joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ffe80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4fffac
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, esi
call fcn.004fe520
xor eax, eax
push ebp
push 0x4fff85
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x2c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004feb28
test al, al
je 0x4fff67
mov eax, dword [ebp + 8]
push eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.004ffd58
pop ecx
mov ecx, dword [ebp - 0x20]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040b9a8
mov ebx, dword [ebp - 0x24]
dec ebx
test ebx, ebx
jl 0x4fff67
inc ebx
xor edi, edi
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040c4fc
push eax
push edi
push esi
call sub.advapi32.dll_RegEnumValueW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004fe480
test al, al
je 0x4fff63
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0040c4fc
mov edx, eax
lea eax, [ebp - 0x30]
call fcn.0040c55c
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.004ffd58
pop ecx
inc edi
dec ebx
jne 0x4fff0b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fff8c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x10]
call fcn.004fe520
pop eax
jmp eax
Function at 0x4fffbc
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
xor ecx, ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x500214
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 8]
call fcn.004fe520
xor eax, eax
push ebp
push 0x5001e8
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x44]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004feb28
test al, al
je 0x5001ca
mov ecx, dword [ebp - 0x40]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040b9a8
mov eax, dword [ebp - 0x44]
dec eax
test eax, eax
jl 0x5001ca
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.0040c4fc
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004fe480
test al, al
je 0x5001be
mov eax, dword [ebp - 4]
call fcn.0040c4fc
mov edx, eax
lea eax, [ebp - 0x48]
call fcn.0040c55c
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004ff8b8
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x5001be
xor eax, eax
push ebp
push 0x5001b7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0xc]
call fcn.004fe520
xor eax, eax
push ebp
push 0x500197
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040c4fc
mov edx, eax
lea eax, [ebp - 0x4c]
call fcn.0040c55c
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004fe524
mov eax, dword [ebp - 4]
call fcn.0040c4fc
mov edx, eax
lea eax, [ebp - 0x50]
call fcn.0040c55c
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004ff8b8
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x500172
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.004ffe80
pop ecx
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.004fffbc
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x500179
mov eax, dword [ebp - 0x24]
push eax
call sub.advapi32.dll_RegCloseKey
pop eax
jmp eax
inc dword [ebp - 0x14]
dec dword [ebp - 0x28]
jne 0x500047
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5001ef
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x18]
call fcn.004fe520
pop eax
jmp eax
Function at 0x5084b0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x5084b6
ret
Function at 0x5100d4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp word [eax + 0x2a], 0
je 0x510102
mov eax, dword [ebp - 4]
call fcn.0050fd58
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x2c]
call dword [ebx + 0x28]
mov eax, dword [ebp - 4]
call fcn.0050fd6c
call fcn.004c34fc
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x3c]
mov edx, dword [ebp - 4]
mov dword [edx + 0x38], eax
mov eax, dword [ebp - 4]
inc dword [eax + 0x40]
mov eax, dword [ebp - 4]
inc dword [eax + 0x44]
call fcn.004c34fc
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x4c]
cmp eax, 0x3e8
jb 0x510150
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov edx, dword [ebp - 4]
mov dword [edx + 0x48], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x44], edx
call fcn.004c34fc
mov edx, dword [ebp - 4]
mov dword [edx + 0x4c], eax
pop ebx
pop ecx
pop ebp
ret

Function at 0x512240
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040b914
xor eax, eax
push ebp
push 0x5122cf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040c200
push eax
call sub.wsock32.dll_gethostbyname
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x5122b7
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x5122ab
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov eax, dword [eax + edx*4]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, dword [ebp - 8]
mov ecx, 0
call fcn.0040bf18
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
cmp dword [eax + edx*4], 0
jne 0x512289
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5122d6
lea eax, [ebp - 4]
call fcn.0040b834
pop eax
jmp eax
Function at 0x51a068
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.005100d4
call fcn.004c34fc
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x70]
cmp eax, 0x3e8
jb 0x51a09e
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x1c]
call fcn.004c34fc
mov edx, dword [ebp - 4]
mov dword [edx + 0x70], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x8c]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x51a2ef
inc eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x51a154
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x8c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
cmp eax, dword [ebp - 8]
ja 0x51a0fd
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 8]
dec edx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.0044a290
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 4]
mov ecx, dword [ebp - 8]
lea edx, [edx + ecx*8]
mov ecx, dword [0x516844]
call fcn.0040d8c8
call fcn.004c34fc
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x40], eax
fild qword [ebp - 0x44]
fld dword [ebp - 0x14]
fucompp
wait
fnstsw ax
test ah, 0x41
setnp byte [ebp - 0x19]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51a15b
lea eax, [ebp - 0x18]
mov edx, dword [0x516844]
call fcn.0040d124
pop eax
jmp eax
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
xor eax, eax
push ebp
push 0x51a2a4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x88]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
cmp dword [eax + 8], 0
ja 0x51a25c
mov eax, dword [ebp - 0x30]
mov edx, dword [eax + 8]
dec edx
mov ecx, dword [ebp - 0x30]
xor eax, eax
call fcn.0044a290
lea eax, [ebp - 0x38]
mov edx, dword [ebp - 0x30]
mov edx, dword [edx + 4]
mov ecx, dword [0x51689c]
call fcn.0040d8c8
mov eax, dword [ebp - 4]
add eax, 0x80
lea edx, [ebp - 0x38]
mov ecx, dword [0x51689c]
call fcn.0040d8c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51a2ab
lea eax, [ebp - 0x38]
mov edx, dword [0x51689c]
call fcn.0040d124
pop eax
jmp eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x88]
cmp dword [eax + 8], 0
jle 0x51a30b
mov eax, dword [ebp - 4]
cmp dword [eax + 0x74], 0
je 0x51a220
mov eax, dword [ebp - 4]
cmp dword [eax + 0x74], 0
jle 0x51a31a
mov eax, dword [ebp - 4]
dec dword [eax + 0x74]
mov esp, ebp
pop ebp
ret
Function at 0x522b40
Capabilities:
Hide graphical window
Set console window title

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
test dl, dl
je 0x522b52
add esp, 0xfffffff0
call fcn.0040a028
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00409a1c
call sub.kernel32.dll_AllocConsole
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
push 0xfffffffffffffff6
call sub.kernel32.dll_GetStdHandle
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_GetLargestConsoleWindowSize
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
add eax, 0x10
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_GetConsoleScreenBufferInfo
mov eax, dword [ebp - 4]
add eax, 0x28
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_GetConsoleCursorInfo
mov eax, dword [ebp - 4]
mov byte [eax + 0x30], 0
push 0x522c20
call sub.kernel32.dll_SetConsoleTitleW
push 0x4e3
call sub.kernel32.dll_SetConsoleOutputCP
push 0x4e3
call sub.kernel32.dll_SetConsoleCP
mov eax, dword [ebp - 4]
mov byte [eax + 0x31], 1
mov eax, 0x522c30
call fcn.004e2ea4
test al, al
je 0x522c00
push 0
call sub.kernel32.dll_GetConsoleWindow
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebp - 4]
cmp byte [ebp - 5], 0
je 0x522c18
call fcn.0040a080
pop dword fs:[0]
add esp, 0xc
mov eax, dword [ebp - 4]
pop ecx
pop ecx
pop ebp
ret
Function at 0x52d4ac
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
and eax, 0xfffffffc
shr eax, 2
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x52d547
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jb 0x52d547
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
shl eax, 2
add eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov edx, dword [ebp - 0x10]
not edx
xor eax, edx
call fcn.004ddd7c
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
shl eax, cl
or al, 0xa5
or al, byte [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add edx, dword [ebp - 0x18]
and edx, 0xf
mov ecx, dword [ebp + 8]
or al, byte [ecx + edx]
mov edx, dword [ebp - 0x18]
xor byte [ebp + edx - 4], al
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jne 0x52d505
mov eax, dword [ebp - 0x10]
xor dword [ebp - 4], eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 4]
mov dword [eax], edx
inc dword [ebp - 0x14]
dec dword [ebp - 0x20]
jne 0x52d4e0
mov esp, ebp
pop ebp
ret 4

Function at 0x52d550
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
and eax, 0xfffffffc
shr eax, 2
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x52d5ee
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jb 0x52d5ee
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
shl eax, 2
add eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
shl eax, cl
or al, 0xa5
or al, byte [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add edx, dword [ebp - 0x18]
and edx, 0xf
mov ecx, dword [ebp + 8]
or al, byte [ecx + edx]
mov edx, dword [ebp - 0x18]
xor byte [ebp + edx - 4], al
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jne 0x52d5a0
mov eax, dword [ebp - 4]
call fcn.004ddd7c
mov edx, dword [ebp - 0x10]
not edx
xor eax, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 4]
mov dword [eax], edx
inc dword [ebp - 0x14]
dec dword [ebp - 0x20]
jne 0x52d584
mov esp, ebp
pop ebp
ret 4
Function at 0x52d620
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0xc], 8
jb 0x52d78c
mov eax, dword [ebp - 8]
and eax, 3
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
sub dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x14]
test eax, eax
jbe 0x52d68b
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 1
mov al, byte [ebp - 0x18]
mov edx, dword [ebp - 8]
xor al, byte [edx]
and eax, 0xff
mov eax, dword [eax*4 + 0x5afa94]
mov edx, dword [ebp - 0x18]
shr edx, 8
xor eax, edx
mov dword [ebp - 0x18], eax
inc dword [ebp - 8]
inc dword [ebp - 0x10]
dec dword [ebp - 0x1c]
jne 0x52d661
mov eax, dword [ebp - 0xc]
shr eax, 3
test eax, eax
jbe 0x52d77e
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 8]
mov eax, dword [eax]
xor dword [ebp - 0x18], eax
xor eax, eax
mov al, byte [ebp - 0x18]
mov eax, dword [eax*4 + 0x5afa94]
mov edx, dword [ebp - 0x18]
shr edx, 8
xor eax, edx
mov dword [ebp - 0x18], eax
xor eax, eax
mov al, byte [ebp - 0x18]
mov eax, dword [eax*4 + 0x5afa94]
mov edx, dword [ebp - 0x18]
shr edx, 8
xor eax, edx
mov dword [ebp - 0x18], eax
xor eax, eax
mov al, byte [ebp - 0x18]
mov eax, dword [eax*4 + 0x5afa94]
mov edx, dword [ebp - 0x18]
shr edx, 8
xor eax, edx
mov dword [ebp - 0x18], eax
xor eax, eax
mov al, byte [ebp - 0x18]
mov eax, dword [eax*4 + 0x5afa94]
mov edx, dword [ebp - 0x18]
shr edx, 8
xor eax, edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
add eax, 4
mov eax, dword [eax]
xor dword [ebp - 0x18], eax
xor eax, eax
mov al, byte [ebp - 0x18]
mov eax, dword [eax*4 + 0x5afa94]
mov edx, dword [ebp - 0x18]
shr edx, 8
xor eax, edx
mov dword [ebp - 0x18], eax
xor eax, eax
mov al, byte [ebp - 0x18]
mov eax, dword [eax*4 + 0x5afa94]
mov edx, dword [ebp - 0x18]
shr edx, 8
xor eax, edx
mov dword [ebp - 0x18], eax
xor eax, eax
mov al, byte [ebp - 0x18]
mov eax, dword [eax*4 + 0x5afa94]
mov edx, dword [ebp - 0x18]
shr edx, 8
xor eax, edx
mov dword [ebp - 0x18], eax
xor eax, eax
mov al, byte [ebp - 0x18]
mov eax, dword [eax*4 + 0x5afa94]
mov edx, dword [ebp - 0x18]
shr edx, 8
xor eax, edx
mov dword [ebp - 0x18], eax
add dword [ebp - 8], 8
inc dword [ebp - 0x10]
dec dword [ebp - 0x1c]
jne 0x52d6a3
and dword [ebp - 0xc], 7
cmp dword [ebp - 0xc], 8
jae 0x52d641
mov eax, dword [ebp - 0xc]
test eax, eax
jbe 0x52d7c7
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 1
mov al, byte [ebp - 0x18]
mov edx, dword [ebp - 8]
xor al, byte [edx]
and eax, 0xff
mov eax, dword [eax*4 + 0x5afa94]
mov edx, dword [ebp - 0x18]
shr edx, 8
xor eax, edx
mov dword [ebp - 0x18], eax
inc dword [ebp - 8]
inc dword [ebp - 0x10]
dec dword [ebp - 0x1c]
jne 0x52d79d
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
mov dword [eax], edx
mov esp, ebp
pop ebp
ret
Function at 0x52d7d4
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov ecx, 0x3fc
xor edx, edx
div ecx
mov eax, 0x5afa94
add eax, edx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 8], 0x3c
jbe 0x52d806
mov dword [ebp - 8], 0x3c
mov ecx, dword [ebp - 8]
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.00407370
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
lea edx, [ebp - 0x18]
mov dword [edx], eax
mov eax, dword [ebp - 8]
mov dl, byte [ebp - 0x18]
mov byte [ebp + eax - 0x5c], dl
mov eax, dword [ebp - 8]
mov dl, byte [ebp - 0x17]
mov byte [ebp + eax - 0x5b], dl
mov eax, dword [ebp - 8]
mov dl, byte [ebp - 0x16]
mov byte [ebp + eax - 0x5a], dl
mov eax, dword [ebp - 8]
mov dl, byte [ebp - 0x15]
mov byte [ebp + eax - 0x59], dl
add dword [ebp - 8], 4
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
call fcn.0052d5f4
lea edx, [ebp - 0x5c]
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 8]
call fcn.0052d620
mov eax, dword [ebp - 0x1c]
call fcn.0052d608
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x52e7cc
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1c], 0
je 0x52e7fb
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
add eax, 0x20
call fcn.005115d8
jmp 0x52e806
lea edx, [ebp - 0x24]
lea eax, [ebp - 0xc]
call fcn.005115d8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1c], 0
je 0x52e859
xor edx, edx
mov eax, dword [ebp - 0x14]
call fcn.004f5ef0
xor edx, edx
mov eax, dword [ebp - 0x14]
call fcn.004f5ef0
xor edx, edx
mov eax, dword [ebp - 0x14]
call fcn.004f5ef0
mov dl, 1
mov eax, dword [ebp - 0x14]
call fcn.004f5ef0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call fcn.004f5f38
mov dx, word [ebp - 8]
xchg dl, dh
mov eax, dword [ebp - 0x14]
call fcn.004f5f14
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov ebx, dword [eax]
call dword [ebx + 0x1c]
push 0x10
lea eax, [ebp - 0x24]
push eax
push 0
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0xc]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 4]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.wsock32.dll_sendto
mov eax, dword [ebp - 0x14]
call fcn.004b5c24
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 8]
add dword [eax + 0x38], edx
mov eax, dword [ebp - 4]
inc dword [eax + 0x48]
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 8]
add dword [eax + 0x58], edx
mov eax, dword [ebp - 4]
inc dword [eax + 0x60]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x52eb5c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x30]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x2c]
jb 0x52ec9b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x18], eax
fild qword [ebp - 0x1c]
fdivr dword [0x52eca0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x18], eax
fild qword [ebp - 0x1c]
fmulp st(1)
call fcn.00407d0c
mov edx, dword [ebp - 4]
mov dword [edx + 0x3c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x18], eax
fild qword [ebp - 0x1c]
fdivr dword [0x52eca0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x18], eax
fild qword [ebp - 0x1c]
fmulp st(1)
call fcn.00407d0c
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
add eax, 0x34
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp - 4]
add eax, 0x38
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x18], eax
fild qword [ebp - 0x1c]
fdivr dword [0x52eca0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x18], eax
fild qword [ebp - 0x1c]
fmulp st(1)
call fcn.00407d0c
mov edx, dword [ebp - 4]
mov dword [edx + 0x4c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x18], eax
fild qword [ebp - 0x1c]
fdivr dword [0x52eca0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x18], eax
fild qword [ebp - 0x1c]
fmulp st(1)
call fcn.00407d0c
mov edx, dword [ebp - 4]
mov dword [edx + 0x50], eax
mov eax, dword [ebp - 4]
add eax, 0x44
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp - 4]
add eax, 0x48
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
xor edx, edx
mov dword [eax], edx
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
mov dword [edx + 0x30], eax
mov esp, ebp
pop ebp
ret