8]
mov eax, dword [esp + 8]
mov ecx, ebx
call fcn.00472450
mov edx, dword [esp + 8]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x5c]
push ebx
mov ecx, edi
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
call fcn.00472534
lea eax, [edi + ebx]
mov edi, eax
dec ebp
jne 0x473487
mov eax, dword [esp]
cdq
idiv ebx
mov ebp, edx
test ebp, ebp
jle 0x473503
mov edx, dword [esp + 8]
mov eax, dword [esi + 8]
mov ecx, dword [esp + 4]
call fcn.00472580
mov edx, dword [esi + 8]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x5c]
dec ebp
test ebp, ebp
jl 0x473503
inc ebp
xor eax, eax
mov edx, dword [esi + 8]
movzx edx, byte [edx + eax]
xor byte [edi + eax], dl
inc eax
dec ebp
jne 0x4734f5
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x47350c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov dword [esp], ecx
mov ebx, edx
mov edi, eax
mov eax, dword [edi]
call dword [eax + 0x20]
mov ebp, eax
mov eax, ebp
shr eax, 2
mov dword [esp + 4], eax
mov eax, dword [esp]
cdq
idiv ebp
mov esi, eax
mov eax, dword [edi + 8]
dec esi
test esi, esi
jl 0x47355b
inc esi
mov edx, eax
mov eax, ebx
mov ecx, dword [esp + 4]
call fcn.00472580
mov edx, ebx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x5c]
mov eax, ebx
lea edx, [ebx + ebp]
mov ebx, edx
dec esi
jne 0x47353b
mov edx, dword [edi + 8]
mov ecx, ebp
call fcn.00402f08
mov eax, dword [esp]
cdq
idiv ebp
mov esi, edx
test esi, esi
jle 0x473591
mov edx, dword [edi + 8]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x5c]
dec esi
test esi, esi
jl 0x473591
inc esi
xor eax, eax
mov edx, dword [edi + 8]
movzx edx, byte [edx + eax]
xor byte [ebx + eax], dl
inc eax
dec esi
jne 0x473583
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4756b4
Capabilities:
Check for time delay via queryperformancecounter
Get disk size
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x11
push 0
push 0
dec ecx
jne 0x4756bc
push ebx
push esi
xor eax, eax
push ebp
push 0x4758d8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
call sub.kernel32.dll_QueryPerformanceCounter
push dword [ebp - 0xc]
push dword [ebp - 0x10]
lea eax, [ebp - 0x4c]
call fcn.00408d48
mov edx, dword [ebp - 0x4c]
lea eax, [ebp - 4]
mov ecx, 0x4758f0
call fcn.00404d00
lea eax, [ebp - 0x50]
call fcn.004601d4
mov eax, dword [ebp - 0x50]
lea edx, [ebp - 8]
call fcn.00460250
mov eax, dword [ebp - 8]
test eax, eax
je 0x475719
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
test ebx, ebx
jle 0x4757a3
mov esi, 1
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x54]
mov edx, dword [ebp - 8]
movzx edx, byte [edx + esi - 1]
call fcn.00404bd8
lea eax, [ebp - 0x54]
mov edx, 0x4758fc
call fcn.00404cbc
mov eax, dword [ebp - 0x54]
call fcn.00404eb4
push eax
call sub.kernel32.dll_GetDiskFreeSpaceExA
test eax, eax
je 0x47579f
push dword [ebp - 4]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
lea eax, [ebp - 0x58]
call fcn.00408d48
push dword [ebp - 0x58]
push 0x475908
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
lea eax, [ebp - 0x5c]
call fcn.00408d48
push dword [ebp - 0x5c]
push 0x4758f0
lea eax, [ebp - 4]
mov edx, 5
call fcn.00404d74
inc esi
dec ebx
jne 0x475728
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
