joyce8/EMBER2024-capa huggingface dataset:
Function at 0x486740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x4867da.0
jmp dword [ecx*4 + 0x486773]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x4867a5
sub dl, 8
je 0x4867b4
jmp case.0x4867da.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4863e8
jmp case.0x4867da.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x486440
jmp case.0x4867da.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x4867da.0
movzx ecx, byte [ecx + 0x4867e1]
jmp dword [ecx*4 + 0x4867f2]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4864ec
jmp case.0x4867da.0
cmp dl, 3
jne 0x48681f
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x486544
jmp case.0x4867da.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x486500
jmp case.0x4867da.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x486588
jmp case.0x4867da.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x48684a
sub dl, 8
je 0x486856
jmp case.0x4867da.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4865b4
jmp case.0x4867da.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x486620
jmp case.0x4867da.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x486875
sub dl, 8
je 0x486881
jmp case.0x4867da.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4866dc
jmp case.0x4867da.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x486704
mov edx, dword [eax + 0x468]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x450]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 8], esi
add edx, dword [eax + 0x44c]
mov dword [ebp - 0x10], edx
mov esi, ecx
test esi, esi
jb 0x486923
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004858ec
test eax, eax
je 0x486923
mov eax, ebx
call fcn.0048692c
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x4868bc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x48692c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x48695d
dec al
je 0x486998
dec al
je 0x4869dd
dec al
je 0x486a46
jmp 0x486ad0
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x486ad0
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x48696d
jmp 0x486ad0
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x486ad0
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4869a8
jmp 0x486ad0
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x486ad0
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x486a0c
xor ebp, ebp
jmp 0x486a1c
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x486a25
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4869ed
jmp 0x486ad0
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x486ad0
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x486a9f
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.00483cd8
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x486a5a
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x48aff0
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x58
call fcn.00403ad8
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret
Function at 0x48c894
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x18], ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x14]
mov edx, dword [0x409c10]
call fcn.00406cb0
xor eax, eax
push ebp
push 0x48ca55
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4b342c], 0
jne 0x48c8e8
mov ecx, dword [0x4bf154]
mov dl, 1
mov eax, dword [0x40a5fc]
call fcn.00410fd4
call fcn.00404d0c
lea eax, [ebp - 0x2c]
xor ecx, ecx
mov edx, 0x10
call fcn.00403ad8
mov eax, ebx
call fcn.004060b8
mov dword [ebp - 0x28], eax
push esi
mov esi, 0x48ca64
lea edi, [ebp - 0x3c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
call fcn.00408168
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, ebx
test eax, eax
je 0x48c92f
sub eax, 4
mov eax, dword [eax]
shr eax, 1
test eax, eax
jle 0x48c9fb
mov dword [ebp - 0x1c], 0x20
