joyce8/EMBER2024-capa huggingface dataset:
Function at 0x441370
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x278
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], str.getaddrinfo
mov dword [ebp - 0x18], 0x441600
mov dword [ebp - 0x14], str.getnameinfo
mov dword [ebp - 0x10], 0x441e80
mov dword [ebp - 0xc], str.freeaddrinfo
mov dword [ebp - 8], fcn.00441590
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
cmp dword [0x49ada8], 0
je 0x4413d8
mov eax, dword [ebp + 8]
and eax, 0xffff
mov eax, dword [eax*8 + 0x49aae4]
jmp 0x44157b
push 0x104
lea ecx, [ebp - 0x12c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x4413f3
jmp 0x4414cd
lea edx, [ebp - 0x12c]
push edx
lea eax, [ebp - 0x238]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.ws2_32
lea ecx, [ebp - 0x238]
push ecx
call sub.MSVCRT.dll_strcat
add esp, 8
lea edx, [ebp - 0x238]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x44145c
push str.getaddrinfo
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x44145c
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x441464
jmp 0x4414cd
lea edx, [ebp - 0x12c]
push edx
lea eax, [ebp - 0x238]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.wship6
lea ecx, [ebp - 0x238]
push ecx
call sub.MSVCRT.dll_strcat
add esp, 8
lea edx, [ebp - 0x238]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4414cd
push str.getaddrinfo
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x4414cd
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x441562
mov dword [ebp - 0x24], 0
jmp 0x4414e9
mov edx, dword [ebp - 0x24]
add edx, 1
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
cmp eax, dword [0x487a00]
jge 0x44152c
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp + ecx*8 - 0x1c]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x24]
mov dword [ebp + ecx*8 - 0x18], eax
mov edx, dword [ebp - 0x24]
cmp dword [ebp + edx*8 - 0x18], 0
jne 0x44152a
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 4], 0
jmp 0x44152c
jmp 0x4414e0
cmp dword [ebp - 4], 0
je 0x441562
mov dword [ebp - 0x24], 0
jmp 0x441544
mov ecx, dword [ebp - 0x24]
add ecx, 1
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
cmp edx, dword [0x487a00]
jge 0x441562
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp + ecx*8 - 0x18]
mov dword [eax*8 + 0x49aae4], edx
jmp 0x44153b
mov dword [0x49ada8], 1
mov eax, dword [ebp + 8]
and eax, 0xffff
mov eax, dword [eax*8 + 0x49aae4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x441cc0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
push edi
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 4]
mov dword [ecx], 0
mov edx, dword [ebp + 0x18]
mov byte [edx], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x441d91
mov ecx, dword [ebp - 8]
movsx edx, word [ecx + 8]
cmp edx, 2
jne 0x441d6b
mov eax, dword [ebp - 8]
movsx ecx, word [eax + 0xa]
cmp ecx, 4
jne 0x441d6b
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xc], eax
jmp 0x441d28
mov ecx, dword [ebp - 0xc]
add ecx, 4
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp dword [edx], 0
je 0x441d6b
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
push edx
mov ax, word [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.00441a90
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
cmp dword [edx], 0
jne 0x441d5e
mov eax, 8
jmp 0x441dd6
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
add ecx, 0x1c
mov dword [ebp - 4], ecx
jmp 0x441d1f
push 0x400
mov edx, dword [ebp - 8]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0xc
mov edx, dword [ebp + 0x18]
mov byte [edx + 0x400], 0
xor eax, eax
jmp 0x441dd6
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
sub eax, 0x2af9
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
ja case.default.0x441dae
mov ecx, dword [ebp - 0x10]
jmp dword [ecx*4 + 0x441ddf]
mov eax, 0x2af9
jmp 0x441dd6
mov eax, 0x2afa
jmp 0x441dd6
mov eax, 0x2afb
jmp 0x441dd6
mov eax, 0x2af9
jmp 0x441dd6
mov eax, 0x2af9
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18

Function at 0x4485b0
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf0000040
push 1
push 0
push 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x4485e0
mov eax, 2
jmp 0x448617
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x448609
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 2
jmp 0x448617
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x449eb0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
mov eax, dword [ebp + 0x10]
push eax
call fcn.00449df0
add esp, 4
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.MSVCRT.dll__read]
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44a830
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x44a862
xor eax, eax
jmp 0x44a9b2
push str.LoadLibraryExA
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
push 0x48a5dc
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCRT.dll_strpbrk]
add esp, 8
test eax, eax
je 0x44a8b8
cmp dword [ebp - 8], 0
je 0x44a8a0
push 8
push 0
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 8]
mov dword [ebp - 0x1c], eax
jmp 0x44a8ad
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 4], ecx
jmp 0x44a9af
cmp dword [ebp - 8], 0
je 0x44a8e7
push str.AddDllDirectory
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x44a8e7
push 0x800
push 0
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x44a9af
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x44a9af
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
lea ecx, [eax + edx + 1]
push ecx
call dword [0x49aa88]
add esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x44a9a2
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x44a9a2
push 0x49a764
mov ecx, dword [ebp - 0x18]
push ecx
call sub.MSVCRT.dll_strlen
add esp, 4
mov edx, dword [ebp - 0x18]
add edx, eax
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call sub.MSVCRT.dll_strlen
add esp, 4
mov edx, dword [ebp - 0x18]
add edx, eax
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
cmp dword [ebp - 8], 0
je 0x44a98f
push 8
push 0
mov eax, dword [ebp - 0x18]
push eax
call dword [ebp - 8]
mov dword [ebp - 0x20], eax
jmp 0x44a99c
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x18]
push eax
call dword [0x49aa8c]
add esp, 4
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4596d0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d8
push ebx
push esi
push edi
xor eax, eax
test eax, eax
jne 0x4596dc
mov word [ebp - 8], 2
lea ecx, [ebp - 0x198]
push ecx
mov dx, word [ebp - 8]
push edx
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x45971f
mov eax, dword [ebp - 4]
push eax
push str.WSAStartup_failed___d_
mov ecx, dword [ebp + 8]
push ecx
call fcn.0043aff0
add esp, 0xc
mov eax, 2
jmp 0x459798
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov edx, dword [ebp - 0x198]
and edx, 0xffff
and edx, 0xff
and edx, 0xff
mov eax, dword [ebp - 8]
and eax, 0xffff
and eax, 0xff
and eax, 0xff
cmp edx, eax
jne 0x45977e
mov ecx, dword [ebp - 0x198]
and ecx, 0xffff
shr ecx, 8
and ecx, 0xff
mov edx, dword [ebp - 8]
and edx, 0xffff
shr edx, 8
and edx, 0xff
cmp ecx, edx
je 0x459796
push str.insufficient_winsock_version_to_support_telnet
mov eax, dword [ebp + 8]
push eax
call fcn.0043aff0
add esp, 8
mov eax, 2
jmp 0x459798
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x459a50
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
mov byte [ebp - 4], 0xff
mov dl, byte [ebp + 0xc]
mov byte [ebp - 3], dl
mov al, byte [ebp + 0x10]
mov byte [ebp - 2], al
push 0
push 3
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x190]
push eax
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jge 0x459ab0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
push str.Sending_data_failed___d_
mov edx, dword [ebp - 0x10]
push edx
call fcn.0043aff0
add esp, 0xc
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push str.SENT
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call fcn.00459ae0
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45f0a0
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 0xc]
cdq
mov ecx, 0x64
idiv ecx
cmp eax, 2
je 0x45f0e0
push str.Couldnt_set_desired_mode
mov edx, dword [ebp - 8]
push edx
call fcn.0043aff0
add esp, 8
mov eax, 0x11
jmp 0x45f15b
cmp dword [ebp + 0xc], 0xc8
je 0x45f0fe
mov eax, dword [ebp + 0xc]
push eax
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
mov ecx, dword [ebp - 8]
push ecx
call fcn.0043af70
add esp, 0xc
cmp dword [ebp + 0x10], 0x13
jne 0x45f115
mov edx, dword [ebp + 8]
push edx
call fcn.0045d030
add esp, 4
mov dword [ebp - 4], eax
jmp 0x45f158
cmp dword [ebp + 0x10], 0x14
jne 0x45f12c
mov eax, dword [ebp + 8]
push eax
call fcn.0045f170
add esp, 4
mov dword [ebp - 4], eax
jmp 0x45f158
cmp dword [ebp + 0x10], 0x15
jne 0x45f143
mov ecx, dword [ebp + 8]
push ecx
call fcn.0045f330
add esp, 4
mov dword [ebp - 4], eax
jmp 0x45f158
cmp dword [ebp + 0x10], 0x16
jne 0x45f158
mov edx, dword [ebp + 8]
push edx
call fcn.0045f360
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45fc20
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x194]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0x20], 0x10
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x45fc7d
mov dword [ebp - 0x20], 0x10
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.WS2_32.dll_accept]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00440d20
add esp, 8
cmp dword [ebp - 0xc], 0xffffffff
jne 0x45fcae
push str.Error_accept__ing_server_connect
mov eax, dword [ebp - 4]
push eax
call fcn.0043aff0
add esp, 8
mov eax, 0x1e
jmp 0x45fd40
push str.Connection_accepted_from_server_n
mov ecx, dword [ebp - 4]
push ecx
call fcn.0043af70
add esp, 8
mov edx, dword [ebp + 8]
mov dword [edx + 0x3c8], 0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax + 0x194], ecx
push 1
mov edx, dword [ebp - 0xc]
push edx
call fcn.004715d0
add esp, 8
mov eax, dword [ebp + 8]
mov dword [eax + 0x1a4], 1
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x1a8], 0
je 0x45fd3e
mov dword [ebp - 0x24], 0
push 1
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x1ac]
push ecx
mov edx, dword [ebp - 4]
call dword [edx + 0x1a8]
add esp, 0xc
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x45fd3e
mov eax, dword [ebp + 8]
push eax
call fcn.0045de50
add esp, 4
mov eax, 0x2a
jmp 0x45fd40
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46f900
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
mov dword [ebp - 0x108], eax
mov byte [ebp - 0x104], 0
cmp dword [ebp - 0x108], 0
je 0x46f948
push 0x104
lea ecx, [ebp - 0x104]
push ecx
mov edx, dword [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
movsx eax, byte [ebp - 0x104]
test eax, eax
je 0x46f96b
lea ecx, [ebp - 0x104]
push ecx
call dword [0x49aa94]
add esp, 4
mov dword [ebp - 0x10c], eax
jmp 0x46f975
mov dword [ebp - 0x10c], 0
mov eax, dword [ebp - 0x10c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4715d0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
xor eax, eax
cmp dword [ebp + 0xc], 0
setne al
mov dword [ebp - 4], eax
lea ecx, [ebp - 4]
push ecx
push 0x8004667e
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4750d0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov byte [eax], 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_gethostname]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
add eax, dword [ebp + 0xc]
mov byte [eax - 1], 0
cmp dword [ebp - 4], 0
je 0x475105
mov eax, dword [ebp - 4]
jmp 0x475125
push 0x2e
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCRT.dll_strchr]
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x475123
mov edx, dword [ebp - 8]
mov byte [edx], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x475190
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x20], 8
push 0xf0000000
push 1
push 0
push 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x4751c0
xor eax, eax
jmp 0x475279
push 0x14
push 0
lea ecx, [ebp - 0x1c]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov byte [ebp - 0x1c], 8
mov byte [ebp - 0x1b], 2
mov dword [ebp - 0x18], 0x6601
mov dword [ebp - 0x14], 8
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp + 0x10]
push eax
call fcn.00475280
add esp, 8
push 8
lea ecx, [ebp - 0x10]
push ecx
call fcn.0047c880
add esp, 8
lea edx, [ebp - 8]
push edx
push 0
push 0
push 0x14
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x475230
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
jmp 0x475279
push 8
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov edx, dword [ebp - 0x20]
push edx
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0
push 0
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x475460
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
push eax
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
shl ecx, 1
push ecx
call dword [0x49aa88]
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x47549a
mov eax, 0x1b
jmp 0x475562
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.00475570
add esp, 0xc
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 0
je 0x4754c3
mov eax, dword [ebp - 0xc]
jmp 0x475562
push 0xf0000000
push 1
push 0
push 0
lea edx, [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x475540
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0x8002
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x475534
mov dword [ebp - 0x18], 0x10
push 0
mov edx, dword [ebp - 4]
shl edx, 1
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 2
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push 5
push 0
mov ecx, dword [ebp + 0x10]
add ecx, 0x10
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov edx, dword [ebp - 8]
push edx
call dword [0x49aa8c]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x479b20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
xor edx, edx
cmp dword [ecx + 4], 3
sete dl
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0
je 0x479b71
mov eax, dword [ebp + 8]
cmp dword [eax + 0xc], 0
jne 0x479b50
xor eax, eax
jmp 0x479bfa
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 1
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
call dword [eax + 0xc]
add esp, 0x10
mov dword [ebp - 4], eax
jmp 0x479bc2
mov ecx, dword [ebp + 8]
cmp dword [ecx + 8], 0
jne 0x479ba5
push 0x4990dc
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov edx, dword [ebp + 8]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0
jne 0x479ba5
or eax, 0xffffffff
jmp 0x479bfa
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 1
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x479bf7
mov edx, dword [ebp + 8]
cmp dword [edx + 8], 0
je 0x479beb
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
mov eax, dword [ecx]
mov dword [edx], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100027b0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x30]
lea esi, [ebp - 0x2c]
push ebx
sub esp, 0x2c
mov dword [ebp - 0x30], 0x10
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetComputerNameW]
sub esp, 8
test eax, eax
je 0x10002820
movzx eax, word [ebp - 0x2c]
test ax, ax
je 0x10002807
mov ebx, dword [sym.imp.ucrtbase.dll_towupper]
mov edi, esi
lea esi, cs:[esi]
movzx eax, ax
add edi, 2
mov dword [esp], eax
call ebx
mov word [edi - 2], ax
movzx eax, word [edi]
test ax, ax
jne 0x100027f0
mov dword [esp], esi
call dword [sym.imp.oleaut32.dll_SysAllocString]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x10004f20
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
push ebx
sub esp, 0x20
mov dword [ebp - 0x10], eax
movzx ecx, word [edx]
test esi, esi
je 0x10005090
mov eax, dword [ebp + 8]
test eax, eax
je 0x10005000
test cx, cx
je 0x10005080
mov ebx, edx
nop
add ebx, 2
cmp word [ebx], 0
jne 0x10004f50
sub ebx, edx
sar ebx, 1
cmp word [esi], 0
je 0x10004f77
mov eax, esi
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x10004f68
sub eax, esi
sar eax, 1
add ebx, eax
mov eax, dword [ebp + 8]
cmp word [eax], 0
je 0x10004f90
add eax, 2
cmp word [eax], 0
jne 0x10004f80
sub eax, dword [ebp + 8]
sar eax, 1
add ebx, eax
add ebx, 0x4a
mov dword [ebp - 0x14], edx
lea eax, [ebx + ebx]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov edx, dword [ebp - 0x14]
test eax, eax
mov edi, eax
je 0x100050fa
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x14], eax
mov dword [esp + 8], str.SELECT__FROM___QUALIFIERS_WHERE_Class_s_AND_Member_s_AND_Name_s
mov dword [esp + 4], ebx
mov dword [esp], edi
call sym._swprintf_2
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], edi
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._exec_query
mov dword [esp], edi
mov ebx, eax
call dword [sym.imp.ucrtbase.dll_free]
add esp, 0x20
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
test esi, esi
je 0x10005090
test cx, cx
je 0x100050e7
mov eax, edx
lea esi, cs:[esi]
add eax, 2
cmp word [eax], 0
jne 0x10005018
sub eax, edx
sar eax, 1
cmp word [esi], 0
je 0x1000503f
mov ecx, esi
lea esi, [esi]
add ecx, 2
cmp word [ecx], 0
jne 0x10005030
sub ecx, esi
sar ecx, 1
add eax, ecx
lea ebx, [eax + 0x3c]
mov dword [ebp - 0x14], edx
lea eax, [ebx + ebx]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov edi, eax
test eax, eax
je 0x100050fa
mov edx, dword [ebp - 0x14]
mov dword [esp + 0x10], esi
mov dword [esp + 8], str.SELECT__FROM___QUALIFIERS_WHERE_Class_s_AND_Member_s
mov dword [esp + 0xc], edx
mov dword [esp + 4], ebx
mov dword [esp], eax
call sym._swprintf_2
jmp 0x10004fd2
xor ebx, ebx
jmp 0x10004f5d
mov eax, edx
test cx, cx
je 0x100050ee
lea esi, cs:[esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x100050a0
sub eax, edx
mov ebx, eax
add eax, 0x58
sar ebx, 1
add ebx, 0x2c
mov dword [ebp - 0x14], edx
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov edi, eax
test eax, eax
je 0x100050fa
mov edx, dword [ebp - 0x14]
mov dword [esp + 8], str.SELECT__FROM___QUALIFIERS_WHERE_Class_s
mov dword [esp + 4], ebx
mov dword [esp + 0xc], edx
mov dword [esp], eax
call sym._swprintf_2
jmp 0x10004fd2
xor eax, eax
jmp 0x10005025
mov eax, 0x58
mov ebx, 0x2c
jmp 0x100050b5
mov ebx, 0x8007000e
jmp 0x10004ff3