joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402e4c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x516008], 0x8088405
inc edx
mov dword [ebx + 0x516008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x42b768
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x42b76e
ret

Function at 0x436c70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x436e21
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.00404ac8
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x436e38
call fcn.00404724
mov eax, ebx
call fcn.00427414
mov edi, eax
dec edi
test edi, edi
jl 0x436d28
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.004273e8
mov edx, dword [0x43b2a0]
call fcn.00403690
test al, al
je 0x436d24
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.004273e8
lea edx, [ebp - 0x14]
call fcn.00472c28
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.00404ac8
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404798
inc esi
dec edi
jne 0x436cd6
mov al, byte [0x436e3c]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x436e48
mov eax, dword [ebp - 0xc]
call fcn.0040e5a4
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.004044b0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.00472c28
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x436e38
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.00472c28
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x436e38
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x436e38
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x436e54
call fcn.0040a024
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x436e28
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.0040443c
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.0040443c
lea eax, [ebp - 0x14]
call fcn.00404418
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.0040443c
ret
Function at 0x4d05c0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x4d0649
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x51bd24
push 0x101
call sub.wsock32.dll_WSAStartup
mov ebx, eax
test ebx, ebx
je 0x4d0633
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.0040c7dc
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xb
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 0
mov eax, 0x4d0660
mov dword [ebp - 8], eax
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x18]
push eax
push 2
mov ecx, dword [0x51a798]
mov dl, 1
mov eax, dword [0x4cfdc4]
call fcn.0040d100
call fcn.00403d94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d0650
lea eax, [ebp - 0x1c]
call fcn.00404418
ret
Function at 0x4d0cf0
Capabilities:
Connect socket

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, ebx
call fcn.004d0c14
mov cl, 1
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call fcn.00403700
push 0x10
lea eax, [ebx + 0x18]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_connect
mov edx, 0x4d0d54
call fcn.004d0508
mov byte [ebx + 0x29], 0
test byte [ebx + 0x28], 0x10
jne 0x4d0d46
cmp dword [ebx + 4], 0xffffffff
setne al
mov byte [ebx + 8], al
mov cl, 2
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call fcn.00403700
pop esi
pop ebx
ret

Function at 0x4d0d78
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004d0ab0
xor eax, eax
push ebp
push 0x4d0df1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404418
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
jne 0x4d0db4
call fcn.00403e40
jmp 0x4d0df8
push 0x100
lea eax, [ebp - 0x104]
push eax
call sub.wsock32.dll_gethostname
test eax, eax
jne 0x4d0ddb
mov eax, ebx
lea edx, [ebp - 0x104]
mov ecx, 0x100
call fcn.00404688
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d0df8
mov eax, dword [ebp - 4]
call fcn.004d0abc
ret
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4d0e00
Capabilities:
Resolve dns

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, edx
mov eax, ebx
call fcn.004048d8
push eax
call sub.wsock32.dll_gethostbyname
mov ebx, eax
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 4
call fcn.00402e2c
test ebx, ebx
je 0x4d0e4b
mov eax, ebx
mov edx, dword [eax + 0xc]
mov edx, dword [edx]
mov cl, byte [edx]
mov byte [esp + 4], cl
mov cl, byte [edx + 1]
mov byte [esp + 5], cl
mov cl, byte [edx + 2]
mov byte [esp + 6], cl
mov al, byte [edx + 3]
mov byte [esp + 7], al
mov eax, dword [esp + 4]
mov dword [esp], eax
mov eax, dword [esp]
pop ecx
pop edx
pop ebx
ret

Function at 0x4d0e90
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov word [ebx], 2