push dword [ebp - 4]
lea ecx, [ebp - 0x60]
lea eax, [ebp - 0x48]
mov edx, 0x20
call fcn.0045fe94
push dword [ebp - 0x60]
push 0x4758f0
call sub.kernel32.dll_GetTickCount
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x64]
call fcn.00408d48
push dword [ebp - 0x64]
push 0x4758f0
call sub.kernel32.dll_GetCurrentProcessId
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x68]
call fcn.00408d48
push dword [ebp - 0x68]
push 0x4758f0
call sub.kernel32.dll_GetCurrentThreadId_1
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x6c]
call fcn.00408d48
push dword [ebp - 0x6c]
push 0x4758f0
lea eax, [ebp - 0x80]
call fcn.00460428
lea eax, [ebp - 0x80]
lea edx, [ebp - 0x70]
call fcn.00408548
push dword [ebp - 0x70]
push 0x4758f0
call fcn.0040a964
add esp, 0xfffffff4
fstp xword [esp]
wait
lea eax, [ebp - 0x84]
call fcn.0040a41c
push dword [ebp - 0x84]
push 0x4758f0
lea eax, [ebp - 4]
mov edx, 0xd
call fcn.00404d74
push 0x32
call sub.kernel32.dll_Sleep_1
lea eax, [ebp - 0x10]
push eax
call sub.kernel32.dll_QueryPerformanceCounter
push dword [ebp - 0xc]
push dword [ebp - 0x10]
lea eax, [ebp - 0x88]
call fcn.00408d48
mov edx, dword [ebp - 0x88]
lea eax, [ebp - 4]
call fcn.00404cbc
mov eax, dword [ebp - 4]
test eax, eax
je 0x475897
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 4]
xchg edx, eax
call fcn.00475594
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4758df
lea eax, [ebp - 0x88]
mov edx, 2
call fcn.00404a14
lea eax, [ebp - 0x70]
mov edx, 0xa
call fcn.00404a14
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404a14
ret
Function at 0x478ee0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x479070
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, byte [ebp + 0x10]
call fcn.00478848
test al, al
je 0x478f1c
cmp edi, 0x14
je 0x478f30
mov ecx, 0x642
mov edx, 0x47908c
mov eax, 0x4790bc
call fcn.004049d0
cmp esi, 0xbf
jb 0x478f42
mov eax, esi
and eax, 7
cmp eax, 7
je 0x478f56
mov ecx, 0x643
mov edx, 0x47908c
mov eax, 0x4790bc
call fcn.004049d0
lea ecx, [ebp - 4]
lea edx, [esi + 1]
shr edx, 3
xor eax, eax
call fcn.004051a0
mov edi, dword [ebp - 4]
test edi, edi
je 0x478f72
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 4]
call fcn.00404f0c
mov edx, eax
mov ecx, edi
mov eax, dword [ebp - 8]
call fcn.004786a8
test bl, bl
je 0x478f92
mov eax, dword [ebp - 4]
cmp byte [eax], 0x4b
je 0x478fa2
mov eax, dword [ebp - 4]
cmp byte [eax], 0x6b
jne 0x478f9e
test bl, bl
je 0x478fa2
xor eax, eax
jmp 0x478fa4
mov al, 1
mov ebx, eax
test bl, bl
je 0x47903f
inc esi
shr esi, 3
sub esi, 0x18
lea eax, [esi + 1]
sub eax, 2
jl 0x478fdd
inc eax
mov edx, 2
test bl, bl
je 0x478fd1
mov ecx, dword [ebp - 4]
cmp byte [ecx + edx - 1], 0xbb
je 0x478fd5
xor ecx, ecx
jmp 0x478fd7
mov cl, 1
mov ebx, ecx
inc edx
dec eax
jne 0x478fc3
test bl, bl
je 0x47903f
mov edx, dword [ebp - 4]
mov eax, edx
test eax, eax
je 0x478fef
sub eax, 4
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
movzx eax, byte [ecx + eax - 2]
sub al, 0x31
jne 0x479004
cmp byte [ebp + 0x10], 2
sete bl
jmp 0x479006
xor ebx, ebx
test bl, bl
je 0x47903f
mov eax, edx
test eax, eax
je 0x479015
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp byte [edx + eax - 1], 0xcc
