joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a25e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x50bc38
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5894dc]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
call fcn.004b5c30
xor eax, eax
lea ecx, [esi + 0x38]
mov dword [esp + 0x14], eax
mov dword [esi], 0x555874
mov byte [esi + 0x30], al
mov dword [esi + 0x34], eax
call fcn.00408020
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x4a2640
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x50bc73
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5894dc]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], 0x555874
cmp byte [esi + 0x30], 0
mov dword [esp + 0x14], 1
je 0x4a268b
mov ecx, dword [esi + 0x34]
test ecx, ecx
je 0x4a268b
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
lea ecx, [esi + 0x38]
mov dword [esi + 0x34], 0
mov byte [esp + 0x14], 0
call fcn.00408310
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.004b5cc0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x4a46f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x50e6d8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x5894dc]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
lea ecx, [esp + 8]
call fcn.00404230
mov eax, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 0xc]
push ecx
push edx
push eax
mov dword [esp + 0x40], 0
call fcn.004a4150
add esp, 0x10
test al, al
lea ecx, [esp + 8]
jne 0x4a4769
mov dword [esp + 0x30], 0xffffffff
call fcn.00404a00
xor eax, eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret
call fcn.0046fb70
push eax
lea ecx, [esp + 0xc]
call fcn.004e81e0
push eax
call fcn.004bec50
add esp, 8
lea ecx, [esp + 8]
mov esi, eax
mov dword [esp + 0x30], 0xffffffff
call fcn.00404a00
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret
Function at 0x4a7d10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x50eef8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
mov eax, dword [0x5894dc]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x488], 0x100
mov byte [esp + 0xc], 1
jne 0x4a7d4e
mov byte [esp + 0xc], bl
lea ecx, [esp + 0x10]
call fcn.00404230
mov ecx, dword [esi + 0x157c]
lea eax, [esp + 0x10]
push eax
push ecx
mov dword [esp + 0x40], ebx
call fcn.004a42a0
mov edx, dword [esp + 0x54]
mov eax, dword [esp + 0x50]
push edx
mov edx, dword [esp + 0x50]
push eax
lea ecx, [esi + 0x458]
push ecx
mov ecx, dword [esp + 0x54]
push edx
mov edx, dword [esp + 0x24]
add esi, 0x438
push esi
lea eax, [esp + 0x2c]
push eax
push ecx
push edx
call fcn.004a4de0
add esp, 0x28
lea ecx, [esp + 0x10]
mov bl, al
mov dword [esp + 0x38], 0xffffffff
call fcn.00404a00
mov al, bl
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x30
ret 0x10
Function at 0x4ab490
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x50c25c
mov eax, dword fs:[0]
push eax
sub esp, 0x194
mov eax, dword [0x5894dc]
xor eax, esp
mov dword [esp + 0x190], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5894dc]
xor eax, esp
push eax
lea eax, [esp + 0x1a8]
mov dword fs:[0], eax
mov eax, dword [esp + 0x1b8]
mov ecx, dword [esp + 0x1cc]
mov ebp, dword [esp + 0x1c0]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
call fcn.00404150
mov ebx, dword [esp + 0x1c8]
cmp ebx, 3
mov esi, 0x40
jne 0x4ab503
mov esi, 0x80
lea ecx, [esp + 0x5c]
call fcn.00404230
mov edi, dword [esp + 0x1c4]
cmp edi, esi
mov dword [esp + 0x1b0], 0
jle 0x4ab54e
lea ecx, [esp + 0x5c]
push ecx
push ebx
push edi
push ebp
call fcn.0043d9f0
add esp, 0x10
lea ecx, [esp + 0x5c]
call fcn.004e81e0
push ebx
mov ebp, eax
call fcn.0043d910
mov edi, eax
add esp, 4
cmp edi, esi
jle 0x4ab54e
mov edi, esi
push esi
lea edx, [esp + 0xa0]
push 0
push edx
call fcn.004ed3e0
push esi
lea eax, [esp + 0x130]
push 0
push eax
call fcn.004ed3e0
push edi
lea ecx, [esp + 0xb8]
push ebp
push ecx
call fcn.004ed460
push edi
lea edx, [esp + 0x148]
push ebp
push edx
call fcn.004ed460
add esp, 0x30
xor eax, eax
test esi, esi
jle 0x4ab5b7
jmp 0x4ab5a0
xor byte [esp + eax + 0x9c], 0x36
xor byte [esp + eax + 0x120], 0x5c
add eax, 1
cmp eax, esi
jl 0x4ab5a0
lea ecx, [esp + 0x1c]
call fcn.00404230
push esi
lea eax, [esp + 0xa0]
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x1b8], 1
call fcn.004050c0
mov ecx, dword [esp + 0x1bc]
mov edx, dword [esp + 0x14]
push ecx
push edx
lea ecx, [esp + 0x24]
call fcn.004050c0
lea ecx, [esp + 0x7c]
call fcn.00404230
lea eax, [esp + 0x7c]
push eax
push ebx
lea ecx, [esp + 0x24]
mov byte [esp + 0x1b8], 2
call fcn.0046fb70
push eax
lea ecx, [esp + 0x28]
call fcn.004e81e0
push eax
call fcn.0043d9f0
add esp, 0x10
lea ecx, [esp + 0x3c]
call fcn.00404230
push esi
lea ecx, [esp + 0x124]
push ecx
lea ecx, [esp + 0x44]
mov byte [esp + 0x1b8], 3
call fcn.004050c0
lea edx, [esp + 0x7c]
push edx
lea ecx, [esp + 0x40]
call fcn.004058a0
mov eax, dword [esp + 0x18]
push eax
push ebx
lea ecx, [esp + 0x44]
call fcn.0046fb70
push eax
lea ecx, [esp + 0x48]
call fcn.004e81e0
push eax
call fcn.0043d9f0
add esp, 0x10
lea ecx, [esp + 0x3c]
mov byte [esp + 0x1b0], 2
call fcn.00404a00
lea ecx, [esp + 0x7c]
mov byte [esp + 0x1b0], 1
call fcn.00404a00
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1b0], 0
call fcn.00404a00
lea ecx, [esp + 0x5c]
mov dword [esp + 0x1b0], 0xffffffff
call fcn.00404a00
mov ecx, dword [esp + 0x1a8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.004ec47e
add esp, 0x1a0
ret
Function at 0x4b6010
Capabilities:
Hash data using crc32b

Disassembly:
cmp byte [0x58bcd0], 0
jne 0x4b61e4
push 0x400
call fcn.004eceb1
add esp, 4
push ebx
push esi
mov dword [0x58bcd4], eax
xor eax, eax
push edi
xor ecx, ecx
test al, 1
je 0x4b603f
mov ecx, 0x80
mov edx, eax
shr edx, 1
test dl, 1
je 0x4b604b
or ecx, 0x40
shr edx, 1
test dl, 1
je 0x4b6055
or ecx, 0x20
shr edx, 1
test dl, 1
je 0x4b605f
or ecx, 0x10
shr edx, 1
test dl, 1
je 0x4b6069
or ecx, 8
shr edx, 1
test dl, 1
je 0x4b6073
or ecx, 4
shr edx, 1
test dl, 1
je 0x4b607d
or ecx, 2
test dl, 2
je 0x4b6085
or ecx, 1
mov edx, dword [0x58bcd4]
shl ecx, 0x18
mov dword [edx + eax*4], ecx
mov edx, dword [0x58bcd4]
mov ecx, dword [edx + eax*4]
mov esi, ecx
and esi, 0x80000000
neg esi
sbb esi, esi
and esi, 0x4c11db7
add ecx, ecx
xor esi, ecx
mov dword [edx + eax*4], esi
mov edx, dword [0x58bcd4]
mov ecx, dword [edx + eax*4]
