joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4633c0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb4
push esi
push edi
lea edi, [ebp - 0xb4]
mov ecx, 0x2d
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x4b965c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 8], ecx
mov edx, 4
shl edx, 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + edx + 0x140]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0xa8], 0x80
mov esi, esp
lea edx, [ebp - 0xa8]
push edx
lea eax, [ebp - 0x9c]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.WS2_32.dll_getsockname]
cmp esi, esp
call fcn.004a09b1
test eax, eax
jne 0x463469
mov dword [ebp - 0xa8], 0x80
mov esi, esp
lea edx, [ebp - 0xa8]
push edx
lea eax, [ebp - 0x9c]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.WS2_32.dll_accept]
cmp esi, esp
call fcn.004a09b1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x46348a
push str.Error_accept__ing_server_connect
mov edx, dword [ebp + 8]
push edx
call fcn.0042e770
add esp, 8
mov eax, 0x1e
jmp 0x463564
push str.Connection_accepted_from_server
mov eax, dword [ebp + 8]
push eax
call fcn.0042e8d0
add esp, 8
mov ecx, dword [ebp - 8]
mov byte [ecx + 0x1ed], 0
push 1
mov edx, dword [ebp - 0x14]
push edx
call fcn.00493850
add esp, 8
lea eax, [ebp - 0x14]
push eax
push 1
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0047eff0
add esp, 0x10
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0
je 0x4634e3
mov eax, dword [ebp - 0xb0]
jmp 0x463564
mov eax, dword [ebp + 8]
cmp dword [eax + 0x1ac], 0
je 0x463562
mov dword [ebp - 0xb4], 0
push 1
mov ecx, dword [ebp + 8]
push ecx
call fcn.00412360
add esp, 8
mov esi, esp
push 1
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1b0]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x1ac]
call eax
add esp, 0xc
cmp esi, esp
call fcn.004a09b1
mov dword [ebp - 0xb4], eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.00412360
add esp, 8
cmp dword [ebp - 0xb4], 0
je 0x463562
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00463290
add esp, 8
mov eax, 0x2a
jmp 0x463564
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x463594]
call fcn.004a095d
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a039d
add esp, 0xb4
cmp ebp, esp
call fcn.004a09b1
mov esp, ebp
pop ebp
ret
Function at 0x466820
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 0xc]
cdq
mov ecx, 0x64
idiv ecx
cmp eax, 2
je 0x46686f
push str.Couldnt_set_desired_mode
mov edx, dword [ebp + 8]
push edx
call fcn.0042e770
add esp, 8
mov eax, 0x11
jmp 0x4668fa
cmp dword [ebp + 0xc], 0xc8
je 0x46688d
mov eax, dword [ebp + 0xc]
push eax
push str.Got_a__03d_response_code_instead_of_the_assumed_200
mov ecx, dword [ebp + 8]
push ecx
call fcn.0042e8d0
add esp, 0xc
movzx edx, byte [ebp + 0x10]
cmp edx, 0x13
jne 0x4668ab
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00464ed0
add esp, 8
mov dword [ebp - 4], eax
jmp 0x4668f7
movzx edx, byte [ebp + 0x10]
cmp edx, 0x14
jne 0x4668c5
mov eax, dword [ebp + 8]
push eax
call fcn.00464f80
add esp, 4
mov dword [ebp - 4], eax
jmp 0x4668f7
movzx ecx, byte [ebp + 0x10]
cmp ecx, 0x15
jne 0x4668df
mov edx, dword [ebp + 8]
push edx
call fcn.004651b0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x4668f7
movzx eax, byte [ebp + 0x10]
cmp eax, 0x16
jne 0x4668f7
mov ecx, dword [ebp + 8]
push ecx
call fcn.004651d0
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add esp, 8
cmp ebp, esp
call fcn.004a09b1
mov esp, ebp
pop ebp
ret

Function at 0x46fab0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov eax, 0xcccccccc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x14], ecx
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 8], 0xff
mov ecx, 1
shl ecx, 0
mov dl, byte [ebp + 0xc]
mov byte [ebp + ecx - 8], dl
mov eax, 1
shl eax, 1
mov cl, byte [ebp + 0x10]
mov byte [ebp + eax - 8], cl
mov esi, esp
push 0
push 3
lea edx, [ebp - 8]
push edx
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + ecx + 0x140]
push eax
call dword [sym.imp.WS2_32.dll_send]