sete bl
test bl, bl
je 0x47903f
lea eax, [ebp - 4]
call fcn.00404f0c
lea edx, [eax + esi + 2]
mov eax, dword [ebp - 0xc]
mov ecx, 0x14
call fcn.00408750
mov ebx, eax
mov esi, dword [ebp - 4]
test esi, esi
je 0x47904b
sub esi, 4
mov esi, dword [esi]
lea eax, [ebp - 4]
call fcn.00404f0c
mov edx, esi
call fcn.0047240c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x479077
lea eax, [ebp - 4]
call fcn.004049f0
ret
Function at 0x47ac98
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff84
xor eax, eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47adae
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov dword [ebp - 0x70], eax
mov byte [ebp - 0x6c], 0xb
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 4]
mov eax, dword [eax + 8]
mov eax, dword [eax + 4]
mov dword [ebp - 0x68], eax
mov byte [ebp - 0x64], 0xb
mov eax, 0x47adc4
mov dword [ebp - 0x60], eax
mov byte [ebp - 0x5c], 0xb
lea edx, [ebp - 0x70]
mov ecx, 2
mov eax, 0x47add8
call fcn.00409cd4
lea eax, [ebp - 0x74]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x7c], eax
mov byte [ebp - 0x78], 0xb
lea edx, [ebp - 0x7c]
xor ecx, ecx
mov eax, 0x47adec
call fcn.00409cd4
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 4]
call fcn.0047c6f4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00403418
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404eb4
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00404eb4
push eax
call sub.kernel32.dll_CreateProcessA
call fcn.0040e17c
push 0x1f4
mov eax, dword [ebp - 0x58]
push eax
call sub.user32.dll_WaitForInputIdle
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47adb5
lea eax, [ebp - 0x74]
call fcn.004049f0
lea eax, [ebp - 4]
call fcn.004049f0
ret

Function at 0x47c8b4
Capabilities:
Initialize winsock library

Disassembly:
push ebx
add esp, 0xfffffe68
push esp
push 0x101
call sub.wsock32.dll_WSAStartup
mov ebx, eax
test ebx, ebx
je 0x47c8fb
mov dword [esp + 0x190], ebx
mov byte [esp + 0x194], 0
lea eax, [esp + 0x190]
push eax
push 0
mov ecx, 0x47c90c
mov dl, 1
mov eax, dword [0x4078d8]
call fcn.0040c818
call fcn.004043d8
add esp, 0x198
pop ebx
ret

Function at 0x47e5ac
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
movzx ebx, dl
dec ebx
test ebx, ebx
jl 0x47e600
inc ebx
xor edx, edx
mov ecx, edx
add ecx, ecx
add ecx, ecx
movzx esi, byte [eax + ecx]
lea esi, [esi*4 + 0x48a324]
mov esi, dword [esi]
movzx edi, byte [eax + ecx + 1]
lea edi, [edi*4 + 0x48a724]
xor esi, dword [edi]
movzx edi, byte [eax + ecx + 2]
lea edi, [edi*4 + 0x48ab24]
xor esi, dword [edi]
movzx edi, byte [eax + ecx + 3]
lea edi, [edi*4 + 0x48af24]
xor esi, dword [edi]
lea ecx, [eax + ecx]
mov dword [ecx], esi
inc edx
dec ebx
jne 0x47e5ba
pop edi
pop esi
pop ebx
ret
Function at 0x482640
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffce8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x318], ecx
mov dword [ebp - 0x314], ecx
mov byte [ebp - 1], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x4827f8
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 2], 0
jmp 0x4827d0
cmp dword [ebx + 0x18], 0
je 0x48269c
push 0
mov eax, dword [ebx + 0x18]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