mov esi, ecx
and esi, 0x80000000
neg esi
sbb esi, esi
and esi, 0x4c11db7
add ecx, ecx
xor esi, ecx
mov dword [edx + eax*4], esi
mov edx, dword [0x58bcd4]
mov ecx, dword [edx + eax*4]
mov esi, ecx
and esi, 0x80000000
neg esi
sbb esi, esi
and esi, 0x4c11db7
add ecx, ecx
xor esi, ecx
mov dword [edx + eax*4], esi
mov edx, dword [0x58bcd4]
mov ecx, dword [edx + eax*4]
mov esi, ecx
and esi, 0x80000000
neg esi
sbb esi, esi
and esi, 0x4c11db7
add ecx, ecx
xor esi, ecx
mov dword [edx + eax*4], esi
mov edx, dword [0x58bcd4]
mov ecx, dword [edx + eax*4]
mov esi, ecx
and esi, 0x80000000
neg esi
sbb esi, esi
and esi, 0x4c11db7
add ecx, ecx
xor esi, ecx
mov dword [edx + eax*4], esi
mov edx, dword [0x58bcd4]
mov ecx, dword [edx + eax*4]
mov esi, ecx
and esi, 0x80000000
neg esi
sbb esi, esi
and esi, 0x4c11db7
add ecx, ecx
xor esi, ecx
mov dword [edx + eax*4], esi
mov edx, dword [0x58bcd4]
mov ecx, dword [edx + eax*4]
mov esi, ecx
and esi, 0x80000000
neg esi
sbb esi, esi
and esi, 0x4c11db7
add ecx, ecx
xor esi, ecx
mov dword [edx + eax*4], esi
mov edx, dword [0x58bcd4]
mov ecx, dword [edx + eax*4]
mov esi, ecx
and esi, 0x80000000
neg esi
sbb esi, esi
and esi, 0x4c11db7
add ecx, ecx
xor esi, ecx
mov dword [edx + eax*4], esi
mov edi, dword [0x58bcd4]
mov edx, dword [edi + eax*4]
xor esi, esi
mov ecx, 0x1f
test dl, 1
je 0x4b61bf
mov ebx, 1
shl ebx, cl
or esi, ebx
sub ecx, 1
shr edx, 1
cmp ecx, 0xffffffff
jg 0x4b61b1
mov dword [edi + eax*4], esi
add eax, 1
cmp eax, 0xff
jle 0x4b6034
pop edi
pop esi
mov byte [0x58bcd0], 1
pop ebx
ret
Function at 0x4b6210
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x400
push edi
mov edi, dword [esp + 0x40c]
test edi, edi
jne 0x4b622c
xor eax, eax
pop edi
add esp, 0x400
ret
push ebx
push esi
call fcn.004b6010
mov ebx, dword [esp + 0x418]
or esi, 0xffffffff
test ebx, ebx
jne 0x4b627b
mov ecx, dword [0x58bcd4]
mov eax, dword [esp + 0x410]
mov edi, edi
movzx ebx, byte [eax]
mov edx, esi
and edx, 0xff
xor edx, ebx
shr esi, 8
xor esi, dword [ecx + edx*4]
sub edi, 1
add eax, 1
test edi, edi
jne 0x4b6250
mov eax, esi
pop esi
pop ebx
not eax
pop edi
add esp, 0x400
ret
push 0x400
lea eax, [esp + 0x10]
push 0
push eax
call fcn.004ed3e0
mov edx, dword [0x58bcd4]
mov ecx, dword [esp + 0x41c]
add esp, 0xc
push ebp
lea ecx, [ecx]
movzx eax, byte [ecx]
add dword [esp + eax*4 + 0x10], 1
mov ebp, esi
and ebp, 0xff
xor ebp, eax
shr esi, 8
xor esi, dword [edx + ebp*4]
sub edi, 1
add ecx, 1
test edi, edi
jne 0x4b62a0
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
add eax, ecx
add eax, dword [esp + 0x18]
xor edx, edx
add eax, dword [esp + 0x1c]
mov ecx, 7
add eax, dword [esp + 0x20]
pop ebp
add eax, dword [esp + 0x20]
add eax, dword [esp + 0x24]
jmp 0x4b62f0
add edx, dword [esp + ecx*4 + 0xc]
add ecx, 1
cmp ecx, 0x80
jl 0x4b62f0
cmp ecx, 0x100
jge 0x4b631f
jmp 0x4b6310
add eax, dword [esp + ecx*4 + 0xc]
add ecx, 1
cmp ecx, 0x100
jl 0x4b6310
shr edx, 2
cmp edx, eax
sbb ecx, ecx
mov eax, esi
neg ecx
pop esi
mov word [ebx], cx
pop ebx
not eax
pop edi
add esp, 0x400
ret

Function at 0x4b6b50
Capabilities:
Resolve dns

Disassembly:
sub esp, 0xcc
mov eax, dword [0x5894dc]
xor eax, esp
mov dword [esp + 0xc8], eax
push esi
mov esi, ecx
lea ecx, [esi + 8]
call fcn.004e81e0
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x4b6bcb
mov ecx, dword [eax + 0xc]
cmp dword [ecx], 0
je 0x4b6b8b
mov ecx, dword [ecx]
mov edx, dword [ecx]
mov dword [esi + 0x64], edx
jmp 0x4b6b92
mov dword [esi + 0x64], 0
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
movzx ecx, byte [eax + 3]
movzx edx, byte [eax + 2]
push ecx
movzx ecx, byte [eax + 1]
push edx
movzx edx, byte [eax]
push ecx
push edx
lea eax, [esp + 0x14]
push str._d._d._d._d
push eax
call fcn.004ed7f9
add esp, 0x18
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x38]
call fcn.004091c0
jmp 0x4b6bd3
lea ecx, [esi + 0x38]
call fcn.00407610
mov ecx, dword [esp + 0xcc]
mov byte [esi + 0x60], 0
pop esi
xor ecx, esp
call fcn.004ec47e
add esp, 0xcc
ret

Function at 0x4b6c70
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x50cde3
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x5894dc]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.004b7540
xor ebx, ebx
lea ecx, [esi + 8]
mov dword [esp + 0x18], ebx
mov dword [esi], 0x5583f4
call fcn.00408020
lea ecx, [esi + 0x38]
mov byte [esp + 0x18], 1
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
call fcn.00408020
mov byte [esi + 0x60], bl
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x4b6f10
Capabilities:
Check for time delay via gettickcount
Create thread

Disassembly:
mov eax, dword [esp + 0x24]
push ebp
mov ebp, dword [esp + 8]
push esi
mov esi, ecx
mov ecx, dword [esp + 0x30]
push edi
mov byte [eax], 0
mov byte [ecx], 0
lea edi, [esi + 0x18]
push ebp
mov ecx, edi
call fcn.004091c0
mov edx, dword [esp + 0x14]
push 0x510649
push str.http:__
mov ecx, edi
mov dword [esi + 0x40], edx
call fcn.004087f0
push 0x510649
push str.https:__
mov ecx, edi
call fcn.004087f0
push 0x2f
mov ecx, edi
call fcn.004074f0
push 0x3a
mov ecx, edi
call fcn.004074f0
mov ecx, edi
call fcn.00407400
mov ecx, edi
call fcn.0046fb80
test eax, eax
jne 0x4b6fa8
mov esi, dword [esp + 0x20]
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
push str.Invalid_hostname_for_resolving_hostname_to_IP_address.
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
push ebp
push str.hostname
mov ecx, esi
call edx
pop edi
pop esi
xor al, al
pop ebp
ret 0x28
push ebx
mov ecx, edi
call fcn.004e81e0
mov edi, dword [esp + 0x28]
test edi, edi
mov ebx, eax
je 0x4b6fc7
push ebx
push str.HostnameResolveIpv6
mov ecx, edi
call fcn.0044e7a0
mov ebp, dword [esp + 0x20]
test ebp, ebp
je 0x4b70eb
test edi, edi
je 0x4b70eb
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
mov dword [esi + 0x48], ecx
push 0x3e9
mov ecx, esi
mov dword [esi + 0xc], ebp
mov dword [esi + 0x10], edi
mov byte [esi + 8], 1
mov dword [esi + 0x44], eax
mov byte [esi + 0x4c], 0
call fcn.004b75a0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea edx, [esp + 0x14]
push edx
push 0
push esi
push 0x4b6ea0
push 0
push 0
mov dword [esp + 0x44], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x24]
mov eax, dword [ecx]
mov edx, dword [eax + 0x14]
push str.Resolving_domain_name__IPV4_IPV6_...
