joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f328e
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x4f329c
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x10]
not eax
mov ecx, 0xff
cmp edi, 8
jb 0x4f3357
mov esi, edi
shr esi, 3
push ebx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x58b750]
movzx ebx, byte [edx + 1]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x58b750]
movzx ebx, byte [edx + 2]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x58b750]
movzx ebx, byte [edx + 3]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x58b750]
movzx ebx, byte [edx + 4]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x58b750]
movzx ebx, byte [edx + 5]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x58b750]
movzx ebx, byte [edx + 6]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x58b750]
movzx ebx, byte [edx + 7]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x58b750]
add edx, 8
sub edi, 8
dec esi
jne 0x4f32ba
pop ebx
test edi, edi
je 0x4f3370
movzx esi, byte [edx]
xor esi, eax
and esi, ecx
shr eax, 8
xor eax, dword [esi*4 + 0x58b750]
inc edx
dec edi
jne 0x4f335b
pop edi
not eax
pop esi
pop ebp
ret

Function at 0x4f3376
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
movsx edx, byte [ebp + 0xc]
xor edx, eax
push esi
mov esi, 0xff
and edx, esi
mov edx, dword [edx*4 + 0x58b750]
shr eax, 8
xor edx, eax
mov eax, dword [ecx + 8]
mov dword [ecx], edx
movzx edx, dl
add edx, dword [ecx + 4]
imul edx, edx, 0x8088405
inc edx
mov dword [ecx + 4], edx
shr edx, 0x18
xor edx, eax
and edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x58b750]
pop esi
mov dword [ecx + 8], eax
pop ebp
ret
Function at 0x4f3905
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
cmp byte [esi + 0x2d], 0
push edi
mov edi, dword [ebp + 0xc]
je 0x4f397a
mov eax, dword [esi + 0x3c]
xor ebx, ebx
cmp eax, ebx
je 0x4f3931
cmp dword [esi + 0x40], edi
jae 0x4f3931
push eax
call fcn.005383cd
pop ecx
mov dword [esi + 0x3c], ebx
cmp dword [esi + 0x3c], ebx
jne 0x4f3946
lea eax, [edi + edi]
push eax
call fcn.00538174
pop ecx
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
push edi
push dword [ebp + 8]
push dword [esi + 0x3c]
call fcn.00534c80
add esp, 0xc
test edi, edi
je 0x4f3977
mov eax, dword [esi + 0x3c]
movzx eax, byte [ebx + eax]
push eax
lea eax, [esi + 0x30]
push eax
call fcn.004f33e3
pop ecx
pop ecx
mov ecx, dword [esi + 0x3c]
mov byte [ebx + ecx], al
inc ebx
cmp ebx, edi
jb 0x4f3959
mov edx, dword [esi + 0x3c]
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x4f39a9
mov eax, dword [esi + 0x24]
lea ebx, [eax + edi]
cmp ebx, dword [esi + 0x28]
jb 0x4f3995
mov dword [esi + 0x14], 0x30000
jmp 0x4f39cb
push edi
push edx
add eax, ecx
push eax
call fcn.00534c80
add esp, 0xc
add dword [esi + 0x24], edi
mov eax, edi
jmp 0x4f39cd
mov eax, dword [esi + 4]
test eax, eax
je 0x4f39c4
push 0
lea ecx, [ebp + 8]
push ecx
push edi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 8]
jmp 0x4f39cd
mov dword [esi + 0x14], 0x1000000
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4f3cbe
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [esi + 0x84]
push edi
test ecx, ecx
je 0x4f3d14
mov eax, dword [esi + 0x8c]
mov edi, dword [esi + 0x88]
cmp eax, edi
jae 0x4f3d50
sub edi, eax
cmp edi, dword [ebp + 0xc]
jbe 0x4f3ce9
mov edi, dword [ebp + 0xc]
push edi
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.00534c80
add dword [esi + 0x8c], edi
add dword [esi + 0x74], edi
push edi
push dword [ebp + 8]