jne 0x48269c
mov dl, 1
mov eax, dword [0x47145c]
call fcn.0047154c
call fcn.004043d8
cmp dword [ebx + 0x28], 0
je 0x4826c0
mov eax, dword [ebx + 0x24]
call fcn.0045fe08
cmp eax, dword [ebx + 0x28]
jbe 0x4826c0
mov dl, 1
mov eax, dword [0x4714d0]
call fcn.00471c5c
call fcn.004043d8
xor edx, edx
mov eax, ebx
call fcn.00482578
lea eax, [ebp - 0x108]
call fcn.00471190
lea edx, [ebp - 0x108]
mov eax, dword [ebx + 0x30]
call fcn.00471180
cmp byte [ebp - 1], 0
je 0x482709
lea eax, [ebp - 0x20c]
call fcn.00471190
lea edx, [ebp - 0x20c]
mov eax, dword [ebx + 0x30]
call fcn.00471180
lea edi, [ebp - 0x20c]
jmp 0x48270b
xor edi, edi
lea eax, [ebp - 0x310]
call fcn.00471190
lea edx, [ebp - 0x310]
mov eax, dword [ebx + 0x30]
call fcn.00471180
push 0x48f3a8
lea eax, [ebp - 0x310]
push eax
push edi
lea eax, [ebp - 0x108]
push eax
push 0x40
call sub.wsock32.dll_select
mov esi, eax
cmp esi, 0xffffffff
jne 0x482750
mov eax, 0x482810
call fcn.00471218
test esi, esi
jle 0x4827d0
lea edx, [ebp - 0x310]
mov eax, dword [ebx + 0x30]
call fcn.00471168
test al, al
je 0x48278d
lea edx, [ebp - 0x314]
mov eax, 0x4814f4
call fcn.00406698
mov ecx, dword [ebp - 0x314]
mov dl, 1
mov eax, dword [0x4078d8]
call fcn.0040c7dc
call fcn.004043d8
cmp byte [ebp - 1], 0
je 0x4827cc
lea edx, [ebp - 0x108]
mov eax, dword [ebx + 0x30]
call fcn.00471168
test al, al
je 0x4827cc
lea edx, [ebp - 0x318]
mov eax, 0x4814fc
call fcn.00406698
mov ecx, dword [ebp - 0x318]
mov dl, 1
mov eax, dword [0x4078d8]
call fcn.0040c7dc
call fcn.004043d8
mov byte [ebp - 2], 1
cmp byte [ebp - 2], 0
je 0x482676
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4827ff
lea eax, [ebp - 0x318]
mov edx, 2
call fcn.00404a14
ret
Function at 0x482818
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x14], eax
mov esi, dword [ebp + 8]
add esi, 0xfffffffc
xor eax, eax
push ebp
push 0x482925
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
jmp 0x482900
mov eax, dword [esi]
mov dl, 1
call fcn.00482640
push 0
mov eax, dword [esi]
mov eax, dword [eax + 0x1ba8]
push eax
mov eax, dword [esi]
lea eax, [eax + edi + 0x50]
push eax
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
push eax
call sub.wsock32.dll_send
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4828bf
call sub.wsock32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x482900
mov eax, 0x48293c
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0xb
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 8], eax
mov byte [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
push 1
lea edx, [ebp - 0x14]
mov eax, 0x48150c
call fcn.00406698
mov ecx, dword [ebp - 0x14]
mov dl, 1
mov eax, dword [0x4078d8]
call fcn.0040c818
call fcn.004043d8
jmp 0x482900
cmp ebx, 1
jge 0x4828d8
mov ecx, 0x1fa
mov edx, 0x48294c
mov eax, 0x482984
call fcn.004049d0
mov eax, dword [esi]
cmp ebx, dword [eax + 0x1ba8]
jle 0x4828f6
mov ecx, 0x1fb
mov edx, 0x48294c
mov eax, 0x482984
call fcn.004049d0
add edi, ebx
mov eax, dword [esi]
sub dword [eax + 0x1ba8], ebx
mov eax, dword [esi]
cmp dword [eax + 0x1ba8], 0
jg 0x482841
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48292c
lea eax, [ebp - 0x14]
call fcn.004049f0
ret