call edx
xor eax, eax
xor ebx, ebx
cmp byte [esi + 8], al
jne 0x4b7054
mov al, byte [esi + 0x4c]
pop ebx
pop edi
pop esi
pop ebp
ret 0x28
mov eax, dword [esp + 0x30]
add eax, 1
cmp eax, 0xc8
mov dword [esp + 0x30], eax
jle 0x4b7066
push 0xa
jmp 0x4b7068
push 2
call fcn.0041e160
add ebx, 1
add esp, 4
cmp ebx, ebp
jb 0x4b70ab
push 0x74
push ebp
mov ecx, edi
xor ebx, ebx
call fcn.0044e7f0
mov ecx, edi
call fcn.0044e700
test al, al
jne 0x4b70bb
cmp dword [esp + 0x1c], 0
je 0x4b70ab
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x2c]
cmp eax, ecx
jbe 0x4b70ab
sub eax, ecx
cmp eax, dword [esp + 0x1c]
ja 0x4b70db
cmp byte [esi + 8], 0
jne 0x4b7050
mov al, byte [esi + 0x4c]
pop ebx
pop edi
pop esi
pop ebp
ret 0x28
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x24]
mov byte [eax], 1
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
push str.DNS_lookup_aborted_by_application_callback
call eax
pop ebx
pop edi
pop esi
xor al, al
pop ebp
ret 0x28
mov ecx, dword [esp + 0x38]
pop ebx
pop edi
pop esi
mov byte [ecx], 1
xor al, al
pop ebp
ret 0x28
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x2c]
push edx
mov edx, dword [esp + 0x1c]
push eax
push ecx
push edx
push ebx
call fcn.0045a330
add esp, 0x14
pop ebx
pop edi
pop esi
pop ebp
ret 0x28
Function at 0x4b8930
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x50d0fe
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5894dc]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
call fcn.004230e0
xor eax, eax
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], eax
mov dword [esi], 0x558790
mov byte [esi + 0x10], al
mov byte [esi + 0x11], 1
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
call fcn.00404230
lea ecx, [esi + 0x50]
mov byte [esp + 0x14], 1
call fcn.00408020
lea ecx, [esi + 0x78]
mov byte [esp + 0x14], 2
call fcn.004d6d00
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x4bedc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x50e6d8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x5894dc]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
lea ecx, [esp + 8]
call fcn.00404230
mov ecx, dword [esp + 0x38]
lea eax, [esp + 8]
push eax
push ecx
mov dword [esp + 0x38], 0
call fcn.0047a670
add esp, 8
lea ecx, [esp + 8]
call fcn.0046fb70
push eax
lea ecx, [esp + 0xc]
call fcn.004e81e0
push eax
call fcn.004bec50
add esp, 8
lea ecx, [esp + 8]
mov esi, eax
mov dword [esp + 0x30], 0xffffffff
call fcn.00404a00
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret
Function at 0x4bff40
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x50d7b3
mov eax, dword fs:[0]
push eax
sub esp, 0x88
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5894dc]
xor eax, esp
push eax
lea eax, [esp + 0x9c]
mov dword fs:[0], eax
mov eax, dword [esp + 0xc0]
mov ecx, eax
shr ecx, 0x18
mov byte [esp + 0x14], cl
mov ecx, eax
shr ecx, 8
mov edx, eax
shr edx, 0x10
mov byte [esp + 0x16], cl
lea ecx, [esp + 0x7c]
mov byte [esp + 0x15], dl
mov byte [esp + 0x17], al
call fcn.00404230
mov edx, dword [esp + 0xb8]
mov eax, dword [esp + 0xb4]
push edx
push eax
lea ecx, [esp + 0x84]
mov dword [esp + 0xac], 0
call fcn.004050c0
push 4
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x84]
call fcn.004050c0
lea ecx, [esp + 0x5c]
call fcn.00404230
lea ecx, [esp + 0x3c]
mov byte [esp + 0xa4], 1
call fcn.00404230
lea ecx, [esp + 0x1c]
mov byte [esp + 0xa4], 2
call fcn.00404230
mov ebx, dword [esp + 0xc4]
mov eax, dword [esp + 0xb0]
mov ecx, dword [esp + 0xac]
lea edx, [esp + 0x1c]
push edx
push ebx
push eax
push ecx
lea ecx, [esp + 0x8c]
mov byte [esp + 0xb4], 3
call fcn.0046fb70
push eax
lea ecx, [esp + 0x90]
call fcn.004e81e0
push eax
call fcn.004ab490
add esp, 0x18
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x40]
call fcn.004058a0
lea ecx, [esp + 0x1c]
call fcn.0046fb70
mov esi, eax
mov eax, dword [esp + 0xc8]
cmp esi, eax
jbe 0x4c006e
mov esi, eax
lea ecx, [esp + 0x1c]
call fcn.004e81e0
mov ebp, eax
mov eax, dword [esp + 0xbc]
cmp eax, 1
jbe 0x4c0109
add eax, 0xffffffff
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0xb0]
mov edx, dword [esp + 0xac]
lea eax, [esp + 0x5c]
push eax
push ebx
push ecx
push edx
lea ecx, [esp + 0x4c]
call fcn.0046fb70
push eax
lea ecx, [esp + 0x50]
call fcn.004e81e0
push eax
call fcn.004ab490
add esp, 0x18
lea ecx, [esp + 0x5c]
call fcn.004e81e0
test esi, esi
jbe 0x4c00e2
mov ecx, ebp
sub eax, ebp
mov edi, esi
mov dl, byte [eax + ecx]
xor byte [ecx], dl
add ecx, 1
sub edi, 1
jne 0x4c00d5
lea ecx, [esp + 0x3c]
call fcn.00404150
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x40]
call fcn.004058a0
lea ecx, [esp + 0x5c]
call fcn.00404150
sub dword [esp + 0x18], 1
jne 0x4c0090
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0xd0]
call fcn.004058a0
lea ecx, [esp + 0x1c]
mov byte [esp + 0xa4], 2
call fcn.00404a00
lea ecx, [esp + 0x3c]
mov byte [esp + 0xa4], 1
call fcn.00404a00
lea ecx, [esp + 0x5c]
mov byte [esp + 0xa4], 0
call fcn.00404a00
lea ecx, [esp + 0x7c]
mov dword [esp + 0xa4], 0xffffffff
call fcn.00404a00
mov ecx, dword [esp + 0x9c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x94
ret
Function at 0x4c25e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5056e8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x5894dc]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 8]
call fcn.00408020
mov eax, dword [esp + 0x40]
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x3c], 0
call fcn.00407b70
lea ecx, [esp + 8]
call fcn.00407400
push 0x510649
push str.http:__
lea ecx, [esp + 0x10]
call fcn.004087f0
push 0x2f
lea ecx, [esp + 0xc]
call fcn.004092d0
lea ecx, [esp + 8]
add esi, 8
call fcn.004e81e0
push eax
mov ecx, esi
call fcn.004e08d0
mov ecx, eax
add ecx, 0x158
call fcn.004091c0
mov ecx, esi
call fcn.004e08d0
mov ecx, dword [esp + 0x44]
mov dword [eax + 0x180], ecx
lea ecx, [esp + 8]
mov dword [esp + 0x38], 0xffffffff
call fcn.00408310
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x34
ret 8

Function at 0x4c26f0
Capabilities:
Access peb ldr_data

Disassembly:
add ecx, 0x40
jmp 0x4c26f0
push 0xffffffffffffffff
push 0x5056e8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x5894dc]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 8]
call fcn.00408020
mov eax, dword [esp + 0x40]
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x3c], 0
call fcn.00407b70
lea ecx, [esp + 8]
call fcn.00407400
lea ecx, [esp + 8]
call fcn.00408eb0
push 0x20
lea ecx, [esp + 0xc]
call fcn.004092d0
push 0x2e
lea ecx, [esp + 0xc]
call fcn.004092d0
push str.ssl30
lea ecx, [esp + 0xc]
call fcn.004095a0
test al, al
je 0x4c277c
mov dword [esi + 0x5c], 0
mov byte [esi + 0x60], 1
jmp 0x4c27a6
push str.tls10
lea ecx, [esp + 0xc]
call fcn.004095a0
test al, al
je 0x4c279b
mov eax, 1
mov dword [esi + 0x5c], eax
mov byte [esi + 0x60], al
jmp 0x4c27a6
mov dword [esi + 0x5c], 1
mov byte [esi + 0x60], 0
lea ecx, [esp + 8]
mov dword [esi + 0x58], 3
mov dword [esp + 0x38], 0xffffffff
call fcn.00408310
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x34
ret 4
Function at 0x4cd9d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x50e6d8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x5894dc]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
lea ecx, [esp + 8]
call fcn.00404230
mov edx, dword [esp + 0x38]
mov eax, edx
mov dword [esp + 0x30], 0
lea esi, [eax + 1]
mov edi, edi
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4cda10
sub eax, esi
push eax
push edx
lea ecx, [esp + 0x10]
call fcn.004050c0
mov eax, dword [esp + 0x3c]
push eax
lea ecx, [esp + 0xc]
push ecx
call fcn.004cd880
add esp, 8
lea ecx, [esp + 8]
mov dword [esp + 0x30], 0xffffffff
call fcn.00404a00
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret
Function at 0x4d1740
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [ecx + 0x404]
mov edx, dword [ecx + 0x408]
push esi
mov esi, dword [esp + 0x14]
test esi, esi
jle 0x4d17b4
push ebp
mov ebp, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x18]
sub ebp, edi
mov dword [esp + 0x14], esi
add al, 1
movzx esi, al
mov eax, dword [ecx + esi*4 + 4]
add dl, al
mov dword [esp + 0x18], eax
movzx eax, dl
mov edx, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov eax, dword [ecx + eax*4 + 4]
mov dword [ecx + esi*4 + 4], eax
add al, dl
mov dword [esp + 0xc], esi
mov esi, dword [esp + 0x1c]
movzx eax, al
mov dword [ecx + esi*4 + 4], edx
mov dl, byte [ecx + eax*4 + 4]
xor dl, byte [edi + ebp]
mov eax, dword [esp + 0xc]
mov byte [edi], dl
add edi, 1
sub dword [esp + 0x14], 1
mov edx, esi
jne 0x4d1766
pop edi
pop ebp
mov dword [ecx + 0x408], edx
mov dword [ecx + 0x404], eax
pop esi
pop ecx
ret 0xc

Function at 0x4d1a30
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0x10]
cmp esi, 0x80
mov ebp, ecx
jbe 0x4d1a47
pop esi
xor al, al
pop ebp
ret 0xc
push ebx
mov ebx, dword [esp + 0x18]
test ebx, ebx
push edi
jne 0x4d1a56
mov ebx, 0x400
mov eax, dword [esp + 0x14]
push esi
push eax
lea edi, [ebp + 4]
push edi
call fcn.004ed460
add esp, 0xc
cmp esi, 0x80
jae 0x4d1aa2
movzx eax, byte [esi + ebp + 3]
mov ecx, edi
jmp 0x4d1a80
movzx edx, byte [ecx]
add edx, eax
and edx, 0xff
mov al, byte [edx + 0x55eac8]
mov byte [edi + esi], al
add esi, 1
add ecx, 1
cmp esi, 0x80
jb 0x4d1a80
lea edx, [ebx + 7]
shr edx, 3
mov ecx, ebx
neg ecx
mov eax, 0x80
and ecx, 7
sub eax, edx
lea esi, [eax + ebp + 4]
mov edi, 0xff
sar edi, cl
movzx ecx, byte [esi]
and edi, ecx
test eax, eax
mov cl, byte [edi + 0x55eac8]
mov byte [esi], cl
je 0x4d1aee
movzx edi, byte [esi + edx - 1]
sub esi, 1
movzx ecx, cl
xor edi, ecx
mov cl, byte [edi + 0x55eac8]
sub eax, 1
test eax, eax
mov byte [esi], cl
jne 0x4d1ad2
pop edi
mov ecx, 0x3f
lea eax, [ebp + 0x82]
pop ebx
jmp 0x4d1b00
movzx dx, byte [eax + 1]
movzx si, byte [eax]
shl dx, 8
add dx, si
mov word [eax], dx
mov edx, ecx
sub ecx, 1
sub eax, 2
test edx, edx
jne 0x4d1b00
pop esi
mov al, 1
pop ebp
ret 0xc