joyce8/EMBER2024-capa huggingface dataset:
Function at 0x480f20
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59686d
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x5f88c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x28]
call fcn.004031c0
mov dword [ebp - 4], 0
push 0
push 2
lea ecx, [ebp - 0x28]
call fcn.00403370
xor ecx, ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], ecx
mov word [ebp - 0x34], cx
mov edx, 0x50
mov word [ebp - 0x40], dx
push 0
lea ecx, [ebp - 0x28]
call fcn.004030d0
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x4c], 3
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
jne 0x480fbd
mov dword [ebp - 0x30], 1
jmp 0x480fc4
mov dword [ebp - 0x30], 0
mov cl, byte [ebp - 0x30]
mov byte [ebp - 0x29], cl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00403120
movzx eax, byte [ebp - 0x29]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0054b289
mov esp, ebp
pop ebp
ret
Function at 0x481430
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
cmp dword [ebp + 8], 0
jne 0x481440
xor eax, eax
jmp 0x4814ba
push 0x44
push 0
lea eax, [ebp - 0x54]
push eax
call fcn.0054d9f0
add esp, 0xc
mov dword [ebp - 0x54], 0x44
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ecx
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x48148f
xor eax, eax
jmp 0x4814ba
cmp dword [ebp + 0x10], 0
je 0x4814a1
push 0xffffffffffffffff
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x4814c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
cmp dword [ebp + 8], 0
jne 0x4814dc
mov eax, dword [ebp + 0x10]
mov dword [eax], 0xffffffff
xor eax, eax
jmp 0x48155f
push 0x44
push 0
lea ecx, [ebp - 0x54]
push ecx
call fcn.0054d9f0
add esp, 0xc
mov dword [ebp - 0x54], 0x44
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x54]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x481534
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
xor eax, eax
jmp 0x48155f
cmp dword [ebp + 0xc], 0
je 0x481546
push 0xffffffffffffffff
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4816e0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x440
mov eax, dword [0x5f88c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x438], 0x22c
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x43c], eax
cmp dword [ebp - 0x43c], 0xffffffff
jne 0x48173a
push 0x46f8e0
push str.Error_creating_process_snapshot.
push 0x604370
call fcn.0046e8d0
add esp, 8
mov ecx, eax
call fcn.004700d0
xor al, al
jmp 0x4817f4
lea eax, [ebp - 0x438]
push eax
mov ecx, dword [ebp - 0x43c]
push ecx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4817e5
push 0x104
lea edx, [ebp - 0x20c]
push edx
mov eax, dword [ebp - 0x430]
push eax
call fcn.00481000
add esp, 0xc
movzx ecx, al
test ecx, ecx
je 0x4817ca
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x20c]
push eax
call fcn.00567994
add esp, 8
test eax, eax
jne 0x4817ca
mov ecx, dword [ebp - 0x430]
push ecx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x440], eax
cmp dword [ebp - 0x440], 0
je 0x4817ca
push 0
mov edx, dword [ebp - 0x440]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0x440]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x438]
push ecx
mov edx, dword [ebp - 0x43c]
push edx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x481755
mov eax, dword [ebp - 0x43c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054b289
mov esp, ebp
pop ebp
ret
Function at 0x48dd70
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
push str.SOFTWAREjiebangbang
