joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46e0d5
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0xe8
push ebx
push esi
mov esi, dword [ebp + 0x74]
push edi
push esi
call fcn.004b0250
pop ecx
push 0x40
mov ebx, eax
pop edi
cmp ebx, edi
jle 0x46e120
lea eax, [ebp + 4]
push eax
call fcn.0040890f
push ebx
lea eax, [ebp + 4]
push esi
push eax
call fcn.00418853
lea eax, [ebp + 4]
push eax
lea eax, [ebp + 0x5c]
push eax
call fcn.004188e3
add esp, 0x18
push 0x10
lea esi, [ebp + 0x5c]
pop ebx
push edi
lea eax, [ebp - 0x3c]
push 0
push eax
call fcn.004b01f0
push ebx
lea eax, [ebp - 0x3c]
push esi
push eax
call fcn.004af940
push edi
lea eax, [ebp - 0x7c]
push 0
push eax
call fcn.004b01f0
push ebx
lea eax, [ebp - 0x7c]
push esi
push eax
call fcn.004af940
add esp, 0x30
xor eax, eax
xor byte [ebp + eax - 0x3c], 0x36
xor byte [ebp + eax - 0x7c], 0x5c
inc eax
cmp eax, edi
jl 0x46e153
lea eax, [ebp + 4]
push eax
call fcn.0040890f
push edi
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp + 4]
push eax
call fcn.00418853
push dword [ebp + 0x78]
call fcn.004b0250
push eax
push dword [ebp + 0x78]
lea eax, [ebp + 4]
push eax
call fcn.00418853
lea eax, [ebp + 4]
push eax
lea eax, [ebp + 0x5c]
push eax
call fcn.004188e3
lea eax, [ebp + 4]
push eax
call fcn.0040890f
push edi
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 4]
push eax
call fcn.00418853
push 0x10
lea eax, [ebp + 0x5c]
push eax
lea eax, [ebp + 4]
push eax
call fcn.00418853
add esp, 0x44
lea eax, [ebp + 4]
push eax
lea eax, [ebp + 0x5c]
push eax
call fcn.004188e3
mov esi, dword [ebp + 0x7c]
pop ecx
pop ecx
xor ecx, ecx
movsx eax, byte [ebp + ecx + 0x5c]
mov edx, eax
sar edx, 4
mov dl, byte [edx + str.0123456789abcdef]
and eax, 0xf
mov byte [esi + ecx*2], dl
mov al, byte [eax + str.0123456789abcdef]
mov byte [esi + ecx*2 + 1], al
inc ecx
cmp ecx, 0x10
jl 0x46e1d8
and byte [esi + 0x20], 0
pop edi
pop esi
pop ebx
add ebp, 0x6c
leave
ret
Function at 0x46e805
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push ebx
push dword [ebp + 0x10]
xor esi, esi
push edi
push dword [ebp + 8]
call sub.WSOCK32.dll_recv
jmp 0x46e882
cmp eax, ebx
je 0x46e887
add esi, eax
mov eax, dword [ebp + 0x10]
cmp esi, eax
jge 0x46e8d7
lea ebx, [esi + edi]
and byte [ebx], 0
cmp esi, 5
jl 0x46e86f
push edi
call fcn.0046e7eb
test eax, eax
pop ecx
je 0x46e85d
cmp byte [esi + edi - 5], 0xd
jne 0x46e86f
cmp byte [esi + edi - 4], 0xa
jne 0x46e86f
cmp byte [esi + edi - 3], 0x2e
jne 0x46e86f
cmp byte [esi + edi - 2], 0xd
jne 0x46e86f
cmp byte [esi + edi - 1], 0xa
je 0x46e916
mov eax, dword [ebp + 0x10]
push 0
sub eax, esi
push eax
push ebx
push dword [ebp + 8]
call sub.WSOCK32.dll_recv
xor ebx, ebx
cmp eax, 0xffffffff
jne 0x46e821
cmp dword [ebp + 0x14], ebx
je 0x46e8d0
push ebx
push 0x100
lea eax, [ebp + 0x10]
push eax
mov dword [ebp + 0x10], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx eax, ax
push eax
call sub.WSOCK32.dll_WSAGetLastError
push eax
push ebx
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
cmp dword [ebp + 0x10], ebx
je 0x46e8d0
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push ebx
call dword [ebp + 0x14]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
and byte [edi + eax - 1], 0
push edi
call fcn.0046e7eb
cmp eax, ebx
pop ecx
lea eax, [esi + edi]
je 0x46e90a
cmp byte [eax - 5], 0xd
jne 0x46e8d0
cmp byte [eax - 4], 0xa
jne 0x46e8d0
cmp byte [eax - 3], 0x2e
jne 0x46e8d0
cmp byte [eax - 2], 0xd
jne 0x46e8d0
cmp byte [eax - 1], 0xa
je 0x46e916
jmp 0x46e8d0
cmp byte [eax - 2], 0xd
jne 0x46e8d0
cmp byte [eax - 1], 0xd
jne 0x46e8d0
xor eax, eax
inc eax
jmp 0x46e8d2

Function at 0x46e91b
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push ebx
push dword [ebp + 0x10]
xor esi, esi
push edi
jmp 0x46e95a
cmp eax, ebx
je 0x46e967
add esi, eax
cmp esi, dword [ebp + 0x10]
lea eax, [esi + edi]
mov byte [eax], bl
jge 0x46e9b7
cmp esi, 2
jl 0x46e952
cmp byte [esi + edi - 2], 0xd
jne 0x46e952
cmp byte [esi + edi - 1], 0xa
je 0x46e9c6
mov ecx, dword [ebp + 0x10]
push ebx
sub ecx, esi
push ecx
push eax
push dword [ebp + 8]
call sub.WSOCK32.dll_recv
cmp eax, 0xffffffff
jne 0x46e92f
cmp dword [ebp + 0x14], ebx
je 0x46e9b0
push ebx
push 0x100
lea eax, [ebp + 0x10]
push eax
mov dword [ebp + 0x10], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx eax, ax
push eax
call sub.WSOCK32.dll_WSAGetLastError
push eax
push ebx
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
cmp dword [ebp + 0x10], ebx
je 0x46e9b0
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push ebx
call dword [ebp + 0x14]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
lea eax, [esi + edi]
cmp byte [eax - 2], 0xd
jne 0x46e9b0
cmp byte [eax - 1], 0xa
jne 0x46e9b0
xor eax, eax
inc eax
jmp 0x46e9b2
Function at 0x46f13c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 0x10], esi
jbe 0x46f169
mov eax, dword [ebp + 0x10]
push 0
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push eax
push dword [ebp + 8]
call sub.WSOCK32.dll_send
cmp eax, 0xffffffff
je 0x46f16f
add esi, eax
cmp esi, dword [ebp + 0x10]
jb 0x46f147
xor eax, eax
inc eax
pop esi
pop ebp
ret
xor eax, eax
jmp 0x46f16c

Function at 0x46f173
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 0x10], esi
jbe 0x46f1a4
mov eax, dword [ebp + 0x10]
push 0
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push eax
push dword [ebp + 8]
call sub.WSOCK32.dll_recv
cmp eax, 0xffffffff
je 0x46f1aa
test eax, eax
je 0x46f1aa
add esi, eax
cmp esi, dword [ebp + 0x10]
jb 0x46f17e
xor eax, eax
inc eax
pop esi
pop ebp
ret
xor eax, eax
jmp 0x46f1a7

Function at 0x46f1ae
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and dword [ebp - 0x10], 0
push edi
push 6
push 1
push 2
mov dword [ebp - 8], 0x2710
call sub.WSOCK32.dll_socket
mov edi, eax
cmp edi, 0xffffffff
jne 0x46f1d9
xor eax, eax
jmp 0x46f30e
push esi
push 4
lea eax, [ebp - 8]
push eax
push 0x1005
mov esi, 0xffff
push esi
push edi
call sub.WSOCK32.dll_setsockopt
push 4
lea eax, [ebp - 8]
push eax
push 0x1006
push esi
push edi
call sub.WSOCK32.dll_setsockopt
push 0x35
call sub.WSOCK32.dll_htons
push dword [ebp + 0xc]
mov word [ebp - 0x1e], ax
mov word [ebp - 0x20], 2
call sub.WSOCK32.dll_gethostbyname
test eax, eax
je 0x46f238
movsx ecx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
push ecx
push dword [eax]
lea eax, [ebp - 0x1c]
push eax
call fcn.004af940
add esp, 0xc
jmp 0x46f24c
push dword [ebp + 0xc]
call sub.WSOCK32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [ebp - 0x1c], eax
je 0x46f304
push ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call fcn.0046ef2a
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
je 0x46f303
push 0x10
lea eax, [ebp - 0x20]
push eax
push edi
call sub.WSOCK32.dll_connect
cmp eax, 0xffffffff
je 0x46f2fc
push dword [ebp - 0xc]
call sub.WSOCK32.dll_htons
push 2
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
call fcn.0046f13c
add esp, 0xc
test eax, eax
je 0x46f2fc
movzx eax, word [ebp - 0xc]
push eax
push ebx
push edi
call fcn.0046f13c
add esp, 0xc
test eax, eax
je 0x46f2fc
push 2
lea eax, [ebp - 4]
push eax
push edi
call fcn.0046f173
add esp, 0xc
test eax, eax
je 0x46f2fc
push dword [ebp - 4]
call sub.WSOCK32.dll_ntohs
push ebx
mov esi, eax
call fcn.004af839
movzx esi, si
push esi
call fcn.004af827
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
je 0x46f303
push esi
push ebx
push edi
call fcn.0046f173
add esp, 0xc
test eax, eax
je 0x46f2fc
push dword [ebp + 0x10]
push ebx
call fcn.0046f073
pop ecx
pop ecx
mov dword [ebp - 0x10], eax
push ebx
call fcn.004af839
pop ecx
pop ebx
push edi
call sub.WSOCK32.dll_closesocket
mov eax, dword [ebp - 0x10]
pop esi
pop edi
leave
ret
Function at 0x472563
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
mov eax, dword [ebp + 0x18]
push ebx
xor ebx, ebx
push str.ICMP.DLL
mov dword [eax], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x47258d
xor eax, eax
jmp 0x47263e
push esi
push 0x10
lea eax, [ebp - 0x20]
push ebx
push eax
call fcn.004b01f0
add esp, 0xc
push dword [ebp + 8]
call sub.WSOCK32.dll_gethostbyname
cmp eax, ebx
je 0x472641
movsx ecx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
push ecx
push dword [eax]
lea eax, [ebp - 0x1c]
push eax
call fcn.004af940
add esp, 0xc
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
push str.IcmpCreateFile
push dword [ebp - 8]
call esi
push str.IcmpCloseHandle
push dword [ebp - 8]
mov edi, eax
call esi
push str.IcmpSendEcho
push dword [ebp - 8]
mov dword [ebp - 4], eax
call esi
cmp edi, ebx
mov dword [ebp - 0x10], eax
je 0x47262f
cmp dword [ebp - 4], ebx
je 0x47262f
cmp eax, ebx
je 0x47262f
call edi
cmp eax, 0xffffffff
mov dword [ebp - 0xc], eax
je 0x47262f
push 0x20
lea eax, [ebp - 0x40]
push 0xffffffffffffffaa
push eax
call fcn.004b01f0
add esp, 0xc
push 0x3c
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
cmp esi, ebx
jne 0x472686
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
pop edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
pop esi
pop ebx
leave
ret
push dword [ebp + 8]
call sub.WSOCK32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [ebp - 0x1c], eax
jne 0x4725c3
push dword [ebp + 8]
lea eax, [ebp - 0x140]
push str.Unkown_host__s
push eax
call fcn.004b1a3d
add esp, 0xc
cmp dword [ebp + 0x10], ebx
je 0x472681
push dword [ebp + 0x14]
lea eax, [ebp - 0x140]