push dword [esi + 0x78]
call fcn.004f328e
add esp, 0x18
mov dword [esi + 0x78], eax
mov eax, edi
jmp 0x4f3d52
mov eax, dword [esi + 0x7c]
test eax, eax
je 0x4f3d49
push 0
lea ecx, [ebp + 0xc]
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4f3d50
mov edi, dword [ebp + 0xc]
add dword [esi + 0x74], edi
push edi
push dword [ebp + 8]
push dword [esi + 0x78]
call fcn.004f328e
add esp, 0xc
jmp 0x4f3d0d
mov dword [esi + 0x14], 0x1000000
xor eax, eax
pop edi
pop esi
pop ebp
ret 8
Function at 0x4f4439
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
lea eax, [ebx - 1]
push edi
cmp eax, 7
jbe 0x4f4457
mov dword [esi + 0x6afa4], str.bad_pack_level
xor edi, edi
mov dword [esi + 0x6af78], edi
cmp dword [esi + 0x6af70], edi
jne 0x4f447b
mov dword [esi + 0x6af78], 1
mov dword [esi + 0x6af70], 0x10000
push 0x1fffc
lea eax, [esi + 0x4af70]
push edi
push eax
mov dword [esi + 0x6af6c], edi
call fcn.00534b40
mov eax, ebx
movzx ecx, word [eax*8 + 0x58b702]
mov dword [esi + 0x6af98], ecx
movzx ecx, word [eax*8 + 0x58b700]
mov dword [esi + 0x6af9c], ecx
movzx ecx, word [eax*8 + 0x58b704]
mov dword [esi + 0x6afa0], ecx
movzx eax, word [eax*8 + 0x58b706]
add esp, 0xc
mov dword [esi + 0x6af94], eax
cmp ebx, 2
jg 0x4f44de
mov eax, dword [ebp + 0x10]
or word [eax], 4
jmp 0x4f44ea
cmp ebx, 8
jl 0x4f44ea
mov eax, dword [ebp + 0x10]
or word [eax], 2
push 0x10000
lea ebx, [esi + 0x1af70]
push ebx
push esi
mov dword [esi + 0x6af84], edi
mov dword [esi + 0x6af74], edi
call dword [esi + 0xc]
add esp, 0xc
mov dword [esi + 0x6af90], eax
cmp eax, edi
je 0x4f4551
cmp eax, 0xffffffff
je 0x4f4551
mov dword [esi + 0x6af8c], edi
cmp eax, 0x106
jae 0x4f452c
push esi
call fcn.004f29a3
pop ecx
mov dword [esi + 0x6af7c], edi
xor eax, eax
movzx ecx, byte [ebx + eax]
shl edi, 5
xor edi, ecx
and edi, 0x7fff
inc eax
mov dword [esi + 0x6af7c], edi
cmp eax, 2
jb 0x4f4534
jmp 0x4f4561
mov dword [esi + 0x6af8c], 1
mov dword [esi + 0x6af90], edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4f4b66
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x6af80], 2
cmp dword [esi + 0x6af90], ebx
je 0x4f4d6e
push edi
mov edi, 0x7fff
cmp dword [esi + 0x6af90], 3
jb 0x4f4be0
mov ecx, dword [esi + 0x6af84]
movzx eax, byte [ecx + esi + 0x1af72]
mov edx, dword [esi + 0x6af7c]
shl edx, 5
xor eax, edx
and eax, edi
mov dword [esi + 0x6af7c], eax
mov eax, dword [esi + eax*4 + 0x4af70]
and ecx, edi
mov dword [esi + ecx*4 + 0x2af70], eax
mov ecx, dword [esi + 0x6af84]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x6af7c]
mov dword [esi + eax*4 + 0x4af70], ecx
cmp dword [ebp - 4], 0
je 0x4f4c23
mov eax, dword [esi + 0x6af84]
sub eax, dword [ebp - 4]
cmp eax, 0x7efa
ja 0x4f4c23
mov ecx, dword [esi + 0x6af90]
cmp dword [esi + 0x6afa0], ecx
jbe 0x4f4c0a
mov dword [esi + 0x6afa0], ecx
push dword [ebp - 4]
push esi
call fcn.004f2818
mov ebx, eax
mov eax, dword [esi + 0x6af90]
pop ecx
pop ecx
cmp ebx, eax
jbe 0x4f4c23
mov ebx, eax
cmp ebx, 3
jb 0x4f4ce8
lea eax, [ebx - 3]
push eax
mov eax, dword [esi + 0x6af84]
sub eax, dword [esi + 0x6af88]
push eax
push esi
call fcn.004f2341
sub dword [esi + 0x6af90], ebx
add esp, 0xc
mov dword [ebp + 8], eax
mov eax, dword [esi + 0x6af90]
cmp ebx, dword [esi + 0x6af98]
ja 0x4f4cb5
cmp eax, 3
jb 0x4f4cb5
dec ebx
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
movzx ecx, byte [esi + edx + 0x1af72]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
xor ecx, eax
and ecx, edi
mov dword [esi + 0x6af7c], ecx
mov ecx, dword [esi + ecx*4 + 0x4af70]
and edx, edi
dec ebx
mov dword [esi + edx*4 + 0x2af70], ecx
mov eax, dword [esi + 0x6af7c]
mov dword [ebp - 4], ecx
mov ecx, dword [esi + 0x6af84]
mov dword [esi + eax*4 + 0x4af70], ecx
jne 0x4f4c63
jmp 0x4f4d0b
add dword [esi + 0x6af84], ebx
mov edx, dword [esi + 0x6af84]
movzx ecx, byte [edx + esi + 0x1af70]
mov dword [esi + 0x6af7c], ecx
movzx edx, byte [edx + esi + 0x1af71]
shl ecx, 5
xor edx, ecx
xor ebx, ebx
and edx, edi
mov dword [esi + 0x6af7c], edx
jmp 0x4f4d11
mov eax, dword [esi + 0x6af84]
movzx eax, byte [eax + esi + 0x1af70]
push eax
push 0
push esi
call fcn.004f2341
add esp, 0xc
dec dword [esi + 0x6af90]
mov dword [ebp + 8], eax
inc dword [esi + 0x6af84]
cmp dword [ebp + 8], 0
je 0x4f4d4d
mov eax, dword [esi + 0x6af74]
test eax, eax
js 0x4f4d2a
lea ecx, [eax + esi + 0x1af70]
jmp 0x4f4d2c
xor ecx, ecx
mov edx, dword [esi + 0x6af84]
push 0
sub edx, eax
push edx
push ecx
push esi
call fcn.004f49c2
mov eax, dword [esi + 0x6af84]
add esp, 0x10
mov dword [esi + 0x6af74], eax
cmp dword [esi + 0x6af90], 0x106
jae 0x4f4d60
push esi
call fcn.004f29a3
pop ecx
cmp dword [esi + 0x6af90], 0
jne 0x4f4b90
pop edi
mov eax, dword [esi + 0x6af74]
test eax, eax
js 0x4f4d81
lea ecx, [eax + esi + 0x1af70]
jmp 0x4f4d83
xor ecx, ecx
mov edx, dword [esi + 0x6af84]
push 1
sub edx, eax
push edx
push ecx
push esi
call fcn.004f49c2
add esp, 0x10
pop esi
pop ebx
leave
ret
Function at 0x4f5970
Capabilities:
Capture microphone audio

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x676300]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov edx, dword [ebp + 0x10]
push esi
push edi
lea edi, [ebp - 0x16]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
inc eax
mov word [ebp - 0x18], ax
mov eax, dword [ebp + 0xc]
mov word [ebp - 0x16], ax
movzx eax, ax
mov esi, dword [ebp + 8]
mov word [ebp - 0xa], dx
movzx edx, dx
imul eax, edx
cdq
and dword [ecx + 4], 0
and edx, 7
add eax, edx
sar eax, 3
mov word [ebp - 0xc], ax
movzx eax, ax
imul eax, esi
push 0x30000
push ecx
push 0x4f5952
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
lea edi, [ecx + 8]
push 0xffffffffffffffff
push edi
mov dword [ebp - 0x14], esi
call dword [sym.imp.WINMM.dll_waveInOpen]
test eax, eax
je 0x4f59ec
xor eax, eax
jmp 0x4f5a51
and dword [ebp - 0x1c], 0
push 0x20
call fcn.00535efc
push 0x20
mov esi, eax
push 0
push esi
call fcn.00534b40
push 0x4000
call fcn.00538174
and dword [esi + 0x10], 0
add esp, 0x14
push 0x20
push esi
mov dword [esi], eax
mov dword [esi + 4], 0x4000
push dword [edi]
call dword [sym.imp.WINMM.dll_waveInPrepareHeader]
test eax, eax
jne 0x4f59e8
push 0x20
push esi
push dword [edi]
call dword [sym.imp.WINMM.dll_waveInAddBuffer]
test eax, eax
jne 0x4f59e8
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xa
jl 0x4f59f0
push dword [edi]
call dword [sym.imp.WINMM.dll_waveInStart]
neg eax
sbb eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00534bba
leave
ret 0xc
Function at 0x4f79e3
Capabilities:
Resolve dns

Disassembly:
push 0x548
mov eax, 0x57103a
call fcn.0053d211
mov esi, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov al, byte [esi]
mov dword [ebp - 0x4bc], edx
mov ecx, esi
jmp 0x4f7a13
cmp al, 0x30
jl 0x4f7a0c
cmp al, 0x39
jle 0x4f7a10
cmp al, 0x2e
jne 0x4f7a28
inc ecx
mov al, byte [ecx]
test al, al
jne 0x4f7a04
push esi
push edx
call fcn.0053d0b0
pop ecx
pop ecx
xor eax, eax
inc eax
jmp 0x4f7c50
push 0x3ff
xor edi, edi
lea eax, [ebp - 0x40f]
push edi
push eax
mov byte [ebp - 0x410], 0
