joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4aa560
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x18
mov eax, dword [0x569434]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
lea eax, [esp + 0xc]
push edi
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x14], 0x10
mov ebp, dword [esi + 0x16c]
or edi, 0xffffffff
mov ebx, dword [esi]
push eax
push ebp
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x4aa5b9
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x10
push eax
lea eax, [esp + 0x18]
push eax
push ebp
call dword [sym.imp.WS2_32.dll_accept]
mov edi, eax
push ebp
push esi
call fcn.0049a5b0
add esp, 8
cmp edi, 0xffffffff
jne 0x4aa5ee
push str.Error_accept__ing_server_connect
push ebx
call fcn.00499d00
add esp, 8
mov eax, 0x1e
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.004db7a8
add esp, 0x18
ret
push str.Connection_accepted_from_server_n
push ebx
call fcn.00499dd0
push 1
mov byte [esi + 0x293], 0
push edi
mov dword [esi + 0x16c], edi
call fcn.004ba480
mov byte [esi + 0x179], 1
add esp, 0x10
mov eax, dword [ebx + 0x1d8]
test eax, eax
je 0x4aa655
push 1
push edi
push dword [ebx + 0x1dc]
call eax
add esp, 0xc
test eax, eax
je 0x4aa655
push esi
call fcn.004aaad0
add esp, 4
mov eax, 0x2a
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.004db7a8
add esp, 0x18
ret
mov ecx, dword [esp + 0x24]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004db7a8
add esp, 0x18
ret
Function at 0x4af130
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x569434]
xor eax, esp
mov dword [esp + 0x190], eax
push esi
mov esi, dword [esp + 0x19c]
lea eax, [esp + 4]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x4af16e
push eax
push str.WSAStartup_failed___d_
push esi
call fcn.00499d00
add esp, 0xc
jmp 0x4af1a9
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [esp + 4]
cmp al, 2
jne 0x4af19b
shr eax, 8
test al, al
jne 0x4af19b
xor eax, eax
pop esi
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.004db7a8
add esp, 0x194
ret
push str.insufficient_winsock_version_to_support_telnet
push esi
call fcn.00499d00
add esp, 8
mov ecx, dword [esp + 0x194]
mov eax, 2
pop esi
xor ecx, esp
call fcn.004db7a8
add esp, 0x194
ret

