joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49f930
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x118], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405848
xor eax, eax
push ebp
push 0x49fade
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
test ebx, ebx
je 0x49fabd
mov eax, ebx
xor ecx, ecx
mov edx, 0x21
call fcn.00403b48
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
call fcn.00405858
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x49fabd
mov eax, dword [ebp - 0x14]
call fcn.00402f9c
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x49fab6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 0
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x49faa0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x49faf0
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x49faa0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
shr eax, 0x10
mov word [ebx + 0x19], ax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax + 8]
mov word [ebx + 0x1b], ax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
shr eax, 0x10
mov word [ebx + 0x1d], ax
mov eax, dword [ebp - 0x10]
movzx esi, word [eax + 0xc]
mov word [ebx + 0x1f], si
lea eax, [ebp - 0x118]
push eax
movzx eax, word [ebx + 0x19]
mov dword [ebp - 0x138], eax
mov byte [ebp - 0x134], 0
movzx eax, word [ebx + 0x1b]
mov dword [ebp - 0x130], eax
mov byte [ebp - 0x12c], 0
movzx eax, word [ebx + 0x1d]
mov dword [ebp - 0x128], eax
mov byte [ebp - 0x124], 0
movzx eax, si
mov dword [ebp - 0x120], eax
mov byte [ebp - 0x11c], 0
lea edx, [ebp - 0x138]
mov ecx, 3
mov eax, 0x49fafc
call fcn.0040c0e4
mov edx, dword [ebp - 0x118]
lea eax, [ebp - 0x114]
mov ecx, 0xff
call fcn.00405664
lea edx, [ebp - 0x114]
mov eax, ebx
mov cl, 0x18
call fcn.00403a38
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49fabd
mov eax, dword [ebp - 0xc]
call fcn.00402fd0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49fae5
lea eax, [ebp - 0x118]
call fcn.004053c8
lea eax, [ebp - 4]
call fcn.004053c8
ret

Function at 0x4b351c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405848
xor eax, eax
push ebp
push 0x4b357a
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 4]
call fcn.004b35f8
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
je 0x4b3562
lea eax, [ebp - 4]
call fcn.004b35f8
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 5
jne 0x4b3564
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b3581
lea eax, [ebp - 4]
call fcn.004053c8
ret
Function at 0x4b3588
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405848
xor eax, eax
push ebp
push 0x4b35ec
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xe
lea eax, [ebp - 0x1a]
push eax
lea eax, [ebp - 4]
call fcn.004b35f8
push eax
call sub.kernel32.dll_GetVolumeInformationA
mov edx, ebx
lea eax, [ebp - 0x1a]
call fcn.0040b858
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b35f3
lea eax, [ebp - 4]
call fcn.004053c8
ret

