joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ada25
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x538fdc
call fcn.004ea774
sub esp, 0x18
push esi
push edi
mov dword [ebp - 0x18], ecx
call fcn.00520100
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4ada64
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x4ada69
or eax, 0xffffffff
jmp 0x4adae4
call fcn.0042e1bb
test eax, eax
mov dword [ebp - 0x14], eax
jle 0x4adad7
mov eax, dword [0x58c61c]
mov dword [ebp + 8], eax
and dword [ebp - 4], 0
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 8]
push eax
push edi
call fcn.0050c9a4
add esp, 0xc
test eax, eax
je 0x4adacb
push edi
lea ecx, [ebp - 0x24]
call fcn.0050c7f3
push dword [ebp - 0x14]
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 1
push dword [ebp + 8]
call fcn.0050ca13
lea ecx, [ebp - 0x24]
call fcn.0050c890
and byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
mov edi, eax
call fcn.0050c882
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00505ad8
mov ecx, dword [ebp - 0x18]
push esi
push dword [ebp + 0xc]
push edi
call fcn.0050a8ce
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 8

Function at 0x4ae980
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword [0x59222c]
test eax, eax
jne 0x4ae997
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x59222c], eax
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
neg eax
sbb eax, eax
inc eax
ret

Function at 0x4afce0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
xor ebx, ebx
cmp esi, 1
mov dword [0x5e0adc], ebx
jl 0x4afcf8
cmp esi, 9
jle 0x4afd05
push str.bad_pack_level
call fcn.004afde0
add esp, 4
push edi
mov ecx, 0x4000
xor eax, eax
mov edi, 0x5d0aa0
rep stosd dword es:[edi], eax
lea eax, [esi + esi*2]
push 0x10000
push 0x5c0a80
lea eax, [esi + eax*4]
mov ecx, dword [eax + 0x5841b4]
mov edx, dword [eax + 0x5841b0]
mov dword [0x5ad124], ecx
mov ecx, dword [eax + 0x5841b8]
mov dword [0x5d0a80], edx
mov dword [0x5c0a60], ecx
movzx dx, byte [eax + 0x5841bc]
mov eax, dword [esp + 0x1c]
or word [eax], dx
mov dword [0x5b0a54], ebx
mov dword [0x5d0a88], ebx
call fcn.004aeb50
add esp, 8
cmp eax, ebx
mov dword [0x5ad130], eax
pop edi
jne 0x4afd88
mov dword [0x5ad130], ebx
pop esi
mov dword [0x5ad12c], 1
pop ebx
ret
mov esi, 0x106
mov dword [0x5ad12c], ebx
cmp eax, esi
jae 0x4afdac
cmp dword [0x5ad12c], ebx
jne 0x4afdac
call fcn.004afef0
cmp dword [0x5ad130], esi
jb 0x4afd97
xor ecx, ecx
xor eax, eax
xor edx, edx
and ecx, 0x3ff
mov dl, byte [eax + 0x5c0a80]
and edx, 0x7fff
shl ecx, 5
xor ecx, edx
inc eax
cmp eax, 2
jb 0x4afdb0
pop esi
mov dword [0x5ad128], ecx
pop ebx
ret
Function at 0x4b1939
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x5390a2
call fcn.004ea774
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov dword [ebp - 0x10], ebx
cmp dword [esi], ebx
jne 0x4b1a01
push 8
call fcn.00505819
mov edi, eax
pop ecx
mov dword [ebp + 8], edi
cmp edi, ebx
mov dword [ebp - 4], ebx
je 0x4b1978
mov ecx, edi
call fcn.0052333f
mov ecx, edi
jmp 0x4b197a
xor ecx, ecx
or dword [ebp - 4], 0xffffffff
push ebx
push str.HexinSSLCnt.SocksProxy
mov dword [esi], ecx
call fcn.005233eb
test eax, eax
jne 0x4b1a01
push 0xffffffffffffffff
push 4
push 0x14d
call fcn.00513ffb
cmp eax, 6
jne 0x4b19e7
lea ecx, [ebp - 0x18]
call fcn.004219ec
push 1
lea ecx, [ebp - 0x18]
pop edi
push 0x166
mov dword [ebp - 4], edi
call fcn.00421a9e
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x14]
neg eax
sbb eax, eax
push edi
and eax, ecx
push ebx
push ebx
mov eax, dword [eax]
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00421a1a
mov edi, dword [esi]
or dword [ebp - 0x10], 0xffffffff
cmp edi, ebx
je 0x4b19ff
mov ecx, edi
call fcn.0052343e
push edi
call fcn.00505842
pop ecx
mov dword [esi], ebx
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4b48dd
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004b495d
add esp, 0xc
mov dword [ebp + 8], eax
test eax, eax
jne 0x4b48fa
pop ebp
ret
push esi
lea ecx, [ebp + 0xc]
push edi
push ecx
lea ecx, [ebp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0
push ecx
push 0
push dword [ebp + 0x14]
push eax
call esi
mov edi, eax
test edi, edi
jne 0x4b4949
cmp dword [ebp + 0x10], 1
jne 0x4b4946
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 0x10]
push dword [ebp + 0x18]
push eax
push edi
push dword [ebp + 0x14]
push dword [ebp + 8]
call esi
mov edi, eax
test edi, edi
jne 0x4b4949
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x18]
and byte [eax + ecx], 0
jmp 0x4b4949
or edi, 0xffffffff
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test edi, edi
pop edi
pop esi
sete al
pop ebp
ret