cmp esi, esp
call fcn.004a09b1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jge 0x46fb5b
mov esi, esp
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp esi, esp
call fcn.004a09b1
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
push 0x4b4a08
mov edx, dword [ebp + 8]
push edx
call fcn.0042e770
add esp, 0xc
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0x4b4a24
mov edx, dword [ebp + 8]
push edx
call fcn.0046f870
add esp, 0x10
push edx
mov ecx, ebp
push eax
lea edx, [0x46fb94]
call fcn.004a095d
pop eax
pop edx
pop esi
add esp, 0x18
cmp ebp, esp
call fcn.004a09b1
mov esp, ebp
pop ebp
ret
Function at 0x47e840
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
mov eax, 0xcccccccc
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x4020
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x20], 4
cmp dword [0x4ba894], 0
jne 0x47e8b4
push 3
push 2
push 0
push 0
push 6
call fcn.00489a00
add esp, 0x14
movzx eax, al
test eax, eax
je 0x47e8aa
mov dword [0x4ba894], 2
jmp 0x47e8b4
mov dword [0x4ba894], 1
cmp dword [0x4ba894], 2
jne 0x47e8bf
jmp 0x47e915
mov esi, esp
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x14]
push edx
push 0x1001
push 0xffff
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_getsockopt]
cmp esi, esp
call fcn.004a09b1
test eax, eax
jne 0x47e8f2
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 8]
jle 0x47e8f2
jmp 0x47e915
mov esi, esp
push 4
lea edx, [ebp - 8]
push edx
push 0x1001
push 0xffff
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp esi, esp
call fcn.004a09b1
push edx
mov ecx, ebp
push eax
lea edx, [0x47e938]
call fcn.004a095d
pop eax
pop edx
pop esi
add esp, 0x24
cmp ebp, esp
call fcn.004a09b1
mov esp, ebp
pop ebp
ret

Function at 0x47f250
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push esi
push edi
lea edi, [ebp - 0x11c]
mov ecx, 0x47
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x4b965c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x14], 6
mov esi, esp
push 4
lea eax, [ebp - 0xc]
push eax
push 1
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp esi, esp
call fcn.004a09b1
test eax, eax
jge 0x47f2de
push 0x100
lea eax, [ebp - 0x118]
push eax
mov esi, esp
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp esi, esp
call fcn.004a09b1
push eax
call fcn.00409790
add esp, 0xc
push eax
push str.Could_not_set_TCP_NODELAY:__s
mov ecx, dword [ebp + 8]
push ecx
call fcn.0042e8d0
add esp, 0xc
push edx
mov ecx, ebp
push eax
lea edx, [0x47f30c]
call fcn.004a095d
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a039d
add esp, 0x11c
cmp ebp, esp
call fcn.004a09b1
mov esp, ebp
pop ebp
ret
Function at 0x47f340
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push esi
push edi
lea edi, [ebp - 0x34]
mov ecx, 0xd
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x4b965c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0x6d7]
test ecx, ecx
je 0x47f378
mov dword [ebp - 0x34], 1
jmp 0x47f37f
mov dword [ebp - 0x34], 0
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0xc], edx
mov esi, esp
push 4
lea eax, [ebp - 0xc]
push eax
push 8
push 0xffff
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp esi, esp
call fcn.004a09b1
test eax, eax
jge 0x47f3c3
mov edx, dword [ebp + 0xc]
push edx
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d
mov eax, dword [ebp + 8]
push eax
call fcn.0042e8d0
add esp, 0xc
jmp 0x47f467
mov dword [ebp - 0x20], 1
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x670]
push edx
call fcn.00432a40
add esp, 4
mov dword [ebp - 0xc], eax
imul eax, dword [ebp - 0xc], 0x3e8
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x674]
push eax
call fcn.00432a40
add esp, 4
mov dword [ebp - 0xc], eax
imul ecx, dword [ebp - 0xc], 0x3e8
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x18], edx
mov esi, esp
push 0
push 0
lea eax, [ebp - 0x2c]
push eax
push 0
push 0
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 0x98000004
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.WS2_32.dll_WSAIoctl]
cmp esi, esp
call fcn.004a09b1
test eax, eax
je 0x47f467
mov esi, esp
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp esi, esp
call fcn.004a09b1
push eax
mov eax, dword [ebp + 0xc]
push eax
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d
mov ecx, dword [ebp + 8]
push ecx
call fcn.0042e8d0
add esp, 0x10
push edx
mov ecx, ebp
push eax
lea edx, [0x47f494]
call fcn.004a095d
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a039d
add esp, 0x34
cmp ebp, esp
call fcn.004a09b1
mov esp, ebp
pop ebp
ret
Function at 0x480170
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push esi
push edi
lea edi, [ebp - 0x11c]
mov ecx, 0x47
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x4b965c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x14]
mov dword [ecx], 0
mov esi, esp
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x98]
push edx
call dword [sym.imp.WS2_32.dll_recv]
cmp esi, esp
call fcn.004a09b1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x480256
mov esi, esp
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp esi, esp
call fcn.004a09b1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x2733
jne 0x48020a
mov eax, dword [ebp + 0x14]
mov dword [eax], 0x51
mov dword [ebp - 0x10], 0xffffffff
jmp 0x480256
push 0x100
lea ecx, [ebp - 0x118]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.00409790
add esp, 0xc
push eax
push str.Recv_failure:__s
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
push ecx
call fcn.0042e770
add esp, 0xc
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 0x934], ecx
mov edx, dword [ebp + 0x14]
mov dword [edx], 0x38
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 0x10]
push eax
push str.nw_in_read_len_zu______d__err_d
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
push ecx
call fcn.0042e9f0
add esp, 0x18
mov eax, dword [ebp - 0x10]
push edx
mov ecx, ebp
push eax
lea edx, [0x4802b0]
call fcn.004a095d
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a039d
add esp, 0x11c
cmp ebp, esp
call fcn.004a09b1
mov esp, ebp
pop ebp
ret

Function at 0x480b20
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0xffffffff
movzx edx, byte [ebp + 0x10]
test edx, edx
je 0x480b4f
jmp 0x480b79
mov esi, esp
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x14]
push ecx
mov edx, dword [ebp - 4]
add edx, 0x18
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x98]
push ecx
call dword [sym.imp.WS2_32.dll_connect]
cmp esi, esp
call fcn.004a09b1
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
pop esi
add esp, 8
cmp ebp, esp
call fcn.004a09b1
mov esp, ebp
pop ebp
ret
Function at 0x481ba0
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov eax, 0xcccccccc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov dword [ebp - 4], ecx
xor edx, edx
jne 0x481bc1
mov esi, esp
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x14]
push ecx
mov edx, dword [ebp - 4]
add edx, 0x18
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x98]
push ecx
call dword [sym.imp.WS2_32.dll_connect]
cmp esi, esp
call fcn.004a09b1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x481c20
mov esi, esp
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp esi, esp
call fcn.004a09b1
push eax
mov edx, dword [ebp - 4]
add edx, 0xbc
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.00480020
add esp, 0xc
jmp 0x481cb0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004804c0
add esp, 8
mov eax, dword [ebp - 4]
cmp dword [eax], 5
jne 0x481c41
mov dword [ebp - 0xc], str.QUIC
jmp 0x481c48
mov dword [ebp - 0xc], 0x4b5e74
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xec]
push edx
mov eax, dword [ebp - 4]
add eax, 0xbc
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x120]
push edx
mov eax, dword [ebp - 4]
add eax, 0xf0
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x98]
push edx
mov eax, dword [ebp - 0xc]
push eax
push str._s_socket__d_connected:___s:_d_______s:_d_
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.0042e9f0
add esp, 0x24
push 1
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x98]
push ecx
call fcn.00493850
add esp, 8
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
mov dword [ebp - 0x10], eax
xor eax, eax
pop esi
add esp, 0x10
cmp ebp, esp
call fcn.004a09b1
mov esp, ebp
pop ebp
ret
Function at 0x499c60
Capabilities:
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, esp
push 0xf0000040
push 1
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
cmp esi, esp
call fcn.004a09b1
test eax, eax
jne 0x499c8d
mov eax, 0x1b
jmp 0x499cdf
mov ecx, dword [ebp + 8]
add ecx, 4
mov esi, esp
push ecx
push 0
push 0
push 0x8003
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
cmp esi, esp
call fcn.004a09b1
test eax, eax
jne 0x499cdd
mov esi, esp
push 0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
cmp esi, esp
call fcn.004a09b1
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov eax, 2
jmp 0x499cdf
xor eax, eax
pop esi
cmp ebp, esp
call fcn.004a09b1
pop ebp
ret

Function at 0x499e10
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
mov byte [edx + ecx], 0
mov esi, esp
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_gethostname]
cmp esi, esp
call fcn.004a09b1
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
add edx, dword [ebp + 0xc]
mov byte [edx - 1], 0
cmp dword [ebp - 4], 0
je 0x499e63
mov eax, dword [ebp - 4]
jmp 0x499e82
push 0x2e
mov eax, dword [ebp + 8]
push eax
call sub.VCRUNTIME140.dll_strchr
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x499e80
mov ecx, dword [ebp - 8]
mov byte [ecx], 0
xor eax, eax
pop esi
add esp, 8
cmp ebp, esp
call fcn.004a09b1
mov esp, ebp
pop ebp
ret

Function at 0x49e880
Capabilities:
Create new key via cryptacquirecontext
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, esp
push 0xf0000040
push 0x18
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
cmp esi, esp
call fcn.004a09b1
test eax, eax
jne 0x49e8ad
mov eax, 0x1b
jmp 0x49e8ff
mov ecx, dword [ebp + 8]
add ecx, 4
mov esi, esp
push ecx
push 0
push 0
push 0x800c
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
cmp esi, esp
call fcn.004a09b1
test eax, eax
jne 0x49e8fd
mov esi, esp
push 0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
cmp esi, esp
call fcn.004a09b1
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov eax, 2
jmp 0x49e8ff
xor eax, eax
pop esi
cmp ebp, esp
call fcn.004a09b1
pop ebp
ret
Function at 0x4a0150
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0
mov esi, esp
push 0xf0000040
push 1
push 0
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
cmp esi, esp
call fcn.004a09b1
test eax, eax
jne 0x4a018d
xor eax, eax
jmp 0x4a01df
mov eax, dword [ebp + 8]
add eax, 4
mov esi, esp
push eax
push 0
push 0
push 0x8002
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
cmp esi, esp
call fcn.004a09b1
test eax, eax
jne 0x4a01da
mov esi, esp
push 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
cmp esi, esp
call fcn.004a09b1
mov edx, dword [ebp + 8]
mov dword [edx], 0
xor eax, eax
jmp 0x4a01df
mov eax, 1
pop esi
cmp ebp, esp
call fcn.004a09b1
pop ebp
ret

Function at 0x4a1341
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4a1380
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4a1380
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4a1380
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4a1380
cmp dword [ecx + 0x74], 0xe
jbe 0x4a1380
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x402e40
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
push ebx
test eax, eax
je 0x403360
test edx, edx
je 0x403360
call fcn.00402e57
mov eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x406b40
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
call fcn.00406b49
Function at 0x418ba0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x48
mov eax, dword [0x557008]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov eax, ebx
neg eax
mov eax, 0
sbb eax, esi
setl cl
xor eax, eax
test edi, edi
setne al
mov edx, ebx
or edx, esi
movzx ecx, cl
cmovne eax, ecx
cmp al, 1
jne 0x418ccf
mov ecx, ebx
mov eax, 0x418937
xor ecx, eax
cmp eax, ebx
mov eax, 0
sbb eax, esi
setl dl
xor eax, eax
cmp edi, 0x46555f01
setae al
or ecx, esi
movzx ecx, dl
cmovne eax, ecx
test al, al
mov eax, 0x418937
cmovne ebx, eax
mov eax, 0
cmovne esi, eax
mov ecx, 0x46555f00
cmovne edi, ecx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov eax, 0x3d0900
mov dword [ebp - 0x14], eax
mov dword [esp + 0x18], eax
movsd xmm0, qword [ebp - 0x1c]
movsd qword [esp + 0x10], xmm0
mov eax, dword [ebp - 0x20]
mov dword [esp + 0xc], eax
movsd xmm0, qword [ebp - 0x28]
movsd qword [esp + 4], xmm0
lea eax, [ebp - 0x28]
mov dword [esp + 0x1c], eax
mov dword [esp], 1
call fcn.00418cf0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], edi
mov dword [esp + 8], edi
movsd xmm0, qword [ebp - 0x34]
movsd qword [esp], xmm0
lea edi, [ebp + 8]
mov ecx, edi
call fcn.004d66d0
sub esp, 0xc
mov ebx, dword [edi]
mov esi, dword [edi + 4]
mov edi, dword [edi + 8]
mov eax, ebx
neg eax
mov eax, 0
sbb eax, esi
setl cl
xor eax, eax
test edi, edi
setne al
mov edx, ebx
or edx, esi
movzx ecx, cl
cmovne eax, ecx
test al, al
jne 0x418be3
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a927c
add esp, 0x48
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41ab80
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov ecx, dword [ebp + 8]
mov eax, dword [0x557008]
xor eax, ebp
mov dword [esp + 0x28], eax
test ecx, ecx
je 0x41ad81
cmp dword [0x558cb0], 0xe69e32f3
jne 0x41ad84
mov edi, 0x308
mov edx, 0x20
mov esi, 0x20
add edi, dword [ecx + 8]
mov byte [esp + 0xf], 0xff
mov al, byte [ecx + 2]
je 0x41abd4
bsr esi, edi
xor esi, 0x1f
mov ecx, 0x53e834
sub ecx, esi
mov cl, byte [ecx]
mov ebx, edi
shr ebx, cl
sub edx, esi
and ebx, 7
lea ecx, [ebx + edx*8]
mov edx, dword [edx*4 + 0x53e838]
and edx, edi
cmp edx, 1
mov edx, dword [ebp + 8]
lea esi, [edx + 0x48]
sbb ecx, 0xffffffff
movzx ecx, word [ecx + ecx + 0x53e600]
test al, al
mov dword [esp], edi
jne 0x41ac23
cmp edi, 0x41
setae al
cmp cx, 0x76
setb dl
and dl, al
movzx eax, dl
or eax, ecx
mov ecx, eax
movzx ebx, cx
shl ebx, 5
mov dword [esp + 4], esi
lea edi, [esi + ebx]
mov eax, dword [ebp + 8]
lea esi, [eax + 0x40]
push esi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x41ad1e
mov dword [esp + 8], esi
mov eax, dword [edi]
mov esi, dword [eax]
test esi, esi
je 0x41ad2a
mov byte [esp + 0xf], 0
mov ecx, dword [esi]
test ecx, ecx
je 0x41ad17
mov edx, dword [esp + 4]
mov ebx, dword [edx + ebx + 0xc]
bswap ecx
mov edx, ecx
xor edx, esi
cmp edx, 0x1fffff
ja 0x41ad87
mov edx, ecx
and edx, 0x1fc000
je 0x41ad87
prefetcht0 byte [ecx]
mov dword [eax], ecx
mov ecx, dword [eax + 0xc]
lea edx, [ecx + 2]
and edx, 0x3ffe
and ecx, 0xffffc001
or ecx, edx
mov dword [eax + 0xc], ecx
mov edi, dword [ebp + 8]
mov eax, dword [eax + 8]
mov ecx, dword [edi + 0x117c]
add ecx, dword [eax + 0xc]
mov eax, dword [edi + 0x1180]
mov dword [edi + 0x117c], ecx
cmp eax, ecx
cmova ecx, eax
mov dword [edi + 0x1180], ecx
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov ecx, esi
push edi
call fcn.0045f750
push esi
push dword [0x567760]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x55ae20]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
mov dword [eax + 0xa8], esi
mov ecx, dword [esp + 0x28]
xor ecx, ebp
call fcn.004a927c
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor ecx, ecx
jmp 0x41ac8f
mov ecx, esi
call fcn.0045f3b0
jmp 0x41ac45
lea eax, [esp + 0xf]
mov ecx, edi
push eax
push 0x4000
push dword [esp + 8]
push 2
mov edi, dword [ebp + 8]
push edi
call fcn.0045d930
test eax, eax
je 0x41ad7a
mov esi, eax
and eax, 0xffe00000
mov ecx, esi
shr ecx, 9
and ecx, 0x1fe0
or ecx, eax
mov eax, ecx
or eax, 0x1000
or ecx, 0x101e
movzx ecx, byte [ecx]
and ecx, 0x3f
shl ecx, 5
sub eax, ecx
jmp 0x41acab
xor esi, esi
jmp 0x41acce
int3
int3
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x10]
movdqa xmmword [edi], xmm0
mov ecx, edi
push 0
push dword [esi]
push str.first
call fcn.004d6aa0
push edi
call fcn.00410a20
add esp, 4
push ebx
call fcn.004d6b20
int3