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x5c]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x48c9e7
lea eax, [ebp - 4]
lea edx, [ebp - 0x5c]
mov ecx, 0x10
call fcn.00406500
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00406568
mov eax, dword [ebp - 4]
test eax, eax
je 0x48c98a
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x48c98a
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.004056b4
mov ebx, eax
test ebx, ebx
je 0x48c995
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [ebp - 8]
test eax, eax
je 0x48c9b2
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x48c9b2
lea eax, [ebp - 8]
mov edx, dword [ebp - 8]
call fcn.004056b4
mov edi, eax
test edi, edi
je 0x48c9bd
sub edi, 4
mov edi, dword [edi]
push edi
mov eax, dword [ebp - 8]
call fcn.004063bc
push eax
push ebx
mov eax, dword [ebp - 4]
call fcn.004063bc
push eax
push 1
push 0x400
call sub.kernel32.dll_CompareStringW_1
sub eax, 2
test eax, eax
sete al
jmp 0x48c9e9
xor eax, eax
test al, al
je 0x48c9f4
mov ebx, 0x15
jmp 0x48ca00
mov ebx, 0x10
jmp 0x48ca00
mov ebx, 0x15
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0x2c]
push eax
push ebx
push 0
push esi
call dword [0x4b342c]
call fcn.0048c6a4
mov eax, dword [ebp - 0xc]
call fcn.0048c6a4
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x10]
call fcn.00408180
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48ca5c
lea eax, [ebp - 0x14]
mov edx, dword [0x409c10]
call fcn.00406d88
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406328
ret
Function at 0x48dca0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
test eax, 0x4000000
je 0x48dcb5
or edx, 0x200
test eax, 0x20000000
je 0x48dce8
test eax, 0x40000000
je 0x48dcd4
test eax, 0x80000000
je 0x48dccf
or edx, 0x40
jmp 0x48dd0f
or edx, 0x20
jmp 0x48dd0f
test eax, 0x80000000
je 0x48dce3
or edx, 0x80
jmp 0x48dd0f
or edx, 0x10
jmp 0x48dd0f
test eax, 0x40000000
je 0x48dd00
test eax, 0x80000000
je 0x48dcfb
or edx, 4
jmp 0x48dd0f
or edx, 2
jmp 0x48dd0f
test eax, 0x80000000
je 0x48dd0c
or edx, 8
jmp 0x48dd0f
or edx, 1
mov eax, edx
pop ebp
ret 4
Function at 0x48de0c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec0
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 4], eax
xor ecx, ecx
push ebp
push 0x48e027
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov eax, dword [esi]
lea edx, [ebp - 0x48]
mov ecx, 0x40
call fcn.00403258
cmp word [ebp - 0x48], 0x5a4d
je 0x48de66
mov eax, 0x4c55f4
mov edx, 0x48e060
call fcn.00405538
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48e047
mov eax, dword [esi]
add eax, dword [ebp - 0xc]
lea edx, [ebp - 0x140]
mov ecx, 0xf8
call fcn.00403258
cmp dword [ebp - 0x140], 0x4550
je 0x48dea3
mov eax, 0x4c55f4
mov edx, 0x48e09c
call fcn.00405538
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48e047
push 4
push 0x2000
mov eax, dword [ebp - 0xf0]
push eax
mov eax, dword [ebp - 0x10c]
push eax
call sub.kernel32.dll_VirtualAlloc_1
mov ebx, eax
test ebx, ebx
jne 0x48deda
push 4
push 0x2000
mov eax, dword [ebp - 0xf0]
push eax
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov ebx, eax
test ebx, ebx
jne 0x48defa
mov eax, 0x4c55f4
mov edx, 0x48e0dc
call fcn.00405538
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48e047
push 0x11
push 0
call sub.kernel32.dll_GetProcessHeap
push eax
call sub.kernel32.dll_HeapAlloc
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax + 4], ebx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 8], edx
mov eax, dword [ebp - 8]
mov byte [eax + 0x10], 0
push 4
push 0x1000
mov eax, dword [ebp - 0xf0]
push eax
push ebx
call sub.kernel32.dll_VirtualAlloc_1
push 4
push 0x1000
mov eax, dword [ebp - 0xec]
push eax
push ebx
call sub.kernel32.dll_VirtualAlloc_1
mov edi, eax
mov eax, dword [esi]
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 0xec]
push edi
pop edx
call fcn.00403258
mov eax, edi
add eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov edi, ebx
mov dword [eax + 0x34], edi
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x140]
push eax
mov eax, dword [esi]
push eax
call fcn.0048d8ac
mov eax, edi
sub eax, dword [ebp - 0x10c]
test eax, eax
je 0x48df9d
push eax
mov eax, dword [ebp - 8]
push eax
call fcn.0048d954
mov eax, dword [ebp - 8]
push eax
call fcn.0048da0c
test al, al
jne 0x48dfbe
mov eax, 0x4c55f4
mov edx, 0x48e110
call fcn.0040587c
call fcn.00410eec
mov eax, dword [ebp - 8]
push eax
call fcn.0048dd18
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
test eax, eax
je 0x48e01d
mov edx, eax
add edx, edi
mov esi, edx
test edx, edx
jne 0x48dff1
mov eax, 0x4c55f4
mov edx, 0x48e14c
call fcn.00405538
call fcn.00410eec
push 0
push 1
push edi
call esi
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x48e016
mov eax, 0x4c55f4
mov edx, 0x48e184
call fcn.00405538
call fcn.00410eec
mov eax, dword [ebp - 8]
mov byte [eax + 0x10], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48e041
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x48fbf4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004060b8
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x48fc0d
test al, 0x10
jne 0x48fc11
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x48fef0
Capabilities:
Create directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.004062f8
xor eax, eax
push ebp
push 0x490047
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
mov eax, dword [ebp - 4]
xor edx, edx
call fcn.00406250
jne 0x48ff47
mov ecx, 0x490064
mov dl, 1
mov eax, dword [0x40a7c0]
call fcn.00410f18
mov edx, eax
mov dword [edx + 0x18], 3
mov eax, edx
call fcn.00404d0c
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0048fb84
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.00405f2c
mov eax, dword [ebp - 4]
call fcn.0048fbf4
test al, al
jne 0x490017
mov eax, dword [ebp - 4]
test eax, eax
je 0x48ff7b
sub eax, 4
mov eax, dword [eax]
shr eax, 1
cmp eax, 3
jge 0x48ff84
mov al, 1
jmp 0x48ff8c
mov eax, dword [ebp - 4]
call fcn.0048fbf4
test al, al
je 0x48ff94
mov al, 1
jmp 0x48ffc5
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.00406568
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.0040d104
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.00406568
mov edx, dword [ebp - 0x14]
pop eax
call fcn.0040694c
sete al
test al, al
jne 0x490017
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.0048fb00
mov eax, dword [ebp - 0x18]
xor edx, edx
call fcn.0048fef0
test al, al
je 0x48fff6
push 0
mov eax, dword [ebp - 4]
call fcn.004060b8
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x48fffa
xor ebx, ebx
jmp 0x48fffc
mov bl, 1
test bl, bl
je 0x490017
test si, si
jbe 0x490017
movzx eax, si
push eax
mov eax, dword [ebp - 4]
call fcn.004060b8
push eax
call sub.kernel32.dll_SetFileAttributesW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49004e
lea eax, [ebp - 0x18]
call fcn.00405ec8
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00406328
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405ee0
ret
Function at 0x4927d8
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
test dl, dl
je 0x4927ea
add esp, 0xfffffff0
call fcn.00404768
mov esi, ecx
mov ebx, edx
mov edi, eax
lea eax, [ebp + 0x1c]
call fcn.004062f8
xor eax, eax
push ebp
push 0x492896
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, edi
call fcn.004042e8
mov dword [edi + 0x38], esi
lea eax, [edi + 0xc]
mov edx, dword [ebp + 0x1c]
call fcn.00405f04
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x18], eax
movzx eax, byte [ebp + 8]
mov byte [edi + 0x1c], al
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x20], eax
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
push 0
lea eax, [edi + 0x40]
mov ecx, 1
mov edx, dword [0x48eba4]
call fcn.00407980
add esp, 4
mov eax, edi
call fcn.0049262c
test al, al
jne 0x492880
call fcn.00410eec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49289d
lea eax, [ebp + 0x1c]
call fcn.00405ec8
ret
Function at 0x493000
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x14
add esp, 0xfffff004
push eax
dec eax
jne 0x493009
mov eax, dword [ebp - 4]
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14018], ecx
mov dword [ebp - 0x1401c], ecx
mov dword [ebp - 0x14008], edx
mov ebx, eax
lea eax, [ebp - 0x14008]
call fcn.004062f8
xor eax, eax
push ebp
push 0x493222
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x14009], 0
lea edx, [ebp - 0x1401c]
mov eax, dword [ebp - 0x14008]
call fcn.0048fd78
mov eax, dword [ebp - 0x1401c]
lea edx, [ebp - 0x14018]
call fcn.0049009c
mov eax, dword [ebp - 0x14018]
mov edx, 0x49323c
call fcn.00406250
jne 0x4931f9
mov dword [ebx + 0xb8], 0
mov dword [ebx + 0xbc], 0
mov byte [ebx + 0xb0], 0
push 0
push 3
push 0
push 0
mov eax, dword [ebp - 0x14008]
call fcn.004060b8
mov ecx, 1
mov edx, 0x80000000
call fcn.00490180
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4931f2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
mov edx, 2
mov eax, dword [ebp - 4]
call fcn.0049021c
mov dword [ebp - 0x14010], eax
push 0
push 0x10000
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0049021c
push 0
lea eax, [ebp - 0x14014]
push eax
push 0x14000
lea eax, [ebp - 0x14004]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_ReadFile_1
mov edi, dword [ebp - 0x14014]
sub edi, 6
test edi, edi
jb 0x493167
inc edi
xor esi, esi
push ebp
mov eax, esi
call fcn.00492fc8
pop ecx
mov byte [ebx + 0xb0], al
cmp byte [ebx + 0xb0], 0
je 0x493163
lea eax, [esi + 0x10000]
xor edx, edx
mov dword [ebx + 0xb8], eax
mov dword [ebx + 0xbc], edx
mov byte [ebp - 0x14009], 1
jmp 0x493167
inc esi
dec edi
jne 0x49312e
cmp byte [ebx + 0xb0], 0
jne 0x4931db
push ebp
call fcn.00492e78
pop ecx
mov esi, eax
cmp esi, dword [ebp - 0x14010]
je 0x4931db
mov eax, esi
xor edx, edx
push edx
push eax
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0049021c
push 0
lea eax, [ebp - 0x14014]
push eax
push 6
lea eax, [ebp - 0x14004]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_ReadFile_1
push ebp
xor eax, eax
call fcn.00492fc8
pop ecx
mov byte [ebx + 0xb0], al
cmp byte [ebx + 0xb0], 0
je 0x4931db
mov eax, esi
xor edx, edx
mov dword [ebx + 0xb8], eax
mov dword [ebx + 0xbc], edx
mov byte [ebp - 0x14009], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4931f9
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x493229
lea eax, [ebp - 0x1401c]
mov edx, 2
call fcn.00405ee0
lea eax, [ebp - 0x14008]
call fcn.00405ec8
ret
Function at 0x494b90
Capabilities:
Encrypt data using rc6

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
lea edx, [esp + 4]
mov eax, dword [0x4c5608]
mov ecx, 0x40
call fcn.00403258
mov dword [0x4c560c], 0xb7e15163
mov ebx, 0x19
mov eax, 0x4c560c
mov edx, dword [eax]
add edx, 0x9e3779b9
mov dword [eax + 4], edx
add eax, 4
dec ebx
jne 0x494bbe
xor ebx, ebx
xor edi, edi
xor esi, esi
xor ebp, ebp
mov dword [esp], 0x4e
mov eax, dword [ebx*4 + 0x4c560c]
add eax, esi
add eax, ebp
mov edx, 3
call fcn.004949c4
mov esi, eax
mov dword [ebx*4 + 0x4c560c], esi
lea edx, [ebp + esi]
mov eax, dword [esp + edi*4 + 4]
add eax, esi
add eax, ebp
call fcn.004949c4
mov ebp, eax
mov dword [esp + edi*4 + 4], ebp
lea eax, [ebx + 1]
mov ecx, 0x1a
cdq
idiv ecx
mov ebx, edx
inc edi
and edi, 0x8000000f
jns 0x494c2e
dec edi
or edi, 0xfffffff0
inc edi
dec dword [esp]
jne 0x494bde
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x494c3c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov esi, 0xc
mov eax, dword [ebx + 4]
mov edi, esi
add edi, edi
sub eax, dword [edi*4 + 0x4c5610]
mov edx, dword [ebx]
call fcn.004949cc
mov ebp, eax
xor ebp, dword [ebx]
mov dword [ebx + 4], ebp
mov eax, dword [ebx]
sub eax, dword [edi*4 + 0x4c560c]
mov edx, ebp
call fcn.004949cc
xor eax, dword [ebx + 4]
mov dword [ebx], eax
dec esi
test esi, esi
jne 0x494c47
mov eax, dword [0x4c5610]
sub dword [ebx + 4], eax
mov eax, dword [0x4c560c]
sub dword [ebx], eax
mov al, 1
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x495378
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405b60
xor eax, eax
push ebp
push 0x49549b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00405b70
mov esi, eax
push esi
call sub.wsock32.dll_inet_addr
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x49547d
cmp byte [0x4c5695], 0
je 0x49544b
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.0040608c
cmp byte [0x4c5694], 0
je 0x4953e1
mov esi, 8
jmp 0x4953fe
xor esi, esi
jmp 0x4953fe
lea eax, [ebp - 8]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 0x18]
call fcn.00406034
push 1
mov eax, dword [ebp - 0xc]
push eax
call sub.dnsapi.dll_DnsRecordListFree
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push esi
push 5
mov eax, dword [ebp - 8]
call fcn.004060b8
push eax
call sub.dnsapi.dll_DnsQuery_W
test eax, eax
je 0x4953e5
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push esi
push 1
mov eax, dword [ebp - 8]
call fcn.004060b8
push eax
call sub.dnsapi.dll_DnsQuery_W
test eax, eax
jne 0x49547d
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax + 0x18]
push 1
mov eax, dword [ebp - 0xc]
push eax
call sub.dnsapi.dll_DnsRecordListFree
jmp 0x49547d
push esi
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x49547d
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x49545d
inc ebx
cmp dword [esi + ebx*4], 0
jne 0x49545c
cmp ebx, 1
jne 0x49546c
xor eax, eax
jmp 0x495478
call fcn.004034d4
mov eax, ebx
call fcn.004034fc
mov eax, dword [esi + eax*4]
mov ebx, dword [eax]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4954a2
lea eax, [ebp - 8]
call fcn.00405ec8
lea eax, [ebp - 4]
call fcn.004054e4
ret

Function at 0x4954ac
Capabilities:
Connect socket
Get socket status
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], ecx
mov ebx, eax
xor esi, esi
mov dword [ebp - 8], 1
or edi, 0xffffffff
lea eax, [ebp - 8]
push eax
push 0x8004667e
push ebx
call sub.wsock32.dll_ioctlsocket
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
call sub.wsock32.dll_connect
inc eax
jne 0x495550
call sub.wsock32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x495550
lea eax, [ebp - 0x124]
call fcn.004950d8
lea edx, [ebp - 0x124]
mov eax, ebx
call fcn.004950c8
mov eax, dword [ebp + 8]
mov ecx, 0x3e8
cdq
idiv ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov ecx, 0x3e8
cdq
idiv ecx
imul eax, edx, 0x3e8
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0x124]
push eax
push 0
push 0
call sub.wsock32.dll_select
mov esi, eax
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0x8004667e
push ebx
call sub.wsock32.dll_ioctlsocket
test esi, esi
jle 0x49556a
xor edi, edi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x49ce7c
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
xor edi, edi
push pe_nt_image_headers32
lea eax, [esp + 0xc]
push eax
call sub.wsock32.dll_gethostname
lea eax, [esp + 8]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x49cefe
mov eax, dword [eax + 0xc]
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp], eax
jmp 0x49cef1
mov eax, dword [esp + 4]
mov edx, dword [esp]
mov eax, dword [eax + edx*4]
mov ecx, dword [eax]
mov edx, dword [0x4c5864]
dec edx
test edx, edx
jl 0x49ceea
inc edx
xor esi, esi
lea eax, [esi + esi*2]
mov ebx, dword [0x4c5860]
lea eax, [ebx + eax*4]
cmp ecx, dword [eax]
jb 0x49cee6
cmp ecx, dword [eax + 4]
ja 0x49cee6
mov edi, dword [eax + 8]
jmp 0x49ceea
inc esi
dec edx
jne 0x49cecc
test edi, edi
ja 0x49cefe
inc dword [esp]
mov eax, dword [esp + 4]
mov edx, dword [esp]
cmp dword [eax + edx*4], 0
jne 0x49ceb2
mov eax, edi
add esp, 0x108
pop edi
pop esi
pop ebx
ret