test edi, edi
je 0x4d0eb8
mov edx, edi
mov eax, esi
call fcn.004d0e00
mov dword [ebx + 4], eax
jmp 0x4d0ef5
cmp dword [ebp - 4], 0
je 0x4d0ed1
mov eax, dword [ebp - 4]
call fcn.004048d8
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebx + 4], eax
jmp 0x4d0ef5
cmp byte [ebp + 0xc], 0
jne 0x4d0ede
xor eax, eax
mov dword [ebx + 4], eax
jmp 0x4d0ef5
mov ecx, dword [0x519f34]
mov dl, 1
mov eax, dword [0x4cfdc4]
call fcn.0040d0c4
call fcn.00403d94
cmp dword [ebp + 0x14], 0
je 0x4d0f11
mov edx, dword [ebp + 0x14]
mov eax, esi
call fcn.004d0e5c
push eax
call sub.wsock32.dll_htons_1
mov word [ebx + 2], ax
jmp 0x4d0f1f
mov ax, word [ebp + 0x10]
push eax
call sub.wsock32.dll_htons_1
mov word [ebx + 2], ax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x10
Function at 0x4d0f28
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x4d0f59
mov ecx, dword [0x51a5bc]
mov dl, 1
mov eax, dword [0x4cfdc4]
call fcn.0040d0c4
call fcn.00403d94
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], ebx
inc ebx
jne 0x4d0f86
mov ecx, dword [0x51a4bc]
mov dl, 1
mov eax, dword [0x4cfdc4]
call fcn.0040d0c4
call fcn.00403d94
xor eax, eax
push ebp
push 0x4d1002
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xffff
call fcn.00403700
cmp byte [ebp + 8], 0
je 0x4d0fde
mov eax, dword [ebp + 0x10]
push eax
mov ax, word [ebp + 0xc]
push eax
push 1
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.004d0e90
mov eax, dword [ebp - 4]
lea esi, [ebp - 0x18]
lea edi, [eax + 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 4]
call fcn.004d0cf0
jmp 0x4d0ff8
mov eax, dword [ebp + 0x10]
push eax
mov ax, word [ebp + 0xc]
push eax
push 0
push 1
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.004d07f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d101f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4d11e4
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004d0ab0
xor eax, eax
push ebp
push 0x4d1355
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x4d133f
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
je 0x4d122f
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x4d1239
call fcn.00403e40
jmp 0x4d135c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00420754
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x1010]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov ecx, 0x1000
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
test ebx, ebx
jle 0x4d1334
push 0
push ebx
lea eax, [ebp - 0x1010]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x4d12e7
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2733
je 0x4d12d4
lea eax, [ebp - 0x10]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00403700
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
push ebp
call fcn.004d119c
pop ecx
mov eax, dword [ebp - 4]
mov dl, byte [0x4d1368]
cmp dl, byte [eax + 0x28]
je 0x4d133b
call fcn.0040cfe8
jmp 0x4d133b
mov eax, dword [ebp - 0xc]
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00420774
jmp 0x4d133b
cmp ecx, ebx
jge 0x4d1303
mov eax, dword [ebp - 0xc]
add eax, ecx
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00420774
jmp 0x4d1239
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00420754
cmp edx, dword [esp + 4]
jne 0x4d1323
cmp eax, dword [esp]
pop edx
pop eax
jne 0x4d1239
push ebp
call fcn.004d119c
pop ecx
jmp 0x4d133b
push ebp
call fcn.004d119c
pop ecx
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d135c
mov eax, dword [ebp - 4]
call fcn.004d0abc
ret
mov al, byte [ebp - 5]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d136c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d148e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004d0ab0
xor eax, eax
push ebp
push 0x4d1471
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x4d13bc
call fcn.00403e40
jmp 0x4d1478
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x4d145b
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x4d145b
lea eax, [ebp - 0xc]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00403700
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x4d145b
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040c7dc
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x4d14a8
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x51a798]
mov dl, 1
mov eax, dword [0x4cfdc4]
call fcn.0040d100
call fcn.00403d94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d1478
mov eax, dword [ebp - 4]
