joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a42ec
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [esi + 0x110]
cmp byte [eax + 0x4c], 0
jne 0x4a4320
mov edi, ecx
dec edi
test edi, edi
jl 0x4a4331
inc edi
mov eax, esi
call fcn.004a42d0
xor byte [ebx], al
movzx edx, byte [ebx]
mov eax, esi
call fcn.004a4278
inc ebx
dec edi
jne 0x4a4307
jmp 0x4a4331
lea eax, [esi + 0x3bc]
push eax
push ecx
push ebx
call fcn.0049bedc
add esp, 0xc
pop edi
pop esi
pop ebx
ret

Function at 0x4a43c8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00405780
xor eax, eax
push ebp
push 0x4a443e
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.004a4338
mov dword [ebp - 8], 0xc
lea esi, [ebp - 0x14]
mov eax, edi
call fcn.004a42d0
mov ebx, eax
xor bl, byte [esi]
mov edx, ebx
mov eax, edi
call fcn.004a4278
mov byte [esi], bl
inc esi
dec dword [ebp - 8]
jne 0x4a4408
movzx ebx, byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a4445
lea eax, [ebp - 4]
call fcn.00405300
ret
Function at 0x4a51f4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4a53e3
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
jle 0x4a539f
mov eax, dword [ebp - 4]
call fcn.004a6a80
cmp ebx, eax
jge 0x4a539f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x118]
mov edx, ebx
call fcn.00497fe4
mov edx, dword [0x499900]
call fcn.00404570
mov esi, eax
mov eax, esi
call fcn.0049aaec
test al, al
je 0x4a5395
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov eax, dword [esi + 0x50]
test eax, eax
je 0x4a5276
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4a5388
xor eax, eax
push ebp
push 0x4a5381
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004a5758
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
call fcn.0041dba0
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push dword [esi + 0x34]
push dword [esi + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
lea edx, [ebp - 0x46]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, 0x2e
mov esi, dword [eax]
call dword [esi + 0xc]
movzx eax, word [ebp - 0x2a]
movzx edx, word [ebp - 0x28]
add eax, edx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x18]
movzx esi, word [ebp - 0x26]
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.00405a20
mov eax, dword [ebp - 8]
call fcn.004057f0
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, esi
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
movzx eax, byte [eax + 0x28]
mov byte [ebp - 9], al
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004a5570
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
movzx edx, byte [ebp - 9]
mov byte [eax + 0x28], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a53cd
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
jne 0x4a5380
mov eax, dword [ebp - 4]
call fcn.004a57dc
ret
mov eax, dword [ebp - 8]
mov edx, dword [esi + 0x50]
call fcn.00405354
jmp 0x4a53cd
mov eax, dword [ebp - 8]
call fcn.00405300
jmp 0x4a53cd
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x4c], 0
lea eax, [ebp - 0x50]
push eax
push 0
lea edx, [ebp - 0x54]
mov eax, 0xb3
call fcn.0040a01c
mov ecx, dword [ebp - 0x54]
mov dl, 1
mov eax, dword [0x417e5c]
call fcn.0040dc78
call fcn.00404c34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a53ea
lea eax, [ebp - 0x54]
call fcn.00405300
ret
Function at 0x4ab6f0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x410038]
call fcn.00405dc8
xor eax, eax
push ebp
push 0x4ab891
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x52ee04], 0
jne 0x4ab74b
mov ecx, dword [0x5324f4]
mov dl, 1
mov eax, dword [0x408870]
call fcn.0040dcf8
call fcn.00404c34
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x10
call fcn.00403b78
mov eax, ebx
call fcn.00405c98
mov dword [ebp - 0x24], eax
mov esi, 0x4ab8a0
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.00406da0
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.00405ca8
test eax, eax
jle 0x4ab834
mov dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4ab820
lea eax, [ebp - 0x4c]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00405570
mov edi, dword [ebp - 0x4c]
test edi, edi
je 0x4ab7c6
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x50]
mov edx, ebx
call fcn.00405588
mov esi, dword [ebp - 0x50]
test esi, esi
je 0x4ab7dc
sub esi, 4
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x54]
mov edx, ebx
call fcn.00405588
mov eax, dword [ebp - 0x54]
call fcn.00405790
push eax
push edi
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00405570
mov eax, dword [ebp - 0x58]
call fcn.00405790
push eax
push 1
push 0x400
call sub.kernel32.dll_CompareStringA_1
sub eax, 2
test eax, eax
sete al
jmp 0x4ab822
xor eax, eax
test al, al
je 0x4ab82d
mov ebx, 0x15