Function at 0x4b49c5
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004b495d
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x4b4a1d
lea eax, [ebp + 0x10]
push edi
push eax
lea eax, [ebp + 0xc]
push dword [ebp + 0x18]
mov dword [ebp + 0x10], 4
push eax
push 0
push dword [ebp + 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
test edi, edi
jne 0x4b4a0b
cmp dword [ebp + 0xc], 4
je 0x4b4a0e
or edi, 0xffffffff
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test edi, edi
sete al
pop edi
pop ebx
pop ebp
ret
Function at 0x4b4cf1
Capabilities:
Link many functions at runtime

Disassembly:
push esi
push edi
mov esi, ecx
push str.RasAPI32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [esi + 0x90], eax
je 0x4b4e18
push 0x28
push 0
push 0x5ad228
call fcn.004ea940
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 0xc
push str.RasEnumEntriesA
push dword [esi + 0x90]
call edi
test eax, eax
mov dword [0x5ad228], eax
je 0x4b4e11
push str.RasGetEntryDialParamsA
push dword [esi + 0x90]
call edi
test eax, eax
mov dword [0x5ad22c], eax
je 0x4b4e11
push str.RasSetEntryDialParamsA
push dword [esi + 0x90]
call edi
test eax, eax
mov dword [0x5ad230], eax
je 0x4b4e11
push str.RasDialA
push dword [esi + 0x90]
call edi
test eax, eax
mov dword [0x5ad234], eax
je 0x4b4e11
push str.RasHangUpA
push dword [esi + 0x90]
call edi
test eax, eax
mov dword [0x5ad238], eax
je 0x4b4e11
push str.RasGetErrorStringA
push dword [esi + 0x90]
call edi
test eax, eax
mov dword [0x5ad23c], eax
je 0x4b4e11
push str.RasEnumConnectionsA
push dword [esi + 0x90]
call edi
test eax, eax
mov dword [0x5ad240], eax
je 0x4b4e11
push str.RasGetConnectStatusA
push dword [esi + 0x90]
call edi
test eax, eax
mov dword [0x5ad244], eax
je 0x4b4e11
push str.RasGetEntryPropertiesA
push dword [esi + 0x90]
call edi
test eax, eax
mov dword [0x5ad248], eax
je 0x4b4e11
push str.RasSetEntryPropertiesA
push dword [esi + 0x90]
call edi
test eax, eax
mov dword [0x5ad24c], eax
jne 0x4b4e1c
mov ecx, esi
call fcn.004b4cd4
xor eax, eax
jmp 0x4b4e1f
push 1
pop eax
pop edi
pop esi
ret
Function at 0x4b9643
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x539ab7
call fcn.004ea774
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edx, dword [0x58c61c]
lea ecx, [esi + 0xc]
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ecx], edx
mov edx, dword [0x58c61c]
mov dword [esi + 0x10], edx
mov edx, dword [0x58c61c]
mov dword [esi + 0x18], edx
mov edx, dword [0x58c61c]
mov dword [esi + 0x1c], edx
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov edx, dword [0x58c61c]
mov dword [esi + 0x68], edx
mov edx, dword [0x58c61c]
mov dword [esi + 0x6c], edx
mov edx, dword [0x58c61c]
mov dword [esi + 0x7c], edx
mov edx, dword [ebp + 0x14]
or dword [esi + 0x14], 0xffffffff
mov dword [esi + 8], edx
mov edx, dword [ebp + 8]
mov dword [esi + 0x20], edx
mov edx, dword [ebp + 0xc]
mov dword [esi + 0x24], edx
mov edx, dword [ebp + 0x10]
push 0x5913bc
mov byte [ebp - 4], 9
mov dword [esi], method.CCommandLineInfo.virtual_0
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x28], edx
mov dword [esi + 0x58], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x60], eax
mov dword [esi + 0x74], eax
mov dword [esi + 0x78], eax
mov dword [esi + 0x80], eax
mov dword [esi + 0x5c], eax
mov dword [esi + 0x70], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x84], eax
mov dword [esi + 0x88], eax
mov dword [esi + 0x8c], eax
mov dword [esi + 4], eax
call fcn.00505c61
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 0x10
Function at 0x4bf862
Capabilities:
Create thread