call fcn.004d0abc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d1495
lea eax, [ebp - 0x28]
call fcn.00404418
ret
Function at 0x4d14f4
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d163e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004d0ab0
xor eax, eax
push ebp
push 0x4d1621
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp ebx, 0xffffffff
jne 0x4d1559
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x4d1559
lea eax, [ebp - 8]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x4d160b
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x4d156c
call fcn.00403e40
jmp 0x4d1628
push 0
push ebx
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x4d160b
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x4d160b
lea eax, [ebp - 0xc]
push eax
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00403700
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x4d160b
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040c7dc
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x4d1658
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x51a798]
mov dl, 1
mov eax, dword [0x4cfdc4]
call fcn.0040d100
call fcn.00403d94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d1628
mov eax, dword [ebp - 4]
call fcn.004d0abc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d1645
lea eax, [ebp - 0x28]
call fcn.00404418
ret
Function at 0x4d2654
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov dword [esp], ecx
mov ebp, edx
mov esi, eax
mov eax, dword [esi]
push eax
call sub.wsock32.dll_htonl
mov ebx, eax
mov eax, dword [esi + 4]
push eax
call sub.wsock32.dll_htonl
mov esi, eax
mov eax, dword [ebp]
push eax
call sub.wsock32.dll_htonl
mov edi, eax
mov eax, dword [ebp + 4]
push eax
call sub.wsock32.dll_htonl
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
push eax
call sub.wsock32.dll_htonl
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
push eax
call sub.wsock32.dll_htonl
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 0x10], 0x9e3779b9
mov edx, 0x10
add eax, dword [esp + 0x10]
mov ecx, esi
shl ecx, 4
add ecx, edi
lea ebp, [eax + esi]
xor ecx, ebp
mov ebp, esi
shr ebp, 5
add ebp, dword [esp + 4]
xor ecx, ebp
add ebx, ecx
mov ecx, ebx
shl ecx, 4
add ecx, dword [esp + 8]
lea ebp, [eax + ebx]
xor ecx, ebp
mov ebp, ebx
shr ebp, 5
add ebp, dword [esp + 0xc]
xor ecx, ebp
add esi, ecx
dec edx
jne 0x4d26b8
push ebx
call sub.wsock32.dll_htonl_1
mov edx, dword [esp]
mov dword [edx], eax
push esi
call sub.wsock32.dll_htonl_1
mov edx, dword [esp]
mov dword [edx + 4], eax
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4d2714
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov dword [esp], ecx
mov ebp, edx
mov esi, eax
mov eax, dword [esi]
push eax
call sub.wsock32.dll_htonl
mov ebx, eax
mov eax, dword [esi + 4]
push eax
call sub.wsock32.dll_htonl
mov esi, eax
mov eax, dword [ebp]
push eax
call sub.wsock32.dll_htonl
mov edi, eax
mov eax, dword [ebp + 4]
push eax
call sub.wsock32.dll_htonl
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
push eax
call sub.wsock32.dll_htonl
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
push eax
call sub.wsock32.dll_htonl
mov dword [esp + 0xc], eax
mov eax, 0xe3779b90
mov dword [esp + 0x10], 0x9e3779b9
mov edx, 0x10
mov ecx, ebx
shl ecx, 4
add ecx, dword [esp + 8]
lea ebp, [eax + ebx]
xor ecx, ebp
mov ebp, ebx
shr ebp, 5
add ebp, dword [esp + 0xc]
xor ecx, ebp
sub esi, ecx
mov ecx, esi
shl ecx, 4
add ecx, edi
lea ebp, [eax + esi]
xor ecx, ebp
mov ebp, esi
shr ebp, 5
add ebp, dword [esp + 4]
xor ecx, ebp
sub ebx, ecx
sub eax, dword [esp + 0x10]
dec edx
jne 0x4d277b
push ebx
call sub.wsock32.dll_htonl_1
mov edx, dword [esp]
mov dword [edx], eax
push esi
call sub.wsock32.dll_htonl_1
mov edx, dword [esp]
mov dword [edx + 4], eax
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4d27e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
mov eax, 8
mov edx, dword [ebp + 8]
lea esi, [edx - 0x10]
mov edx, dword [ebp + 8]
add edx, 0xfffffff8
mov ebx, dword [ebp + 8]
cmp byte [ebx - 0x15], 0
je 0x4d280b
mov bl, byte [esi]
xor byte [edx], bl
jmp 0x4d2810
mov bl, byte [ecx]
xor byte [edx], bl
inc ecx
inc edx
inc esi
dec eax
jne 0x4d27fc
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x20]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0x1c]
mov eax, dword [ebp + 8]
add eax, 0xfffffff8
call fcn.004d2654
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x20]
mov eax, 8
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
mov bl, byte [edx]
xor byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x4d283d
mov eax, dword [ebp + 8]
lea edx, [eax - 0x10]
mov eax, dword [ebp + 8]
add eax, 0xfffffff8
mov ecx, 8
call fcn.004029ec
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x20]
mov edx, dword [ebp + 8]
mov dword [edx - 0x14], eax
mov eax, dword [ebp + 8]
add dword [eax - 0x20], 8
mov eax, dword [ebp + 8]
add dword [eax - 0x24], 8
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax - 0x28], edx
mov eax, dword [ebp + 8]
mov byte [eax - 0x15], 0
pop esi
pop ebx
pop ebp
ret

Function at 0x4f0eb8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
add eax, 0xc
mov eax, dword [eax]
mov dword [edx + 0xc], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0xc]
mov ebx, ecx
shl ebx, 0x18
shr ecx, 8
or ebx, ecx
mov ecx, ebx
xor ebx, ebx
mov bl, cl
mov ebx, dword [ebx*4 + 0x518acc]
mov dword [esp + 4], ebx
mov ebx, ecx
shr ebx, 8
and ebx, 0xff
mov esi, dword [ebx*4 + 0x518acc]
mov ebx, ecx
shr ebx, 0x10
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x518acc]
mov dword [esp + 8], ebx
shr ecx, 0x18
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x518acc]
mov ebx, esi
shl ebx, 8
shr esi, 0x18
or ebx, esi
xor ebx, dword [esp + 4]
mov esi, dword [esp + 8]
shl esi, 0x10
mov edi, dword [esp + 8]
shr edi, 0x10
or esi, edi
xor ebx, esi
mov esi, ecx
shl esi, 0x18
shr ecx, 8
or esi, ecx
xor ebx, esi
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x518a50]
mov dword [edx + eax*4 + 0x10], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x14], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x18], ebx
mov ecx, dword [edx + eax*4 + 0xc]
xor ecx, ebx
mov dword [edx + eax*4 + 0x1c], ecx
add eax, 4
cmp eax, 0x28
jl 0x4f0ee3
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x4fb654
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x4fb65c
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4fb84e
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x4fb864
mov eax, esi
call fcn.004f93e4
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.0040446c
lea ecx, [ebp - 0x10]
mov edx, 0x4fb878
mov eax, esi
call fcn.004f93e4
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.0040446c
lea ecx, [ebp - 0x14]
mov edx, 0x4fb890
mov eax, esi
call fcn.004f93e4
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.0040446c
lea ecx, [ebp - 0x18]
mov edx, 0x4fb8ac
mov eax, esi
call fcn.004f93e4
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.0040446c
lea ecx, [ebp - 0x1c]
mov edx, 0x4fb8c8
mov eax, esi
call fcn.004f93e4
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.0040446c
lea ecx, [ebp - 0x24]
mov edx, 0x4fb8e0
mov eax, esi
call fcn.004f93e4
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408d80
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.004092c8
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x4fb8f8
mov eax, esi
call fcn.004f93e4
mov eax, dword [ebp - 0x28]
call fcn.004f84fc
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x4fb908
mov eax, esi
call fcn.004f93e4
mov eax, dword [ebp - 0x2c]
call fcn.004f84fc
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x4fb920
mov eax, esi
call fcn.004f93e4
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.004092c8
inc eax
je 0x4fb7f1
lea ecx, [ebp - 0x34]
mov edx, 0x4fb920
mov eax, esi
call fcn.004f93e4
mov eax, dword [ebp - 0x34]
call fcn.0040928c
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040ae34
fstp qword [ebp - 0x3c]
wait
call fcn.0040b1c4
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x4fb80c
lea ecx, [ebp - 0x40]
mov edx, 0x4fb920
mov eax, esi
call fcn.004f93e4
mov eax, dword [ebp - 0x40]
call fcn.004f84fc
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x4fb930
mov eax, esi
call fcn.004f93e4
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.0040446c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fb855
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.0040443c
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.0040443c
ret
Function at 0x507aec
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x507b46
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.00507adc
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.004f7168
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.004f6d68
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x507b4d
lea eax, [ebp - 4]
call fcn.00404418
ret