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov dword [ebp - 8], eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstalljiebangbang
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 8], 0
jne 0x48ddb4
cmp dword [ebp - 0xc], 0
jne 0x48ddb4
mov dword [ebp - 4], 1
jmp 0x48ddbb
mov dword [ebp - 4], 0
movzx eax, byte [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x48ddd0
Capabilities:
Create process on windows
Self delete
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5978ad
mov eax, dword fs:[0]
push eax
sub esp, 0x90
mov eax, dword [0x5f88c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x58], ecx
push 0x44
push 0
lea eax, [ebp - 0x9c]
push eax
call fcn.0054d9f0
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x9c], 0x44
mov dword [ebp - 0x70], 1
xor edx, edx
mov word [ebp - 0x6c], dx
lea eax, [ebp - 0x28]
push eax
call fcn.004029a0
add esp, 4
mov dword [ebp - 4], 0
push str.del.bat
lea ecx, [ebp - 0x28]
call fcn.00415320
lea ecx, [ebp - 0x28]
call fcn.00403230
push eax
push str.cmd__c_call___s_
lea ecx, [ebp - 0x40]
push ecx
call fcn.004037f0
add esp, 0xc
lea edx, [ebp - 0x54]
push edx
lea eax, [ebp - 0x9c]
push eax
push 0
push 0
push 0x10
push 0
push 0
push 0
lea ecx, [ebp - 0x40]
call fcn.00403230
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
je 0x48debd
mov ecx, dword [ebp - 0x54]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x50]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [ebp - 0x40]
call fcn.00403120
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00403120
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0054b289
mov esp, ebp
pop ebp
ret
Function at 0x48df30
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5968ed
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5f88c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], ecx
push 0
lea eax, [ebp - 0x28]
push eax
call fcn.00479010
add esp, 8
mov dword [ebp - 4], 0
push 0x5a7820
lea ecx, [ebp - 0x28]
call fcn.00415320
push 0x5a7824
lea ecx, [ebp - 0x28]
call fcn.00415320
lea ecx, [ebp - 0x28]
call fcn.00403230
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x48dfa3
mov byte [ebp - 0x29], 1
jmp 0x48dfa7
mov byte [ebp - 0x29], 0
mov cl, byte [ebp - 0x29]
mov byte [ebp - 0x2a], cl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00403120
movzx eax, byte [ebp - 0x2a]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0054b289
mov esp, ebp
pop ebp
ret

Function at 0x48dfe0
Capabilities:
Delete file
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x5f88c0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov dword [ebp - 0x21c], ecx
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.0054d9f0
add esp, 0xc
push 0
push 7
lea ecx, [ebp - 0x20c]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edx, [ebp - 0x20c]
add edx, 0xfffffffe
mov dword [ebp - 0x214], edx
mov eax, dword [ebp - 0x214]
mov cx, word [eax + 2]
mov word [ebp - 0x216], cx
add dword [ebp - 0x214], 2
cmp word [ebp - 0x216], 0
jne 0x48e032
mov edi, dword [ebp - 0x214]
mov edx, dword [str.b...]
mov dword [edi], edx
mov eax, dword [0x5a7918]
mov dword [edi + 4], eax
mov ecx, dword [0x5a791c]
mov dword [edi + 8], ecx
mov edx, dword [0x5a7920]
mov dword [edi + 0xc], edx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x48e096
mov byte [ebp - 0x20d], 1
jmp 0x48e09d
mov byte [ebp - 0x20d], 0
movzx eax, byte [ebp - 0x20d]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054b289
mov esp, ebp
pop ebp
ret
Function at 0x4ac5f0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x4ac69f
push esi
call fcn.004bad20
add esp, 4
test al, al
jne 0x4ac69f
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x4ac617
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.004bc2f0
add esp, 0xc
test eax, eax
je 0x4ac64b
sub eax, esi
push eax
push 0x2e
push esi
call fcn.004bc2f0
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x4ac64d
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
lea ebx, [esi + edi]
mov edi, 0x1505
cmp esi, ebx
jae 0x4ac67e
nop dword [eax]
mov al, byte [esi]
push eax
call fcn.004aa680
movsx ecx, al
inc esi
mov eax, edi
add esp, 4
shl eax, 5
add eax, edi
xor ecx, eax
mov edi, ecx
cmp esi, ebx
jb 0x4ac660
mov eax, 0x4104105
mov esi, edi
mul edi
sub esi, edx
shr esi, 1
add esi, edx
shr esi, 5
mov ecx, esi
shl ecx, 6
sub ecx, esi
sub edi, ecx
mov eax, edi
pop edi
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x4bad20
Capabilities:
Convert ip address from string

Disassembly:
sub esp, 0x18
mov eax, dword [0x5f88c0]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
mov esi, dword [esp + 0x20]
lea eax, [esp + 4]
push eax
push esi
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jg 0x4bad68
lea eax, [esp + 8]
push eax
push esi
push 0x17
call dword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
pop esi
setg al
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0054b289
add esp, 0x18
ret
mov ecx, dword [esp + 0x18]
mov al, 1
pop esi
xor ecx, esp
call fcn.0054b289
add esp, 0x18
ret

Function at 0x4baed0
Capabilities:
Create udp socket

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x4baf0e
mov eax, dword [esi + 0x7c]
cmp byte [eax + 0x104], 0
jne 0x4baeff
push 0
call fcn.004baed0
add esp, 4
test al, al
mov eax, dword [esi + 0x7c]
setne cl
inc cl
mov byte [eax + 0x104], cl
mov eax, dword [esi + 0x7c]
pop esi
cmp byte [eax + 0x104], 2
sete al
ret
push 0
push 2
push 0x17
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
jne 0x4baf23
xor al, al
pop esi
ret
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov al, 1
pop esi
ret
Function at 0x4bbc70
Capabilities:
Convert ip address from string
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x6c
mov eax, dword [0x5f88c0]
xor eax, esp
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x70]
push ebp
mov ebp, dword [esp + 0x78]
push edi
xor edi, edi
mov dword [esp + 8], eax
cmp byte [eax + 0x6cb], 0
je 0x4bbe49
cmp byte [ebp + 0x18], 0
push ebx
lea ebx, [ebp + 0x18]
je 0x4bbe48
push esi
mov esi, dword [sym.imp.WS2_32.dll_inet_pton]
lea eax, [esp + 0x34]
push eax
push ebx
push 2
call esi
test eax, eax
jg 0x4bbe47
lea eax, [esp + 0x38]
push eax
push ebx
push 0x17
call esi
test eax, eax
jg 0x4bbe47
push dword [ebp + 0x14]
cmp byte [ebx], 0
mov eax, str._none_
mov esi, dword [ebp]
mov ebp, dword [esp + 0x14]
cmovne eax, ebx
push eax
push str.Host__s:_d_was_resolved.
push ebp
call fcn.004bc050
lea eax, [esp + 0x24]
push 0x400
push eax
call fcn.004bcec0
lea eax, [esp + 0x3c]
push 0x400
push eax
call fcn.004bcec0
add esp, 0x20
test esi, esi
je 0x4bbdbb
lea edx, [edi + 0x10]
mov ecx, dword [esi + 4]
cmp ecx, 0x17
je 0x4bbd32
cmp ecx, 2
jne 0x4bbdb0
xor eax, eax
mov byte [esp + 0x48], 0
cmp ecx, 2
lea ebx, [esp + 0x14]
cmovne eax, edx
add ebx, eax
sub ecx, 2
je 0x4bbd61
sub ecx, 0x15
jne 0x4bbd76
push 0x2e
lea eax, [esp + 0x4c]
push eax
mov eax, dword [esi + 0x18]
add eax, 8
push eax
push 0x17
jmp 0x4bbd71
push 0x2e
lea eax, [esp + 0x4c]
push eax
mov eax, dword [esi + 0x18]
add eax, 4
push eax
push 2
call sub.WS2_32.dll_inet_ntop
push ebx
call fcn.004bcee0
add esp, 4
test eax, eax
je 0x4bbd95
push 2
push 0x5b0f00
push ebx
call fcn.004bce80
add esp, 0xc
mov edi, eax
test edi, edi
jne 0x4bbddb
lea eax, [esp + 0x48]
push eax
push ebx
call fcn.004bce30
mov edi, eax
add esp, 8
test edi, edi
jne 0x4bbddb
lea edx, [eax + 0x10]
mov esi, dword [esi + 0x1c]
test esi, esi
jne 0x4bbd21
lea eax, [esp + 0x24]
push eax
call fcn.004bcee0
add esp, 4
test eax, eax
je 0x4bbdeb
lea eax, [esp + 0x24]
push eax
call fcn.004bcef0
add esp, 4
jmp 0x4bbdf0
push str.too_many_IP__cant_show
push ebp
call fcn.004bc050
add esp, 8
jmp 0x4bbe30
mov eax, str._none_
push eax
push str.IPv6:__s
push ebp
call fcn.004bc050
lea eax, [esp + 0x20]
push eax
call fcn.004bcee0
add esp, 0x10
test eax, eax
je 0x4bbe1c
lea eax, [esp + 0x14]
push eax
call fcn.004bcef0
add esp, 4
jmp 0x4bbe21
mov eax, str._none_
push eax
push str.IPv4:__s
push ebp
call fcn.004bc050
add esp, 0xc
lea eax, [esp + 0x14]
push eax
call fcn.004bce90
lea eax, [esp + 0x28]
push eax
call fcn.004bce90
add esp, 8
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
pop edi
pop ebp
xor ecx, esp
call fcn.0054b289
add esp, 0x6c
ret
Function at 0x4bca50
Capabilities:
Move file

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
call fcn.004d8e70
push dword [esp + 0x38]
movups xmm0, xmmword [eax]
movups xmmword [esp + 0x18], xmm0
call fcn.004b8090
push dword [esp + 0x40]
mov edi, eax
call fcn.004b8090
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExW]
add esp, 0xc
mov esi, eax
push 1
push esi
push edi
call ebx
test eax, eax
jne 0x4bcae5
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
nop dword [eax + eax]
lea eax, [esp + 0x20]
push eax
call fcn.004d8e70
movups xmm0, xmmword [esp + 0x14]
sub esp, 0xc
mov ecx, esp
sub esp, 0x10
movups xmmword [ecx], xmm0
mov ecx, esp
movups xmm0, xmmword [eax]
movups xmmword [ecx], xmm0
call fcn.004d8f20
add esp, 0x20
test edx, edx
ja 0x4bcb09
jb 0x4bcad7
cmp eax, 0x3e8
ja 0x4bcb09
push 1
call ebp
push 1
push esi
push edi
call ebx
test eax, eax
je 0x4bcaa0
test edi, edi
je 0x4bcaf2
push edi
call fcn.0055fc02
add esp, 4
test esi, esi
je 0x4bcaff
push esi
call fcn.0055fc02
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
test edi, edi
je 0x4bcb16
push edi
call fcn.0055fc02
add esp, 4
test esi, esi
je 0x4bcb23
push esi
call fcn.0055fc02
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x20
ret

Function at 0x4bd080
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov ecx, 0x2b
test edi, edi
je 0x4bd130
mov ebp, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
nop dword [eax]
mov ebx, 4
lea eax, [esp + 0x1c]
push 4
push eax
cmp edi, ebx
push ebp
cmovb ebx, edi
call fcn.004b5b90
add esp, 0xc
cmp eax, 4
je 0x4bd0c3
mov ecx, eax
jmp 0x4bd0ed
cmp byte [0x603bec], 0
jne 0x4bd0f7
push 2
push 4
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0
push eax
push 0
call sub.bcrypt.dll_BCryptGenRandom
neg eax
sbb ecx, ecx
and ecx, 2
mov eax, ecx
test eax, eax
jne 0x4bd132
mov eax, dword [esp + 0x1c]
jmp 0x4bd114
imul eax, dword [0x603be8], 0x41c64e6d
add eax, 0x3039
mov dword [0x603be8], eax
ror eax, 0x10
xor ecx, ecx
mov dword [esp + 0x1c], eax
test ebx, ebx
je 0x4bd128
mov byte [esi], al
dec edi
inc esi
shr eax, 8
sub ebx, 1
jne 0x4bd118
mov dword [esp + 0x1c], eax
test edi, edi
jne 0x4bd0a0
mov eax, ecx
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4bd140
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
sub ebx, 1
je 0x4bd1bb
mov esi, dword [esp + 0x14]
mov ebp, 0x3e
nop word [eax + eax]
push 4
lea eax, [esp + 0x20]
push eax
push esi
call fcn.004b5b90
add esp, 0xc
cmp eax, 4
jne 0x4bd19c
cmp byte [0x603bec], 0
jne 0x4bd1c5
push 2
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0
push eax
push 0
call sub.bcrypt.dll_BCryptGenRandom
neg eax
sbb eax, eax
and eax, 2
test eax, eax
jne 0x4bd1c0
mov eax, dword [esp + 0x1c]
cmp eax, 0xfffffffc
jae 0x4bd160
xor edx, edx
div ebp
mov al, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789]
mov byte [edi], al
inc edi
sub ebx, 1
jne 0x4bd160
mov byte [edi], 0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
imul eax, dword [0x603be8], 0x41c64e6d
add eax, 0x3039
mov dword [0x603be8], eax
ror eax, 0x10
mov dword [esp + 0x1c], eax
jmp 0x4bd1a4

Function at 0x4bd1f0
Capabilities:
Generate random numbers via winapi

Disassembly:
push dword [esp + 8]
push 0
push dword [esp + 0xc]
call fcn.0054d9f0
add esp, 0xc
push 2
push dword [esp + 0xc]
push dword [esp + 0xc]
push 0
call sub.bcrypt.dll_BCryptGenRandom
neg eax
sbb eax, eax
and eax, 2
ret

Function at 0x4be330
Capabilities:
Send data
Send data on socket

Disassembly:
mov ecx, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
push 0
mov byte [esp + 0x12], cl
lea ecx, [esp + 0x10]
push 3
mov eax, dword [esi + 0x18]
push ecx
mov byte [esp + 0x18], 0xff
mov byte [esp + 0x19], bl
push dword [eax + 0x140]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x4be37c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push esi
call fcn.004bbf80
add esp, 0xc
push dword [esp + 0x14]
push ebx
push str.SENT
push esi
call fcn.004bdf50
add esp, 0x10
pop esi
pop ebx
ret
Function at 0x4be4c0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0xc
cmp dword [esp + 0x14], 0x1f
push ebx
mov ebx, dword [esp + 0x14]
mov ecx, dword [ebx + 0x11c]
mov eax, dword [ebx + 0x18]
mov dword [esp + 0x14], ecx
mov dword [esp + 4], eax
jne 0x4be62c
push ebp
push esi
lea ebp, [ecx + 0x1cb4]
push edi
lea edi, [ecx + 0x1eb4]
mov eax, ebp
mov dword [edi], ebp
cmp ebp, edi
jae 0x4be504
lea eax, [ebp + 1]
mov byte [ebp], 0xff
mov dword [edi], eax
cmp eax, edi
jae 0x4be518
mov byte [eax], 0xfa
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x4be518
mov byte [eax], 0x1f
inc dword [edi]
movzx eax, word [ecx + 0x1ca8]
mov esi, dword [sym.imp.WS2_32.dll_htons]
push eax
call esi
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x24], eax
shr eax, 8
mov dword [esp + 0x14], eax
movzx ecx, word [ecx + 0x1caa]
push ecx
call esi
mov ecx, dword [edi]
mov edx, eax
shr edx, 8
mov dword [esp + 0x18], eax
cmp ecx, edi
jae 0x4be595
mov eax, dword [esp + 0x24]
mov byte [ecx], al
inc dword [edi]
mov ecx, dword [edi]
cmp ecx, edi
jae 0x4be595
mov eax, dword [esp + 0x14]
mov byte [ecx], al
inc dword [edi]
mov ecx, dword [edi]
cmp ecx, edi
jae 0x4be595
mov eax, dword [esp + 0x18]
mov byte [ecx], al
inc dword [edi]
mov ecx, dword [edi]
cmp ecx, edi
jae 0x4be595
mov byte [ecx], dl
inc dword [edi]
mov ecx, dword [edi]
cmp ecx, edi
jae 0x4be595
mov byte [ecx], 0xff
inc dword [edi]
mov ecx, dword [edi]
cmp ecx, edi
jae 0x4be595
mov byte [ecx], 0xf0
mov ecx, dword [edi]
inc ecx
mov esi, dword [esp + 0x20]
mov dword [edi], ebp
mov dword [esi + 0x1eb8], ecx
lea eax, [esi + 0x1cb6]
sub ecx, ebp
sub ecx, 2
push ecx
push eax
push 0x3e
push ebx
call fcn.004be050
mov eax, dword [esp + 0x20]
add esp, 0x10
push 0
push 3
push ebp
push dword [eax + 0x140]
mov ebp, dword [sym.imp.WS2_32.dll_send]
call ebp
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jns 0x4be5eb
call edi
push eax
push str.Sending_data_failed___d_
push ebx
call fcn.004bbf80
add esp, 0xc
push 4
lea eax, [esi + 0x1cb7]
push eax
push ebx
call fcn.004be3a0
add esp, 0xc
lea eax, [esi + 0x1cbb]
push 0
push 2
push eax
mov eax, dword [esp + 0x1c]
push dword [eax + 0x140]
call ebp
test eax, eax
jns 0x4be629
call edi
push eax
push str.Sending_data_failed___d_
push ebx
call fcn.004bbf80
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x4be640
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x80c
mov eax, dword [0x5f88c0]
xor eax, esp
mov dword [esp + 0x808], eax
push ebx
mov ebx, dword [esp + 0x814]
push ebp
push esi
mov dword [esp + 0xc], ebx
mov esi, dword [ebx + 0x11c]
mov ebp, dword [ebx + 0x18]
mov dword [esp + 0x10], ebp
mov eax, dword [esi + 0x1eb8]
sub eax, dword [esi + 0x1eb4]
add eax, 2
push eax
lea eax, [esi + 0x1cb4]
push eax
push 0x3c
push ebx
call fcn.004be050
mov eax, dword [esi + 0x1eb4]
add esp, 0x10
mov cl, byte [eax]
inc eax
mov dword [esi + 0x1eb4], eax
cmp cl, 0x18
je 0x4be818
cmp cl, 0x23
je 0x4be7f5
cmp cl, 0x27
jne 0x4be8a0
push edi
push 0
push 0x27
push 0xfa
push 0xff
push str._c_c_c_c
lea eax, [esp + 0x2c]
push 0x800
push eax
call fcn.004b96d0
mov esi, dword [esi + 0x1cb0]
add esp, 0x1c
mov edi, 4
test esi, esi
je 0x4be775
mov edx, dword [esi]
mov ecx, edx
lea ebx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4be700
sub ecx, ebx
lea eax, [ecx + 1]
add eax, edi
cmp eax, 0x7fa
jae 0x4be766
push 0x2c
push edx
call fcn.0054f8b0
mov ebx, 0x800
lea ebp, [esp + 0x20]
mov edx, eax
add esp, 8
sub ebx, edi
add ebp, edi
test edx, edx
jne 0x4be747
push dword [esi]
push eax
push str._c_s
push ebx
push ebp
call fcn.004b96d0
add esp, 0x14
jmp 0x4be764
mov ecx, dword [esi]
lea eax, [edx + 1]
push eax
push 1
push ecx
sub edx, ecx
push edx
push 0
push str._c_.s_c_s
push ebx
push ebp
call fcn.004b96d0
add esp, 0x20
add edi, eax
mov esi, dword [esi + 4]
test esi, esi
jne 0x4be6f4
mov ebx, dword [esp + 0x10]
mov ebp, dword [esp + 0x14]
push 0xf0
push 0xff
mov eax, 0x800
sub eax, edi
push str._c_c
push eax
lea eax, [esp + 0x28]
add eax, edi
push eax
call fcn.004b96d0
add esp, 0x14
lea eax, [edi + 2]
push 0
push eax
lea eax, [esp + 0x20]
push eax
push dword [ebp + 0x140]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x4be7cb
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push ebx
call fcn.004bbf80
add esp, 0xc
push edi
lea eax, [esp + 0x1e]
push eax
push 0x3e
push ebx
call fcn.004be050
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x808]
xor ecx, esp
call fcn.0054b289
add esp, 0x80c
ret
lea edx, [esi + 0x1c28]
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4be800
push 0xf0
push 0xff
push edx
push 0
push 0x23
jmp 0x4be839
lea edx, [esi + 0x1c08]
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4be823
push 0xf0
push 0xff
push edx
push 0
push 0x18
push 0xfa
push 0xff
push str._c_c_c_c_s_c_c
sub ecx, esi
lea eax, [esp + 0x34]
push 0x800
push eax
lea esi, [ecx + 6]
call fcn.004b96d0
add esp, 0x28
lea eax, [esp + 0x14]
push 0
push esi
push eax
push dword [ebp + 0x140]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x4be88c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push ebx
call fcn.004bbf80
add esp, 0xc
lea eax, [esi - 2]
push eax
lea eax, [esp + 0x1a]
push eax
push 0x3e
push ebx
call fcn.004be050
add esp, 0x10
mov ecx, dword [esp + 0x814]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0054b289
add esp, 0x80c
ret