jmp 0x4ab839
mov ebx, 0x10
jmp 0x4ab839
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x28]
push eax
push ebx
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [0x52ee04]
call fcn.004ab570
mov eax, dword [ebp - 4]
call fcn.004ab570
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.00406db8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ab898
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.00405324
lea eax, [ebp - 0xc]
mov edx, dword [0x410038]
call fcn.00405e98
ret
Function at 0x4af014
Capabilities:
Hide graphical window

Disassembly:
push ebx
add esp, 0xfffffff0
mov ebx, eax
mov eax, ebx
call fcn.004aea74
test byte [ebx + 0x285], 4
jne 0x4af0a9
mov edx, esp
mov eax, ebx
call fcn.00451d5c
push esp
mov eax, ebx
call fcn.0045a2b4
push eax
push 0
mov eax, ebx
test eax, eax
je 0x4af049
sub eax, 0xfffffd34
push eax
push 0
push 0xfffffffffffffffb
mov eax, dword [ebx + 0x260]
push eax
mov eax, dword [eax]
call dword [eax + 0x2c]
cmp dword [ebx + 0x274], 0
jne 0x4af07a
mov ecx, dword [0x532890]
mov dl, 1
mov eax, dword [0x4ab22c]
call fcn.0040dcf8
call fcn.00404c34
mov eax, ebx
call fcn.004af5ec
cmp byte [ebx + 0x57], 0
jne 0x4af0b0
mov eax, ebx
call fcn.0045a4c4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4af0b0
push 0
mov eax, ebx
call fcn.0045a4c4
push eax
call sub.user32.dll_ShowWindow
jmp 0x4af0b0
mov eax, ebx
call fcn.00456720
add esp, 0x10
pop ebx
ret

Function at 0x4bc124
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.0042bab4
cmp ebx, dword [ebp - 8]
jge 0x4bc187
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.0042bf2c
mov edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.0042bf2c
xor edi, eax
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.0042bf58
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x4bc14d
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4bc190
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.0042bab4
cmp ebx, dword [ebp - 8]
jge 0x4bc1f3
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.0042bf2c
mov edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.0042bf2c
xor edi, eax
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.0042bf58
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x4bc1b9
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4dd970
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4dd99e
mov eax, ebx
call fcn.004de424
cmp dword [ebx + 0x40], 0
je 0x4dd997
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4dda0f
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4dda01
cmp dword [ebx + 8], 0
je 0x4dd9c0
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4dd9d2
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4dda01
cmp dword [ebx + 8], 0
je 0x4dd9b3
cmp eax, 3
je 0x4dd9e5
dec eax
jne 0x4dd9b3
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4dd9b3
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4dd9b3
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4dda2d
cmp dword [ebx + 0x14], 0xcc
je 0x4dda2d
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004dda38
pop ebx
ret

Function at 0x4f2334
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405780
mov eax, dword [ebp - 8]
call fcn.00405780
xor eax, eax
push ebp
push 0x4f23ff
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 0x14
mov dword [ebp - 0x1c], 0x14
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 3
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x3c], 3
mov dword [ebp - 0x34], 2
mov eax, dword [ebp - 8]
call fcn.00405790
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 3
mov eax, 0x4f240c
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
call fcn.00405790
push eax
call sub.wininet.dll_InternetOpenA
mov ebx, eax
push esi
lea eax, [ebp - 0x1c]
push eax
push 0x4b
push ebx
call sub.wininet.dll_InternetSetOptionA
push 0
push 0
push 0x25
push ebx
call sub.wininet.dll_InternetSetOptionA
push ebx
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f2406
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405324
ret
Function at 0x4f2414
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405780
mov eax, dword [ebp - 8]
call fcn.00405780
mov eax, dword [ebp - 0xc]
call fcn.00405780
mov eax, dword [ebp + 0xc]
call fcn.00405780
xor eax, eax
push ebp
push 0x4f2521
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 0x14
mov dword [ebp - 0x20], 0x14
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 3
mov dword [ebp - 0x44], 1
mov dword [ebp - 0x40], 3
mov dword [ebp - 0x38], 2
mov eax, dword [ebp - 8]
call fcn.00405790
mov edi, eax
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x2c], 3
mov eax, 0x4f2534
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
call fcn.00405790
push eax
call sub.wininet.dll_InternetOpenA
mov ebx, eax
push 0
push 0
push 3
mov eax, dword [ebp + 0xc]
call fcn.00405790
push eax
mov eax, dword [ebp - 0xc]
call fcn.00405790
push eax
movzx eax, word [ebp + 8]
push eax
push edi
push ebx
call sub.wininet.dll_InternetConnectA
push esi
lea eax, [ebp - 0x20]
push eax
push 0x4b
push ebx
call sub.wininet.dll_InternetSetOptionA
push 0
push 0
push 0x25
push ebx
call sub.wininet.dll_InternetSetOptionA
push ebx
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f2528
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405324
lea eax, [ebp + 0xc]
call fcn.00405300
ret

Function at 0x4f6238
Capabilities:
Get geographical location

Disassembly:
add esp, 0xfffffff4
mov eax, esp
xor ecx, ecx
mov edx, 0xa
call fcn.00403b78
push 0xa
lea eax, [esp + 4]
push eax
push 0xd
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
cmp byte [esp], 0x31
jne 0x4f6266
mov al, 1
jmp 0x4f6268
xor eax, eax
add esp, 0xc
ret
Function at 0x4fa694
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
mov byte [ebp - 1], 0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4fa74b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.00405790
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jne 0x4fa6d6
call fcn.00404ce0
jmp 0x4fa752
mov eax, ebx
call fcn.00402fcc
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push ebx
push 0
mov eax, esi
call fcn.00405790
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
jne 0x4fa6ff
call fcn.00404ce0
jmp 0x4fa752
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4fa760
mov eax, dword [ebp - 8]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
jne 0x4fa720
call fcn.00404ce0
jmp 0x4fa752
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
mov dword [edi], eax
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fa752
mov eax, dword [ebp - 8]
call fcn.00402fe8
ret
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x500b28
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 4], 5
ja 0x500b54
cmp dword [esp + 4], 5
jne 0x500b50
cmp dword [esp + 8], 1
jae 0x500b54
xor eax, eax
jmp 0x500b56
mov al, 1
mov byte [0x539028], al
add esp, 0x94
ret
Function at 0x514110
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd44
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x29c], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405780
xor eax, eax
push ebp
push 0x51425a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x198]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
xor ecx, ecx
push ebp
push 0x514232
push dword fs:[ecx]
mov dword fs:[ecx], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x298]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x298]
mov edx, dword [ebp - 4]
call fcn.0040aa90
lea eax, [ebp - 0x298]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x51421b
mov edx, dword [eax + 0xc]
test edx, edx
je 0x514215
mov ebx, dword [edx]
test ebx, ebx
je 0x51420f
lea eax, [ebp - 0x29c]
push eax
movzx eax, byte [ebx]
mov dword [ebp - 0x2bc], eax
mov byte [ebp - 0x2b8], 0
movzx eax, byte [ebx + 1]
mov dword [ebp - 0x2b4], eax
mov byte [ebp - 0x2b0], 0
movzx eax, byte [ebx + 2]
mov dword [ebp - 0x2ac], eax
mov byte [ebp - 0x2a8], 0
movzx eax, byte [ebx + 3]
mov dword [ebp - 0x2a4], eax
mov byte [ebp - 0x2a0], 0
lea edx, [ebp - 0x2bc]
mov ecx, 3
mov eax, 0x514274
call fcn.0040b100
mov edx, dword [ebp - 0x29c]
mov eax, esi
call fcn.00405354
mov byte [ebp - 5], 1
jmp 0x51421f
mov byte [ebp - 5], 0
jmp 0x51421f
mov byte [ebp - 5], 0
jmp 0x51421f
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x514239
call sub.wsock32.dll_WSACleanup
ret
Function at 0x516010
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, eax
mov ebp, edx
xor ebx, ebx
xor edi, edi
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
test eax, eax
jle 0x5160aa
movzx edx, byte [esi + ebx]
shr edx, 2
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi], dl
movzx edx, byte [esi + ebx]
and dl, 3
movzx edx, dl
shl edx, 4
movzx ecx, byte [esi + ebx + 1]
shr ecx, 4
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
push edx
pop edx
mov byte [ebp + edi + 1], dl
movzx edx, byte [esi + ebx + 1]
and dl, 0xf
movzx edx, dl
add edx, edx
add edx, edx
movzx ecx, byte [esi + ebx + 2]
shr ecx, 6
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
push edx
pop edx
mov byte [ebp + edi + 2], dl
movzx edx, byte [esi + ebx + 2]
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi + 3], dl
add edi, 4
add ebx, 3
dec eax
jne 0x51602f
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
dec edx
je 0x5160c0
dec edx
je 0x5160f5
jmp 0x516146
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi + 1], al