call fcn.00534b40
push 0x400
lea eax, [ebp - 0x410]
push esi
push eax
call fcn.00537970
lea eax, [ebp - 0x410]
push eax
call fcn.00540173
push edi
call fcn.005377d5
mov ebx, 0x67f0e4
add esp, 0x20
mov ecx, ebx
mov dword [ebp - 0x4c0], eax
mov dword [ebp - 0x4cc], ebx
call fcn.004f0b18
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x42c]
mov dword [ebp - 4], edi
call fcn.004088f0
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x4b4]
push eax
mov ecx, 0x67f0d4
mov byte [ebp - 4], 1
call fcn.004f7077
push edi
push 1
lea ecx, [ebp - 0x42c]
mov byte [ebp - 4], 0
call fcn.0040a5e0
mov esi, dword [ebp - 0x4b4]
cmp esi, dword [0x67f0d8]
je 0x4f7b07
mov eax, dword [ebp - 0x4c0]
sub eax, dword [esi + 0xa8]
cmp eax, 0x12c
jg 0x4f7b07
add esi, 0x28
push esi
push dword [ebp - 0x4bc]
call fcn.0053d0b0
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
mov ecx, ebx
call fcn.004f0b20
jmp 0x4f7a20
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 0x4c4], eax
cmp eax, edi
je 0x4f7c43
mov dword [ebp - 0x4b8], edi
mov eax, dword [ebp - 0x4c4]
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0x4b8]
cmp dword [eax + ecx], edi
je 0x4f7c43
mov eax, dword [eax + ecx]
push dword [eax]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push 2
push 0x57aed0
push eax
mov dword [ebp - 0x4b4], eax
call fcn.005374b7
add esp, 0xc
test eax, eax
je 0x4f7b7b
push 0x58bcdc
push dword [ebp - 0x4b4]
call fcn.005383e0
pop ecx
pop ecx
test eax, eax
je 0x4f7b84
add dword [ebp - 0x4b8], 4
jmp 0x4f7b28
mov eax, dword [ebp - 0x4c0]
push dword [ebp - 0x4b4]
mov dword [ebp - 0x430], eax
lea eax, [ebp - 0x4b0]
push eax
call fcn.0053d0b0
pop ecx
pop ecx
lea eax, [ebp - 0x410]
cmp esi, dword [0x67f0d8]
je 0x4f7bf1
push eax
lea ecx, [ebp - 0x42c]
call fcn.004088f0
lea eax, [ebp - 0x42c]
push eax
mov ecx, 0x67f0d4
mov byte [ebp - 4], 2
call fcn.004f78ae
push 0x21
pop ecx
mov edi, eax
lea esi, [ebp - 0x4b0]
push 0
rep movsd dword es:[edi], dword [esi]
push 1
lea ecx, [ebp - 0x42c]
call fcn.0040a5e0
jmp 0x4f7c2c
push 0x21
pop ecx
mov dword [ebp - 0x554], eax
lea esi, [ebp - 0x4b0]
lea edi, [ebp - 0x550]
rep movsd dword es:[edi], dword [esi]
push 0
lea eax, [ebp - 0x554]
mov esi, 0x67f0d4
push eax
mov ecx, esi
call fcn.004f7961
push eax
lea eax, [ebp - 0x4c8]
push eax
mov ecx, esi
call fcn.004f7568
lea eax, [ebp - 0x4b0]
push eax
push dword [ebp - 0x4bc]
call fcn.0053d0b0
pop ecx
xor edi, edi
pop ecx
inc edi
or dword [ebp - 4], 0xffffffff
mov ecx, ebx
call fcn.004f0b20
mov eax, edi
call fcn.0053d25b
ret
Function at 0x4f7d99
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x676300]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
push ebx
mov esi, str._pmc
push esi
call sub.KERNEL32.dll_GetCommandLineA
push eax
call fcn.004f1cb4
add esp, 0xc
test al, al
je 0x4f7e50
push edi
mov edi, 0x3ff
push edi
lea eax, [ebp - 0x803]
push ebx
push eax
mov byte [ebp - 0x804], bl
call fcn.00534b40
push edi
lea eax, [ebp - 0x403]
push ebx
push eax
mov byte [ebp - 0x404], bl
call fcn.00534b40
lea eax, [ebp - 0x404]
push eax
call fcn.004f0512
call sub.KERNEL32.dll_GetCommandLineA
push esi
push eax
call fcn.005383e0
push esi
mov edi, eax
call fcn.0053d020
add eax, edi
push eax
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x804]
push str.__s__s
push eax
call fcn.00535bfb
push ebx
push ebx
push 0x20
lea eax, [ebp - 0x804]
push ebx
push eax
call fcn.004f0633
add esp, 0x4c
xor eax, eax
inc eax
pop edi
jmp 0x4f7e52
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00534bba