Function at 0x4afa50
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
push edi
push 0
mov byte [esp + 0x16], al
lea eax, [esp + 0x14]
mov edi, dword [esi]
push 3
push eax
push dword [esi + 0x168]
mov byte [esp + 0x20], 0xff
mov byte [esp + 0x21], bl
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x4afa9c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push edi
call fcn.00499d00
add esp, 0xc
push dword [esp + 0x18]
push ebx
push str.SENT
push dword [esi]
call fcn.004af350
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x4afb80
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x14
cmp dword [esp + 0x1c], 0x1f
mov eax, dword [esp + 0x18]
push ebx
mov eax, dword [eax]
mov dword [esp + 4], eax
mov ebx, dword [eax + 0x154]
jne 0x4afcd9
push ebp
push edi
lea ebp, [ebx + 0x1cb0]
lea edi, [ebx + 0x1eb0]
mov dword [edi], ebp
cmp ebp, edi
jae 0x4afbb9
mov byte [ebp], 0xff
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x4afbc4
mov byte [eax], 0xfa
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x4afbcf
mov byte [eax], 0x1f
inc dword [edi]
movzx eax, word [ebx + 0x1ca8]
push esi
mov esi, dword [sym.imp.WS2_32.dll_htons]
push eax
call esi
mov word [esp + 0x14], ax
movzx eax, word [ebx + 0x1caa]
push eax
call esi
mov ecx, dword [edi]
mov word [esp + 0x1c], ax
cmp ecx, edi
jae 0x4afc02
mov al, byte [esp + 0x14]
mov byte [ecx], al
inc dword [edi]
mov ecx, dword [edi]
cmp ecx, edi
jae 0x4afc10
mov al, byte [esp + 0x15]
mov byte [ecx], al
inc dword [edi]
mov ecx, dword [edi]
cmp ecx, edi
jae 0x4afc1e
mov al, byte [esp + 0x1c]
mov byte [ecx], al
inc dword [edi]
mov ecx, dword [edi]
cmp ecx, edi
jae 0x4afc2c
mov al, byte [esp + 0x1d]
mov byte [ecx], al
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x4afc37
mov byte [eax], 0xff
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x4afc42
mov byte [eax], 0xf0
inc dword [edi]
mov eax, dword [edi]
mov esi, dword [esp + 0x10]
mov dword [ebx + 0x1eb4], eax
sub eax, ebp
sub eax, 2
mov dword [edi], ebp
push eax
lea eax, [ebx + 0x1cb2]
push eax
push 0x3e
push esi
call fcn.004af460
mov edi, dword [esp + 0x38]
add esp, 0x10
push 0
push 3
push ebp
push dword [edi + 0x168]
call dword [sym.imp.WS2_32.dll_send]
mov ebp, dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jns 0x4afc98
call ebp
push eax
push str.Sending_data_failed___d_
push esi
call fcn.00499d00
add esp, 0xc
push 4
lea eax, [ebx + 0x1cb3]
push eax
push edi
call fcn.004afac0
add esp, 0xc
lea eax, [ebx + 0x1cb7]
push 0
push 2
push eax
push dword [edi + 0x168]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x4afcd6
call ebp
push eax
push str.Sending_data_failed___d_
push esi
call fcn.00499d00
add esp, 0xc
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x4b0be0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x88
mov eax, dword [0x569434]
xor eax, esp
mov dword [esp + 0x84], eax
push ebx
push ebp
mov ebp, dword [esp + 0x94]
lea eax, [esp + 8]
push esi
push edi
push eax
mov esi, dword [ebp + 0x4e8]
lea eax, [esp + 0x18]
mov edi, dword [ebp]
push eax
mov dword [esp + 0x18], 0x80
mov eax, dword [esi + 0x154]
push 0
add eax, 4
push eax
push dword [esi + 0x15c]
push dword [esi + 0x14]
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [esi + 0x148], 0
mov dword [esi + 0x14c], eax
jne 0x4b0c66
push dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
lea eax, [esi + 0xc8]
push eax
call fcn.004892e0
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov dword [esi + 0x148], eax
mov edx, dword [esi + 0x14c]
cmp edx, 4
jge 0x4b0ca1
push str.Received_too_short_packet
push edi
call fcn.00499d00
add esp, 8
mov dword [esi + 0xc], 7
xor eax, eax
mov ecx, dword [esp + 0x94]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004db7a8
add esp, 0x88
ret
mov eax, dword [esi + 0x15c]
movzx ecx, byte [eax + 1]
movzx eax, byte [eax]
shl eax, 8
or ecx, eax
mov dword [esi + 0xc], ecx
add ecx, 0xfffffffd
cmp ecx, 3
ja case.default.0x4b0cc2
jmp dword [ecx*4 + 0x4b0dcc]
cmp edx, 4
jle case.0x4b0cc2.4
mov eax, dword [esi + 0x15c]
movzx ecx, byte [eax + 2]
movzx eax, byte [eax + 3]
shl ecx, 8
or ecx, eax
movzx eax, word [esi + 0x40]
inc eax
movzx eax, ax
cmp eax, ecx
jne case.0x4b0cc2.4
lea eax, [edx - 4]
push eax
mov eax, dword [esi + 0x15c]
add eax, 4
push eax
push 1
push ebp
call fcn.00499be0
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x4b0d26
push 5
push esi
call fcn.004b1520
add esp, 8
mov eax, ebx
jmp 0x4b0c88
mov eax, dword [esi + 0x14c]
sub eax, 4
cdq
add dword [edi + 0x70], eax
adc dword [edi + 0x74], edx
push dword [edi + 0x74]
push dword [edi + 0x70]
push edi
call fcn.004a3d90
jmp 0x4b0da1
mov eax, dword [esi + 0x15c]
movzx ecx, byte [eax + 2]
movzx eax, byte [eax + 3]
shl ecx, 8
or ecx, eax
mov eax, dword [esi + 0x15c]
add eax, 4
mov dword [esi + 8], ecx
push eax
push 0x535180
push edi
call fcn.00499dd0
jmp 0x4b0da1
lea eax, [edx - 2]
push eax
mov eax, dword [esi + 0x15c]
add eax, 2
push eax
push esi
call fcn.004b0970
add esp, 0xc
test eax, eax
je case.0x4b0cc2.4
jmp 0x4b0c88
push str.Internal_error:_Unexpected_packet
push 0x535cf0
push edi
call fcn.00499d00
add esp, 0xc
push ebp
call fcn.004a4000
add esp, 4
test eax, eax
je 0x4b0c86
push 5
push esi
call fcn.004b1520
add esp, 8
mov eax, 0x2a
jmp 0x4b0c88
Function at 0x4b7fa0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x569434]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call fcn.00507c87
add esp, 4
mov byte [esp], 0
test eax, eax
je 0x4b8005
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [esp], 0
je 0x4b8005
lea eax, [esp]
push eax
call dword [0x56936c]
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004db7a8
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor eax, eax
xor ecx, esp
call fcn.004db7a8
add esp, 0x108
ret
Function at 0x4bbb00
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov eax, dword [esi]
cmp dword [eax + 4], 2
jne 0x4bbb2b
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x4bbb1a
pop edi
xor eax, eax
pop esi
ret
push dword [eax + 8]
push dword [esp + 0x18]
push 1
push dword [esp + 0x1c]
call ecx
jmp 0x4bbb60
cmp dword [esi + 8], 0
jne 0x4bbb4e
push 0x5560c4
push dword [eax + 8]
call fcn.004f91ad
add esp, 8
mov dword [esi + 8], eax
test eax, eax
jne 0x4bbb4e
pop edi
or eax, 0xffffffff
pop esi
ret
push dword [esi + 8]
push dword [esp + 0x18]
push 1
push dword [esp + 0x1c]
call fcn.004fcb5a
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x4bbb82
mov eax, dword [esi + 8]
test eax, eax
je 0x4bbb7c
push eax
call fcn.004f9281
add esp, 4
mov dword [esi + 8], edi
mov eax, dword [esi]
mov eax, dword [eax]
mov dword [esi], eax
mov eax, edi
pop edi
pop esi
ret