push eax
push ebx
push 2
call dword [ebp + 0x10]
xor esi, esi
inc esi
jmp 0x472632
mov eax, dword [ebp + 0xc]
cmp eax, ebx
jle 0x472734
mov dword [ebp - 4], eax
push 0x3c
push ebx
push esi
call fcn.004b01f0
add esp, 0xc
push 0x1388
push 0x3c
push esi
push ebx
lea eax, [ebp - 0x40]
mov dword [esi + 0x10], eax
push 0x20
lea eax, [ebp - 0x40]
push eax
mov word [esi + 0xc], 0x20
push dword [ebp - 0x1c]
push dword [ebp - 0xc]
call dword [ebp - 0x10]
test eax, eax
je 0x472718
movzx ecx, byte [esi + 0x14]
movzx eax, word [esi + 2]
mov edi, dword [esi + 8]
push ecx
push edi
movzx ecx, ah
push 0x20
push ecx
movzx ecx, byte [esi + 1]
movzx eax, al
push ecx
push eax
movzx eax, byte [esi]
push eax
lea eax, [ebp - 0x140]
push str.Reply_from__d._d._d._d:_bytes_d_time_dms_TTL_d
push eax
call fcn.004b1a3d
add esp, 0x24
cmp dword [ebp + 0x10], ebx
je 0x472711
push dword [ebp + 0x14]
lea eax, [ebp - 0x140]
push eax
push edi
push 4
call dword [ebp + 0x10]
mov eax, dword [ebp + 0x18]
inc dword [eax]
jmp 0x47272b
cmp dword [ebp + 0x10], ebx
je 0x47272b
push dword [ebp + 0x14]
push str.Destination_host_unreachable
push ebx
push 1
call dword [ebp + 0x10]
dec dword [ebp - 4]
jne 0x472694
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
inc esi
jmp 0x472631
Function at 0x47285c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00472795
add esp, 0xc
push 0x10
push dword [ebp + 0x18]
push 0
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.WSOCK32.dll_sendto
test eax, eax
jge 0x47289c
cmp dword [ebp + 0x1c], 0
je 0x47289c
push dword [ebp + 0x20]
push str.Destination_host_unreachable
push 0
push 1
call dword [ebp + 0x1c]
pop ebp
ret

Function at 0x47289e
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x14]
push 0
push 0x400
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.WSOCK32.dll_recvfrom
test eax, eax
jl 0x4728e7
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push dword [ebp + 0xc]
call fcn.004727e5
add esp, 0x18
test eax, eax
je 0x4728a9
xor eax, eax
inc eax
leave
ret
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x274c
jne 0x47290b
cmp dword [ebp + 0x18], 0
je 0x47290b
push dword [ebp + 0x1c]
push str.Request_timed_out
push 0x3e8
push 0
call dword [ebp + 0x18]
xor eax, eax
leave
ret
Function at 0x47290f
Capabilities:
Create raw socket
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x930
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x14]
xor ebx, ebx
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call fcn.00472563
add esp, 0x14
test eax, eax
jne 0x472a7d
push str.icmp
mov dword [ebp - 0xc], 0x3e8
call sub.WSOCK32.dll_getprotobyname
cmp eax, ebx
jne 0x47296b
cmp edi, ebx
je 0x472abf
push dword [ebp + 0x14]
push str.getprotobyname_error
jmp 0x472aba
movsx eax, word [eax + 8]
push eax
push 3
push 2
call sub.WSOCK32.dll_socket
cmp eax, ebx
mov dword [ebp - 8], eax
jge 0x472995
cmp edi, ebx
je 0x472abf
push dword [ebp + 0x14]
push str.socket_error
jmp 0x472aba
push 4
lea ecx, [ebp - 0xc]
push ecx
push 0x1006
mov esi, 0xffff
push esi
push eax
call sub.WSOCK32.dll_setsockopt
push 4
lea eax, [ebp - 0xc]