Function at 0x4b3bac
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405848
xor eax, eax
push ebp
push 0x4b3ca5
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, word [esi + 4]
mov word [ebx + 4], ax
movzx eax, word [esi + 6]
mov word [ebx + 6], ax
movzx eax, word [esi + 8]
mov word [ebx + 8], ax
movzx eax, word [esi + 0xa]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xc]
call fcn.004b32b0
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x18], eax
movzx eax, word [esi + 0x1c]
mov word [ebx + 0x1c], ax
movzx eax, word [esi + 0x1e]
mov word [ebx + 0x1e], ax
movzx eax, word [esi + 0x20]
mov word [ebx + 0x22], ax
movzx eax, word [esi + 0x22]
mov word [ebx + 0x24], ax
movzx eax, word [esi + 0x24]
mov word [ebx + 0x26], ax
mov eax, dword [esi + 0x26]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2a]
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040b43c
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004b457c
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040b2fc
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004b45f4
xor eax, eax
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b3cac
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004053ec
ret
Function at 0x4b3cb4
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405848
xor eax, eax
push ebp
push 0x4b3dbd
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebx + 4], 0
movzx eax, word [esi + 4]
mov word [ebx + 6], ax
movzx eax, word [esi + 6]
mov word [ebx + 8], ax
movzx eax, word [esi + 8]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xa]
call fcn.004b32b0
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0xe]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x12]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x16]
mov dword [ebx + 0x18], eax
movzx eax, word [esi + 0x1a]
mov word [ebx + 0x1c], ax
movzx eax, word [esi + 0x1c]
mov word [ebx + 0x20], ax
mov word [ebx + 0x22], 0
mov word [ebx + 0x24], 0
mov word [ebx + 0x26], 0
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
cmp dword [ebp - 4], 0
je 0x4b3d83
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040b43c
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004b457c
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040b2fc
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004b45f4
jmp 0x4b3d95
xor edx, edx
mov eax, ebx
call fcn.004b457c
xor edx, edx
mov eax, ebx
call fcn.004b45f4
xor eax, eax
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b3dc4
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004053ec
ret
Function at 0x4b73c4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b7535
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b7510
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x111], 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x105
lea eax, [ebp - 0x111]
push eax
lea eax, [ebp - 0x118]
mov edx, ebx
call fcn.004055b0
lea eax, [ebp - 0x118]
mov edx, 0x4b754c
call fcn.00405694
mov eax, dword [ebp - 0x118]
call fcn.00405858
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x4b7482
lea eax, [ebp - 0x111]
call fcn.0040b618
mov ecx, eax
lea edx, [ebp - 0x111]
mov eax, esi
call fcn.004054b8
jmp 0x4b7489
mov eax, esi
call fcn.004053c8
cmp bl, 0x61
jae 0x4b74aa
lea edx, [ebp - 0x11c]
mov eax, dword [esi]
call fcn.0040ff34
mov edx, dword [ebp - 0x11c]
mov eax, esi
call fcn.0040541c
jmp 0x4b74c4
lea edx, [ebp - 0x120]
mov eax, dword [esi]
call fcn.0040fea0
mov edx, dword [ebp - 0x120]
mov eax, esi
call fcn.0040541c
lea eax, [ebp - 0x124]
push eax
mov eax, dword [esi]
mov dword [ebp - 0x12c], eax
mov byte [ebp - 0x128], 0xb
lea edx, [ebp - 0x12c]
xor ecx, ecx
mov eax, 0x4b7558
call fcn.0040c0e4
mov edx, dword [ebp - 0x124]
mov eax, esi
call fcn.0040541c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b7517
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x4c018c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov ecx, dword [edi + 0x170]
mov edx, ebx
mov eax, edi
call fcn.004c03c8
mov esi, eax
mov dword [edi + 0x170], esi
and esi, 0xff
add dword [edi + 0x174], esi
imul esi, dword [edi + 0x174], 0x8088405
inc esi
mov dword [edi + 0x174], esi
mov edx, esi
shr edx, 0x18
mov ecx, dword [edi + 0x178]
mov eax, edi
call fcn.004c03c8
mov dword [edi + 0x178], eax
pop edi
pop esi
pop ebx
ret