leave
ret

Function at 0x4f7f04
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x676300]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x414], eax
mov eax, dword [ebp + 0xc]
push ebx
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp + 0x10]
push esi
mov esi, ecx
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0x418], eax
mov eax, dword [esi]
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x410], ecx
cmp eax, 0xffffffff
je 0x4f7ff6
xor ebx, ebx
cmp eax, ebx
je 0x4f7ff6
push 0x3ff
lea eax, [ebp - 0x403]
push ebx
push eax
mov dword [ebp - 0x408], ecx
mov byte [ebp - 0x404], bl
call fcn.00534b40
push 0x400
push dword [ebp - 0x40c]
lea eax, [ebp - 0x404]
push eax
call fcn.00537970
add esp, 0x18
cmp edi, ebx
jne 0x4f7fb9
lea eax, [ebp - 0x404]
push ebx
push eax
call fcn.004ee9b6
mov edi, eax
pop ecx
pop ecx
cmp edi, ebx
je 0x4f7ff6
push 0x2e
push edi
call fcn.005383a0
pop ecx
pop ecx
cmp eax, ebx
je 0x4f7fb9
mov byte [eax], bl
cmp dword [ebp - 0x410], ebx
jne 0x4f7fc7
mov dword [ebp - 0x408], edi
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x40c]
push 1
push dword [ebp - 0x418]
push dword [ebp - 0x414]
push 0xf01ff
push dword [ebp - 0x408]
push edi
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
jmp 0x4f7ff8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00534bba
leave
ret 0x14
Function at 0x511c70
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x571d2e
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x676300]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
test byte [0x67fb68], 1
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], ecx
jne 0x511ce2
or dword [0x67fb68], 1
mov ecx, 0x67fb50
mov dword [ebp - 4], 0
call fcn.004f0b02
push 0x5769a0
call fcn.005382a2
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, 0x67fb50
mov dword [ebp - 0x64], ecx
call fcn.004f0b18
cmp byte [0x67fb40], 0
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], 1
je 0x511d1d
cmp byte [0x67fb30], 0
je 0x511d1d
call ebx
sub eax, dword [0x67fb2c]
cmp eax, 0x2710
jbe 0x511d70
call ebx
push edi
push esi
lea ecx, [ebp - 0x58]
mov dword [0x67fb2c], eax
call fcn.004f1577
push 0x65c915
push 0xd
push 0x67fb40
push 0x57b0d4
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 2
call fcn.004f10ba
push 0x65c915
push 0xd
push 0x67fb30
push str.BuildNumber
lea ecx, [ebp - 0x58]
call fcn.004f10ba
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 1
call fcn.004f12d2
mov ecx, 0x67fb50
mov dword [ebp - 4], 0xffffffff
call fcn.004f0b20
mov edx, dword [ebp - 0x60]
mov eax, 0x67fb40
sub edx, eax
jmp 0x511d90
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x511d90
mov edx, dword [ebp - 0x5c]
mov eax, 0x67fb30
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x511da4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00534bba
mov esp, ebp
pop ebp
ret

Function at 0x517810
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
push 0x579fa8
push eax
mov edi, ecx
call fcn.00536808
mov esi, eax
add esp, 8
test esi, esi
jne 0x517836
pop edi
xor al, al
pop esi
pop ebp
ret 4
mov ecx, dword [edi + 0x30]
push ebx
push esi
push 0x10000
push 2
push ecx
call fcn.00535138
push esi
push 1
lea ebx, [edi + 0x4c]
push 4
push ebx
call fcn.00535138
push esi
push 1
lea edx, [edi + 0x44]
push 1
push edx
call fcn.00535138
mov eax, dword [ebx]
mov ecx, dword [edi + 0x48]
push esi
push eax
push 0x10
push ecx
call fcn.00535138
add esp, 0x40
push esi
call fcn.00536f74
add esp, 4
