joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e4454
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
xor ebx, ebx
mov esi, ecx
push edi
mov edi, edx
mov dword [esp + 0x24], esi
mov edx, ebx
mov dword [esp + 0x10], edx
test edi, edi
je 0x4e44a5
mov ebp, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
sub ebp, edx
cmp dword [esi + 0x80], 0x40
jae 0x4e44a1
mov ecx, dword [esi + 0x80]
mov al, byte [edx + ebp]
xor al, byte [ecx + esi + 0x40]
mov byte [edx], al
inc dword [esi + 0x80]
inc dword [esp + 0x10]
inc edx
sub edi, 1
jne 0x4e4479
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x30]
lea eax, [esi + 0x40]
cmp edi, 0x40
jb 0x4e4574
lea eax, [esi + 0x41]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x2c]
mov ebp, eax
add eax, 3
sub ebp, ecx
add eax, edx
inc ecx
mov dword [esp + 0x14], eax
add ecx, edx
mov eax, edi
mov dword [esp + 0x18], ecx
shr eax, 6
mov dword [esp + 0x1c], eax
shl eax, 6
add edx, eax
mov dword [esp + 0x10], edx
lea edx, [esi + 0x40]
mov ecx, esi
call fcn.004e4182
inc dword [esi + 0x30]
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push 8
pop ebx
mov al, byte [edx - 3]
xor al, byte [esi - 1]
mov byte [ecx - 1], al
mov al, byte [ecx + ebp]
xor al, byte [esi]
lea esi, [esi + 8]
mov byte [ecx], al
mov al, byte [edx - 1]
xor al, byte [esi - 7]
mov byte [ecx + 1], al
mov al, byte [esi - 6]
xor al, byte [edx]
mov byte [ecx + 2], al
mov al, byte [edx + 1]
xor al, byte [esi - 5]
mov byte [ecx + 3], al
mov al, byte [edx + 2]
xor al, byte [esi - 4]
mov byte [ecx + 4], al
mov al, byte [edx + 3]
xor al, byte [esi - 3]
mov byte [ecx + 5], al
mov al, byte [edx + 4]
add edx, 8
xor al, byte [esi - 2]
mov byte [ecx + 6], al
add ecx, 8
sub ebx, 1
jne 0x4e4502
mov esi, dword [esp + 0x24]
sub edi, 0x40
sub dword [esp + 0x1c], 1
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], ecx
jne 0x4e44e6
lea eax, [esi + 0x40]
jmp 0x4e457a
mov ebp, dword [esp + 0x2c]
sub ebp, ecx
test edi, edi
je 0x4e45a9
mov edx, eax
mov ecx, esi
call fcn.004e4182
mov edx, dword [esp + 0x10]
inc dword [esi + 0x30]
add edx, dword [esp + 0x30]
lea ecx, [edx + ebx]
mov al, byte [ecx + ebp]
xor al, byte [esi + ebx + 0x40]
inc ebx
mov byte [ecx], al
cmp ebx, edi
jb 0x4e4592
mov dword [esi + 0x80], edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret

Function at 0x4e460a
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push esi
push edi
mov esi, ecx
xor edi, edi
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
push 0x38
pop ecx
sub ecx, edi
call fcn.0054e830
xor byte [esi], al
add edi, 8
inc esi
cmp edi, 0x40
jb 0x4e4610
pop edi
pop esi
ret
Function at 0x4e652a
Capabilities:
Encrypt data using camellia

Disassembly:
push ebx
mov ebx, dword [ecx]
mov ecx, dword [ecx + 4]
xor ecx, dword [edx + 4]
xor ebx, dword [edx]
mov eax, ecx
shr eax, 0x18
push esi
push edi
movzx esi, byte [eax + 0x5780a0]
mov eax, ecx
shr eax, 0x10
movzx eax, al
movzx edi, byte [eax + 0x577fa0]
mov eax, esi
shl eax, 8
or edi, eax
mov eax, ecx
shr eax, 8
movzx eax, al
shl edi, 8
movzx eax, byte [eax + 0x577d40]
or edi, eax
movzx eax, cl
shl edi, 8
mov ecx, dword [esp + 0x10]
movzx eax, byte [eax + 0x577ea0]
or edi, eax
mov eax, ebx
shr eax, 0x18
movzx edx, byte [eax + 0x577ea0]
mov eax, ebx
shr eax, 0x10
movzx eax, al
shl edx, 8
movzx eax, byte [eax + 0x5780a0]
or edx, eax
mov eax, ebx
shr eax, 8
movzx eax, al
shl edx, 8
movzx eax, byte [eax + 0x577fa0]
or edx, eax
movzx eax, bl
shl edx, 8
movzx eax, byte [eax + 0x577d40]
or edx, eax
mov eax, edi
shl eax, 8
or eax, esi
xor edx, eax
mov eax, edx
ror eax, 0x10
xor edi, eax
mov eax, edi
ror eax, 8
xor edx, eax
xor dword [ecx + 4], edx
mov eax, edx
ror eax, 8
xor eax, dword [ecx]
xor eax, edi
pop edi
pop esi
mov dword [ecx], eax
pop ebx
ret
Function at 0x4e7021
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [0x5c9040]
xor eax, esp
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x2c]
push ebx
mov ebx, dword [esp + 0x34]
push esi
mov esi, dword [esp + 0x3c]
push edi
mov edi, edx
mov dword [esp + 0x14], ecx
mov edx, dword [esp + 0x34]
mov dword [esp + 0x10], eax
test dl, 0xf
je 0x4e7059
push 0xffffffffffffffda
pop eax
jmp 0x4e7115
test edx, edx
je 0x4e7113
push ebp
lea ebp, [edx - 1]
push 0x10
shr ebp, 4
test edi, edi
pop edi
jne 0x4e70c0
sub eax, esi
inc ebp
mov dword [esp + 0x10], eax
push edi
lea eax, [esp + 0x24]
push ebx
push eax
call fcn.0051c650
mov ecx, dword [esp + 0x24]
push esi
push ebx
call fcn.004e6de0
mov ecx, dword [esp + 0x24]
add esp, 0x14
mov edx, edi
mov al, byte [ecx + esi]
xor byte [esi], al
inc esi
sub edx, 1
jne 0x4e7096
push edi
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x1c]
call fcn.0051c650
sub dword [esp + 0x1c], edi
add esp, 0xc
add ebx, edi
sub ebp, 1
jne 0x4e7076
jmp 0x4e7112
mov ecx, esi
sub ebx, eax
sub ecx, eax
inc ebp
mov dword [esp + 0x10], ecx
mov edx, eax
mov dword [esp + 0x1c], edi
mov al, byte [ebx + edx]
xor al, byte [edx]
mov byte [edx + ecx], al
inc edx
sub edi, 1
jne 0x4e70d1
mov ecx, dword [esp + 0x18]
push esi
push esi
call fcn.004e6de0
push 0x10
pop edi
push edi
push esi
push dword [esp + 0x24]
call fcn.0051c650
mov ecx, dword [esp + 0x24]
add esp, 0x14
mov eax, dword [esp + 0x14]
add ecx, edi
add ebx, edi
mov dword [esp + 0x10], ecx
add esi, edi
sub ebp, 1
jne 0x4e70cb
pop ebp
xor eax, eax
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0051b034
add esp, 0x24
ret

Function at 0x4e7456
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [edx]
push esi
mov esi, dword [ebp + 8]
push edi
push 0x5782e0
push 0x5784e0
xor eax, dword [esi]
mov edi, ecx
mov dword [ebp + 8], eax
lea ecx, [ebp + 8]
mov eax, dword [edx + 4]
xor eax, dword [esi + 4]
mov dword [ebp - 4], eax
mov eax, dword [edx + 8]
xor eax, dword [esi + 8]
mov dword [ebp - 8], eax
mov eax, dword [edx + 0xc]
lea edx, [ebp - 4]
xor eax, dword [esi + 0xc]
push 0x5783e0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push str.cw
push eax
lea eax, [ebp - 8]
push eax
call fcn.004e7371
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 4]
lea ecx, [ebp + 8]
call fcn.004e726c
mov ecx, dword [ebp + 0xc]
add esp, 0x20
mov eax, dword [ecx]
xor eax, dword [ebp + 8]
mov dword [edi], eax
mov eax, dword [ecx + 4]
xor eax, dword [ebp - 4]
mov dword [edi + 4], eax
mov eax, dword [ecx + 8]
xor eax, dword [ebp - 8]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0xc]
xor eax, dword [ebp - 0xc]
mov dword [edi + 0xc], eax
pop edi
pop esi
leave
ret
Function at 0x4e74eb
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [edx]
push esi
mov esi, dword [ebp + 8]
push edi
push 0x5783e0
push str.cw
xor eax, dword [esi]
mov edi, ecx
mov dword [ebp + 8], eax
lea ecx, [ebp + 8]
mov eax, dword [edx + 4]
xor eax, dword [esi + 4]
mov dword [ebp - 4], eax
mov eax, dword [edx + 8]
xor eax, dword [esi + 8]
mov dword [ebp - 8], eax
mov eax, dword [edx + 0xc]
lea edx, [ebp - 4]
xor eax, dword [esi + 0xc]
push 0x5782e0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push 0x5784e0
push eax
lea eax, [ebp - 8]
push eax
call fcn.004e7371
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 4]
lea ecx, [ebp + 8]
call fcn.004e726c
mov ecx, dword [ebp + 0xc]
add esp, 0x20
mov eax, dword [ecx]
xor eax, dword [ebp + 8]
mov dword [edi], eax
mov eax, dword [ecx + 4]
xor eax, dword [ebp - 4]
mov dword [edi + 4], eax
mov eax, dword [ecx + 8]
xor eax, dword [ebp - 8]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0xc]
xor eax, dword [ebp - 0xc]
mov dword [edi + 0xc], eax
pop edi
pop esi
leave
ret

Function at 0x4e7580
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
movzx eax, byte [esp + 0x18]
push ebx
push ebp
mov bl, al
mov dword [esp + 8], edx
shr eax, 5
and bl, 0x1f
mov ebp, ecx
push esi
push edi
and eax, reloc.WS2_32.dll_closesocket
jns 0x4e75a6
dec eax
or eax, 0xfffffffc
inc eax
mov esi, dword [esp + 0x24]
movzx ecx, al
mov dword [esp + 0x14], eax
mov dword [esp + 0x28], 4
mov edx, dword [esi + ecx*4]
mov edi, edx
shl edi, 0x10
mov eax, edx
and eax, 0xff00
shr edx, 8
xor edi, eax
and edx, 0xff00
movzx eax, byte [esi + ecx*4 + 3]
shl edi, 8
xor edi, eax
movzx eax, bl
mov dword [esp + 0x1c], eax
xor edi, edx
mov al, 0x20
sub al, bl
neg bl
sbb bl, bl
and bl, al
sub dword [esp + 0x10], ebp
movzx eax, bl
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x18], eax
inc bl
and bl, 3
movzx edx, bl
mov ecx, dword [esi + edx*4]
mov esi, ecx
mov eax, ecx
shl esi, 0x10
and eax, 0xff00
shr ecx, 8
xor esi, eax
and ecx, 0xff00
mov eax, dword [esp + 0x24]
shl esi, 8
xor esi, ecx
mov ecx, dword [esp + 0x18]
movzx eax, byte [eax + edx*4 + 3]
xor esi, eax
mov eax, esi
shr eax, cl
mov ecx, dword [esp + 0x1c]
shl edi, cl
mov ecx, dword [esp + 0x10]
or eax, edi
bswap eax
mov edi, esi
mov esi, dword [esp + 0x24]
xor eax, dword [ecx + ebp]
sub dword [esp + 0x28], 1
mov dword [ebp], eax
lea ebp, [ebp + 4]
jne 0x4e75ff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x4e7c8d
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [0x5c9040]
xor eax, esp
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x2c]
push ebx
mov ebx, dword [esp + 0x34]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 8], eax
push esi
mov esi, dword [esp + 0x3c]
test cl, 0xf
je 0x4e7cc2
push 0xffffffffffffffa2
pop eax
jmp 0x4e7d82
test ecx, ecx
je 0x4e7d80
push ebp
push edi
lea ebp, [ecx - 1]
push 0x10
shr ebp, 4
pop edi
test edx, edx
jne 0x4e7d2b
sub eax, esi
inc ebp
mov dword [esp + 0x10], eax
push edi
lea eax, [esp + 0x24]
push ebx
push eax
call fcn.0051c650
mov ecx, dword [esp + 0x24]
mov edx, ebx
push esi
call fcn.004e79ef
mov ecx, dword [esp + 0x20]
add esp, 0x10
mov edx, edi
mov al, byte [ecx + esi]
xor byte [esi], al
inc esi
sub edx, 1
jne 0x4e7d01
push edi
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x1c]
call fcn.0051c650
sub dword [esp + 0x1c], edi
add esp, 0xc
add ebx, edi
sub ebp, 1
jne 0x4e7ce0
jmp 0x4e7d7e
mov edx, esi
sub ebx, eax
sub edx, eax
inc ebp
mov dword [esp + 0x10], edx
mov ecx, eax
mov dword [esp + 0x1c], edi
mov al, byte [ebx + ecx]
xor al, byte [ecx]
mov byte [ecx + edx], al
inc ecx
sub edi, 1
jne 0x4e7d3c
mov ecx, dword [esp + 0x18]
mov edx, esi
push esi
call fcn.004e79ef
push 0x10
pop edi
push edi
push esi
push dword [esp + 0x20]
call fcn.0051c650
mov edx, dword [esp + 0x20]
add esp, 0x10
mov eax, dword [esp + 0x14]
add edx, edi
add ebx, edi
mov dword [esp + 0x10], edx
add esi, edi
sub ebp, 1
jne 0x4e7d36
pop edi
pop ebp
xor eax, eax
mov ecx, dword [esp + 0x28]
pop esi
pop ebx
xor ecx, esp
call fcn.0051b034
add esp, 0x24
ret
Function at 0x4e83f9
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x11c
mov eax, dword [0x5c9040]
xor eax, esp
mov dword [esp + 0x114], eax
mov eax, dword [esp + 0x12c]
push ebx
mov ebx, dword [esp + 0x128]
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x130]
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], eax
test edi, edi
jne 0x4e8453
mov edi, dword [0x6054c4]
test edi, edi
jne 0x4e8453
call fcn.004e81fa
mov edx, dword [esp + 0x14]
mov edi, eax
mov dword [0x6054c4], edi
movzx ebp, dl
cmp dword [edi + 4], ebp
jl 0x4e857b
mov esi, dword [esp + 0x138]
cmp esi, 0xffffffff
jne 0x4e8474
push ebx
call fcn.00520660
pop ecx
mov esi, eax
push dword [esp + 0x18]
lea eax, [esp + 0x24]
push 0x585398
push 0x100
push eax
call fcn.004ea423
add esp, 0x10
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [edi + 0x14]
test ecx, ecx
je 0x4e84c2
mov eax, dword [edi + 0x10]
test eax, eax
je 0x4e84c2
push esi
push ebx
cmp ebp, 4
ja 0x4e84b7
lea eax, [esp + 0x28]
push eax
push ebp
call ecx
jmp 0x4e84bf
lea ecx, [esp + 0x28]
push ecx
push ebp
call eax
add esp, 0x10
cmp byte [edi + 8], 0
je 0x4e84d7
push ecx
push ebx
push ecx
mov edx, ebp
mov ecx, edi
call fcn.004e9a9d
add esp, 0xc
cmp byte [edi + 9], 0
je 0x4e850a
test byte [edi], 2
mov ecx, ebx
je 0x4e84e9
lea ecx, [ebx + 9]
jmp 0x4e84f1
test byte [edi], 0x40
je 0x4e84f1
lea ecx, [ebx + 0xd]
call fcn.004edc7f
mov esi, eax
test esi, esi
je 0x4e8503
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, esi
call fcn.004ebe45
cmp byte [edi + 0xa], 0
je 0x4e8539
mov eax, dword [esp + 0x1c]
mov esi, ebx
test eax, eax
cmovne esi, eax
push esi
call fcn.00520660
pop ecx
push eax
lea eax, [esp + 0x24]
mov edx, ebp
push esi
push eax
lea ecx, [edi + 0x428]
call fcn.004e9650
add esp, 0xc
cmp byte [edi + 0xb], 0
je 0x4e8556
push ecx
lea eax, [esp + 0x24]
mov edx, ebp
push ebx
push eax
lea ecx, [edi + 0x1c3c]
call fcn.004e99ab
add esp, 0xc
lea ecx, [edi + 0x41c]
mov edx, ebx
call fcn.004fabbe
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp ebp, 2
jne 0x4e857b
test dword [esp + 0x14], 0x200
je 0x4e8596
mov ecx, dword [esp + 0x124]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0051b034
add esp, 0x11c
ret
push 1
call fcn.005205b9
int3
Function at 0x4e9b1c
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.0054e7e0
mov eax, dword [0x5c9040]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x6054c8], 0
je 0x4e9b8e
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x1004]
push 0x1000
push eax
call fcn.00439680
add esp, 0x10
lea eax, [ebp - 0x1004]
push eax
push 0x585398
push 2
call fcn.005207b3
pop ecx
push eax
call fcn.0041c442
push 2
call fcn.005207b3
push eax
call fcn.00532d52
add esp, 0x14
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.0051b034
leave
ret

Function at 0x4e9e6d
Capabilities:
Connect socket
Get hostname

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
mov eax, edx
mov ebx, ecx
push edi
push eax
push ebx
push str.syslog_open___s:_s___n
mov dword [esp + 0x20], eax
mov esi, eax
call fcn.004e9b1c
add esp, 0xc
cmp dword [0x893e8c], 0
jne 0x4e9ed8
push 0x80
mov edi, 0x8960c0
push edi
call dword [sym.imp.WS2_32.dll_gethostname]
cmp byte [0x8960c0], 0
je 0x4e9ec1
push str._none_
push edi
call fcn.005205d0
pop ecx
pop ecx
test eax, eax
jne 0x4e9ece
push str.unknown
push edi
call fcn.00528060
pop ecx
pop ecx
mov dword [0x893e8c], 1
push 2
pop ebp
push 0x20
lea eax, [esp + 0x1c]
mov edi, esi
push 0
push eax
call fcn.0051c010
add esp, 0xc
cmp ebp, 2
jne 0x4e9f0e
test byte [esp + 0x3c], 2
je 0x4e9f31
cmp dword [esp + 0x14], 0
push ebp
pop eax
mov dword [esp + 0x20], eax
jne 0x4e9f39
mov esi, str.syslog
jmp 0x4e9f35
mov esi, edi
cmp ebp, 1
jne 0x4e9f31
test byte [esp + 0x3c], 4
je 0x4e9f31
xor eax, eax
inc eax
cmp dword [esp + 0x14], 0
mov dword [esp + 0x20], eax
jne 0x4e9f39
mov esi, str.syslog_conn
jmp 0x4e9f35
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4e9fab
and dword [esp + 0x1c], 0
lea eax, [esp + 0x10]
and dword [esp + 0x24], 0
mov edx, esi
push eax
lea eax, [esp + 0x1c]
mov ecx, ebx
push eax
call fcn.004f9d84
pop ecx
pop ecx
test eax, eax
jne 0x4e9fe4
mov eax, dword [esp + 0x10]
push dword [eax + 0xc]
push dword [eax + 8]
push dword [eax + 4]
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4e9f85
mov ecx, dword [esp + 0x10]
call fcn.004f9dd3
jmp 0x4e9fab
mov eax, dword [esp + 0x10]
push dword [eax + 0x10]
push dword [eax + 0x18]
push edi
call dword [sym.imp.WS2_32.dll_connect]
mov ecx, dword [esp + 0x10]
cmp eax, 0xffffffff
jne 0x4e9fd7
call fcn.004f9dd3
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
sub ebp, 1
jne 0x4e9edb
push esi
push ebx
push str.failed_to_connect_to__s_port__s
push 2
call fcn.005207b3
pop ecx
push eax
call fcn.0041c442
add esp, 0x10
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
call fcn.004f9dd3
test ebp, ebp
je 0x4e9fb4
mov eax, edi
jmp 0x4e9fcf
push 0x58622c
call fcn.00536f8c
pop ecx
push esi
push ebx
push str.failed_to_resolve_name__s_port__s
jmp 0x4e9fbb
Function at 0x4e9ff9
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x62c
mov eax, dword [0x5c9040]
xor eax, esp
mov dword [esp + 0x628], eax
test byte [ecx], 2
mov eax, dword [esp + 0x630]
push ebx
mov ebx, dword [esp + 0x638]
push ebp
push esi
push edi
mov edi, dword [esp + 0x648]
mov ebp, edx
je 0x4ea032
add edi, 9
jmp 0x4ea03a
test byte [ecx], 0x40
je 0x4ea03a
add edi, 0xd
mov ecx, eax
call fcn.004e9d69
mov esi, eax
call sub.KERNEL32.dll_GetCurrentProcessId
push eax
push str.__d_
lea eax, [esp + 0x20]
push 0x1e
push eax
call fcn.004ea423
lea eax, [esp + 0x20]
push eax
call fcn.00530c3c
lea eax, [esp + 0x24]
push eax
call fcn.00536fb6
push edi
lea ecx, [esp + 0x34]
test ebx, ebx
push ecx
mov ecx, str._someone_
cmovne ecx, ebx
add eax, 4
push ecx
push 0x8960c0
push eax
push esi
push str.__d__.15s__.32s__.64s_s:__.800s
lea eax, [esp + 0x6c]
push 0x600
push eax
call fcn.004ea423
add esp, 0x3c
lea eax, [esp + 0x38]
push 0
push eax
call fcn.00520660
pop ecx
inc eax
push eax
lea eax, [esp + 0x40]
push eax
push ebp
call dword [sym.imp.WS2_32.dll_send]
mov ecx, dword [esp + 0x638]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0051b034
add esp, 0x62c
ret

Function at 0x4ea523
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], edx
xor esi, esi
mov eax, esi
mov dword [edi + 0x100], esi
mov dword [edi + 0x104], esi
movd xmm0, eax
pshufd xmm0, xmm0, 0
paddd xmm0, xmmword [0x5b2120]
andps xmm0, xmmword [0x5b2130]
packuswb xmm0, xmm0
packuswb xmm0, xmm0
movd dword [edi + eax], xmm0
add eax, 4
cmp eax, 0x100
jb 0x4ea53e
mov ebp, esi
xor edx, edx
mov bl, byte [edi + ebp]
mov eax, ebp
movzx ecx, bl
div dword [esp + 0x18]
mov eax, dword [esp + 0x10]
movzx eax, byte [edx + eax]
add eax, esi
add ecx, eax
movzx esi, cl
mov al, byte [esi + edi]
mov byte [edi + ebp], al
inc ebp
mov byte [esi + edi], bl
cmp ebp, 0x100
jb 0x4ea56f
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x4ea5a4
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ecx
push ecx
push ebp
push esi
push edi
xor edi, edi
mov dword [esp + 0xc], ecx
mov esi, edx
mov dword [esp + 0x10], edi
cmp dword [esp + 0x1c], edi
je 0x4ea60e
push ebx
mov ebx, dword [esp + 0x1c]
sub esi, ebx
lea eax, [edi + 1]
movzx edi, al
mov eax, dword [esp + 0x14]
mov cl, byte [edi + ecx]
movzx edx, cl
add eax, edx
movzx ebp, al
mov eax, dword [esp + 0x10]
mov dword [esp + 0x14], ebp
mov al, byte [eax + ebp]
mov ebp, dword [esp + 0x10]
mov byte [edi + ebp], al
mov eax, ebp
mov ebp, dword [esp + 0x14]
mov byte [eax + ebp], cl
mov ecx, eax
movzx eax, byte [edi + ecx]
add eax, edx
movzx eax, al
mov al, byte [eax + ecx]
xor al, byte [ebx + esi]
mov byte [ebx], al
inc ebx
