joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c7917
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
and dword [esi], 0
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4c7971
cmp dword [ebp + 0x10], 1
je 0x4c7956
cmp dword [ebp + 0x10], 2
je 0x4c7956
push 0xd
pop eax
jmp 0x4c7971
mov eax, dword [ebp - 4]
test edi, edi
je 0x4c796d
test eax, eax
je 0x4c796a
cmp byte [eax + edi - 1], 0
je 0x4c796d
jmp 0x4c7951
mov byte [edi], 0
mov dword [esi], eax
xor eax, eax
pop edi
pop esi
leave
ret 0xc

Function at 0x4c79a9
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
push dword [ecx + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp eax, 5
je 0x4c79ee
cmp byte [ebp + 0x18], 0
je 0x4c79ee
test eax, eax
je 0x4c79ee
push 0
push eax
lea ecx, [ebp - 0x3c]
call fcn.004cb0b4
push 0x7c8444
lea eax, [ebp - 0x3c]
push eax
call fcn.004d4753
leave
ret 0x14

Function at 0x4c7e00
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
lea eax, [ecx + 4]
sub esp, 0x3c
cmp dword [eax + 0x14], 0x10
jb 0x4c7e11
mov eax, dword [eax]
push eax
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
je 0x4c7e3c
cmp eax, 2
je 0x4c7e3c
push 0
push eax
lea ecx, [ebp - 0x3c]
call fcn.004cb0b4
push 0x7c8444
lea eax, [ebp - 0x3c]
push eax
call fcn.004d4753
leave
ret
Function at 0x4c8916
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x72a389
call fcn.004dc888
sub esp, 0x50
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 0x10], ebx
push edi
mov esi, ecx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
push dword [ebp + 0x10]
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], ebx
call fcn.004c841d
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x20]
push eax
call fcn.004c854f
mov eax, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
sub eax, edi
mov dword [ebp + 0x10], eax
cmp dword [ebp + 0xc], ebx
je 0x4c8983
push str._Default_
push dword [ebp + 0xc]
call fcn.004dc383
pop ecx
pop ecx
test eax, eax
jne 0x4c8983
lea eax, [ebp + 0x10]
push eax
push edi
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
jmp 0x4c8990
lea eax, [ebp + 0x10]
push eax
push edi
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [ebp + 0xc]
push dword [esi + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 0xea
je 0x4c89a8
cmp edi, ebx
jne 0x4c89db
cmp eax, ebx
jne 0x4c89ec
push dword [ebp + 0x10]
lea ecx, [ebp - 0x20]
call fcn.004c854f
mov eax, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
sub eax, edi
cmp eax, dword [ebp + 0x10]
jne 0x4c89d8
lea eax, [ebp + 0x10]
push eax
push edi
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [ebp + 0xc]
push dword [esi + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jmp 0x4c89db
push 8
pop eax
cmp eax, ebx
jne 0x4c89ec
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0x10]
push dword [ebp + 0x10]
mov dword [esi], eax
jmp 0x4c8a14
cmp eax, 5
je 0x4c8a0e
cmp byte [ebp + 0x14], bl
je 0x4c8a0e
push ebx
push eax
lea ecx, [ebp - 0x5c]
call fcn.004cb0b4
push 0x7c8444
lea eax, [ebp - 0x5c]
push eax
call fcn.004d4753
mov esi, dword [ebp + 8]
push ebx
mov dword [esi], ebx
push edi
lea ecx, [esi + 4]
call fcn.004c86dd
lea ecx, [ebp - 0x20]
call fcn.004c8145
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10

Function at 0x4c8e76
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
push esi
push edi
xor edi, edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x140]
mov esi, ecx
push eax
push dword [esi + 0x20]
mov dword [ebp - 4], 0x100
push dword [esi + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, edi
jne 0x4c8eca
mov ecx, esi
cmp dword [ebp - 4], edi
jne 0x4c8eb9
push str._Default_
jmp 0x4c8ec0
lea eax, [ebp - 0x140]
push eax
call fcn.004019e8
inc dword [esi + 0x20]
jmp 0x4c8edb
cmp eax, 0x103
jne 0x4c8ee1
push 0xffffffffffffffff
push edi
mov ecx, esi
call fcn.00401ba1
pop edi
mov eax, esi
pop esi
leave
ret
push edi
push eax
lea ecx, [ebp - 0x40]
call fcn.004cb0b4
push 0x7c8444
lea eax, [ebp - 0x40]
push eax
call fcn.004d4753
int3
Function at 0x4c8efa
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x72a3d7
call fcn.004dc888
sub esp, 0x148
push ebx
push esi
lea eax, [ebp - 0x54]
push eax
xor ebx, ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x154]
mov esi, ecx
push eax
push dword [esi + 0x24]
mov dword [ebp - 0x10], 0x100
push dword [esi + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, ebx
jne 0x4c8f50
lea eax, [ebp - 0x154]
push eax
lea ecx, [esi + 0x28]
call fcn.004019e8
inc dword [esi + 0x24]
mov byte [esi + 0x64], bl
jmp 0x4c8f90
cmp eax, 0x103
jne 0x4c8fa0
push 0xffffffffffffffff
push ebx
lea ecx, [esi + 0x28]
call fcn.00401ba1
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
lea eax, [ebp - 0x30]
push eax
lea ecx, [esi + 0x44]
mov dword [ebp - 4], ebx
call fcn.004c8df2
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.004010ac
mov byte [esi + 0x64], 1
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
push ebx
push eax
lea ecx, [ebp - 0x4c]
call fcn.004cb0b4
push 0x7c8444
lea eax, [ebp - 0x4c]
push eax
call fcn.004d4753
int3

Function at 0x4c9691
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push 0x94
lea eax, [ebp - 0x94]
push 0
push eax
call fcn.004d4a00
add esp, 0xc
lea eax, [ebp - 0x94]
push eax
mov dword [ebp - 0x94], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x90], 6
sbb eax, eax
inc eax
leave
ret
Function at 0x4d482d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x7d3574]
jne 0x4d4837
repz ret
jmp fcn.004e8963

Function at 0x4d8036
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x4d805d
call fcn.004d5496
mov dword [eax], esi
call fcn.004d5483
push 0x16
pop esi
mov dword [eax], esi
call fcn.004e19db
mov eax, esi
jmp 0x4d80b2
test dword [ebp + 0xc], 0xfffffff9
jne 0x4d8043
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4d808a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004d54a9
pop ecx
call fcn.004d5483
mov eax, dword [eax]
jmp 0x4d80b2
test al, 0x10
jne 0x4d80b0
test al, 1
je 0x4d80b0
test byte [ebp + 0xc], 2
je 0x4d80b0
call fcn.004d5496
mov dword [eax], 5
call fcn.004d5483
mov dword [eax], 0xd
jmp 0x4d8081
xor eax, eax
pop esi
pop ebp
ret
Function at 0x4f8567
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x7d3574]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004e3c0f
and dword [ebp - 0x14], 0
cmp dword [0x7d7ad4], 0
mov dword [ebp - 0x18], eax
jne 0x4f861a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4f86c2
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x749d48
push ebx
call edi
test eax, eax
je 0x4f86c2
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x7d7ad4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x7d7ad8], eax
call edi
push eax
call esi
push 0x749d08
push ebx
mov dword [0x7d7adc], eax
call edi
push eax
call esi
mov dword [0x7d7ae4], eax
test eax, eax
je 0x4f861a
push 0x749cf0
push ebx
call edi
push eax
call esi
mov dword [0x7d7ae0], eax
mov eax, dword [0x7d7ae0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4f8673
cmp dword [0x7d7ae4], ecx
je 0x4f8673
push eax
call esi
push dword [0x7d7ae4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4f8673
test ebx, ebx
je 0x4f8673
call edi
test eax, eax
je 0x4f866a
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4f866a
test byte [ebp - 8], 1
jne 0x4f8673
or dword [ebp + 0x10], 0x200000
jmp 0x4f86a6
mov eax, dword [0x7d7ad8]
cmp eax, dword [ebp - 0x18]
je 0x4f86a6
push eax
call esi
test eax, eax
je 0x4f86a6
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4f86a6
mov eax, dword [0x7d7adc]
cmp eax, dword [ebp - 0x18]
je 0x4f86a6
push eax
call esi
test eax, eax
je 0x4f86a6
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x7d7ad4]
call esi
test eax, eax
je 0x4f86c2
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4f86c4
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d482d
leave
ret
Function at 0x526c60
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xc
call fcn.004d61c0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.005c0990
add esp, 8
mov dword [ebp - 8], eax
mov dword [ebp - 4], 1
push 0x62
mov edx, dword [ebp + 0xc]
push edx
call fcn.004d0b30
add esp, 8
test eax, eax
jne 0x526ca2
mov eax, dword [ebp - 4]
or eax, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
jne 0x526d51
call fcn.005316f0
push str.BIO_new_file
push 0x43
push str.crypto_bio_bss_file.c
call fcn.00531940
add esp, 0xc
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push str.calling_fopen__s___s_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 2
call fcn.00531a70
add esp, 0x14
call fcn.004d5483
cmp dword [eax], 2
je 0x526cf7
call fcn.004d5483
cmp dword [eax], 6
jne 0x526d23
call fcn.005316f0
push str.BIO_new_file
push 0x4b
push str.crypto_bio_bss_file.c
call fcn.00531940
add esp, 0xc
push 0
push 0x80
push 0x20
call fcn.00531a70
add esp, 0xc
jmp 0x526d4d
call fcn.005316f0
push str.BIO_new_file
push 0x4d
push str.crypto_bio_bss_file.c
call fcn.00531940
add esp, 0xc
push 0
push 0x80002
push 0x20
call fcn.00531a70
add esp, 0xc
xor eax, eax
jmp 0x526d9f
call fcn.00526e10
push eax
call fcn.004ff000
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x526d78
mov eax, dword [ebp - 8]
push eax
call fcn.004d4438
add esp, 4
xor eax, eax
jmp 0x526d9f
push 0
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.004ff330
add esp, 8
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
push 0x6a
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.004ffe90
add esp, 0x10
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x527000
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
call fcn.004d61c0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0
je 0x527074
cmp dword [ebp + 0xc], 0
je 0x527074
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x1c]
and edx, 0
je 0x52704c
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
push ecx
push 1
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.004d4351
add esp, 0x10
mov dword [ebp - 4], eax
jmp 0x527068
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x28]
push edx
push 1
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004d4351
add esp, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x527074
mov edx, dword [ebp + 0x10]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x53d1b0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
call fcn.004d61c0
mov dword [ebp - 4], 0
push 0
call dword [sym.imp.WSOCK32.dll_WSASetLastError]
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x24]
push eax
call dword [sym.imp.WSOCK32.dll_send]
mov dword [ebp - 4], eax
push 0xf
mov ecx, dword [ebp + 8]
push ecx
call fcn.004ff330
add esp, 8
cmp dword [ebp - 4], 0
jg 0x53d218
mov edx, dword [ebp - 4]
push edx
call fcn.0053d3d0
add esp, 4
test eax, eax
je 0x53d218
push 0xa
mov eax, dword [ebp + 8]
push eax
call fcn.004ff360
add esp, 8
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x55b220
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, 8
call fcn.004d61c0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp dword [edx], 5
je 0x55b25c
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0055ac60
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jg 0x55b25c
mov eax, dword [ebp - 4]
jmp 0x55b2b3
push 0
call dword [sym.imp.WSOCK32.dll_WSASetLastError]
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x24]
push edx
call dword [sym.imp.WSOCK32.dll_send]
mov dword [ebp - 4], eax
push 0xf
mov eax, dword [ebp + 8]
push eax
call fcn.004ff330
add esp, 8
cmp dword [ebp - 4], 0
jg 0x55b2b0
mov ecx, dword [ebp - 4]
push ecx
call fcn.0053d3d0
add esp, 4
test eax, eax
je 0x55b2b0
push 0xa
mov edx, dword [ebp + 8]
push edx
call fcn.004ff360
add esp, 8
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x579f00
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x240
call fcn.004d61c0
mov eax, dword [0x7d3574]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0x767a60
mov dword [ebp - 0x1c], 0x57a1b0
mov dword [ebp - 0x18], str.getnameinfo
mov dword [ebp - 0x14], 0x57aa70
mov dword [ebp - 0x10], 0x767a44
mov dword [ebp - 0xc], fcn.0057a140
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 0
cmp dword [0x7d7fc0], 0
je 0x579f6f
movzx eax, word [ebp + 8]
mov eax, dword [eax*8 + 0x7d4d90]
jmp 0x57a129
push 0x104
lea ecx, [ebp - 0x240]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x579f8a
jmp 0x57a07f
lea edx, [ebp - 0x240]
push edx
push 0x10c
lea eax, [ebp - 0x138]
push eax
call fcn.004e1b90
add esp, 0xc
push str.ws2_32
push 0x10c
lea ecx, [ebp - 0x138]
push ecx
call fcn.004f13c0
add esp, 0xc
lea edx, [ebp - 0x138]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x579ffd
push 0x767a60
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x579ffd
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x24], 0
cmp dword [ebp - 0x24], 0
je 0x57a005
jmp 0x57a07f
lea edx, [ebp - 0x240]
push edx
push 0x10c
lea eax, [ebp - 0x138]
push eax
call fcn.004e1b90
add esp, 0xc
push str.wship6
push 0x10c
lea ecx, [ebp - 0x138]
push ecx
call fcn.004f13c0
add esp, 0xc
lea edx, [ebp - 0x138]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x57a078
push 0x767a60
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x57a078
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x24], 0
jmp 0x57a07f
cmp dword [ebp - 0x24], 0
je 0x57a114
mov dword [ebp - 4], 0
jmp 0x57a09b
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp eax, dword [0x767a30]
jge 0x57a0de
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + ecx*8 - 0x20]
push edx
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*8 - 0x1c], eax
mov edx, dword [ebp - 4]
cmp dword [ebp + edx*8 - 0x1c], 0
jne 0x57a0dc
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x24], 0
jmp 0x57a0de
jmp 0x57a092
cmp dword [ebp - 0x24], 0
je 0x57a114
mov dword [ebp - 4], 0
jmp 0x57a0f6
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [0x767a30]
jge 0x57a114
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + ecx*8 - 0x1c]
mov dword [eax*8 + 0x7d4d90], edx
jmp 0x57a0ed
mov dword [0x7d7fc0], 1
movzx eax, word [ebp + 8]
mov eax, dword [eax*8 + 0x7d4d90]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004d482d
mov esp, ebp
pop ebp
ret 4
Function at 0x57a5b0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xc
call fcn.004d61c0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
jmp 0x57a5e3
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
movsx eax, byte [edx]
test eax, eax
je 0x57a603
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx]
cmp edx, 0x2e
jne 0x57a601
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
jmp 0x57a5da
cmp dword [ebp - 0xc], 3
je 0x57a60d
xor eax, eax
jmp 0x57a631
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WSOCK32.dll_inet_addr]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x57a624
xor eax, eax
jmp 0x57a631
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
mov dword [edx], eax
mov eax, 1
mov esp, ebp
pop ebp
ret 8

Function at 0x57a8b0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10
call fcn.004d61c0
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 0xc]
mov dword [ecx], 0
mov edx, dword [ebp + 0x18]
mov byte [edx], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WSOCK32.dll_gethostbyname]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x57a97f
mov ecx, dword [ebp - 8]
movsx edx, word [ecx + 8]
cmp edx, 2
jne 0x57a95f
mov eax, dword [ebp - 8]
movsx ecx, word [eax + 0xa]
cmp ecx, 4
jne 0x57a95f
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0xc]
mov dword [ebp - 4], eax
jmp 0x57a91c
mov ecx, dword [ebp - 4]
add ecx, 4
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp dword [edx], 0
je 0x57a95f
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ecx]
push edx
movzx eax, word [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.0057a640
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov edx, dword [ebp - 0xc]
cmp dword [edx], 0
jne 0x57a952
mov eax, 8
jmp 0x57a9c5
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
add ecx, 0x1c
mov dword [ebp - 0xc], ecx
jmp 0x57a913
push 0x400
mov edx, dword [ebp - 8]
mov eax, dword [edx]
push eax
push 0x401
mov ecx, dword [ebp + 0x18]
push ecx
call fcn.004f142d
add esp, 0x10
xor eax, eax
jmp 0x57a9c5
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
sub edx, 0x2af9
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 3
ja case.default.0x57a99d
mov eax, dword [ebp - 0x10]
jmp dword [eax*4 + 0x57a9cc]
mov eax, 0x2af9
jmp 0x57a9c5
mov eax, 0x2afa
jmp 0x57a9c5
mov eax, 0x2afb
jmp 0x57a9c5
mov eax, 0x2af9
jmp 0x57a9c5
mov eax, 0x2af9
mov esp, ebp
pop ebp
ret 0x18
Function at 0x582250
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x7d8168], 0
jne 0x5822f3
mov dword [0x7d8168], 1
push 0x190
push 0
push 0x7d7fd8
call fcn.004d4a00
add esp, 0xc
push 0x7d7fd8
push 0x202
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
je 0x5822f3
call fcn.005316f0
push str.BIO_sock_init
push 0x94
push str.crypto_bio_bio_sock.c
call fcn.00531940
add esp, 0xc
push str.calling_wsastartup__
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
push 2
call fcn.00531a70
add esp, 0xc
call fcn.005316f0
push str.BIO_sock_init
push 0x96
push str.crypto_bio_bio_sock.c
call fcn.00531940
add esp, 0xc
push 0
push 0x7a
push 0x20
call fcn.00531a70
add esp, 0xc
or eax, 0xffffffff
jmp 0x5822f8
mov eax, 1
pop ebp
ret

Function at 0x582870
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x124
call fcn.004d61c0
mov eax, dword [0x7d3574]
xor eax, ebp
mov dword [ebp - 0xc], eax
cmp dword [ebp + 8], 0
jl 0x582893
cmp dword [ebp + 8], 0x40
jl 0x58289b
or eax, 0xffffffff
jmp 0x5829b6
mov eax, dword [ebp + 0x10]
or eax, dword [ebp + 0x14]
jne 0x5828ad
mov eax, 1
jmp 0x5829b6
push 0
call fcn.005829d0
add esp, 4
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x11c], edx
mov ecx, dword [ebp + 0x14]
cmp ecx, dword [ebp - 0x11c]
jg 0x5828e2
jl 0x5828db
mov edx, dword [ebp + 0x10]
cmp edx, dword [ebp - 0x120]
jae 0x5828e2
xor eax, eax
jmp 0x5829b6
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x124], 0
jmp 0x582907
mov eax, dword [ebp - 0x124]
add eax, 1
mov dword [ebp - 0x124], eax
mov ecx, dword [ebp - 0x124]
cmp ecx, dword [ebp - 0x118]
jae 0x58292b
mov edx, dword [ebp - 0x124]
mov eax, dword [ebp + edx*4 - 0x114]
cmp eax, dword [ebp + 8]
jne 0x582929
jmp 0x58292b
jmp 0x5828f8
mov ecx, dword [ebp - 0x124]
cmp ecx, dword [ebp - 0x118]
jne 0x582961
cmp dword [ebp - 0x118], 0x40
jae 0x582961
mov edx, dword [ebp - 0x124]
mov eax, dword [ebp + 8]
mov dword [ebp + edx*4 - 0x114], eax
mov ecx, dword [ebp - 0x118]
add ecx, 1
mov dword [ebp - 0x118], ecx
xor edx, edx
jne 0x5828ec
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp - 0x120]
mov ecx, dword [ebp + 0x14]
sbb ecx, dword [ebp - 0x11c]
mov dword [ebp - 8], eax
lea edx, [ebp - 8]
push edx
push 0
mov eax, dword [ebp + 0xc]
neg eax
sbb eax, eax
not eax
lea ecx, [ebp - 0x118]
and eax, ecx
push eax
mov edx, dword [ebp + 0xc]
neg edx
sbb edx, edx
lea eax, [ebp - 0x118]
and edx, eax
push edx
mov ecx, dword [ebp + 8]
add ecx, 1
push ecx
call dword [sym.imp.WSOCK32.dll_select]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004d482d
mov esp, ebp
pop ebp
ret
Function at 0x59ed30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10
call fcn.004d61c0
mov dword [ebp - 4], 0
jmp 0x59ed4f
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0x10]
jge 0x59ed6f
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 4]
movzx edx, byte [ecx]
cmp eax, edx
jne 0x59ed6f
jmp 0x59ed46
mov eax, dword [ebp + 0x10]
sub eax, 1
mov dword [ebp - 0xc], eax
jmp 0x59ed83
mov ecx, dword [ebp - 0xc]
sub ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0
jl 0x59eda9
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0xc]
movzx eax, byte [edx]
test eax, eax
jne 0x59eda9
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0xc]
movzx edx, byte [ecx]
cmp edx, 0xff
jne 0x59eda9
jmp 0x59ed7a
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jge 0x59edb9
or eax, 0xffffffff
jmp 0x59ee86
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0xc]
jle 0x59edcc
mov eax, dword [ebp - 4]
shl eax, 3
jmp 0x59ee86
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 4]
movzx edx, byte [ecx]
xor eax, edx
mov byte [ebp - 5], al
movzx eax, byte [ebp - 5]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x7e
ja case.0x59ee03.1
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x59eeac]
jmp dword [eax*4 + 0x59ee8c]
mov dword [ebp - 0xc], 7
jmp 0x59ee4e
mov dword [ebp - 0xc], 6
jmp 0x59ee4e
mov dword [ebp - 0xc], 5
jmp 0x59ee4e
mov dword [ebp - 0xc], 4
jmp 0x59ee4e
mov dword [ebp - 0xc], 3
jmp 0x59ee4e
mov dword [ebp - 0xc], 2
jmp 0x59ee4e
mov dword [ebp - 0xc], 1
jmp 0x59ee4e
or eax, 0xffffffff
jmp 0x59ee86
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movzx edx, byte [ecx]
movzx eax, byte [ebp - 5]
and edx, eax
jne 0x59ee76
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 4]
movzx edx, byte [ecx]
movzx eax, byte [ebp - 5]
and edx, eax
movzx ecx, byte [ebp - 5]
cmp edx, ecx
je 0x59ee7d
or eax, 0xffffffff
jmp 0x59ee86
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
lea eax, [eax + edx*8]
mov esp, ebp
pop ebp
ret