Function at 0x4bfe70
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push esi
mov esi, ebx
push edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x4bfe80
sub esi, ecx
lea ebp, [esi + esi]
push ebp
call dword [0x569360]
mov edi, eax
add esp, 4
test edi, edi
jne 0x4bfea7
lea eax, [edi + 0x1b]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
xor ecx, ecx
test esi, esi
je 0x4bfec0
nop dword [eax]
mov al, byte [ecx + ebx]
mov byte [edi + ecx*2], al
mov byte [edi + ecx*2 + 1], 0
inc ecx
cmp ecx, esi
jb 0x4bfeb0
push 0xf0000000
push 1
push 0
push 0
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov esi, dword [esp + 0x28]
test eax, eax
je 0x4bff3a
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0x8002
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x4bff2e
push 0
push ebp
push edi
push dword [esp + 0x1c]
mov dword [esp + 0x28], 0x10
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
lea eax, [esp + 0x1c]
push eax
push esi
push 2
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esi + 0x10], 0
push edi
mov byte [esi + 0x14], 0
call dword [0x569364]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x4bff60
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
sub esp, 0x24
mov eax, dword [0x569434]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov esi, dword [esp + 0x30]
lea eax, [esp + 4]
push edi
mov edi, dword [esp + 0x38]
push 0xf0000000
push 1
push 0
push 0
push eax
mov dword [esp + 0x20], 8
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x4c0004
lea eax, [esp + 0x20]
mov dword [esp + 0x24], 0
push eax
xorps xmm0, xmm0
movups xmmword [esp + 0x18], xmm0
push edi
mov word [esp + 0x1c], 0x208
mov dword [esp + 0x20], 0x6601
mov dword [esp + 0x24], 8
call fcn.004c0070
lea eax, [esp + 0x28]
push 8
push eax
call fcn.004c4eb0
add esp, 0x10
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0x14
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x4c0017
push eax
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004db7a8
add esp, 0x24
ret
mov ecx, dword [esp + 0x30]
push dword [esp + 0xc]
mov eax, dword [ecx]
mov dword [esi], eax
mov eax, dword [ecx + 4]
mov dword [esi + 4], eax
lea eax, [esp + 0x10]
push eax
push esi
push 0
push 0
push 0
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push 0
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [esp + 0x28]
mov al, 1
pop edi
pop esi
xor ecx, esp
call fcn.004db7a8
add esp, 0x24
ret
Function at 0x4c52d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x4c52dc
pop ebp
ret
mov dword [ebp + 0xc], eax
pop ebp
jmp fcn.004c52f0

Function at 0x4c5e90
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0x569360]
mov edi, eax
add esp, 4
test edi, edi
jne 0x4c5eb7
pop edi
pop esi
pop ecx
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [esp + 0x1c]
mov dword [edi + 8], eax
push ebp
cmp ebx, dword [esi + 0x10]
jbe 0x4c5eff
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [esp + 0x24]
push dword [edi + 4]
call eax
mov ebp, dword [edi + 8]
push dword [edi + 4]
add ebp, dword [esi + 0xc]
mov eax, dword [esi + 8]
push ebp
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov dword [esp + 0x20], ebx
jmp 0x4c5f03
mov ebp, dword [esp + 0x1c]
push dword [edi + 4]
mov eax, dword [esi]
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [esp + 0x28]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x4c5f65
mov dword [esp + 0x10], eax
mov ebx, eax
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x18], al
lea eax, [esp + 0x18]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x24], al
lea eax, [esp + 0x24]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub ebx, 1
jne 0x4c5f24
mov ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0x10]
jae 0x4c5f97
nop word [eax + eax]
mov eax, dword [esi + 4]
push 1
push 0x540358
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x540359
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x4c5f70
pop ebp
pop ebx
mov eax, edi
pop edi
pop esi
pop ecx
ret

Function at 0x4dfe29
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x511f2a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00511da9

Function at 0x518d49
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00518a09
Function at 0x429ab0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 8]
push ebx
push esi
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.0040cff0
mov eax, dword [ebp - 8]
call fcn.0040cff0
xor eax, eax
push fcn.00429a90
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [esi - 1]
mov esi, 0xffffffff
add esi, 1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov al, byte [eax + esi]
mov dl, byte [edx + esi]
xor dl, al
mov eax, dword [ebx]
mov byte [eax + esi], dl
cmp ecx, esi
ja 0x429af0
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00429a90
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x42acf0
Capabilities:
Parse pe header

Disassembly:
cmp word [edx], 0x5a4d
je 0x42acfc
xor eax, eax
ret
add edx, dword [edx + 0x3c]
cmp dword [edx], 0x4550
jne 0x42ad0c
mov eax, dword [edx + 0x28]
ret
xor eax, eax
ret
Function at 0x43bcd0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor eax, eax
mov edx, ecx
and edx, 0x4000000
je 0x43bce8
or eax, 0x200
nop
mov edx, ecx
and edx, 0x20000000
je 0x43bd26
mov edx, ecx
and edx, 0x40000000
je 0x43bd10
mov edx, ecx
and edx, 0x80000000
je 0x43bd0b
or eax, 0x40
jmp 0x43bd54
or eax, 0x20
jmp 0x43bd54
mov edx, ecx
and edx, 0x80000000
je 0x43bd21
or eax, 0x80
jmp 0x43bd54
or eax, 0x10
jmp 0x43bd54
mov edx, ecx
and edx, 0x40000000
je 0x43bd44
mov edx, ecx
and edx, 0x80000000
je 0x43bd3f
or eax, 4
jmp 0x43bd54
or eax, 2
jmp 0x43bd54
and ecx, 0x80000000
je 0x43bd51
or eax, 8
jmp 0x43bd54
or eax, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x44b8e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov eax, 0x6251b8
call fcn.0040d6e0
test al, al
je 0x44b9c6
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
call fcn.0044b9e0
xor eax, eax
push fcn.0044b8d0
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0xc4]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x18]
mov byte [edx + 0x18], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x1a]
mov byte [edx + 0x1a], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x1b]
mov byte [edx + 0x1b], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x1c]
mov byte [edx + 0x1c], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x28]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x30]
mov eax, dword [ebp - 8]
add eax, 0x30
call fcn.00408bc0
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
mov dword [edx + 0x2c], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 8]
call fcn.0044ab10
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 8]
call fcn.0044a660
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
call dword [ecx + 0xb0]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.0044b8d0
jmp 0x44b9d1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.0044e530
mov esp, ebp
pop ebp
ret
Function at 0x49c660
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
lea esi, [ecx - 1]
test esi, esi
jl 0x49c694
mov edi, 0xffffffff
nop
add edi, 1
mov cl, al
xor cl, byte [edx]
and ecx, 0xff
mov ebx, ecx
mov ecx, eax
shr ecx, 8
xor ecx, dword [ebx*4 + 0x674170]
mov eax, ecx
add edx, 1
cmp esi, edi
jg 0x49c670
pop edi
pop esi
pop ebx
ret

Function at 0x4b7270
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov edx, eax
xor eax, eax
lea ebx, [edx + 1]
movzx ecx, byte [edx]
add ecx, 1
and ecx, 0xff
add edx, ecx
jmp 0x4b72a1
mov ecx, eax
shl ecx, 5
sub ecx, eax
movzx esi, byte [ebx]
xor ecx, esi
mov eax, ecx
add ebx, 1
cmp edx, ebx
ja 0x4b7290
pop esi
pop ebx
ret

Function at 0x4b8a80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
push ebx
push esi
push edi
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
cmp edx, 1
jne 0x4b8aa4
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
call dword [edx + 0x34]
mov dword [ebp - 8], eax
lea esi, [esi]
cmp dword [ebp - 8], 0
je 0x4b8b6a
mov esi, esi
xor eax, eax
push 0x4b8b4b
push ebp
push 0x414de0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.0040d7c0
mov eax, dword [ebp - 8]
mov byte [eax + 0xc], 0
mov eax, dword [ebp - 8]
mov byte [eax + 0xe], 0
mov edx, 1
mov eax, 0x624d98
call fcn.00449e80
mov edx, dword [ebp - 8]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 8]
call fcn.004b8d00
mov edx, dword [ebp - 8]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 8]
call fcn.004b8d70
mov edx, dword [ebp - 8]
mov dword [edx + 0x38], eax
mov eax, dword [ebp - 8]
call fcn.004b8de0
mov edx, dword [ebp - 8]
mov dword [edx + 0x30], eax
mov dword [ebp - 0xc], 1
cmp dword [ebp - 8], 0
je 0x4b8b40
cmp dword [ebp - 4], 0
je 0x4b8b40
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x44]
nop
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
jmp 0x4b8b6a
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c2a90
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov esi, eax
cmp dword [esi + 0x14], 0xca
jne 0x4c2ac4
mov eax, esi
call fcn.004c7010
cmp byte [esi + 0x40], 0
je 0x4c2abc
mov dword [esi + 0x14], 0xcf
mov bl, 1
jmp 0x4c2b75
mov dword [esi + 0x14], 0xcb
nop
cmp dword [esi + 0x14], 0xcb
jne 0x4c2b54
mov eax, dword [esi + 0x184]
cmp byte [eax + 0x10], 0
je 0x4c2b4c
lea esi, [esi]
cmp dword [esi + 8], 0
je 0x4c2af8
mov eax, esi
mov edx, dword [esi + 8]
call dword [edx]
lea esi, [esi]
mov eax, esi
mov edx, dword [esi + 0x184]
call dword [edx]
mov edi, eax
test edi, edi
jne 0x4c2b10
xor bl, bl
jmp 0x4c2b75
cmp edi, 2
je 0x4c2b4a
lea esi, [esi]
cmp dword [esi + 8], 0
je 0x4c2ae8
cmp edi, 3
je 0x4c2b28
cmp edi, 1
jne 0x4c2ae8
mov eax, dword [esi + 8]
add dword [eax + 4], 1
mov eax, dword [esi + 8]
mov edx, dword [eax + 4]
cmp edx, dword [eax + 8]
jl 0x4c2ae8
mov edx, dword [esi + 8]
mov eax, dword [esi + 0x110]
add dword [edx + 8], eax
mov esi, esi
jmp 0x4c2ae8
mov esi, esi
mov eax, dword [esi + 0x70]
mov dword [esi + 0x78], eax
jmp 0x4c2b6c
cmp dword [esi + 0x14], 0xcc
je 0x4c2b6c
mov ecx, dword [esi + 0x14]
mov eax, esi
mov dl, 0x14
call fcn.004c2eb0
lea esi, [esi]
mov eax, esi
call fcn.004c2b80
mov bl, al
mov al, bl
pop edi
pop esi
pop ebx
ret

Function at 0x508710
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
push ebx
push esi
push edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
cmp dword [ebp - 8], 1
jne 0x508738
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
call dword [edx + 0x34]
mov dword [ebp - 0xc], eax
lea esi, [esi]
cmp dword [ebp - 0xc], 0
je 0x5087ee
mov esi, esi
xor eax, eax
push 0x5087cf
push ebp
push 0x414de0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.0040d7c0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x20], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x30], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x34], 0
mov dword [ebp - 0x10], 1
cmp dword [ebp - 0xc], 0
je 0x5087c4
cmp dword [ebp - 8], 0
je 0x5087c4
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
call dword [edx + 0x44]
lea esi, [esi]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
jmp 0x5087ee
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret