joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50078834
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov dword [ebp - 4], 4
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0x7008
push 0xffff
push 0xffffffffffffffff
call sub.wsock32.dll_getsockopt
test eax, eax
jne 0x50078979
xor edx, edx
push ebp
push 0x50078972
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [ebx + 0x58], 1
jne 0x5007889d
mov dword [ebp - 0xc], 0x20
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x7008
push 0xffff
push 0xffffffffffffffff
call sub.wsock32.dll_setsockopt
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x1c]
push eax
push esi
call sub.wsock32.dll_accept
cmp eax, 0xffffffff
je 0x50078944
mov edx, eax
mov eax, ebx
mov si, 0xfffb
call sym.rtl120.bpl__System__CallDynaInst_qqrv
mov esi, eax
cmp word [ebx + 0x32], 0
je 0x500788dd
push 5
mov ecx, esi
mov edx, ebx
mov eax, dword [ebx + 0x34]
call dword [ebx + 0x30]
cmp byte [ebx + 0x58], 1
jne 0x50078944
movzx edx, byte [0x50078980]
mov eax, esi
call sym.rtl120.bpl__Scktcomp_TCustomWinSocket_SetAsyncStyles_qqr48System__Set_t20Scktcomp_TAsyncStyle_iuc_0_iuc_5_
xor eax, eax
push ebp
push 0x50078916
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, esi
mov eax, ebx
mov si, 0xfffa
call sym.rtl120.bpl__System__CallDynaInst_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x50078944
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50078979
mov dword [ebp - 4], 4
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0x7008
push 0xffff
push 0xffffffffffffffff
call sub.wsock32.dll_setsockopt
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x500791c8
Capabilities:
Get socket status

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef4
mov ebx, eax
lea esi, [esp + 8]
mov edi, esp
jmp 0x50079253
mov eax, esi
call fcn.500753f4
mov edx, esi
mov eax, dword [ebx + 0x40]
mov eax, dword [eax + 4]
call fcn.500753e4
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], 0x1f4
push edi
push 0
push 0
push esi
push 0
call sub.wsock32.dll_select
test eax, eax
jle 0x5007922f
cmp byte [ebx + 0xd], 0
jne 0x5007922f
mov edx, esi
or ecx, 0xffffffff
mov eax, dword [ebx + 0x40]
call sym.rtl120.bpl__Scktcomp_TCustomWinSocket_ReceiveBuf_qqrpvi
test eax, eax
je 0x50079266
push ebx
push sym.rtl120.bpl__Scktcomp_TServerClientThread_DoRead_qqrv
mov eax, ebx
call sym.rtl120.bpl__Classes_TThread_Synchronize_qqrynpqqrv_v
push edi
push 0
push esi
push 0
push 0
call sub.wsock32.dll_select
test eax, eax
jle 0x50079253
cmp byte [ebx + 0xd], 0
jne 0x50079253
push ebx
push sym.rtl120.bpl__Scktcomp_TServerClientThread_DoWrite_qqrv
mov eax, ebx
call sym.rtl120.bpl__Classes_TThread_Synchronize_qqrynpqqrv_v
cmp byte [ebx + 0xd], 0
jne 0x50079266
mov eax, dword [ebx + 0x40]
cmp byte [eax + 8], 0
jne 0x500791db
add esp, 0x10c
pop edi
pop esi
pop ebx
ret
Function at 0x500796cc
Capabilities:
Get socket status

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ecx, edx
mov ebx, eax
mov eax, ecx
mov esi, 0x3e8
cdq
idiv esi
mov dword [esp], eax
mov eax, ecx
mov ecx, 0x3e8
cdq
idiv ecx
imul eax, edx, 0x3e8
mov dword [esp + 4], eax
lea eax, [esp + 8]
call fcn.500753f4
lea edx, [esp + 8]
mov eax, dword [ebx + 4]
mov eax, dword [eax + 4]
call fcn.500753e4
push esp
push 0
push 0
lea eax, [esp + 0x14]
push eax
push 0
call sub.wsock32.dll_select
test eax, eax
setg al
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0x50079730
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x3c], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x50079883
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call sym.rtl120.bpl__Scktcomp_TCustomWinSocket_Lock_qqrv
xor eax, eax
push ebp
push 0x50079861
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1c]
xor ecx, ecx
mov edx, 0x14
call sym.rtl120.bpl__System__FillChar_qqrpvib
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 8]
push eax
push esi
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
jne 0x50079808
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x3e5
je 0x50079808
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
lea edx, [ebp - 0x38]
mov eax, dword [sym.rtl120.bpl__Rtlconsts__sSocketRead]
call sym.rtl120.bpl__System_LoadResString_qqrp20System_TResStringRec
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0x11
mov dword [ebp - 0x2c], ebx
mov byte [ebp - 0x28], 0
lea edx, [ebp - 0x3c]
mov eax, ebx
call sym.rtl120.bpl__Sysutils_SysErrorMessage_qqrui
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea eax, [ebp - 0x34]
push eax
push 2
mov ecx, dword [sym.rtl120.bpl__Rtlconsts__sSocketIOError]
mov dl, 1
mov eax, dword [sym.rtl120.bpl__Scktcomp_ESocketError_]
call sym.rtl120.bpl__Sysutils_Exception__bctr_qqrp20System_TResStringRecpx14System_TVarRecxi
call sym.rtl120.bpl__System__RaiseExcept_qqrv
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
call dword [ecx + 8]
test al, al
je 0x50079824
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x50079848
push 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_GetOverlappedResult
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call sym.rtl120.bpl__Syncobjs_TEvent_ResetEvent_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50079868
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call sym.rtl120.bpl__Scktcomp_TCustomWinSocket_Unlock_qqrv
ret
Function at 0x50079894
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x3c], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x500799dc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call sym.rtl120.bpl__Scktcomp_TCustomWinSocket_Lock_qqrv
xor eax, eax
push ebp
push 0x500799ba
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1c]
xor ecx, ecx
mov edx, 0x14
call sym.rtl120.bpl__System__FillChar_qqrpvib
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 8]
push eax
push esi
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
jne 0x5007996c
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x3e5
je 0x5007996c
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
lea edx, [ebp - 0x38]
mov eax, dword [sym.rtl120.bpl__Rtlconsts__sSocketWrite]
call sym.rtl120.bpl__System_LoadResString_qqrp20System_TResStringRec
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0x11
mov dword [ebp - 0x2c], ebx
mov byte [ebp - 0x28], 0
lea edx, [ebp - 0x3c]
mov eax, ebx
call sym.rtl120.bpl__Sysutils_SysErrorMessage_qqrui
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea eax, [ebp - 0x34]
push eax
push 2
mov ecx, dword [sym.rtl120.bpl__Rtlconsts__sSocketIOError]
mov dl, 1
mov eax, dword [sym.rtl120.bpl__Scktcomp_ESocketError_]
call sym.rtl120.bpl__Sysutils_Exception__bctr_qqrp20System_TResStringRecpx14System_TVarRecxi
call sym.rtl120.bpl__System__RaiseExcept_qqrv
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
call dword [ecx + 8]
test al, al
je 0x50079988
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x500799a1
push 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_GetOverlappedResult
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x500799c1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call sym.rtl120.bpl__Scktcomp_TCustomWinSocket_Unlock_qqrv
ret

Function at 0x50079e60
Capabilities:
Check os version

Disassembly:
unpckhps xmm1, xmmword [ecx + 0x47]
je 0x50079eaa
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x50079ed0
js 0x50079ee1
push eax
jb 0x50079edf
jo 0x50079ed7
jb 0x50079ee8
imul esp, dword [ebp + 0x73], 0x50001360
add esp, esi
sub dh, byte [edi]
push ecx
out 0xca, eax
iretd
jb 0x50079f4e
mov esi, 0xaa0081
mov byte [0x4d0325fa], al
je sym.rtl120.bpl___xp_19ITransactionContext
add eax, 0xfcffff00
sahf
pop es
push eax
Function at 0x50079ec8
Capabilities:
Check os version

Disassembly:
movups xmmword [ecx + 0x53], xmm1
arpl word gs:[ebp + 0x72], si
imul esi, dword [ecx + edi*2 + 0x50], 0x65706f72
jb 0x50079f4e
jns 0x50079f3c
adc eax, dword [eax]
push eax
add edx, ebp
sub dh, byte [edi]
push ecx
out 0xca, eax
iretd

Function at 0x50079f30
Capabilities:
Check os version

Disassembly:
movhps xmm1, qword [ecx + 0x4f]
bound ebp, qword [edx + 0x65]
arpl word [ebx + eax*2 + 0x6f], si
outsb dx, byte [esi]
je 0x50079fa3
js 0x50079fb4
inc ecx
arpl word [ecx + ebp*2 + 0x76], si
imul esi, dword [ecx + edi*2 + 0x60], 0x1500013
cld
sub dh, byte [edi]
push ecx

Function at 0x50079f6c
Capabilities:
Check os version

Disassembly:
out 0xca, eax
iretd
movlps qword [ecx + 0x54], xmm1
jb 0x50079fd3
outsb dx, byte [esi]
jae 0x50079fd6
arpl word [ecx + ebp*2 + 0x6f], si
outsb dx, byte [esi]
inc ebx
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x50079fe4
js 0x50079ff5
pop esp
adc al, 0
push eax
add dword [ecx], esp
cld
cdq
jns 0x50079f51
invalid
sub bl, dh
movsd dword es:[edi], dword [esi]
iretd

Function at 0x50079fa4
Capabilities:
Check os version

Disassembly:
ror edi, cl
adc dword [ebx + ebp*4 - 0x5adb6000], ebp
pop edx
out dx, eax
add ecx, dword [ebp + 0x74]
js 0x50079f9e
add bh, bh
dec dword [ebx + 0x79fa4c0]
mov eax, eax
movsb byte es:[edi], byte [esi]
lahf
pop es
push eax
unpckhps xmm1, xmmword [ecx + 0x54]
jb 0x5007a00b
outsb dx, byte [esi]
jae 0x5007a00e
arpl word [ecx + ebp*2 + 0x6f], si
outsb dx, byte [esi]
inc ebx
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x5007a01c
js 0x5007a02d
inc ebp
js 0x5007a01c
adc eax, dword [eax]
push eax
add dword [edx], esp
cld
cdq
jns 0x50079f8b
ror edi, cl
adc dword [ebx + ebp*4 - 0x5adb6000], ebp
pop edx
out dx, eax
add ecx, dword [ebp + 0x74]
js 0x50079fd8
add bh, bh
invalid
fcomp qword [edi + 0xf0f5007]
dec ecx
push ebx
push 0x64657261
push eax
rcl byte [eax], 0xa0
pop es

Function at 0x5007a010
Capabilities:
Check os version

Disassembly:
unpcklps xmm1, xmmword [ecx + 0x53]
push 0x64657261
push eax
jb 0x5007a08b
jo 0x5007a083
jb 0x5007a094
jns 0x5007a069
jb 0x5007a093
jne 0x5007a096
pop esp
adc al, 0
push eax
add dword [edi], eax
pop esp
add byte [edx], ch
fisub word [ebp + 0x669e11cf]
add byte [edx + 0x64f4a300], ch
add ecx, dword [ebp + 0x74]
js 0x5007a046
add bh, bh
call dword [eax + sym.rtl120.bpl___xp_27ISharedPropertyGroupManager]
pop es
push eax
rol byte [ecx - 0x1133c], 0xff
mov dword [esp], 0x114
add al, 0x24
adc al, 1
add byte [eax], al
push esp
call sub.kernel32.dll_GetVersionExW
cmp dword [esp + 0x10], 2
xchg ecx, eax
dec eax
stc
inc dword [ebx + 0x210247c]
jne 0x5007a0a9
cmp dword [esp + 4], 5
Function at 0x5007a084
Capabilities:
Check os version

Disassembly:
unpcklps xmm1, xmmword [ecx + 0x53]
push 0x64657261
push eax
jb 0x5007a08b
jo 0x5007a083
jb 0x5007a094
jns 0x5007a069
jb 0x5007a093
jne 0x5007a096
pop esp
adc al, 0
push eax
add dword [edi], eax
pop esp
add byte [edx], ch
fisub word [ebp + 0x669e11cf]
add byte [edx + 0x64f4a300], ch
add ecx, dword [ebp + 0x74]
js 0x5007a046
add bh, bh
call dword [eax + sym.rtl120.bpl___xp_27ISharedPropertyGroupManager]
pop es
push eax
rol byte [ecx - 0x1133c], 0xff
mov dword [esp], 0x114
add al, 0x24
adc al, 1
add byte [eax], al
push esp
call sub.kernel32.dll_GetVersionExW
cmp dword [esp + 0x10], 2
xchg ecx, eax
dec eax
stc
inc dword [ebx + 0x210247c]
jne 0x5007a0a9
cmp dword [esp + 4], 5

Function at 0x5007f9c4
Capabilities:
Query or enumerate registry value

Disassembly:
add esp, 0xfffffecc
cmp byte [0x5009e290], 0
jne 0x5007faa1
mov byte [0x5009e290], 1
xor eax, eax
mov dword [0x5009e25c], eax
mov dword [esp + 0xc], 0x114
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetVersionExW
cmp dword [esp + 0x10], 3
ja 0x5007fa0c
cmp dword [esp + 0x10], 3
jne 0x5007fa77
cmp dword [esp + 0x14], 0x33
jbe 0x5007fa77
mov dword [esp + 4], 0x12
push esp
push 0x20019
push 0
push 0x5007faa8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x5007faa1
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x124]
push eax
lea eax, [esp + 0x10]
push eax
push 0
push 0x5007fb08
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x5007faa1
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
cmp word [esp + 0x120], 0x31
jne 0x5007faa1
cmp word [esp + 0x122], 0
jne 0x5007faa1
jmp 0x5007fa8c
push 0
push 0x5007fb08
push 0x5007fb14
call sub.kernel32.dll_GetProfileIntW
test eax, eax
je 0x5007faa1
mov eax, dword [sym.rtl120.bpl__Mapi_MAPIDLL]
call sym.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.kernel32.dll_LoadLibraryW
mov dword [0x5009e25c], eax
add esp, 0x134
ret

Function at 0x50088500
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movlps qword [ecx + 0x57], xmm1
imul esp, dword [ebp + 0x53], 0x6e697274
jae 0x50088550
popal
jo 0x50088587
jb 0x50088576
adc eax, dword [eax]
push eax
add dword [ebx], edi
push cs
invalid
push eax
test byte [ebx], ch
push eax

Function at 0x50088594
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xchg esp, eax
test dword [eax], ecx
push eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
xchg esp, eax
push ss
push esp
push edi
imul esp, dword [ebp + 0x53], 0x6e697274
jae 0x500885e7
outsb dx, byte [esi]
jne 0x50088612
jb 0x50088609
je 0x50088619
jb 0x5008853c
mov al, 0x85
or byte [eax + 7], dl
pop es
add byte [eax], al
add byte [eax], al
add byte [esi + eax*4 - 0x7917aff8], bh
or byte [eax], dl
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add dh, dl
adc eax, dword [eax + edx*2]
Function at 0x500885b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test dword [eax], ecx
push eax
adc byte [eax], al
add byte [eax], al
loopne 0x50088578
add byte [eax - 0x58], dl
insb byte es:[edi], dx
add byte [eax - 0x50], dl
insb byte es:[edi], dx
add byte [eax + 0x20], dl
outsd dx, dword [esi]
add byte [eax + 0x18], dl
outsd dx, dword [esi]
add byte [eax + 0x38], dl
outsd dx, dword [esi]
add byte [eax + 0x3c], dl
outsd dx, dword [esi]
cmp byte [edi], ch
push eax
cmp al, 0x6f
add byte [eax + 0x40], dl
outsd dx, dword [esi]
add byte [eax + 0x34], dl
outsd dx, dword [esi]
add byte [eax - 0x7c], dl
imul eax, dword [eax], 0x50
mov al, byte [0xdc50006b]
imul eax, dword [eax], 0x50
pop es
push ss
push esp
push edi
imul esp, dword [ebp + 0x53], 0x6e697274
jae 0x50088604
outsb dx, byte [esi]
jne 0x5008862f
jb 0x50088626
je 0x50088636
jb 0x5008855d
test dword [eax], ecx
push eax
inc eax
adc eax, dword [eax]
push eax
add byte [eax], al
or edx, dword [edi + 0x69]
push ebx
je 0x5008864c
imul ebp, dword [esi + 0x67], 0x38000073
xchg byte [eax], cl
push eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
mov esp, 0xe8500886
xchg byte [eax], cl
push eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
salc
xchg byte [eax], cl
push eax
and byte [eax], al
add byte [eax], al
adc byte [ebx], 4
push eax
test al, 0x6c
add byte [eax - 0x50], dl
insb byte es:[edi], dx
add byte [eax + 0x20], dl
outsd dx, dword [esi]
add byte [eax + 0x18], dl
outsd dx, dword [esi]
add byte [eax + 0x38], dl
outsd dx, dword [esi]
add byte [eax + 0x3c], dl
outsd dx, dword [esi]
add byte [eax + 0x40], dl
outsd dx, dword [esi]
add byte [eax + 0x34], dl
outsd dx, dword [esi]
add byte [eax - 0x7c], dl
imul eax, dword [eax], 0x50
push eax
mov al, byte [0x3c50006b]
mov dword [eax], ecx
push eax
or byte [eax - 0x24], dl
mov word [eax], cs
push eax
int3
mov esp, 0x38500049
Function at 0x5008d9c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x74]
sub edi, dword [ebx + 0x6c]
jmp 0x5008d9ef
mov eax, dword [ebx + 0x2c]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x6c]
ja 0x5008da6e
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.5008b2d8
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], ebp
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x5008da3c
mov cx, word [esp]
sub cx, si
jmp 0x5008da3e
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x5008da25
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x5008da64
mov cx, word [esp]
sub cx, si
jmp 0x5008da66
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x5008da4d
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x5008dacb
mov edx, dword [ebx + 0x38]
mov ecx, edi
add edx, dword [ebx + 0x6c]
mov eax, ebp
add edx, dword [ebx + 0x74]
call fcn.5008d694
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x5008dab6
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x6c]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x5008dacb
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x5008d9ca
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x50095cec
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x50095d3e
test eax, edx
je 0x50095d41
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x50095d01
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x50095d27
add ecx, 4
js 0x50095d17
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x50095d24
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x50095d4d
test edx, edx
jne 0x50095cf4
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret
Function at 0x407788
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0040acb0
test esi, esi
jne 0x4077be
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.0040ae48
jmp 0x4077dc
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00407668
mov edi, eax
test esi, esi
je 0x4077dc
cmp dword [ebx], 0
je 0x4077dc
dec esi
jmp 0x4077c5
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x409834
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.00409cf4
mov byte [esp], al
cmp byte [esp], 0
jne 0x4099bd
test edi, edi
je 0x4099bd
mov byte [esp + 1], 0
test ebp, ebp
jle 0x4098fd
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
test ebp, ebp
jle 0x4098d8
cmp edi, 0xffffffff
je 0x409899
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x409899
mov byte [esp], 0
jmp 0x4099bd
cmp dword [esi], 1
jg 0x4098d8
cmp dword [esi], 0
jne 0x4098ca
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x4098ca
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x4099bd
lea eax, [esp + 0xc]
call fcn.004094e8
dec ebp
test ebp, ebp
jg 0x40987e
cmp edi, 0xffffffff
je 0x4098fd
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x4098fb
mov byte [esp], 0
jmp 0x4099bd
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x409842
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x4098fd
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.00409a38
mov edx, eax
mov ebx, dword [0x5008fc]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x409961
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x40995f
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x409961
xor edi, edi
cmp byte [esp], 0
je 0x409987
mov ebx, dword [esi]
test bl, 1
jne 0x40999d
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x409967
mov byte [esp + 1], 1
jmp 0x40999d
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x409987
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x409914
cmp byte [esp], 0
je 0x4099bd
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40a948
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x50005c], 0
je 0x40a9af
cmp word [0x500348], 0xd7b2
jne 0x40a971
cmp dword [0x500350], 0
jbe 0x40a971
mov eax, 0x500344
call dword [0x500360]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x40a9dc
call fcn.0040b5a4
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4fb032], 0
jne 0x40a9cb
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x40ab70
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [0x4fb034], 0
je 0x40ab9b
mov edx, edi
mov eax, esi
call dword [0x4fb034]
mov ebx, eax
jmp 0x40abac
mov eax, 8
call fcn.00407020
mov ebx, eax
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov byte [0x50005d], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov eax, 0x40ab38
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CreateThread
mov esi, eax
test esi, esi
jne 0x40abdc
mov eax, ebx
call fcn.0040703c
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc