joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432330
Capabilities:
Terminate process

Disassembly:
push esi
push 0
push 0x7d0
push 0x511af0
call fcn.00486170
add esp, 0xc
test al, al
je 0x432362
push str.Badly_out_of_memory__please_check_your_system_status_n
push 0x50b500
call fcn.004b5540
add esp, 8
push 1
call fcn.004b544d
mov esi, dword [esp + 8]
mov dword [0x511eac], 1
movsx eax, byte [esi]
push eax
call fcn.004b575f
add esp, 4
test eax, eax
je 0x432392
movsx ecx, byte [esi + 1]
inc esi
push ecx
call fcn.004b575f
add esp, 4
test eax, eax
jne 0x432380
push 3
push 0x4edde0
push esi
call fcn.0047fc30
add esp, 0xc
test eax, eax
jne 0x4323b4
pop esi
mov dword [esp + 4], 0x511af0
jmp 0x486320
cmp byte [esi], 0
je 0x432422
lea esp, [esp]
lea edx, [esp + 8]
push edx
push bind
push 0
push 0xa
push esi
call fcn.0048a7f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x432422
mov eax, dword [esp + 8]
cmp eax, 0x7d0
jge 0x4323f6
push eax
push 0x511af0
call fcn.004861f0
add esp, 8
movsx eax, byte [esi]
push eax
call fcn.004b570a
add esp, 4
test eax, eax
jne 0x43241d
cmp byte [esi], 0
je 0x432422
movsx ecx, byte [esi + 1]
inc esi
push ecx
call fcn.004b570a
add esp, 4
test eax, eax
je 0x432406
cmp byte [esi], 0
jne 0x4323c0
pop esi
ret
push esi
mov esi, dword [esp + 8]
mov al, byte [esi + 8]
test al, al
je 0x486336
lea eax, [esi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [esi + 4]
add ecx, 7
shr ecx, 3
mov edx, ecx
push edi
mov edi, dword [esi]
shr ecx, 2
or eax, 0xffffffff
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov al, byte [esi + 8]
test al, al
pop edi
je 0x486365
add esi, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
ret
Function at 0x442c80
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
push esi
mov esi, ecx
jbe 0x442cd3
push edi
mov edi, dword [esp + 0x10]
push esi
call fcn.004316b0
fmul qword [0x4c7350]
add esp, 4
call fcn.004b5cec
xor dword [esi + 0x230], eax
mov dl, byte [esi + 0x230]
xor eax, eax
mov al, byte [edi]
mov cl, byte [esi + eax + 0x130]
xor cl, dl
mov byte [edi], cl
mov ecx, dword [esi + 0x230]
xor ecx, eax
inc edi
dec ebx
mov dword [esi + 0x230], ecx
jne 0x442c91
pop edi
pop esi
pop ebx
ret 8

Function at 0x442ce0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
push esi
mov esi, ecx
jbe 0x442d3b
push edi
mov edi, dword [esp + 0x10]
push esi
call fcn.004316b0
fmul qword [0x4c7350]
add esp, 4
call fcn.004b5cec
mov ecx, dword [esi + 0x230]
xor ecx, eax
mov dword [esi + 0x230], ecx
mov eax, ecx
xor ecx, ecx
mov cl, byte [edi]
xor ecx, eax
xor eax, eax
mov al, byte [ecx + esi + 0x30]
mov byte [edi], al
mov edx, dword [esi + 0x230]
and eax, 0xff
xor edx, eax
inc edi
dec ebx
mov dword [esi + 0x230], edx
jne 0x442cf1
pop edi
pop esi
pop ebx
ret 8
Function at 0x445810
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
mov ebp, dword [esi + 0x4b8]
push edi
lea edi, [ebp + 0x654]
push edi
mov dword [esi + 0x45c], 0x4ef54c
mov dword [esp + 0x14], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 0x680]
cmp eax, dword [0x511210]
jb 0x445871
mov eax, dword [esi + 0x630]
test eax, eax
jne 0x445871
lea ecx, [ebp + 0x674]
push edi
push ecx
call fcn.00480650
mov edx, dword [ebp + 0x680]
mov eax, dword [0x511210]
add esp, 8
cmp edx, eax
jae 0x445848
mov eax, dword [esi + 0x630]
test eax, eax
mov dword [esi + 0x45c], 0x4ef534
jne 0x4459fb
push 0x18
push 0x40
call fcn.0047fff0
mov ebx, eax
xor eax, eax
add esp, 8
cmp ebx, eax
je 0x4459fb
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x2c]
mov dword [ebx + 0x14], ecx
cmp dword [esp + 0x24], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x28], edx
mov dword [ebx], 0x4cb940
jne 0x4458cb
mov dword [esp + 0x28], eax
mov esi, dword [esp + 0x1c]
mov eax, dword [esi + 0x54]
mov ecx, dword [esp + 0x28]
lea edx, [eax + ecx + 1]
push 0x10
push edx
call fcn.0047fff0
add esp, 8
test eax, eax
mov dword [ebx + 0xc], eax
je 0x4459f3
mov ecx, dword [esi + 0x54]
mov esi, dword [esi + 0x44]
mov edx, dword [esp + 0x1c]
mov edi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x28]
and ecx, 3
test eax, eax
rep movsb byte es:[edi], byte [esi]
je 0x445937
mov ecx, dword [edx + 0x54]
mov esi, dword [ebx + 0xc]
lea edi, [ecx + esi]
mov esi, dword [esp + 0x24]
lea ecx, [eax + 1]
mov eax, ecx
shr ecx, 2
mov dword [ebx + 0x10], edi
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x28]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebx + 0x3c], eax
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x4a0]
mov dword [ebx + 0x18], ecx
mov ecx, dword [eax + 0x60c]
mov dword [ebx + 0x1c], ecx
mov ecx, dword [eax + 0x610]
mov dword [ebx + 0x20], ecx
mov ecx, dword [eax + 0x614]
mov dword [ebx + 0x24], ecx
mov ecx, dword [eax + 0x568]
mov dword [ebx + 0x30], ecx
mov eax, dword [eax + 0x56c]
mov dword [ebx + 0x34], eax
mov ecx, dword [edx + 0xdc]
mov dword [ebx + 0x38], ecx
mov eax, dword [ebp + 0x6ac]
mov dword [eax], ebx
lea eax, [ebx + 8]
lea ecx, [ebp + 0x6a8]
mov dword [eax], ecx
mov ecx, dword [ebp + 0x6ac]
mov dword [ebx + 4], ecx
mov dword [ebp + 0x6ac], eax
mov eax, dword [ebp + 0x680]
inc eax
mov dword [ebp + 0x680], eax
mov dword [ebp + 0x684], 1
mov eax, dword [edx + 0x78]
test eax, eax
je 0x4459c6
push edx
call fcn.00445ff0
add esp, 4
add ebp, 0x66c
push ebp
call fcn.00480740
add esp, 4
push 0x51157c
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov edx, dword [ebx]
push 1
mov ecx, ebx
call dword [edx]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x447c90
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0xc]
push ebp
xor ecx, ecx
push esi
mov esi, dword [eax + 0x10]
mov cl, byte [esi]
xor edx, edx
xor eax, eax
push edi
mov dl, byte [ecx + 0x4f13b0]
mov ax, word [ecx*2 + 0x4f11b0]
mov ecx, edx
add eax, 0x5d89c3
cmp ecx, ebx
lea edx, [esi + 1]
jle 0x447cc5
mov ecx, ebx
dec ecx
test ecx, ecx
jle 0x447ce8
mov edi, ecx
lea esp, [esp]
xor ecx, ecx
mov cl, byte [edx]
xor ebp, ebp
mov bp, word [ecx*2 + 0x4f11b0]
lea ecx, [ebp + eax*4]
xor eax, ecx
inc edx
dec edi
jne 0x447cd0
and eax, 0x7fffff
xor edx, edx
mov ecx, 0x1085
div ecx
xor ecx, ecx
mov cx, word [edx*2 + 0x4f14b0]
cmp ecx, 0x137
jb 0x447d29
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x447d85
cmp ecx, 0x7fff
jae 0x447d85
add ecx, 0xfffffec9
shl ecx, 4
add ecx, 0x4f0a00
jmp 0x447d32
shl ecx, 4
add ecx, 0x4ef690
cmp ebx, dword [ecx + 8]
jne 0x447d85
mov eax, dword [ecx]
mov edi, esi
mov ebp, ebx
sub edi, eax
nop
mov edx, ebp
dec ebp
test edx, edx
je 0x447d63
xor ebx, ebx
mov bl, byte [eax]
xor edx, edx
mov dl, byte [edi + eax]
inc eax
mov bl, byte [ebx + 0x4ef590]
cmp byte [edx + 0x4ef590], bl
mov ebx, dword [esp + 0x18]
je 0x447d40
inc ebp
test ebp, ebp
jne 0x447d85
mov eax, dword [esp + 0x14]
mov edx, dword [eax + 8]
mov dword [edx], ecx
mov edx, dword [eax + 8]
mov dword [edx + 4], esi
mov eax, dword [eax + 8]
pop edi
pop esi
mov dword [eax + 8], ebx
mov eax, dword [ecx + 4]
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x470f70
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, 0x1010
call fcn.004b63e0
push ebx
or ecx, 0xffffffff
push ebp
push esi
xor eax, eax
push edi
mov edi, dword [esp + 0x1030]
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x1028]
mov edx, dword [eax + 0xa]
mov ebp, dword [esp + 0x1024]
not ecx
dec ecx
mov edi, ecx
xor ecx, ecx
mov cx, word [eax + 8]
xor esi, esi
mov si, word [eax + 4]
xor ebx, ebx
mov bx, word [eax + 6]
inc edi
add eax, 0xa
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], edi
lea ecx, [esi + ecx*4 + 0x44]
add ecx, edi
cmp ecx, ebx
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], edx
jbe 0x4710d4
push 0
push 2
push 0
add edx, 0x1000
push 0
push ebp
mov dword [esp + 0x30], edx
mov dword [eax], edx
call fcn.004816f0
mov esi, eax
add esp, 0x14
and esi, 0xfff
cmp eax, ebx
jbe 0x47105f
nop
push 0
push 0
mov edi, eax
push 0
sub edi, esi
push edi
push ebp
call fcn.004816f0
push 0x14
push esi
lea edx, [esp + 0x3c]
push edx
push ebp
call fcn.00480330
add esp, 0x24
test eax, eax
jne 0x4711af
push eax
push eax
lea eax, [edi + 0x1000]
push 0
push eax
push ebp
call fcn.004816f0
push 0x14
push esi
lea ecx, [esp + 0x3c]
push ecx
push ebp
call fcn.00481590
add esp, 0x24
test eax, eax
jne 0x4711af
mov eax, edi
cmp eax, ebx
mov esi, 0x1000
ja 0x471000
xor eax, eax
push eax
push eax
push eax
push ebx
mov ecx, 0x400
lea edi, [esp + 0x30]
push ebp
rep stosd dword es:[edi], eax
call fcn.004816f0
push 0x14
push esi
lea edx, [esp + 0x3c]
push edx
push ebp
call fcn.00481590
add esp, 0x24
test eax, eax
jne 0x4711af
mov eax, dword [esp + 0x1028]
mov ecx, dword [esp + 0x102c]
add ebx, 0x1000
mov word [eax + 6], bx
mov edx, dword [ecx + 8]
mov ecx, dword [esp + 0x14]
mov eax, dword [edx]
lea eax, [eax + ecx - 1]
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x4710cc
lea esp, [esp]
add dword [eax], 0x1000
add eax, 4
dec ecx
jne 0x4710c0
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
cmp esi, 1
push 0
push 0x4e8b64
jne 0x4710fd
mov edx, dword [esp + 0x1038]
push edx
lea eax, [esp + 0x2c]
push 0x4e8b64
push eax
inc edi
call fcn.0048a7a0
add esp, 0x14
jmp 0x471112
mov ecx, dword [esp + 0x1038]
push ecx
lea edx, [esp + 0x2c]
push edx
call fcn.0048a7a0
add esp, 0x10
push 0
push 0
lea eax, [esi + 0x3f]
push 0
push eax
push ebp
call fcn.004816f0
push 0x14
lea ecx, [edi + 1]
push ecx
lea edx, [esp + 0x3c]
push edx
push ebp
call fcn.00481590
add esp, 0x24
test eax, eax
jne 0x4711af
mov eax, dword [esp + 0x10]
test eax, eax
je 0x471166
mov ecx, dword [esp + 0x102c]
mov edx, dword [ecx + 8]
push 0x14
shl eax, 2
push eax
mov eax, dword [edx]
lea ecx, [eax + esi - 1]
push ecx
push ebp
call fcn.00481590
add esp, 0x10
test eax, eax
jne 0x4711af
mov ebx, dword [esp + 0x1028]
push 0x14
push 4
lea eax, [ebx + 0xa]
push eax
push ebp
call fcn.00481590
add esp, 0x10
test eax, eax
jne 0x4711af
mov edx, dword [esp + 0x10]
push 0x10
add edi, esi
mov esi, dword [esp + 0x20]
push eax
inc edx
push esi
push ebp
mov word [ebx + 8], dx
mov word [ebx + 4], di
call fcn.004891f0
add esp, 0x10
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1010
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1010
ret
Function at 0x473b50
Capabilities:
Read file on windows
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x30], 3
push 0
jne 0x473b82
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
push edx
mov edx, dword [eax + 4]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x473b7d
or eax, 0xffffffff
ret
mov eax, dword [esp + 0xc]
ret
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov eax, dword [eax]
push ecx
push edx
push eax
call sub.WSOCK32.dll_recv
ret

Function at 0x473ba0
Capabilities:
Send data
Send data on socket
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x30], 3
push 0
jne 0x473bd2
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
push edx
mov edx, dword [eax + 4]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x473bcd
or eax, 0xffffffff
ret
mov eax, dword [esp + 0xc]
ret
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov eax, dword [eax]
push ecx
push edx
push eax
call sub.WSOCK32.dll_send
ret

Function at 0x473c10
Capabilities:
Set socket configuration

Disassembly:
push ecx
mov ecx, dword [esp + 8]
mov edx, dword [ecx + 0x30]
xor eax, eax
cmp edx, 3
mov dword [esp], eax
je 0x473c47
cmp byte [esp + 0xc], al
je 0x473c31
mov dword [esp], 1
mov ecx, dword [ecx]
push 4
lea eax, [esp + 4]
push eax
push 8
push 0xffff
push ecx
call sub.WSOCK32.dll_setsockopt
pop ecx
ret
Function at 0x47fff0
Capabilities:
Terminate process

Disassembly:
push ebx
push edi
mov edi, dword [esp + 0xc]
test edi, edi
jne 0x47ffff
mov edi, 1
push edi
call fcn.004b6511
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x480053
push esi
call fcn.004b5d86
mov esi, eax
call fcn.00480930
mov ecx, dword [esi]
mov dword [eax], ecx
mov eax, dword [esp + 0x14]
mov esi, eax
and esi, 8
je 0x480036
mov edx, dword [fcn.00483190]
mov dword [fcn.00483190], edx
test al, 0x18
je 0x480047
push edi
push 0x24
push 5
call fcn.0047fe20
add esp, 0xc
test esi, esi
pop esi
je 0x48006e
push 1
call fcn.004b544d
test byte [esp + 0x10], 0x20
je 0x48006e
mov ecx, edi
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
pop edi
mov eax, ebx
pop ebx
ret

Function at 0x480330
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
lea esp, [esp]
call fcn.004b5d86
mov dword [eax], 0
mov eax, dword [esp + 0x18]
push edi
push eax
push ebx
call fcn.004bfc60
mov esi, eax
add esp, 0xc
cmp esi, edi
je 0x4803fa
call fcn.004b5d86
cmp dword [eax], 0
je 0x480377
call fcn.004b5d86
mov ebp, dword [eax]
jmp 0x48037a
or ebp, 0xffffffff
call fcn.00480930
test esi, esi
mov dword [eax], ebp
jne 0x48038f
call fcn.004b5d86
cmp dword [eax], 4
je 0x480340
mov al, byte [esp + 0x20]
test al, 0x1a
je 0x4803e7
cmp esi, 0xffffffff
jne 0x4803c1
call fcn.00480930
mov ecx, dword [eax]
push ecx
push ebx
call fcn.00489420
add esp, 4
push eax
push 0x24
push 2
call fcn.0047fe20
add esp, 0x10
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
test al, 6
je 0x4803e7
call fcn.00480930
mov edx, dword [eax]
push edx
push ebx
call fcn.00489420
add esp, 4
push eax
push 0x24
push 9
call fcn.0047fe20
mov al, byte [esp + 0x30]
add esp, 0x10
cmp esi, 0xffffffff
je 0x4803f0
test al, 6
je 0x480404
pop edi
pop esi
pop ebp
mov eax, 0xffffffff
pop ebx
ret
mov al, byte [esp + 0x20]
test al, 6
je 0x480404
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret

Function at 0x480810
Capabilities:
Terminate process

Disassembly:
push 0
call fcn.00486540
add esp, 4
test eax, eax
je 0x48083f
call fcn.004b5d86
mov eax, dword [eax]
push eax
push str.Cant_initialize_threads:_error__d_n
push 0x50b500
call fcn.004b5540
add esp, 0xc
push 1
call fcn.004b544d
push esi
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x520280
call esi
push 0x520220
call esi
push 0x5202a0
call esi
push 0x520240
call esi
push 0x5201e0
call esi
push 0x520200
call esi
push 0x5201c0
call esi
push 0x5201a0
call esi
push 0x520260
call esi
call fcn.004855d0
pop esi
jmp fcn.00480890
Function at 0x481190
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov eax, edi
shl eax, 5
lea ebp, [eax + 0x517840]
jmp 0x4811b0
mov edi, dword [esp + 0x14]
lea esp, [esp]
push ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push 0
push ecx
push edx
push edi
or esi, 0xffffffff
call fcn.004b7ecf
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
je 0x4811f3
mov ebx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push ebx
push eax
push edi
call fcn.004bfc60
mov esi, eax
add esp, 0xc
cmp esi, ebx
jne 0x4811f3
xor edi, edi
jmp 0x4811f8
mov edi, 1
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
mov ebx, dword [esp + 0x28]
je 0x481299
call fcn.004b5d86
mov edi, eax
call fcn.00480930
test esi, esi
mov ecx, dword [edi]
mov dword [eax], ecx
jne 0x48122d
call fcn.004b5d86
cmp dword [eax], 4
je 0x4811a5
test bl, 0x1a
je 0x481287
cmp esi, 0xffffffff
jne 0x481260
call fcn.00480930
mov edx, dword [eax]
mov eax, dword [esp + 0x14]
push edx
push eax
call fcn.00489420
add esp, 4
push eax
push 0x24
push 2
call fcn.0047fe20
add esp, 0x10
pop edi
or eax, esi
pop esi
pop ebp
pop ebx
ret
test bl, 6
je 0x481287
call fcn.00480930
mov ecx, dword [eax]
mov edx, dword [esp + 0x14]
push ecx
push edx
call fcn.00489420
add esp, 4
push eax
push 0x24
push 9
call fcn.0047fe20
add esp, 0x10
cmp esi, 0xffffffff
je 0x481291
test bl, 6
je 0x481299
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
and bl, 6
neg bl
pop edi
sbb ebx, ebx
not ebx
and ebx, esi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret

Function at 0x485220
Capabilities:
Initialize winsock library

Disassembly:
mov al, byte [0x51fd0d]
test al, al
jne 0x4852bd
mov byte [0x51fd0d], 1
call fcn.00480810
mov eax, dword [0x517420]
test eax, eax
jne 0x4852b8
call fcn.004853d0
push str.HOME
call fcn.004b7122
add esp, 4
test eax, eax
mov dword [0x517420], eax
je 0x485270
push eax
push 0x517628
call fcn.00487c70
add esp, 8
mov dword [0x517420], eax
push str.UMASK
call fcn.004b7122
add esp, 4
test eax, eax
je 0x485294
push eax
call fcn.004852c0
add esp, 4
or eax, 0x180
mov dword [0x4f5e74], eax
push str.UMASK_DIR
call fcn.004b7122
add esp, 4
test eax, eax
je 0x4852b8
push eax
call fcn.004852c0
add esp, 4
or eax, 0x1c0
mov dword [0x4f5e78], eax
jmp 0x4854e0
ret
sub esp, 0x190
call fcn.00485540
test al, al
je 0x48552f
lea eax, [esp]
push eax
push 2
call sub.WSOCK32.dll_WSAStartup
test eax, eax
je 0x48550b
call sub.WSOCK32.dll_WSACleanup
lea ecx, [esp]
push ecx
jmp 0x48551d
cmp word [esp], 2
je 0x485528
call sub.WSOCK32.dll_WSACleanup
lea edx, [esp]
push edx
push 2
call sub.WSOCK32.dll_WSAStartup
test eax, eax
jne 0x48552f
mov byte [0x51fd0c], 1
xor al, al
add esp, 0x190
ret
Function at 0x4853d0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xa04
push 0x50f0d4
push 2
mov dword [esp + 0xc], 0x100
mov dword [esp + 0x10], 0x400
call fcn.004b88e3
add esp, 8
lea eax, [esp]
push eax
push 0x20019
push 0
push str.SoftwareMySQL
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4854d1
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x118]
push edx
mov edx, dword [esp + 0x10]
push eax
push eax
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x28]
push ecx
push 0
push edx
mov esi, 1
call edi
cmp eax, 0x103
je 0x4854c4
nop
lea eax, [esp + 0x114]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x51c]
push edx
call fcn.004853b0
lea eax, [esp + 0x520]
push eax
call fcn.004c3fe8
lea ecx, [esp + 0x524]
push ecx
call fcn.004c50a0
add esp, 0x14
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x118]
push ecx
push 0
push 0
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x28]
mov eax, esi
push ecx
push eax
push edx
mov dword [esp + 0x2c], 0x100
mov dword [esp + 0x30], 0x400
inc esi
call edi
cmp eax, 0x103
jne 0x485450
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
add esp, 0xa04
ret

Function at 0x4855e0
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
push 0xc
call fcn.004b6511
mov esi, eax
add esp, 4
test esi, esi
jne 0x4855fa
pop edi
pop esi
or eax, 0xffffffff
pop ebx
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
push 0x51fd10
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [esp + 0x14]
mov eax, dword [ebx]
test eax, eax
jne 0x485622
mov eax, 0xffff
push esi
push eax
push 0x485670
call fcn.004b76b4
mov edx, dword [esp + 0x1c]
mov edi, eax
add esp, 0xc
mov dword [esi], edi
push 0x51fd10
mov dword [edx], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp edi, 0xffffffff
jne 0x48565c
call fcn.004b5d86
mov eax, dword [eax]
test eax, eax
jne 0x485669
or eax, edi
pop edi
pop esi
pop ebx
ret
mov eax, dword [ebx + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor eax, eax
pop edi
pop esi
pop ebx
ret
Function at 0x485fd0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x200
push esi
mov esi, dword [esp + 0x208]
push edi
push esi
call fcn.00484820
mov dl, byte [eax]
xor ecx, ecx
test dl, dl
setne cl
push str._nDefault_options_are_read_from_the_following_files_in_the_given_order:
mov edi, ecx
call fcn.004b75eb
push esi
call fcn.00484860
add esp, 0xc
test eax, eax
je 0x48601a
push 0x50b4e0
push esi
call fcn.004b7fd8
add esp, 8
jmp 0x486106
push 0x200
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test edi, edi
mov eax, 0x50f0d4
jne 0x486038
mov eax, str..ini
push ebp
push eax
push esi
lea eax, [esp + 0x14]
push eax
push str._s_s_s
call fcn.004b7563
mov eax, dword [0x4f65bc]
add esp, 0x10
test eax, eax
mov ebp, 0x4f65bc
je 0x4860f8
mov ecx, dword [0x51fd28]
mov eax, dword [ebp]
cmp byte [eax], 0
je 0x486075
push eax
lea ecx, [esp + 0x10]
push ecx
jmp 0x48607f
test ecx, ecx
je 0x4860ea
push ecx
lea edx, [esp + 0x10]
push edx
call fcn.00489da6
lea eax, [esp + 0x14]
add esp, 8
push eax
call fcn.004848e0
mov al, byte [esp + 0x10]
add esp, 4
cmp al, 0x7e
jne 0x4860b2
or ecx, 0xffffffff
lea edi, [esp + 0xc]
xor eax, eax
repne scasb al, byte es:[edi]
mov cx, word [0x4e868c]
mov word [edi - 1], cx
push 0
push 0x4e8c48
push str..cnf
lea edx, [esp + 0x18]
push esi
push edx
call fcn.00489c3e
add esp, 4
push eax
call fcn.0048a7a0
lea eax, [esp + 0x20]
push 0x50b4e0
push eax
call fcn.004b7fd8
mov ecx, dword [0x51fd28]
add esp, 0x1c
mov eax, dword [ebp + 4]
add ebp, 4
test eax, eax
jne 0x486065
push 0x50f0d4
call fcn.004b75eb
add esp, 4
pop ebp
push 0x50b4e0
push str.The_following_groups_are_read:
call fcn.004b7fd8
mov esi, dword [esp + 0x218]
mov eax, dword [esi]
add esp, 8
test eax, eax
je 0x48614b
push 0x50b4e0
push 0x20
call fcn.004b7011
mov ecx, dword [esi]
push 0x50b4e0
push ecx
call fcn.004b7fd8
mov eax, dword [esi + 4]
add esi, 4
add esp, 0x10
test eax, eax
jne 0x486125
push str._nThe_following_options_may_be_given_as_the_first_argument:_n__print_defaults_tPrint_the_program_argument_list_and_exit_n__no_defaults_t_tDont_read_default_options_from_any_options_file_n__defaults_file_tOnly_read_default_options_from_the_given_file__n__defaults_extra_file_Read_this_file_after_the_global_files_are_read
call fcn.004b75eb
add esp, 4
pop edi
pop esi
add esp, 0x200
ret
Function at 0x489dd0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x44
push ebx
mov ebx, dword [esp + 0x58]
test ebx, ebx
push edi
jge 0x489e21
cmp ebx, 0xffffffdc
jl 0x489eeb
cmp ebx, 0xfffffffe
jg 0x489eeb
mov ecx, dword [esp + 0x54]
test ecx, ecx
mov edi, dword [esp + 0x50]
jg 0x489e19
jl 0x489e01
test edi, edi
jae 0x489e19
mov edx, dword [esp + 0x58]
inc edx
mov byte [edx - 1], 0x2d
neg edi
adc ecx, 0
neg ecx
mov dword [esp + 0x58], edx
neg ebx
jmp 0x489e3f
mov edx, dword [esp + 0x58]
neg ebx
jmp 0x489e3f
cmp ebx, 0x24
jg 0x489eeb
cmp ebx, 2
jl 0x489eeb
mov ecx, dword [esp + 0x54]
mov edi, dword [esp + 0x50]
mov edx, dword [esp + 0x58]
mov eax, edi
or eax, ecx
jne 0x489e54
mov byte [edx], 0x30
inc edx
pop edi
mov byte [edx], 0
mov eax, edx
pop ebx
add esp, 0x44
ret
test ecx, ecx
push esi
lea esi, [esp + 0x4c]
mov byte [esp + 0x4c], 0
ja 0x489e6a
cmp edi, 0x7fffffff
jbe 0x489e9f
push ebp
xor ebp, ebp
lea ecx, [ecx]
push ebp
push ebx
push ecx
push edi
call fcn.004b5e90
mov ecx, eax
imul ecx, ebx
sub edi, ecx
mov cl, byte [edi + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
dec esi
test edx, edx
mov byte [esi], cl
mov edi, eax
mov ecx, edx
ja 0x489e70
jb 0x489e9a
cmp eax, 0x7fffffff
ja 0x489e70
mov edx, dword [esp + 0x60]
pop ebp
test edi, edi
mov dword [esp + 0x60], edi
je 0x489ed7
mov eax, dword [esp + 0x60]
cdq
idiv ebx
xor edx, edx
mov dl, byte [esp + 0x60]
dec esi
mov ecx, eax
mov al, bl
imul cl
sub dl, al
mov dword [esp + 0x60], ecx
and edx, 0xff
test ecx, ecx
mov al, byte [edx + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
mov byte [esi], al
jne 0x489ea7
mov edx, dword [esp + 0x5c]
mov al, byte [esi]
mov byte [edx], al
inc edx
inc esi
test al, al
jne 0x489ed7
pop esi
pop edi
lea eax, [edx - 1]
pop ebx
add esp, 0x44
ret
pop edi
xor eax, eax
pop ebx
add esp, 0x44
ret