mov byte [ebp + edi + 2], 0x3d
mov byte [ebp + edi + 3], 0x3d
jmp 0x516146
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx edx, byte [esi + ebx + 1]
shr edx, 4
add eax, edx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi + 1], al
movzx eax, byte [esi + ebx + 1]
and al, 0xf
movzx eax, al
add eax, eax
add eax, eax
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi + 2], al
mov byte [ebp + edi + 3], 0x3d
mov eax, dword [esp]
add eax, 2
mov ecx, 3
cdq
idiv ecx
add eax, eax
add eax, eax
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5161b0
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov edi, eax
mov dword [esp + 8], edx
xor esi, esi
xor ebp, ebp
xor eax, eax
mov edx, dword [esp]
test edx, edx
jns 0x5161cf
add edx, 3
sar edx, 2
test edx, edx
jle 0x5162dd
mov dword [esp + 0xc], edx
mov edx, 4
lea eax, [esp + 4]
movzx ecx, byte [edi + esi]
cmp ecx, 0x3d
jg 0x516204
je 0x516247
sub ecx, 0x2b
je 0x51623d
sub ecx, 4
je 0x516242
dec ecx
sub ecx, 0xa
jb 0x51622f
jmp 0x51624a
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x516216
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x516221
jmp 0x51624a
movzx ecx, byte [edi + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x51624a
movzx ecx, byte [edi + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x51624a
movzx ecx, byte [edi + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x51624a
mov byte [eax], 0x3e
jmp 0x51624a
mov byte [eax], 0x3f
jmp 0x51624a
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x5161e7
movzx eax, byte [esp + 4]
add eax, eax
add eax, eax
movzx edx, byte [esp + 5]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp], al
lea eax, [ebp + 1]
movzx edx, byte [esp + 6]
cmp dl, 0xff
je 0x51629b
cmp byte [esp + 7], 0xff
jne 0x51629b
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
lea eax, [ebp + 2]
inc ebp
jmp 0x5162d2
cmp dl, 0xff
je 0x5162d2
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
mov eax, dword [esp + 8]
movzx edx, byte [esp + 6]
shl edx, 6
or dl, byte [esp + 7]
mov byte [eax + ebp + 2], dl
lea eax, [ebp + 3]
add ebp, 2
inc ebp
dec dword [esp + 0xc]
jne 0x5161de
add esp, 0x10
pop ebp
pop edi
pop esi
ret
Function at 0x518464
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
cmp byte [ebx + 0x30], 0
jne 0x51848e
mov ecx, 0x5184f0
mov dl, 1
mov eax, dword [0x517a8c]
call fcn.0040dc3c
call fcn.00404c34
mov dword [ebp - 8], edx
mov esi, dword [ebp - 4]
mov eax, dword [ebp + 8]
test eax, eax
jle 0x5184dd
mov dword [ebp - 0xc], eax
mov ecx, dword [ebx + 0x40]
mov edx, dword [ebx + 0x3c]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x60]
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
mov edx, dword [ebx + 0x40]
xor al, byte [edx]
mov byte [esi], al
mov ecx, dword [ebx + 0x44]
dec ecx
mov edx, dword [ebx + 0x3c]
mov eax, dword [ebx + 0x3c]
inc eax
call fcn.004032e8
mov eax, dword [ebx + 0x3c]
add eax, dword [ebx + 0x44]
dec eax
movzx edx, byte [esi]
mov byte [eax], dl
inc dword [ebp - 8]
inc esi
dec dword [ebp - 0xc]
jne 0x51849e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x518508
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
cmp byte [ebx + 0x30], 0
jne 0x518532
mov ecx, 0x51859c
mov dl, 1
mov eax, dword [0x517a8c]
call fcn.0040dc3c
call fcn.00404c34
mov esi, edx
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
test eax, eax
jle 0x51858a
mov dword [ebp - 0x10], eax
movzx eax, byte [esi]
mov byte [ebp - 9], al
mov ecx, dword [ebx + 0x40]
mov edx, dword [ebx + 0x3c]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x60]
mov eax, dword [ebx + 0x40]
movzx eax, byte [eax]
xor al, byte [esi]
mov edx, dword [ebp - 8]
mov byte [edx], al
mov ecx, dword [ebx + 0x44]
dec ecx
mov edx, dword [ebx + 0x3c]
mov eax, dword [ebx + 0x3c]
inc eax
call fcn.004032e8
mov eax, dword [ebx + 0x3c]
add eax, dword [ebx + 0x44]
dec eax
movzx edx, byte [ebp - 9]
mov byte [eax], dl
inc esi
inc dword [ebp - 8]
dec dword [ebp - 0x10]
jne 0x518544
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x518b58
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x518bda
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x517db0]
mov eax, 0x14
call fcn.00406208
mov edi, eax
mov dword [edi + 0xc], esi
lea edx, [ebp - 8]
mov eax, esi
call dword [eax + 0x34]
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00409638
mov edx, dword [ebp - 4]
lea eax, [edi + 4]
call fcn.00405354
mov eax, esi
call dword [eax + 0x30]
mov dword [edi + 8], eax
mov eax, dword [0x539464]
mov dword [edi], eax
mov byte [edi + 0x10], bl
mov dword [0x539464], edi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x518be1
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405324
ret