sub dword [esp + 0x20], 1
jne 0x4ea5c2
pop ebx
pop edi
pop esi
pop ebp
pop ecx
pop ecx
ret
Function at 0x4eb0af
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x1004
call fcn.0054e7e0
mov eax, dword [0x5c9040]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
push edi
mov ebx, edx
mov edx, 0x591c68
push ecx
call fcn.004eb49c
mov edi, eax
pop ecx
test edi, edi
je 0x4eb147
push esi
call fcn.004f495a
mov esi, eax
test esi, esi
jne 0x4eb0f4
push edi
call fcn.005335d9
pop ecx
xor eax, eax
jmp 0x4eb146
push ebp
push edi
mov ebp, 0x1000
lea eax, [esp + 0x14]
push ebp
push 1
push eax
call fcn.005333ca
add esp, 0x10
jmp 0x4eb12a
push eax
lea edx, [esp + 0x14]
mov ecx, esi
call fcn.004f49c8
push edi
push ebp
lea eax, [esp + 0x1c]
push 1
push eax
call fcn.005333ca
add esp, 0x14
test eax, eax
jne 0x4eb10d
push edi
call fcn.005335d9
pop ecx
pop ebp
test ebx, ebx
je 0x4eb13f
mov eax, dword [esi + 4]
mov dword [ebx], eax
mov ecx, esi
call fcn.004f4991
pop esi
mov ecx, dword [esp + 0x1008]
pop edi
pop ebx
xor ecx, esp
call fcn.0051b034
add esp, 0x1004
ret

Function at 0x4eb15e
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x2004
call fcn.0054e7e0
mov eax, dword [0x5c9040]
xor eax, esp
mov dword [esp + 0x2000], eax
push ebx
push esi
push edi
mov esi, edx
mov ebx, ecx
push ecx
mov edx, 0x591c68
call fcn.004eb49c
mov edi, eax
pop ecx
test edi, edi
jne 0x4eb197
or eax, 0xffffffff
jmp 0x4eb245
push ebp
push esi
call fcn.00520660
mov ebp, 0x1000
pop ecx
test eax, eax
je 0x4eb1da
mov al, byte [esi + eax - 1]
cmp al, 0x5c
je 0x4eb1b4
cmp al, 0x2f
jne 0x4eb1da
mov ecx, ebx
call fcn.004ee26c
push eax
push esi
push 0x5849a0
lea eax, [esp + 0x101c]
push ebp
push eax
call fcn.004ea423
add esp, 0x14
lea esi, [esp + 0x1010]
mov ecx, esi
call fcn.004f0b47
push ecx
mov edx, 0x5a99cc
mov ecx, esi
call fcn.004eb49c
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x4eb1fa
or esi, 0xffffffff
jmp 0x4eb23b
push edi
push ebp
xor ebp, ebp
inc ebp
jmp 0x4eb21b
push ebx
push ebp
lea eax, [esp + 0x18]
push esi
push eax
call fcn.005331aa
add esp, 0x10
cmp eax, ebp
jne 0x4eb231
push edi
push 0x1000
lea eax, [esp + 0x18]
push ebp
push eax
call fcn.005333ca
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x4eb201
jmp 0x4eb234
or esi, 0xffffffff
push ebx
call fcn.005335d9
pop ecx
push edi
call fcn.005335d9
pop ecx
mov eax, esi
pop ebp
mov ecx, dword [esp + 0x200c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0051b034
add esp, 0x2004
ret

Function at 0x4eb25d
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.0054e7e0
mov eax, dword [0x5c9040]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x5c9c58], 0
push ecx
jne 0x4eb299
lea edx, [ebp - 0x1004]
call fcn.004eb3e8
pop ecx
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x4eb2b2
lea edx, [ebp - 0x2004]
call fcn.004eb320
pop ecx
lea eax, [ebp - 0x2004]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4eb2bb
or eax, eax
jmp 0x4eb2c3
shr eax, 4
not eax
and eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051b034
leave
ret