push eax
push 0x1005
push esi
push dword [ebp - 8]
call sub.WSOCK32.dll_setsockopt
push 0x10
lea eax, [ebp - 0x20]
push ebx
push eax
call fcn.004b01f0
mov esi, dword [ebp + 8]
add esp, 0xc
push esi
mov word [ebp - 0x20], 2
call sub.WSOCK32.dll_gethostbyname
cmp eax, ebx
je 0x472a85
movsx ecx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
push ecx
push dword [eax]
lea eax, [ebp - 0x1c]
push eax
call fcn.004af940
add esp, 0xc
call sub.KERNEL32.dll_GetCurrentProcessId
push 0x20
push dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
call sub.WSOCK32.dll_inet_ntoa
push eax
push esi
lea eax, [ebp - 0x130]
push str.Pinging__s___s_:_with__d_bytes_of_data:_n_n
push eax
call fcn.004b1a3d
add esp, 0x14
cmp edi, ebx
je 0x472a37
push dword [ebp + 0x14]
lea eax, [ebp - 0x130]
push eax
push ebx
push 3
call edi
cmp dword [ebp + 0xc], ebx
jle 0x472a7d
push dword [ebp + 0x14]
lea eax, [ebp - 0x20]
push edi
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x530]
push ebx
push eax
push dword [ebp - 8]
call fcn.0047285c
push dword [ebp + 0x14]
lea eax, [ebp - 0x30]
push edi
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x930]
push eax
push dword [ebp - 8]
call fcn.0047289e
add dword [ebp - 4], eax
add esp, 0x34
inc ebx
cmp ebx, dword [ebp + 0xc]
jl 0x472a3c
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
push esi
call sub.WSOCK32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [ebp - 0x1c], eax
jne 0x4729fc
push esi
lea eax, [ebp - 0x130]
push str.Unkown_host__s
push eax
call fcn.004b1a3d
add esp, 0xc
cmp edi, ebx
je 0x472abf
push dword [ebp + 0x14]
lea eax, [ebp - 0x130]
push eax
push ebx
push 2
call edi
xor eax, eax
jmp 0x472a80

Function at 0x472c40
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
mov esi, 0x120
cmp dword [esp + 0x10], esi
jae 0x472c64
push eax
call fcn.00473679
push 2
call fcn.00473668
pop ecx
pop ecx
mov dword [edi], eax
push esi
push 0
push eax
call fcn.004b01f0
add esp, 0xc
pop edi
pop esi
ret
Function at 0x47d0a5
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
push dword [ebp + 0x18]
push dword [ebp + 0x1c]
push 1
call fcn.00473544
mov esi, eax
xor ebx, ebx
add esp, 0xc
cmp esi, ebx
mov dword [ebp - 8], esi
je 0x47d0f9
push esi
call fcn.00473086
push ebx
push esi
call fcn.004b52f8
add esp, 0xc
test eax, eax
je 0x47d100
mov edi, dword [ebp - 8]
lea esi, [edi + 0xac]
push dword [esi]
push edi
call fcn.004736de
push edi
mov dword [esi], ebx
call fcn.00473679
add esp, 0xc
xor eax, eax
jmp 0x47d202
push dword [ebp + 0x20]
mov esi, dword [ebp - 8]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push esi
call fcn.00473645
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.00473247
mov ecx, dword [ebp + 8]
mov edi, 0x52cac0
mov dword [ebp - 4], ecx
add esp, 0x20
sub dword [ebp - 4], edi
mov eax, edi
mov edx, dword [ebp - 4]
mov dl, byte [edx + eax]
cmp dl, byte [eax]
je 0x47d142
or byte [esi + 0x6e], 2
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x47d134
test byte [esi + 0x6e], 2
je 0x47d1c0
cmp ecx, ebx
je 0x47d196
mov al, byte [ecx]
cmp al, byte [0x52cac0]
jne 0x47d176
cmp al, 0x31
jne 0x47d16c
mov dl, byte [ecx + 2]
cmp dl, byte [0x52cac2]
jne 0x47d176
cmp al, 0x30
jne 0x47d1c0
cmp byte [ecx + 2], 0x39
jge 0x47d1c0
cmp ecx, ebx
je 0x47d196
push ecx
lea eax, [ebp - 0x58]
push str.Application_was_compiled_with_png.h_from_libpng__.20s
push eax
call fcn.004b1a3d
lea eax, [ebp - 0x58]
push eax
push esi
call fcn.004732ed
add esp, 0x14
push edi
lea eax, [ebp - 0x58]
push str.Application__is__running_with_png.c_from_libpng__.20s
push eax
call fcn.004b1a3d
lea eax, [ebp - 0x58]
push eax
push esi
call fcn.004732ed
push str.Incompatible_libpng_version_in_application_and_library
push esi
mov dword [esi + 0x6c], ebx
call fcn.00473261
add esp, 0x1c
mov eax, 0x2000
push eax
push esi
mov dword [esi + 0xb0], eax
call fcn.0047368a
push ebx
push ebx
push ebx
push esi
mov dword [esi + 0xac], eax
call fcn.0047c4a4
push ebx
push ebx
push 1
push ebx
push esi
call fcn.0047ce7e
push ebx
push esi
call fcn.004b52f8
add esp, 0x34
test eax, eax
je 0x47d1ff
jmp 0x4b550b
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x48204c
Capabilities:
Query or enumerate registry value
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 4]
push eax
xor ebx, ebx
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
test eax, eax
jne 0x4820f8
cmp dword [ebp - 4], 1
jbe 0x4820f8
cmp dword [ebp - 8], 1
jne 0x4820f8
push edi
push dword [ebp - 4]
call fcn.004af827
pop ecx
mov edi, eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x10], edi
push dword [ebp + 8]
call esi
test eax, eax
jne 0x4820ea
cmp edi, ebx
je 0x4820e7
mov esi, dword [ebp + 0x10]
mov ebx, str.____t
push ebx
push edi
call fcn.004b5e40
add edi, eax
push ebx
push edi
mov dword [ebp - 0xc], edi
call fcn.004b5e00
mov edi, eax
add esp, 0x10
test edi, edi
je 0x4820d3
and byte [edi], 0
inc edi
push dword [ebp - 0xc]
call sub.WSOCK32.dll_inet_addr
mov ecx, dword [esi]
mov dword [esi + ecx*4 + 4], eax
inc dword [esi]
test edi, edi
jne 0x4820b3
xor ebx, ebx
inc ebx
push dword [ebp - 0x10]
call fcn.004af839
pop ecx
mov eax, ebx
pop edi
jmp 0x4820fa
xor eax, eax
pop esi
pop ebx
leave
ret
Function at 0x48216e
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
and dword [ebp - 0x18], 0
push 0x44
push 1
call fcn.004b0d51
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 4], eax
jne 0x48218f
leave
ret
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push esi
push edi
lea eax, [ebp - 8]
push eax
push str.SYSTEMCurrentControlSetServicesTcpipparametersTransient
mov edi, 0x80000002
push edi
call ebx
test eax, eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x4821cb
push dword [ebp - 4]
push str.NameServer
push dword [ebp - 8]
call fcn.0048204c
add esp, 0xc
push dword [ebp - 8]
call esi
lea eax, [ebp - 8]
push eax
push str.SYSTEMCurrentControlSetServicesTcpipparameters
push edi
call ebx
test eax, eax
push dword [ebp - 4]
je 0x4821eb
call fcn.004af839
pop ecx
xor eax, eax
jmp 0x4822df
push str.NameServer
push dword [ebp - 8]
call fcn.0048204c
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
push str.Interfaces
push dword [ebp - 8]
call ebx
test eax, eax
je 0x482215
push dword [ebp - 8]
jmp 0x4822da
xor edi, edi
lea eax, [ebp - 0x2c]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x18]
push eax
push edi
push edi
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
cmp dword [ebp - 0x18], edi
mov dword [ebp - 0xc], edi
jle 0x4822d2
mov dword [ebp - 0x20], 8
mov dword [ebp - 0x14], 0x44
lea eax, [ebp - 0x2c]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x134]
push eax
push dword [ebp - 0xc]
mov dword [ebp - 0x1c], edi
push dword [ebp - 0x10]
mov dword [ebp - 0x24], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x4822c3
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x134]
push eax
push dword [ebp - 0x10]
call ebx
test eax, eax
jne 0x4822c3
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
cmp ecx, dword [ebp - 0x20]
jl 0x4822ab
add dword [ebp - 0x14], 0x20
push dword [ebp - 0x14]
add dword [ebp - 0x20], 8
push eax
call fcn.004b2042
pop ecx
pop ecx
mov dword [ebp - 4], eax
push dword [ebp - 4]
push str.NameServer
push dword [ebp - 0x1c]
call fcn.0048204c
add esp, 0xc
push dword [ebp - 0x1c]
call esi
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x18]
jl 0x48224b
push dword [ebp - 8]
call esi
push dword [ebp - 0x10]
call esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x498ed0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax], 0x9ac6cdd7
jne 0x498f10
xor ecx, ecx
mov cx, word [eax]
push esi
push 9
lea edx, [eax + 2]
pop esi
mov dword [ebp + 8], ecx
xor cx, word [edx]
inc edx
inc edx
dec esi
jne 0x498eed
cmp cx, word [eax + 0x14]
pop esi
jne 0x498f10
mov ax, word [eax + 0xe]
test ax, ax
jbe 0x498f10
cmp ax, 0x9ec
ja 0x498f10
xor eax, eax
inc eax
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x49c917
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ecx, ecx
push esi
xor eax, eax
cmp dword [ebp + 0x10], ecx
push edi
jbe 0x49c944
mov esi, dword [ebp + 0xc]
movzx esi, byte [ecx + esi]
mov edx, eax
shr edx, 9
xor edx, eax
shr edx, 7
xor edx, esi
shl eax, 5
xor eax, edx
inc ecx
cmp ecx, dword [ebp + 0x10]
jb 0x49c926
mov esi, dword [ebp + 8]
and eax, 0xff
lea ebx, [esi + eax*4 + 0x2c]
mov edi, dword [ebx]
jmp 0x49c96b
push dword [ebp + 0xc]
push dword [edi + 4]
call fcn.004b2330
test eax, eax
pop ecx
pop ecx
je 0x49c9fb
mov edi, dword [edi]
test edi, edi
jne 0x49c954
push 0xc
push esi
call fcn.00418b3a
push dword [ebp + 0xc]
mov edi, eax
push esi
call fcn.00418c12
mov dword [edi + 4], eax
mov eax, dword [ebx]
mov dword [edi], eax
mov dword [ebx], edi
mov eax, dword [esi + 0x434]
add esp, 0x10
cmp dword [esi + 0x430], eax
jb 0x49c9c2
add eax, 0x400
shl eax, 4
push eax
lea ebx, [esi + 0x42c]
push dword [ebx]
push esi
call fcn.00418bb1
add esp, 0xc
add dword [esi + 0x434], 0x400
mov dword [ebx], eax
mov eax, dword [esi + 0x430]
mov ecx, dword [esi + 0x42c]
shl eax, 4
and dword [eax + ecx], 0
mov eax, dword [esi + 0x430]
mov dword [edi + 8], eax
inc dword [esi + 0x430]
mov ecx, dword [edi + 8]
mov esi, dword [esi + 0x42c]
mov eax, edi
cdq
shl ecx, 4
mov dword [ecx + esi + 8], eax
mov dword [ecx + esi + 0xc], edx
mov eax, dword [edi + 8]
pop edi
pop esi
pop ebx
pop ebp
ret