Disassembly:
mov eax, 0x53a614
call fcn.004ea774
push ecx
push ecx
push ebx
push esi
mov ebx, ecx
push 0x10
call fcn.00505819
test eax, eax
pop ecx
je 0x4bf893
mov ecx, dword [0x58c61c]
mov esi, eax
mov dword [eax], ecx
mov ecx, dword [0x58c61c]
mov dword [eax + 4], ecx
jmp 0x4bf895
xor esi, esi
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push dword [ebp + 0xc]
call fcn.0050584d
lea eax, [ebp + 0xc]
push eax
call fcn.004beafb
pop ecx
pop ecx
and dword [ebp - 4], 0
push eax
lea ecx, [esi + 4]
call fcn.00505c11
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00505ad8
mov eax, dword [ebp + 0x10]
add ebx, 0x44
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 8]
push ebx
mov ecx, esi
mov dword [esi + 8], eax
call fcn.00505c11
lea eax, [ebp - 0x14]
push eax
push 0
push esi
push 0x4bf90f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x4bf8ff
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 0xc

Function at 0x4c01c3
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x186], edi
je 0x4c01d8
xor eax, eax
jmp 0x4c0205
cmp dword [esi + 0x60], edi
jne 0x4c01d4
mov eax, dword [ebp + 8]
mov dword [esi + 0x186], eax
lea eax, [ebp + 8]
push eax
push edi
push esi
push 0x4c020b
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
cmp eax, edi
setne cl
mov dword [esi + 0x64], eax
mov eax, ecx
pop edi
pop esi
pop ebp
ret 4

Function at 0x4c2629
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x53abab
call fcn.004ea774
push ecx
mov eax, dword [0x58c61c]
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi + 0x10], eax
xor edi, edi
lea ecx, [esi + 0x34]
push edi
push edi
push edi
mov dword [ebp - 4], edi
call fcn.004e300b
mov ecx, dword [ebp - 0xc]
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x14], edi
mov dword [esi + 4], edi
mov dword [esi], 0x54c9f4
mov dword [esi + 0x18], 0x2710
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x4c4010
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, ebp
push edi
mov eax, ecx
sub esi, ecx
mov edi, 8
mov dl, byte [esi + eax]
or dl, 0x80
mov byte [eax], dl
inc eax
dec edi
jne 0x4c4027
mov eax, 1
mov dl, byte [eax + ebp - 1]
mov bl, byte [eax + ecx]
xor bl, dl
mov byte [eax + ecx], bl
inc eax
cmp eax, 8
jl 0x4c4038
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x4c44b0
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf0
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x5850a0]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x48], al
inc ecx
cmp ecx, 0x38
jl 0x4c44c3
xor edx, edx
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x84]
lea ebp, [esp + eax*4 + 0x80]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x585148]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x4c4523
mov bl, byte [esp + ecx + 0x48]
jmp 0x4c4527
mov bl, byte [esp + ecx + 0x2c]
mov byte [esp + eax + 0x10], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x4c4518
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x4c4545
mov bl, byte [esp + ecx + 0x48]
jmp 0x4c4549
mov bl, byte [esp + ecx + 0x2c]
mov byte [esp + eax + 0x10], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x4c453a
xor ecx, ecx
mov eax, 0x5850b0
xor ebx, ebx
mov bl, byte [ecx + 0x585158]
cmp byte [esp + ebx + 0x10], 0
je 0x4c4574
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x585170]
cmp byte [esp + ebx + 0x10], 0
je 0x4c458b
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x4c455b
inc edx
cmp edx, 0x10
jl 0x4c44ee
mov edx, dword [esp + 0x10c]
mov ecx, dword [esp + 0x104]
lea eax, [esp + 0x80]
push edx
push eax
push ecx
call fcn.004c45d0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf0
ret
Function at 0x4c5ae0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x4c6ed0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x30
push ebx
mov ebx, dword [esp + 0x40]
push ebp
push esi
push edi
mov edi, dword [esp + 0x44]
lea esi, [esp + 0x20]
lea ebp, [esp + 0x30]
sub esi, edi
sub ebx, edi
mov eax, edi
sub ebp, edi
mov dword [esp + 0x44], 0x10
mov dl, byte [eax]
mov cl, byte [ebx + eax]
mov byte [esi + eax - 0x10], dl
mov byte [esi + eax], cl
xor cl, dl
mov byte [eax + ebp], cl
mov ecx, dword [esp + 0x44]
inc eax
dec ecx
mov dword [esp + 0x44], ecx
jne 0x4c6ef7
xor eax, eax
xor edx, edx
xor ecx, ecx
mov al, byte [eax + str._.C]
mov bl, byte [esp + ecx + 0x10]
xor bl, al
mov al, bl
mov byte [esp + ecx + 0x10], bl
and eax, 0xff
inc ecx
cmp ecx, 0x30
jb 0x4c6f1a
add eax, edx
and eax, 0xff
inc edx
cmp edx, 0x12
jb 0x4c6f18
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x4c]
mov dword [edi], ecx
mov ecx, dword [esp + 0x1c]
mov dword [edi + 4], edx
mov dword [edi + 8], eax
mov eax, dword [esp + 0x48]
mov dword [edi + 0xc], ecx
xor ecx, ecx
sub esi, eax
mov cl, byte [eax + 0xf]
mov edi, 0x10
xor edx, edx
mov dl, byte [esi + eax]
xor edx, ecx
mov cl, byte [edx + str._.C]
mov dl, byte [eax]
xor dl, cl
mov cl, dl
mov byte [eax], dl
and ecx, 0xff
inc eax
dec edi
jne 0x4c6f73
push 0x30
lea edx, [esp + 0x14]
push 0
push edx
call fcn.004c6fb0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret

Function at 0x4c9230
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
inc ecx
push ecx
call fcn.00505819
add esp, 4
mov ebx, eax
call fcn.004c92c0
mov byte [ebx], al
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebx + 1]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
lea eax, [esi - 1]
test eax, eax
jle 0x4c929d
mov cl, byte [eax + ebx - 1]
mov dl, byte [eax + ebx]
xor dl, cl
mov byte [eax + ebx], dl
dec eax
test eax, eax
jg 0x4c928c
push 0x100
push 0x5ad524
push esi
push ebx
call fcn.004c9100
push ebx
call fcn.00505842
add esp, 0x14
mov eax, 0x5ad524
pop edi
pop esi
pop ebx
ret
Function at 0x4c9300
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push edi
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, 0x5ad424
mov ebx, ecx
mov ecx, 0x40
rep stosd dword es:[edi], eax
mov eax, ebx
and eax, reloc.WSOCK32.dll_accept
jns 0x4c932f
dec eax
or eax, 0xfffffffe
inc eax
je 0x4c933a
pop edi
pop ebp
mov eax, 0x5ad424
pop ebx
ret
mov eax, ebx
push esi
cdq
sub eax, edx
mov esi, eax
sar esi, 1
add esi, 2
push esi
call fcn.00505819
mov edi, eax
push esi
push edi
push ebx
push ebp
call fcn.004c91c0
sub esi, 2
mov eax, 1
add esp, 0x14
cmp esi, eax
jle 0x4c9378
mov cl, byte [eax + edi - 1]
mov bl, byte [eax + edi]
xor bl, cl
mov byte [eax + edi], bl
inc eax
cmp eax, esi
jl 0x4c9367
push 0
lea edx, [edi + 1]
push 0xffffffffffffffff
push edx
push 0x100
push 0x5ad424
mov byte [eax + edi], 0
call fcn.004c8af0
push edi
call fcn.00505842
add esp, 0x18
mov eax, 0x5ad424
pop esi
pop edi
pop ebp
pop ebx
ret

Function at 0x4c98fb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4c9953
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
push dword [ebp + 8]
push esi
push esi
push 0x5913bc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4c9946
push 1
pop esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x4c9955
xor eax, eax
pop esi
leave
ret 4
Function at 0x4d1720
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x53ad47
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [0x58c61c]
push ebx
push esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
push eax
push eax
push ecx
lea edx, [esp + 0x14]
mov ebx, 1
push str._s___s___s
push edx
mov dword [esp + 0x44], ebx
call fcn.00501ac9
mov eax, dword [esp + 0x1c]
add esp, 0x14
lea ecx, [esp + 0x10]
push eax
call fcn.0040af95
mov ecx, dword [esp + 0x3c]
mov byte [esp + 0x30], 2
mov eax, dword [ecx + 0x14]
lea ecx, [esp + 0x10]
push eax
call int.0040b073
test eax, eax
je 0x4d17ae
mov esi, dword [esp + 0x38]
push ebx
push esi
lea ecx, [esp + 0x18]
call fcn.0040b13b
mov dword [esp + 0xc], ebx
jmp 0x4d17c2
mov esi, dword [esp + 0x38]
push 0x5913bc
mov ecx, esi
call fcn.00505b46
mov dword [esp + 0xc], ebx
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], bl
call fcn.0040b035
lea ecx, [esp + 8]
mov byte [esp + 0x30], 0
call fcn.00505ad8
mov ecx, dword [esp + 0x28]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x4d1960
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x53adc1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0x1c], esi
mov dword [esi + 4], 0x54cf14
mov dword [esi + 8], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0xc], ebx
lea ebp, [esi + 0x18]
mov dword [esp + 0x28], ebx
mov dword [ebp], method.CCommandLineInfo.virtual_0
mov dword [ebp + 4], ebx
mov dword [ebp + 0x10], ebx
mov dword [ebp + 0xc], ebx
mov dword [ebp + 8], ebx
mov al, byte [esp + 0x13]
mov cl, byte [esp + 0x13]
push 0x24
mov byte [esp + 0x2c], 1
mov byte [esi + 0x30], al
mov byte [esi + 0x31], cl
mov byte [esi + 0x38], bl
call fcn.00505819
mov edi, eax
add esp, 4
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], edi
mov dword [edi + 4], ebx
mov dword [edi + 0x20], 1
call fcn.004fa836
cmp dword [0x5adc74], ebx
jne 0x4d1a07
mov dword [0x5adc74], edi
mov dword [edi], ebx
mov edx, dword [0x5adc74]
mov dword [esp + 0x14], ebx
mov dword [edx + 8], ebx
mov edx, dword [0x5adc70]
lea ecx, [esp + 0x18]
inc edx
mov dword [0x5adc70], edx
call fcn.004fa8d2
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x4d1a2e
push eax
call fcn.00505842
add esp, 4
mov edi, dword [0x5adc74]
push 0x24
call fcn.00505819
mov dword [eax + 4], edi
mov dword [eax + 0x20], ebx
mov dword [esi + 0x34], eax
mov dword [esi + 0x3c], ebx
mov dword [eax], eax
mov eax, dword [esi + 0x34]
add esp, 4
mov dword [eax + 8], eax
mov dword [esi], 0x54cf04
mov dword [esi + 0x2c], ebx
mov edi, dword [esi + 0x20]
mov byte [esp + 0x28], 2
dec edi
js 0x4d1a8d
cmp edi, ebx
jl 0x4d1a8a
cmp edi, dword [esi + 0x20]
jge 0x4d1a8a
mov eax, dword [esi + 0x1c]
mov ecx, dword [eax + edi*4]
cmp ecx, ebx
je 0x4d1a8a
mov edx, dword [ecx]
push 1
call dword [edx + 4]
push 1
push edi
mov ecx, ebp
call fcn.004d25d0
dec edi
jns 0x4d1a66
push 0xffffffffffffffff
push ebx
lea ecx, [esi + 4]
mov dword [esi + 0x2c], ebx
call fcn.004469fa
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x4d4170
Capabilities:
Create thread

Disassembly:
push ebx
mov ebx, dword [esp + 0x18]
push edi
xor edi, edi
cmp ebx, edi
jne 0x4d4182
pop edi
or eax, 0xffffffff
pop ebx
ret
push esi
push 0x20
call fcn.00505819
add esp, 4
cmp eax, edi
je 0x4d41c2
mov ecx, dword [0x58c61c]
mov esi, eax
mov dword [eax], ecx
mov edx, dword [0x58c61c]
mov dword [eax + 4], edx
mov ecx, dword [0x58c61c]
mov dword [eax + 0x1c], ecx
mov dword [eax + 8], 3
mov dword [eax + 0xc], edi
mov dword [eax + 0x14], edi
mov dword [eax + 0x10], edi
mov dword [eax + 0x18], edi
jmp 0x4d41c4
xor esi, esi
mov edx, dword [esp + 0x10]
mov ecx, esi
push edx
call fcn.00505c61
mov eax, dword [esp + 0x18]
lea ecx, [esi + 4]
push eax
call fcn.00505c61
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x14]
mov dword [esi + 0x14], ecx
push eax
lea ecx, [esi + 0x1c]
mov dword [esi + 0xc], ebx
mov dword [esi + 8], edx
call fcn.00505c61
lea ecx, [esp + 0x20]
push ecx
push edi
push esi
push 0x4d4090
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
neg eax
sbb eax, eax
pop esi
neg eax
pop edi
dec eax
pop ebx
ret

Function at 0x4d4720
Capabilities:
Check internet connectivity via wininet
Connect to http server
Create http request

Disassembly:
mov eax, dword [esp + 8]
push esi
push 0
push 0x5913bc
push 0x5913bc
push 0
mov esi, ecx
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
mov dword [esi + 0x30d65], eax
jne 0x4d4758
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x30d71], eax
xor eax, eax
pop esi
ret 0x14
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push 0
push 0x4400000
push 3
push ecx
mov ecx, dword [esp + 0x20]
push edx
mov edx, dword [esp + 0x1c]
push ecx
push edx
push eax
call dword [sym.imp.WININET.dll_InternetConnectA]
test eax, eax
mov dword [esi + 0x30d69], eax
jne 0x4d47a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x30d71], eax
mov eax, dword [esi + 0x30d65]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
ret 0x14
push 0
call dword [sym.imp.WININET.dll_InternetAttemptConnect]
test eax, eax
je 0x4d47dd
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi + 0x30d69]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
mov dword [esi + 0x30d71], eax
call edi
mov edx, dword [esi + 0x30d65]
push edx
call edi
pop edi
xor eax, eax
pop esi
ret 0x14
mov eax, 1
pop esi
ret 0x14