Function at 0x4c0200
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x4c0226
inc esi
mov eax, edi
call fcn.004c01e4
xor byte [ebx], al
movzx edx, byte [ebx]
mov eax, edi
call fcn.004c018c
inc ebx
dec esi
jne 0x4c020f
pop edi
pop esi
pop ebx
ret
Function at 0x4c02bc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00405848
xor eax, eax
push ebp
push 0x4c0332
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.004c022c
mov dword [ebp - 8], 0xc
lea esi, [ebp - 0x14]
mov eax, edi
call fcn.004c01e4
mov ebx, eax
xor bl, byte [esi]
mov edx, ebx
mov eax, edi
call fcn.004c018c
mov byte [esi], bl
inc esi
dec dword [ebp - 8]
jne 0x4c02fc
movzx ebx, byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c0339
lea eax, [ebp - 4]
call fcn.004053c8
ret
Function at 0x4c0fcc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4c11b2
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
jle 0x4c116e
mov eax, dword [ebp - 4]
call fcn.004c29a0
cmp ebx, eax
jge 0x4c116e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x118]
mov edx, ebx
call fcn.004b29d4
mov edx, dword [0x4b364c]
call fcn.00404534
mov esi, eax
mov eax, esi
call fcn.004b4510
test al, al
je 0x4c1164
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov edi, dword [esi + 0x44]
test edi, edi
jne 0x4c1158
xor eax, eax
push ebp
push 0x4c1151
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004c1584
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
call fcn.004204fc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push dword [esi + 0x34]
push dword [esi + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
lea edx, [ebp - 0x46]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, 0x2e
mov esi, dword [eax]
call dword [esi + 0xc]
movzx eax, word [ebp - 0x2a]
movzx edx, word [ebp - 0x28]
add eax, edx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x18]
movzx esi, word [ebp - 0x26]
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.00405ae8
mov eax, dword [ebp - 8]
call fcn.004058b8
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, esi
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
movzx eax, byte [eax + 0x28]
mov byte [ebp - 9], al
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004c1348
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
movzx edx, byte [ebp - 9]
mov byte [eax + 0x28], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c119c
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
jne 0x4c1150
mov eax, dword [ebp - 4]
call fcn.004c1608
ret
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.0040b858
jmp 0x4c119c
mov eax, dword [ebp - 8]
call fcn.004053c8
jmp 0x4c119c
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x4c], 0
lea eax, [ebp - 0x50]
push eax
push 0
lea edx, [ebp - 0x54]
mov eax, 0xb3
call fcn.0040ac20
mov ecx, dword [ebp - 0x54]
mov dl, 1
mov eax, dword [0x41a2ec]
call fcn.0040f05c
call fcn.00404cfc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c11b9
lea eax, [ebp - 0x54]
call fcn.004053c8
ret
Function at 0x4c9978
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4c99a6
mov eax, ebx
call fcn.004ca42c
cmp dword [ebx + 0x40], 0
je 0x4c999f
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4c9a17
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4c9a09
cmp dword [ebx + 8], 0
je 0x4c99c8
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4c99da
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4c9a09
cmp dword [ebx + 8], 0
je 0x4c99bb
cmp eax, 3
je 0x4c99ed
dec eax
jne 0x4c99bb
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4c99bb
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4c99bb
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4c9a35
cmp dword [ebx + 0x14], 0xcc
je 0x4c9a35
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004c9a40
pop ebx
ret

Function at 0x4ff8e4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x4ff93e
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.004ff8d4
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.004fd1c4
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.004fccdc
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ff945
lea eax, [ebp - 4]
call fcn.004053c8
ret
Function at 0x508988
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
push ecx
mov ebx, 0x54680c
test edx, edx
jne 0x50899b
xor eax, eax
jmp 0x508ab0
mov dword [esp], 1
cmp byte [esp], 0
je 0x5089b8
push ecx
push edx
push eax
call fcn.00508ab4
add esp, 0xc
jmp 0x508ab0
push ecx
push edx
push eax
call fcn.00508d74
add esp, 0xc
jmp 0x508ab0
pop edx
pop esi
pop ebx
ret
Function at 0x50a620
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov esi, dword [ebx + 0x2c]
mov eax, dword [ebx + 0x3c]
sub eax, dword [ebx + 0x74]
sub eax, dword [ebx + 0x6c]
mov dword [ebp - 8], eax
jmp 0x50a65b
mov edx, dword [ebx + 0x2c]
sub edx, 0x106
add edx, esi
cmp edx, dword [ebx + 0x6c]
ja 0x50a6dc
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov edi, esi
add edx, edi
push edx
push eax
call fcn.00507ce0
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], edi
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [ebp - 4], ecx
cmp esi, dword [ebp - 4]
ja 0x50a6a9
mov cx, word [ebp - 4]
sub cx, si
jmp 0x50a6ab
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x50a692
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [ebp - 4], ecx
cmp esi, dword [ebp - 4]
ja 0x50a6d1
mov cx, word [ebp - 4]
sub cx, si
jmp 0x50a6d3
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x50a6ba
add dword [ebp - 8], esi
mov edi, dword [ebx]
cmp dword [edi + 4], 0
je 0x50a73e
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebx + 0x38]
add edx, dword [ebx + 0x6c]
add edx, dword [ebx + 0x74]
push edx
push edi
call fcn.0050a2ec
add esp, 0xc
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x50a729
mov ecx, dword [ebx + 0x38]
mov eax, dword [ebx + 0x6c]
movzx eax, byte [ecx + eax]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x50a73e
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x50a62f
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x510880
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebx
push 1
push 0
push 0
push 0
push 1
push 2
call sub.ws2_32.dll_WSASocketA
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x51089e
call fcn.0041086c
mov eax, ebx
pop ebx
ret

Function at 0x510964
Capabilities:
Initialize winsock library

Disassembly:
add esp, 0xfffffe70
push esp
push 0x202
call sub.ws2_32.dll_WSAStartup
test eax, eax
je 0x51097e
call fcn.0041086c
add esp, 0x190
ret

Function at 0x51136c
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret
Function at 0x512988
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00512a10
cmp dword [ebx + 8], 1
jne 0x5129ae
push 1
push 0
push 0
push 6
push 1
push 0x17
call sub.ws2_32.dll_WSASocketA
mov dword [ebx + 0xc], eax
jmp 0x5129c2
push 1
push 0
push 0
push 6
push 1
push 2
call sub.ws2_32.dll_WSASocketA
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x5129ce
cmp eax, 0xffffffff
jne 0x5129d3
call fcn.0041086c
push 0x56db54
call sub.kernel32.dll_InterlockedIncrement_1
xor eax, eax
mov dword [ebx + 4], eax
pop ebx
ret

Function at 0x512a34
Capabilities:
Resolve dns

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov eax, ebx
call fcn.00405858
push eax
call sub.ws2_32.dll_gethostbyname
mov ebx, eax
test ebx, ebx
jne 0x512a52
call fcn.0041086c
mov eax, dword [ebx + 0xc]
mov eax, dword [eax]
push dword [eax]
call sub.ws2_32.dll_inet_ntoa
mov edx, eax
mov eax, esi
call fcn.004055c0
pop esi
pop ebx
ret

Function at 0x512a6c
Capabilities:
Set socket configuration

Disassembly:
push ebx
push ecx
mov ebx, eax
cmp dl, 1
cmc
sbb eax, eax
mov dword [esp], eax
push 4
lea eax, [esp + 4]
push eax
push 1
push 6
mov eax, dword [ebx + 0xc]
push eax
call sub.ws2_32.dll_setsockopt
inc eax
setne al
pop edx
pop ebx
ret

Function at 0x512a9c
Capabilities:
Initialize winsock library

Disassembly:
add esp, 0xfffffe70
mov ecx, 0x56db60
mov dl, 1
xor eax, eax
call fcn.00512a94
test al, al
jne 0x512acf
push esp
push 0x101
call sub.ws2_32.dll_WSAStartup
test eax, eax
je 0x512acf
mov byte [0x56db60], 0
call fcn.0041086c
add esp, 0x190
ret

Function at 0x51986c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, edx
mov ebx, eax
call fcn.00510ba8
mov edi, eax
mov eax, dword [ebx + 0x5c]
mov esi, dword [eax + 0x14]
jmp 0x51989b
push 0xa
call sub.kernel32.dll_Sleep_2
call fcn.00510ba8
sub eax, edi
cmp ebp, eax
jb 0x5198a5
mov eax, dword [ebx + 0x5c]
mov esi, dword [eax + 0x14]
test esi, esi
jg 0x519883
cmp dword [ebx + 0x30], 0
jg 0x519883
mov eax, dword [ebx + 0x5c]
cmp dword [eax + 0x14], 0
sete al
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x519b8c
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, eax
xor eax, eax
mov dword [esp], eax
xor eax, eax
mov dword [edi + 0x94], eax
mov dword [edi + 0x90], edx
mov dword [edi + 0x8c], ecx
xor esi, esi
mov ebp, dword [edi + 0x98]
mov eax, dword [edi + 0x98]
test eax, eax
je 0x519bc7
cmp dword [eax + 0x68], 0
je 0x519bc7
mov esi, dword [eax + 0x68]
push 0
lea eax, [edi + 0x5c]
push eax
lea eax, [edi + 0x94]
push eax
lea eax, [esp + 0xc]
push eax
push 1
lea eax, [edi + 0x8c]
push eax
mov eax, dword [edi + 0x9c]
mov eax, dword [eax + 0xc4]
mov eax, dword [eax + 0xc]
push eax
call sub.ws2_32.dll_WSARecv
inc eax
jne 0x519c29
call sub.ws2_32.dll_WSAGetLastError
cmp eax, 0x3e5
sete bl
test bl, bl
jne 0x519c1c
mov ecx, eax
mov edx, dword [edi + 0x9c]
mov eax, ebp
call fcn.00518d1c
jmp 0x519c36
test esi, esi
je 0x519c36
mov eax, esi
call fcn.0051a7a0
jmp 0x519c36
mov bl, 1
test esi, esi
je 0x519c36
mov eax, esi
call fcn.0051a7a0
mov eax, ebx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5282ac
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x528335
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x56dbf4
push 0x202
call sub.wsock32.dll_WSAStartup_1
mov ebx, eax
test ebx, ebx
je 0x52831f
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.0040e7dc
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xb
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 0
mov eax, 0x52834c
mov dword [ebp - 8], eax
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x18]
push eax
push 2
mov ecx, dword [0x562ff4]
mov dl, 1
mov eax, dword [0x527aac]
call fcn.0040f118
call fcn.00404cfc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52833c
lea eax, [ebp - 0x1c]
call fcn.004053c8
ret

Function at 0x528908
Capabilities:
Set socket configuration

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, eax
xor esi, esi
xor edi, edi
movzx eax, byte [0x528964]
cmp al, byte [ebx + 0x28]
je 0x52892c
mov esi, 0x401
mov eax, ebx
call fcn.00528a60
mov edi, eax
movzx eax, byte [ebx + 0x28]
push eax
push esi
push edi
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_WSAAsyncSelect
movzx eax, byte [0x528964]
cmp al, byte [ebx + 0x28]
jne 0x52895c
xor eax, eax
mov dword [esp], eax
push esp
push 0x8004667e
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_ioctlsocket
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x5289f0
Capabilities:
Connect socket

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, ebx
call fcn.00528908
mov cl, 1
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call fcn.00404580
push 0x10
lea eax, [ebx + 0x18]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_connect
mov edx, eax
mov ecx, 0x528a58
mov eax, ebx
call fcn.005281f0
mov byte [ebx + 0x29], 0
test byte [ebx + 0x28], 0x10
jne 0x528a4a
cmp dword [ebx + 4], 0xffffffff
setne al
mov byte [ebx + 8], al
mov cl, 2
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call fcn.00404580
pop esi
pop ebx
ret

Function at 0x528a7c
Capabilities:
Resolve dns

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, edx
mov eax, ebx
call fcn.00405858
push eax
call sub.wsock32.dll_gethostbyname_1
mov ebx, eax
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 4
call fcn.00403b48
test ebx, ebx
je 0x528acb
mov eax, ebx
mov edx, dword [eax + 0xc]
mov edx, dword [edx]
movzx ecx, byte [edx]
mov byte [esp + 4], cl
movzx ecx, byte [edx + 1]
mov byte [esp + 5], cl
movzx ecx, byte [edx + 2]
mov byte [esp + 6], cl
movzx eax, byte [edx + 3]
mov byte [esp + 7], al
mov eax, dword [esp + 4]
mov dword [esp], eax
mov eax, dword [esp]
pop ecx
pop edx
pop ebx
ret