pop ebx
pop edi
mov al, 1
pop esi
pop ebp
ret 4
Function at 0x518660
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
push 0x579fa8
push eax
mov edi, ecx
call fcn.00536808
mov esi, eax
add esp, 8
test esi, esi
jne 0x518686
pop edi
xor al, al
pop esi
pop ebp
ret 4
mov ecx, dword [edi + 0x30]
push ebx
push esi
push 0x10000
push 2
push ecx
call fcn.00535138
push esi
push 1
lea ebx, [edi + 0x4c]
push 4
push ebx
call fcn.00535138
push esi
push 1
lea edx, [edi + 0x44]
push 1
push edx
call fcn.00535138
mov eax, dword [ebx]
mov ecx, dword [edi + 0x48]
push esi
push eax
push 0x14
push ecx
call fcn.00535138
add esp, 0x40
push esi
call fcn.00536f74
add esp, 4
pop ebx
pop edi
mov al, 1
pop esi
pop ebp
ret 4
Function at 0x5219d0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57280b
mov eax, dword fs:[0]
push eax
sub esp, 0x94c
mov eax, dword [0x676300]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x14]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
lea edx, [ebp - 0x810]
mov dword [ebp - 0x954], eax
mov eax, esi
sub edx, esi
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x521a20
push edi
push esi
lea ecx, [ebp - 0x410]
push 0x657928
push ecx
call fcn.00535bfb
add esp, 0x10
lea edx, [ebp - 0x950]
push edx
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x521abd
test esi, esi
je 0x521abd
mov dword [ebp - 0x958], esi
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x924]
push ecx
lea edx, [ebp - 0x810]
push edx
lea eax, [ebp - 0x410]
push 0x57a838
push eax
call fcn.00535bfb
mov ecx, dword [ebp - 0x954]
push ecx
lea edx, [ebp - 0x410]
push edx
push ebx
call fcn.00521940
add esp, 0x1c
lea eax, [ebp - 0x950]
push eax
push esi
call edi
test eax, eax
jne 0x521a72
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00534bba
mov esp, ebp
pop ebp
ret
Function at 0x524990
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0
mov esi, ecx
call fcn.005377d5
add esp, 4
lea ecx, [esi + 0x34]
mov dword [esi + 4], eax
mov dword [esi + 0x48], 1
mov dword [esi + 0x44], 0
call fcn.004f161a
cmp eax, 0xffffffff
je 0x5249cc
lea ecx, [esi + 0x34]
call fcn.004f161a
test eax, eax
jne 0x5249da
push 1
push 0
push 0
lea ecx, [esi + 0x34]
call fcn.004f16ce
lea ecx, [esi + 0x3c]
call fcn.004f161a
cmp eax, 0xffffffff
je 0x5249f3
lea ecx, [esi + 0x3c]
call fcn.004f161a
test eax, eax
jne 0x524a01
push 1
push 0
push 0
lea ecx, [esi + 0x3c]
call fcn.004f16ce
cmp dword [esi + 0x38], 0
jne 0x524a39
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
mov dword [esi + 0x38], eax
test eax, eax
jne 0x524a39
call fcn.00568c15
push eax
push str.CreateWsaEvent_failed:__s
push str.NetworkConnection
push 0x67fa0c
call fcn.004ebec7
add esp, 0x10
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x28]
cmp eax, 0xffffffff
je 0x524a6b
cmp dword [esi + 0x7c], 0
je 0x524ac3
cmp eax, 0xffffffff
je 0x524a6b
push 1
push eax
call dword [sym.imp.WS2_32.dll_shutdown]
mov eax, dword [esi + 0x28]
cmp eax, 0xffffffff
je 0x524a6b
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 0x28], 0xffffffff
mov eax, dword [esi + 0x4c]
push eax
mov dword [esi + 0x7c], 0
call fcn.00568bf3
add esp, 4
mov dword [esi + 0x28], eax
cmp eax, 0xffffffff
jne 0x524aa5
push str.CreateSocket_failed
push str.NetworkConnection
push 0x67fa0c
call fcn.004ebec7
add esp, 0xc
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push 4
lea ecx, [ebp - 4]
push ecx
push 0x80
push 0xffff
push eax
mov dword [ebp - 4], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret